@seams/wallet-server 0.6.2 → 0.7.1

package/dist/types/wallet-server/src/router/framework/authServicePort.d.ts

@@ -1,5 +1,7 @@
 import type { DigestB64u } from '../../../../shared-ts/src/utils/canonicalPrimitives';
+import type { TenantRootIdentityV1 } from '../../../../shared-ts/src/tenant-root/tenantRootIdentity';
 import type { AddAuthMethodIntentCallerV1, AddAuthMethodIntentGrant } from '../../../../shared-ts/src/utils/registrationIntent';
+import type { ActiveEmailOtpWalletAuthMethodRecordV2, ActivePasskeyWalletAuthMethodRecordV2, ActiveWalletAuthMethodRecordV2 } from '../../../../shared-ts/src/utils/walletAuthMethodRecord';
 import type { WalletRegistrationNearProvisioningResponseV2, WalletRegistrationNearAdmissionResponseV2, WalletRegistrationActivateResponseV2, WalletRegistrationRespondResponseV2, WalletRegistrationSetupResponseV2 } from '../../core/threeRouteRegistrationContracts';
 import type { WalletRegistrationNearProvisioningInput, WalletRegistrationNearAdmissionInput, WalletRegistrationActivateInput, WalletRegistrationRespondInput, WalletRegistrationSetupInput } from '../domains/walletRegistration/walletRegistrationInputs';
 import type { WalletEmailOtpAction } from '../../../../shared-ts/src/utils/emailOtpDomain';
@@ -23,24 +25,20 @@ import type { DeviceLinkingOwnerAuthorizationRouteServiceV1 } from '../transport
 import type { WalletEcdsaSignerKey, WalletEcdsaSignerRecord } from '../../core/WalletStore';
 import type { FundImplicitNearAccountRequest, FundImplicitNearAccountResult, ThresholdEcdsaChainTarget, ThresholdEd25519AuthorityScope, ThresholdRuntimePolicyScope, WebAuthnAuthenticationCredential } from '../../core/types';
 import type { AddAuthMethodInput, AddSignerSelection, CreateAddAuthMethodIntentResponse, CreateAddSignerIntentResponse, WalletAddAuthMethodFinalizeRequest, WalletAddAuthMethodFinalizeResponse, WalletAddAuthMethodStartRequest, WalletAddAuthMethodStartResponse, WalletAddSignerFinalizeRequest, WalletAddSignerFinalizeResponse, WalletAddSignerEcdsaActivationRequest, WalletAddSignerEcdsaActivationResponse, WalletAddSignerEcdsaDerivationRespondRequest, WalletAddSignerEcdsaDerivationRespondResponse, WalletAddSignerStartRequest, WalletAddSignerStartResponse, WalletRegistrationEcdsaActivationRequest, WalletRegistrationEcdsaActivationResponse, WalletRegistrationEcdsaDerivationRespondRequest, WalletRegistrationEcdsaDerivationRespondResponse, WalletRevokeAuthMethodRequest, WalletRevokeAuthMethodResponse } from '../../core/registrationContracts';
-import type { WalletAuthMethodRevocationProof } from '../../../../shared-ts/src/utils/registrationIntent';
-import type { WalletAuthMethodRecordV2 } from '../../../../shared-ts/src/utils/registrationIntent';
+import type { WalletAuthMethodRecordV2 } from '../../../../shared-ts/src/utils/walletAuthMethodRecord';
 import type { DirectV2IssueResult, IssuedWalletSessionAuthorizationV2 } from '../../authorization/domain';
 import type { IssueWalletSessionAuthorizationV2Input } from '../../authorization/service';
 import type { WalletSessionOperationCredentialV1 } from '../../../../shared-ts/src/device-linking/contracts';
-export type WalletAuthMethodManagementSubject = Readonly<{
+type WalletAuthMethodManagementSubject = Readonly<{
     kind: 'wallet_auth_method_management';
     walletId: WalletId;
 }>;
-export type WalletUnlockIssuanceRejectionCode = 'unauthorized' | 'invalid_body' | 'invalid_state' | 'not_found' | 'tenant_scope_mismatch' | 'provider_identity_mismatch' | 'internal';
+type WalletUnlockIssuanceRejectionCode = 'unauthorized' | 'invalid_body' | 'invalid_state' | 'not_found' | 'tenant_scope_mismatch' | 'provider_identity_mismatch' | 'internal';
 export declare function parseWalletUnlockIssuanceRejectionCode(value: unknown): WalletUnlockIssuanceRejectionCode;
 export type WalletUnlockPasskeyAuthorityResolution = {
     readonly kind: 'active_authority';
     readonly authority: ActiveWalletAuthorityV1;
-    readonly authMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly kind: 'passkey';
-        readonly status: 'active';
-    }>;
+    readonly authMethod: ActivePasskeyWalletAuthMethodRecordV2;
 } | {
     readonly kind: 'rejected';
     readonly code: WalletUnlockIssuanceRejectionCode;
@@ -50,16 +48,13 @@ export type WalletUnlockEmailOtpAuthorityResolution = {
     readonly kind: 'active_authority';
     readonly authority: ActiveWalletAuthorityV1;
     readonly walletAuthAuthority: EmailOtpWalletAuthAuthority;
-    readonly authMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly kind: 'email_otp';
-        readonly status: 'active';
-    }>;
+    readonly authMethod: ActiveEmailOtpWalletAuthMethodRecordV2;
 } | {
     readonly kind: 'rejected';
     readonly code: WalletUnlockIssuanceRejectionCode;
     readonly message: string;
 };
-export type WalletUnlockEmailOtpSessionRequest = {
+type WalletUnlockEmailOtpSessionRequest = {
     readonly kind: 'wallet_session';
 } | {
     readonly kind: 'ed25519_yao';
@@ -98,12 +93,10 @@ export type RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext = {
         readonly kind: 'exhausted';
     };
     readonly authority: ActiveWalletAuthorityV1;
-    readonly authMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly status: 'active';
-    }>;
+    readonly authMethod: ActiveWalletAuthMethodRecordV2;
     readonly retiredAtMs: null;
 };
-export type RouterApiHostedWalletSessionAuthorizationV2AdmissionContext = RouterApiWalletSessionAuthorizationV2AdmissionContext & {
+type RouterApiHostedWalletSessionAuthorizationV2AdmissionContext = RouterApiWalletSessionAuthorizationV2AdmissionContext & {
     readonly hostedCredentialId: HostedWalletSessionCredentialId;
     readonly appOrigin: SessionOrigin;
     readonly walletOrigin: SessionOrigin;
@@ -112,9 +105,7 @@ export type RouterApiHostedWalletSessionAuthorizationV2AdmissionContext = Router
 export type ActiveWalletSessionAuthorityResolution = {
     readonly kind: 'active_authority';
     readonly authority: ActiveWalletAuthorityV1;
-    readonly authMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly status: 'active';
-    }>;
+    readonly authMethod: ActiveWalletAuthMethodRecordV2;
 } | {
     readonly kind: 'rejected';
     readonly code: string;
@@ -130,7 +121,7 @@ export type CreateAddAuthMethodIntentCommand = Readonly<{
      */
     caller: AddAuthMethodIntentCallerV1;
 }>;
-export type WalletSignerManagementSubject = Readonly<{
+type WalletSignerManagementSubject = Readonly<{
     kind: 'wallet_signer_management';
     walletId: WalletId;
 }>;
@@ -141,49 +132,50 @@ export type CreateAddSignerIntentCommand = Readonly<{
 export type StartWalletAddAuthMethodCommand = Readonly<{
     subject: WalletAuthMethodManagementSubject;
 } & Omit<WalletAddAuthMethodStartRequest, 'walletId'>>;
-export type RevokeWalletAuthMethodCommand = Readonly<{
+export type RevokeWalletAuthMethodWithFreshProofCommand = Readonly<{
     subject: WalletAuthMethodManagementSubject;
-    verifiedSource: {
-        readonly walletAuthMethodId: WalletAuthMethodId;
-        readonly verifiedAtMs: number;
-    };
+    /** The origin a WebAuthn source proof must have been made on. */
+    expectedOrigin: string;
 } & Omit<WalletRevokeAuthMethodRequest, 'walletId'>>;
-export type WalletAuthMethodRevokeProofVerificationResult = {
-    readonly kind: 'authorized';
-    readonly walletAuthMethodId: WalletAuthMethodId;
-    readonly verifiedAtMs: number;
+/**
+ * `denied` is a source proof that did not verify. Anything else, a
+ * revocation or a refusal, is the Gateway's answer to the request.
+ */
+export type RevokeWalletAuthMethodWithFreshProofResult = {
+    readonly kind: 'answered';
+    readonly response: WalletRevokeAuthMethodResponse;
 } | {
     readonly kind: 'denied';
     readonly code: string;
     readonly message: string;
 };
-export type WalletAddAuthMethodFinalizeAuthorizationV1 = {
+type WalletAddAuthMethodFinalizeAuthorizationV1 = {
     readonly kind: 'owner';
 };
 export type FinalizeWalletAddAuthMethodCommand = Readonly<{
     subject: WalletAuthMethodManagementSubject;
     authorization: WalletAddAuthMethodFinalizeAuthorizationV1;
 } & WalletAddAuthMethodFinalizeRequest>;
-export type EmailOtpAuthorizationSessionSubject = Readonly<{
+type EmailOtpAuthorizationSessionSubject = Readonly<{
     kind: 'authorization_session';
     tenantId: TenantId;
     principalId: PrincipalId;
     walletId: WalletId;
 }>;
-export type EmailOtpProviderIdentitySubject = Readonly<{
+type EmailOtpProviderIdentitySubject = Readonly<{
     kind: 'provider_identity';
     orgId: OrgId;
     providerSubject: ProviderSubject;
     walletId: WalletId;
 }>;
-export type EmailOtpGrantSubject = EmailOtpAuthorizationSessionSubject | EmailOtpProviderIdentitySubject;
-export type ConsumeEmailOtpGrantCommand = Readonly<{
+type EmailOtpGrantSubject = EmailOtpAuthorizationSessionSubject | EmailOtpProviderIdentitySubject;
+type ConsumeEmailOtpGrantCommand = Readonly<{
     subject: EmailOtpGrantSubject;
     loginGrant: string;
     otpChannel: EmailOtpChannel;
     clientIp?: string;
 }>;
-export type EmailOtpStrongAuthSubject = Readonly<{
+type EmailOtpStrongAuthSubject = Readonly<{
     kind: 'email_otp_strong_auth';
     walletId: WalletId;
 }>;
@@ -384,7 +376,7 @@ type RouterApiOkFailure = {
     readonly code: string;
     readonly message: string;
 };
-export type RouterApiMethodTypes = {
+type RouterApiMethodTypes = {
     applyEmailOtpServerSeal: {
         readonly input: {
             readonly wrappedCiphertext?: unknown;
@@ -739,9 +731,9 @@ export type RouterApiMethodTypes = {
         };
         readonly result: string;
     };
-    revokeWalletAuthMethod: {
-        readonly input: RevokeWalletAuthMethodCommand;
-        readonly result: WalletRevokeAuthMethodResponse;
+    revokeWalletAuthMethodWithFreshProof: {
+        readonly input: RevokeWalletAuthMethodWithFreshProofCommand;
+        readonly result: RevokeWalletAuthMethodWithFreshProofResult;
     };
     startWalletAddAuthMethod: {
         readonly input: StartWalletAddAuthMethodCommand;
@@ -931,23 +923,23 @@ export type RouterApiMethodTypes = {
         };
     };
 };
-export type GoogleEmailOtpRegistrationCandidateWalletValidationRequest = {
+type GoogleEmailOtpRegistrationCandidateWalletValidationRequest = {
     readonly registrationAttemptId: string;
     readonly walletId: string;
     readonly ownerProofBindingDigest: string;
     readonly providerSubject: string;
 };
-export type GoogleEmailOtpRegistrationCandidateWalletValidationResult = {
+type GoogleEmailOtpRegistrationCandidateWalletValidationResult = {
     readonly ok: true;
 } | {
     readonly ok: false;
     readonly code: string;
     readonly message: string;
 };
-export interface RouterAbSigningRuntimeService {
+interface RouterAbSigningRuntimeService {
     getRouterAbEcdsaPresignRuntime(): RouterAbEcdsaPresignRuntime | null;
 }
-export interface RouterApiEmailOtpChallengeService {
+interface RouterApiEmailOtpChallengeService {
     createEmailOtpChallenge(input: RouterApiMethodTypes['createEmailOtpChallenge']['input']): Promise<RouterApiMethodTypes['createEmailOtpChallenge']['result']>;
     createEmailOtpEnrollmentChallenge(input: RouterApiMethodTypes['createEmailOtpEnrollmentChallenge']['input']): Promise<RouterApiMethodTypes['createEmailOtpEnrollmentChallenge']['result']>;
 }
@@ -993,6 +985,7 @@ export interface RouterApiWalletRegistrationService {
         readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
     }): Promise<{
         readonly ok: true;
+        readonly identity: TenantRootIdentityV1;
         readonly identityDigestB64u: string;
         readonly custodyLineageB64u: string;
     } | {
@@ -1023,6 +1016,7 @@ export interface RouterApiWalletRegistrationService {
         readonly ok: true;
         readonly identityDigestB64u: string;
         readonly custodyLineageB64u: string;
+        readonly projectEnvironmentId: string;
     } | {
         readonly ok: false;
         readonly code: 'not_found' | 'invalid_state' | 'internal';
@@ -1065,7 +1059,7 @@ export interface RouterApiWalletRegistrationService {
         readonly message: string;
     }>;
 }
-export interface RouterApiWalletAuthVerificationService {
+interface RouterApiWalletAuthVerificationService {
     verifyWebAuthnAuthenticationLite(input: RouterApiMethodTypes['verifyWebAuthnAuthenticationLite']['input']): Promise<RouterApiMethodTypes['verifyWebAuthnAuthenticationLite']['result']>;
 }
 export interface RouterApiWalletAuthMethodService {
@@ -1074,13 +1068,11 @@ export interface RouterApiWalletAuthMethodService {
         readonly authorityRef: WalletAuthAuthorityRef;
         readonly authSource: WalletExecutionLaneAuthSource;
     }): Promise<ActiveWalletSessionAuthorityResolution>;
-    verifyWalletAuthMethodRevokeProof(input: {
-        readonly walletId: WalletId;
-        readonly targetWalletAuthMethodId: WalletAuthMethodId;
-        readonly requestedAtMs: number;
-        readonly sourceProof: WalletAuthMethodRevocationProof;
-        readonly expectedOrigin: string;
-    }): Promise<WalletAuthMethodRevokeProofVerificationResult>;
+    /**
+     * Revokes one method on a fresh proof from a different active full-owner
+     * method. An exact retry receives the answer that committed.
+     */
+    revokeWalletAuthMethodWithFreshProof(input: RevokeWalletAuthMethodWithFreshProofCommand): Promise<RevokeWalletAuthMethodWithFreshProofResult>;
     verifyActivePasskeyAuthority(authority: import('../../../../shared-ts/src/utils/walletAuthAuthority').PasskeyWalletAuthAuthority): Promise<{
         readonly ok: true;
     } | {
@@ -1096,10 +1088,7 @@ export interface RouterApiWalletAuthMethodService {
         readonly ok: true;
         readonly authority: import('../../../../shared-ts/src/utils/walletAuthAuthority').PasskeyWalletAuthAuthority;
         readonly walletAuthority: ActiveWalletAuthorityV1;
-        readonly authMethod: Extract<WalletAuthMethodRecordV2, {
-            readonly kind: 'passkey';
-            readonly status: 'active';
-        }>;
+        readonly authMethod: ActivePasskeyWalletAuthMethodRecordV2;
     } | {
         readonly ok: false;
         readonly code: string;
@@ -1160,7 +1149,6 @@ export interface RouterApiWalletAuthMethodService {
     respondWalletAddSignerEcdsaDerivation(input: WalletAddSignerEcdsaDerivationRespondRequest): Promise<WalletAddSignerEcdsaDerivationRespondResponse>;
     activateWalletAddSignerEcdsa(input: WalletAddSignerEcdsaActivationRequest): Promise<WalletAddSignerEcdsaActivationResponse>;
     getWalletAddSignerRuntimePolicyScope(addSignerCeremonyId: string): Promise<ThresholdRuntimePolicyScope | null>;
-    revokeWalletAuthMethod(input: RevokeWalletAuthMethodCommand): Promise<WalletRevokeAuthMethodResponse>;
     /** Sends the enrollment code for an Email OTP addition, bound to its intent. */
     createAddAuthMethodEmailOtpChallenge(input: {
         readonly walletId: WalletId;
@@ -1283,11 +1271,11 @@ export interface RouterApiWebAuthnService {
     verifyWebAuthnLogin(input: RouterApiMethodTypes['verifyWebAuthnLogin']['input']): Promise<RouterApiMethodTypes['verifyWebAuthnLogin']['result']>;
     verifyWebAuthnSyncAccount(input: RouterApiMethodTypes['verifyWebAuthnSyncAccount']['input']): Promise<RouterApiMethodTypes['verifyWebAuthnSyncAccount']['result']>;
 }
-export interface RouterApiNearFundingService {
+interface RouterApiNearFundingService {
     fundImplicitNearAccount(input: FundImplicitNearAccountRequest): Promise<FundImplicitNearAccountResult>;
     listNearPublicKeysForUser(input: RouterApiMethodTypes['listNearPublicKeysForUser']['input']): Promise<RouterApiMethodTypes['listNearPublicKeysForUser']['result']>;
 }
-export interface RouterApiRouterAccountService {
+interface RouterApiRouterAccountService {
     getConfiguredRelayerAccount(): string;
     getRelayerAccount(): Promise<{
         accountId: string;
@@ -1316,15 +1304,24 @@ export interface RouterApiServiceBag {
      * a port on the bag is what makes it callable from a route.
      */
     passkeyCustody: RouterApiPasskeyCustodyService;
-    /** Durable R103 link-session transport; omitted by deployments that disable linking. */
+    /** Durable link-session transport; omitted by deployments that disable linking. */
     deviceLinking?: DeviceLinkingRouteServiceV1;
-    /** Authenticated R103 linked-device projection and revocation transport. */
+    /** Authenticated linked-device projection and revocation transport. */
     deviceManagement?: DeviceManagementRouteServiceV1;
     /** Request-scoped owner Wallet Session metadata for Device 1 approval. */
     deviceLinkingOwnerAuthorization?: DeviceLinkingOwnerAuthorizationRouteServiceV1;
 }
 export interface RouterApiAuthorizedOperationService {
+    admitEcdsaWalletSessionOperation(input: import('../../authorization/ecdsaWalletSessionAdmission').EcdsaWalletSessionAdmissionInput): Promise<import('../../authorization/ecdsaWalletSessionAdmission').EcdsaWalletSessionAdmissionResult>;
     readonly tenantId: TenantId;
+    readPinnedOwnerWalletScope(input: {
+        readonly operation: AuthorizedOperation;
+        readonly walletId: WalletId;
+    }): Promise<{
+        readonly orgId: string;
+        readonly projectId: string;
+        readonly projectEnvironmentId: string;
+    }>;
     buildVerifiedOwnerProof(input: VerifiedOwnerProofInput): Promise<VerifiedOwnerProof>;
     recordVerifiedWalletOperationFactorEvidenceSet(input: VerifiedWalletOperationFactorEvidenceSetInput): Promise<VerifiedAuthorizationEvidenceSet>;
     readAuthorizedOperationById(input: {
@@ -1350,6 +1347,12 @@ export interface RouterApiAuthorizedOperationService {
     } | {
         readonly kind: 'authorization_grant_rejected' | 'verified_step_up_rejected' | 'wallet_session_quota_exhausted' | 'material_mismatch';
     }>;
+    /** The admission `admitAuthorizedOperation` would make, prepared for another store's batch. */
+    prepareAuthorizedOperationAdmission(input: {
+        readonly operation: AuthorizedOperationInput;
+    }): Promise<import('../../authorization/service').PreparedAuthorizedOperationAdmission>;
+    /** The rejection a prepared admission's failed batch stands for, if any. */
+    classifyAuthorizedOperationAdmissionFailure(error: unknown): import('../../authorization/service').AuthorizedOperationAdmissionRejection | null;
     completeAuthorizedOperation(input: {
         readonly operation: AuthorizedOperation;
         readonly result: import('../../authorization/domain').CompletedCapabilityOperationResult;

package/dist/types/wallet-server/src/router/framework/http.d.ts

@@ -6,7 +6,6 @@ export declare function toResponse(out: {
     headers: Record<string, string>;
     body: string;
 }): Response;
-export declare function isObject(v: unknown): v is Record<string, unknown>;
 export declare function readJson(request: Request): Promise<unknown>;
 export declare function headersToRecord(headers: Headers): Record<string, string>;
 //# sourceMappingURL=http.d.ts.map

package/dist/types/wallet-server/src/router/framework/ror/normalize.d.ts

@@ -2,13 +2,13 @@ import { type SigningSessionSealProtocol } from '../../../../../shared-ts/src/ut
 export declare function normalizeCsv(valuesRaw: unknown): string[];
 export declare function sanitizeRorOrigins(origins: unknown): string[];
 export declare function normalizeRorHost(hostRaw: unknown): string | null;
-export type WellKnownSigningSessionSealCapabilities = {
+type WellKnownSigningSessionSealCapabilities = {
     mode: 'none';
 } | {
     mode: 'sealed_refresh_v1';
     protocol: SigningSessionSealProtocol;
     currentKeyVersion: string;
 };
-export declare function normalizeWellKnownSigningSessionSealCapabilities(value: unknown): WellKnownSigningSessionSealCapabilities | null;
 export declare function resolveWellKnownSigningSessionSealCapabilities(signingSessionSealOptionsRaw: unknown): WellKnownSigningSessionSealCapabilities;
+export {};
 //# sourceMappingURL=normalize.d.ts.map

package/dist/types/wallet-server/src/router/framework/routeMeteringPolicy.d.ts

@@ -1,5 +1,5 @@
-export type RouteEventMeteringAction = 'wallet_created';
-export type RouteGasLedger = 'evm' | 'near_delegate';
+type RouteEventMeteringAction = 'wallet_created';
+type RouteGasLedger = 'evm' | 'near_delegate';
 export type RouteMeteringPolicy = {
     kind: 'none';
 } | {
@@ -14,4 +14,5 @@ export interface RouteUsageData {
     transactionHash?: string;
     walletId?: string;
 }
+export {};
 //# sourceMappingURL=routeMeteringPolicy.d.ts.map

package/dist/types/wallet-server/src/router/framework/routerApi.d.ts

@@ -6,7 +6,7 @@ import type { SigningSessionSealRoutesOptions } from '../../threshold/session/si
 import { WALLET_EMAIL_OTP_EXPORT_OPERATION } from '../../../../shared-ts/src/utils/emailOtpDomain';
 import type { RuntimePolicyScope } from '../../../../shared-ts/src/threshold/signingRootScope';
 import type { RouterAbPublicKeysetV2 } from '../../../../shared-ts/src/utils/routerAbPublicKeyset';
-import type { RouterAbNormalSigningAdmissionAdapter } from '../domains/signingOperations/routerAbPrivateSigningWorker';
+import type { RouterAbNormalSigningAdmissionAdapter } from '../domains/signingOperations/routerAbNormalSigningAdmission';
 import type { RouterAbEd25519YaoProductRegistrationRuntimeV1 } from '../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration';
 import type { RouterAbEcdsaStrictPostRegistrationPort } from '../domains/ecdsa/routerAbEcdsaStrictRegistration';
 import type { RouterApiKeyAuthAdapter, RouterApiProjectEnvironmentResolver, RouterApiPublishableKeyAuthAdapter, RouterApiUsageMeterAdapter } from './apiCredentialPorts';

package/dist/types/wallet-server/src/router/framework/routerApiRouteSurface.d.ts

@@ -1,14 +1,14 @@
 import type { RouterApiOptions } from './routerApi';
-import { type RouterApiRouteDefinitionOptions, type RouteDefinition } from './routeDefinitions';
+import { type RouteDefinition } from './routeDefinitions';
 import { type RouterApiRouteExtensionTransport } from './routeExtensions';
-export interface RouterApiRouteSurface {
+interface RouterApiRouteSurface {
     routeDefinitions: readonly RouteDefinition[];
     signedDelegatePath: string;
 }
-export declare function resolveRouterApiRouteDefinitionOptions(opts: RouterApiOptions): RouterApiRouteDefinitionOptions;
 export declare function resolveRouterApiRouteSurface(opts: RouterApiOptions, input?: {
     transport?: RouterApiRouteExtensionTransport;
 }): RouterApiRouteSurface;
 export declare function attachRouterApiRouteSurface<T extends object>(target: T, surface: RouterApiRouteSurface): T;
 export declare function getRouterApiRouteSurface(target: unknown): RouterApiRouteSurface | null;
+export {};
 //# sourceMappingURL=routerApiRouteSurface.d.ts.map

package/dist/types/wallet-server/src/router/node/nodeHostedWalletGateway.d.ts

@@ -0,0 +1,34 @@
+import { type CloudflareD1GatewayEnv, type HostedWalletGatewayDependenciesV1 } from '../../hosted-wallet-gateway';
+import type { CfExecutionContext } from '../cloudflare/runtime/cloudflare.types';
+import { type SyncSqliteConnectionV1 } from '../../storage/syncSqlite';
+/** One Gateway request handler: the hosted Gateway or the local Gateway. */
+type NodeWalletGatewayRequestHandlerV1 = (request: Request, env: CloudflareD1GatewayEnv & {
+    readonly WALLET_LOCAL_DEPLOYMENT_JSON: string;
+}, ctx: CfExecutionContext, dependencies: HostedWalletGatewayDependenciesV1) => Promise<Response>;
+type NodeHostedWalletGatewayOptionsV1 = {
+    /** Gateway configuration and secrets, as the Worker receives them as vars. */
+    readonly vars: Readonly<Record<string, string>>;
+    /** Shared Gateway SQL store (already migrated). */
+    readonly connection: SyncSqliteConnectionV1;
+    /** VM Router base URL. */
+    readonly routerUrl: string;
+    /** VM SigningWorker base URL. */
+    readonly signingWorkerUrl: string;
+    /** Path to wasm_signer_worker_bg.wasm. */
+    readonly signerWasmPath: string;
+    readonly onBackgroundError?: (error: unknown) => void;
+    /**
+     * The handler that serves requests. The hosted Gateway by default; local
+     * development passes the local Gateway, which adds the intended-suite
+     * transport faults exactly as the local Worker entry does.
+     */
+    readonly handler?: NodeWalletGatewayRequestHandlerV1;
+};
+type NodeHostedWalletGatewayV1 = {
+    handle(request: Request): Promise<Response>;
+    /** Resolves when every background task started by handled requests settles. */
+    drain(): Promise<void>;
+};
+export declare function createNodeHostedWalletGatewayV1(options: NodeHostedWalletGatewayOptionsV1): NodeHostedWalletGatewayV1;
+export {};
+//# sourceMappingURL=nodeHostedWalletGateway.d.ts.map

package/dist/types/wallet-server/src/router/node/nodeHostedWalletGatewayCheck.d.ts

@@ -0,0 +1,21 @@
+import { type NodeDatabaseSyncConstructor } from './nodeSqlite';
+type NodeGatewayCheckStatusV1 = 'passed' | 'failed' | 'unverified';
+type NodeGatewayCheckItemV1 = {
+    readonly check: string;
+    readonly status: NodeGatewayCheckStatusV1;
+    readonly detail: Readonly<Record<string, unknown>>;
+};
+type NodeGatewayCheckInputV1 = {
+    readonly DatabaseSync: NodeDatabaseSyncConstructor;
+    readonly databasePath: string;
+    readonly migrationsDir: string;
+    readonly varsPath: string | undefined;
+    /** Parses the vars file; its errors name the file and key, not values. */
+    readonly readVars: (path: string) => Record<string, string>;
+    readonly routerUrl: string | undefined;
+    readonly signingWorkerUrl: string | undefined;
+    readonly signerWasmPath: string | undefined;
+};
+export declare function checkNodeHostedWalletGatewayV1(input: NodeGatewayCheckInputV1): Promise<readonly NodeGatewayCheckItemV1[]>;
+export {};
+//# sourceMappingURL=nodeHostedWalletGatewayCheck.d.ts.map

package/dist/types/wallet-server/src/router/node/nodeHostedWalletGatewayMain.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=nodeHostedWalletGatewayMain.d.ts.map

package/dist/types/wallet-server/src/router/node/nodeHttp.d.ts

@@ -0,0 +1,13 @@
+import { type Server } from 'node:http';
+/**
+ * Headers that describe one connection or one message's framing. A Worker's
+ * runtime sets them for the bytes it actually sends; on Node they are never
+ * copied from a Request or Response that another hop produced.
+ */
+export declare const NODE_HOP_BY_HOP_HEADERS_V1: readonly string[];
+export declare function listenNodeFetchHandler(input: {
+    readonly host: string;
+    readonly port: number;
+    readonly handle: (request: Request) => Promise<Response>;
+}): Promise<Server>;
+//# sourceMappingURL=nodeHttp.d.ts.map

package/dist/types/wallet-server/src/router/node/nodeSqlite.d.ts

@@ -0,0 +1,22 @@
+import type { SyncSqliteConnectionV1, SyncSqliteValue } from '../../storage/syncSqlite';
+/** The subset of `node:sqlite`'s DatabaseSync the VM hosts use. */
+type NodeDatabaseSyncLike = {
+    exec(sql: string): void;
+    prepare(sql: string): {
+        all(...params: SyncSqliteValue[]): unknown[];
+    };
+    close(): void;
+};
+export type NodeDatabaseSyncConstructor = new (path: string, options?: {
+    readonly readOnly?: boolean;
+}) => NodeDatabaseSyncLike;
+/** Loads `node:sqlite` at runtime so the package builds without its typings. */
+export declare function loadNodeDatabaseSync(): Promise<NodeDatabaseSyncConstructor>;
+/**
+ * Opens a SQLite file for one role-private store. Writers from separate
+ * processes serialize on `BEGIN IMMEDIATE`; WAL lets readers proceed.
+ */
+export declare function openNodeSqliteFile(DatabaseSync: NodeDatabaseSyncConstructor, path: string): NodeDatabaseSyncLike;
+export declare function nodeSqliteConnection(database: NodeDatabaseSyncLike): SyncSqliteConnectionV1;
+export {};
+//# sourceMappingURL=nodeSqlite.d.ts.map

package/dist/types/wallet-server/src/router/node/signerSqlMigrations.d.ts

@@ -0,0 +1,20 @@
+import type { SyncSqliteConnectionV1 } from '../../storage/syncSqlite';
+type SignerSqlMigrationStatusV1 = {
+    readonly applied: readonly string[];
+    readonly pending: readonly string[];
+    /** Applied migrations this package does not ship: a newer schema. */
+    readonly unknown: readonly string[];
+};
+/** Read-only: compares the database ledger with the shipped migration chain. */
+export declare function inspectSignerSqlMigrationsV1(connection: SyncSqliteConnectionV1, directory: string): SignerSqlMigrationStatusV1;
+/**
+ * Applies pending migrations in order, each in one transaction together
+ * with its ledger row, so an interrupted run resumes at the first missing
+ * migration. Refuses a database that already carries migrations this
+ * package does not know, or whose applied set is not a prefix of the chain.
+ */
+export declare function applySignerSqlMigrationsV1(connection: SyncSqliteConnectionV1, directory: string, nowMs: number): {
+    readonly applied: readonly string[];
+};
+export {};
+//# sourceMappingURL=signerSqlMigrations.d.ts.map

package/dist/types/wallet-server/src/router/transport/fetch/createFetchRouter.d.ts

@@ -1,8 +1,6 @@
-import type { SigningSessionSealAuthorizeInput, SigningSessionSealAuthorizeResult } from '../../../threshold/session/signingSessionSeal/signingSessionSeal.types';
-import type { RouterApiAuthorizationSessionService, RouterApiServiceBag, RouterApiWalletRegistrationService } from '../../framework/authServicePort';
+import type { RouterApiServiceBag } from '../../framework/authServicePort';
 import type { RouterApiOptions } from '../../framework/routerApi';
 import type { FetchRouterHandler, FetchRouterRuntime } from './fetchRouter.types';
 export type { FetchRouterApiContext, FetchRouterHandler, FetchRouterRuntime, } from './fetchRouter.types';
-export declare function authorizeSigningSessionSealWithExactWalletSession(authorizationSessions: RouterApiAuthorizationSessionService | null | undefined, walletRegistration: RouterApiWalletRegistrationService, input: SigningSessionSealAuthorizeInput): Promise<SigningSessionSealAuthorizeResult>;
 export declare function createFetchRouter(service: RouterApiServiceBag, opts: RouterApiOptions, runtime: FetchRouterRuntime): FetchRouterHandler;
 //# sourceMappingURL=createFetchRouter.d.ts.map

package/dist/types/wallet-server/src/router/transport/fetch/routes/deviceLinking.d.ts

@@ -6,12 +6,12 @@ import { type LinkedDeviceEd25519SourceContributionPreparationV1 } from '../../.
 import { type RouterAbEd25519YaoActivationExecuteRequestV1 } from '../../../../../../shared-ts/src/utils/routerAbEd25519Yao';
 import type { ActivateInstalledAuthorityResultV1 as D1ActivateInstalledAuthorityResultV1, CommitPendingAuthorityResultV1, LocalAuthorityActivationAcknowledgementAuthenticationV1 } from '../../../../router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService';
 import { type LinkedDeviceRequestProofV1 } from '../../../../core/deviceLinking/requestProof';
-import type { LinkedDeviceOwnerAuthorizationContextV1, LinkedDeviceSessionRecordV1, LinkedDeviceSessionServiceResultV1, LinkedDeviceSessionServiceV1 } from '../../../../core/deviceLinking/linkedDeviceSession';
+import type { LinkedDeviceOwnerAuthorizationContextV1, LinkedDeviceSessionServiceV1 } from '../../../../core/deviceLinking/linkedDeviceSession';
+import type { LinkedDeviceSessionRecordV1 } from '../../../../core/deviceLinking/linkedDeviceSessionRecord';
 import type { FetchRouterApiContext } from '../createFetchRouter';
 import { type DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
 import { type LinkDeviceSessionId } from '../../../../../../shared-ts/src/signing-lanes/ids';
 import type { WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
-export declare const DEVICE_LINKING_REQUEST_PROOF_HEADER_V1 = "x-seams-linked-device-proof-v1";
 export type DeviceLinkingAuthDeniedV1 = {
     readonly kind: 'denied';
     readonly code: 'unauthorized' | 'expired' | 'invalid' | 'replayed';
@@ -37,13 +37,12 @@ export type DeviceLinkingAuthenticatedRequestV1 = {
     readonly owner: LinkedDeviceOwnerAuthorizationContextV1;
     readonly binding: DeviceLinkingRequestBindingV1;
 };
-export type DeviceLinkingRequestProofV1 = LinkedDeviceRequestProofV1;
+type DeviceLinkingRequestProofV1 = LinkedDeviceRequestProofV1;
 export type DeviceLinkingDeviceAuthenticatedRequestV1 = {
     readonly kind: 'authorized';
     readonly body: unknown;
     readonly proof: DeviceLinkingRequestProofV1;
 };
-export type DeviceLinkingRouteMutationResultV1 = LinkedDeviceSessionServiceResultV1;
 export type DeviceLinkingTargetCredentialProviderV1 = {
     getTargetPreparationV1(input: {
         readonly session: LinkedDeviceSessionRecordV1;
@@ -128,7 +127,7 @@ export type DeviceLinkingEmailOtpTargetFactorProviderV1 = {
         readonly message: string;
     }>;
 };
-export type DeviceLinkingInstallationReceiptPortV1 = {
+type DeviceLinkingInstallationReceiptPortV1 = {
     commitPendingAuthorityV1(input: {
         readonly input: VerifiedLinkInputV1;
         readonly nowMs: number;
@@ -198,5 +197,5 @@ export type DeviceLinkingRouteServiceV1 = {
     readonly sourceContributionRouter?: DeviceLinkingEd25519SourcePreservingRouterPortV1;
 };
 export declare function handleDeviceLinking(ctx: FetchRouterApiContext): Promise<Response | null>;
-export declare function targetCredentialResultResponse(record: LinkedDeviceSessionRecordV1, outcome: 'applied' | 'replayed', targetCredential: LinkedDeviceTargetCredentialRegistrationResultV1): Response;
+export {};
 //# sourceMappingURL=deviceLinking.d.ts.map

package/dist/types/wallet-server/src/router/transport/fetch/routes/deviceLinkingOwnerAuthorization.d.ts

@@ -8,7 +8,7 @@ import type { RouterApiAuthorizationSessionService } from '../../../framework/au
 import type { FetchRouterApiContext } from '../createFetchRouter';
 import type { DeviceLinkingAuthDeniedV1, DeviceLinkingOwnerRequestInputV1 } from './deviceLinking';
 import type { WalletExecutionLaneAuthSource } from '../../../../core/signingLanes/WalletExecutionLaneProjection';
-import { type DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
+import type { DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
 import type { ExactAdministeredSignerManifestV1 } from '../../../../../../shared-ts/src/device-linking/delegatedActivationPlan';
 export declare const LINKED_DEVICE_OWNER_AUTHORIZATION_PATH_V1: "/wallet/device-linking/v1/owner-authorization";
 export type DeviceLinkingOwnerAuthorizationAuthenticationV1 = {
@@ -50,7 +50,7 @@ export type DeviceLinkingOwnerWalletSessionContextV1 = {
     readonly authority?: never;
     readonly authorityScope?: never;
 };
-export type DeviceLinkingOwnerRequestAuthenticationV1 = {
+type DeviceLinkingOwnerRequestAuthenticationV1 = {
     readonly kind: 'authorized';
     readonly body: unknown;
     readonly binding: {

package/dist/types/wallet-server/src/router/transport/fetch/routes/deviceManagement.d.ts

@@ -1,28 +1,26 @@
-import { type DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
-import { type WalletAuthMethodId, type WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
+import type { LinkedDeviceRevokeRequestV1, LinkedDeviceRevokeResultV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
 import type { DeviceLinkingAuthDeniedV1, DeviceLinkingAuthenticatedRequestV1, DeviceLinkingOwnerRequestInputV1 } from './deviceLinking';
-import { type LinkedDeviceManagementServiceV1 } from '../../../../core/deviceLinking/linkedDeviceManagement';
+import { type LinkedDeviceManagementSourceV1, type LinkedDeviceManagementServiceV1 } from '../../../../core/deviceLinking/linkedDeviceManagement';
 import type { D1LinkedDeviceFreshRevokeProofV1 } from '../../../cloudflare/d1/wallet/d1WalletAuthMethodBoundary';
 import type { FetchRouterApiContext } from '../createFetchRouter';
 export declare const LINKED_DEVICE_MANAGEMENT_BASE_V1 = "/wallet/device-linking/v1/devices";
-export declare const LINKED_DEVICE_MANAGEMENT_MAX_PAGE_SIZE_V1 = 50;
 export type DeviceManagementRouteServiceV1 = {
-    readonly management: Pick<LinkedDeviceManagementServiceV1, 'listLinkedDevicesV1' | 'revokeLinkedDeviceV1'>;
+    readonly management: Pick<LinkedDeviceManagementServiceV1, 'listLinkedDevicesV1'>;
     readonly nowV1: () => number;
     authenticateOwnerRequestV1(input: DeviceLinkingOwnerRequestInputV1): Promise<DeviceLinkingAuthenticatedRequestV1 | DeviceLinkingAuthDeniedV1>;
-    verifyFreshRevokeProofV1(input: {
-        readonly walletId: WalletId;
-        readonly targetWalletAuthMethodId: WalletAuthMethodId;
+    /**
+     * Verifies the fresh proof and revokes in one call. An exact retry of a
+     * committed revocation is answered from its record, before its proof is
+     * examined again.
+     */
+    revokeLinkedDeviceWithFreshProofV1(input: {
+        readonly request: LinkedDeviceRevokeRequestV1;
+        readonly owner: LinkedDeviceManagementSourceV1;
         readonly proof: D1LinkedDeviceFreshRevokeProofV1;
-        readonly request: Request;
-        readonly method: string;
-        readonly pathname: string;
-        readonly bodyDigestB64u: DigestB64u;
-        readonly requestedAtMs: number;
+        readonly httpRequest: Request;
     }): Promise<{
-        readonly kind: 'authorized';
-        readonly walletAuthMethodId: WalletAuthMethodId;
-        readonly verifiedAtMs: number;
+        readonly kind: 'answered';
+        readonly result: LinkedDeviceRevokeResultV1;
     } | DeviceLinkingAuthDeniedV1>;
 };
 export declare function handleDeviceManagement(ctx: FetchRouterApiContext, service: DeviceManagementRouteServiceV1): Promise<Response | null>;