@seams/wallet-server 0.7.1 → 0.7.3

package/dist/types/wallet-server/src/router/cloudflare/d1/webauthn/d1WebAuthnRecords.d.ts

@@ -6,31 +6,18 @@ import { type ActiveWalletAuthMethodRecordV2 } from '../../../../../../shared-ts
 import { type RecoveryCodeReservationId } from '../../../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation';
 import { type WebAuthnAuthenticatorDeviceInfo } from '../../../../../../shared-ts/src/utils/webauthnDeviceInfo';
 import type { WebAuthnCredentialBindingRecord as CoreWebAuthnCredentialBindingRecord } from '../../../../core/WebAuthnCredentialBindingStore';
-export type D1AuthenticatorRow = {
-    readonly credential_id_b64u?: unknown;
-    readonly credential_public_key_b64u?: unknown;
-    readonly counter?: unknown;
-    readonly created_at_ms?: unknown;
-    readonly updated_at_ms?: unknown;
-    readonly device_info_json?: unknown;
-};
+import type { D1WebAuthnAuthenticatorRow } from '../../../../core/WebAuthnAuthenticatorStore';
+import type { WebAuthnLoginChallengeRecord as CoreWebAuthnLoginChallengeRecord } from '../../../../core/WebAuthnLoginChallengeStore';
+import type { WebAuthnSyncChallengeRecord as CoreWebAuthnSyncChallengeRecord } from '../../../../core/WebAuthnSyncChallengeStore';
+import type { NearPublicKeyAuthBinding } from '../../../../core/NearPublicKeyStore';
+import type { ResolvedEd25519WalletBinding } from '../../../../core/authService/webauthnWalletBinding';
+export type D1AuthenticatorRow = D1WebAuthnAuthenticatorRow;
 export type D1RecordJsonRow = {
     readonly record_json?: unknown;
 };
 export type WebAuthnCredentialBindingRecord = CoreWebAuthnCredentialBindingRecord;
-export type WebAuthnSyncWalletBinding = {
-    readonly walletId: string;
-    readonly nearAccountId: string;
-    readonly nearEd25519SigningKeyId: string;
-    readonly rpId: string;
-    readonly credentialIdB64u: string;
-    readonly signerSlot: number;
-};
-export type NearPublicKeyAuthBinding = {
-    readonly kind: 'passkey';
-    readonly rpId: WebAuthnRpId;
-    readonly credentialIdB64u: string;
-};
+export type WebAuthnSyncWalletBinding = Readonly<ResolvedEd25519WalletBinding>;
+export type { NearPublicKeyAuthBinding };
 export type NearPublicKeyRecord = {
     readonly publicKey: string;
     readonly kind: 'threshold' | 'local' | 'backup' | 'ephemeral';
@@ -50,24 +37,8 @@ export type WebAuthnAuthenticatorRecord = {
     readonly deviceInfo: WebAuthnAuthenticatorDeviceInfo;
 };
 export declare function parseWebAuthnAuthenticatorRowDeviceInfo(raw: unknown): WebAuthnAuthenticatorDeviceInfo;
-export type WebAuthnLoginChallengeRecord = {
-    readonly version: 'webauthn_login_challenge_v1';
-    readonly challengeId: string;
-    readonly userId: string;
-    readonly rpId: string;
-    readonly challengeB64u: string;
-    readonly createdAtMs: number;
-    readonly expiresAtMs: number;
-};
-export type WebAuthnSyncChallengeRecord = {
-    readonly version: 'webauthn_sync_challenge_v1';
-    readonly challengeId: string;
-    readonly rpId: string;
-    readonly expectedUserId?: string;
-    readonly challengeB64u: string;
-    readonly createdAtMs: number;
-    readonly expiresAtMs: number;
-};
+export type WebAuthnLoginChallengeRecord = Readonly<CoreWebAuthnLoginChallengeRecord>;
+export type WebAuthnSyncChallengeRecord = Readonly<CoreWebAuthnSyncChallengeRecord>;
 /**
  * The exact continuity snapshot selected by prepare. The snapshot is stored
  * inside the one-shot challenge so finalization cannot silently switch to a

package/dist/types/wallet-server/src/router/cloudflare/runtime/walletConsoleOps.d.ts

@@ -1,5 +1,6 @@
 import type { TenantRootIdentityFieldV1, TenantRootIdentityWireV1 } from '../../../../../shared-ts/src/tenant-root';
-import type { RouterApiCredentialScope } from '../../framework/apiCredentialPorts';
+import type { RouterApiCredentialScope, RouterApiKeyAuthRequest, RouterApiProjectEnvironment, RouterApiPublishableKeyAuthRequest, RouterApiUsageMeterEvent } from '../../framework/apiCredentialPorts';
+import type { ReadonlyExclusiveUnion } from '../../../../../shared-ts/src/utils/variant';
 export declare const WALLET_CONSOLE_OPS_BASE_PATH_V1 = "/internal/wallet-console/v1";
 export declare const WALLET_CONSOLE_SERVICE_ORIGIN_V1 = "https://wallet-console.internal";
 export declare const WALLET_CONSOLE_OP_PATHS_V1: {
@@ -9,12 +10,7 @@ export declare const WALLET_CONSOLE_OP_PATHS_V1: {
     readonly projectEnvironments: "/internal/wallet-console/v1/project-environments";
     readonly tenantRootActiveLineage: "/internal/wallet-console/v1/tenant-root/active-lineage";
 };
-export interface WalletConsoleSecretKeyAuthRequestV1 {
-    readonly secret: string;
-    readonly endpoint: string;
-    readonly requiredScopes: RouterApiCredentialScope[];
-    readonly sourceIp?: string;
-    readonly environmentId?: string;
+export interface WalletConsoleSecretKeyAuthRequestV1 extends Readonly<RouterApiKeyAuthRequest> {
 }
 export interface WalletConsolePrincipalV1 {
     readonly apiKeyId: string;
@@ -33,23 +29,10 @@ export type WalletConsoleSecretKeyAuthResponseV1 = {
     readonly code: string;
     readonly message: string;
 };
-export interface WalletConsolePublishableKeyAuthRequestV1 {
-    readonly secret: string;
-    readonly origin: string;
-    readonly environmentId: string;
+export interface WalletConsolePublishableKeyAuthRequestV1 extends Readonly<RouterApiPublishableKeyAuthRequest> {
 }
 export type WalletConsolePublishableKeyAuthResponseV1 = WalletConsoleSecretKeyAuthResponseV1;
-export interface WalletConsoleUsageEventV1 {
-    readonly orgId: string;
-    readonly environmentId: string;
-    readonly apiKeyId: string;
-    readonly endpoint: string;
-    readonly walletId: string;
-    readonly action: 'wallet_created';
-    readonly succeeded: boolean;
-    readonly occurredAt?: string;
-    /** Producer-owned idempotency key; replays with the same id must not double-count. */
-    readonly sourceEventId?: string;
+export interface WalletConsoleUsageEventV1 extends Readonly<RouterApiUsageMeterEvent> {
 }
 export interface WalletConsoleUsageEventsResponseV1 {
     readonly ok: boolean;
@@ -68,12 +51,7 @@ export interface WalletConsoleProjectEnvironmentsRequestV1 {
         readonly status?: string;
     };
 }
-export interface WalletConsoleProjectEnvironmentV1 {
-    readonly id: string;
-    readonly projectId: string;
-    readonly key: string;
-    readonly signingRootVersion: string;
-    readonly status?: string;
+export interface WalletConsoleProjectEnvironmentV1 extends Readonly<RouterApiProjectEnvironment> {
 }
 export interface WalletConsoleProjectEnvironmentsResponseV1 {
     readonly ok: boolean;
@@ -87,19 +65,15 @@ export interface WalletConsoleTenantRootActiveLineageV1 {
     readonly identityDigestB64u: string;
     readonly custodyLineageB64u: string;
 }
-export type WalletConsoleTenantRootActiveLineageResponseV1 = {
+export type WalletConsoleTenantRootActiveLineageResponseV1 = ReadonlyExclusiveUnion<{
     readonly ok: true;
     readonly identityDigestB64u: string;
     readonly custodyLineageB64u: string;
-    readonly code?: never;
-    readonly message?: never;
 } | {
     readonly ok: false;
     readonly code: 'invalid_body' | 'tenant_root_active_lineage_not_found';
     readonly message: string;
-    readonly identityDigestB64u?: never;
-    readonly custodyLineageB64u?: never;
-};
+}>;
 export type WalletConsoleDecodeResult<T, E> = {
     readonly ok: true;
     readonly value: T;

package/dist/types/wallet-server/src/router/domains/ecdsa/thresholdEcdsaRequestValidation.d.ts

@@ -1,5 +1,4 @@
-import { type RouterAbEcdsaOperationStepUpPreparationV1Wire } from '../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
-import { type RouterAbNormalSigningAuthorizationWire } from '../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
+import { type RouterAbEcdsaDerivationPoolFillAuthorization } from '../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
 import type { RouterAbEcdsaDerivationPoolFillInitRequest, RouterAbEcdsaDerivationPoolFillStepRequest } from '../../../core/types';
 type ThresholdEcdsaRouteErrorBody = {
     ok: false;
@@ -13,19 +12,8 @@ type ThresholdEcdsaRouteParseResult<T> = {
     ok: false;
     body: ThresholdEcdsaRouteErrorBody;
 };
-type RouterAbEcdsaPoolFillAuthorization = {
-    readonly authorization: Extract<RouterAbNormalSigningAuthorizationWire, {
-        readonly kind: 'reusable_wallet_session';
-    }>;
-    readonly operation?: never;
-} | {
-    readonly authorization: Extract<RouterAbNormalSigningAuthorizationWire, {
-        readonly kind: 'operation_step_up';
-    }>;
-    readonly operation: RouterAbEcdsaOperationStepUpPreparationV1Wire;
-};
-export type RouterAbEcdsaPoolFillInitRouteRequest = RouterAbEcdsaDerivationPoolFillInitRequest & RouterAbEcdsaPoolFillAuthorization;
-export type RouterAbEcdsaPoolFillStepRouteRequest = RouterAbEcdsaDerivationPoolFillStepRequest & RouterAbEcdsaPoolFillAuthorization;
+export type RouterAbEcdsaPoolFillInitRouteRequest = RouterAbEcdsaDerivationPoolFillInitRequest & RouterAbEcdsaDerivationPoolFillAuthorization;
+export type RouterAbEcdsaPoolFillStepRouteRequest = RouterAbEcdsaDerivationPoolFillStepRequest & RouterAbEcdsaDerivationPoolFillAuthorization;
 export declare function parseRouterAbEcdsaDerivationPoolFillInitRouteRequest(raw: unknown): ThresholdEcdsaRouteParseResult<RouterAbEcdsaPoolFillInitRouteRequest>;
 export declare function parseRouterAbEcdsaDerivationPoolFillStepRouteRequest(raw: unknown): ThresholdEcdsaRouteParseResult<RouterAbEcdsaPoolFillStepRouteRequest>;
 export {};

package/dist/types/wallet-server/src/router/domains/ed25519Yao/session/routerAbEd25519YaoWalletSession.d.ts

@@ -5,9 +5,11 @@ import type { WebAuthnAuthenticationCredential } from '../../../../core/types';
 import { thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from '../../../../core/ThresholdService/validation';
 import type { WalletRegistrationEd25519YaoBootstrapSession } from '../../../../../../shared-ts/src/utils/registrationContracts';
 import type { RouterAbEd25519YaoActiveCapabilityDescriptorV1 } from '../recovery/routerAbEd25519YaoRecovery';
-import type { MpcWalletSigningQuotaId, WalletSessionMintId, WalletSessionAuthorizationId, WalletSessionId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
+import type { MpcWalletSigningQuotaId, WalletSessionAuthorizationId, WalletSessionId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
+import type { WalletSessionAlreadyCommittedResponseV1, WalletSessionRejectionV1 } from '../../../../../../shared-ts/src/authorization/walletSessionIssuance';
 import type { WalletSessionOperationCredentialV1 } from '../../../../../../shared-ts/src/device-linking';
-import type { ThresholdEd25519SessionId, WalletAuthMethodId, WalletAuthorityId, WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
+import type { ThresholdEd25519SessionId } from '../../../../../../shared-ts/src/utils/domainIds';
+import type { RouterAbEd25519OperationStepUpMaterialRecoveryRequest, RouterAbEd25519OperationStepUpMaterialRecoveryResponse } from '../../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
 import type { VerifiedOwnerProof } from '../../../../authorization/factorEvidence';
 export type RouterAbEd25519YaoSessionPolicyV1 = {
     readonly version: 'threshold_session_v1';
@@ -35,23 +37,8 @@ export type RouterAbEd25519YaoSessionRouteCommandV1 = {
     };
     readonly sessionKind: 'opaque';
 };
-type RouterAbEd25519YaoOperationStepUpMaterialRecoveryRequest = {
-    readonly kind: 'not_requested';
-} | {
-    readonly kind: 'email_otp_factor_release_v1';
-    readonly workerEphemeralPublicKey65B64u: string;
-};
-export type RouterAbEd25519YaoOperationStepUpMaterialRecoveryResponse = {
-    readonly kind: 'not_requested';
-} | {
-    readonly kind: 'email_otp_factor_release_v1';
-    readonly challengeId: string;
-    readonly enrollmentId: string;
-    readonly enrollmentSealKeyVersion: string;
-    readonly serverEphemeralPublicKey65B64u: string;
-    readonly nonce12B64u: string;
-    readonly ciphertextB64u: string;
-};
+type RouterAbEd25519YaoOperationStepUpMaterialRecoveryRequest = Readonly<RouterAbEd25519OperationStepUpMaterialRecoveryRequest>;
+export type RouterAbEd25519YaoOperationStepUpMaterialRecoveryResponse = Readonly<RouterAbEd25519OperationStepUpMaterialRecoveryResponse>;
 type RouterAbEd25519YaoOperationStepUpGrantCommandBase = {
     readonly kind: 'router_ab_ed25519_yao_operation_step_up_grant_v1';
     readonly normalSigningRequest: Record<string, unknown>;
@@ -93,35 +80,7 @@ export type RouterAbEd25519YaoBudgetRefreshRequestV1 = {
     readonly sessionPolicy: RouterAbEd25519YaoSessionPolicyV1;
     readonly authorization: RouterAbEd25519YaoBudgetRefreshAuthorizationV1;
 };
-/**
- * The committed identity of one Wallet Session issuance attempt whose
- * credential is unreachable. It is credential-free by construction: a replay
- * reads a committed digest, and no digest reproduces plaintext.
- */
-type RouterAbEd25519YaoCommittedWalletSessionV1 = {
-    readonly kind: 'already_committed_wallet_session_v1';
-    readonly walletId: WalletId;
-    readonly authorityId: WalletAuthorityId;
-    readonly walletAuthMethodId: WalletAuthMethodId;
-    readonly mintId: WalletSessionMintId;
-    readonly authorizationId: WalletSessionAuthorizationId;
-    readonly walletSessionId: WalletSessionId;
-    readonly quotaId: MpcWalletSigningQuotaId;
-};
-export type RouterAbEd25519YaoAlreadyCommittedResponseV1 = {
-    readonly ok: false;
-    readonly code: 'already_committed';
-    readonly message: string;
-    readonly next: 'unlock_exact_method';
-    readonly committed: RouterAbEd25519YaoCommittedWalletSessionV1;
-};
-type RouterAbEd25519YaoWalletSessionRejectionV1 = {
-    readonly ok: false;
-    readonly code: string;
-    readonly message: string;
-    readonly next?: never;
-    readonly committed?: never;
-};
+export type RouterAbEd25519YaoAlreadyCommittedResponseV1 = WalletSessionAlreadyCommittedResponseV1;
 type RouterAbEd25519YaoBudgetRefreshSessionV1 = {
     readonly ok: true;
     readonly walletId: string;
@@ -145,7 +104,7 @@ export type RouterAbEd25519YaoBudgetRefreshResponseV1 = (RouterAbEd25519YaoBudge
 }) | (RouterAbEd25519YaoBudgetRefreshSessionV1 & {
     readonly sessionKind: 'already_committed_exact_wallet_session';
     readonly operationCredential?: never;
-}) | RouterAbEd25519YaoAlreadyCommittedResponseV1 | RouterAbEd25519YaoWalletSessionRejectionV1;
+}) | RouterAbEd25519YaoAlreadyCommittedResponseV1 | WalletSessionRejectionV1;
 type RouterAbEd25519YaoVerifiedWalletUnlockRequestBaseV1 = {
     readonly walletId: string;
     readonly signerSlot: number;
@@ -173,6 +132,6 @@ export type RouterAbEd25519YaoVerifiedWalletUnlockResponseV1 = {
     readonly ok: true;
     readonly session: WalletRegistrationEd25519YaoBootstrapSession;
     readonly capability: RouterAbEd25519YaoActiveCapabilityDescriptorV1;
-} | RouterAbEd25519YaoAlreadyCommittedResponseV1 | RouterAbEd25519YaoWalletSessionRejectionV1;
+} | RouterAbEd25519YaoAlreadyCommittedResponseV1 | WalletSessionRejectionV1;
 export {};
 //# sourceMappingURL=routerAbEd25519YaoWalletSession.d.ts.map

package/dist/types/wallet-server/src/router/domains/passkeyCustody/walletRecoveryKeyManifest.d.ts

@@ -3,7 +3,6 @@ import type { EcdsaServerGeneration } from '../../../../../shared-ts/src/utils/e
 import type { RuntimePolicyScope } from '../../../../../shared-ts/src/threshold/signingRootScope';
 import type { WalletId } from '../../../../../shared-ts/src/utils/domainIds';
 import type { ThresholdEcdsaChainTarget } from '../../../core/thresholdEcdsaChainTarget';
-import type { RouterAbEd25519YaoApplicationBindingFactsV1, RouterAbEd25519YaoBytes32V1, RouterAbEd25519YaoLifecycleScopeV1 } from '../../../../../shared-ts/src/utils/routerAbEd25519Yao';
 import { type RouterAbEcdsaDerivationPublicCapabilityV1, type RouterAbEcdsaRegistrationActivationReceiptV1 } from '../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
 import { type WalletEcdsaSignerRecord, type WalletEd25519SignerRecord } from '../../../core/WalletStore';
 import type { D1WalletStore } from '../../../core/d1WalletStore';
@@ -11,6 +10,7 @@ import { type RecoveryCodeReservationId, type WalletRecoveryKeySetId } from '../
 import type { WalletRecoveryEcdsaPossessionChallengeV1 } from '../../../../../shared-ts/src/wallet-recovery/walletRecoveryEcdsaPossession';
 import { type WalletRecoveryEcdsaPossessionProofV1 } from '../../../../../shared-ts/src/wallet-recovery/walletRecoveryEcdsaPossession';
 import type { WalletAuthAuthorityRef } from '../../../../../shared-ts/src/utils/walletAuthAuthority';
+import type { WalletRecoveryPreparationNearRecoveryBasisV1 } from '../../../../../shared-ts/src/wallet-recovery/walletRecoveryPreparation';
 export type { WalletRecoveryKeySetId } from '../../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation';
 type WalletRecoveryKeyManifestEntryV1 = {
     readonly kind: 'near_ed25519';
@@ -79,18 +79,6 @@ type WalletRecoveryPreparationKeyManifestEntryV1 = {
     readonly recordedKeyManifestDigestB64u: string;
     readonly recoveryBasis: WalletRecoveryPreparationEcdsaRecoveryBasisV1;
 };
-type WalletRecoveryPreparationNearRecoveryBasisV1 = {
-    readonly capabilityKind: 'registration' | 'recovery';
-    readonly activeCapabilityBinding: RouterAbEd25519YaoBytes32V1;
-    readonly scope: RouterAbEd25519YaoLifecycleScopeV1;
-    readonly applicationBinding: RouterAbEd25519YaoApplicationBindingFactsV1;
-    readonly participantIds: readonly [number, number];
-    readonly registeredPublicKey: RouterAbEd25519YaoBytes32V1;
-    readonly runtimePolicyScope: RuntimePolicyScope;
-    readonly activationTranscript: RouterAbEd25519YaoBytes32V1;
-    readonly activationStateEpoch: number;
-    readonly signingWorkerVerifyingShare: RouterAbEd25519YaoBytes32V1;
-};
 type WalletRecoveryPreparationEcdsaRecoveryBasisV1 = {
     readonly publicCapability: RouterAbEcdsaDerivationPublicCapabilityV1;
     readonly activationReceipt: RouterAbEcdsaRegistrationActivationReceiptV1;

package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbEcdsaDerivationNormalSigningRoute.d.ts

@@ -1,9 +1,9 @@
-import type { EcdsaWalletSessionAdmission } from '../../../authorization/ecdsaWalletSessionAdmission';
+import type { EcdsaWalletSessionAdmissionInput, EcdsaWalletSessionPhaseAdmission } from '../../../authorization/ecdsaWalletSessionAdmission';
 import { type ThresholdEcdsaSessionInputs } from '../../auth/commonRouterUtils';
 import type { SessionAdapter } from '../../framework/routerApi';
 import { type RouterAbEcdsaDerivationEvmDigestSigningRequestV1Wire, type RouterAbEcdsaOperationStepUpPreparationV1Wire } from '../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
 import type { RuntimePolicyScope } from '../../../../../shared-ts/src/threshold/signingRootScope';
-import type { RouterApiAuthorizedOperationService, RouterApiAuthorizationSessionService, RouterApiWalletRegistrationService, RouterApiWalletSessionAuthorizationV2AdmissionContext, RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext } from '../../framework/authServicePort';
+import type { RouterApiAuthorizedOperationService, RouterApiAuthorizationSessionService, RouterApiWalletRegistrationService, RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext } from '../../framework/authServicePort';
 import { type AuthorizedOperation, type AuthorizedOperationReplayResponse, type OwnerOperationAuthorizationDecision, type SessionOrigin } from '../../../authorization/domain';
 import { type RouterAbMpcMaterialActivationRefWire } from '../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
 import { type AcceptedEcdsaRouteAdmission, type RouterAbEcdsaOperationAdmission, type RouterAbEcdsaOperationAdmissionKind, type RouterAbJsonRouteResult, type RouterAbNormalSigningAdmissionAdapter, type RouterAbNormalSigningRouteRuntime } from './routerAbNormalSigningAdmission';
@@ -88,21 +88,20 @@ export declare function resolveFreshRouterAbEcdsaMaterialActivation(input: {
 }>;
 type RouterAbEcdsaWalletSessionOperationBinding = {
     readonly kind: 'wallet_session_operation_credential_v1';
-    readonly context: RouterApiWalletSessionAuthorizationV2AdmissionContext;
+    readonly validated: Pick<RouterAbEcdsaV2WalletSessionValidationSuccess, 'admission'>;
 } | {
     readonly kind: 'wallet_session_operation_credential_exhausted_candidate_v1';
     readonly candidate: RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext;
 };
 export declare function admitRouterAbEcdsaReusableWalletSessionOperation(input: {
+    readonly phase: 'prepare' | 'finalize';
     request: RouterAbEcdsaOperationStepUpRequest;
-    materialActivation: RouterAbMpcMaterialActivationRefWire;
+    material: Pick<EcdsaWalletSessionAdmissionInput['material'], 'readSnapshot' | 'materialActivation' | 'keyHandle' | 'runtimePolicyScope'>;
     binding: RouterAbEcdsaWalletSessionOperationBinding;
-    authorizedOperations: Pick<RouterApiAuthorizedOperationService, 'tenantId' | 'admitEcdsaWalletSessionOperation'>;
-    resolveEcdsaMaterialActivation: RouterApiWalletRegistrationService['resolveEcdsaMaterialActivation'];
-}): Promise<{
+    authorizedOperations: Pick<RouterApiAuthorizedOperationService, 'tenantId' | 'admitEcdsaWalletSessionOperation' | 'resolveEcdsaWalletSessionOperation'>;
+}): Promise<({
     readonly ok: true;
-    readonly admission: EcdsaWalletSessionAdmission;
-} | {
+} & EcdsaWalletSessionPhaseAdmission) | {
     readonly ok: false;
     readonly error: RouterAbJsonRouteResult;
 }>;

package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbNormalSigningAdmission.d.ts

@@ -1,3 +1,4 @@
+import type { D1EcdsaAdmissionPolicyRead } from '../../cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore';
 import type { RouterAbNormalSigningAuthorizationIdentity } from '../../../core/routerAbSigning/RouterAbNormalSigningRuntime';
 import type { RouterAbNormalSigningRuntime } from '../../../core/routerAbSigning/RouterAbNormalSigningRuntime';
 import type { ThresholdEd25519AuthorityScope } from '../../../core/types';
@@ -277,8 +278,16 @@ export type RouterAbNormalSigningAdmissionFailure = {
 export type RouterAbNormalSigningAdmissionResult = {
     ok: true;
 } | RouterAbNormalSigningAdmissionFailure;
+type RouterAbNormalSigningPolicyReadSource = {
+    readonly kind: 'database';
+    readonly policyRead?: never;
+} | {
+    readonly kind: 'credential_snapshot';
+    readonly policyRead: D1EcdsaAdmissionPolicyRead;
+};
 export type RouterAbNormalSigningAdmissionInput = {
     curve: 'ed25519';
+    readonly policyReadSource?: never;
     authorityKind: 'wallet_authority_v1';
     authorityId: string;
     authorityScope?: never;
@@ -293,6 +302,7 @@ export type RouterAbNormalSigningAdmissionInput = {
     runtimePolicyScope: RuntimePolicyScope;
 } | {
     curve: 'ed25519';
+    readonly policyReadSource?: never;
     authorityKind?: never;
     authorityId?: never;
     phase: 'prepare' | 'finalize';
@@ -307,6 +317,7 @@ export type RouterAbNormalSigningAdmissionInput = {
     runtimePolicyScope: RuntimePolicyScope;
 } | {
     curve: 'ecdsa';
+    readonly policyReadSource: RouterAbNormalSigningPolicyReadSource;
     phase: 'prepare' | 'finalize';
     walletId: string;
     materialActivationId: MpcMaterialActivationId;
@@ -323,6 +334,7 @@ export interface RouterAbNormalSigningAdmissionAdapter {
 export type RouterAbNormalSigningAdmissionEvaluationInput = {
     adapter: RouterAbNormalSigningAdmissionAdapter | null | undefined;
     curve: 'ed25519';
+    readonly policyReadSource?: never;
     authorizationKind: 'wallet_session_operation_credential_v1';
     phase: 'prepare' | 'finalize';
     walletId: string;
@@ -337,6 +349,7 @@ export type RouterAbNormalSigningAdmissionEvaluationInput = {
 } | {
     adapter: RouterAbNormalSigningAdmissionAdapter | null | undefined;
     curve: 'ecdsa';
+    readonly policyReadSource: RouterAbNormalSigningPolicyReadSource;
     authorizationKind: 'wallet_session_operation_credential_v1';
     phase: 'prepare' | 'finalize';
     walletId: string;

package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbOperationStepUp.d.ts

@@ -9,6 +9,7 @@ import { type RouterAbMpcMaterialActivationRefWire } from '../../../../../shared
 import type { Ed25519OperationKind } from './ed25519AuthorizedOperationReceipt';
 import { type WalletAuthMethodId } from '../../../../../shared-ts/src/utils/domainIds';
 import { type RouterAbJsonRouteResult } from './routerAbNormalSigningAdmission';
+import type { ReadonlyExclusiveUnion } from '../../../../../shared-ts/src/utils/variant';
 export type ActiveEd25519MaterialActivation = Extract<Awaited<ReturnType<RouterApiWalletRegistrationService['resolveEd25519MaterialActivation']>>, {
     readonly ok: true;
 }>;
@@ -64,17 +65,15 @@ type RouterAbExactOperationStepUpIdentityInput = {
     readonly requestExpiresAtMs: number;
     readonly authorizedOperations: RouterApiAuthorizedOperationService | null | undefined;
     readonly authorizationSessions: RouterApiAuthorizationSessionService | null | undefined;
-} & ({
+} & ReadonlyExclusiveUnion<{
     readonly keyFamily: 'ed25519';
     readonly operationKind: Ed25519OperationKind;
     readonly resolveEd25519MaterialActivation: RouterApiWalletRegistrationService['resolveEd25519MaterialActivation'];
-    readonly resolveEcdsaMaterialActivation?: never;
 } | {
     readonly keyFamily: 'ecdsa_secp256k1';
     readonly operationKind: 'evm.sign_transaction' | 'evm.export_key';
-    readonly resolveEd25519MaterialActivation?: never;
     readonly resolveEcdsaMaterialActivation: RouterApiWalletRegistrationService['resolveEcdsaMaterialActivation'];
-});
+}>;
 type RouterAbVerifiedOwnerOperationStepUpIdentityInput = {
     readonly kind: 'verified_owner_proof';
     readonly headers: Record<string, string | string[] | undefined>;

package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbPrivateSigningWorker.d.ts

@@ -3,9 +3,11 @@ import { type RouterAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestV1Wire,
 import type { RuntimePolicyScope } from '../../../../../shared-ts/src/threshold/signingRootScope';
 import type { SigningWorkerLaneMaterialIdentityV1 } from '../../../core/signingLanes/signingWorkerLaneMaterialIdentity';
 import type { AuthorizedOperationReplayResponse } from '../../../authorization/domain';
+import type { RouterAbNormalSigningAuthorizationWire } from '../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
 import type { MpcMaterialActivationId } from '../../../../../shared-ts/src/utils/domainIds';
 import { type RouterAbSigningWorkerJsonResult } from './routerAbNormalSigningAdmission';
 import type { RouterAbOperationStepUpWalletSession } from './routerAbOperationStepUp';
+import type { ReadonlyExclusiveUnion } from '../../../../../shared-ts/src/utils/variant';
 declare const PRIVATE_ED25519_SIGNING_PREPARE_PATH = "/router-ab/signing-worker/sign/prepare";
 declare const PRIVATE_ED25519_SIGNING_FINALIZE_PATH = "/router-ab/signing-worker/sign";
 declare const PRIVATE_ECDSA_DERIVATION_SIGNING_PREPARE_PATH = "/router-ab/signing-worker/ecdsa-derivation/sign/prepare";
@@ -23,14 +25,7 @@ export declare const ROUTER_AB_ECDSA_DERIVATION_PRIVATE_SIGNING_PATHS: {
 type RouterAbConfiguredSigningWorkerPrivateTransport = Extract<RouterAbSigningWorkerPrivateTransport, {
     readonly kind: 'configured';
 }>;
-export type RouterAbEd25519NormalSigningAuthorizationV2 = {
-    readonly kind: 'reusable_wallet_session';
-    readonly wallet_session_id: string;
-} | {
-    readonly kind: 'operation_step_up';
-    readonly evidence_set_digest?: never;
-    readonly wallet_session_id?: never;
-};
+export type RouterAbEd25519NormalSigningAuthorizationV2 = RouterAbNormalSigningAuthorizationWire;
 type RouterAbMpcMaterialActivationRefV1 = {
     readonly kind: 'mpc_material_activation_ref';
     readonly activation_id: MpcMaterialActivationId;
@@ -56,26 +51,22 @@ type RouterAbPrivateSigningAuthorization = {
     readonly kind: 'operation_step_up';
     readonly session: RouterAbOperationStepUpWalletSession;
 };
-type RouterAbOwnerAdmissionAuthV1 = {
+type RouterAbOwnerAdmissionAuthV1 = ReadonlyExclusiveUnion<{
     readonly auth: 'owner_wallet_session';
     readonly subject_id: string;
     readonly wallet_session_id: string;
-    readonly authorization_session_id?: never;
 } | {
     readonly auth: 'owner_operation_step_up';
     readonly subject_id: string;
     readonly authorization_session_id: string;
-    readonly wallet_session_id?: never;
-};
-type RouterAbNormalSigningPrivateAuthorizationV2 = {
+}>;
+type RouterAbNormalSigningPrivateAuthorizationV2 = ReadonlyExclusiveUnion<{
     readonly kind: 'reusable_wallet_session';
     readonly wallet_session_id: string;
-    readonly authorization_session_id?: never;
 } | {
     readonly kind: 'operation_step_up';
     readonly authorization_session_id: string;
-    readonly wallet_session_id?: never;
-};
+}>;
 type RouterAbNormalSigningTrustedMetadataV1 = {
     readonly org_id: string;
     readonly project_id: string;

package/dist/types/wallet-server/src/router/domains/syncAccount/syncAccountRequestValidation.d.ts

@@ -1,14 +1,9 @@
-import type { WebAuthnAuthenticationCredential } from '../../../core/types';
+import type { PasskeyVerifyRequest } from '../../auth/authRequestValidation';
 type SyncAccountOptionsRequest = {
     rp_id: string;
     account_id?: string;
     ttl_ms?: number;
 };
-type SyncAccountVerifyRequest = {
-    challengeId: string;
-    webauthn_authentication: WebAuthnAuthenticationCredential;
-    expected_origin: string;
-};
 type SyncAccountRouteErrorBody = {
     ok: false;
     code: 'invalid_body';
@@ -26,6 +21,6 @@ export declare function parseSyncAccountOptionsRequest(raw: unknown): SyncAccoun
 export declare function parseSyncAccountVerifyRequest(input: {
     body: unknown;
     origin: unknown;
-}): SyncAccountRouteParseResult<SyncAccountVerifyRequest>;
+}): SyncAccountRouteParseResult<PasskeyVerifyRequest>;
 export {};
 //# sourceMappingURL=syncAccountRequestValidation.d.ts.map

package/dist/types/wallet-server/src/router/framework/apiCredentialPorts.d.ts

@@ -1,6 +1,7 @@
+import type { RouterApiKeyAuthFailureCode } from '../../../../shared-ts/src/utils/routerApiKeyAuth';
 export declare const ROUTER_API_CREDENTIAL_SCOPES: readonly ["accounts.create", "wallets.read", "wallets.auth_methods.create", "wallets.signers.create"];
 export type RouterApiCredentialScope = (typeof ROUTER_API_CREDENTIAL_SCOPES)[number];
-export type RouterApiKeyAuthFailureCode = 'secret_key_missing' | 'secret_key_invalid' | 'secret_key_revoked' | 'secret_key_forbidden_scope' | 'secret_key_ip_blocked' | 'secret_key_environment_mismatch';
+export type { RouterApiKeyAuthFailureCode };
 export interface RouterApiKeyAuthRequest {
     secret: string;
     endpoint: string;
@@ -56,6 +57,7 @@ export interface RouterApiUsageMeterEvent {
     action: RouterApiUsageMeterAction;
     succeeded: boolean;
     occurredAt?: string;
+    /** Producer-owned idempotency key; replays with the same id must not double-count. */
     sourceEventId?: string;
 }
 export interface RouterApiUsageMeterAdapter {

package/dist/types/wallet-server/src/router/framework/authServicePort.d.ts

@@ -1,3 +1,6 @@
+import type { D1EcdsaAdmissionPolicyRead } from '../cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore';
+import type { EcdsaMaterialRead, EcdsaMaterialActivationReadInput } from '../../core/d1EcdsaSignerRead';
+import type { EcdsaMaterialReadSnapshot } from '../../core/ecdsaMaterialReadSnapshot';
 import type { DigestB64u } from '../../../../shared-ts/src/utils/canonicalPrimitives';
 import type { TenantRootIdentityV1 } from '../../../../shared-ts/src/tenant-root/tenantRootIdentity';
 import type { AddAuthMethodIntentCallerV1, AddAuthMethodIntentGrant } from '../../../../shared-ts/src/utils/registrationIntent';
@@ -96,6 +99,19 @@ export type RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext = {
     readonly authMethod: ActiveWalletAuthMethodRecordV2;
     readonly retiredAtMs: null;
 };
+export type RouterApiWalletSessionSigningCandidate = {
+    readonly kind: 'active';
+    readonly materialRead: EcdsaMaterialRead;
+    readonly policyRead: D1EcdsaAdmissionPolicyRead;
+    readonly context: RouterApiWalletSessionAuthorizationV2AdmissionContext;
+    readonly candidate?: never;
+} | {
+    readonly kind: 'exhausted';
+    readonly materialRead: EcdsaMaterialRead;
+    readonly policyRead: D1EcdsaAdmissionPolicyRead;
+    readonly candidate: RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext;
+    readonly context?: never;
+};
 type RouterApiHostedWalletSessionAuthorizationV2AdmissionContext = RouterApiWalletSessionAuthorizationV2AdmissionContext & {
     readonly hostedCredentialId: HostedWalletSessionCredentialId;
     readonly appOrigin: SessionOrigin;
@@ -993,11 +1009,9 @@ export interface RouterApiWalletRegistrationService {
         readonly code: 'not_found' | 'invalid_state' | 'internal';
         readonly message: string;
     }>;
-    resolveEcdsaMaterialActivation(input: {
-        readonly walletId: string;
-        readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
-    }): Promise<{
+    resolveEcdsaMaterialActivation(input: EcdsaMaterialActivationReadInput): Promise<{
         readonly ok: true;
+        readonly readSnapshot: EcdsaMaterialReadSnapshot;
         readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
         readonly keyHandle: string;
         readonly relayerKeyId: string;
@@ -1312,6 +1326,7 @@ export interface RouterApiServiceBag {
     deviceLinkingOwnerAuthorization?: DeviceLinkingOwnerAuthorizationRouteServiceV1;
 }
 export interface RouterApiAuthorizedOperationService {
+    resolveEcdsaWalletSessionOperation(input: import('../../authorization/ecdsaWalletSessionAdmission').EcdsaWalletSessionAdmissionInput): Promise<import('../../authorization/ecdsaWalletSessionAdmission').EcdsaWalletSessionResolutionResult>;
     admitEcdsaWalletSessionOperation(input: import('../../authorization/ecdsaWalletSessionAdmission').EcdsaWalletSessionAdmissionInput): Promise<import('../../authorization/ecdsaWalletSessionAdmission').EcdsaWalletSessionAdmissionResult>;
     readonly tenantId: TenantId;
     readPinnedOwnerWalletScope(input: {
@@ -1369,6 +1384,12 @@ export interface RouterApiAuthorizationSessionService {
         readonly token: string;
         readonly nowMs: number;
     }) => Promise<RouterApiWalletSessionAuthorizationV2AdmissionContext | null>;
+    readonly readWalletSessionSigningCandidateByOperationCredential: (input: {
+        readonly tenantId: TenantId;
+        readonly token: string;
+        readonly nowMs: number;
+        readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
+    }) => Promise<RouterApiWalletSessionSigningCandidate | null>;
     readonly readWalletSessionExactOperationContextByCredential: (input: {
         readonly tenantId: TenantId;
         readonly token: string;

package/dist/types/wallet-server/src/router/framework/http.d.ts

@@ -1,5 +1,6 @@
 import type { RouterApiOptions } from './routerApi';
 export declare function json(body: unknown, init?: ResponseInit, extraHeaders?: Record<string, string>): Response;
+export declare function jsonFailure(status: number, code: string, message: string): Response;
 export declare function withCors(headers: Headers, opts?: RouterApiOptions, request?: Request): void;
 export declare function toResponse(out: {
     status: number;

package/dist/types/wallet-server/src/router/framework/ror/normalize.d.ts

@@ -1,14 +1,6 @@
-import { type SigningSessionSealProtocol } from '../../../../../shared-ts/src/utils/signingSessionSeal';
+import { type WellKnownSigningSessionSealCapabilities } from '../../../../../shared-ts/src/utils/signingSessionSeal';
 export declare function normalizeCsv(valuesRaw: unknown): string[];
 export declare function sanitizeRorOrigins(origins: unknown): string[];
 export declare function normalizeRorHost(hostRaw: unknown): string | null;
-type WellKnownSigningSessionSealCapabilities = {
-    mode: 'none';
-} | {
-    mode: 'sealed_refresh_v1';
-    protocol: SigningSessionSealProtocol;
-    currentKeyVersion: string;
-};
 export declare function resolveWellKnownSigningSessionSealCapabilities(signingSessionSealOptionsRaw: unknown): WellKnownSigningSessionSealCapabilities;
-export {};
 //# sourceMappingURL=normalize.d.ts.map