@seams/wallet-server 0.6.2 → 0.7.3

package/dist/types/wallet-server/src/localIntendedEcdsaFinalizeFault.d.ts

@@ -0,0 +1,33 @@
+export declare const LOCAL_INTENDED_ECDSA_FINALIZE_FAULT_HEADER_V1 = "x-seams-intended-ecdsa-finalize-fault-v1";
+export declare const LOCAL_INTENDED_ECDSA_FINALIZE_FAULT_TOKEN_HEADER_V1 = "x-seams-intended-ecdsa-finalize-fault-token-v1";
+export declare const ROUTER_AB_ECDSA_FINALIZE_PATH_V1 = "/router-ab/ecdsa-derivation/sign";
+/**
+ * The Router's response to an admitted ECDSA finalize is lost after the
+ * SigningWorker has signed, and the identical request is sent again before the
+ * Gateway records any outcome. The retry reaches the SigningWorker, which must
+ * answer from the signing effect it already claimed: the same signature, with
+ * no second presignature consumed.
+ */
+type LocalIntendedEcdsaFinalizeFaultModeV1 = 'drop_router_response_once';
+type LocalIntendedEcdsaFinalizeFaultProofV1 = 'stored_signature_replayed';
+type LocalIntendedEcdsaFinalizeFaultViolationV1 = 'router_finalize_not_observed' | 'router_first_response_failed' | 'router_retry_response_failed' | 'router_retry_changed_response' | 'unexpected_additional_finalize';
+type LocalIntendedEcdsaFinalizeFaultOutcomeV1 = {
+    readonly kind: 'proved';
+    readonly proof: LocalIntendedEcdsaFinalizeFaultProofV1;
+} | {
+    readonly kind: 'violated';
+    readonly violation: LocalIntendedEcdsaFinalizeFaultViolationV1;
+};
+export declare function parseLocalIntendedEcdsaFinalizeFaultModeV1(value: string | null): LocalIntendedEcdsaFinalizeFaultModeV1 | null;
+export declare function parseLocalIntendedEcdsaFinalizeFaultTokenV1(value: string | null): string | null;
+export declare class LocalIntendedEcdsaFinalizeFaultControllerV1 {
+    private readonly baseFetch;
+    private state;
+    constructor(baseFetch: typeof globalThis.fetch);
+    fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
+    consumeOutcome(): LocalIntendedEcdsaFinalizeFaultOutcomeV1;
+}
+export declare function requestWithoutLocalIntendedEcdsaFinalizeFaultHeadersV1(request: Request): Request;
+export declare function responseWithLocalIntendedEcdsaFinalizeFaultOutcomeV1(response: Response, outcome: LocalIntendedEcdsaFinalizeFaultOutcomeV1, token: string): Response;
+export {};
+//# sourceMappingURL=localIntendedEcdsaFinalizeFault.d.ts.map

package/dist/types/wallet-server/src/localIntendedLinkExecuteFault.d.ts

@@ -0,0 +1,47 @@
+export declare const LOCAL_INTENDED_LINK_EXECUTE_FAULT_HEADER_V1 = "x-seams-intended-link-execute-fault-v1";
+export declare const LOCAL_INTENDED_LINK_EXECUTE_FAULT_TOKEN_HEADER_V1 = "x-seams-intended-link-execute-fault-token-v1";
+/**
+ * `drop_router_response_once` lets the Router run a linked device's
+ * source-preserving execution, then loses its answer. The Gateway must send
+ * the same request again, marked as the Router's replay, and the Router must
+ * answer it with the reservation the lost answer carried.
+ */
+type LocalIntendedLinkExecuteFaultModeV1 = 'drop_router_response_once';
+type LocalIntendedLinkExecuteFaultProofV1 = 'replay_answered_same_reservation';
+type LocalIntendedLinkExecuteFaultViolationV1 = 'router_execute_not_observed' | 'router_first_response_failed' | 'router_first_marked_as_replay' | 'router_retry_not_observed' | 'router_retry_body_changed' | 'router_retry_not_marked_as_replay' | 'router_retry_response_failed' | 'router_retry_answer_changed' | 'unexpected_additional_execute';
+type LocalIntendedLinkExecuteFaultStateV1 = {
+    readonly kind: 'armed';
+} | {
+    readonly kind: 'awaiting_replay';
+    readonly body: Uint8Array;
+    readonly answer: Uint8Array;
+} | {
+    readonly kind: 'proved';
+    readonly proof: LocalIntendedLinkExecuteFaultProofV1;
+} | {
+    readonly kind: 'violated';
+    readonly violation: LocalIntendedLinkExecuteFaultViolationV1;
+};
+type LocalIntendedLinkExecuteFaultOutcomeV1 = Extract<LocalIntendedLinkExecuteFaultStateV1, {
+    kind: 'proved';
+} | {
+    kind: 'violated';
+}>;
+type LocalIntendedLinkExecuteFaultTokenV1 = {
+    readonly value: string;
+};
+export declare function parseLocalIntendedLinkExecuteFaultModeV1(value: string | null): LocalIntendedLinkExecuteFaultModeV1 | null;
+export declare function parseLocalIntendedLinkExecuteFaultTokenV1(value: string | null): LocalIntendedLinkExecuteFaultTokenV1 | null;
+export declare class LocalIntendedLinkExecuteFaultControllerV1 {
+    private readonly baseFetch;
+    private state;
+    constructor(baseFetch: typeof globalThis.fetch);
+    fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
+    outcome(): LocalIntendedLinkExecuteFaultOutcomeV1;
+    private handleFirstExecute;
+    private handleReplay;
+}
+export declare function requestWithoutLocalIntendedLinkExecuteFaultHeadersV1(request: Request): Request;
+export declare function responseWithLocalIntendedLinkExecuteFaultOutcomeV1(response: Response, outcome: LocalIntendedLinkExecuteFaultOutcomeV1, token: LocalIntendedLinkExecuteFaultTokenV1): Response;
+export {};
+//# sourceMappingURL=localIntendedLinkExecuteFault.d.ts.map

package/dist/types/wallet-server/src/localIntendedMaterialAdmissionFault.d.ts

@@ -0,0 +1,38 @@
+import type { D1DatabaseLike, D1PreparedStatementLike, D1ResultLike } from './storage/tenantRoute';
+type Mode = 'canonical_claim' | 'canonical_existing' | 'linked_claim' | 'linked_existing';
+type Role = 'material' | 'claim' | 'existing';
+type LocalMaterialAdmissionFault = {
+    readonly database: LocalMaterialAdmissionFaultDatabase;
+    readonly request: Request;
+    readonly token: string;
+};
+export declare function localMaterialAdmissionFault(request: Request, database: D1DatabaseLike): LocalMaterialAdmissionFault | Response | null;
+/** Retire material after resolution and before one admission statement, then restore it. */
+declare class LocalMaterialAdmissionFaultDatabase implements D1DatabaseLike {
+    private readonly base;
+    private readonly mode;
+    private scope;
+    private state;
+    constructor(base: D1DatabaseLike, mode: Mode);
+    prepare(query: string): D1PreparedStatementLike;
+    captureScope(values: readonly unknown[]): void;
+    batch<T = unknown>(statements: readonly D1PreparedStatementLike[]): Promise<readonly T[]>;
+    exec(query: string): Promise<unknown>;
+    first<T>(statement: FaultStatement, columnName: string | undefined): Promise<T | null>;
+    private shouldRetire;
+    private execute;
+    response(response: Response, token: string): Response;
+    private target;
+}
+declare class FaultStatement implements D1PreparedStatementLike {
+    private readonly database;
+    readonly inner: D1PreparedStatementLike;
+    readonly role: Role;
+    constructor(database: LocalMaterialAdmissionFaultDatabase, inner: D1PreparedStatementLike, role: Role);
+    bind(...values: readonly unknown[]): D1PreparedStatementLike;
+    first<T = unknown>(columnName?: string): Promise<T | null>;
+    all<T = unknown>(): Promise<D1ResultLike<T>>;
+    run<T = unknown>(): Promise<D1ResultLike<T>>;
+}
+export {};
+//# sourceMappingURL=localIntendedMaterialAdmissionFault.d.ts.map

package/dist/types/wallet-server/src/localIntendedPresignCancellation.d.ts

@@ -0,0 +1,4 @@
+import { type CloudflareD1GatewayEnv, type HostedWalletGatewayDependenciesV1 } from './hosted-wallet-gateway';
+import type { CfExecutionContext } from './router/cloudflare/runtime/cloudflare.types';
+export declare function localPresignCancellationProbe(request: Request, env: CloudflareD1GatewayEnv, ctx: CfExecutionContext, dependencies: HostedWalletGatewayDependenciesV1 | undefined): Promise<Response | null>;
+//# sourceMappingURL=localIntendedPresignCancellation.d.ts.map

package/dist/types/wallet-server/src/localIntendedRevokeFault.d.ts

@@ -0,0 +1,40 @@
+import type { D1DatabaseLike, D1PreparedStatementLike } from './storage/tenantRoute';
+export declare const LOCAL_INTENDED_REVOKE_FAULT_HEADER_V1 = "x-seams-intended-revoke-fault-v1";
+export declare const LOCAL_INTENDED_REVOKE_FAULT_TOKEN_HEADER_V1 = "x-seams-intended-revoke-fault-token-v1";
+export declare const WALLET_REVOKE_AUTH_METHOD_PATH_PATTERN_V1: RegExp;
+/** A linked device's method, revoked through device management. */
+export declare const LINKED_DEVICE_REVOKE_PATH_PATTERN_V1: RegExp;
+/**
+ * `refuse_revocation_batch_once` refuses the batch that would revoke an auth
+ * method, directly or as a linked device's, and record its answer, as a
+ * commit that failed: nothing in it is written. The proof says whether that batch carried the spend of the
+ * request's Email OTP code, and whether anything spent a code outside it. A
+ * code spent before its revocation commits is lost with a failed commit, and
+ * the request could not be sent again.
+ */
+type LocalIntendedRevokeFaultModeV1 = 'refuse_revocation_batch_once';
+type LocalIntendedRevokeFaultProofV1 = 'refused_revocation_with_its_code' | 'refused_revocation_without_code';
+type LocalIntendedRevokeFaultViolationV1 = 'revocation_batch_not_observed' | 'code_spent_outside_revocation' | 'additional_revocation_batch';
+export declare function parseLocalIntendedRevokeFaultModeV1(value: string | null): LocalIntendedRevokeFaultModeV1 | null;
+export declare function parseLocalIntendedRevokeFaultTokenV1(value: string | null): string | null;
+/** The signer database, refusing one auth-method revocation's batch. */
+export declare class LocalIntendedRevokeFaultDatabaseV1 implements D1DatabaseLike {
+    private readonly base;
+    private state;
+    constructor(base: D1DatabaseLike);
+    prepare(query: string): D1PreparedStatementLike;
+    batch<T = unknown>(statements: readonly D1PreparedStatementLike[]): Promise<readonly T[]>;
+    exec(query: string): Promise<unknown>;
+    spentCodeOutsideRevocation(): void;
+    outcome(): {
+        readonly kind: 'proved';
+        readonly proof: LocalIntendedRevokeFaultProofV1;
+    } | {
+        readonly kind: 'violated';
+        readonly violation: LocalIntendedRevokeFaultViolationV1;
+    };
+}
+export declare function requestWithoutLocalIntendedRevokeFaultHeadersV1(request: Request): Request;
+export declare function responseWithLocalIntendedRevokeFaultOutcomeV1(response: Response, outcome: ReturnType<LocalIntendedRevokeFaultDatabaseV1['outcome']>, token: string): Response;
+export {};
+//# sourceMappingURL=localIntendedRevokeFault.d.ts.map

package/dist/types/wallet-server/src/localIntendedSessionAdmissionFault.d.ts

@@ -0,0 +1,41 @@
+import type { D1DatabaseLike, D1PreparedStatementLike } from './storage/tenantRoute';
+export declare const LOCAL_INTENDED_SESSION_ADMISSION_FAULT_HEADER_V1 = "x-seams-intended-session-admission-fault-v1";
+export declare const LOCAL_INTENDED_SESSION_ADMISSION_FAULT_TOKEN_HEADER_V1 = "x-seams-intended-session-admission-fault-token-v1";
+export declare const LOCAL_INTENDED_SESSION_ADMISSION_FAULT_PROOF_HEADER_V1 = "x-seams-intended-session-admission-fault-proof-v1";
+/** The ECDSA signing prepare: it admits the Wallet Session's operation credential. */
+export declare const ECDSA_SIGN_PREPARE_PATH_V1 = "/router-ab/ecdsa-derivation/sign/prepare";
+/**
+ * `hold_after_session_read_until_authority_changes` lets the request's first
+ * operation-credential session read return, then holds the request until the
+ * wallet's stored authority digest differs from the one that read saw: another
+ * request, NEAR provisioning extending the authority, committed in between.
+ * The request then continues. Admission read the authority again at this
+ * point before it judged one snapshot, and paired the session with the newer
+ * authority.
+ */
+type LocalIntendedSessionAdmissionFaultModeV1 = 'hold_after_session_read_until_authority_changes';
+type LocalIntendedSessionAdmissionFaultProofV1 = 'held_until_authority_changed';
+type LocalIntendedSessionAdmissionFaultViolationV1 = 'session_read_not_observed' | 'authority_unchanged';
+export declare function parseLocalIntendedSessionAdmissionFaultModeV1(value: string | null): LocalIntendedSessionAdmissionFaultModeV1 | null;
+export declare function parseLocalIntendedSessionAdmissionFaultTokenV1(value: string | null): string | null;
+/** The signer database, holding one request after its session read. */
+export declare class LocalIntendedSessionAdmissionFaultDatabaseV1 implements D1DatabaseLike {
+    private readonly base;
+    private state;
+    constructor(base: D1DatabaseLike);
+    prepare(query: string): D1PreparedStatementLike;
+    batch<T = unknown>(statements: readonly D1PreparedStatementLike[]): Promise<readonly T[]>;
+    exec(query: string): Promise<unknown>;
+    holdAfterSessionRead(row: unknown): Promise<void>;
+    outcome(): {
+        readonly kind: 'proved';
+        readonly proof: LocalIntendedSessionAdmissionFaultProofV1;
+    } | {
+        readonly kind: 'violated';
+        readonly violation: LocalIntendedSessionAdmissionFaultViolationV1;
+    };
+}
+export declare function requestWithoutLocalIntendedSessionAdmissionFaultHeadersV1(request: Request): Request;
+export declare function responseWithLocalIntendedSessionAdmissionFaultOutcomeV1(response: Response, outcome: ReturnType<LocalIntendedSessionAdmissionFaultDatabaseV1['outcome']>, token: string): Response;
+export {};
+//# sourceMappingURL=localIntendedSessionAdmissionFault.d.ts.map

package/dist/types/wallet-server/src/localIntendedYaoExportFault.d.ts

@@ -0,0 +1,41 @@
+import type { D1DatabaseLike, D1PreparedStatementLike } from './storage/tenantRoute';
+export declare const LOCAL_INTENDED_YAO_EXPORT_FAULT_HEADER_V1 = "x-seams-intended-yao-export-fault-v1";
+export declare const LOCAL_INTENDED_YAO_EXPORT_FAULT_TOKEN_HEADER_V1 = "x-seams-intended-yao-export-fault-token-v1";
+/**
+ * An Ed25519 Yao export admission loses the Gateway's storage once, right
+ * after the batch that authorized the export committed: its next storage call
+ * fails, and the request ends there. The identical request is then sent
+ * again, and must admit the export from the authorization that batch made
+ * durable. Local only.
+ */
+type LocalIntendedYaoExportFaultModeV1 = 'lose_storage_after_export_authorization_once';
+type LocalIntendedYaoExportFaultProofV1 = 'export_authorization_committed_then_storage_lost';
+type LocalIntendedYaoExportFaultViolationV1 = 'export_authorization_not_committed' | 'no_storage_call_after_authorization' | 'interrupted_admission_answered' | 'retried_admission_failed';
+type LocalIntendedYaoExportFaultOutcomeV1 = {
+    readonly kind: 'proved';
+    readonly proof: LocalIntendedYaoExportFaultProofV1;
+} | {
+    readonly kind: 'violated';
+    readonly violation: LocalIntendedYaoExportFaultViolationV1;
+};
+export declare function parseLocalIntendedYaoExportFaultModeV1(value: string | null): LocalIntendedYaoExportFaultModeV1 | null;
+export declare function parseLocalIntendedYaoExportFaultTokenV1(value: string | null): string | null;
+/** The signer database, losing itself once after an export authorization commits. */
+export declare class LocalIntendedYaoExportFaultDatabaseV1 implements D1DatabaseLike {
+    private readonly base;
+    private state;
+    constructor(base: D1DatabaseLike);
+    prepare(query: string): D1PreparedStatementLike;
+    batch<T = unknown>(statements: readonly D1PreparedStatementLike[]): Promise<readonly T[]>;
+    exec(query: string): Promise<unknown>;
+    loseStorageIfAuthorized(): void;
+    /** The fault's outcome, from whether each of the two identical requests was admitted. */
+    outcome(answers: {
+        readonly interruptedOk: boolean;
+        readonly retriedOk: boolean;
+    }): LocalIntendedYaoExportFaultOutcomeV1;
+}
+export declare function requestWithoutLocalIntendedYaoExportFaultHeadersV1(request: Request): Request;
+export declare function responseWithLocalIntendedYaoExportFaultOutcomeV1(response: Response, outcome: LocalIntendedYaoExportFaultOutcomeV1, token: string): Response;
+export {};
+//# sourceMappingURL=localIntendedYaoExportFault.d.ts.map

package/dist/types/wallet-server/src/localIntendedYaoFault.d.ts

@@ -1,8 +1,14 @@
 export declare const LOCAL_INTENDED_YAO_FAULT_HEADER_V1 = "x-seams-intended-yao-fault-v1";
 export declare const LOCAL_INTENDED_YAO_FAULT_TOKEN_HEADER_V1 = "x-seams-intended-yao-fault-token-v1";
+/**
+ * - `drop_router_response_once` loses the Router's reply to the first
+ *   execute, and expects the Gateway to send the identical request again.
+ * - `return_terminal_burned_once` has the Router end the first execute
+ *   burned, and expects the Gateway to answer that failure without retrying.
+ */
 type LocalIntendedYaoFaultModeV1 = 'drop_router_response_once' | 'return_terminal_burned_once';
 type LocalIntendedYaoFaultProofV1 = 'exact_request_replayed' | 'terminal_failure_not_retried';
-type LocalIntendedYaoFaultViolationV1 = 'fault_already_armed' | 'router_execute_not_observed' | 'router_first_response_failed' | 'router_retry_not_observed' | 'router_retry_body_changed' | 'router_retry_trace_changed' | 'router_retry_marker_missing' | 'router_retry_response_failed' | 'unexpected_additional_execute';
+type LocalIntendedYaoFaultViolationV1 = 'fault_already_armed' | 'router_execute_not_observed' | 'router_first_response_failed' | 'router_retry_not_observed' | 'router_retry_body_changed' | 'router_retry_trace_changed' | 'router_retry_marked_as_replay' | 'router_retry_response_failed' | 'router_terminal_not_recorded' | 'unexpected_additional_execute';
 type LocalIntendedYaoFaultOutcomeV1 = {
     readonly kind: 'proved';
     readonly proof: LocalIntendedYaoFaultProofV1;

package/dist/types/wallet-server/src/localIntendedYaoFinalizeFault.d.ts

@@ -0,0 +1,37 @@
+import type { D1DatabaseLike, D1PreparedStatementLike } from './storage/tenantRoute';
+export declare const LOCAL_INTENDED_YAO_FINALIZE_FAULT_HEADER_V1 = "x-seams-intended-yao-finalize-fault-v1";
+export declare const LOCAL_INTENDED_YAO_FINALIZE_FAULT_TOKEN_HEADER_V1 = "x-seams-intended-yao-finalize-fault-token-v1";
+export declare const WALLET_REGISTRATION_NEAR_PROVISIONING_PATH_V1 = "/wallets/register/near-provisioning";
+/**
+ * The Gateway loses its storage once, right after the batch that made an
+ * Ed25519 Yao registration visible committed the lifecycle's decision: the
+ * finalize's next storage call fails. The finalize reports a retryable
+ * failure, and a retry must resume from the decision instead of committing
+ * the registration again.
+ */
+type LocalIntendedYaoFinalizeFaultModeV1 = 'lose_storage_after_decision_once';
+type LocalIntendedYaoFinalizeFaultProofV1 = 'decision_committed_then_storage_lost';
+type LocalIntendedYaoFinalizeFaultViolationV1 = 'decision_not_committed' | 'no_storage_call_after_decision';
+export declare function parseLocalIntendedYaoFinalizeFaultModeV1(value: string | null): LocalIntendedYaoFinalizeFaultModeV1 | null;
+export declare function parseLocalIntendedYaoFinalizeFaultTokenV1(value: string | null): string | null;
+/** The signer database, losing itself once after a Yao decision commits. */
+export declare class LocalIntendedYaoFinalizeFaultDatabaseV1 implements D1DatabaseLike {
+    private readonly base;
+    private state;
+    constructor(base: D1DatabaseLike);
+    prepare(query: string): D1PreparedStatementLike;
+    batch<T = unknown>(statements: readonly D1PreparedStatementLike[]): Promise<readonly T[]>;
+    exec(query: string): Promise<unknown>;
+    loseStorageIfDecided(): void;
+    outcome(): {
+        readonly kind: 'proved';
+        readonly proof: LocalIntendedYaoFinalizeFaultProofV1;
+    } | {
+        readonly kind: 'violated';
+        readonly violation: LocalIntendedYaoFinalizeFaultViolationV1;
+    };
+}
+export declare function requestWithoutLocalIntendedYaoFinalizeFaultHeadersV1(request: Request): Request;
+export declare function responseWithLocalIntendedYaoFinalizeFaultOutcomeV1(response: Response, outcome: ReturnType<LocalIntendedYaoFinalizeFaultDatabaseV1['outcome']>, token: string): Response;
+export {};
+//# sourceMappingURL=localIntendedYaoFinalizeFault.d.ts.map

package/dist/types/wallet-server/src/localIntendedYaoRecoveryFault.d.ts

@@ -0,0 +1,45 @@
+export declare const LOCAL_INTENDED_YAO_RECOVERY_FAULT_HEADER_V1 = "x-seams-intended-yao-recovery-fault-v1";
+export declare const LOCAL_INTENDED_YAO_RECOVERY_FAULT_TOKEN_HEADER_V1 = "x-seams-intended-yao-recovery-fault-token-v1";
+/**
+ * Faults on one recovery execution's way to the Router. Local only.
+ * - `lose_router_recovery_replies`: the execution completes at the Router,
+ *   and every reply to it is lost on its way back to the Gateway, the
+ *   Gateway's replay included. The Gateway records the execution as
+ *   interrupted, while the attempt's candidate is already staged at the
+ *   SigningWorker.
+ * - `withhold_router_recovery_execute`: the execution never reaches the
+ *   Router, and the Gateway keeps it; the Gateway records it as interrupted.
+ * - `release_router_recovery_execute`: a kept execution reaches the Router
+ *   now, exactly as the Gateway sent it: a late run of an attempt the Gateway
+ *   has since superseded.
+ */
+type LocalIntendedYaoRecoveryFaultModeV1 = 'lose_router_recovery_replies' | 'withhold_router_recovery_execute' | 'release_router_recovery_execute';
+type LocalIntendedYaoRecoveryFaultOutcomeV1 = {
+    readonly kind: 'proved';
+    readonly proof: 'recovery_replies_lost_after_router_executed' | 'recovery_execute_withheld';
+} | {
+    readonly kind: 'violated';
+    readonly violation: 'router_recovery_not_executed' | 'router_recovery_answer_failed' | 'router_recovery_execute_not_observed';
+};
+export declare function parseLocalIntendedYaoRecoveryFaultModeV1(value: string | null): LocalIntendedYaoRecoveryFaultModeV1 | null;
+export declare function parseLocalIntendedYaoRecoveryFaultTokenV1(value: string | null): string | null;
+/** The Gateway's Router binding, faulting every call to a recovery execution. */
+export declare class LocalIntendedYaoRecoveryFaultControllerV1 {
+    private readonly baseFetch;
+    private readonly mode;
+    private readonly token;
+    private executed;
+    private failed;
+    private kept;
+    constructor(baseFetch: typeof globalThis.fetch, mode: 'lose_router_recovery_replies' | 'withhold_router_recovery_execute', token: string);
+    fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
+    outcome(): LocalIntendedYaoRecoveryFaultOutcomeV1;
+}
+/** Sends the execution kept under `token` to the Router, exactly. */
+export declare function releaseLocalIntendedYaoRecoveryExecuteV1(router: {
+    fetch(request: Request): Promise<Response>;
+}, token: string): Promise<Response>;
+export declare function requestWithoutLocalIntendedYaoRecoveryFaultHeadersV1(request: Request): Request;
+export declare function responseWithLocalIntendedYaoRecoveryFaultOutcomeV1(response: Response, outcome: LocalIntendedYaoRecoveryFaultOutcomeV1, token: string): Response;
+export {};
+//# sourceMappingURL=localIntendedYaoRecoveryFault.d.ts.map

package/dist/types/wallet-server/src/localIntendedYaoSigningFault.d.ts

@@ -0,0 +1,51 @@
+export declare const LOCAL_INTENDED_YAO_SIGNING_FAULT_HEADER_V1 = "x-seams-intended-yao-signing-fault-v1";
+export declare const LOCAL_INTENDED_YAO_SIGNING_FAULT_TOKEN_HEADER_V1 = "x-seams-intended-yao-signing-fault-token-v1";
+export declare const ROUTER_AB_ED25519_SIGNING_FINALIZE_PATH_V1 = "/router-ab/ed25519/sign";
+/**
+ * A NEAR signature's finalize, as the Gateway sends it to the Router after
+ * authorizing it, kept to be sent again later: a request authorized before a
+ * recovery that arrives after it. Local only.
+ * - `capture_signing_finalize` lets the finalize run and keeps it: a
+ *   signature already made.
+ * - `withhold_signing_finalize` keeps it and never sends it: a signature
+ *   authorized but not yet made. The Gateway's answer is a refusal.
+ * - `release_signing_finalize` sends a kept finalize to the Router again,
+ *   exactly, and answers with the Router's reply.
+ * - `arm_signing_worker_hold` asks the SigningWorker to hold the next NEAR
+ *   finalize of the wallet the body names after it signs and before it
+ *   commits, until its activation is retired: a finalize that loaded its
+ *   material just before a recovery promoted. Dev builds of the Workers D1
+ *   SigningWorker only; the wallet object and the VM SigningWorker sign and
+ *   commit in one step.
+ * - `read_signing_worker_hold` reads that hold's state.
+ */
+type LocalIntendedYaoSigningFaultModeV1 = 'capture_signing_finalize' | 'withhold_signing_finalize' | 'release_signing_finalize' | 'arm_signing_worker_hold' | 'read_signing_worker_hold';
+export declare function parseLocalIntendedYaoSigningFaultModeV1(value: string | null): LocalIntendedYaoSigningFaultModeV1 | null;
+export declare function parseLocalIntendedYaoSigningFaultTokenV1(value: string | null): string | null;
+/** The Gateway's Router binding, keeping the first NEAR finalize it carries. */
+export declare class LocalIntendedYaoSigningFaultControllerV1 {
+    private readonly baseFetch;
+    private readonly mode;
+    private readonly token;
+    private kept;
+    constructor(baseFetch: typeof globalThis.fetch, mode: 'capture_signing_finalize' | 'withhold_signing_finalize', token: string);
+    fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
+    private keep;
+    outcome(): string;
+}
+/** Sends the finalize kept under `token` to the Router again, exactly. */
+export declare function releaseLocalIntendedYaoSigningFinalizeV1(router: {
+    fetch(request: Request): Promise<Response>;
+}, token: string): Promise<Response>;
+/**
+ * Arms or reads the SigningWorker's hold on one wallet's next NEAR finalize,
+ * with the Gateway's own SigningWorker credential, and answers with the
+ * SigningWorker's reply.
+ */
+export declare function commandLocalIntendedSigningWorkerHoldV1(signingWorker: {
+    fetch(request: Request): Promise<Response>;
+}, credential: string | undefined, mode: 'arm_signing_worker_hold' | 'read_signing_worker_hold', body: unknown): Promise<Response>;
+export declare function requestWithoutLocalIntendedYaoSigningFaultHeadersV1(request: Request): Request;
+export declare function responseWithLocalIntendedYaoSigningFaultOutcomeV1(response: Response, outcome: string): Response;
+export {};
+//# sourceMappingURL=localIntendedYaoSigningFault.d.ts.map

package/dist/types/wallet-server/src/router/auth/authRequestValidation.d.ts

@@ -1,5 +1,5 @@
 import type { WebAuthnAuthenticationCredential } from '../../core/types';
-export type AuthProviderActionRoute = {
+type AuthProviderActionRoute = {
     kind: 'passkey_options';
 } | {
     kind: 'passkey_verify';
@@ -10,17 +10,17 @@ export type AuthProviderActionRoute = {
 } | {
     kind: 'github_options';
 };
-export type PasskeyLoginOptionsRequest = {
+type PasskeyLoginOptionsRequest = {
     user_id: string;
     rp_id: string;
     ttl_ms?: number;
 };
-export type PasskeyLoginVerifyRequest = {
+export type PasskeyVerifyRequest = {
     challengeId: string;
     webauthn_authentication: WebAuthnAuthenticationCredential;
     expected_origin: string;
 };
-export type GoogleLoginVerifyRequest = {
+type GoogleLoginVerifyRequest = {
     idToken: string;
     accountMode: 'login' | 'register';
     projectEnvironmentId: string;
@@ -34,21 +34,16 @@ export type GoogleLoginVerifyRequest = {
      */
     restartRegistrationOffer: boolean;
 };
-export type AuthPasskeyStepUpRequest = {
-    challengeId: string;
-    webauthn_authentication: WebAuthnAuthenticationCredential;
-    expected_origin: string;
-};
-export type AuthLinkIdentityRequest = {
+type AuthLinkIdentityRequest = {
     provider: 'google';
     idToken: string;
-    stepUp: AuthPasskeyStepUpRequest;
+    stepUp: PasskeyVerifyRequest;
 };
-export type AuthUnlinkIdentityRequest = {
+type AuthUnlinkIdentityRequest = {
     subject: string;
-    stepUp: AuthPasskeyStepUpRequest;
+    stepUp: PasskeyVerifyRequest;
 };
-export type AuthIdentityMutationRequest = {
+type AuthIdentityMutationRequest = {
     kind: 'link';
     source: 'auth.link';
     request: AuthLinkIdentityRequest;
@@ -57,12 +52,12 @@ export type AuthIdentityMutationRequest = {
     source: 'auth.unlink';
     request: AuthUnlinkIdentityRequest;
 };
-export type AuthRouteErrorBody = {
+type AuthRouteErrorBody = {
     ok: false;
     code: 'invalid_body';
     message: string;
 };
-export type AuthRouteParseResult<T> = {
+type AuthRouteParseResult<T> = {
     ok: true;
     request: T;
 } | {
@@ -70,28 +65,17 @@ export type AuthRouteParseResult<T> = {
     status: 400;
     body: AuthRouteErrorBody;
 };
-export declare function parseAuthProviderAction(input: {
-    provider: unknown;
-    action: unknown;
-}): AuthProviderActionRoute | null;
 export declare function parseAuthProviderActionPath(pathname: string): AuthProviderActionRoute | null;
 export declare function parsePasskeyLoginOptionsRequest(raw: unknown): AuthRouteParseResult<PasskeyLoginOptionsRequest>;
 export declare function parsePasskeyLoginVerifyRequest(input: {
     body: unknown;
     origin: unknown;
-}): AuthRouteParseResult<PasskeyLoginVerifyRequest>;
+}): AuthRouteParseResult<PasskeyVerifyRequest>;
 export declare function parseGoogleLoginVerifyRequest(raw: unknown): AuthRouteParseResult<GoogleLoginVerifyRequest>;
-export declare function parseAuthLinkIdentityRequest(input: {
-    body: unknown;
-    origin: unknown;
-}): AuthRouteParseResult<AuthLinkIdentityRequest>;
-export declare function parseAuthUnlinkIdentityRequest(input: {
-    body: unknown;
-    origin: unknown;
-}): AuthRouteParseResult<AuthUnlinkIdentityRequest>;
 export declare function parseAuthIdentityMutationRequest(input: {
     pathname: unknown;
     body: unknown;
     origin: unknown;
 }): AuthRouteParseResult<AuthIdentityMutationRequest> | null;
+export {};
 //# sourceMappingURL=authRequestValidation.d.ts.map

package/dist/types/wallet-server/src/router/auth/commonRouterUtils.d.ts

@@ -1,6 +1,8 @@
+import type { D1EcdsaAdmissionPolicyRead } from '../cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore';
+import type { EcdsaMaterialRead } from '../../core/d1EcdsaSignerRead';
 import type { ThresholdRuntimePolicyScope } from '../../core/types';
 import type { RouterApiAuthorizationSessionService } from '../framework/authServicePort';
-import type { RouterApiWalletSessionAuthorizationV2AdmissionContext, RouterApiWalletSessionExactOperationContext } from '../framework/authServicePort';
+import type { RouterApiWalletSessionAuthorizationV2AdmissionContext, RouterApiWalletSessionExactOperationContext, RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext } from '../framework/authServicePort';
 import type { RouterApiProjectEnvironmentResolver, RouterApiPublishableKeyAuthAdapter } from '../framework/routerApi';
 import { type WalletSessionFailureCode } from './walletSessionFailure';
 import { type WalletSessionAuthorizationV2AdministrationAdmissionResult, type WalletSessionAuthorizationV2AdministrationOperation, type WalletSessionAuthorizationV2AdmissionResult, type WalletSessionAuthorizationV2RequestedOperation } from '../domains/signingOperations/walletExecutionAdmission';
@@ -26,7 +28,7 @@ export type WalletSessionOperationCredentialAdmission = {
         readonly keyFamily: 'ecdsa_secp256k1';
     }>;
 };
-export type WalletSessionOperationCredentialResolution = {
+type WalletSessionOperationCredentialResolution = {
     readonly kind: 'not_found';
 } | {
     readonly kind: 'rejected';
@@ -52,7 +54,7 @@ export declare function resolveWalletSessionOperationCredentialAdmission(input:
     readonly nowMs: number;
     readonly operation: WalletSessionOperationCredentialRequest;
 }): Promise<WalletSessionOperationCredentialResolution>;
-export type WalletSessionAdministrationRequest = Pick<WalletSessionAuthorizationV2AdministrationOperation, 'kind' | 'walletId'>;
+type WalletSessionAdministrationRequest = Pick<WalletSessionAuthorizationV2AdministrationOperation, 'kind' | 'walletId'>;
 export type WalletSessionAdministrationAdmission = {
     readonly kind: 'wallet_session_administration_v1';
     readonly operationKind: 'link_devices';
@@ -61,7 +63,7 @@ export type WalletSessionAdministrationAdmission = {
         readonly ok: true;
     }>;
 };
-export type WalletSessionAdministrationResolution = {
+type WalletSessionAdministrationResolution = {
     readonly kind: 'not_found';
 } | {
     readonly kind: 'rejected';
@@ -93,11 +95,22 @@ export declare function validateRouterAbEd25519WalletSessionInputs(input: {
 }): Promise<ThresholdEd25519SessionInputs>;
 export type ThresholdEcdsaSessionInputs = {
     readonly ok: true;
+    readonly materialRead: EcdsaMaterialRead;
+    readonly policyRead: D1EcdsaAdmissionPolicyRead;
     readonly kind: 'wallet_session_operation_credential_v1';
     readonly admission: Extract<WalletSessionOperationCredentialAdmission, {
         readonly curve: 'ecdsa';
     }>;
     readonly context: RouterApiWalletSessionAuthorizationV2AdmissionContext;
+    readonly candidate?: never;
+} | {
+    readonly ok: true;
+    readonly materialRead: EcdsaMaterialRead;
+    readonly policyRead: D1EcdsaAdmissionPolicyRead;
+    readonly kind: 'wallet_session_operation_credential_exhausted_candidate_v1';
+    readonly candidate: RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext;
+    readonly admission?: never;
+    readonly context?: never;
 } | AuthorizeErr;
 export declare function validateEcdsaPreprocessingSession(input: {
     readonly headers: Record<string, string | string[] | undefined>;
@@ -106,6 +119,7 @@ export declare function validateEcdsaPreprocessingSession(input: {
     readonly ok: true;
     readonly kind: 'ecdsa_preprocessing_session';
     readonly session: RouterApiWalletSessionExactOperationContext['session'];
+    readonly ownerWalletScope: RouterApiWalletSessionExactOperationContext['ownerWalletScope'];
     readonly signer: Extract<WalletSessionAuthorizationV2AdmissionResult, {
         readonly ok: true;
         readonly keyFamily: 'ecdsa_secp256k1';
@@ -116,6 +130,7 @@ export declare function validateEcdsaPreprocessingSession(input: {
     }>['materialActivation'];
 }>;
 export declare function validateRouterAbEcdsaDerivationWalletSessionInputs(input: {
+    materialActivation: import('../../../../shared-ts/src/utils/routerAbNormalSigningIdentity').RouterAbMpcMaterialActivationRefWire;
     headers: Record<string, string | string[] | undefined>;
     authorizationSessions: RouterApiAuthorizationSessionService | null | undefined;
     nowMs?: () => number;
@@ -123,7 +138,7 @@ export declare function validateRouterAbEcdsaDerivationWalletSessionInputs(input
         readonly keyFamily: 'ecdsa_secp256k1';
     }>['operationKind'];
 }): Promise<ThresholdEcdsaSessionInputs>;
-export type ThresholdRuntimePolicyScopeResolution = {
+type ThresholdRuntimePolicyScopeResolution = {
     ok: true;
     scope?: ThresholdRuntimePolicyScope;
 } | {
@@ -140,12 +155,6 @@ export declare function resolveThresholdRuntimePolicyScope(input: {
     publishableKeyAuth?: RouterApiPublishableKeyAuthAdapter | null;
     orgProjectEnv?: RouterApiProjectEnvironmentResolver | null;
 }): Promise<ThresholdRuntimePolicyScopeResolution>;
-export declare function resolveActiveRuntimePolicyScopeFromFields(input: {
-    orgProjectEnv: RouterApiProjectEnvironmentResolver | null;
-    fields: Omit<ThresholdRuntimePolicyScope, 'signingRootVersion'> & {
-        readonly signingRootVersion?: string;
-    };
-}): Promise<ThresholdRuntimePolicyScope>;
 export declare function resolveActiveRuntimePolicyScopeForEnvironment(input: {
     orgProjectEnv: RouterApiProjectEnvironmentResolver | null;
     orgId: string;

package/dist/types/wallet-server/src/router/auth/walletSessionFailure.d.ts

@@ -1,14 +1,11 @@
-import type { SessionParseFailureReason } from '../../core/sessionValidation';
-import { WALLET_SESSION_FAILURE_CODES, type WalletSessionFailureCode } from '../../../../shared-ts/src/utils/walletSessionFailure';
+import { type WalletSessionFailureCode } from '../../../../shared-ts/src/utils/walletSessionFailure';
 export type { WalletSessionFailureCode } from '../../../../shared-ts/src/utils/walletSessionFailure';
 export type WalletSessionBoundaryFailure = {
     readonly ok: false;
     readonly code: WalletSessionFailureCode;
     readonly message: string;
 };
-export declare function walletSessionFailureCodeFromParseReason(reason: SessionParseFailureReason): Exclude<WalletSessionFailureCode, typeof WALLET_SESSION_FAILURE_CODES.scopeMismatch | typeof WALLET_SESSION_FAILURE_CODES.unavailable | typeof WALLET_SESSION_FAILURE_CODES.budgetExhausted>;
 export declare function walletSessionFailureMessage(code: WalletSessionFailureCode): string;
 export declare function walletSessionFailureStatus(code: WalletSessionFailureCode): 401 | 403 | 409 | 503;
-export declare function walletSessionParseFailure(reason: SessionParseFailureReason): WalletSessionBoundaryFailure;
 export declare function walletSessionFailure(code: WalletSessionFailureCode): WalletSessionBoundaryFailure;
 //# sourceMappingURL=walletSessionFailure.d.ts.map

package/dist/types/wallet-server/src/router/auth/webAuthnCredentialCodecs.d.ts

@@ -1,5 +1,5 @@
 import type { WebAuthnAuthenticationCredential } from '../../core/types';
-export type WebAuthnCredentialIdParseResult = {
+type WebAuthnCredentialIdParseResult = {
     readonly ok: true;
     readonly credentialIdB64u: string;
 } | {
@@ -7,7 +7,7 @@ export type WebAuthnCredentialIdParseResult = {
     readonly code: string;
     readonly message: string;
 };
-export type WebAuthnClientDataJson = {
+type WebAuthnClientDataJson = {
     readonly challenge: string;
     readonly origin: string;
     readonly type: string;
@@ -17,4 +17,5 @@ export declare function parseWebAuthnClientDataJsonBase64url(clientDataJSONB64u:
 export declare function webAuthnOriginHostnameOrEmpty(origin: string): string;
 export declare function webAuthnCredentialIdB64uFromCredential(input: unknown): WebAuthnCredentialIdParseResult;
 export declare function parseWebAuthnAuthenticationCredential(input: unknown): WebAuthnAuthenticationCredential | null;
+export {};
 //# sourceMappingURL=webAuthnCredentialCodecs.d.ts.map