@seams/wallet-server 0.7.1 → 0.8.0

package/dist/types/shared-ts/src/utils/routerAbNormalSigningIdentity.d.ts

@@ -1,4 +1,6 @@
 import { type MpcMaterialActivationRef } from './domainIds';
+import type { RouterAbEcdsaOperationStepUpPreparationV1Wire } from './routerAbEcdsaDerivation';
+import type { RouterAbMpcMaterialActivationRefV1 } from './generated/routerAbEd25519YaoCore';
 export type RouterAbNormalSigningAuthorizationWire = {
     readonly kind: 'reusable_wallet_session';
     readonly wallet_session_id: string;
@@ -7,15 +9,18 @@ export type RouterAbNormalSigningAuthorizationWire = {
     readonly evidence_set_digest?: never;
     readonly wallet_session_id?: never;
 };
-export type RouterAbMpcMaterialActivationRefWire = {
-    readonly kind: 'mpc_material_activation_ref';
-    readonly activation_id: string;
-    readonly capability: string;
-    readonly material_owner: string;
-    readonly key_binding: string;
-    readonly lifecycle_binding: string;
-    readonly signing_worker: string;
+export type RouterAbEcdsaDerivationPoolFillAuthorization = {
+    readonly authorization: Extract<RouterAbNormalSigningAuthorizationWire, {
+        readonly kind: 'reusable_wallet_session';
+    }>;
+    readonly operation?: never;
+} | {
+    readonly authorization: Extract<RouterAbNormalSigningAuthorizationWire, {
+        readonly kind: 'operation_step_up';
+    }>;
+    readonly operation: RouterAbEcdsaOperationStepUpPreparationV1Wire;
 };
+export type RouterAbMpcMaterialActivationRefWire = Readonly<RouterAbMpcMaterialActivationRefV1>;
 export type RouterAbEd25519OperationStepUpPreparationV1Wire = {
     readonly wallet_id: string;
     readonly operation_kind: 'near.sign_transaction' | 'near.sign_delegate_action' | 'near.sign_nep413_message';
@@ -29,6 +34,23 @@ export type RouterAbEd25519OperationStepUpPreparationV1Wire = {
     readonly participant_ids: readonly [number, number];
     readonly expires_at_ms: number;
 };
+export type RouterAbEd25519OperationStepUpMaterialRecoveryRequest = {
+    kind: 'not_requested';
+} | {
+    kind: 'email_otp_factor_release_v1';
+    workerEphemeralPublicKey65B64u: string;
+};
+export type RouterAbEd25519OperationStepUpMaterialRecoveryResponse = {
+    kind: 'not_requested';
+} | {
+    kind: 'email_otp_factor_release_v1';
+    challengeId: string;
+    enrollmentId: string;
+    enrollmentSealKeyVersion: string;
+    serverEphemeralPublicKey65B64u: string;
+    nonce12B64u: string;
+    ciphertextB64u: string;
+};
 export type RouterAbEd25519OwnerOperationAuthorizationDecisionV1Wire = {
     readonly kind: 'authorized';
     readonly operation: {

package/dist/types/shared-ts/src/utils/routerApiKeyAuth.d.ts

@@ -0,0 +1,2 @@
+export type RouterApiKeyAuthFailureCode = 'secret_key_missing' | 'secret_key_invalid' | 'secret_key_revoked' | 'secret_key_forbidden_scope' | 'secret_key_ip_blocked' | 'secret_key_environment_mismatch';
+//# sourceMappingURL=routerApiKeyAuth.d.ts.map

package/dist/types/shared-ts/src/utils/signingSessionSeal.d.ts

@@ -1,6 +1,7 @@
 import type { RouterAbEcdsaDerivationNormalSigningStateV1, RouterAbEcdsaDerivationPublicCapabilityV1 } from './routerAbEcdsaDerivation';
 import type { EmailOtpProvider, EmailOtpWalletAuthAuthority, WalletAuthAuthorityRef } from './walletAuthAuthority';
 import type { MpcMaterialActivationRef } from './domainIds';
+import type { ThresholdEcdsaChainTarget } from './thresholdEcdsaChainTarget';
 import { SIGNER_AUTH_METHODS, type SignerAuthMethod } from './signerDomain';
 export declare const SIGNING_SESSION_SEALED_RECORD_VERSION: 2;
 export declare const SIGNING_SESSION_SEAL_ALG: "shamir3pass-v2";
@@ -23,6 +24,14 @@ export type SigningSessionSealProtocol = {
     algorithm: typeof SIGNING_SESSION_SEAL_ALG;
     groupId: SigningSessionSealGroupId;
 };
+/** The signing-session seal capabilities a relayer publishes in its well-known document. */
+export type WellKnownSigningSessionSealCapabilities = {
+    mode: 'none';
+} | {
+    mode: 'sealed_refresh_v1';
+    protocol: SigningSessionSealProtocol;
+    currentKeyVersion: string;
+};
 export type SealedSigningSessionEcdsaRestoreSource = 'login' | 'registration' | 'manual-bootstrap' | 'email_otp';
 export type RouterAbEd25519NormalSigningState = {
     kind: typeof ROUTER_AB_ED25519_NORMAL_SIGNING_STATE_KIND;
@@ -30,18 +39,8 @@ export type RouterAbEd25519NormalSigningState = {
 };
 export declare function parseRouterAbEd25519NormalSigningState(value: unknown): RouterAbEd25519NormalSigningState | null;
 export declare function requireRouterAbEd25519NormalSigningState(value: unknown): RouterAbEd25519NormalSigningState;
-type SealedSigningSessionEcdsaChainTarget = {
-    kind: 'tempo';
-    chainId: number;
-    networkSlug: string;
-} | {
-    kind: 'evm';
-    namespace: 'eip155';
-    chainId: number;
-    networkSlug: string;
-};
 type SealedSigningSessionEcdsaRestoreMetadataBase = {
-    chainTarget: SealedSigningSessionEcdsaChainTarget;
+    chainTarget: ThresholdEcdsaChainTarget;
     signingRootId: string;
     signingRootVersion: string;
     keyHandle: string;

package/dist/types/shared-ts/src/utils/thresholdEcdsaChainTarget.d.ts

@@ -0,0 +1,25 @@
+export type EvmEip155ChainTarget = {
+    kind: 'evm';
+    namespace: 'eip155';
+    chainId: number;
+    networkSlug: string;
+};
+export type TempoChainTarget = {
+    kind: 'tempo';
+    chainId: number;
+    networkSlug: string;
+};
+export type ThresholdEcdsaChainTarget = EvmEip155ChainTarget | TempoChainTarget;
+/** A chain target as requests carry it: the network slug may still be unresolved. */
+export type ThresholdEcdsaChainTargetWire = {
+    kind: 'evm';
+    namespace: 'eip155';
+    chainId: number;
+    networkSlug?: string;
+} | {
+    kind: 'tempo';
+    chainId: number;
+    networkSlug?: string;
+};
+export declare function thresholdEcdsaChainTargetKey(target: ThresholdEcdsaChainTargetWire): string;
+//# sourceMappingURL=thresholdEcdsaChainTarget.d.ts.map

package/dist/types/shared-ts/src/utils/validation.d.ts

@@ -1,6 +1,4 @@
-export type { NearAccountValidationOptions } from './near';
-export { ensureEd25519Prefix, validateNearAccountId, isValidAccountId } from './near';
-export { normalizeOptionalString as toOptionalString, normalizeOptionalTrimmedString as toOptionalTrimmedString, normalizeTrimmedString as toTrimmedString, stripTrailingSlashes, ensureLeadingSlash, toBasePath, toOriginOrUndefined, toRorOriginOrNull, toSingleLine, normalizeInteger, normalizePositiveInteger, } from './normalize';
+export { normalizeOptionalString as toOptionalString, normalizeOptionalTrimmedString as toOptionalTrimmedString, normalizeTrimmedString as toTrimmedString, stripTrailingSlashes, ensureLeadingSlash, toBasePath, toOriginOrUndefined, toRorOriginOrNull, normalizeInteger, normalizePositiveInteger, } from './normalize';
 export declare function requireTrimmedString(value: unknown, label: string, message?: string): string;
 export declare function toOptionalTrimmedNonEmptyString(value: unknown): string | undefined;
 export declare function requireNonEmptyString(value: unknown, label: string): string;

package/dist/types/shared-ts/src/utils/variant.d.ts

@@ -8,4 +8,22 @@
 export type Variant<U, K extends keyof U, V extends U[K]> = Extract<U, {
     readonly [P in K]: V;
 }>;
+type KeysOfUnion<U> = U extends unknown ? keyof U : never;
+type Flatten<T> = {
+    [K in keyof T]: T[K];
+};
+/**
+ * Union `U` with each member's missing keys added as `?: never`, where the missing keys are
+ * those that other members declare. The members stay mutually exclusive, and code can read any
+ * member's key without narrowing first (it reads as `undefined` on the members that lack it).
+ * `K` holds every member's keys, taken before `U` distributes.
+ */
+export type ExclusiveUnion<U, K extends PropertyKey = KeysOfUnion<U>> = U extends unknown ? Flatten<U & {
+    [P in Exclude<K, keyof U>]?: never;
+}> : never;
+/** `ExclusiveUnion` for readonly members: the added keys are `readonly` too. */
+export type ReadonlyExclusiveUnion<U, K extends PropertyKey = KeysOfUnion<U>> = U extends unknown ? Flatten<U & {
+    readonly [P in Exclude<K, keyof U>]?: never;
+}> : never;
+export {};
 //# sourceMappingURL=variant.d.ts.map

package/dist/types/shared-ts/src/utils/walletAuthMethodRecord.d.ts

@@ -1,6 +1,6 @@
 import { type DigestB64u } from './canonicalPrimitives';
 import { type WalletAuthMethodId, type WalletAuthorityId, type WalletId, type WebAuthnCredentialIdB64u, type WebAuthnRpId } from './domainIds';
-import type { Variant } from './variant';
+import type { Variant, ReadonlyExclusiveUnion } from './variant';
 export type WalletAuthMethodRevocationProof = {
     readonly kind: 'webauthn_assertion';
     rpId: WebAuthnRpId;
@@ -44,19 +44,16 @@ export type WalletAuthMethodRecord = {
     credentialPublicKeyB64u?: never;
     counter?: never;
 };
-type WalletAuthMethodLifecycleV1 = {
+type WalletAuthMethodLifecycleV1 = ReadonlyExclusiveUnion<{
     readonly status: 'pending_local_install';
-    readonly activatedAtMs?: never;
-    readonly revokedAtMs?: never;
 } | {
     readonly status: 'active';
     readonly activatedAtMs: number;
-    readonly revokedAtMs?: never;
 } | {
     readonly status: 'revoked';
     readonly activatedAtMs: number;
     readonly revokedAtMs: number;
-};
+}>;
 type WalletAuthMethodDraftCommonV1 = {
     readonly walletAuthMethodId: WalletAuthMethodId;
     readonly walletId: WalletId;

package/dist/types/shared-ts/src/utils/walletCapabilityBindings.d.ts

@@ -74,7 +74,6 @@ export declare function buildEmailOtpWalletAuthMethodBinding(args: {
     emailHashHex: string;
     registrationAuthorityId: string;
 }): WalletAuthMethodBinding;
-export declare function walletAuthMethodBindingId(binding: WalletAuthMethodBinding): WalletAuthMethodId;
 export declare function walletAuthMethodBindingFromRaw(raw: unknown): WalletCapabilityBindingParseResult<WalletAuthMethodBinding>;
 export declare function buildNoCurrentWalletAuthMethod(): Extract<CurrentWalletAuthMethod, {
     kind: 'none';

package/dist/types/shared-ts/src/utils/walletManagementProtocol.d.ts

@@ -0,0 +1,3 @@
+export declare const WALLET_MANAGEMENT_PROTOCOL_HEADER = "X-Seams-Wallet-Protocol";
+export declare const WALLET_MANAGEMENT_PROTOCOL_VERSION = "2";
+//# sourceMappingURL=walletManagementProtocol.d.ts.map

package/dist/types/shared-ts/src/utils/webauthnDeviceInfo.d.ts

@@ -10,8 +10,8 @@
  * Stored on the authenticator row and returned by the authenticators listing
  * so profile UIs can label signers ("Chrome on macOS", "iCloud Keychain").
  */
-type WebAuthnDeviceBrowser = 'chrome' | 'safari' | 'firefox' | 'edge' | 'other';
-type WebAuthnDeviceOs = 'macos' | 'ios' | 'windows' | 'android' | 'linux' | 'other';
+type WebAuthnDeviceBrowser = (typeof WEBAUTHN_DEVICE_BROWSERS)[number];
+type WebAuthnDeviceOs = (typeof WEBAUTHN_DEVICE_OSES)[number];
 export type WebAuthnAuthenticatorDeviceInfo = {
     /** Display-ready label, e.g. "Chrome on macOS". Never empty. */
     label: string;
@@ -26,6 +26,8 @@ export type WebAuthnAuthenticatorDeviceInfo = {
     /** Display name for the provider, e.g. "iCloud Keychain". */
     providerLabel?: string;
 };
+declare const WEBAUTHN_DEVICE_BROWSERS: readonly ["chrome", "safari", "firefox", "edge", "other"];
+declare const WEBAUTHN_DEVICE_OSES: readonly ["macos", "ios", "windows", "android", "linux", "other"];
 export declare function deriveWebAuthnAuthenticatorDeviceInfo(input: {
     userAgent?: string;
     aaguid?: string;

package/dist/types/shared-ts/src/utils/wireSchema.d.ts

@@ -50,8 +50,6 @@ export declare function wireUnion<K extends string, V extends WireParser<unknown
 }>(tag: K, variants: readonly V[]): WireParser<WireType<V>>;
 /** `null`, or a value `parse` accepts. */
 export declare function wireNullable<T>(parse: WireParser<T>): WireParser<T | null>;
-/** A non-empty array of `item`; `refine` checks rules that span the items. */
-export declare function wireNonEmptyArray<T>(item: WireParser<T>, refine?: (items: readonly [T, ...T[]], label: string) => void): WireParser<readonly [T, ...T[]]>;
 /** Adapts a parser that returns a result, putting the field's label before its error. */
 export declare function wireResult<T>(parse: (raw: unknown) => ParseResult<T>): WireParser<T>;
 /** Adapts a parser that throws, putting the field's label before its error. */

package/dist/types/shared-ts/src/wallet-recovery/backupAcknowledgement.d.ts

@@ -32,7 +32,6 @@ type WalletRecoveryBackupAcknowledgementParseResult = {
     readonly record: WalletRecoveryBackupAcknowledgementV1;
 } | {
     readonly ok: false;
-    readonly reason: string;
 };
 export declare function parseWalletRecoveryBackupAcknowledgementV1(raw: unknown, options: {
     readonly expectedWalletId: string;

package/dist/types/shared-ts/src/wallet-recovery/recoveryCodeReservation.d.ts

@@ -29,7 +29,7 @@ type RecoveryCodeTransitionResult = {
     code: RecoveryCodeTransitionRejection;
     message: string;
 };
-export type RecoveryCodeTransitionRejection = 'already_consumed' | 'revoked' | 'already_reserved' | 'not_reserved' | 'reservation_expired' | 'reservation_mismatch';
+type RecoveryCodeTransitionRejection = 'already_consumed' | 'revoked' | 'already_reserved' | 'not_reserved' | 'reservation_expired' | 'reservation_mismatch';
 export declare function parseRecoveryCodeReservationId(value: unknown): RecoveryCodeReservationId;
 /**
  * Places a hold on an active code.
@@ -44,15 +44,6 @@ export declare function reserveRecoveryCode(args: {
     nowMs: number;
     reservationTtlMs: number;
 }): RecoveryCodeTransitionResult;
-/**
- * Releases a hold after a failed pre-commit recovery, returning the code to the
- * active pool. Releasing a consumed code is refused: consumption is terminal
- * and a post-commit failure must not hand the code back.
- */
-export declare function releaseRecoveryCodeReservation(args: {
-    lifecycle: RecoveryCodeLifecycleState;
-    reservationId: RecoveryCodeReservationId;
-}): RecoveryCodeTransitionResult;
 /**
  * Consumes a reserved code once every required activation receipt has verified.
  *

package/dist/types/shared-ts/src/wallet-recovery/recoveryCodes.d.ts

@@ -1,11 +1,9 @@
 export { EMAIL_OTP_RECOVERY_KEY_ALPHABET as WALLET_RECOVERY_CODE_ALPHABET, EMAIL_OTP_RECOVERY_KEY_BYTE_LENGTH as WALLET_RECOVERY_CODE_BYTE_LENGTH, EMAIL_OTP_RECOVERY_KEY_CHAR_LENGTH as WALLET_RECOVERY_CODE_CHAR_LENGTH, EMAIL_OTP_RECOVERY_KEY_COUNT as WALLET_RECOVERY_CODE_COUNT, EMAIL_OTP_RECOVERY_KEY_GROUP_COUNT as WALLET_RECOVERY_CODE_GROUP_COUNT, EMAIL_OTP_RECOVERY_KEY_GROUP_LENGTH as WALLET_RECOVERY_CODE_GROUP_LENGTH, buildEmailOtpRecoveryCodeSet as buildWalletRecoveryCodeSet, decodeEmailOtpRecoveryKey as decodeWalletRecoveryCode, formatEmailOtpRecoveryKey as formatWalletRecoveryCode, normalizeEmailOtpRecoveryKey as normalizeWalletRecoveryCode, } from '../utils/emailOtpRecoveryKey';
 export type { EmailOtpRecoveryCode as WalletRecoveryCode, EmailOtpRecoveryCodeSet as WalletRecoveryCodeSet, } from '../utils/emailOtpRecoveryKey';
-export { deriveWalletRecoveryKeyId, deriveWalletRecoveryKeyIdFromBytes, isDerivedWalletRecoveryKeyId, parseDerivedWalletRecoveryKeyId, WALLET_RECOVERY_KEY_ID_PREFIX_V1, } from './recoveryKeyId';
+export { deriveWalletRecoveryKeyIdFromBytes, parseDerivedWalletRecoveryKeyId, WALLET_RECOVERY_KEY_ID_PREFIX_V1, } from './recoveryKeyId';
 export type { DerivedWalletRecoveryKeyId } from './recoveryKeyId';
 export { issueWalletRecoveryCodes, zeroizeIssuedWalletRecoveryCodes } from './recoveryCodeIssuance';
 export type { IssuedWalletRecoveryCodes } from './recoveryCodeIssuance';
-export { runWalletRecoveryWithCode } from './recoveryCodeAttempt';
-export type { WalletRecoveryActivationResult, WalletRecoveryAttemptOutcome, } from './recoveryCodeAttempt';
 export { buildWalletRecoveryBackupAcknowledgementV1, parseWalletRecoveryBackupAcknowledgementV1, walletRecoveryBackupIsOutstanding, } from './backupAcknowledgement';
 export type { WalletRecoveryBackupAcknowledgementV1 } from './backupAcknowledgement';
 //# sourceMappingURL=recoveryCodes.d.ts.map

package/dist/types/shared-ts/src/wallet-recovery/recoveryEnvelopes.d.ts

@@ -1,4 +1,5 @@
 import type { RecoveryCodeReservationId } from './recoveryCodeReservation';
+import type { ExclusiveUnion } from '../utils/variant';
 /**
  * Lifecycle of one recovery code.
  *
@@ -6,37 +7,23 @@ import type { RecoveryCodeReservationId } from './recoveryCodeReservation';
  * commits only after the replacement credential activates. See
  * `recoveryCodeReservation.ts` for the transitions between these states.
  */
-export type RecoveryCodeLifecycleState = {
+export type RecoveryCodeLifecycleState = ExclusiveUnion<{
     state: 'active';
     issuedAtMs: number;
-    reservationId?: never;
-    reservedAtMs?: never;
-    reservationExpiresAtMs?: never;
-    consumedAtMs?: never;
-    revokedAtMs?: never;
 } | {
     state: 'reserved';
     issuedAtMs: number;
     reservationId: RecoveryCodeReservationId;
     reservedAtMs: number;
     reservationExpiresAtMs: number;
-    consumedAtMs?: never;
-    revokedAtMs?: never;
 } | {
     state: 'consumed';
     issuedAtMs: number;
     reservationId: RecoveryCodeReservationId;
     consumedAtMs: number;
-    reservedAtMs?: never;
-    reservationExpiresAtMs?: never;
-    revokedAtMs?: never;
 } | {
     state: 'revoked';
     issuedAtMs: number;
     revokedAtMs: number;
-    reservationId?: never;
-    reservedAtMs?: never;
-    reservationExpiresAtMs?: never;
-    consumedAtMs?: never;
-};
+}>;
 //# sourceMappingURL=recoveryEnvelopes.d.ts.map

package/dist/types/shared-ts/src/wallet-recovery/recoveryKeyId.d.ts

@@ -1,9 +1,9 @@
 /**
  * The identity of one recovery code inside a wallet's custody set.
  *
- * **Wallet-scoped, and factor-neutral on purpose.** The Email OTP id it
- * replaces (`deriveEmailOtpRecoveryKeyId`) puts `enrollmentVersion` and
- * `enrollmentSealKeyVersion` in its tuple, so it cannot mint an id for a
+ * **Wallet-scoped, and factor-neutral on purpose.** The tuple holds the code,
+ * the wallet id and the set version, and no Email OTP enrollment field
+ * (`enrollmentVersion`, `enrollmentSealKeyVersion`), so it can mint an id for a
  * passkey wallet — which has no enrollment at all. A wallet custody recovery
  * set belongs to the wallet, not to whichever factor happened to establish it,
  * exactly as the seed and the continuity cache do.
@@ -25,29 +25,13 @@ export type DerivedWalletRecoveryKeyId = string & {
 };
 export declare const WALLET_RECOVERY_KEY_ID_PREFIX_V1: "wallet-rkid-v1-";
 export declare function parseDerivedWalletRecoveryKeyId(value: unknown, label?: string): DerivedWalletRecoveryKeyId;
-export declare function isDerivedWalletRecoveryKeyId(value: unknown): value is DerivedWalletRecoveryKeyId;
 /**
- * Derives one code's id within a wallet's recovery set.
+ * Derives one code's id within a wallet's recovery set, from the decoded code
+ * bytes the ceremony already holds.
  *
  * Bound to the wallet and the set version, so the same code typed against a
  * different wallet produces a different id and finds no wrap. Length-delimited
  * fields under a fixed context, so no two inputs encode alike.
- *
- * The decoded code bytes are zeroized before returning, including on failure —
- * the code is the factor that opens the seed, and it must not outlive this
- * call in a buffer the caller cannot see.
- */
-export declare function deriveWalletRecoveryKeyId(args: {
-    readonly recoveryCode: string;
-    readonly walletId: string;
-    readonly setVersion?: string;
-}): Promise<DerivedWalletRecoveryKeyId>;
-/**
- * The same derivation from decoded bytes.
- *
- * Separate entry point because the ceremony seals wraps from bytes it already
- * holds, while a user typing a code arrives as a string. Both must reach one
- * id, so both go through this.
  */
 export declare function deriveWalletRecoveryKeyIdFromBytes(args: {
     readonly codeBytes: Uint8Array;

package/dist/types/shared-ts/src/wallet-recovery/walletRecoveryPreparation.d.ts

@@ -0,0 +1,15 @@
+import type { RuntimePolicyScope } from '../threshold/signingRootScope';
+import type { RouterAbEd25519YaoApplicationBindingFactsV1, RouterAbEd25519YaoBytes32V1, RouterAbEd25519YaoLifecycleScopeV1 } from '../utils/routerAbEd25519Yao';
+export type WalletRecoveryPreparationNearRecoveryBasisV1 = {
+    readonly capabilityKind: 'registration' | 'recovery';
+    readonly activeCapabilityBinding: RouterAbEd25519YaoBytes32V1;
+    readonly scope: RouterAbEd25519YaoLifecycleScopeV1;
+    readonly applicationBinding: RouterAbEd25519YaoApplicationBindingFactsV1;
+    readonly participantIds: readonly [number, number];
+    readonly registeredPublicKey: RouterAbEd25519YaoBytes32V1;
+    readonly runtimePolicyScope: RuntimePolicyScope;
+    readonly activationTranscript: RouterAbEd25519YaoBytes32V1;
+    readonly activationStateEpoch: number;
+    readonly signingWorkerVerifyingShare: RouterAbEd25519YaoBytes32V1;
+};
+//# sourceMappingURL=walletRecoveryPreparation.d.ts.map

package/dist/types/shared-ts/src/wallet-recovery/walletRecoveryTarget.d.ts

@@ -1,12 +1,11 @@
 import { type WebAuthnRpId } from '../utils/domainIds';
-export type WalletRecoveryTargetV1 = {
+import type { ReadonlyExclusiveUnion } from '../utils/variant';
+export type WalletRecoveryTargetV1 = ReadonlyExclusiveUnion<{
     readonly kind: 'passkey';
     readonly rpId: WebAuthnRpId;
-    readonly googleProvider?: never;
 } | {
     readonly kind: 'google_email_otp';
     readonly googleProvider: 'google';
-    readonly rpId?: never;
-};
+}>;
 export declare function parseWalletRecoveryTargetV1(raw: unknown): WalletRecoveryTargetV1;
 //# sourceMappingURL=walletRecoveryTarget.d.ts.map

package/dist/types/wallet-server/src/authorization/domain.d.ts

@@ -1,3 +1,4 @@
+import type { Variant } from '../../../shared-ts/src/utils/variant';
 import type { ActiveWalletAuthMethodRecordV2, WalletAuthMethodRecordV2 } from '../../../shared-ts/src/utils/walletAuthMethodRecord';
 import { CAPABILITY_KINDS, EVM_ECDSA_MPC_OPERATION_KINDS, NEAR_ED25519_MPC_OPERATION_KINDS } from '../../../shared-ts/src/authorization/capabilityKinds';
 import type { CapabilityOperationRef, AuthorizationAuditEventId, AuthorizationGrantRef, AuthorizedOperationId, WalletSessionAuthorizationId, AuthorizationEvidenceId, AuthorizationEvidenceKind, HostedWalletSessionExchangeCodeId, MpcWalletSigningQuotaId, PrincipalId, WalletSessionMintId, TenantId, WalletSessionId } from '../../../shared-ts/src/authorization/capabilityKinds';
@@ -247,10 +248,20 @@ export type ExactWalletSessionStatusV2 = {
  * lands between separate reads cannot pair a session with a newer authority.
  */
 export type WalletSessionAdmissionSnapshotV2 = {
-    readonly authorization: IssuedWalletSessionAuthorizationV2;
     readonly authority: WalletAuthorityV1 | null;
     readonly authMethod: WalletAuthMethodRecordV2 | null;
-};
+} & ({
+    readonly kind: 'active';
+    readonly authorization: IssuedWalletSessionAuthorizationV2;
+    readonly session?: never;
+    readonly quota?: never;
+} | {
+    readonly kind: 'exhausted';
+    readonly session: WalletSessionAuthorizationV2;
+    readonly quota: ExactWalletSessionQuotaProjectionV1;
+    readonly authorization?: never;
+});
+export type WalletSessionAdmissionSnapshotV2Variant<Kind extends WalletSessionAdmissionSnapshotV2['kind']> = Variant<WalletSessionAdmissionSnapshotV2, 'kind', Kind>;
 /** An exact status with the authority and auth method it was judged against. */
 export type ExactWalletSessionStatusSnapshotV2 = {
     readonly status: ExactWalletSessionStatusV2;

package/dist/types/wallet-server/src/authorization/ecdsaWalletSessionAdmission.d.ts

@@ -1,4 +1,6 @@
+import type { EcdsaMaterialReadSnapshot } from '../core/ecdsaMaterialReadSnapshot';
 import type { CapabilityOperationEnvelope } from '../../../shared-ts/src/authorization/operationFingerprint';
+import type { Variant } from '../../../shared-ts/src/utils/variant';
 import type { AuthorizedOperation, AuthorizedOperationInput } from './domain';
 import type { AuthorizedOperationAdmissionRejection, EcdsaMaterialActivationScope } from './service';
 export type EcdsaWalletSessionAdmissionInput = {
@@ -14,15 +16,17 @@ export type EcdsaWalletSessionAdmissionInput = {
             readonly kind: 'consume_reusable_wallet_session';
         };
     };
-    readonly material: EcdsaMaterialActivationScope;
+    readonly material: EcdsaMaterialActivationScope & {
+        readonly readSnapshot: EcdsaMaterialReadSnapshot;
+    };
 };
 export type PinnedOwnerWalletScope = {
     readonly orgId: string;
     readonly projectId: string;
     readonly projectEnvironmentId: string;
 };
-export type EcdsaWalletSessionAdmission = {
-    readonly kind: 'claimed' | 'operation_in_progress';
+type EcdsaWalletSessionExistingOperation = {
+    readonly kind: 'operation_in_progress';
     readonly operation: AuthorizedOperation;
     readonly ownerScope: PinnedOwnerWalletScope;
 } | {
@@ -30,8 +34,28 @@ export type EcdsaWalletSessionAdmission = {
     readonly operation: AuthorizedOperation;
     readonly ownerScope?: never;
 };
+type EcdsaWalletSessionAdmission = EcdsaWalletSessionExistingOperation | {
+    readonly kind: 'claimed';
+    readonly operation: AuthorizedOperation;
+    readonly ownerScope: PinnedOwnerWalletScope;
+};
+export type EcdsaWalletSessionAdmissionVariant<K extends EcdsaWalletSessionAdmission['kind']> = Variant<EcdsaWalletSessionAdmission, 'kind', K>;
+export type EcdsaWalletSessionResolutionResult = EcdsaWalletSessionExistingOperation | ((AuthorizedOperationAdmissionRejection | {
+    readonly kind: 'authorized_operation_missing';
+}) & {
+    readonly operation?: never;
+    readonly ownerScope?: never;
+});
 export type EcdsaWalletSessionAdmissionResult = EcdsaWalletSessionAdmission | (AuthorizedOperationAdmissionRejection & {
     readonly operation?: never;
     readonly ownerScope?: never;
 });
+export type EcdsaWalletSessionPhaseAdmission = {
+    readonly phase: 'prepare';
+    readonly admission: EcdsaWalletSessionAdmission;
+} | {
+    readonly phase: 'finalize';
+    readonly admission: EcdsaWalletSessionExistingOperation;
+};
+export {};
 //# sourceMappingURL=ecdsaWalletSessionAdmission.d.ts.map

package/dist/types/wallet-server/src/authorization/lifecycleRouting.d.ts

@@ -0,0 +1,32 @@
+import { type WalletId } from '../../../shared-ts/src/utils/domainIds';
+import type { RouterAbEd25519YaoRecoveryAdmissionRequestV1 } from '../../../shared-ts/src/utils/routerAbEd25519Yao';
+export declare class WalletLifecycleLocator {
+    #private;
+    readonly kind: 'yao_recovery' | 'yao_export' | 'passkey_challenge' | 'linked_device';
+    readonly value: string;
+    private constructor();
+    matches(other: WalletLifecycleLocator): boolean;
+    static parse(raw: unknown): WalletLifecycleLocator;
+}
+export interface WalletLifecycleRoutingPublisher {
+    publishLifecycle(input: {
+        readonly walletId: WalletId;
+        readonly locator: WalletLifecycleLocator;
+    }): Promise<{
+        readonly ok: true;
+    } | {
+        readonly ok: false;
+        readonly code: 'locator_conflict';
+    }>;
+}
+type PublicationResult = {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly status: 409 | 503;
+    readonly code: string;
+    readonly message: string;
+};
+export declare function publishWalletLifecycleHome(publisher: WalletLifecycleRoutingPublisher | null, kind: 'yao_recovery' | 'yao_export', admission: Pick<RouterAbEd25519YaoRecoveryAdmissionRequestV1, 'scope' | 'application_binding'>): Promise<PublicationResult>;
+export {};
+//# sourceMappingURL=lifecycleRouting.d.ts.map

package/dist/types/wallet-server/src/authorization/lifecycleRouting.typecheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=lifecycleRouting.typecheck.d.ts.map

package/dist/types/wallet-server/src/authorization/recoveryRouting.d.ts

@@ -0,0 +1,22 @@
+import type { WalletId, WalletRecoveryOperationId } from '../../../shared-ts/src/utils/domainIds';
+import type { RecoveryCodeLocatorV1 } from '../../../shared-ts/src/wallet-recovery/recoveryCodeLocator';
+export type WalletRecoveryRoutingPublication = {
+    readonly kind: 'codes';
+    readonly walletId: WalletId;
+    readonly locators: readonly RecoveryCodeLocatorV1[];
+    readonly operationId?: never;
+} | {
+    readonly kind: 'operation';
+    readonly walletId: WalletId;
+    readonly operationId: WalletRecoveryOperationId;
+    readonly locators?: never;
+};
+export interface WalletRecoveryRoutingPublisher {
+    publishRecovery(input: WalletRecoveryRoutingPublication): Promise<{
+        readonly ok: true;
+    } | {
+        readonly ok: false;
+        readonly code: 'locator_conflict';
+    }>;
+}
+//# sourceMappingURL=recoveryRouting.d.ts.map

package/dist/types/wallet-server/src/authorization/recoveryRouting.typecheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=recoveryRouting.typecheck.d.ts.map

package/dist/types/wallet-server/src/authorization/service.d.ts

@@ -1,3 +1,6 @@
+import type { WalletSessionRoutingPublisher } from './sessionRouting';
+import type { D1EcdsaAdmissionPolicyRead } from '../router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore';
+import type { EcdsaMaterialRead } from '../core/d1EcdsaSignerRead';
 import type { D1PreparedStatementLike } from '../storage/tenantRoute';
 import type { WalletAuthMethodId, WalletId } from '../../../shared-ts/src/utils/domainIds';
 import type { ActiveWalletAuthorityV1 } from '../../../shared-ts/src/authorization/walletAuthority';
@@ -10,9 +13,14 @@ import type { DigestB64u } from '../../../shared-ts/src/utils/canonicalPrimitive
 import type { RouterAbMpcMaterialActivationRefWire } from '../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
 import type { RuntimePolicyScope } from '../../../shared-ts/src/threshold/signingRootScope';
 import type { CapabilityOperationFingerprintDigest } from '../../../shared-ts/src/authorization/operationFingerprint';
+export type EcdsaWalletSessionAdmissionRead = {
+    readonly snapshot: WalletSessionAdmissionSnapshotV2;
+    readonly materialRead: EcdsaMaterialRead;
+    readonly policyRead: D1EcdsaAdmissionPolicyRead;
+};
 export interface AuthorizationSessionPort {
     putIssuedHostedWalletSeamsSessionExchange(exchange: IssuedHostedWalletSeamsSessionExchangeV2): Promise<void>;
-    redeemHostedWalletSeamsSessionExchange(input: RedeemHostedWalletSeamsSessionExchangeV2Input): Promise<PersistedHostedWalletSeamsSessionExchangeV2Result>;
+    redeemHostedWalletSeamsSessionExchange(input: RedeemHostedWalletSeamsSessionExchangeV2Input, publishCredentialLocator?: () => Promise<void>): Promise<PersistedHostedWalletSeamsSessionExchangeV2Result>;
     readHostedWalletSessionOperationCredentialV2(input: {
         readonly tenantId: TenantId;
         readonly tokenHash: DigestB64u;
@@ -43,6 +51,7 @@ export interface AuthorizationGrantPort {
     commitDirectWalletSessionAuthorizationV2(input: {
         readonly persisted: PersistedActiveWalletSessionAuthorizationV2;
     }): Promise<DirectV2CommitResult>;
+    /** Inserted confirms readback of the exact session identity and primary credential digest. */
     commitDirectReplayableWalletSessionAuthorizationV2(input: {
         readonly persisted: PersistedActiveWalletSessionAuthorizationV2;
     }): Promise<DirectV2CommitResult>;
@@ -67,6 +76,12 @@ export interface AuthorizationGrantPort {
         readonly tokenHash: DigestB64u;
         readonly nowMs: number;
     }): Promise<WalletSessionAdmissionSnapshotV2 | null>;
+    readEcdsaWalletSessionAdmissionSnapshotByOperationCredential(input: {
+        readonly tenantId: TenantId;
+        readonly tokenHash: DigestB64u;
+        readonly nowMs: number;
+        readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
+    }): Promise<EcdsaWalletSessionAdmissionRead | null>;
     readWalletSessionExactOperationContextByCredential(input: {
         readonly tenantId: TenantId;
         readonly tokenHash: DigestB64u;
@@ -147,6 +162,7 @@ export type AuthorizedOperationMaterialScope = EcdsaMaterialActivationScope & {
     readonly kind?: 'ecdsa_material_activation';
 };
 export type AuthorizationServicePorts = {
+    readonly sessionRouting?: WalletSessionRoutingPublisher;
     readonly policy: CapabilityPolicyPort;
     readonly sessions: AuthorizationSessionPort;
     readonly evidence: AuthorizationEvidencePort;
@@ -226,6 +242,10 @@ export declare class AuthorizationService {
     /** The Ed25519 registration caller validates current authority and owner proof first. */
     issueDirectRegistrationPromotedWalletSessionAuthorizationV2(input: IssueWalletSessionAuthorizationV2Input): Promise<DirectV2IssueResult>;
     private issueDirectWalletSessionAuthorizationV2WithReplayMode;
+    prepareDirectWalletSessionCredential(prepared: PreparedWalletSessionAuthorizationV2): Promise<{
+        persisted: PersistedActiveWalletSessionAuthorizationV2;
+        operationCredential: import("../../../shared-ts/src/device-linking").WalletSessionOperationCredentialV1;
+    }>;
     refreshWalletSessionAuthorizationV2AuthorityProjection(input: {
         readonly existing: IssuedWalletSessionAuthorizationV2;
         readonly authority: ActiveWalletAuthorityV1;
@@ -260,6 +280,12 @@ export declare class AuthorizationService {
         readonly token: string;
         readonly nowMs: number;
     }): Promise<WalletSessionAdmissionSnapshotV2 | null>;
+    readEcdsaWalletSessionAdmissionSnapshotByOperationCredential(input: {
+        readonly tenantId: TenantId;
+        readonly token: string;
+        readonly nowMs: number;
+        readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
+    }): Promise<EcdsaWalletSessionAdmissionRead | null>;
     readLiveWalletSessionAuthorizationProjectionByCredential(input: {
         readonly tenantId: TenantId;
         readonly token: string;