@seams/wallet-server 0.6.2 → 0.7.3

package/dist/types/wallet-server/src/router/domains/signingOperations/walletExecutionAdmission.d.ts

@@ -4,25 +4,18 @@ import { type DigestB64u } from '../../../../../shared-ts/src/utils/canonicalPri
 import { type MpcMaterialActivationRef, type WalletAuthorityId, type WalletId, type WalletKeyId } from '../../../../../shared-ts/src/utils/domainIds';
 import type { ActiveWalletAuthorityV1 } from '../../../../../shared-ts/src/authorization/walletAuthority';
 import type { ExactAdministeredEcdsaSignerV1, ExactAdministeredEd25519SignerV1 } from '../../../../../shared-ts/src/device-linking/delegatedActivationPlan';
-import type { WalletAuthMethodRecordV2 } from '../../../../../shared-ts/src/utils/registrationIntent';
+import type { WalletAuthMethodRecordV2 } from '../../../../../shared-ts/src/utils/walletAuthMethodRecord';
 import type { AuthorizedOperation, WalletSessionAuthorizationV2 } from '../../../authorization/domain';
 import type { PrincipalId, TenantId } from '../../../../../shared-ts/src/authorization/capabilityKinds';
-export type ClaimedAuthorizedOperation = AuthorizedOperation & {
-    readonly lifecycle: 'claimed';
-    readonly result?: never;
-    readonly response?: never;
-    readonly resultDigest?: never;
-    readonly completedAtMs?: never;
-};
-export type WalletExecutionAdmissionRefusalReason = 'operation_not_claimed' | 'wallet_key_inactive' | 'lane_inactive' | 'unsupported_lane' | 'wallet_mismatch' | 'wallet_key_mismatch' | 'curve_mismatch' | 'capability_mismatch' | 'material_activation_mismatch' | 'participant_binding_mismatch' | 'activation_receipt_mismatch';
-export type WalletExecutionAdmissionResult = {
+type WalletExecutionAdmissionRefusalReason = 'operation_not_claimed' | 'wallet_key_inactive' | 'lane_inactive' | 'unsupported_lane' | 'wallet_mismatch' | 'wallet_key_mismatch' | 'curve_mismatch' | 'capability_mismatch' | 'material_activation_mismatch' | 'participant_binding_mismatch' | 'activation_receipt_mismatch';
+type WalletExecutionAdmissionResult = {
     readonly kind: 'prepared';
     readonly execution: PreparedOwnerWalletExecution;
 } | {
     readonly kind: 'refused';
     readonly reason: WalletExecutionAdmissionRefusalReason;
 };
-export type OwnerWalletExecutionEvidence = {
+type OwnerWalletExecutionEvidence = {
     readonly walletId: WalletId;
     readonly walletKey: WalletKeyRecord;
     readonly lane: SigningLaneRecord;
@@ -52,7 +45,7 @@ export type WalletSessionAuthorizationV2AdministrationOperation = {
     readonly principalId: PrincipalId;
     readonly walletId: WalletId;
 };
-export type WalletSessionAuthorizationV2AdmissionError = 'invalid_time' | 'authorization_retired' | 'authorization_expired' | 'operation_identity_mismatch' | 'wallet_mismatch' | 'authority_inactive' | 'authority_mismatch' | 'authority_digest_mismatch' | 'authority_revocation_epoch_mismatch' | 'auth_method_inactive' | 'auth_method_mismatch' | 'permission_mismatch' | 'capability_subject_mismatch' | 'signer_family_mismatch' | 'signer_activation_mismatch';
+type WalletSessionAuthorizationV2AdmissionError = 'invalid_time' | 'authorization_retired' | 'authorization_expired' | 'operation_identity_mismatch' | 'wallet_mismatch' | 'authority_inactive' | 'authority_mismatch' | 'authority_digest_mismatch' | 'authority_revocation_epoch_mismatch' | 'auth_method_inactive' | 'auth_method_mismatch' | 'permission_mismatch' | 'capability_subject_mismatch' | 'signer_family_mismatch' | 'signer_activation_mismatch';
 type WalletSessionAuthorizationV2AdmittedSigner = {
     readonly keyFamily: 'ed25519';
     readonly operationKind: WalletSessionAuthorizationV2Ed25519OperationKind;

package/dist/types/wallet-server/src/router/domains/syncAccount/syncAccountRequestValidation.d.ts

@@ -1,20 +1,15 @@
-import type { WebAuthnAuthenticationCredential } from '../../../core/types';
-export type SyncAccountOptionsRequest = {
+import type { PasskeyVerifyRequest } from '../../auth/authRequestValidation';
+type SyncAccountOptionsRequest = {
     rp_id: string;
     account_id?: string;
     ttl_ms?: number;
 };
-export type SyncAccountVerifyRequest = {
-    challengeId: string;
-    webauthn_authentication: WebAuthnAuthenticationCredential;
-    expected_origin: string;
-};
-export type SyncAccountRouteErrorBody = {
+type SyncAccountRouteErrorBody = {
     ok: false;
     code: 'invalid_body';
     message: string;
 };
-export type SyncAccountRouteParseResult<T> = {
+type SyncAccountRouteParseResult<T> = {
     ok: true;
     request: T;
 } | {
@@ -26,5 +21,6 @@ export declare function parseSyncAccountOptionsRequest(raw: unknown): SyncAccoun
 export declare function parseSyncAccountVerifyRequest(input: {
     body: unknown;
     origin: unknown;
-}): SyncAccountRouteParseResult<SyncAccountVerifyRequest>;
+}): SyncAccountRouteParseResult<PasskeyVerifyRequest>;
+export {};
 //# sourceMappingURL=syncAccountRequestValidation.d.ts.map

package/dist/types/wallet-server/src/router/domains/tenantRoot/tenantRootCustodyLineage.d.ts

@@ -4,11 +4,16 @@ export type TenantRootActiveLineageV1 = {
     readonly identityDigestB64u: string;
     readonly custodyLineageB64u: string;
 };
+export type TenantRootRuntimeActiveLineageV1 = TenantRootActiveLineageV1 & {
+    /** The lineage's identity, whose envId is the Console environment ID. */
+    readonly identity: TenantRootIdentityV1;
+    readonly projectEnvironmentId: string;
+};
 export interface TenantRootCustodyLineageResolverV1 {
     /** Runtime envId is an environment key; resolve its Console ID before root lookup. */
     resolveActiveLineageForRuntimeScope(scope: RuntimePolicyScope & {
         readonly signingRootId: string;
-    }): Promise<TenantRootActiveLineageV1 | null>;
+    }): Promise<TenantRootRuntimeActiveLineageV1 | null>;
     resolveActiveLineage(identity: TenantRootIdentityV1): Promise<TenantRootActiveLineageV1 | null>;
 }
 //# sourceMappingURL=tenantRootCustodyLineage.d.ts.map

package/dist/types/wallet-server/src/router/domains/tenantRoot/tenantRootIdentityResolution.d.ts

@@ -7,7 +7,7 @@ export type ActiveEd25519MaterialActivationV1 = Extract<Awaited<ReturnType<Route
 export type ActiveEcdsaMaterialActivationV1 = Extract<Awaited<ReturnType<RouterApiWalletRegistrationService['resolveEcdsaMaterialActivation']>>, {
     readonly ok: true;
 }>;
-export type ForbiddenTenantRootSelectorFieldsV1 = {
+type ForbiddenTenantRootSelectorFieldsV1 = {
     readonly orgId?: never;
     readonly projectId?: never;
     readonly envId?: never;
@@ -33,17 +33,15 @@ export type ForbiddenTenantRootSelectorFieldsV1 = {
     readonly requestId?: never;
     readonly diagnostics?: never;
 };
-declare const FORBIDDEN_TENANT_ROOT_SELECTOR_FIELDS_V1: readonly ["orgId", "projectId", "envId", "signingRootId", "signingRootVersion", "walletId", "materialActivation", "tenantRootIdentity", "tenantRootId", "tenantRootShareEpoch", "rootShareEpoch", "epoch", "role", "walletSession", "walletSessionId", "authorization", "authorizationId", "credential", "credentialIdB64u", "browser", "browserRecord", "requestBody", "requestId", "diagnostics"];
-export type ForbiddenTenantRootSelectorFieldV1 = (typeof FORBIDDEN_TENANT_ROOT_SELECTOR_FIELDS_V1)[number];
-export type ServerResolvedTenantRootMaterialV1 = (ForbiddenTenantRootSelectorFieldsV1 & {
+type ServerResolvedTenantRootMaterialV1 = (ForbiddenTenantRootSelectorFieldsV1 & {
     readonly kind: 'ed25519_b5_active_material';
     readonly activeMaterial: ActiveEd25519MaterialActivationV1;
 }) | (ForbiddenTenantRootSelectorFieldsV1 & {
     readonly kind: 'ecdsa_b5_active_material';
     readonly activeMaterial: ActiveEcdsaMaterialActivationV1;
 });
-export type TenantRootIdentityResolutionErrorCodeV1 = 'caller_selected_tenant_root' | 'material_activation_mismatch' | 'non_canonical_tenant_root_field' | 'signing_root_id_mismatch' | 'signing_root_version_mismatch';
-export type TenantRootIdentityResolutionResultV1 = {
+type TenantRootIdentityResolutionErrorCodeV1 = 'caller_selected_tenant_root' | 'material_activation_mismatch' | 'non_canonical_tenant_root_field' | 'signing_root_id_mismatch' | 'signing_root_version_mismatch';
+type TenantRootIdentityResolutionResultV1 = {
     readonly ok: true;
     readonly identity: TenantRootIdentityV1;
 } | {
@@ -51,6 +49,5 @@ export type TenantRootIdentityResolutionResultV1 = {
     readonly code: TenantRootIdentityResolutionErrorCodeV1;
     readonly message: string;
 };
-export declare function findForbiddenTenantRootSelectorFieldV1(input: object): ForbiddenTenantRootSelectorFieldV1 | null;
 export declare function resolveTenantRootIdentityV1(input: ServerResolvedTenantRootMaterialV1): TenantRootIdentityResolutionResultV1;
 //# sourceMappingURL=tenantRootIdentityResolution.d.ts.map

package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationInputs.d.ts

@@ -1,5 +1,6 @@
 import type { CorrelationId } from '../../../../../shared-ts/src/utils/canonicalPrimitives';
-import type { RegisterWalletInput, RegistrationAuthMethodInput, RegistrationSignerSetSelection } from '../../../../../shared-ts/src/utils/registrationIntent';
+import type { RegistrationSignerSetSelection } from '../../../../../shared-ts/src/utils/registrationSignerPlan';
+import type { RegisterWalletInput, RegistrationAuthMethodInput } from '../../../../../shared-ts/src/utils/registrationAuthMethodInput';
 import type { RouterAbEcdsaRegistrationRequestV1, RouterAbEcdsaVerifiedClientActivationFactsV1 } from '../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
 import type { WalletRegistrationAuthorityInput, WalletRegistrationFinalizeSignerWork } from '../../../core/registrationContracts';
 import type { ThresholdRuntimePolicyScope } from '../../../core/types';

package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationRoutes.d.ts

@@ -34,8 +34,8 @@ type RouterApiWalletRegistrationInput = {
 };
 export declare function handleRouterApiWalletAddSignerIntent(input: RouterApiWalletRegistrationInput): Promise<RouteResponse<CreateAddSignerIntentResponse | RouteErrorBody>>;
 /**
- * Refactor 94C. `POST /wallets/register/setup` — the single admitted entry
- * point that replaces the bootstrap grant, the intent, and start.
+ * `POST /wallets/register/setup` — the single admitted entry point that
+ * replaces the bootstrap grant, the intent, and start.
  *
  * Authentication is the same API-credential plane the intent route used, so
  * origin and environment binding are unchanged; what is gone is the stored
@@ -43,7 +43,7 @@ export declare function handleRouterApiWalletAddSignerIntent(input: RouterApiWal
  */
 export declare function handleRouterApiWalletRegistrationSetup(input: RouterApiWalletRegistrationInput): Promise<RouteResponse<WalletRegistrationSetupResponseV2 | RouteErrorBody>>;
 /**
- * Refactor 94C. `POST /wallets/register/respond` — the authenticated leg.
+ * `POST /wallets/register/respond` — the authenticated leg.
  *
  * Bearing the proof, so it is a public-plane route authorized by the signed
  * setup payload plus the WebAuthn or Email OTP proof, exactly as the
@@ -52,14 +52,14 @@ export declare function handleRouterApiWalletRegistrationSetup(input: RouterApiW
 export declare function handleRouterApiWalletRegistrationRespond(input: RouterApiWalletRegistrationInput): Promise<RouteResponse<WalletRegistrationRespondResponseV2 | RouteErrorBody>>;
 export declare function handleRouterApiWalletRegistrationNearAdmission(input: RouterApiWalletRegistrationInput): Promise<RouteResponse<WalletRegistrationNearAdmissionResponseV2 | RouteErrorBody>>;
 /**
- * Refactor 94C. `POST /wallets/register/activate` — activation and
- * finalization behind one Gateway operation row.
+ * `POST /wallets/register/activate` — activation and finalization behind
+ * one Gateway operation row.
  */
 export declare function handleRouterApiWalletRegistrationActivate(input: RouterApiWalletRegistrationInput): Promise<RouteResponse<WalletRegistrationActivateRouteResponseV2 | RouteErrorBody>>;
 /**
- * Refactor 94C. `POST /wallets/register/near-provisioning` — the non-blocking
- * completion the client calls after activate, once its already-running Yao
- * computation produces an activation.
+ * `POST /wallets/register/near-provisioning` — the non-blocking completion
+ * the client calls after activate, once its already-running Yao computation
+ * produces an activation.
  */
 export declare function handleRouterApiWalletRegistrationNearProvisioning(input: RouterApiWalletRegistrationInput): Promise<RouteResponse<WalletRegistrationNearProvisioningResponseV2 | RouteErrorBody>>;
 export declare function handleRouterApiWalletAddSignerStart(input: RouterApiWalletRegistrationInput): Promise<RouteResponse<WalletAddSignerStartResponse | RouteErrorBody>>;

package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationSetupPayload.d.ts

@@ -1,6 +1,5 @@
 /**
- * Refactor 94C. The opaque payload `/wallets/register/setup` mints and routes
- * 2 and 3 verify.
+ * The opaque payload `/wallets/register/setup` mints and routes 2 and 3 verify.
  *
  * Setup admits the application, allocates the wallet, and runs the Router
  * preparation in one request. Routes 2 and 3 then need to know that the
@@ -32,7 +31,7 @@ export type WalletRegistrationSetupVerifier = {
         readonly valid: false;
     }>;
 };
-export declare const WALLET_REGISTRATION_SETUP_CLAIM_KIND: "wallet_registration_setup_v1";
+declare const WALLET_REGISTRATION_SETUP_CLAIM_KIND: "wallet_registration_setup_v1";
 export type WalletRegistrationSetupClaimsV1 = {
     readonly kind: typeof WALLET_REGISTRATION_SETUP_CLAIM_KIND;
     readonly registrationCeremonyId: string;
@@ -69,7 +68,7 @@ export declare function computeWalletRegistrationSetupDigestB64u(input: {
     readonly expectedOrigin: string;
 }): Promise<string>;
 export declare function mintSignedWalletRegistrationSetup(signer: WalletRegistrationSetupMinter, claims: WalletRegistrationSetupClaimsV1): Promise<SignedSetupPayloadB64u>;
-export type WalletRegistrationSetupVerification = {
+type WalletRegistrationSetupVerification = {
     readonly ok: true;
     readonly claims: WalletRegistrationSetupClaimsV1;
 } | {
@@ -102,4 +101,5 @@ export declare function verifySignedWalletRegistrationSetup(signer: WalletRegist
     readonly nowMs: number;
 }): Promise<WalletRegistrationSetupVerification>;
 export declare function parseWalletRegistrationSetupClaims(value: unknown): WalletRegistrationSetupClaimsV1 | null;
+export {};
 //# sourceMappingURL=walletRegistrationSetupPayload.d.ts.map

package/dist/types/wallet-server/src/router/domains/walletUnlock/walletUnlockRequestedCapabilitiesValidation.d.ts

@@ -1,6 +1,6 @@
-export declare const EMAIL_OTP_NO_REQUESTED_CAPABILITIES_KIND: "none";
-export declare const EMAIL_OTP_WALLET_SESSION_REQUESTED_CAPABILITIES_KIND: "wallet_session";
-export declare const EMAIL_OTP_ED25519_YAO_REQUESTED_CAPABILITIES_KIND: "ed25519_yao";
+declare const EMAIL_OTP_NO_REQUESTED_CAPABILITIES_KIND: "none";
+declare const EMAIL_OTP_WALLET_SESSION_REQUESTED_CAPABILITIES_KIND: "wallet_session";
+declare const EMAIL_OTP_ED25519_YAO_REQUESTED_CAPABILITIES_KIND: "ed25519_yao";
 type WalletUnlockEmailOtpRequestedCapabilitiesBase = {
     readonly signerSlot: number;
     readonly remainingUses: number;
@@ -27,7 +27,7 @@ type WalletUnlockRequestedCapabilitiesParseFailure = {
         readonly message: string;
     };
 };
-export type WalletUnlockRequestedCapabilitiesParseResult = {
+type WalletUnlockRequestedCapabilitiesParseResult = {
     readonly ok: true;
     readonly request: null;
 } | {

package/dist/types/wallet-server/src/router/domains/walletUnlock/walletUnlockRouteHandlers.d.ts

@@ -1,50 +1,28 @@
-import { EMAIL_OTP_CHANNEL } from '../../../../../shared-ts/src/utils/emailOtpDomain';
 import { type TenantId } from '../../../../../shared-ts/src/authorization/capabilityKinds';
 import { type VerifiedOwnerProof } from '../../../authorization/domain';
 import { type WalletAuthMethodId } from '../../../../../shared-ts/src/utils/domainIds';
-import { ROUTER_AB_ED25519_YAO_EMAIL_OTP_RECOVERY_BOOTSTRAP_KIND_V1 } from '../../../../../shared-ts/src/utils/routerAbEd25519Yao';
-import type { DirectV2IssueResult } from '../../../authorization/domain';
 import type { WalletSessionOperationCredentialV1 } from '../../../../../shared-ts/src/device-linking/contracts';
-import type { WalletRegistrationEd25519YaoBootstrapSession } from '../../../core/registrationContracts';
 import type { RouterApiWalletRegistrationService, RouterApiWalletUnlockService, RouterApiPasskeyCustodyService, RouterApiAuthorizedOperationService } from '../../framework/authServicePort';
 import { type EmailOtpWebhookEventDescriptor } from '../emailOtp/emailOtpSessionRouteHelpers';
 import type { RouterAbEd25519YaoActiveCapabilityDescriptorV1 } from '../ed25519Yao/recovery/routerAbEd25519YaoRecovery';
 import type { RouterAbEcdsaCredentialFreeSessionActivationResponseV1, RouterAbEcdsaPostRegistrationSessionActivationResponseV1, RouterAbEcdsaRegistrationActivationReceiptV1, RouterAbEcdsaPostRegistrationSessionActivationPolicyV1 } from '../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
 import type { WalletEcdsaSignerRecord } from '../../../core/WalletStore';
-import type { PasskeyCustodyEnvelopeRecord } from '../../../../../shared-ts/src/passkey-custody';
-import type { WalletUnlockKeyManifestV1 } from '../passkeyCustody/walletRecoveryKeyManifest';
 import type { WalletUnlockEmailOtpRequestedCapabilitiesRequestV1 } from './walletUnlockRequestedCapabilitiesValidation';
-export type WalletUnlockRouteResponse = {
+type WalletUnlockRouteResponse = {
     status: number;
     body: Record<string, unknown>;
 };
-export type WalletUnlockAlreadyCommittedRouteBody = {
-    readonly ok: false;
-    readonly unlocked: false;
-    readonly unlockBackend: 'passkey' | typeof EMAIL_OTP_CHANNEL;
-    readonly code: 'already_committed';
-    readonly message: 'Wallet Session unlock is already committed; retry the exact method';
-} & Extract<DirectV2IssueResult, {
-    readonly kind: 'already_committed';
-}>;
-export type EmitWalletUnlockRouterApiWebhook = (input: {
+type EmitWalletUnlockRouterApiWebhook = (input: {
     eventType: string;
     userId?: string;
     eventId?: string;
     payload: Record<string, unknown>;
 }) => Promise<void>;
-export type EmitWalletUnlockEmailOtpWebhook = (input: {
+type EmitWalletUnlockEmailOtpWebhook = (input: {
     descriptor: EmailOtpWebhookEventDescriptor;
     userId: string;
     walletId?: string;
 }) => Promise<void>;
-type WalletUnlockProvisionedCapabilityMaterialV1 = {
-    readonly session: WalletRegistrationEd25519YaoBootstrapSession;
-    readonly capability: RouterAbEd25519YaoActiveCapabilityDescriptorV1;
-};
-export type WalletUnlockProvisionedCapabilityV1 = WalletUnlockProvisionedCapabilityMaterialV1 & {
-    readonly kind: typeof ROUTER_AB_ED25519_YAO_EMAIL_OTP_RECOVERY_BOOTSTRAP_KIND_V1;
-};
 export type WalletUnlockCapabilityContext = {
     readonly kind: 'passkey_unlock';
     readonly provisionWalletSession: (input: Parameters<RouterApiWalletRegistrationService['provisionEd25519YaoWalletSession']>[0]) => ReturnType<RouterApiWalletRegistrationService['provisionEd25519YaoWalletSession']>;
@@ -78,7 +56,7 @@ export type WalletUnlockEcdsaCustodySignerV1 = {
     readonly activationReceipt: WalletEcdsaSignerRecord['activationReceipt'];
     readonly runtimePolicyScope: WalletEcdsaSignerRecord['runtimePolicyScope'];
 };
-export type WalletUnlockEcdsaCustodyContinuityV1 = {
+type WalletUnlockEcdsaCustodyContinuityV1 = {
     readonly kind: 'wallet_custody_ecdsa_sync_continuity_v1';
     readonly signers: readonly WalletUnlockEcdsaCustodySignerV1[];
 };
@@ -91,47 +69,11 @@ export type WalletUnlockEcdsaAuthorization = {
     readonly operationCredential: WalletSessionOperationCredentialV1;
     readonly proof: WalletSessionOwnerProof;
 };
-export type WalletUnlockEmailOtpCustodyProjectionV1 = {
-    readonly kind: 'wallet_custody_email_otp_unlock_v1';
-    readonly walletId: string;
-    readonly enrollmentId: string;
-    readonly enrollmentSealKeyVersion: string;
-    readonly envelopeId: PasskeyCustodyEnvelopeRecord['envelopeId'];
-    readonly envelopeVersion: PasskeyCustodyEnvelopeRecord['envelopeVersion'];
-    readonly envelopeRevision: number;
-    readonly storeVersion: string;
-    readonly activeKeySetIds: readonly string[];
-    readonly keyManifest: WalletUnlockKeyManifestV1;
-    readonly envelope: PasskeyCustodyEnvelopeRecord;
-};
-export type WalletUnlockPasskeyCustodyProjectionV1 = {
-    readonly kind: 'wallet_custody_passkey_login_v1';
-    readonly envelope: PasskeyCustodyEnvelopeRecord;
-    readonly storeVersion: string;
-    readonly ed25519: {
-        readonly kind: 'absent';
-    } | {
-        readonly kind: 'active';
-        readonly nearAccountId: string;
-        readonly nearEd25519SigningKeyId: string;
-        readonly signerSlot: number;
-        readonly publicKey: string;
-        readonly relayerKeyId: string;
-        readonly participantIds: readonly [number, number];
-        readonly capability: RouterAbEd25519YaoActiveCapabilityDescriptorV1;
-    };
-};
 type WalletUnlockEmailOtpCustodyLookup = Awaited<ReturnType<RouterApiPasskeyCustodyService['readVerifiedFactorCustody']>>;
 type WalletUnlockPasskeyCustodyResolution = {
     readonly custody: WalletUnlockEmailOtpCustodyLookup;
     readonly capability: RouterAbEd25519YaoActiveCapabilityDescriptorV1 | null;
 };
-export declare function walletUnlockAlreadyCommittedRouteResponse(input: {
-    readonly unlockBackend: WalletUnlockAlreadyCommittedRouteBody['unlockBackend'];
-    readonly committed: Extract<DirectV2IssueResult, {
-        readonly kind: 'already_committed';
-    }>;
-}): WalletUnlockRouteResponse;
 export declare function handleWalletUnlockChallengeRoute(input: {
     body: unknown;
     service: RouterApiWalletUnlockService;

package/dist/types/wallet-server/src/router/express-adaptor.d.ts

@@ -4,9 +4,9 @@ import type { RouterApiOptions } from './framework/routerApi';
 export type { RouterApiOptions, SessionAdapter, RouterApiKeyAuthFailureCode, RouterApiKeyAuthRequest, RouterApiKeyPrincipal, RouterApiKeyAuthResult, RouterApiKeyAuthAdapter, RouterApiPublishableKeyAuthFailureCode, RouterApiPublishableKeyAuthRequest, RouterApiPublishableKeyAuthResult, RouterApiPublishableKeyAuthAdapter, RouterApiUsageMeterAction, RouterApiUsageMeterEvent, RouterApiUsageMeterAdapter, RouterApiRuntimePolicyScope, RouterApiRuntimeSnapshotEnvelope, RouterApiRuntimeSnapshotConsumer, } from './framework/routerApi';
 export { ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, parseRouterAbPublicKeysetV2, } from '../../../shared-ts/src/utils/routerAbPublicKeyset';
 export type { RouterAbPublicKeysetV2 } from '../../../shared-ts/src/utils/routerAbPublicKeyset';
-export type { RouterAbNormalSigningAdmissionAdapter, RouterAbNormalSigningAdmissionFailure, RouterAbNormalSigningAdmissionFailureCode, RouterAbNormalSigningAdmissionInput, RouterAbNormalSigningAdmissionResult, } from './domains/signingOperations/routerAbPrivateSigningWorker';
+export type { RouterAbNormalSigningAdmissionAdapter, RouterAbNormalSigningAdmissionFailure, RouterAbNormalSigningAdmissionFailureCode, RouterAbNormalSigningAdmissionInput, RouterAbNormalSigningAdmissionResult, } from './domains/signingOperations/routerAbNormalSigningAdmission';
 export { InMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createRouterAbNormalSigningAdmissionAdapter, } from './domains/signingOperations/routerAbNormalSigningAdmissionCore';
-export type { RouterAbNormalSigningAbuseDecision, RouterAbNormalSigningAbuseProvider, RouterAbNormalSigningAdmissionStore, RouterAbNormalSigningProjectPolicyDecision, RouterAbNormalSigningProjectPolicyProvider, } from './domains/signingOperations/routerAbNormalSigningAdmissionCore';
+export type { RouterAbNormalSigningAbuseDecision, RouterAbNormalSigningPolicyDecision, RouterAbNormalSigningAdmissionStore, RouterAbNormalSigningProjectPolicyDecision, } from './domains/signingOperations/routerAbNormalSigningAdmissionCore';
 export type { RouterApiFetchRouteExtension, RouterApiFetchRouteExtensionInput, RouterApiRouteExtension, RouterApiRouteExtensionTransport, } from './framework/routeExtensions';
 export type { RouterApiModule, RouterApiModuleKind, RouterApiModuleOptions, } from './framework/modules';
 export { createRouterApiModule } from './framework/modules';

package/dist/types/wallet-server/src/router/framework/apiCredentialPorts.d.ts

@@ -1,6 +1,7 @@
+import type { RouterApiKeyAuthFailureCode } from '../../../../shared-ts/src/utils/routerApiKeyAuth';
 export declare const ROUTER_API_CREDENTIAL_SCOPES: readonly ["accounts.create", "wallets.read", "wallets.auth_methods.create", "wallets.signers.create"];
 export type RouterApiCredentialScope = (typeof ROUTER_API_CREDENTIAL_SCOPES)[number];
-export type RouterApiKeyAuthFailureCode = 'secret_key_missing' | 'secret_key_invalid' | 'secret_key_revoked' | 'secret_key_forbidden_scope' | 'secret_key_ip_blocked' | 'secret_key_environment_mismatch';
+export type { RouterApiKeyAuthFailureCode };
 export interface RouterApiKeyAuthRequest {
     secret: string;
     endpoint: string;
@@ -56,6 +57,7 @@ export interface RouterApiUsageMeterEvent {
     action: RouterApiUsageMeterAction;
     succeeded: boolean;
     occurredAt?: string;
+    /** Producer-owned idempotency key; replays with the same id must not double-count. */
     sourceEventId?: string;
 }
 export interface RouterApiUsageMeterAdapter {