@seams/wallet-server 0.6.1 → 0.7.1

package/dist/types/wallet-server/src/core/deviceLinking/linkedDeviceEmailOtpGrant.d.ts

@@ -20,7 +20,7 @@ export declare function computeLinkedDeviceEmailOtpChallengeBindingDigestV1(inpu
     readonly baseWalletAuthMethodId?: WalletAuthMethodId;
     readonly walletAuthMethodId: WalletAuthMethodId;
 }): Promise<DigestB64u>;
-export type LinkedDeviceEmailOtpGrantStateV1 = {
+type LinkedDeviceEmailOtpGrantStateV1 = {
     readonly kind: 'issued';
     readonly consumedAtMs?: never;
 } | {
@@ -84,4 +84,5 @@ export declare function computeLinkedDeviceEmailOtpAuthorityDigestV1(input: {
  * Deterministic, so replays reproduce byte-identical descriptor requests.
  */
 export declare function linkedDeviceEmailOtpDescriptorCredentialIdV1(walletAuthMethodId: WalletAuthMethodId): Promise<WebAuthnCredentialIdB64u>;
+export {};
 //# sourceMappingURL=linkedDeviceEmailOtpGrant.d.ts.map

package/dist/types/wallet-server/src/core/deviceLinking/linkedDeviceManagement.d.ts

@@ -1,14 +1,14 @@
 import type { LinkedDeviceListRequestV1, LinkedDeviceListResultV1, LinkedDeviceRevokeRequestV1, LinkedDeviceRevokeResultV1 } from '../../../../shared-ts/src/device-linking/contracts';
-import { type DelegatedWalletAuthorityV1 } from '../../../../shared-ts/src/authorization/delegatedAuthority';
 import type { ActiveWalletAuthorityV1, WalletAuthorityV1 } from '../../../../shared-ts/src/authorization/walletAuthority';
 import type { AuthorizationService } from '../../authorization/service';
+import type { D1PreparedStatementLike } from '../../storage/tenantRoute';
 import type { OrdinaryInactiveSignerMaterialDeactivationPortV1 } from '../signingMaterial/ordinaryInactiveSignerMaterialReservation';
 import { type WalletAuthorityId, type WalletAuthMethodId, type WalletId } from '../../../../shared-ts/src/utils/domainIds';
 import type { TenantId, WalletSessionAuthorizationId, WalletSessionId } from '../../../../shared-ts/src/authorization/capabilityKinds';
-import type { WalletAuthMethodRecordV2 } from '../../../../shared-ts/src/utils/registrationIntent';
+import type { RevokedWalletAuthMethodRecordV2, WalletAuthMethodRecordV2 } from '../../../../shared-ts/src/utils/walletAuthMethodRecord';
 import type { WebAuthnAuthenticatorDeviceInfo } from '../../../../shared-ts/src/utils/webauthnDeviceInfo';
 export declare const MAX_LINKED_DEVICE_LIST_LIMIT_V1 = 50;
-export type LinkedDeviceManagementListCursorV1 = {
+type LinkedDeviceManagementListCursorV1 = {
     readonly kind: 'wallet_authority_v1';
     readonly updatedAtMs: number;
     readonly authorityId: WalletAuthorityId;
@@ -24,26 +24,31 @@ export type LinkedDeviceManagementSourceV1 = {
     readonly expiresAtMs: number;
 };
 /** A fresh factor proof is produced by the request boundary after verification. */
-export type LinkedDeviceManagementFreshProofV1 = {
+type LinkedDeviceManagementFreshProofV1 = {
     readonly walletAuthMethodId: WalletAuthMethodId;
     readonly verifiedAtMs: number;
 };
-export type LinkedDeviceManagementRevocationSourceV1 = LinkedDeviceManagementSourceV1 & {
+type LinkedDeviceManagementRevocationSourceV1 = LinkedDeviceManagementSourceV1 & {
     readonly freshProof: LinkedDeviceManagementFreshProofV1;
 };
-export type LinkedDeviceManagementSourceResolutionV1 = {
-    readonly session: LinkedDeviceManagementOwnerSessionV1;
-    readonly authority: ActiveWalletAuthorityV1;
-    readonly authMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly status: 'active';
-    }>;
-    readonly permission: DelegatedWalletAuthorityV1;
+/**
+ * What the request boundary commits with one revocation: the statements its
+ * fresh proof owes (the approving method's guard, an Email OTP code's spend)
+ * and the record of the answer, for an exact retry. The authority port runs
+ * them in the revocation's own batch, so they commit together or not at all.
+ */
+type LinkedDeviceRevocationCommitV1 = {
+    readonly prerequisites: readonly D1PreparedStatementLike[];
+    /** Run after the revocation's writes, which the record reads. */
+    readonly recordAnswer: (target: {
+        readonly authorityId: WalletAuthorityId;
+    }) => readonly D1PreparedStatementLike[];
 };
 export type LinkedDeviceManagementAuthorityPageV1 = {
     readonly records: readonly ActiveWalletAuthorityV1[];
     readonly nextCursor: LinkedDeviceManagementListCursorV1 | null;
 };
-export type LinkedDeviceManagementAuthorityPortV1 = {
+type LinkedDeviceManagementAuthorityPortV1 = {
     listActiveForWalletV1(input: {
         readonly walletId: WalletId;
         readonly limit: number;
@@ -56,11 +61,14 @@ export type LinkedDeviceManagementAuthorityPortV1 = {
         readonly walletAuthMethodId: WalletAuthMethodId;
         readonly expectedAuthorityRevocationEpoch: number;
         readonly requestedAtMs: number;
+        /** Committed in the revocation's batch: before its writes, and after. */
+        readonly commit?: {
+            readonly statements: readonly D1PreparedStatementLike[];
+            readonly trailingStatements: readonly D1PreparedStatementLike[];
+        };
     }): Promise<{
         readonly kind: 'revoked_method';
-        readonly authMethod: Extract<WalletAuthMethodRecordV2, {
-            readonly status: 'revoked';
-        }>;
+        readonly authMethod: RevokedWalletAuthMethodRecordV2;
         readonly authority: WalletAuthorityV1;
     } | {
         readonly kind: 'would_remove_last_wallet_auth_method';
@@ -68,7 +76,7 @@ export type LinkedDeviceManagementAuthorityPortV1 = {
         readonly kind: 'conflict';
     }>;
 };
-export type LinkedDeviceManagementAuthMethodPortV1 = {
+type LinkedDeviceManagementAuthMethodPortV1 = {
     listForAuthorityV1(input: {
         readonly walletId: WalletId;
         readonly authorityId: WalletAuthorityId;
@@ -77,7 +85,7 @@ export type LinkedDeviceManagementAuthMethodPortV1 = {
         readonly walletAuthMethodId: WalletAuthMethodId;
     }): Promise<WalletAuthMethodRecordV2 | null>;
 };
-export type LinkedDeviceManagementOwnerSessionV1 = {
+type LinkedDeviceManagementOwnerSessionV1 = {
     readonly walletId: WalletId;
     readonly walletSessionId: WalletSessionId;
     readonly authorizationId: WalletSessionAuthorizationId;
@@ -85,7 +93,7 @@ export type LinkedDeviceManagementOwnerSessionV1 = {
     readonly authorityDigestB64u: import('../../../../shared-ts/src/utils/canonicalPrimitives').DigestB64u;
     readonly expiresAtMs: number;
 };
-export type LinkedDeviceManagementAuthenticatorPortV1 = {
+type LinkedDeviceManagementAuthenticatorPortV1 = {
     readActiveOwnerWalletSessionV1(input: {
         readonly tenantId: TenantId;
         readonly walletId: WalletId;
@@ -94,8 +102,8 @@ export type LinkedDeviceManagementAuthenticatorPortV1 = {
         readonly nowMs: number;
     }): Promise<LinkedDeviceManagementOwnerSessionV1 | null>;
 };
-export type LinkedDeviceManagementSessionRetirementPortV1 = Pick<AuthorizationService, 'retireWalletSessionAuthorizationsForAuthMethod'>;
-export type LinkedDeviceManagementCredentialMetadataPortV1 = {
+type LinkedDeviceManagementSessionRetirementPortV1 = Pick<AuthorizationService, 'retireWalletSessionAuthorizationsForAuthMethod'>;
+type LinkedDeviceManagementCredentialMetadataPortV1 = {
     readPasskeyDeviceInfoV1(input: {
         readonly walletId: WalletId;
         readonly credentialIdB64u: string;
@@ -110,7 +118,7 @@ export type LinkedDeviceManagementCredentialMetadataPortV1 = {
         readonly walletId: WalletId;
     }): Promise<string | null>;
 };
-export type LinkedDeviceManagementServiceOptionsV1 = {
+type LinkedDeviceManagementServiceOptionsV1 = {
     readonly tenantId: TenantId;
     readonly authenticator: LinkedDeviceManagementAuthenticatorPortV1;
     readonly authority: LinkedDeviceManagementAuthorityPortV1;
@@ -119,19 +127,29 @@ export type LinkedDeviceManagementServiceOptionsV1 = {
     readonly credentials: LinkedDeviceManagementCredentialMetadataPortV1;
     readonly materialDeactivation?: OrdinaryInactiveSignerMaterialDeactivationPortV1;
 };
-export type LinkedDeviceManagementServiceResultV1 = LinkedDeviceListResultV1 | {
+type LinkedDeviceManagementServiceResultV1 = LinkedDeviceListResultV1 | {
     readonly kind: 'unauthorized';
 };
 export declare class LinkedDeviceManagementServiceV1 {
     private readonly options;
     constructor(options: LinkedDeviceManagementServiceOptionsV1);
     listLinkedDevicesV1(request: LinkedDeviceListRequestV1, source: LinkedDeviceManagementSourceV1, requestedAtMs: number): Promise<LinkedDeviceManagementServiceResultV1>;
-    revokeLinkedDeviceV1(request: LinkedDeviceRevokeRequestV1, source: LinkedDeviceManagementRevocationSourceV1): Promise<LinkedDeviceRevokeResultV1>;
+    revokeLinkedDeviceV1(request: LinkedDeviceRevokeRequestV1, source: LinkedDeviceManagementRevocationSourceV1, commit?: LinkedDeviceRevocationCommitV1): Promise<LinkedDeviceRevokeResultV1>;
+    /**
+     * Finishes, again, what follows a committed revocation: the method's
+     * sessions retired and a revoked authority's signer material deactivated.
+     * Both are idempotent, so an exact retry answered from the record completes
+     * whatever its first attempt left undone.
+     */
+    finishLinkedDeviceRevocationV1(input: {
+        readonly walletId: WalletId;
+        readonly walletAuthMethodId: WalletAuthMethodId;
+        readonly requestedAtMs: number;
+    }): Promise<void>;
     private resolveSourceV1;
     private deactivateSignerMaterialV1;
     private buildLinkedDeviceSummaryV1;
     private buildOwnerDeviceSummaryV1;
 }
-export declare function encodeLinkedDeviceListCursorV1(cursor: LinkedDeviceManagementListCursorV1): string;
-export declare function decodeLinkedDeviceListCursorV1(raw: string | null): LinkedDeviceManagementListCursorV1 | null;
+export {};
 //# sourceMappingURL=linkedDeviceManagement.d.ts.map

package/dist/types/wallet-server/src/core/deviceLinking/linkedDeviceSession.d.ts

@@ -1,10 +1,11 @@
-import { type DelegatedWalletAuthorityV1 } from '../../../../shared-ts/src/authorization/delegatedAuthority';
-import type { LinkPrecommitFailureV1, LinkSessionStateV1, LinkedDeviceApprovalV1, LinkedDeviceSessionClaimV1, LinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1, LinkedDeviceApprovedTargetFactorV1, QrLinkedDeviceSessionPayloadV5 } from '../../../../shared-ts/src/device-linking/contracts';
-import { type DigestB64u } from '../../../../shared-ts/src/utils/canonicalPrimitives';
+import type { DelegatedWalletAuthorityV1 } from '../../../../shared-ts/src/authorization/delegatedAuthority';
+import type { LinkPrecommitFailureV1, LinkedDeviceApprovalV1, LinkedDeviceSessionClaimV1, LinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1, QrLinkedDeviceSessionPayloadV5 } from '../../../../shared-ts/src/device-linking/contracts';
+import type { DigestB64u } from '../../../../shared-ts/src/utils/canonicalPrimitives';
 import { type WalletAuthorityId, type WalletId } from '../../../../shared-ts/src/utils/domainIds';
 import type { WalletSessionAuthorizationId, WalletSessionId } from '../../../../shared-ts/src/authorization/capabilityKinds';
 import { type LinkedDeviceEnrollmentId, type LinkedDeviceId, type LinkDeviceSessionId } from '../../../../shared-ts/src/signing-lanes/ids';
-import { type ExactAdministeredSignerV1, type ExactAdministeredSignerManifestV1 } from '../../../../shared-ts/src/device-linking/delegatedActivationPlan';
+import type { ExactAdministeredSignerManifestV1 } from '../../../../shared-ts/src/device-linking/delegatedActivationPlan';
+import { type LinkedDeviceSessionMutationResultV1, type LinkedDeviceSessionRecordV1, type LinkedDeviceSourceKeyManifestDigestsV1 } from './linkedDeviceSessionRecord';
 type LinkedDeviceClaimV1 = LinkedDeviceSessionClaimV1;
 export type { LinkSessionStateV1, QrLinkedDeviceSessionPayloadV5, } from '../../../../shared-ts/src/device-linking/contracts';
 export type LinkedDeviceSessionListCursorV1 = {
@@ -15,162 +16,13 @@ export type LinkedDeviceSessionListPageV1 = {
     readonly records: readonly LinkedDeviceSessionRecordV1[];
     readonly nextCursor: LinkedDeviceSessionListCursorV1 | null;
 };
-export type LinkedDeviceClaimTranscriptV1 = {
-    readonly digestB64u: DigestB64u;
-    readonly value: LinkedDeviceClaimV1;
-};
-export type LinkedDeviceSourceKeyManifestDigestsV1 = {
-    readonly ed25519: DigestB64u;
-    readonly ecdsa_secp256k1?: never;
-} | {
-    readonly ed25519?: never;
-    readonly ecdsa_secp256k1: DigestB64u;
-} | {
-    readonly ed25519: DigestB64u;
-    readonly ecdsa_secp256k1: DigestB64u;
-};
-export type LinkedDeviceApprovalTranscriptV1 = {
-    readonly digestB64u: DigestB64u;
-    readonly value: LinkedDeviceApprovalV1;
-    readonly sourceSignerManifest: ExactAdministeredSignerManifestV1;
-    readonly sourceKeyManifestDigestsB64u: LinkedDeviceSourceKeyManifestDigestsV1;
-    /** Authority digest at approval time; rotation advances it, so use must re-approve. */
-    readonly sourceAuthorityDigestB64u: DigestB64u;
-};
-export declare function sourceKeyManifestDigestForFamilyV1(digests: LinkedDeviceSourceKeyManifestDigestsV1, keyFamily: ExactAdministeredSignerV1['keyFamily']): DigestB64u | null;
-export type LinkedDeviceSourceContributionTranscriptV1 = LinkedDeviceApprovalTranscriptV1;
-type LinkedDeviceEmailOtpChallengeV1 = {
-    readonly state: 'available';
-    readonly maskedEmailHint: string;
-} | {
-    readonly state: 'sent';
-    readonly challengeId: string;
-    readonly workerEphemeralPublicKey65B64u: string;
-    readonly maskedEmailHint: string;
-    readonly expiresAtMs: number;
-    readonly resendAvailableAtMs: number;
-};
-type LinkedDeviceTargetFactorRecordV1 = {
-    readonly targetFactor: Extract<LinkedDeviceApprovedTargetFactorV1, {
-        readonly kind: 'passkey_prf';
-    }>;
-    readonly emailOtpChallenge?: never;
-} | {
-    readonly targetFactor: Extract<LinkedDeviceApprovedTargetFactorV1, {
-        readonly kind: 'email_otp';
-    }>;
-    readonly emailOtpChallenge?: LinkedDeviceEmailOtpChallengeV1;
-};
-type LinkedDeviceSessionRecordBaseV1 = {
-    readonly version: 'linked_device_session_v1';
-    readonly linkSessionId: LinkDeviceSessionId;
-    readonly qrPayload: QrLinkedDeviceSessionPayloadV5;
-    readonly revision: number;
-    readonly createdAtMs: number;
-    readonly updatedAtMs: number;
-};
-type LinkedDeviceSessionUnclaimedRecordV1 = LinkedDeviceSessionRecordBaseV1 & {
-    readonly state: Extract<LinkSessionStateV1, {
-        readonly state: 'displaying_qr';
-    }>;
-    readonly claimTranscript?: never;
-    readonly approvalTranscript?: never;
-    readonly targetFactor?: never;
-    readonly emailOtpChallenge?: never;
-    readonly authorityId?: never;
-    readonly packageSetDigestB64u?: never;
-    readonly sourceContributionPreparation?: never;
-    readonly sourceContributionTranscript?: never;
-};
-type LinkedDeviceSessionClaimedRecordV1 = LinkedDeviceSessionRecordBaseV1 & {
-    readonly state: Extract<LinkSessionStateV1, {
-        readonly state: 'claimed';
-    }>;
-    readonly claimTranscript: LinkedDeviceClaimTranscriptV1;
-    readonly approvalTranscript?: never;
-    readonly targetFactor?: never;
-    readonly emailOtpChallenge?: never;
-    readonly authorityId?: never;
-    readonly packageSetDigestB64u?: never;
-    readonly sourceContributionPreparation?: never;
-    readonly sourceContributionTranscript?: never;
-};
-type LinkedDeviceSessionApprovedRecordV1 = LinkedDeviceSessionRecordBaseV1 & LinkedDeviceTargetFactorRecordV1 & {
-    readonly state: Extract<LinkSessionStateV1, {
-        readonly state: 'awaiting_target_factor';
-    }>;
-    readonly claimTranscript: LinkedDeviceClaimTranscriptV1;
-    readonly approvalTranscript: LinkedDeviceApprovalTranscriptV1;
-    readonly authorityId?: never;
-    readonly packageSetDigestB64u?: never;
-    readonly sourceContributionPreparation?: never;
-    readonly sourceContributionTranscript?: never;
-};
-type LinkedDeviceSessionSourceContributionRecordV1 = LinkedDeviceSessionRecordBaseV1 & LinkedDeviceTargetFactorRecordV1 & {
-    readonly state: Extract<LinkSessionStateV1, {
-        readonly state: 'awaiting_source_contribution';
-    }>;
-    readonly claimTranscript: LinkedDeviceClaimTranscriptV1;
-    readonly approvalTranscript: LinkedDeviceApprovalTranscriptV1;
-    readonly sourceContributionPreparation: LinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1;
-    readonly sourceContributionTranscript?: never;
-    readonly authorityId?: never;
-    readonly packageSetDigestB64u?: never;
-};
-type LinkedDeviceSessionProvisioningRecordV1 = LinkedDeviceSessionRecordBaseV1 & LinkedDeviceTargetFactorRecordV1 & {
-    readonly state: Extract<LinkSessionStateV1, {
-        readonly state: 'provisioning';
-    }>;
-    readonly claimTranscript: LinkedDeviceClaimTranscriptV1;
-    readonly approvalTranscript: LinkedDeviceApprovalTranscriptV1;
-    readonly sourceContributionPreparation: LinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1;
-    readonly sourceContributionTranscript: LinkedDeviceSourceContributionTranscriptV1;
-    readonly authorityId?: never;
-    readonly packageSetDigestB64u?: never;
-};
-type LinkedDeviceSessionPendingRecordV1 = LinkedDeviceSessionRecordBaseV1 & LinkedDeviceTargetFactorRecordV1 & {
-    readonly state: Extract<LinkSessionStateV1, {
-        readonly state: 'authority_pending_local_install';
-    }>;
-    readonly claimTranscript: LinkedDeviceClaimTranscriptV1;
-    readonly approvalTranscript: LinkedDeviceApprovalTranscriptV1;
-    readonly sourceContributionPreparation: LinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1;
-    readonly sourceContributionTranscript: LinkedDeviceSourceContributionTranscriptV1;
-    readonly authorityId: WalletAuthorityId;
-    readonly packageSetDigestB64u: DigestB64u;
-};
-type LinkedDeviceSessionActiveRecordV1 = LinkedDeviceSessionRecordBaseV1 & LinkedDeviceTargetFactorRecordV1 & {
-    readonly state: Extract<LinkSessionStateV1, {
-        readonly state: 'active';
-    }>;
-    readonly claimTranscript: LinkedDeviceClaimTranscriptV1;
-    readonly approvalTranscript: LinkedDeviceApprovalTranscriptV1;
-    readonly sourceContributionPreparation: LinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1;
-    readonly sourceContributionTranscript: LinkedDeviceSourceContributionTranscriptV1;
-    readonly authorityId: WalletAuthorityId;
-    readonly packageSetDigestB64u: DigestB64u;
-};
-type LinkedDeviceSessionTerminalRecordV1 = LinkedDeviceSessionRecordBaseV1 & {
-    readonly state: Extract<LinkSessionStateV1, {
-        readonly state: 'failed_before_commit' | 'cancelled' | 'expired';
-    }>;
-    readonly claimTranscript?: LinkedDeviceClaimTranscriptV1;
-    readonly approvalTranscript?: LinkedDeviceApprovalTranscriptV1;
-    readonly targetFactor?: LinkedDeviceApprovedTargetFactorV1;
-    readonly emailOtpChallenge?: LinkedDeviceEmailOtpChallengeV1;
-    readonly sourceContributionPreparation?: LinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1;
-    readonly sourceContributionTranscript?: LinkedDeviceSourceContributionTranscriptV1;
-    readonly authorityId?: never;
-    readonly packageSetDigestB64u?: never;
-};
-export type LinkedDeviceSessionRecordV1 = LinkedDeviceSessionUnclaimedRecordV1 | LinkedDeviceSessionClaimedRecordV1 | LinkedDeviceSessionApprovedRecordV1 | LinkedDeviceSessionSourceContributionRecordV1 | LinkedDeviceSessionProvisioningRecordV1 | LinkedDeviceSessionPendingRecordV1 | LinkedDeviceSessionActiveRecordV1 | LinkedDeviceSessionTerminalRecordV1;
-export type LinkedDeviceSessionClaimIdentityV1 = {
+type LinkedDeviceSessionClaimIdentityV1 = {
     readonly walletId: WalletId;
     readonly enrollmentId: LinkedDeviceEnrollmentId;
     readonly deviceId: LinkedDeviceId;
     readonly claimExpiresAtMs: number;
 };
-export type LinkedDeviceOwnerAuthorizationDeniedV1 = {
+type LinkedDeviceOwnerAuthorizationDeniedV1 = {
     readonly kind: 'denied';
     readonly code: 'unauthorized' | 'expired' | 'invalid';
     readonly message: string;
@@ -292,29 +144,6 @@ export type LinkedDeviceSessionStoreV1 = {
         readonly nowMs: number;
     }): Promise<LinkedDeviceSessionMutationResultV1>;
 };
-export type LinkedDeviceSessionMutationResultV1 = {
-    readonly outcome: 'applied' | 'replayed';
-    readonly record: LinkedDeviceSessionRecordV1;
-} | {
-    readonly outcome: 'conflict';
-    readonly expectedRevision: number;
-    readonly actualRevision: number | null;
-    readonly record: LinkedDeviceSessionRecordV1 | null;
-} | {
-    readonly outcome: 'expired';
-    readonly record: LinkedDeviceSessionRecordV1;
-} | {
-    readonly outcome: 'deleted';
-    readonly record: null;
-} | {
-    readonly outcome: 'invalid_state';
-    readonly state: LinkSessionStateV1['state'];
-    readonly record: LinkedDeviceSessionRecordV1;
-} | {
-    readonly outcome: 'integrity_error';
-    readonly reason: 'authority_id_mismatch' | 'package_set_digest_mismatch';
-    readonly record: LinkedDeviceSessionRecordV1;
-};
 export type LinkedDeviceSessionServiceResultV1 = LinkedDeviceSessionMutationResultV1 | {
     readonly outcome: 'invalid_input';
     readonly message: string;
@@ -323,53 +152,53 @@ export type LinkedDeviceSessionServiceResultV1 = LinkedDeviceSessionMutationResu
     readonly code: string;
     readonly message: string;
 };
-export type LinkedDeviceTargetCredentialMutationResultV1 = LinkedDeviceSessionMutationResultV1 | {
+type LinkedDeviceTargetCredentialMutationResultV1 = LinkedDeviceSessionMutationResultV1 | {
     readonly outcome: 'invalid_input';
     readonly message: string;
 };
-export type LinkedDeviceSessionCreateInputV1 = {
+type LinkedDeviceSessionCreateInputV1 = {
     readonly payload: QrLinkedDeviceSessionPayloadV5;
     readonly nowMs: number;
 };
-export type LinkedDeviceSessionClaimInputV1 = {
+type LinkedDeviceSessionClaimInputV1 = {
     readonly payload: QrLinkedDeviceSessionPayloadV5;
     readonly nowMs: number;
     readonly owner: LinkedDeviceOwnerAuthorizationContextV1;
 };
-export type LinkedDeviceSessionApprovalInputV1 = {
+type LinkedDeviceSessionApprovalInputV1 = {
     readonly approval: LinkedDeviceApprovalV1;
     readonly nowMs: number;
     readonly owner: LinkedDeviceOwnerAuthorizationContextV1;
 };
-export type LinkedDeviceSessionCancelInputV1 = {
+type LinkedDeviceSessionCancelInputV1 = {
     readonly linkSessionId: LinkDeviceSessionId;
     readonly expectedRevision: number;
     readonly nowMs: number;
 };
-export type LinkedDeviceSessionExpireInputV1 = {
+type LinkedDeviceSessionExpireInputV1 = {
     readonly linkSessionId: LinkDeviceSessionId;
     readonly expectedRevision: number;
     readonly nowMs: number;
 };
-export type LinkedDeviceSessionDeleteInputV1 = {
+type LinkedDeviceSessionDeleteInputV1 = {
     readonly linkSessionId: LinkDeviceSessionId;
     readonly expectedRevision: number;
     readonly authorityId: WalletAuthorityId;
     readonly packageSetDigestB64u: DigestB64u;
     readonly nowMs: number;
 };
-export type LinkedDeviceSessionTargetCredentialInputV1 = {
+type LinkedDeviceSessionTargetCredentialInputV1 = {
     readonly linkSessionId: LinkDeviceSessionId;
     readonly expectedRevision: number;
     readonly sourceContributionPreparation: LinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1;
     readonly nowMs: number;
 };
-export type LinkedDeviceSessionSourceContributionInputV1 = {
+type LinkedDeviceSessionSourceContributionInputV1 = {
     readonly approval: LinkedDeviceApprovalV1;
     readonly nowMs: number;
     readonly owner: LinkedDeviceOwnerAuthorizationContextV1;
 };
-export type LinkedDeviceSessionEmailOtpChallengeInputV1 = {
+type LinkedDeviceSessionEmailOtpChallengeInputV1 = {
     readonly linkSessionId: LinkDeviceSessionId;
     readonly expectedRevision: number;
     readonly challenge: {
@@ -381,14 +210,14 @@ export type LinkedDeviceSessionEmailOtpChallengeInputV1 = {
     };
     readonly nowMs: number;
 };
-export type LinkedDeviceSessionCommitInputV1 = {
+type LinkedDeviceSessionCommitInputV1 = {
     readonly linkSessionId: LinkDeviceSessionId;
     readonly expectedRevision: number;
     readonly authorityId: WalletAuthorityId;
     readonly packageSetDigestB64u: DigestB64u;
     readonly nowMs: number;
 };
-export type LinkedDeviceSessionActivationInputV1 = {
+type LinkedDeviceSessionActivationInputV1 = {
     readonly linkSessionId: LinkDeviceSessionId;
     readonly expectedRevision: number;
     readonly authorityId: WalletAuthorityId;
@@ -432,31 +261,4 @@ export declare class LinkedDeviceSessionServiceV1 {
     }): Promise<LinkedDeviceSessionListPageV1>;
     private requireSession;
 }
-export declare function digestTranscriptV1(kind: 'claim', value: LinkedDeviceClaimV1): Promise<DigestB64u>;
-export declare function digestTranscriptV1(kind: 'approval', value: LinkedDeviceApprovalV1): Promise<DigestB64u>;
-export declare function buildUnclaimedSessionRecordV1(payload: QrLinkedDeviceSessionPayloadV5, nowMs: number): LinkedDeviceSessionRecordV1;
-export declare function parseLinkedDeviceSessionRecordV1(raw: unknown): LinkedDeviceSessionRecordV1;
-/** Builds the next linear session record for the authority commit transaction. */
-export declare function buildAuthorityPendingLocalInstallSessionRecordV1(input: {
-    readonly record: LinkedDeviceSessionRecordV1;
-    readonly authorityId: WalletAuthorityId;
-    readonly packageSetDigestB64u: DigestB64u;
-    readonly nowMs: number;
-}): LinkedDeviceSessionRecordV1;
-/** Builds the next linear session record for the authority activation transaction. */
-export declare function buildAuthorityActiveSessionRecordV1(input: {
-    readonly record: LinkedDeviceSessionRecordV1;
-    readonly activatedAtMs: number;
-    readonly nowMs: number;
-}): LinkedDeviceSessionRecordV1;
-export declare function linkedDeviceQrPayloadsEqualV1(left: QrLinkedDeviceSessionPayloadV5, right: QrLinkedDeviceSessionPayloadV5): boolean;
-/**
- * A stored transcript no longer parses under the current schema. This class
- * marks exactly the failures a deployment boundary produces - transcript
- * shapes are what refactors move - so a store can delete-and-recover them
- * while every value-consistency failure (tampering) keeps throwing raw.
- */
-export declare class LinkedDeviceRetiredSessionShapeErrorV1 extends Error {
-    constructor(transcript: string, cause: unknown);
-}
 //# sourceMappingURL=linkedDeviceSession.d.ts.map

package/dist/types/wallet-server/src/core/deviceLinking/linkedDeviceSessionApproval.d.ts

@@ -0,0 +1,8 @@
+import { type DelegatedWalletAuthorityV1 } from '../../../../shared-ts/src/authorization/delegatedAuthority';
+import type { LinkedDeviceApprovalV1 } from '../../../../shared-ts/src/device-linking/contracts';
+import { type LinkedDeviceSessionRecordV1 } from './linkedDeviceSessionRecord';
+export declare function validateApprovalMatchesSession(record: LinkedDeviceSessionRecordV1, approval: LinkedDeviceApprovalV1, nowMs: number): void;
+export declare function validateSourceContributionApprovalMatchesSession(record: LinkedDeviceSessionRecordV1, approval: LinkedDeviceApprovalV1, nowMs: number): void;
+export declare function validateSourceContributionPreparationMatchesApproval(record: LinkedDeviceSessionRecordV1, approval: LinkedDeviceApprovalV1): void;
+export declare function validateLinkedDeviceRequestedAuthorityV1(sourceAuthority: DelegatedWalletAuthorityV1, authority: DelegatedWalletAuthorityV1): string | null;
+//# sourceMappingURL=linkedDeviceSessionApproval.d.ts.map