@seams/wallet-server 0.6.2 → 0.7.3

package/dist/types/shared-ts/src/utils/walletCapabilityBindings.d.ts

@@ -1,6 +1,6 @@
 import { type WalletAuthMethodId, type WalletId, type WebAuthnRpId } from './domainIds';
 import { type ImplicitNearAccountId, type NamedNearAccountId } from './near';
-import { type NearEd25519SigningKeyId } from './registrationIntent';
+import { type NearEd25519SigningKeyId } from './registrationIds';
 export type { WebAuthnRpId };
 export type RpId = WebAuthnRpId;
 export type WalletIdentity = {
@@ -44,11 +44,11 @@ export type NearEd25519SignerBinding = {
     readonly nearEd25519SigningKeyId: NearEd25519SigningKeyId;
     readonly signerSlot: number;
 };
-export type WalletCapabilityBindingParseError = {
+type WalletCapabilityBindingParseError = {
     readonly code: 'missing' | 'invalid';
     readonly message: string;
 };
-export type WalletCapabilityBindingParseResult<T> = {
+type WalletCapabilityBindingParseResult<T> = {
     readonly ok: true;
     readonly value: T;
 } | {
@@ -56,12 +56,9 @@ export type WalletCapabilityBindingParseResult<T> = {
     readonly error: WalletCapabilityBindingParseError;
 };
 export declare function parseRpId(raw: unknown): WalletCapabilityBindingParseResult<RpId>;
-export declare function formatRpIdForWire(value: RpId): string;
-export declare function walletIdentityFromRaw(raw: unknown): WalletCapabilityBindingParseResult<WalletIdentity>;
 export declare function buildWalletIdentity(args: {
     walletId: WalletId;
 }): WalletIdentity;
-export declare function passkeyAuthScopeFromRaw(raw: unknown): WalletCapabilityBindingParseResult<PasskeyAuthScope>;
 export declare function buildPasskeyAuthScope(args: {
     wallet: WalletIdentity;
     rpId: RpId;
@@ -79,7 +76,6 @@ export declare function buildEmailOtpWalletAuthMethodBinding(args: {
 }): WalletAuthMethodBinding;
 export declare function walletAuthMethodBindingId(binding: WalletAuthMethodBinding): WalletAuthMethodId;
 export declare function walletAuthMethodBindingFromRaw(raw: unknown): WalletCapabilityBindingParseResult<WalletAuthMethodBinding>;
-export declare function currentWalletAuthMethodFromRaw(raw: unknown): WalletCapabilityBindingParseResult<CurrentWalletAuthMethod>;
 export declare function buildNoCurrentWalletAuthMethod(): Extract<CurrentWalletAuthMethod, {
     kind: 'none';
 }>;

package/dist/types/shared-ts/src/utils/webauthnDeviceInfo.d.ts

@@ -10,8 +10,8 @@
  * Stored on the authenticator row and returned by the authenticators listing
  * so profile UIs can label signers ("Chrome on macOS", "iCloud Keychain").
  */
-export type WebAuthnDeviceBrowser = 'chrome' | 'safari' | 'firefox' | 'edge' | 'other';
-export type WebAuthnDeviceOs = 'macos' | 'ios' | 'windows' | 'android' | 'linux' | 'other';
+type WebAuthnDeviceBrowser = (typeof WEBAUTHN_DEVICE_BROWSERS)[number];
+type WebAuthnDeviceOs = (typeof WEBAUTHN_DEVICE_OSES)[number];
 export type WebAuthnAuthenticatorDeviceInfo = {
     /** Display-ready label, e.g. "Chrome on macOS". Never empty. */
     label: string;
@@ -26,8 +26,8 @@ export type WebAuthnAuthenticatorDeviceInfo = {
     /** Display name for the provider, e.g. "iCloud Keychain". */
     providerLabel?: string;
 };
-export declare function webAuthnDeviceBrowserFromUserAgent(userAgent: string): WebAuthnDeviceBrowser;
-export declare function webAuthnDeviceOsFromUserAgent(userAgent: string): WebAuthnDeviceOs;
+declare const WEBAUTHN_DEVICE_BROWSERS: readonly ["chrome", "safari", "firefox", "edge", "other"];
+declare const WEBAUTHN_DEVICE_OSES: readonly ["macos", "ios", "windows", "android", "linux", "other"];
 export declare function deriveWebAuthnAuthenticatorDeviceInfo(input: {
     userAgent?: string;
     aaguid?: string;
@@ -45,4 +45,5 @@ export declare function parseWebAuthnAuthenticatorDeviceInfoJson(raw: unknown):
 /** Strict parse of a stored/transported device-info record; null when the
  * shape is not a valid WebAuthnAuthenticatorDeviceInfo. */
 export declare function parseWebAuthnAuthenticatorDeviceInfo(raw: unknown): WebAuthnAuthenticatorDeviceInfo | null;
+export {};
 //# sourceMappingURL=webauthnDeviceInfo.d.ts.map

package/dist/types/shared-ts/src/utils/wireSchema.d.ts

@@ -0,0 +1,60 @@
+/** Parses one wire value; `label` is the value's path, for its error messages. */
+export type WireParser<T> = (raw: unknown, label: string) => T;
+type WireType<P> = P extends WireParser<infer T> ? T : never;
+type WireShape = Record<string, WireParser<unknown>>;
+type WireObjectType<S extends WireShape> = {
+    -readonly [K in keyof S]: WireType<S[K]>;
+};
+type ParseResult<T> = {
+    readonly ok: true;
+    readonly value: T;
+} | {
+    readonly ok: false;
+    readonly error: {
+        readonly message: string;
+    };
+};
+type Equal<A, B> = (<T>() => T extends A ? 1 : 2) extends <T>() => T extends B ? 1 : 2 ? true : false;
+type NeverPaddingKeys<T> = {
+    [K in keyof T]-?: [T[K]] extends [undefined] ? K : never;
+}[keyof T];
+type Writable<T> = T extends string | number | boolean | bigint | symbol | null | undefined ? T : {
+    -readonly [K in keyof T]: Writable<T[K]>;
+};
+/**
+ * Whether parser `P`, or the parser that function `P` builds, produces exactly `T`, apart
+ * from `T`'s `?: never` padding and readonly markers.
+ */
+export type ParsesExactly<P, T> = Equal<Writable<P extends () => infer Built ? WireType<Built> : WireType<P>>, Writable<T extends unknown ? Omit<T, NeverPaddingKeys<T>> : never>>;
+/** Compiles only when every check holds; the error shows which entry is false. */
+export type AllTrue<T extends readonly true[]> = T;
+/** One of the given strings. */
+export declare function wireLiteral<V extends string>(...literals: V[]): WireParser<V> & {
+    readonly literals: readonly V[];
+};
+/**
+ * An object with exactly the fields of `shape`, all required, returned in the shape's order.
+ * Checks run in this order: exact keys, then literals (they say which record this is), then
+ * the other fields in declaration order, then `refine`'s cross-field rules.
+ */
+export declare function wireObject<S extends WireShape>(shape: S, refine?: (value: WireObjectType<S>, label: string) => void): WireParser<WireObjectType<S>> & {
+    readonly shape: S;
+};
+/** One of `variants`, chosen by the literal each declares for field `tag`. */
+export declare function wireUnion<K extends string, V extends WireParser<unknown> & {
+    readonly shape: {
+        readonly [P in K]: {
+            readonly literals: readonly string[];
+        };
+    };
+}>(tag: K, variants: readonly V[]): WireParser<WireType<V>>;
+/** `null`, or a value `parse` accepts. */
+export declare function wireNullable<T>(parse: WireParser<T>): WireParser<T | null>;
+/** A non-empty array of `item`; `refine` checks rules that span the items. */
+export declare function wireNonEmptyArray<T>(item: WireParser<T>, refine?: (items: readonly [T, ...T[]], label: string) => void): WireParser<readonly [T, ...T[]]>;
+/** Adapts a parser that returns a result, putting the field's label before its error. */
+export declare function wireResult<T>(parse: (raw: unknown) => ParseResult<T>): WireParser<T>;
+/** Adapts a parser that throws, putting the field's label before its error. */
+export declare function wireLabeled<T>(parse: (raw: unknown) => T): WireParser<T>;
+export {};
+//# sourceMappingURL=wireSchema.d.ts.map

package/dist/types/shared-ts/src/wallet-recovery/backupAcknowledgement.d.ts

@@ -27,7 +27,7 @@ export type WalletRecoveryBackupAcknowledgementV1 = {
     readonly issuedAtMs: number;
     readonly acknowledgedAtMs: number;
 };
-export type WalletRecoveryBackupAcknowledgementParseResult = {
+type WalletRecoveryBackupAcknowledgementParseResult = {
     readonly ok: true;
     readonly record: WalletRecoveryBackupAcknowledgementV1;
 } | {
@@ -53,4 +53,5 @@ export declare function buildWalletRecoveryBackupAcknowledgementV1(input: {
     readonly issuedAtMs: number;
     readonly acknowledgedAtMs: number;
 }): WalletRecoveryBackupAcknowledgementV1;
+export {};
 //# sourceMappingURL=backupAcknowledgement.d.ts.map

package/dist/types/shared-ts/src/wallet-recovery/index.d.ts

@@ -2,7 +2,6 @@ export * from './recoveryCodes';
 export * from './recoveryEnvelopes';
 export * from './recoveryCodeReservation';
 export * from './recoveryCodeLocator';
-export * from './recoveryKekContext';
 export * from './walletRecoveryEnvelopeSet';
 export * from './walletRecoveryRotation';
 export * from './walletRecoveryEcdsaPossession';

package/dist/types/shared-ts/src/wallet-recovery/recoveryCodeLocator.d.ts

@@ -1,22 +1,6 @@
 import { type DigestB64u } from '../utils/canonicalPrimitives';
-import type { DerivedWalletRecoveryKeyId } from './recoveryKeyId';
 /** The code-only digest used to locate a wallet recovery set. */
 export type RecoveryCodeLocatorV1 = DigestB64u;
-export type WalletRecoveryCodeLocatorRecordV1 = {
-    readonly locatorB64u: RecoveryCodeLocatorV1;
-    readonly recoveryKeyId: DerivedWalletRecoveryKeyId;
-};
 export declare function parseRecoveryCodeLocatorV1(value: unknown, label?: string): RecoveryCodeLocatorV1;
-/**
- * Derives the code-only locator from the normalized recovery code.
- *
- * The locator identifies a set for lookup. It never replaces the existing
- * wallet-bound recovery-key derivation that authenticates a wrap.
- */
-export declare function deriveRecoveryCodeLocatorV1(recoveryCode: string): Promise<RecoveryCodeLocatorV1>;
 export declare function deriveRecoveryCodeLocatorV1FromBytes(codeBytes: Uint8Array): Promise<RecoveryCodeLocatorV1>;
-export declare function deriveRecoveryCodeLocatorRecordsV1(inputs: readonly {
-    readonly codeBytes: Uint8Array;
-    readonly recoveryKeyId: DerivedWalletRecoveryKeyId;
-}[]): Promise<readonly WalletRecoveryCodeLocatorRecordV1[]>;
 //# sourceMappingURL=recoveryCodeLocator.d.ts.map

package/dist/types/shared-ts/src/wallet-recovery/recoveryCodeReservation.d.ts

@@ -21,7 +21,7 @@ export declare function deriveWalletRecoveryKeyLifecycleId(input: {
     readonly reservationId: RecoveryCodeReservationId;
     readonly keySetId: WalletRecoveryKeySetId;
 }): Promise<CorrelationId>;
-export type RecoveryCodeTransitionResult = {
+type RecoveryCodeTransitionResult = {
     ok: true;
     lifecycle: RecoveryCodeLifecycleState;
 } | {
@@ -66,14 +66,5 @@ export declare function consumeReservedRecoveryCode(args: {
     reservationId: RecoveryCodeReservationId;
     nowMs: number;
 }): RecoveryCodeTransitionResult;
-/** Revocation is terminal from every state except consumption. */
-export declare function revokeRecoveryCode(args: {
-    lifecycle: RecoveryCodeLifecycleState;
-    nowMs: number;
-}): RecoveryCodeTransitionResult;
-/**
- * Whether a code can back a new recovery attempt right now. An expired
- * reservation counts as available, matching `reserveRecoveryCode`.
- */
-export declare function isRecoveryCodeAvailable(lifecycle: RecoveryCodeLifecycleState, nowMs: number): boolean;
+export {};
 //# sourceMappingURL=recoveryCodeReservation.d.ts.map

package/dist/types/shared-ts/src/wallet-recovery/recoveryEnvelopes.d.ts

@@ -1,4 +1,5 @@
 import type { RecoveryCodeReservationId } from './recoveryCodeReservation';
+import type { ExclusiveUnion } from '../utils/variant';
 /**
  * Lifecycle of one recovery code.
  *
@@ -6,37 +7,23 @@ import type { RecoveryCodeReservationId } from './recoveryCodeReservation';
  * commits only after the replacement credential activates. See
  * `recoveryCodeReservation.ts` for the transitions between these states.
  */
-export type RecoveryCodeLifecycleState = {
+export type RecoveryCodeLifecycleState = ExclusiveUnion<{
     state: 'active';
     issuedAtMs: number;
-    reservationId?: never;
-    reservedAtMs?: never;
-    reservationExpiresAtMs?: never;
-    consumedAtMs?: never;
-    revokedAtMs?: never;
 } | {
     state: 'reserved';
     issuedAtMs: number;
     reservationId: RecoveryCodeReservationId;
     reservedAtMs: number;
     reservationExpiresAtMs: number;
-    consumedAtMs?: never;
-    revokedAtMs?: never;
 } | {
     state: 'consumed';
     issuedAtMs: number;
     reservationId: RecoveryCodeReservationId;
     consumedAtMs: number;
-    reservedAtMs?: never;
-    reservationExpiresAtMs?: never;
-    revokedAtMs?: never;
 } | {
     state: 'revoked';
     issuedAtMs: number;
     revokedAtMs: number;
-    reservationId?: never;
-    reservedAtMs?: never;
-    reservationExpiresAtMs?: never;
-    consumedAtMs?: never;
-};
+}>;
 //# sourceMappingURL=recoveryEnvelopes.d.ts.map

package/dist/types/shared-ts/src/wallet-recovery/walletRecoveryCommittedProjection.d.ts

@@ -1,7 +1,7 @@
 import { type ActiveRecoveredWalletAuthorityV1 } from '../authorization/walletAuthority';
 import { type DeviceId } from '../authorization/capabilityKinds';
 import { type EmailOtpProviderUserId, type WalletAuthMethodId, type WalletAuthorityId, type WalletId, type WalletRecoveryOperationId, type WebAuthnCredentialIdB64u, type WebAuthnRpId } from '../utils/domainIds';
-import { type WalletAuthMethodRecordV2 } from '../utils/registrationIntent';
+import { type ActiveEmailOtpWalletAuthMethodRecordV2, type ActivePasskeyWalletAuthMethodRecordV2 } from '../utils/walletAuthMethodRecord';
 export type WalletRecoveryEmailOtpEnrollmentReferenceV1 = {
     readonly kind: 'email_otp_enrollment_reference_v1';
     readonly enrollmentId: string;
@@ -19,10 +19,7 @@ type WalletRecoveryCommittedProjectionCommonV1 = {
 };
 export type WalletRecoveryCommittedProjectionV1 = (WalletRecoveryCommittedProjectionCommonV1 & {
     readonly kind: 'passkey';
-    readonly authMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly kind: 'passkey';
-        readonly status: 'active';
-    }>;
+    readonly authMethod: ActivePasskeyWalletAuthMethodRecordV2;
     readonly target: {
         readonly kind: 'passkey';
         readonly rpId: WebAuthnRpId;
@@ -30,10 +27,7 @@ export type WalletRecoveryCommittedProjectionV1 = (WalletRecoveryCommittedProjec
     };
 }) | (WalletRecoveryCommittedProjectionCommonV1 & {
     readonly kind: 'google_email_otp';
-    readonly authMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly kind: 'email_otp';
-        readonly status: 'active';
-    }>;
+    readonly authMethod: ActiveEmailOtpWalletAuthMethodRecordV2;
     readonly target: {
         readonly kind: 'google_email_otp';
         readonly provider: 'google';
@@ -64,7 +58,7 @@ export type WalletRecoveryCommittedProjectionExpectationV1 = {
     readonly registrationAuthorityId: string;
     readonly enrollment: WalletRecoveryEmailOtpEnrollmentReferenceV1;
 };
-export type WalletRecoveryCommittedProjectionBuilderInputV1 = {
+type WalletRecoveryCommittedProjectionBuilderInputV1 = {
     readonly kind: 'passkey';
     readonly storeVersion: string;
     readonly walletId: WalletId;
@@ -73,10 +67,7 @@ export type WalletRecoveryCommittedProjectionBuilderInputV1 = {
     readonly targetAuthorityId: WalletAuthorityId;
     readonly targetWalletAuthMethodId: WalletAuthMethodId;
     readonly authority: ActiveRecoveredWalletAuthorityV1;
-    readonly authMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly kind: 'passkey';
-        readonly status: 'active';
-    }>;
+    readonly authMethod: ActivePasskeyWalletAuthMethodRecordV2;
 } | {
     readonly kind: 'google_email_otp';
     readonly storeVersion: string;
@@ -86,10 +77,7 @@ export type WalletRecoveryCommittedProjectionBuilderInputV1 = {
     readonly targetAuthorityId: WalletAuthorityId;
     readonly targetWalletAuthMethodId: WalletAuthMethodId;
     readonly authority: ActiveRecoveredWalletAuthorityV1;
-    readonly authMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly kind: 'email_otp';
-        readonly status: 'active';
-    }>;
+    readonly authMethod: ActiveEmailOtpWalletAuthMethodRecordV2;
     readonly providerSubject: EmailOtpProviderUserId;
     readonly emailHashHex: string;
     readonly registrationAuthorityId: string;

package/dist/types/shared-ts/src/wallet-recovery/walletRecoveryEcdsaPossession.d.ts

@@ -22,8 +22,6 @@ export type WalletRecoveryEcdsaPossessionProofV1 = {
 };
 export declare function parseWalletRecoveryEcdsaPossessionChallengeV1(value: unknown): WalletRecoveryEcdsaPossessionChallengeV1;
 export declare function parseWalletRecoveryEcdsaPossessionProofV1(value: unknown): WalletRecoveryEcdsaPossessionProofV1;
-export declare function walletRecoveryEcdsaPossessionChallengeCanonicalBytesV1(challenge: WalletRecoveryEcdsaPossessionChallengeV1): Uint8Array;
 export declare function walletRecoveryEcdsaPossessionChallengeDigestB64uV1(challenge: WalletRecoveryEcdsaPossessionChallengeV1): Promise<DigestB64u>;
-export declare const WALLET_RECOVERY_ECDSA_POSSESSION_PROOF_SCHEME_V1 = "secp256k1_bip340_sha256_v1";
 export {};
 //# sourceMappingURL=walletRecoveryEcdsaPossession.d.ts.map

package/dist/types/shared-ts/src/wallet-recovery/walletRecoveryEnvelopeSet.d.ts

@@ -13,7 +13,7 @@ import type { RecoveryCodeLifecycleState } from './recoveryEnvelopes';
  * under that device's own factor, so it never depended on the owner credential
  * and survives owner recovery untouched; including it here would instead let an
  * owner recovery code reconstruct that device's material. A lost lane is
- * revoked and reprovisioned through Refactor 102, not recovered.
+ * revoked and reprovisioned, not recovered.
  */
 export type WalletRecoveryEnvelopeEntry = {
     custodySecretKind: 'wallet_custody_seed_v1';
@@ -110,6 +110,4 @@ export declare function parseWalletRecoveryEnvelopeSetRecord(raw: unknown, optio
     expectedWalletId: WalletId;
     label?: string;
 }): WalletRecoveryEnvelopeSetRecord;
-/** A set is openable while at least one recovery-code wrap remains active. */
-export declare function hasOpenableRecoveryCodeWrap(set: WalletRecoveryEnvelopeSetRecord): boolean;
 //# sourceMappingURL=walletRecoveryEnvelopeSet.d.ts.map

package/dist/types/shared-ts/src/wallet-recovery/walletRecoveryPreparation.d.ts

@@ -0,0 +1,15 @@
+import type { RuntimePolicyScope } from '../threshold/signingRootScope';
+import type { RouterAbEd25519YaoApplicationBindingFactsV1, RouterAbEd25519YaoBytes32V1, RouterAbEd25519YaoLifecycleScopeV1 } from '../utils/routerAbEd25519Yao';
+export type WalletRecoveryPreparationNearRecoveryBasisV1 = {
+    readonly capabilityKind: 'registration' | 'recovery';
+    readonly activeCapabilityBinding: RouterAbEd25519YaoBytes32V1;
+    readonly scope: RouterAbEd25519YaoLifecycleScopeV1;
+    readonly applicationBinding: RouterAbEd25519YaoApplicationBindingFactsV1;
+    readonly participantIds: readonly [number, number];
+    readonly registeredPublicKey: RouterAbEd25519YaoBytes32V1;
+    readonly runtimePolicyScope: RuntimePolicyScope;
+    readonly activationTranscript: RouterAbEd25519YaoBytes32V1;
+    readonly activationStateEpoch: number;
+    readonly signingWorkerVerifyingShare: RouterAbEd25519YaoBytes32V1;
+};
+//# sourceMappingURL=walletRecoveryPreparation.d.ts.map

package/dist/types/shared-ts/src/wallet-recovery/walletRecoveryTarget.d.ts

@@ -1,12 +1,11 @@
 import { type WebAuthnRpId } from '../utils/domainIds';
-export type WalletRecoveryTargetV1 = {
+import type { ReadonlyExclusiveUnion } from '../utils/variant';
+export type WalletRecoveryTargetV1 = ReadonlyExclusiveUnion<{
     readonly kind: 'passkey';
     readonly rpId: WebAuthnRpId;
-    readonly googleProvider?: never;
 } | {
     readonly kind: 'google_email_otp';
     readonly googleProvider: 'google';
-    readonly rpId?: never;
-};
+}>;
 export declare function parseWalletRecoveryTargetV1(raw: unknown): WalletRecoveryTargetV1;
 //# sourceMappingURL=walletRecoveryTarget.d.ts.map

package/dist/types/wallet-server/src/authorization/capabilityPolicy.d.ts

@@ -39,7 +39,6 @@ export interface CapabilityPolicyPort {
     parseEvidenceRequirement(value: unknown): ParseAuthorizationEvidenceRequirementResult;
     evaluateEvidenceRequirement(requirement: AuthorizationEvidenceRequirement, evidenceSet: VerifiedAuthorizationEvidenceSet): AuthorizationEvidenceRequirementEvaluation;
 }
-export declare function parseAuthorizationEvidenceRequirement(value: unknown): ParseAuthorizationEvidenceRequirementResult;
 export declare function evaluateAuthorizationEvidenceRequirement(requirement: AuthorizationEvidenceRequirement, evidenceSet: VerifiedAuthorizationEvidenceSet): AuthorizationEvidenceRequirementEvaluation;
 export declare const capabilityPolicyPort: CapabilityPolicyPort;
 //# sourceMappingURL=capabilityPolicy.d.ts.map

package/dist/types/wallet-server/src/authorization/domain.d.ts

@@ -1,4 +1,5 @@
-import type { WalletAuthMethodRecordV2 } from '../../../shared-ts/src/utils/registrationIntent';
+import type { Variant } from '../../../shared-ts/src/utils/variant';
+import type { ActiveWalletAuthMethodRecordV2, WalletAuthMethodRecordV2 } from '../../../shared-ts/src/utils/walletAuthMethodRecord';
 import { CAPABILITY_KINDS, EVM_ECDSA_MPC_OPERATION_KINDS, NEAR_ED25519_MPC_OPERATION_KINDS } from '../../../shared-ts/src/authorization/capabilityKinds';
 import type { CapabilityOperationRef, AuthorizationAuditEventId, AuthorizationGrantRef, AuthorizedOperationId, WalletSessionAuthorizationId, AuthorizationEvidenceId, AuthorizationEvidenceKind, HostedWalletSessionExchangeCodeId, MpcWalletSigningQuotaId, PrincipalId, WalletSessionMintId, TenantId, WalletSessionId } from '../../../shared-ts/src/authorization/capabilityKinds';
 export { parseMpcWalletSigningQuotaId, parseWalletSessionId, } from '../../../shared-ts/src/authorization/capabilityKinds';
@@ -8,7 +9,7 @@ import { type DomainId, type MpcMaterialActivationRef, type WalletAuthMethodId,
 import type { ProviderSubject, WebAuthnCredentialIdB64u } from '../../../shared-ts/src/utils/domainIds';
 import { type DigestB64u } from '../../../shared-ts/src/utils/canonicalPrimitives';
 import type { AuthFactorIdentity, WalletAuthAuthorityRef } from '../../../shared-ts/src/utils/walletAuthAuthority';
-import type { ActiveWalletAuthorityV1, WalletSignerActivationSetV1 } from '../../../shared-ts/src/authorization/walletAuthority';
+import type { ActiveWalletAuthorityV1, WalletAuthorityV1, WalletSignerActivationSetV1 } from '../../../shared-ts/src/authorization/walletAuthority';
 import { type ActiveWalletSessionV1, type WalletSessionOperationCredentialV1 } from '../../../shared-ts/src/device-linking';
 /** A server-only identity for one consumed owner authentication result. */
 export type VerifiedOwnerProofId = DomainId<'VerifiedOwnerProofId'>;
@@ -209,10 +210,14 @@ export type ExactWalletSessionQuotaProjectionV1 = {
 export type WalletSessionExactOperationContext = {
     readonly session: WalletSessionAuthorizationV2;
     readonly authority: ActiveWalletAuthorityV1;
-    readonly authMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly status: 'active';
-    }>;
+    readonly authMethod: ActiveWalletAuthMethodRecordV2;
     readonly retiredAtMs: null;
+    readonly ownerWalletScope: {
+        readonly orgId: string;
+        readonly projectId: string;
+        readonly projectEnvironmentId: string;
+        readonly walletId: WalletId;
+    };
 };
 /**
  * The digest-free exact status projection. Every branch that observed a stored
@@ -237,6 +242,32 @@ export type ExactWalletSessionStatusV2 = {
     readonly session?: never;
     readonly quota?: never;
 };
+/**
+ * A live session with the authority and auth method read in the same
+ * statement. Admission judges all three from one snapshot, so a commit that
+ * lands between separate reads cannot pair a session with a newer authority.
+ */
+export type WalletSessionAdmissionSnapshotV2 = {
+    readonly authority: WalletAuthorityV1 | null;
+    readonly authMethod: WalletAuthMethodRecordV2 | null;
+} & ({
+    readonly kind: 'active';
+    readonly authorization: IssuedWalletSessionAuthorizationV2;
+    readonly session?: never;
+    readonly quota?: never;
+} | {
+    readonly kind: 'exhausted';
+    readonly session: WalletSessionAuthorizationV2;
+    readonly quota: ExactWalletSessionQuotaProjectionV1;
+    readonly authorization?: never;
+});
+export type WalletSessionAdmissionSnapshotV2Variant<Kind extends WalletSessionAdmissionSnapshotV2['kind']> = Variant<WalletSessionAdmissionSnapshotV2, 'kind', Kind>;
+/** An exact status with the authority and auth method it was judged against. */
+export type ExactWalletSessionStatusSnapshotV2 = {
+    readonly status: ExactWalletSessionStatusV2;
+    readonly authority: WalletAuthorityV1 | null;
+    readonly authMethod: WalletAuthMethodRecordV2 | null;
+};
 export declare function buildExactWalletSessionQuotaProjectionV1(fields: Omit<ExactWalletSessionQuotaProjectionV1, 'kind'>): ExactWalletSessionQuotaProjectionV1;
 /**
  * Every capability subject must resolve through the authoritative active

package/dist/types/wallet-server/src/authorization/ecdsaWalletSessionAdmission.d.ts

@@ -0,0 +1,61 @@
+import type { EcdsaMaterialReadSnapshot } from '../core/ecdsaMaterialReadSnapshot';
+import type { CapabilityOperationEnvelope } from '../../../shared-ts/src/authorization/operationFingerprint';
+import type { Variant } from '../../../shared-ts/src/utils/variant';
+import type { AuthorizedOperation, AuthorizedOperationInput } from './domain';
+import type { AuthorizedOperationAdmissionRejection, EcdsaMaterialActivationScope } from './service';
+export type EcdsaWalletSessionAdmissionInput = {
+    readonly operation: AuthorizedOperationInput & {
+        readonly operation: CapabilityOperationEnvelope<{
+            readonly capabilityKind: 'evm_ecdsa_mpc_signing';
+            readonly operationKind: 'evm.sign_transaction';
+        }>;
+        readonly authorization: {
+            readonly kind: 'authorization_grant';
+        };
+        readonly quota: {
+            readonly kind: 'consume_reusable_wallet_session';
+        };
+    };
+    readonly material: EcdsaMaterialActivationScope & {
+        readonly readSnapshot: EcdsaMaterialReadSnapshot;
+    };
+};
+export type PinnedOwnerWalletScope = {
+    readonly orgId: string;
+    readonly projectId: string;
+    readonly projectEnvironmentId: string;
+};
+type EcdsaWalletSessionExistingOperation = {
+    readonly kind: 'operation_in_progress';
+    readonly operation: AuthorizedOperation;
+    readonly ownerScope: PinnedOwnerWalletScope;
+} | {
+    readonly kind: 'replayed';
+    readonly operation: AuthorizedOperation;
+    readonly ownerScope?: never;
+};
+type EcdsaWalletSessionAdmission = EcdsaWalletSessionExistingOperation | {
+    readonly kind: 'claimed';
+    readonly operation: AuthorizedOperation;
+    readonly ownerScope: PinnedOwnerWalletScope;
+};
+export type EcdsaWalletSessionAdmissionVariant<K extends EcdsaWalletSessionAdmission['kind']> = Variant<EcdsaWalletSessionAdmission, 'kind', K>;
+export type EcdsaWalletSessionResolutionResult = EcdsaWalletSessionExistingOperation | ((AuthorizedOperationAdmissionRejection | {
+    readonly kind: 'authorized_operation_missing';
+}) & {
+    readonly operation?: never;
+    readonly ownerScope?: never;
+});
+export type EcdsaWalletSessionAdmissionResult = EcdsaWalletSessionAdmission | (AuthorizedOperationAdmissionRejection & {
+    readonly operation?: never;
+    readonly ownerScope?: never;
+});
+export type EcdsaWalletSessionPhaseAdmission = {
+    readonly phase: 'prepare';
+    readonly admission: EcdsaWalletSessionAdmission;
+} | {
+    readonly phase: 'finalize';
+    readonly admission: EcdsaWalletSessionExistingOperation;
+};
+export {};
+//# sourceMappingURL=ecdsaWalletSessionAdmission.d.ts.map

package/dist/types/wallet-server/src/authorization/ecdsaWalletSessionAdmission.typecheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ecdsaWalletSessionAdmission.typecheck.d.ts.map

package/dist/types/wallet-server/src/authorization/factorEvidence.d.ts

@@ -56,12 +56,12 @@ type VerifiedWalletOperationFactorBinding = {
     readonly verifiedAtMs: number;
     readonly expiresAtMs: number;
 };
-export type VerifiedWalletOperationPasskeyFactorResult = VerifiedWalletOperationFactorBinding & {
+type VerifiedWalletOperationPasskeyFactorResult = VerifiedWalletOperationFactorBinding & {
     readonly kind: 'verified_wallet_operation_passkey_factor';
     readonly credentialIdB64u: WebAuthnCredentialIdB64u;
     readonly assertionDigest: DigestB64u;
 };
-export type VerifiedWalletOperationEmailOtpFactorResult = VerifiedWalletOperationFactorBinding & {
+type VerifiedWalletOperationEmailOtpFactorResult = VerifiedWalletOperationFactorBinding & {
     readonly kind: 'verified_wallet_operation_email_otp_factor';
     readonly challengeId: EmailOtpChallengeId;
     readonly verificationReceiptDigest: DigestB64u;
@@ -78,12 +78,12 @@ type VerifiedWalletSessionFactorBinding = {
     readonly verifiedAtMs: number;
     readonly expiresAtMs: number;
 };
-export type VerifiedWalletSessionPasskeyFactorResult = VerifiedWalletSessionFactorBinding & {
+type VerifiedWalletSessionPasskeyFactorResult = VerifiedWalletSessionFactorBinding & {
     readonly kind: 'verified_wallet_session_passkey_factor';
     readonly credentialIdB64u: WebAuthnCredentialIdB64u;
     readonly assertionDigest: DigestB64u;
 };
-export type VerifiedWalletSessionEmailOtpFactorResult = VerifiedWalletSessionFactorBinding & {
+type VerifiedWalletSessionEmailOtpFactorResult = VerifiedWalletSessionFactorBinding & {
     readonly kind: 'verified_wallet_session_email_otp_factor';
     readonly challengeId: EmailOtpChallengeId;
     readonly verificationReceiptDigest: DigestB64u;
@@ -110,7 +110,7 @@ export declare function buildVerifiedWalletSessionPasskeyFactorResult(fields: Om
 export declare function buildVerifiedWalletSessionEmailOtpFactorResult(fields: Omit<VerifiedWalletSessionEmailOtpFactorResult, 'kind'>): VerifiedWalletSessionEmailOtpFactorResult;
 /** Nominal server-only owner proofs; private constructors block browser forgery. */
 declare class VerifiedOwnerWalletSessionProof {
-    private readonly __proofBrand;
+    protected readonly __proofBrand = true;
     readonly kind: "verified_owner_proof_v1";
     readonly proofId: VerifiedOwnerProofId;
     readonly method: VerifiedOwnerProofMethod;
@@ -131,7 +131,7 @@ declare class VerifiedOwnerWalletSessionProof {
     }>);
 }
 declare class VerifiedOwnerOperationProof {
-    private readonly __proofBrand;
+    protected readonly __proofBrand = true;
     readonly kind: "verified_owner_proof_v1";
     readonly proofId: VerifiedOwnerProofId;
     readonly method: VerifiedOwnerProofMethod;
@@ -160,6 +160,5 @@ export declare function buildVerifiedOwnerProof(input: Extract<VerifiedOwnerProo
 }>): Promise<VerifiedOwnerOperationProof>;
 export declare function buildVerifiedOwnerProof(input: VerifiedOwnerProofInput): Promise<VerifiedOwnerProof>;
 export declare function buildVerifiedWalletOperationFactorEvidenceSet(input: VerifiedWalletOperationFactorEvidenceSetInput): Promise<VerifiedAuthorizationEvidenceSet>;
-export declare function parseVerifiedAuthorizationEvidenceSetFromPersistence(raw: unknown): VerifiedAuthorizationEvidenceSet;
 export {};
 //# sourceMappingURL=factorEvidence.d.ts.map