@seams/wallet-server 0.6.2 → 0.7.3

package/dist/types/wallet-server/src/core/RegistrationCeremonyStore.d.ts

@@ -1,10 +1,10 @@
 import type { EcdsaDerivationServerBootstrapResponse } from './types';
-import type { AddAuthMethodIntentGrant, AddAuthMethodIntentV1, AddSignerIntentGrant, AddSignerIntentV1, RegistrationIntentV1, WalletAddSignerStartResponse, WalletAddSignerFinalizeRequest, WalletAddAuthMethodFinalizeResponse, WalletAddSignerFinalizeResponse, WalletAddAuthMethodRegistrationOptions, WalletRegistrationStartResponse, WalletId } from './registrationContracts';
-import type { RegistrationAuthority, RegistrationSignerPlan, RegistrationSignerBranchKey } from '../../../shared-ts/src/utils/registrationIntent';
+import type { AddAuthMethodIntentGrant, AddAuthMethodIntentV1, AddSignerIntentGrant, AddSignerIntentV1, RegistrationIntentV1, WalletAddAuthMethodFinalizeSuccess, WalletAddSignerEcdsaPreparePayload, WalletAddSignerFinalizeRequest, WalletAddAuthMethodRegistrationOptions, WalletAddSignerFinalizeSuccess, WalletRegistrationEcdsaPreparePayload, WalletId } from './registrationContracts';
+import type { RegistrationSignerPlan, RegistrationSignerBranchKey } from '../../../shared-ts/src/utils/registrationSignerPlan';
+import type { RegistrationAuthority } from '../../../shared-ts/src/utils/registrationAuthMethodInput';
 import { type PasskeyCustodyEnvelopeRecord } from '../../../shared-ts/src/passkey-custody';
 import { type WalletAuthMethodId, type WalletAuthorityId } from '../../../shared-ts/src/utils/domainIds';
 import { type DeviceId } from '../../../shared-ts/src/authorization/capabilityKinds';
-import type { NormalizedLogger } from './logger';
 import { type DigestB64u } from '../../../shared-ts/src/utils/canonicalPrimitives';
 import type { RuntimePolicyScope } from '../../../shared-ts/src/threshold/signingRootScope';
 import { type ThresholdEcdsaChainTarget } from './thresholdEcdsaChainTarget';
@@ -25,7 +25,7 @@ export type StoredAddSignerIntent = {
     expiresAtMs: number;
     consumedAtMs?: never;
 };
-export type ConsumedAddSignerIntent = Omit<StoredAddSignerIntent, 'kind' | 'consumedAtMs'> & {
+type ConsumedAddSignerIntent = Omit<StoredAddSignerIntent, 'kind' | 'consumedAtMs'> & {
     kind: 'add_signer_intent_consumed';
     consumedAtMs: number;
 };
@@ -41,30 +41,20 @@ export type StoredAddAuthMethodIntent = {
     expiresAtMs: number;
     consumedAtMs?: never;
 };
-export type ConsumedAddAuthMethodIntent = Omit<StoredAddAuthMethodIntent, 'kind' | 'consumedAtMs'> & {
+type ConsumedAddAuthMethodIntent = Omit<StoredAddAuthMethodIntent, 'kind' | 'consumedAtMs'> & {
     kind: 'add_auth_method_intent_consumed';
     consumedAtMs: number;
 };
-export type StoredRegistrationWebAuthnCredential = {
-    credentialIdB64u: string;
-    credentialPublicKeyB64u: string;
-    counter: number;
-};
 export type StoredRegistrationAuthority = RegistrationAuthority;
-type WalletRegistrationEcdsaStartPayload = NonNullable<Extract<WalletRegistrationStartResponse, {
-    ok: true;
-}>['ecdsa']>;
-type WalletAddSignerEcdsaStartPayload = Omit<NonNullable<Extract<WalletAddSignerStartResponse, {
-    ok: true;
-}>['ecdsa']>, 'custodyEnvelope'>;
-export type StoredWalletRegistrationRuntimePolicyContext = {
+type WalletAddSignerEcdsaStartPayload = Omit<WalletAddSignerEcdsaPreparePayload, 'custodyEnvelope'>;
+type StoredWalletRegistrationRuntimePolicyContext = {
     kind: 'runtime_policy_scope';
     scope: RuntimePolicyScope;
 } | {
     kind: 'signing_root_only';
     scope?: never;
 };
-export type StoredWalletRegistrationEcdsaPreparedContext = {
+type StoredWalletRegistrationEcdsaPreparedContext = {
     kind: 'evm_family_ecdsa_requested';
     chainTargets: readonly ThresholdEcdsaChainTarget[];
 } | {
@@ -84,10 +74,9 @@ export declare function buildStoredWalletRegistrationPreparedContext(input: {
     runtimePolicyScope: RuntimePolicyScope | null;
     ecdsaChainTargets: readonly ThresholdEcdsaChainTarget[] | null;
 }): StoredWalletRegistrationPreparedContext;
-export declare function storedWalletRegistrationPreparedContextsMatch(left: StoredWalletRegistrationPreparedContext, right: StoredWalletRegistrationPreparedContext): boolean;
 export declare function storedRegistrationAuthoritiesMatch(left: StoredRegistrationAuthority, right: StoredRegistrationAuthority): boolean;
-type StoredEcdsaRegistrationBase = Omit<WalletRegistrationEcdsaStartPayload, 'kind'> & {
-    derivationKind: WalletRegistrationEcdsaStartPayload['kind'];
+type StoredEcdsaRegistrationBase = Omit<WalletRegistrationEcdsaPreparePayload, 'kind'> & {
+    derivationKind: WalletRegistrationEcdsaPreparePayload['kind'];
     strictRegistrationBindingJson: string;
 };
 export type StoredWalletRegistrationEvmFamilyEcdsaPreparedBranch = StoredEcdsaRegistrationBase & {
@@ -105,6 +94,9 @@ export type StoredWalletRegistrationEvmFamilyEcdsaResponseClaimedBranch = Stored
     kind: 'evm_family_ecdsa_response_claimed';
     branchKey: RegistrationSignerBranchKey;
     registrationRequest: RouterAbEcdsaRegistrationRequestV1;
+    projectEnvironmentId: string;
+    tenantRootIdentityDigestB64u: string;
+    tenantRootCustodyLineageB64u: string;
 };
 export type StoredWalletRegistrationEvmFamilyEcdsaActivationClaimedBranch = StoredEcdsaRegistrationBase & {
     kind: 'evm_family_ecdsa_activation_claimed';
@@ -137,9 +129,8 @@ export type StoredWalletRegistrationEvmFamilyEcdsaActivatedBranch = StoredEcdsaR
 /**
  * The ECDSA signer is durable and the wallet is usable. Reached only on a plan
  * that also has an Ed25519 branch: registration returns ECDSA-ready here and
- * the ceremony stays open for the Ed25519 finalize (Refactor 94 Phase 4+5).
- * On an ECDSA-only plan the ceremony is deleted instead, so this state never
- * appears.
+ * the ceremony stays open for the Ed25519 finalize. On an ECDSA-only plan the
+ * ceremony is deleted instead, so this state never appears.
  */
 export type StoredWalletRegistrationEvmFamilyEcdsaFinalizedBranch = StoredEcdsaRegistrationBase & {
     kind: 'evm_family_ecdsa_finalized';
@@ -161,7 +152,7 @@ export type StoredWalletRegistrationSignerSetState = {
     kind: 'signer_set_registration';
     branches: readonly StoredWalletRegistrationSignerBranch[];
 };
-export type StoredWalletRegistrationEvmFamilyEcdsaBranch = StoredWalletRegistrationEvmFamilyEcdsaPreparedBranch | StoredWalletRegistrationEvmFamilyEcdsaResponseClaimedBranch | StoredWalletRegistrationEvmFamilyEcdsaPendingActivationBranch | StoredWalletRegistrationEvmFamilyEcdsaActivationClaimedBranch | StoredWalletRegistrationEvmFamilyEcdsaActivatedBranch | StoredWalletRegistrationEvmFamilyEcdsaFinalizedBranch;
+type StoredWalletRegistrationEvmFamilyEcdsaBranch = StoredWalletRegistrationEvmFamilyEcdsaPreparedBranch | StoredWalletRegistrationEvmFamilyEcdsaResponseClaimedBranch | StoredWalletRegistrationEvmFamilyEcdsaPendingActivationBranch | StoredWalletRegistrationEvmFamilyEcdsaActivationClaimedBranch | StoredWalletRegistrationEvmFamilyEcdsaActivatedBranch | StoredWalletRegistrationEvmFamilyEcdsaFinalizedBranch;
 export declare function buildStoredWalletRegistrationEvmFamilyEcdsaFinalizedBranch(input: {
     readonly activated: StoredWalletRegistrationEvmFamilyEcdsaActivatedBranch;
     readonly finalizedAtMs: number;
@@ -186,7 +177,7 @@ export declare function replaceStoredWalletRegistrationSignerBranch(input: {
     readonly state: StoredWalletRegistrationSignerSetState;
     readonly replacement: StoredWalletRegistrationSignerBranch;
 }): StoredWalletRegistrationSignerSetState;
-export type StoredWalletRegistrationFailed = {
+type StoredWalletRegistrationFailed = {
     kind: 'registration_failed';
     failedAtMs: number;
     failure: {
@@ -201,10 +192,9 @@ export type StoredWalletRegistrationFailed = {
     responded?: never;
     completed?: never;
 };
-export type StoredWalletRegistrationSignerState = StoredWalletRegistrationSignerSetState | StoredWalletRegistrationFailed;
+type StoredWalletRegistrationSignerState = StoredWalletRegistrationSignerSetState | StoredWalletRegistrationFailed;
 /**
- * Refactor 94C. A registration ceremony now exists before its authority proof
- * does.
+ * A registration ceremony exists before its authority proof does.
  *
  * `/wallets/register/setup` issues the challenge the client's WebAuthn create
  * must sign, so the ceremony — and the Router preparation work bound to it —
@@ -254,7 +244,6 @@ export type StoredWalletRegistrationCeremony = StoredWalletRegistrationCeremonyB
 export declare function verifiedRegistrationCeremonyAuthority(ceremony: {
     readonly authorityState: StoredWalletRegistrationCeremonyAuthorityState;
 }): StoredRegistrationAuthority | null;
-export declare function registrationCeremonyAuthorityRpId(authorityState: StoredWalletRegistrationCeremonyAuthorityState): string | null;
 export type TerminalRegistrationCeremonyCancellationResult = {
     kind: 'cancelled';
     ceremonyDeleted: true;
@@ -262,11 +251,10 @@ export type TerminalRegistrationCeremonyCancellationResult = {
     kind: 'not_found';
     ceremonyDeleted: false;
 };
-export declare function parseTerminalRegistrationCeremonyCancellationResult(value: unknown): TerminalRegistrationCeremonyCancellationResult | null;
 type StoredEcdsaAddSignerBase = Omit<WalletAddSignerEcdsaStartPayload, 'kind'> & {
     derivationKind: WalletAddSignerEcdsaStartPayload['kind'];
 };
-export type StoredEcdsaAddSignerPrepared = StoredEcdsaAddSignerBase & {
+type StoredEcdsaAddSignerPrepared = StoredEcdsaAddSignerBase & {
     kind: 'ecdsa_add_signer_prepared';
     pendingActivation?: never;
     publicResponse?: never;
@@ -274,7 +262,7 @@ export type StoredEcdsaAddSignerPrepared = StoredEcdsaAddSignerBase & {
     activation?: never;
     bootstrap?: never;
 };
-export type StoredEcdsaAddSignerPendingActivation = StoredEcdsaAddSignerBase & {
+type StoredEcdsaAddSignerPendingActivation = StoredEcdsaAddSignerBase & {
     kind: 'ecdsa_add_signer_pending_activation';
     registrationRequest: RouterAbEcdsaRegistrationRequestV1;
     pendingActivation: RouterAbEcdsaPendingActivationV1;
@@ -313,7 +301,7 @@ export type StoredEcdsaAddSignerActivated = StoredEcdsaAddSignerBase & {
     publicCapability: RouterAbEcdsaDerivationPublicCapabilityV1;
     bootstrap: EcdsaDerivationServerBootstrapResponse;
 };
-export type StoredEd25519YaoAddSignerAuthorized = {
+type StoredEd25519YaoAddSignerAuthorized = {
     kind: 'near_ed25519_yao_add_signer_authorized';
     admissionRequest: RouterAbEd25519YaoRegistrationAdmissionRequestV1;
 };
@@ -327,14 +315,12 @@ export type StoredEd25519YaoAddSignerActivation = {
         result: RouterAbEd25519YaoActivationResultV1<'registration'>;
     };
 };
-export type StoredEd25519YaoAddSignerActivated = StoredEd25519YaoAddSignerActivation & {
+type StoredEd25519YaoAddSignerActivated = StoredEd25519YaoAddSignerActivation & {
     kind: 'near_ed25519_yao_add_signer_activated';
 };
-export type StoredEd25519YaoAddSignerFinalizing = StoredEd25519YaoAddSignerActivation & {
+type StoredEd25519YaoAddSignerFinalizing = StoredEd25519YaoAddSignerActivation & {
     kind: 'near_ed25519_yao_add_signer_finalizing';
-    response: Extract<Extract<WalletAddSignerFinalizeResponse, {
-        ok: true;
-    }>, {
+    response: Extract<WalletAddSignerFinalizeSuccess, {
         kind: 'near_ed25519';
     }>;
     signer: WalletEd25519SignerRecord;
@@ -361,14 +347,12 @@ export type StoredWalletAddSignerFinalizeReplay = {
     addSignerCeremonyId: string;
     idempotencyKey: string;
     request: StoredWalletAddSignerFinalizeRequest;
-    response: Extract<WalletAddSignerFinalizeResponse, {
-        ok: true;
-    }>;
+    response: WalletAddSignerFinalizeSuccess;
     createdAtMs: number;
     expiresAtMs: number;
 };
 /**
- * Refactor 103 Phase 8: an add-auth-method finalize that already succeeded.
+ * An add-auth-method finalize that already succeeded.
  *
  * Finalize consumes its ceremony, so a client that lost the response has no way
  * to ask again — the ceremony is gone and the credential is already registered.
@@ -385,9 +369,7 @@ export type StoredWalletAddAuthMethodFinalizeReplay = {
     kind: 'wallet_add_auth_method_finalize_replay_v1';
     addAuthMethodCeremonyId: string;
     requestDigestB64u: string;
-    response: Extract<WalletAddAuthMethodFinalizeResponse, {
-        ok: true;
-    }>;
+    response: WalletAddAuthMethodFinalizeSuccess;
     createdAtMs: number;
     expiresAtMs: number;
 };
@@ -453,7 +435,7 @@ export type StoredWalletAddAuthMethodCeremony = (StoredWalletAddAuthMethodCeremo
      * The SOURCE method's envelope, exactly as the passkey branch below
      * carries it.
      *
-     * Refactor 109C adds Email OTP to a wallet that already holds its custody
+     * This ceremony adds Email OTP to a wallet that already holds its custody
      * seed, so the browser has to open this envelope with the source factor
      * and reseal the same seed under the new Email OTP factor. Without it the
      * ceremony could only ever create an auth method that unlocks nothing.
@@ -499,51 +481,8 @@ export interface RegistrationCeremonyStore {
     updateAddAuthMethodCeremony(ceremony: StoredWalletAddAuthMethodCeremony): Promise<void>;
     takeAddAuthMethodCeremony(addAuthMethodCeremonyId: string): Promise<StoredWalletAddAuthMethodCeremony | null>;
 }
-export declare class MemoryRegistrationCeremonyStore implements RegistrationCeremonyStore {
-    private readonly addAuthMethodIntents;
-    private readonly addSignerIntents;
-    private readonly ceremonies;
-    private readonly addSignerFinalizeReplays;
-    private readonly addSignerFinalizeReplayClaims;
-    private readonly addAuthMethodCeremonies;
-    private readonly addSignerCeremonies;
-    putAddAuthMethodIntent(intent: StoredAddAuthMethodIntent): Promise<void>;
-    getAddAuthMethodIntent(grant: AddAuthMethodIntentGrant): Promise<StoredAddAuthMethodIntent | null>;
-    takeAddAuthMethodIntent(grant: AddAuthMethodIntentGrant): Promise<ConsumedAddAuthMethodIntent | null>;
-    putAddSignerIntent(intent: StoredAddSignerIntent): Promise<void>;
-    getAddSignerIntent(grant: AddSignerIntentGrant): Promise<StoredAddSignerIntent | null>;
-    takeAddSignerIntent(grant: AddSignerIntentGrant): Promise<ConsumedAddSignerIntent | null>;
-    putCeremony(ceremony: StoredWalletRegistrationCeremony): Promise<void>;
-    getCeremony(registrationCeremonyId: string): Promise<StoredWalletRegistrationCeremony | null>;
-    updateCeremony(ceremony: StoredWalletRegistrationCeremony): Promise<void>;
-    takeCeremony(registrationCeremonyId: string): Promise<StoredWalletRegistrationCeremony | null>;
-    cancelTerminalCeremony(input: {
-        registrationCeremonyId: string;
-        walletId: WalletId;
-    }): Promise<TerminalRegistrationCeremonyCancellationResult>;
-    putAddSignerFinalizeReplay(replay: StoredWalletAddSignerFinalizeReplay): Promise<void>;
-    getAddSignerFinalizeReplay(input: {
-        addSignerCeremonyId: string;
-        idempotencyKey: string;
-    }): Promise<StoredWalletAddSignerFinalizeReplay | null>;
-    getAddSignerFinalizeReplayForCeremony(addSignerCeremonyId: string): Promise<StoredWalletAddSignerFinalizeReplay | null>;
-    putAddAuthMethodCeremony(ceremony: StoredWalletAddAuthMethodCeremony): Promise<void>;
-    getAddAuthMethodCeremony(addAuthMethodCeremonyId: string): Promise<StoredWalletAddAuthMethodCeremony | null>;
-    updateAddAuthMethodCeremony(ceremony: StoredWalletAddAuthMethodCeremony): Promise<void>;
-    takeAddAuthMethodCeremony(addAuthMethodCeremonyId: string): Promise<StoredWalletAddAuthMethodCeremony | null>;
-    putAddSignerCeremony(ceremony: StoredWalletAddSignerCeremony): Promise<void>;
-    getAddSignerCeremony(addSignerCeremonyId: string): Promise<StoredWalletAddSignerCeremony | null>;
-    updateAddSignerCeremony(ceremony: StoredWalletAddSignerCeremony): Promise<void>;
-    takeAddSignerCeremony(addSignerCeremonyId: string): Promise<StoredWalletAddSignerCeremony | null>;
-    private pruneExpired;
-}
 export declare function parseStoredRegistrationSignerPlan(value: unknown): RegistrationSignerPlan | null;
 export declare function parseStoredWalletRegistrationPreparedContext(value: unknown): StoredWalletRegistrationPreparedContext | null;
 export declare function storedRegistrationSignerPlansMatch(left: RegistrationSignerPlan, right: RegistrationSignerPlan): boolean;
-export declare function createRegistrationCeremonyStore(input?: {
-    config?: unknown;
-    logger?: NormalizedLogger;
-    isNode?: boolean;
-}): RegistrationCeremonyStore;
 export {};
 //# sourceMappingURL=RegistrationCeremonyStore.d.ts.map

package/dist/types/wallet-server/src/core/ThresholdService/config.d.ts

@@ -1,17 +1,5 @@
 export type ThresholdNodeRole = 'cosigner' | 'coordinator';
 export declare function coerceThresholdNodeRole(input: unknown): ThresholdNodeRole;
-export type ThresholdRelayerCosignerPeer = {
-    cosignerId: number;
-    relayerUrl: string;
-};
-export type ThresholdCoordinatorPeer = {
-    instanceId: string;
-    relayerUrl: string;
-};
-export declare function parseThresholdRelayerCosigners(input: unknown): ThresholdRelayerCosignerPeer[] | null;
-export declare function parseThresholdCoordinatorPeers(input: unknown): ThresholdCoordinatorPeer[] | null;
-export declare function parseThresholdRelayerCosignerThreshold(input: unknown): number | null;
-export declare function parseThresholdCoordinatorSharedSecretBytes(input: unknown): Uint8Array | null;
 export declare function parseThresholdEd25519ParticipantIds2p(input: {
     THRESHOLD_ED25519_CLIENT_PARTICIPANT_ID?: unknown;
     THRESHOLD_ED25519_RELAYER_PARTICIPANT_ID?: unknown;

package/dist/types/wallet-server/src/core/ThresholdService/routerAb/ecdsaDerivationPoolFillHandlers.d.ts

@@ -3,20 +3,28 @@ import type { RouterAbEcdsaDerivationPoolFillInitRequest, RouterAbEcdsaDerivatio
 import { type RuntimePolicyScope } from '../../../../../shared-ts/src/threshold/signingRootScope';
 import type { ThresholdNodeRole } from '../config';
 import { type RouterAbEcdsaDerivationPresignaturePoolFillAuth } from './ecdsaDerivationPresignBridge';
-type RouterAbEcdsaDerivationPoolFillBinding = {
+export type RouterAbEcdsaOwnerWalletScope = {
+    readonly orgId: string;
+    readonly projectId: string;
+    readonly projectEnvironmentId: string;
+    readonly walletId: string;
+};
+export type RouterAbEcdsaDerivationPoolFillBinding = {
     readonly walletId: string;
     readonly relayerKeyId: string;
     readonly keyHandle: string;
     readonly runtimePolicyScope: RuntimePolicyScope;
     readonly participantIds: readonly [number, number];
     readonly thresholdExpiresAtMs: number;
+    readonly routerAbEcdsaDerivationNormalSigning: RouterAbEcdsaDerivationNormalSigningStateV1;
+    /** The wallet whose pool this fill admits into, for either authority. */
+    readonly ownerWalletScope: RouterAbEcdsaOwnerWalletScope;
     readonly authorization: {
         readonly kind: 'wallet_session';
     } | {
         readonly kind: 'operation_step_up';
         readonly materialExpiresAtMs: number;
     };
-    readonly routerAbEcdsaDerivationNormalSigning: RouterAbEcdsaDerivationNormalSigningStateV1;
 };
 export declare function resolveRouterAbEcdsaPresignDeadlines(input: {
     readonly requestedCeremonyExpiresAtMs: number;
@@ -57,5 +65,4 @@ export declare class RouterAbEcdsaDerivationPoolFillHandlers {
         readonly request: RouterAbEcdsaDerivationPoolFillStepRequest;
     }): Promise<RouterAbEcdsaDerivationPoolFillStepResponse>;
 }
-export {};
 //# sourceMappingURL=ecdsaDerivationPoolFillHandlers.d.ts.map

package/dist/types/wallet-server/src/core/ThresholdService/routerAb/ecdsaDerivationPresignBridge.d.ts

@@ -1,59 +1,27 @@
-import { type CloudflareSigningWorkerEcdsaDerivationPresignaturePoolPutReceiptV1Wire, type CloudflareSigningWorkerEcdsaDerivationPresignaturePoolPutRequestV1Wire, type RouterAbEcdsaDerivationServerPresignatureShareV1, type RouterAbEcdsaDerivationNormalSigningScopeV1, type RouterAbEcdsaSigningWorkerExportShareBindingV1, type RouterAbEcdsaSigningWorkerExportShareEnvelopeV1 } from '../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
+import { type RouterAbEcdsaDerivationNormalSigningScopeV1, type RouterAbEcdsaSigningWorkerExportShareBindingV1, type RouterAbEcdsaSigningWorkerExportShareEnvelopeV1 } from '../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
 export { ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1 } from './internalServiceHttp';
-export declare const CLOUDFLARE_SIGNING_WORKER_ECDSA_DERIVATION_PRESIGNATURE_POOL_PUT_PATH: "/router-ab/signing-worker/ecdsa-derivation/presignature-pool/put";
-export declare const CLOUDFLARE_SIGNING_WORKER_ECDSA_PRESIGN_SESSION_INIT_PATH: "/router-ab/signing-worker/ecdsa-derivation/presignature-session/init";
-export declare const CLOUDFLARE_SIGNING_WORKER_ECDSA_PRESIGN_SESSION_STEP_PATH: "/router-ab/signing-worker/ecdsa-derivation/presignature-session/step";
-export declare const CLOUDFLARE_SIGNING_WORKER_ECDSA_LINKED_PRESIGN_SESSION_INIT_PATH: "/router-ab/signing-worker/ecdsa-derivation/linked-device/presignature-session/init";
-export declare const CLOUDFLARE_SIGNING_WORKER_ECDSA_LINKED_PRESIGN_SESSION_STEP_PATH: "/router-ab/signing-worker/ecdsa-derivation/linked-device/presignature-session/step";
-export declare const CLOUDFLARE_SIGNING_WORKER_ECDSA_LINKED_EXPORT_SHARE_PATH: "/router-ab/signing-worker/ecdsa-derivation/linked-device/export-share";
-export type RouterAbEcdsaDerivationPresignaturePoolFillInput = {
-    scope: RouterAbEcdsaDerivationNormalSigningScopeV1;
-    presignature: RouterAbEcdsaDerivationServerPresignatureShareV1;
-    materialExpiresAtMs: number;
-};
-export declare function buildRouterAbEcdsaDerivationPresignaturePoolPutRequest(input: RouterAbEcdsaDerivationPresignaturePoolFillInput): CloudflareSigningWorkerEcdsaDerivationPresignaturePoolPutRequestV1Wire;
 export type RouterAbEcdsaDerivationPresignaturePoolFillAuth = {
     kind: 'internal_service_auth_secret';
     secret: string;
 };
-export type RouterAbEcdsaDerivationPresignaturePoolFillHttpInput = {
-    signingWorkerBaseUrl: string;
-    request: CloudflareSigningWorkerEcdsaDerivationPresignaturePoolPutRequestV1Wire;
-    auth: RouterAbEcdsaDerivationPresignaturePoolFillAuth;
-    fetchImpl: typeof fetch;
-};
-export type RouterAbEcdsaDerivationPresignaturePoolFillHttpResult = {
-    ok: true;
-    status: number;
-    receipt: CloudflareSigningWorkerEcdsaDerivationPresignaturePoolPutReceiptV1Wire & {
-        stored: true;
+export type RouterAbEcdsaPresignAuthorityV1 = {
+    readonly kind: 'owner_wallet_session';
+    readonly wallet_scope: {
+        readonly org_id: string;
+        readonly project_id: string;
+        readonly project_environment_id: string;
+        readonly wallet_id: string;
     };
 } | {
-    ok: false;
-    code: 'already_exists';
-    message: string;
-    status: number;
-    receipt: CloudflareSigningWorkerEcdsaDerivationPresignaturePoolPutReceiptV1Wire & {
-        stored: false;
+    readonly kind: 'operation_step_up';
+    readonly wallet_scope: {
+        readonly org_id: string;
+        readonly project_id: string;
+        readonly project_environment_id: string;
+        readonly wallet_id: string;
     };
-} | {
-    ok: false;
-    code: 'http_error';
-    message: string;
-    status: number;
-    bodyText: string;
-} | {
-    ok: false;
-    code: 'invalid_response';
-    message: string;
-    status: number;
-    bodyText: string;
-} | {
-    ok: false;
-    code: 'network_error';
-    message: string;
 };
-export type RouterAbEcdsaPresignSessionProgress = {
+type RouterAbEcdsaPresignSessionProgress = {
     kind: 'continue';
     presignSessionId: string;
     stage: 'triples' | 'triples_done' | 'presign';
@@ -95,6 +63,7 @@ export declare function exportRouterAbLinkedDeviceEcdsaShare(input: {
 export declare function startRouterAbEcdsaPresignSession(input: {
     signingWorkerBaseUrl: string;
     scope: RouterAbEcdsaDerivationNormalSigningScopeV1;
+    authority: RouterAbEcdsaPresignAuthorityV1;
     presignSessionId: string;
     firstMessageB64u: string;
     ceremonyExpiresAtMs: number;
@@ -106,6 +75,7 @@ export declare function startRouterAbEcdsaPresignSession(input: {
 export declare function stepRouterAbEcdsaPresignSession(input: {
     signingWorkerBaseUrl: string;
     scope: RouterAbEcdsaDerivationNormalSigningScopeV1;
+    authority: RouterAbEcdsaPresignAuthorityV1;
     presignSessionId: string;
     requestedStage: 'triples' | 'presign';
     outgoingMessagesB64u: string[];
@@ -140,5 +110,4 @@ export declare function stepRouterAbLinkedDeviceEcdsaPresignSession(input: {
     auth: RouterAbEcdsaDerivationPresignaturePoolFillAuth;
     fetchImpl: typeof fetch;
 }): Promise<RouterAbEcdsaPresignSessionHttpResult>;
-export declare function putRouterAbEcdsaDerivationPresignaturePoolFill(input: RouterAbEcdsaDerivationPresignaturePoolFillHttpInput): Promise<RouterAbEcdsaDerivationPresignaturePoolFillHttpResult>;
 //# sourceMappingURL=ecdsaDerivationPresignBridge.d.ts.map

package/dist/types/wallet-server/src/core/ThresholdService/routerAb/internalServiceHttp.d.ts

@@ -1,5 +1,5 @@
 export declare const ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1 = "x-router-ab-internal-service-auth";
-export type RouterAbInternalServiceJsonResult = {
+type RouterAbInternalServiceJsonResult = {
     ok: true;
     status: number;
     bodyText: string;
@@ -28,4 +28,5 @@ export declare function postRouterAbInternalServiceJson(input: {
     fetchImpl: typeof fetch;
     onServerTiming?: (header: string | null) => void;
 }): Promise<RouterAbInternalServiceJsonResult>;
+export {};
 //# sourceMappingURL=internalServiceHttp.d.ts.map

package/dist/types/wallet-server/src/core/ThresholdService/stores/CloudflareDurableObjectStore.d.ts

@@ -1,74 +1,8 @@
 import type { NormalizedLogger } from '../../logger';
-import type { CloudflareDurableObjectNamespaceLike, ThresholdStoreConfigInput } from '../../types';
-import type { WalletSessionReplayGuardResult, WalletSessionConsumeUsesResult, EcdsaWalletSessionStore, Ed25519WalletSessionStore, WalletSessionRecord, WalletSessionRecordParser, WalletSessionStore, WalletSessionStatusLookupResult } from './WalletSessionStore';
-import type { ThresholdEd25519ReadyKeyRecord, ThresholdEd25519KeyStore } from './KeyStore';
-import type { ThresholdEd25519CoordinatorSigningSessionRecord, ThresholdEcdsaSessionStore, ThresholdMpcSessionRecord, ThresholdClaimMpcSessionResult, ThresholdEd25519MpcSessionRecord, ThresholdReadMpcSessionResult, ThresholdEd25519SessionStore, ThresholdEd25519SigningSessionRecord } from './SessionStore';
-export declare class CloudflareDurableObjectWalletSessionStore<TRecord extends WalletSessionRecord> implements WalletSessionStore<TRecord> {
-    private readonly stub;
-    private readonly keyPrefix;
-    private readonly parseRecord;
-    constructor(input: {
-        namespace: CloudflareDurableObjectNamespaceLike;
-        objectName: string;
-        keyPrefix: string;
-        parseRecord: WalletSessionRecordParser<TRecord>;
-    });
-    private key;
-    private replayGuardKey;
-    putSession(id: string, record: TRecord, opts: {
-        ttlMs: number;
-        remainingUses: number;
-    }): Promise<void>;
-    getSession(id: string): Promise<TRecord | null>;
-    getSessionStatus(id: string): Promise<WalletSessionStatusLookupResult<TRecord>>;
-    consumeUseCount(id: string): Promise<WalletSessionConsumeUsesResult>;
-    consumeUseCountOnce(id: string, idempotencyKey: string): Promise<WalletSessionConsumeUsesResult>;
-    hasConsumedUseCountOnce(id: string, idempotencyKey: string): Promise<{
-        ok: true;
-        consumed: boolean;
-    } | {
-        ok: false;
-        code: string;
-        message: string;
-    }>;
-    reserveReplayGuard(scopeId: string, replayKey: string, expiresAtMs: number): Promise<WalletSessionReplayGuardResult>;
-}
-type CloudflareDoMpcSessionRecordParser<TRecord extends ThresholdMpcSessionRecord> = (raw: unknown) => TRecord | null;
-export declare class CloudflareDurableObjectThresholdEd25519SessionStore<TMpcRecord extends ThresholdMpcSessionRecord = ThresholdEd25519MpcSessionRecord> {
-    private readonly stub;
-    private readonly keyPrefix;
-    private readonly coordinatorPrefix;
-    private readonly parseMpcSessionRecord;
-    constructor(input: {
-        namespace: CloudflareDurableObjectNamespaceLike;
-        objectName: string;
-        keyPrefix: string;
-        parseMpcSessionRecord?: CloudflareDoMpcSessionRecordParser<TMpcRecord>;
-    });
-    private key;
-    private coordKey;
-    putMpcSession(id: string, record: TMpcRecord, ttlMs: number): Promise<void>;
-    readMpcSession(id: string): Promise<ThresholdReadMpcSessionResult<TMpcRecord> | null>;
-    claimMpcSession(id: string, version: string): Promise<ThresholdClaimMpcSessionResult<TMpcRecord>>;
-    takeMpcSession(id: string): Promise<TMpcRecord | null>;
-    putSigningSession(id: string, record: ThresholdEd25519SigningSessionRecord, ttlMs: number): Promise<void>;
-    takeSigningSession(id: string): Promise<ThresholdEd25519SigningSessionRecord | null>;
-    putCoordinatorSigningSession(id: string, record: ThresholdEd25519CoordinatorSigningSessionRecord, ttlMs: number): Promise<void>;
-    takeCoordinatorSigningSession(id: string): Promise<ThresholdEd25519CoordinatorSigningSessionRecord | null>;
-}
-export declare class CloudflareDurableObjectThresholdEd25519KeyStore implements ThresholdEd25519KeyStore {
-    private readonly stub;
-    private readonly keyPrefix;
-    constructor(input: {
-        namespace: CloudflareDurableObjectNamespaceLike;
-        objectName: string;
-        keyPrefix: string;
-    });
-    private key;
-    get(relayerKeyId: string): Promise<ThresholdEd25519ReadyKeyRecord | null>;
-    put(relayerKeyId: string, record: ThresholdEd25519ReadyKeyRecord): Promise<void>;
-    del(relayerKeyId: string): Promise<void>;
-}
+import type { ThresholdStoreConfigInput } from '../../types';
+import type { EcdsaWalletSessionStore, Ed25519WalletSessionStore } from './WalletSessionStore';
+import type { ThresholdEd25519KeyStore } from './KeyStore';
+import type { ThresholdEcdsaSessionStore, ThresholdEd25519SessionStore } from './SessionStore';
 export declare function createCloudflareDurableObjectThresholdEd25519Stores(input: {
     config?: ThresholdStoreConfigInput | null;
     logger: NormalizedLogger;
@@ -84,5 +18,4 @@ export declare function createCloudflareDurableObjectThresholdEcdsaStores(input:
     sessionStore: ThresholdEcdsaSessionStore;
     walletSessionStore: EcdsaWalletSessionStore;
 } | null;
-export {};
 //# sourceMappingURL=CloudflareDurableObjectStore.d.ts.map

package/dist/types/wallet-server/src/core/ThresholdService/stores/KeyStore.d.ts

@@ -1,6 +1,6 @@
 import type { NormalizedLogger } from '../../logger';
 import type { ThresholdEd25519AuthorityScope, ThresholdStoreConfigInput } from '../../types';
-export type ThresholdEd25519ProvisioningKeyRecord = {
+type ThresholdEd25519ProvisioningKeyRecord = {
     kind: 'provisioning';
     walletId: string;
     nearAccountId: string;
@@ -36,4 +36,5 @@ export declare function createThresholdEd25519KeyStore(input: {
     logger: NormalizedLogger;
     isNode: boolean;
 }): ThresholdEd25519KeyStore;
+export {};
 //# sourceMappingURL=KeyStore.d.ts.map

package/dist/types/wallet-server/src/core/ThresholdService/stores/SessionStore.d.ts

@@ -76,7 +76,7 @@ export type ThresholdEd25519CoordinatorSigningSessionRecord = {
     cosignerCoordinatorGrantsById: Record<string, string>;
     relayerVerifyingSharesById: Record<string, string>;
 };
-export interface ThresholdMpcSessionStore<TRecord extends ThresholdMpcSessionRecord> {
+interface ThresholdMpcSessionStore<TRecord extends ThresholdMpcSessionRecord> {
     putMpcSession(id: string, record: TRecord, ttlMs: number): Promise<void>;
     readMpcSession(id: string): Promise<ThresholdReadMpcSessionResult<TRecord> | null>;
     claimMpcSession(id: string, version: string): Promise<ThresholdClaimMpcSessionResult<TRecord>>;
@@ -94,9 +94,5 @@ export declare function createThresholdEd25519SessionStore(input: {
     logger: NormalizedLogger;
     isNode: boolean;
 }): ThresholdEd25519SessionStore;
-export declare function createThresholdEcdsaSessionStore(input: {
-    config?: ThresholdStoreConfigInput | null;
-    logger: NormalizedLogger;
-    isNode: boolean;
-}): ThresholdEcdsaSessionStore;
+export {};
 //# sourceMappingURL=SessionStore.d.ts.map

package/dist/types/wallet-server/src/core/ThresholdService/stores/StoreConfig.d.ts

@@ -1,3 +1,4 @@
-export type NonDurableObjectThresholdStoreKind = 'in-memory' | 'upstash-redis-rest' | 'redis-tcp';
+type NonDurableObjectThresholdStoreKind = 'in-memory' | 'upstash-redis-rest' | 'redis-tcp';
 export declare function readNonDurableObjectThresholdStoreKind(config: Record<string, unknown>, storeLabel: string): NonDurableObjectThresholdStoreKind | null;
+export {};
 //# sourceMappingURL=StoreConfig.d.ts.map

package/dist/types/wallet-server/src/core/ThresholdService/stores/WalletSessionStore.d.ts

@@ -12,7 +12,7 @@ export type Ed25519WalletSessionRecord = {
     authorityScope: ThresholdEd25519AuthorityScope;
     participantIds: number[];
 } & Partial<ThresholdEcdsaSigningRootMetadata>;
-type EcdsaWalletSessionRecordCore = {
+export type EcdsaWalletSessionRecordCore = {
     expiresAtMs: number;
     relayerKeyId: string;
     walletId: string;
@@ -34,7 +34,7 @@ export type WalletSessionConsumeUsesResult = {
     code: string;
     message: string;
 };
-export type WalletSessionConsumedUseResult = {
+type WalletSessionConsumedUseResult = {
     ok: true;
     consumed: boolean;
 } | {
@@ -61,8 +61,6 @@ export type WalletSessionStatusLookupResult<TRecord extends WalletSessionRecord>
     ok: false;
     code: Extract<WalletSessionFailureCode, typeof WALLET_SESSION_FAILURE_CODES.missing | typeof WALLET_SESSION_FAILURE_CODES.expired | typeof WALLET_SESSION_FAILURE_CODES.unavailable>;
 };
-export type Ed25519WalletSessionStatus = WalletSessionStatus<Ed25519WalletSessionRecord>;
-export type EcdsaWalletSessionStatus = WalletSessionStatus<EcdsaWalletSessionRecord>;
 export interface WalletSessionStore<TRecord extends WalletSessionRecord> {
     putSession(id: string, record: TRecord, opts: {
         ttlMs: number;

package/dist/types/wallet-server/src/core/ThresholdService/stores/exportReplayGuard.d.ts

@@ -0,0 +1,3 @@
+export declare const EXPORT_REPLAY_GUARD_CLOCK_SKEW_MS: number;
+export declare const EXPORT_REPLAY_GUARD_MIN_RETENTION_MS: number;
+//# sourceMappingURL=exportReplayGuard.d.ts.map