@seams/wallet-server 0.7.1 → 0.7.3

package/dist/types/shared-ts/src/utils/webauthnDeviceInfo.d.ts

@@ -10,8 +10,8 @@
  * Stored on the authenticator row and returned by the authenticators listing
  * so profile UIs can label signers ("Chrome on macOS", "iCloud Keychain").
  */
-type WebAuthnDeviceBrowser = 'chrome' | 'safari' | 'firefox' | 'edge' | 'other';
-type WebAuthnDeviceOs = 'macos' | 'ios' | 'windows' | 'android' | 'linux' | 'other';
+type WebAuthnDeviceBrowser = (typeof WEBAUTHN_DEVICE_BROWSERS)[number];
+type WebAuthnDeviceOs = (typeof WEBAUTHN_DEVICE_OSES)[number];
 export type WebAuthnAuthenticatorDeviceInfo = {
     /** Display-ready label, e.g. "Chrome on macOS". Never empty. */
     label: string;
@@ -26,6 +26,8 @@ export type WebAuthnAuthenticatorDeviceInfo = {
     /** Display name for the provider, e.g. "iCloud Keychain". */
     providerLabel?: string;
 };
+declare const WEBAUTHN_DEVICE_BROWSERS: readonly ["chrome", "safari", "firefox", "edge", "other"];
+declare const WEBAUTHN_DEVICE_OSES: readonly ["macos", "ios", "windows", "android", "linux", "other"];
 export declare function deriveWebAuthnAuthenticatorDeviceInfo(input: {
     userAgent?: string;
     aaguid?: string;

package/dist/types/shared-ts/src/wallet-recovery/recoveryEnvelopes.d.ts

@@ -1,4 +1,5 @@
 import type { RecoveryCodeReservationId } from './recoveryCodeReservation';
+import type { ExclusiveUnion } from '../utils/variant';
 /**
  * Lifecycle of one recovery code.
  *
@@ -6,37 +7,23 @@ import type { RecoveryCodeReservationId } from './recoveryCodeReservation';
  * commits only after the replacement credential activates. See
  * `recoveryCodeReservation.ts` for the transitions between these states.
  */
-export type RecoveryCodeLifecycleState = {
+export type RecoveryCodeLifecycleState = ExclusiveUnion<{
     state: 'active';
     issuedAtMs: number;
-    reservationId?: never;
-    reservedAtMs?: never;
-    reservationExpiresAtMs?: never;
-    consumedAtMs?: never;
-    revokedAtMs?: never;
 } | {
     state: 'reserved';
     issuedAtMs: number;
     reservationId: RecoveryCodeReservationId;
     reservedAtMs: number;
     reservationExpiresAtMs: number;
-    consumedAtMs?: never;
-    revokedAtMs?: never;
 } | {
     state: 'consumed';
     issuedAtMs: number;
     reservationId: RecoveryCodeReservationId;
     consumedAtMs: number;
-    reservedAtMs?: never;
-    reservationExpiresAtMs?: never;
-    revokedAtMs?: never;
 } | {
     state: 'revoked';
     issuedAtMs: number;
     revokedAtMs: number;
-    reservationId?: never;
-    reservedAtMs?: never;
-    reservationExpiresAtMs?: never;
-    consumedAtMs?: never;
-};
+}>;
 //# sourceMappingURL=recoveryEnvelopes.d.ts.map

package/dist/types/shared-ts/src/wallet-recovery/walletRecoveryPreparation.d.ts

@@ -0,0 +1,15 @@
+import type { RuntimePolicyScope } from '../threshold/signingRootScope';
+import type { RouterAbEd25519YaoApplicationBindingFactsV1, RouterAbEd25519YaoBytes32V1, RouterAbEd25519YaoLifecycleScopeV1 } from '../utils/routerAbEd25519Yao';
+export type WalletRecoveryPreparationNearRecoveryBasisV1 = {
+    readonly capabilityKind: 'registration' | 'recovery';
+    readonly activeCapabilityBinding: RouterAbEd25519YaoBytes32V1;
+    readonly scope: RouterAbEd25519YaoLifecycleScopeV1;
+    readonly applicationBinding: RouterAbEd25519YaoApplicationBindingFactsV1;
+    readonly participantIds: readonly [number, number];
+    readonly registeredPublicKey: RouterAbEd25519YaoBytes32V1;
+    readonly runtimePolicyScope: RuntimePolicyScope;
+    readonly activationTranscript: RouterAbEd25519YaoBytes32V1;
+    readonly activationStateEpoch: number;
+    readonly signingWorkerVerifyingShare: RouterAbEd25519YaoBytes32V1;
+};
+//# sourceMappingURL=walletRecoveryPreparation.d.ts.map

package/dist/types/shared-ts/src/wallet-recovery/walletRecoveryTarget.d.ts

@@ -1,12 +1,11 @@
 import { type WebAuthnRpId } from '../utils/domainIds';
-export type WalletRecoveryTargetV1 = {
+import type { ReadonlyExclusiveUnion } from '../utils/variant';
+export type WalletRecoveryTargetV1 = ReadonlyExclusiveUnion<{
     readonly kind: 'passkey';
     readonly rpId: WebAuthnRpId;
-    readonly googleProvider?: never;
 } | {
     readonly kind: 'google_email_otp';
     readonly googleProvider: 'google';
-    readonly rpId?: never;
-};
+}>;
 export declare function parseWalletRecoveryTargetV1(raw: unknown): WalletRecoveryTargetV1;
 //# sourceMappingURL=walletRecoveryTarget.d.ts.map

package/dist/types/wallet-server/src/authorization/domain.d.ts

@@ -1,3 +1,4 @@
+import type { Variant } from '../../../shared-ts/src/utils/variant';
 import type { ActiveWalletAuthMethodRecordV2, WalletAuthMethodRecordV2 } from '../../../shared-ts/src/utils/walletAuthMethodRecord';
 import { CAPABILITY_KINDS, EVM_ECDSA_MPC_OPERATION_KINDS, NEAR_ED25519_MPC_OPERATION_KINDS } from '../../../shared-ts/src/authorization/capabilityKinds';
 import type { CapabilityOperationRef, AuthorizationAuditEventId, AuthorizationGrantRef, AuthorizedOperationId, WalletSessionAuthorizationId, AuthorizationEvidenceId, AuthorizationEvidenceKind, HostedWalletSessionExchangeCodeId, MpcWalletSigningQuotaId, PrincipalId, WalletSessionMintId, TenantId, WalletSessionId } from '../../../shared-ts/src/authorization/capabilityKinds';
@@ -247,10 +248,20 @@ export type ExactWalletSessionStatusV2 = {
  * lands between separate reads cannot pair a session with a newer authority.
  */
 export type WalletSessionAdmissionSnapshotV2 = {
-    readonly authorization: IssuedWalletSessionAuthorizationV2;
     readonly authority: WalletAuthorityV1 | null;
     readonly authMethod: WalletAuthMethodRecordV2 | null;
-};
+} & ({
+    readonly kind: 'active';
+    readonly authorization: IssuedWalletSessionAuthorizationV2;
+    readonly session?: never;
+    readonly quota?: never;
+} | {
+    readonly kind: 'exhausted';
+    readonly session: WalletSessionAuthorizationV2;
+    readonly quota: ExactWalletSessionQuotaProjectionV1;
+    readonly authorization?: never;
+});
+export type WalletSessionAdmissionSnapshotV2Variant<Kind extends WalletSessionAdmissionSnapshotV2['kind']> = Variant<WalletSessionAdmissionSnapshotV2, 'kind', Kind>;
 /** An exact status with the authority and auth method it was judged against. */
 export type ExactWalletSessionStatusSnapshotV2 = {
     readonly status: ExactWalletSessionStatusV2;

package/dist/types/wallet-server/src/authorization/ecdsaWalletSessionAdmission.d.ts

@@ -1,4 +1,6 @@
+import type { EcdsaMaterialReadSnapshot } from '../core/ecdsaMaterialReadSnapshot';
 import type { CapabilityOperationEnvelope } from '../../../shared-ts/src/authorization/operationFingerprint';
+import type { Variant } from '../../../shared-ts/src/utils/variant';
 import type { AuthorizedOperation, AuthorizedOperationInput } from './domain';
 import type { AuthorizedOperationAdmissionRejection, EcdsaMaterialActivationScope } from './service';
 export type EcdsaWalletSessionAdmissionInput = {
@@ -14,15 +16,17 @@ export type EcdsaWalletSessionAdmissionInput = {
             readonly kind: 'consume_reusable_wallet_session';
         };
     };
-    readonly material: EcdsaMaterialActivationScope;
+    readonly material: EcdsaMaterialActivationScope & {
+        readonly readSnapshot: EcdsaMaterialReadSnapshot;
+    };
 };
 export type PinnedOwnerWalletScope = {
     readonly orgId: string;
     readonly projectId: string;
     readonly projectEnvironmentId: string;
 };
-export type EcdsaWalletSessionAdmission = {
-    readonly kind: 'claimed' | 'operation_in_progress';
+type EcdsaWalletSessionExistingOperation = {
+    readonly kind: 'operation_in_progress';
     readonly operation: AuthorizedOperation;
     readonly ownerScope: PinnedOwnerWalletScope;
 } | {
@@ -30,8 +34,28 @@ export type EcdsaWalletSessionAdmission = {
     readonly operation: AuthorizedOperation;
     readonly ownerScope?: never;
 };
+type EcdsaWalletSessionAdmission = EcdsaWalletSessionExistingOperation | {
+    readonly kind: 'claimed';
+    readonly operation: AuthorizedOperation;
+    readonly ownerScope: PinnedOwnerWalletScope;
+};
+export type EcdsaWalletSessionAdmissionVariant<K extends EcdsaWalletSessionAdmission['kind']> = Variant<EcdsaWalletSessionAdmission, 'kind', K>;
+export type EcdsaWalletSessionResolutionResult = EcdsaWalletSessionExistingOperation | ((AuthorizedOperationAdmissionRejection | {
+    readonly kind: 'authorized_operation_missing';
+}) & {
+    readonly operation?: never;
+    readonly ownerScope?: never;
+});
 export type EcdsaWalletSessionAdmissionResult = EcdsaWalletSessionAdmission | (AuthorizedOperationAdmissionRejection & {
     readonly operation?: never;
     readonly ownerScope?: never;
 });
+export type EcdsaWalletSessionPhaseAdmission = {
+    readonly phase: 'prepare';
+    readonly admission: EcdsaWalletSessionAdmission;
+} | {
+    readonly phase: 'finalize';
+    readonly admission: EcdsaWalletSessionExistingOperation;
+};
+export {};
 //# sourceMappingURL=ecdsaWalletSessionAdmission.d.ts.map

package/dist/types/wallet-server/src/authorization/service.d.ts

@@ -1,3 +1,5 @@
+import type { D1EcdsaAdmissionPolicyRead } from '../router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore';
+import type { EcdsaMaterialRead } from '../core/d1EcdsaSignerRead';
 import type { D1PreparedStatementLike } from '../storage/tenantRoute';
 import type { WalletAuthMethodId, WalletId } from '../../../shared-ts/src/utils/domainIds';
 import type { ActiveWalletAuthorityV1 } from '../../../shared-ts/src/authorization/walletAuthority';
@@ -10,6 +12,11 @@ import type { DigestB64u } from '../../../shared-ts/src/utils/canonicalPrimitive
 import type { RouterAbMpcMaterialActivationRefWire } from '../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
 import type { RuntimePolicyScope } from '../../../shared-ts/src/threshold/signingRootScope';
 import type { CapabilityOperationFingerprintDigest } from '../../../shared-ts/src/authorization/operationFingerprint';
+export type EcdsaWalletSessionAdmissionRead = {
+    readonly snapshot: WalletSessionAdmissionSnapshotV2;
+    readonly materialRead: EcdsaMaterialRead;
+    readonly policyRead: D1EcdsaAdmissionPolicyRead;
+};
 export interface AuthorizationSessionPort {
     putIssuedHostedWalletSeamsSessionExchange(exchange: IssuedHostedWalletSeamsSessionExchangeV2): Promise<void>;
     redeemHostedWalletSeamsSessionExchange(input: RedeemHostedWalletSeamsSessionExchangeV2Input): Promise<PersistedHostedWalletSeamsSessionExchangeV2Result>;
@@ -67,6 +74,12 @@ export interface AuthorizationGrantPort {
         readonly tokenHash: DigestB64u;
         readonly nowMs: number;
     }): Promise<WalletSessionAdmissionSnapshotV2 | null>;
+    readEcdsaWalletSessionAdmissionSnapshotByOperationCredential(input: {
+        readonly tenantId: TenantId;
+        readonly tokenHash: DigestB64u;
+        readonly nowMs: number;
+        readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
+    }): Promise<EcdsaWalletSessionAdmissionRead | null>;
     readWalletSessionExactOperationContextByCredential(input: {
         readonly tenantId: TenantId;
         readonly tokenHash: DigestB64u;
@@ -260,6 +273,12 @@ export declare class AuthorizationService {
         readonly token: string;
         readonly nowMs: number;
     }): Promise<WalletSessionAdmissionSnapshotV2 | null>;
+    readEcdsaWalletSessionAdmissionSnapshotByOperationCredential(input: {
+        readonly tenantId: TenantId;
+        readonly token: string;
+        readonly nowMs: number;
+        readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
+    }): Promise<EcdsaWalletSessionAdmissionRead | null>;
     readLiveWalletSessionAuthorizationProjectionByCredential(input: {
         readonly tenantId: TenantId;
         readonly token: string;

package/dist/types/wallet-server/src/core/ThresholdService/stores/SessionStore.d.ts

@@ -4,8 +4,8 @@ export type ThresholdEd25519Commitments = {
     hiding: string;
     binding: string;
 };
-type ThresholdEd25519CommitmentsById = Record<string, ThresholdEd25519Commitments>;
-type ThresholdEd25519SigningShareMaterial = {
+export type ThresholdEd25519CommitmentsById = Record<string, ThresholdEd25519Commitments>;
+export type ThresholdEd25519SigningShareMaterial = {
     kind: 'key_store';
 } | {
     kind: 'embedded_cosigner_share';

package/dist/types/wallet-server/src/core/ThresholdService/stores/WalletSessionStore.d.ts

@@ -12,7 +12,7 @@ export type Ed25519WalletSessionRecord = {
     authorityScope: ThresholdEd25519AuthorityScope;
     participantIds: number[];
 } & Partial<ThresholdEcdsaSigningRootMetadata>;
-type EcdsaWalletSessionRecordCore = {
+export type EcdsaWalletSessionRecordCore = {
     expiresAtMs: number;
     relayerKeyId: string;
     walletId: string;

package/dist/types/wallet-server/src/core/ThresholdService/stores/exportReplayGuard.d.ts

@@ -0,0 +1,3 @@
+export declare const EXPORT_REPLAY_GUARD_CLOCK_SKEW_MS: number;
+export declare const EXPORT_REPLAY_GUARD_MIN_RETENTION_MS: number;
+//# sourceMappingURL=exportReplayGuard.d.ts.map

package/dist/types/wallet-server/src/core/ThresholdService/validation.d.ts

@@ -1,12 +1,7 @@
 import { type WalletAuthAuthority } from '../../../../shared-ts/src/utils/walletAuthAuthority';
 import type { EcdsaDerivationPublicIdentity, ThresholdEd25519AuthorityScope } from '../types';
-import { type EcdsaKeyHandle } from '../keyMaterialBrands';
-type ParsedThresholdEcdsaSigningRootMetadata = {
-    signingRootId: string;
-    signingRootVersion?: string;
-    walletKeyVersion: string;
-    derivationVersion: number;
-};
+import type { ThresholdEcdsaMpcSessionRecord, ThresholdEd25519CoordinatorSigningSessionRecord, ThresholdEd25519MpcSessionRecord, ThresholdEd25519SigningSessionRecord } from './stores/SessionStore';
+import type { EcdsaWalletSessionRecord, Ed25519WalletSessionRecord } from './stores/WalletSessionStore';
 export declare function toPrefixWithColon(prefix: unknown, defaultPrefix: string): string;
 export declare function toThresholdEd25519KeyPrefix(prefix: unknown): string;
 export declare function toThresholdEd25519SessionPrefix(prefix: unknown): string;
@@ -33,102 +28,14 @@ type ParsedThresholdEd25519ReadyKeyRecord = {
 };
 export declare function parseThresholdEd25519KeyRecord(raw: unknown): ParsedThresholdEd25519ReadyKeyRecord | null;
 export declare function parseEcdsaDerivationPublicIdentity(raw: unknown): EcdsaDerivationPublicIdentity | null;
-type ParsedThresholdEd25519Commitments = {
-    hiding: string;
-    binding: string;
-};
-type ParsedThresholdEd25519CommitmentsById = Record<string, ParsedThresholdEd25519Commitments>;
 export declare function parseThresholdEd25519AuthorityScope(raw: unknown): ThresholdEd25519AuthorityScope | null;
 export declare function thresholdEd25519AuthorityScopeFromWalletAuthAuthority(authority: WalletAuthAuthority): ThresholdEd25519AuthorityScope;
 export declare function thresholdEd25519AuthorityScopesMatch(left: ThresholdEd25519AuthorityScope, right: ThresholdEd25519AuthorityScope): boolean;
-type ParsedThresholdEd25519MpcSessionRecord = {
-    expiresAtMs: number;
-    ecdsaThresholdKeyId?: string;
-    keyHandle?: string;
-    relayerKeyId: string;
-    purpose: string;
-    intentDigestB64u: string;
-    signingDigestB64u: string;
-    userId: string;
-    authorityScope: ThresholdEd25519AuthorityScope;
-    clientVerifyingShareB64u?: string;
-    participantIds: number[];
-} & Partial<ParsedThresholdEcdsaSigningRootMetadata>;
-type ParsedThresholdEcdsaMpcSessionRecord = {
-    expiresAtMs: number;
-    ecdsaThresholdKeyId?: string;
-    keyHandle?: string;
-    relayerKeyId: string;
-    purpose: string;
-    intentDigestB64u: string;
-    signingDigestB64u: string;
-    walletId: string;
-    clientVerifyingShareB64u?: string;
-    participantIds: number[];
-} & Partial<ParsedThresholdEcdsaSigningRootMetadata>;
-export declare function parseThresholdEd25519MpcSessionRecord(raw: unknown): ParsedThresholdEd25519MpcSessionRecord | null;
-export declare function parseThresholdEcdsaMpcSessionRecord(raw: unknown): ParsedThresholdEcdsaMpcSessionRecord | null;
-type ParsedThresholdEd25519SigningShareMaterial = {
-    kind: 'key_store';
-} | {
-    kind: 'embedded_cosigner_share';
-    relayerSigningShareB64u: string;
-};
-type ParsedThresholdEd25519SigningSessionRecord = {
-    expiresAtMs: number;
-    mpcSessionId: string;
-    relayerKeyId: string;
-    signingDigestB64u: string;
-    userId: string;
-    authorityScope: ThresholdEd25519AuthorityScope;
-    commitmentsById: ParsedThresholdEd25519CommitmentsById;
-    signingShare: ParsedThresholdEd25519SigningShareMaterial;
-    relayerNoncesB64u: string;
-    participantIds: number[];
-};
-export declare function parseThresholdEd25519SigningSessionRecord(raw: unknown): ParsedThresholdEd25519SigningSessionRecord | null;
-type ParsedThresholdEd25519StringById = Record<string, string>;
-type ParsedThresholdEd25519CoordinatorSigningSessionRecord = {
-    mode: 'cosigner';
-    expiresAtMs: number;
-    mpcSessionId: string;
-    relayerKeyId: string;
-    signingDigestB64u: string;
-    userId: string;
-    authorityScope: ThresholdEd25519AuthorityScope;
-    commitmentsById: ParsedThresholdEd25519CommitmentsById;
-    participantIds: number[];
-    groupPublicKey: string;
-    cosignerIds: number[];
-    cosignerRelayerUrlsById: ParsedThresholdEd25519StringById;
-    cosignerCoordinatorGrantsById: ParsedThresholdEd25519StringById;
-    relayerVerifyingSharesById: ParsedThresholdEd25519StringById;
-};
-export declare function parseThresholdEd25519CoordinatorSigningSessionRecord(raw: unknown): ParsedThresholdEd25519CoordinatorSigningSessionRecord | null;
-type ParsedEd25519WalletSessionRecord = {
-    expiresAtMs: number;
-    relayerKeyId: string;
-    userId: string;
-    walletId: string;
-    nearAccountId: string;
-    nearEd25519SigningKeyId: string;
-    authorityScope: ThresholdEd25519AuthorityScope;
-    participantIds: number[];
-} & Partial<ParsedThresholdEcdsaSigningRootMetadata>;
-export declare function parseEd25519WalletSessionRecord(raw: unknown): ParsedEd25519WalletSessionRecord | null;
-type ParsedEcdsaWalletSessionRecordCore = {
-    expiresAtMs: number;
-    relayerKeyId: string;
-    walletId: string;
-    keyHandle: EcdsaKeyHandle;
-    participantIds: number[];
-};
-type ParsedEcdsaWalletSessionRecord = ParsedEcdsaWalletSessionRecordCore & ({
-    signingRootId?: never;
-    signingRootVersion?: never;
-    walletKeyVersion?: never;
-    derivationVersion?: never;
-} | ParsedThresholdEcdsaSigningRootMetadata);
-export declare function parseEcdsaWalletSessionRecord(raw: unknown): ParsedEcdsaWalletSessionRecord | null;
+export declare function parseThresholdEd25519MpcSessionRecord(raw: unknown): ThresholdEd25519MpcSessionRecord | null;
+export declare function parseThresholdEcdsaMpcSessionRecord(raw: unknown): ThresholdEcdsaMpcSessionRecord | null;
+export declare function parseThresholdEd25519SigningSessionRecord(raw: unknown): ThresholdEd25519SigningSessionRecord | null;
+export declare function parseThresholdEd25519CoordinatorSigningSessionRecord(raw: unknown): ThresholdEd25519CoordinatorSigningSessionRecord | null;
+export declare function parseEd25519WalletSessionRecord(raw: unknown): Ed25519WalletSessionRecord | null;
+export declare function parseEcdsaWalletSessionRecord(raw: unknown): EcdsaWalletSessionRecord | null;
 export {};
 //# sourceMappingURL=validation.d.ts.map

package/dist/types/wallet-server/src/core/WebAuthnAuthenticatorStore.d.ts

@@ -30,6 +30,14 @@ export interface D1WebAuthnAuthenticatorStoreSchemaOptions extends D1SchemaOptio
 }
 export interface D1WebAuthnAuthenticatorStoreOptions extends D1TenantStoreOptions {
 }
+export type D1WebAuthnAuthenticatorRow = {
+    readonly credential_id_b64u?: unknown;
+    readonly credential_public_key_b64u?: unknown;
+    readonly counter?: unknown;
+    readonly created_at_ms?: unknown;
+    readonly updated_at_ms?: unknown;
+    readonly device_info_json?: unknown;
+};
 export declare const WEBAUTHN_AUTHENTICATOR_STORE_D1_SCHEMA_SQL: readonly ["\n    CREATE TABLE IF NOT EXISTS webauthn_authenticators (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      user_id TEXT NOT NULL,\n      credential_id_b64u TEXT NOT NULL,\n      credential_public_key_b64u TEXT NOT NULL,\n      counter INTEGER NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      updated_at_ms INTEGER NOT NULL,\n      device_info_json TEXT NOT NULL DEFAULT '{}',\n      PRIMARY KEY (namespace, org_id, project_id, env_id, user_id, credential_id_b64u),\n      CHECK (length(user_id) > 0),\n      CHECK (length(credential_id_b64u) > 0),\n      CHECK (length(credential_public_key_b64u) > 0),\n      CHECK (counter >= 0),\n      CHECK (created_at_ms > 0),\n      CHECK (updated_at_ms > 0)\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS webauthn_authenticators_user_idx\n      ON webauthn_authenticators (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        user_id,\n        created_at_ms\n      )\n  "];
 export declare function ensureWebAuthnAuthenticatorStoreD1Schema(options: D1WebAuthnAuthenticatorStoreSchemaOptions): Promise<void>;
 export declare function resolveWebAuthnAuthenticatorStoreNamespace(config: Record<string, unknown>): string;

package/dist/types/wallet-server/src/core/authService/bytes.d.ts

@@ -1,4 +1,3 @@
 export declare function randomBase64Url(bytes: number): string;
-export declare function randomOpaqueId(byteLength?: number): string;
 export declare function randomNumericCode(length: number): string;
 //# sourceMappingURL=bytes.d.ts.map

package/dist/types/wallet-server/src/core/authService/emailOtpChallenges.d.ts

@@ -1,6 +1,6 @@
 import type { EmailOtpChallengeAction, EmailOtpChallengeOperation, EmailOtpChallengeRecord, EmailOtpChallengeStore, EmailOtpChannel, EmailOtpWalletEnrollmentRecord } from '../EmailOtpStores';
 import { type EmailOtpConfig } from './emailOtpConfig';
-import type { EmailOtpAuthStateReadResult } from './emailOtpEnrollment';
+import type { EmailOtpAuthStateReadResult, EmailOtpEnrollmentReadResult } from './emailOtpEnrollment';
 import type { EmailOtpDeliveryResult, EmailOtpMemoryOutbox } from './emailOtpDelivery';
 import type { RateLimitResult } from './rateLimits';
 type PruneExpiredEmailOtpChallengesInput = {
@@ -48,14 +48,6 @@ export type CreateEmailOtpChallengeWithActionResult = {
     retryAfterMs?: number;
     resetAtMs?: number;
 };
-type EmailOtpChallengeEnrollmentReadResult = {
-    ok: true;
-    enrollment: EmailOtpWalletEnrollmentRecord;
-} | {
-    ok: false;
-    code: string;
-    message: string;
-};
 type EmailOtpChallengeRateLimitConsumer = (input: {
     scope: 'challenge';
     action: EmailOtpChallengeAction;
@@ -82,7 +74,7 @@ type CreateEmailOtpChallengeWithActionInput = {
     readActiveEnrollment: (input: {
         walletId: string;
         orgId: string;
-    }) => Promise<EmailOtpChallengeEnrollmentReadResult>;
+    }) => Promise<EmailOtpEnrollmentReadResult>;
     readEnrollmentAuthState: (enrollment: EmailOtpWalletEnrollmentRecord) => Promise<EmailOtpAuthStateReadResult>;
     consumeRateLimit: EmailOtpChallengeRateLimitConsumer;
     resolveConfig: () => EmailOtpConfig;

package/dist/types/wallet-server/src/core/authService/emailOtpSeal.d.ts

@@ -4,7 +4,7 @@ type EmailOtpShamirCipherConfig = {
     readonly currentKeyVersion: string;
     readonly acceptedWarmKeyVersions: readonly string[];
 };
-type EmailOtpShamirCipherResult = {
+export type EmailOtpShamirCipherResult = {
     readonly ok: true;
     readonly keyVersion: string;
     readonly cipher: SigningSessionSealCipherAdapter;

package/dist/types/wallet-server/src/core/authService/emailOtpUnlock.d.ts

@@ -1,12 +1,5 @@
 import type { EmailOtpAuthStateRecord, EmailOtpUnlockChallengeStore, EmailOtpWalletEnrollmentRecord } from '../EmailOtpStores';
-type EmailOtpUnlockEnrollmentReadResult = {
-    ok: true;
-    enrollment: EmailOtpWalletEnrollmentRecord;
-} | {
-    ok: false;
-    code: string;
-    message: string;
-};
+import type { EmailOtpEnrollmentReadResult } from './emailOtpEnrollment';
 type CreateEmailOtpUnlockChallengeRequest = {
     walletId?: unknown;
     orgId?: unknown;
@@ -54,7 +47,7 @@ export type CreateEmailOtpUnlockChallengeInput = {
     readActiveEnrollment: (input: {
         walletId: string;
         orgId: string | undefined;
-    }) => Promise<EmailOtpUnlockEnrollmentReadResult>;
+    }) => Promise<EmailOtpEnrollmentReadResult>;
 };
 export type VerifyEmailOtpUnlockProofInput = {
     request: VerifyEmailOtpUnlockProofRequest;
@@ -62,7 +55,7 @@ export type VerifyEmailOtpUnlockProofInput = {
     readActiveEnrollment: (input: {
         walletId: string;
         orgId: string | undefined;
-    }) => Promise<EmailOtpUnlockEnrollmentReadResult>;
+    }) => Promise<EmailOtpEnrollmentReadResult>;
     putAuthStateForEnrollment: (enrollment: EmailOtpWalletEnrollmentRecord, patch: Pick<EmailOtpAuthStateRecord, 'lastEmailOtpLoginAtMs'>) => Promise<EmailOtpAuthStateRecord>;
 };
 export declare function createEmailOtpUnlockChallenge(input: CreateEmailOtpUnlockChallengeInput): Promise<CreateEmailOtpUnlockChallengeResult>;

package/dist/types/wallet-server/src/core/d1EcdsaSignerRead.d.ts

@@ -0,0 +1,39 @@
+import type { InstalledEcdsaCustodySnapshotV1 } from '../router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService';
+import { type RouterAbMpcMaterialActivationRefWire } from '../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
+import { EcdsaMaterialReadSnapshot } from './ecdsaMaterialReadSnapshot';
+import type { WalletId } from '../../../shared-ts/src/utils/domainIds';
+import type { D1WalletStoreScope } from './d1WalletStore';
+import { type WalletEcdsaSignerRecord } from './WalletStore';
+import type { D1DatabaseLike, D1PreparedStatementLike } from '../storage/tenantRoute';
+export declare function prepareWalletEcdsaSignersRead(database: D1DatabaseLike, scope: D1WalletStoreScope, walletId: WalletId): D1PreparedStatementLike;
+export declare function parseWalletEcdsaSignerRows(rows: readonly Readonly<Record<string, unknown>>[], walletId: WalletId): readonly WalletEcdsaSignerRecord[];
+/** Parsed persistence evidence; material failures are surfaced after session validation. */
+export declare class EcdsaMaterialRead {
+    #private;
+    readonly walletId: WalletId;
+    private readonly scope;
+    private readonly activation;
+    private readonly linkedSnapshot;
+    private constructor();
+    static fromRows(scope: D1WalletStoreScope, walletId: WalletId, activation: RouterAbMpcMaterialActivationRefWire, rows: unknown, linkedSnapshot: InstalledEcdsaCustodySnapshotV1 | null): EcdsaMaterialRead;
+    resolveLinked(scope: D1WalletStoreScope, walletId: WalletId, activation: RouterAbMpcMaterialActivationRefWire): InstalledEcdsaCustodySnapshotV1 | null;
+    resolve(scope: D1WalletStoreScope, walletId: WalletId, activation: RouterAbMpcMaterialActivationRefWire): CanonicalMaterialSnapshot | null;
+}
+type CanonicalMaterialSnapshot = {
+    readonly signer: WalletEcdsaSignerRecord;
+    readonly readSnapshot: EcdsaMaterialReadSnapshot;
+};
+export type EcdsaMaterialReadSource = {
+    readonly kind: 'database';
+    readonly materialRead?: never;
+} | {
+    readonly kind: 'credential_snapshot';
+    readonly materialRead: EcdsaMaterialRead;
+};
+export type EcdsaMaterialActivationReadInput = {
+    readonly walletId: string;
+    readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
+    readonly source: EcdsaMaterialReadSource;
+};
+export {};
+//# sourceMappingURL=d1EcdsaSignerRead.d.ts.map

package/dist/types/wallet-server/src/core/d1WalletStore.d.ts

@@ -1,3 +1,5 @@
+import type { EcdsaMaterialReadSnapshot } from './ecdsaMaterialReadSnapshot';
+import { type EcdsaMaterialReadSource } from './d1EcdsaSignerRead';
 import type { D1DatabaseLike, D1PreparedStatementLike } from '../storage/tenantRoute';
 import type { WalletId, WalletRegistrationEcdsaWalletKey } from './registrationContracts';
 import { type ThresholdEcdsaChainTarget } from './thresholdEcdsaChainTarget';
@@ -71,6 +73,14 @@ export declare class D1WalletStore implements WalletStore {
         walletId: WalletId;
         materialActivation: RouterAbMpcMaterialActivationRefWire;
     }): Promise<WalletEcdsaSignerRecord | null>;
+    readEcdsaSignerMaterialSnapshot(input: {
+        readonly source: EcdsaMaterialReadSource;
+        walletId: WalletId;
+        materialActivation: RouterAbMpcMaterialActivationRefWire;
+    }): Promise<{
+        readonly signer: WalletEcdsaSignerRecord;
+        readonly readSnapshot: EcdsaMaterialReadSnapshot;
+    } | null>;
     getEcdsaSignerByPostRegistrationRequest(input: {
         walletId: WalletId;
         request: WalletEcdsaPostRegistrationPublicRequest;

package/dist/types/wallet-server/src/core/deviceLinking/linkedDeviceSessionRecord.d.ts

@@ -4,20 +4,19 @@ import { type DigestB64u } from '../../../../shared-ts/src/utils/canonicalPrimit
 import { type DomainIdParseResult, type WalletAuthorityId } from '../../../../shared-ts/src/utils/domainIds';
 import { type LinkDeviceSessionId } from '../../../../shared-ts/src/signing-lanes/ids';
 import { type ExactAdministeredSignerV1, type ExactAdministeredSignerManifestV1 } from '../../../../shared-ts/src/device-linking/delegatedActivationPlan';
+import type { ReadonlyExclusiveUnion } from '../../../../shared-ts/src/utils/variant';
 type LinkedDeviceClaimTranscriptV1 = {
     readonly digestB64u: DigestB64u;
     readonly value: LinkedDeviceClaimV1;
 };
-export type LinkedDeviceSourceKeyManifestDigestsV1 = {
+export type LinkedDeviceSourceKeyManifestDigestsV1 = ReadonlyExclusiveUnion<{
     readonly ed25519: DigestB64u;
-    readonly ecdsa_secp256k1?: never;
 } | {
-    readonly ed25519?: never;
     readonly ecdsa_secp256k1: DigestB64u;
 } | {
     readonly ed25519: DigestB64u;
     readonly ecdsa_secp256k1: DigestB64u;
-};
+}>;
 type LinkedDeviceApprovalTranscriptV1 = {
     readonly digestB64u: DigestB64u;
     readonly value: LinkedDeviceApprovalV1;

package/dist/types/wallet-server/src/core/ecdsaMaterialReadSnapshot.d.ts

@@ -0,0 +1,19 @@
+import type { WalletId } from '../../../shared-ts/src/utils/domainIds';
+import type { D1WalletStoreScope } from './d1WalletStore';
+export declare const ECDSA_INSTALLATION_SNAPSHOT_COLUMNS: readonly ["link_session_id", "authority_id", "wallet_id", "auth_method_id", "device_id", "package_set_digest_b64u", "target_factor_verification_digest_b64u", "target_factor_verified_at_ms", "source_manifest_digest_b64u", "delivery_recipient_public_key_b64u", "packages_json", "server_reservation_ids_json", "installed_record_set_digest_b64u", "activated_at_ms"];
+type SqlCondition = {
+    readonly sql: string;
+    readonly bindings: readonly unknown[];
+};
+type StoredRow = Readonly<Record<string, unknown>>;
+/** Request-local evidence of the exact records a material resolver examined. */
+export declare class EcdsaMaterialReadSnapshot {
+    #private;
+    readonly walletId: WalletId;
+    private constructor();
+    static canonical(scope: D1WalletStoreScope, walletId: WalletId, activationId: string, rows: readonly StoredRow[]): EcdsaMaterialReadSnapshot;
+    static linked(scope: D1WalletStoreScope, walletId: WalletId, installations: readonly StoredRow[], signers: readonly StoredRow[]): EcdsaMaterialReadSnapshot;
+    condition(scope: D1WalletStoreScope): SqlCondition;
+}
+export {};
+//# sourceMappingURL=ecdsaMaterialReadSnapshot.d.ts.map

package/dist/types/wallet-server/src/core/routerAbSigning/RouterAbNormalSigningRuntime.d.ts

@@ -2,7 +2,8 @@ import type { RouterAbEd25519NormalSigningState } from '../../../../shared-ts/sr
 import type { MpcMaterialActivationId } from '../../../../shared-ts/src/utils/domainIds';
 import { type ParseResult, type RouterAbNormalSigningServerPolicy } from '../ThresholdService/routerAbNormalSigningPolicy';
 import type { Ed25519WalletSessionStore, EcdsaWalletSessionStore } from '../ThresholdService/stores/WalletSessionStore';
-export type RouterAbSigningWorkerPrivateTransport = {
+import type { ReadonlyExclusiveUnion } from '../../../../shared-ts/src/utils/variant';
+export type RouterAbSigningWorkerPrivateTransport = ReadonlyExclusiveUnion<{
     readonly kind: 'configured';
     readonly signingWorkerBaseUrl: string;
     readonly auth: {
@@ -12,10 +13,7 @@ export type RouterAbSigningWorkerPrivateTransport = {
     readonly fetchImpl?: typeof fetch;
 } | {
     readonly kind: 'unconfigured';
-    readonly signingWorkerBaseUrl?: never;
-    readonly auth?: never;
-    readonly fetchImpl?: never;
-};
+}>;
 export type RouterAbConfiguredSigningWorkerPrivateTransport = Extract<RouterAbSigningWorkerPrivateTransport, {
     readonly kind: 'configured';
 }>;

package/dist/types/wallet-server/src/core/rpcClients/near/NearClient.d.ts

@@ -1,9 +1,8 @@
 import type { JsonRpcErrorDetails } from '../../../../../shared-ts/src/utils/jsonRpc';
-import type { DecodedNearFinalExecutionOutcome } from '../../../../../shared-ts/src/utils/nearRpcResults';
+import type { DecodedNearFinalExecutionOutcome, NearRpcErrorType } from '../../../../../shared-ts/src/utils/nearRpcResults';
 import { NearJsonRpcClient } from '../../../../../shared-ts/src/near/nearClient';
 export type { AccessKeyList } from '@near-js/types';
 export { SignedTransaction, type NearClient } from '../../../../../shared-ts/src/near/nearClient';
-type NearRpcErrorType = 'InvalidTxError' | 'ActionError' | 'TxExecutionError' | 'RpcError' | 'Failure' | 'Unknown';
 type NearRpcFailureKind = 'transaction_not_found' | 'account_not_found' | 'access_key_not_found' | 'invalid_nonce' | 'expired' | 'invalid_transaction' | 'action_error' | 'execution_failure' | 'infrastructure_failure' | 'unknown';
 export declare class NearRpcError extends Error {
     code?: number;