@seams/wallet-server 0.7.1 → 0.8.0

package/dist/types/wallet-server/src/core/d1IdentityStore.d.ts

@@ -5,8 +5,6 @@ export interface D1IdentityStoreSchemaOptions extends D1SchemaOptions {
 export interface D1IdentityStoreOptions extends D1TenantStoreOptions {
     readonly now?: () => Date;
 }
-/** Names the identity store in D1 scope errors. */
-export declare const IDENTITY_D1_STORE = "identity store";
 export declare const IDENTITY_STORE_D1_SCHEMA_SQL: readonly ["\n    CREATE TABLE IF NOT EXISTS identity_links (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      subject TEXT NOT NULL,\n      user_id TEXT NOT NULL,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      updated_at_ms INTEGER NOT NULL,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, subject),\n      CHECK (length(namespace) > 0),\n      CHECK (length(org_id) > 0),\n      CHECK (length(project_id) > 0),\n      CHECK (length(env_id) > 0),\n      CHECK (length(subject) > 0),\n      CHECK (length(user_id) > 0),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms > 0),\n      CHECK (updated_at_ms >= created_at_ms),\n      CHECK (COALESCE(json_extract(record_json, '$.version') = 'identity_subject_v1', 0)),\n      CHECK (COALESCE(json_extract(record_json, '$.subject') = subject, 0)),\n      CHECK (COALESCE(json_extract(record_json, '$.userId') = user_id, 0)),\n      CHECK (COALESCE(json_extract(record_json, '$.createdAtMs') = created_at_ms, 0)),\n      CHECK (COALESCE(json_extract(record_json, '$.updatedAtMs') = updated_at_ms, 0))\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS identity_links_user_idx\n      ON identity_links (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        user_id,\n        created_at_ms\n      )\n  "];
 export declare function ensureIdentityStoreD1Schema(options: D1IdentityStoreSchemaOptions): Promise<void>;
 export declare class D1IdentityStore implements IdentityStore {

package/dist/types/wallet-server/src/core/d1TenantStore.d.ts

@@ -1,9 +1,4 @@
 import type { D1DatabaseLike, D1PreparedStatementLike } from '../storage/tenantRoute';
-/**
- * A store's key prefix, which is also its D1 namespace: the first of `explicitKeys` set in
- * `config`, else `<THRESHOLD_PREFIX>:<segment>`. It always ends with a colon.
- */
-export declare function resolveStorePrefix(config: Record<string, unknown>, explicitKeys: readonly string[], segment: string): string;
 /** The tenant scope that leads the key of every D1 table. */
 export type D1TenantScope = {
     readonly namespace: string;
@@ -22,8 +17,6 @@ export interface D1TenantStoreOptions {
     readonly envId: string;
     readonly ensureSchema?: boolean;
 }
-/** The scope env-shaped store config names (`orgId` or `ORG_ID`, and so on) under `namespace`. */
-export declare function d1TenantScopeFromConfig(config: Record<string, unknown>, namespace: string, store: string): D1TenantScope;
 export declare function ensureD1Schema(database: D1DatabaseLike, statements: readonly string[]): Promise<void>;
 /** A schema a store creates once, on first use, unless its caller manages it (`enabled: false`). */
 export declare class D1Schema {

package/dist/types/wallet-server/src/core/d1WalletAuthMethodStore.d.ts

@@ -72,7 +72,6 @@ export declare const WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL: readonly ["\n    CR
  */
 export declare const WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL: readonly ["\n    CREATE TABLE IF NOT EXISTS wallet_auth_methods (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      wallet_id TEXT NOT NULL,\n      wallet_authority_id TEXT NOT NULL,\n      rp_id TEXT NOT NULL DEFAULT '',\n      kind TEXT NOT NULL,\n      status TEXT NOT NULL,\n      wallet_auth_method_id TEXT NOT NULL,\n      auth_identifier_key TEXT NOT NULL,\n      credential_id_b64u TEXT,\n      credential_public_key_b64u TEXT,\n      email_hash_hex TEXT,\n      registration_authority_id TEXT,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      updated_at_ms INTEGER NOT NULL,\n      activated_at_ms INTEGER,\n      revoked_at_ms INTEGER,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_auth_method_id),\n      FOREIGN KEY (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        wallet_authority_id\n      ) REFERENCES wallet_authorities(\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        authority_id\n      ),\n      CHECK (length(wallet_id) > 0),\n      CHECK (length(wallet_authority_id) > 0),\n      CHECK (kind IN ('passkey', 'email_otp')),\n      CHECK (status IN ('pending_local_install', 'active', 'revoked')),\n      CHECK (length(wallet_auth_method_id) > 0),\n      CHECK (length(auth_identifier_key) > 0),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms >= 0),\n      CHECK (updated_at_ms >= created_at_ms),\n      CHECK (\n        (status = 'pending_local_install' AND activated_at_ms IS NULL AND revoked_at_ms IS NULL)\n        OR\n        (status = 'active' AND activated_at_ms IS NOT NULL AND revoked_at_ms IS NULL)\n        OR\n        (status = 'revoked' AND activated_at_ms IS NOT NULL AND revoked_at_ms IS NOT NULL)\n      ),\n      CHECK (\n        (kind = 'passkey'\n          AND length(rp_id) > 0\n          AND credential_id_b64u IS NOT NULL\n          AND length(credential_id_b64u) > 0\n          AND credential_public_key_b64u IS NOT NULL\n          AND length(credential_public_key_b64u) > 0\n          AND email_hash_hex IS NULL\n          AND registration_authority_id IS NULL\n          AND auth_identifier_key = credential_id_b64u)\n        OR\n        (kind = 'email_otp'\n          AND rp_id = ''\n          AND credential_id_b64u IS NULL\n          AND credential_public_key_b64u IS NULL\n          AND email_hash_hex IS NOT NULL\n          AND length(email_hash_hex) > 0\n          AND registration_authority_id IS NOT NULL\n          AND length(registration_authority_id) > 0\n          AND auth_identifier_key = email_hash_hex)\n      ),\n      CHECK (json_extract(record_json, '$.version') = 'wallet_auth_method_v2'),\n      CHECK (json_extract(record_json, '$.walletAuthMethodId') = wallet_auth_method_id),\n      CHECK (json_extract(record_json, '$.walletId') = wallet_id),\n      CHECK (json_extract(record_json, '$.walletAuthorityId') = wallet_authority_id),\n      CHECK (json_extract(record_json, '$.kind') = kind),\n      CHECK (json_extract(record_json, '$.status') = status),\n      CHECK (json_extract(record_json, '$.createdAtMs') = created_at_ms),\n      CHECK (json_extract(record_json, '$.updatedAtMs') = updated_at_ms),\n      CHECK (\n        (kind = 'passkey'\n          AND json_extract(record_json, '$.rpId') = rp_id\n          AND json_extract(record_json, '$.credentialIdB64u') = credential_id_b64u\n          AND json_extract(record_json, '$.credentialPublicKeyB64u') = credential_public_key_b64u\n          AND json_extract(record_json, '$.counter') >= 0)\n        OR\n        (kind = 'email_otp'\n          AND json_extract(record_json, '$.emailHashHex') = email_hash_hex\n          AND json_extract(record_json, '$.registrationAuthorityId') = registration_authority_id)\n      )\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS wallet_auth_methods_wallet_authority_status_idx\n      ON wallet_auth_methods (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        wallet_id,\n        wallet_authority_id,\n        status\n      )\n  ", "\n    CREATE UNIQUE INDEX IF NOT EXISTS wallet_auth_methods_v2_passkey_uidx\n      ON wallet_auth_methods (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        rp_id,\n        credential_id_b64u\n      )\n      WHERE kind = 'passkey' AND credential_id_b64u IS NOT NULL\n  "];
 export declare function ensureWalletAuthMethodStoreD1Schema(options: D1WalletAuthMethodStoreSchemaOptions): Promise<void>;
-export declare function ensureWalletAuthMethodStoreD1SchemaV2(options: D1WalletAuthMethodStoreSchemaOptions): Promise<void>;
 export declare function walletAuthMethodId(record: WalletAuthMethodRecord): WalletAuthMethodId;
 export declare function normalizeWalletAuthMethod(raw: unknown): WalletAuthMethodRecord | null;
 export declare function normalizeWalletAuthMethodV2(raw: unknown): WalletAuthMethodRecordV2 | null;

package/dist/types/wallet-server/src/core/d1WalletStore.d.ts

@@ -1,3 +1,5 @@
+import type { EcdsaMaterialReadSnapshot } from './ecdsaMaterialReadSnapshot';
+import { type EcdsaMaterialReadSource } from './d1EcdsaSignerRead';
 import type { D1DatabaseLike, D1PreparedStatementLike } from '../storage/tenantRoute';
 import type { WalletId, WalletRegistrationEcdsaWalletKey } from './registrationContracts';
 import { type ThresholdEcdsaChainTarget } from './thresholdEcdsaChainTarget';
@@ -71,6 +73,14 @@ export declare class D1WalletStore implements WalletStore {
         walletId: WalletId;
         materialActivation: RouterAbMpcMaterialActivationRefWire;
     }): Promise<WalletEcdsaSignerRecord | null>;
+    readEcdsaSignerMaterialSnapshot(input: {
+        readonly source: EcdsaMaterialReadSource;
+        walletId: WalletId;
+        materialActivation: RouterAbMpcMaterialActivationRefWire;
+    }): Promise<{
+        readonly signer: WalletEcdsaSignerRecord;
+        readonly readSnapshot: EcdsaMaterialReadSnapshot;
+    } | null>;
     getEcdsaSignerByPostRegistrationRequest(input: {
         walletId: WalletId;
         request: WalletEcdsaPostRegistrationPublicRequest;

package/dist/types/wallet-server/src/core/deviceLinking/linkedDeviceBootstrap.d.ts

@@ -0,0 +1,19 @@
+import type { LinkDeviceSessionId } from '../../../../shared-ts/src/signing-lanes/ids';
+import type { LinkedDeviceSessionRecordV1 } from './linkedDeviceSessionRecord';
+export type LinkedDeviceBootstrapResult = {
+    readonly ok: true;
+    readonly record: LinkedDeviceSessionRecordV1 | null;
+} | {
+    readonly ok: false;
+    readonly code: 'home_conflict' | 'home_unavailable';
+    readonly record?: never;
+};
+export interface LinkedDeviceBootstrapStore {
+    read(linkSessionId: LinkDeviceSessionId): Promise<LinkedDeviceBootstrapResult>;
+    create(record: LinkedDeviceSessionRecordV1): Promise<LinkedDeviceBootstrapResult>;
+    claim(record: LinkedDeviceSessionRecordV1): Promise<LinkedDeviceBootstrapResult>;
+    finish(record: LinkedDeviceSessionRecordV1): Promise<LinkedDeviceBootstrapResult>;
+}
+export declare function requireLinkedDeviceBootstrapRecord(result: LinkedDeviceBootstrapResult): LinkedDeviceSessionRecordV1 | null;
+export declare function linkedDeviceBootstrapFailure(error: unknown): 'home_conflict' | 'home_unavailable' | null;
+//# sourceMappingURL=linkedDeviceBootstrap.d.ts.map

package/dist/types/wallet-server/src/core/deviceLinking/linkedDeviceSession.d.ts

@@ -144,18 +144,20 @@ export type LinkedDeviceSessionStoreV1 = {
         readonly nowMs: number;
     }): Promise<LinkedDeviceSessionMutationResultV1>;
 };
-export type LinkedDeviceSessionServiceResultV1 = LinkedDeviceSessionMutationResultV1 | {
-    readonly outcome: 'invalid_input';
+type LinkedDeviceSessionFailureV1 = {
+    readonly outcome: 'home_conflict' | 'home_unavailable';
     readonly message: string;
+    readonly record?: never;
 } | {
-    readonly outcome: 'unauthorized';
-    readonly code: string;
+    readonly outcome: 'invalid_input';
     readonly message: string;
 };
-type LinkedDeviceTargetCredentialMutationResultV1 = LinkedDeviceSessionMutationResultV1 | {
-    readonly outcome: 'invalid_input';
+export type LinkedDeviceSessionServiceResultV1 = LinkedDeviceSessionMutationResultV1 | LinkedDeviceSessionFailureV1 | {
+    readonly outcome: 'unauthorized';
+    readonly code: string;
     readonly message: string;
 };
+type LinkedDeviceTargetCredentialMutationResultV1 = LinkedDeviceSessionMutationResultV1 | LinkedDeviceSessionFailureV1;
 type LinkedDeviceSessionCreateInputV1 = {
     readonly payload: QrLinkedDeviceSessionPayloadV5;
     readonly nowMs: number;

package/dist/types/wallet-server/src/core/deviceLinking/linkedDeviceSessionRecord.d.ts

@@ -4,20 +4,19 @@ import { type DigestB64u } from '../../../../shared-ts/src/utils/canonicalPrimit
 import { type DomainIdParseResult, type WalletAuthorityId } from '../../../../shared-ts/src/utils/domainIds';
 import { type LinkDeviceSessionId } from '../../../../shared-ts/src/signing-lanes/ids';
 import { type ExactAdministeredSignerV1, type ExactAdministeredSignerManifestV1 } from '../../../../shared-ts/src/device-linking/delegatedActivationPlan';
+import type { ReadonlyExclusiveUnion } from '../../../../shared-ts/src/utils/variant';
 type LinkedDeviceClaimTranscriptV1 = {
     readonly digestB64u: DigestB64u;
     readonly value: LinkedDeviceClaimV1;
 };
-export type LinkedDeviceSourceKeyManifestDigestsV1 = {
+export type LinkedDeviceSourceKeyManifestDigestsV1 = ReadonlyExclusiveUnion<{
     readonly ed25519: DigestB64u;
-    readonly ecdsa_secp256k1?: never;
 } | {
-    readonly ed25519?: never;
     readonly ecdsa_secp256k1: DigestB64u;
 } | {
     readonly ed25519: DigestB64u;
     readonly ecdsa_secp256k1: DigestB64u;
-};
+}>;
 type LinkedDeviceApprovalTranscriptV1 = {
     readonly digestB64u: DigestB64u;
     readonly value: LinkedDeviceApprovalV1;

package/dist/types/wallet-server/src/core/deviceLinking/requestProof.d.ts

@@ -21,17 +21,14 @@ export type LinkedDeviceRequestProofNonceStoreV1 = {
         readonly expiresAtMs: number;
         readonly consumedAtMs: number;
     }): Promise<{
-        readonly outcome: 'consumed';
-    } | {
-        readonly outcome: 'already_used';
+        readonly outcome: 'consumed' | 'already_used' | 'unavailable';
     }>;
 };
 type LinkedDeviceRequestProofVerificationResultV1 = {
     readonly kind: 'authorized';
-    readonly proofDigestB64u: DigestB64u;
 } | {
     readonly kind: 'denied';
-    readonly code: 'invalid' | 'expired' | 'replayed';
+    readonly code: 'invalid' | 'expired' | 'replayed' | 'unavailable';
     readonly message: string;
 };
 export declare class LinkedDeviceRequestProofVerifierV1 {

package/dist/types/wallet-server/src/core/ecdsaMaterialReadSnapshot.d.ts

@@ -0,0 +1,19 @@
+import type { WalletId } from '../../../shared-ts/src/utils/domainIds';
+import type { D1WalletStoreScope } from './d1WalletStore';
+export declare const ECDSA_INSTALLATION_SNAPSHOT_COLUMNS: readonly ["link_session_id", "authority_id", "wallet_id", "auth_method_id", "device_id", "package_set_digest_b64u", "target_factor_verification_digest_b64u", "target_factor_verified_at_ms", "source_manifest_digest_b64u", "delivery_recipient_public_key_b64u", "packages_json", "server_reservation_ids_json", "installed_record_set_digest_b64u", "activated_at_ms"];
+type SqlCondition = {
+    readonly sql: string;
+    readonly bindings: readonly unknown[];
+};
+type StoredRow = Readonly<Record<string, unknown>>;
+/** Request-local evidence of the exact records a material resolver examined. */
+export declare class EcdsaMaterialReadSnapshot {
+    #private;
+    readonly walletId: WalletId;
+    private constructor();
+    static canonical(scope: D1WalletStoreScope, walletId: WalletId, activationId: string, rows: readonly StoredRow[]): EcdsaMaterialReadSnapshot;
+    static linked(scope: D1WalletStoreScope, walletId: WalletId, installations: readonly StoredRow[], signers: readonly StoredRow[]): EcdsaMaterialReadSnapshot;
+    condition(scope: D1WalletStoreScope): SqlCondition;
+}
+export {};
+//# sourceMappingURL=ecdsaMaterialReadSnapshot.d.ts.map

package/dist/types/wallet-server/src/core/emailOtpD1Statements.d.ts

@@ -5,16 +5,12 @@ export type ScopedD1Prepare = (sql: string, values: readonly unknown[]) => D1Pre
 /** Statements on `email_otp_challenges`. */
 export declare const emailOtpChallengeRows: {
     insert: (prepare: ScopedD1Prepare, record: EmailOtpChallengeRecord) => D1PreparedStatementLike;
-    upsert: (prepare: ScopedD1Prepare, record: EmailOtpChallengeRecord) => D1PreparedStatementLike;
     delete: (prepare: ScopedD1Prepare, challengeId: string) => D1PreparedStatementLike;
 };
 /** Statements on `email_otp_grants`. */
 export declare const emailOtpGrantRows: {
     insert: (prepare: ScopedD1Prepare, record: EmailOtpGrantRecord) => D1PreparedStatementLike;
-    upsert: (prepare: ScopedD1Prepare, record: EmailOtpGrantRecord) => D1PreparedStatementLike;
-    select: (prepare: ScopedD1Prepare, grantToken: string) => D1PreparedStatementLike;
     consume: (prepare: ScopedD1Prepare, grantToken: string) => D1PreparedStatementLike;
-    delete: (prepare: ScopedD1Prepare, grantToken: string) => D1PreparedStatementLike;
 };
 /** Statements on `email_otp_wallet_enrollments`. */
 export declare const emailOtpWalletEnrollmentRows: {
@@ -30,12 +26,19 @@ export declare const emailOtpAuthStateRows: {
 /** Statements on `email_otp_unlock_challenges`. */
 export declare const emailOtpUnlockChallengeRows: {
     insert: (prepare: ScopedD1Prepare, record: EmailOtpUnlockChallengeRecord) => D1PreparedStatementLike;
-    upsert: (prepare: ScopedD1Prepare, record: EmailOtpUnlockChallengeRecord) => D1PreparedStatementLike;
     consume: (prepare: ScopedD1Prepare, challengeId: string) => D1PreparedStatementLike;
 };
 /** Statements on `email_otp_registration_attempts`. */
 export declare const emailOtpRegistrationAttemptRows: {
-    upsert: (prepare: ScopedD1Prepare, record: GoogleEmailOtpRegistrationAttemptRecord) => D1PreparedStatementLike;
+    insertPendingIfAbsent: (prepare: ScopedD1Prepare, record: GoogleEmailOtpRegistrationAttemptRecord) => D1PreparedStatementLike;
+    claimCandidate: (prepare: ScopedD1Prepare, input: {
+        readonly attemptId: string;
+        readonly candidateId: string;
+        readonly walletId: string;
+        readonly intentDigest: string;
+        readonly nowMs: number;
+    }) => D1PreparedStatementLike;
+    updatePending: (prepare: ScopedD1Prepare, record: GoogleEmailOtpRegistrationAttemptRecord) => D1PreparedStatementLike;
     select: (prepare: ScopedD1Prepare, attemptId: string) => D1PreparedStatementLike;
     /** The latest live attempt for the subject, email, owner binding and runtime scope. */
     selectStarted: (prepare: ScopedD1Prepare, input: Readonly<GoogleEmailOtpRegistrationAttemptScopeInput>) => D1PreparedStatementLike;
@@ -49,6 +52,6 @@ export declare const emailOtpRegistrationAttemptRows: {
     deleteExpired: (prepare: ScopedD1Prepare, nowMs: number) => D1PreparedStatementLike;
     /** Finds a live attempt that selected or offered the wallet. */
     selectLiveForWallet: (prepare: ScopedD1Prepare, walletId: string, nowMs: number) => D1PreparedStatementLike;
-    delete: (prepare: ScopedD1Prepare, attemptId: string) => D1PreparedStatementLike;
+    deleteUnclaimed: (prepare: ScopedD1Prepare, attemptId: string) => D1PreparedStatementLike;
 };
 //# sourceMappingURL=emailOtpD1Statements.d.ts.map

package/dist/types/wallet-server/src/core/keyMaterialBrands.d.ts

@@ -1,8 +1,4 @@
 import type { EcdsaThresholdKeyId } from '../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap';
-import { type Brand } from '../../../shared-ts/src/threshold/keyMaterialBrands';
 export type { EcdsaThresholdKeyId };
-export { formatEcdsaClientVerifyingShareB64uForWire, formatEcdsaDerivationKeyVersionForWire, formatEcdsaKeyHandleForWire, formatEcdsaRelayerKeyIdForWire, formatEcdsaThresholdKeyIdForWire, formatEd25519RelayerKeyIdForWire, formatSigningSessionSealKeyVersionForWire, parseEcdsaClientVerifyingShareB64u, parseEcdsaDerivationKeyVersion, parseEcdsaKeyHandle, parseEcdsaRelayerKeyId, parseEd25519RelayerKeyId, parseSigningSessionSealKeyVersion, type EcdsaClientVerifyingShareB64u, type EcdsaDerivationKeyVersion, type EcdsaKeyHandle, type EcdsaRelayerKeyId, type Ed25519RelayerKeyId, type SigningSessionSealKeyVersion, } from '../../../shared-ts/src/threshold/keyMaterialBrands';
-export type Ed25519ClientVerifyingShareB64u = Brand<string, 'Ed25519ClientVerifyingShareB64u'>;
-export declare function parseEcdsaThresholdKeyId(value: unknown): EcdsaThresholdKeyId;
-export declare function formatEd25519ClientVerifyingShareB64uForWire(value: Ed25519ClientVerifyingShareB64u): string;
+export { formatEcdsaKeyHandleForWire, formatSigningSessionSealKeyVersionForWire, parseEcdsaClientVerifyingShareB64u, parseEcdsaKeyHandle, parseEcdsaRelayerKeyId, parseSigningSessionSealKeyVersion, type EcdsaClientVerifyingShareB64u, type EcdsaKeyHandle, type EcdsaRelayerKeyId, type SigningSessionSealKeyVersion, } from '../../../shared-ts/src/threshold/keyMaterialBrands';
 //# sourceMappingURL=keyMaterialBrands.d.ts.map

package/dist/types/wallet-server/src/core/nearRelayerAccountProvisioning.d.ts

@@ -39,7 +39,6 @@ type PrepareSponsoredNearAccountCreationResultV1 = {
     readonly prepared: PreparedSponsoredNearAccountCreationV1;
 } | {
     readonly ok: false;
-    readonly error: string;
     readonly message: string;
 };
 /**

package/dist/types/wallet-server/src/core/passkeyCredentialClaims.d.ts

@@ -0,0 +1,9 @@
+export interface PasskeyCredentialClaims {
+    claim(input: {
+        readonly walletId: string;
+        readonly rpId: string;
+        readonly credentialIdB64u: string;
+    }): Promise<boolean>;
+}
+export declare function reservePasskeyCredential(claims: PasskeyCredentialClaims | undefined, input: Parameters<PasskeyCredentialClaims['claim']>[0]): Promise<void>;
+//# sourceMappingURL=passkeyCredentialClaims.d.ts.map

package/dist/types/wallet-server/src/core/routerAbSigning/RouterAbEcdsaPresignRuntime.d.ts

@@ -1,10 +1,8 @@
-import { coerceThresholdNodeRole } from '../ThresholdService/config';
 import { RouterAbEcdsaDerivationPoolFillHandlers } from '../ThresholdService/routerAb/ecdsaDerivationPoolFillHandlers';
 import { type RouterAbLinkedDeviceEcdsaExportShareHttpResult, type RouterAbEcdsaPresignSessionHttpResult } from '../ThresholdService/routerAb/ecdsaDerivationPresignBridge';
 import type { RouterAbEcdsaSigningWorkerExportShareBindingV1 } from '../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
 import type { RouterAbConfiguredSigningWorkerPrivateTransport } from './RouterAbNormalSigningRuntime';
 export type RouterAbEcdsaPresignRuntimeConfig = {
-    readonly nodeRole: ReturnType<typeof coerceThresholdNodeRole>;
     readonly participantIds: {
         readonly clientParticipantId: number;
         readonly relayerParticipantId: number;

package/dist/types/wallet-server/src/core/routerAbSigning/RouterAbNormalSigningRuntime.d.ts

@@ -2,7 +2,8 @@ import type { RouterAbEd25519NormalSigningState } from '../../../../shared-ts/sr
 import type { MpcMaterialActivationId } from '../../../../shared-ts/src/utils/domainIds';
 import { type ParseResult, type RouterAbNormalSigningServerPolicy } from '../ThresholdService/routerAbNormalSigningPolicy';
 import type { Ed25519WalletSessionStore, EcdsaWalletSessionStore } from '../ThresholdService/stores/WalletSessionStore';
-export type RouterAbSigningWorkerPrivateTransport = {
+import type { ReadonlyExclusiveUnion } from '../../../../shared-ts/src/utils/variant';
+export type RouterAbSigningWorkerPrivateTransport = ReadonlyExclusiveUnion<{
     readonly kind: 'configured';
     readonly signingWorkerBaseUrl: string;
     readonly auth: {
@@ -12,14 +13,10 @@ export type RouterAbSigningWorkerPrivateTransport = {
     readonly fetchImpl?: typeof fetch;
 } | {
     readonly kind: 'unconfigured';
-    readonly signingWorkerBaseUrl?: never;
-    readonly auth?: never;
-    readonly fetchImpl?: never;
-};
+}>;
 export type RouterAbConfiguredSigningWorkerPrivateTransport = Extract<RouterAbSigningWorkerPrivateTransport, {
     readonly kind: 'configured';
 }>;
-export declare function requireRouterAbConfiguredSigningWorkerPrivateTransport(transport: RouterAbSigningWorkerPrivateTransport): RouterAbConfiguredSigningWorkerPrivateTransport;
 type RouterAbNormalSigningRuntimeConfig = {
     readonly policy: RouterAbNormalSigningServerPolicy;
     readonly signingWorkerTransport: RouterAbSigningWorkerPrivateTransport;
@@ -49,7 +46,6 @@ type RouterAbClampedSessionPolicy = {
     readonly ttlMs: number;
     readonly remainingUses: number;
 };
-export declare function parseRouterAbNormalSigningRuntimeConfig(config: Readonly<Record<string, unknown>>): RouterAbNormalSigningRuntimeConfig;
 export declare class RouterAbNormalSigningRuntime {
     private readonly walletSessionStore;
     private readonly ecdsaWalletSessionStore;

package/dist/types/wallet-server/src/core/rpcClients/near/NearClient.d.ts

@@ -1,9 +1,8 @@
 import type { JsonRpcErrorDetails } from '../../../../../shared-ts/src/utils/jsonRpc';
-import type { DecodedNearFinalExecutionOutcome } from '../../../../../shared-ts/src/utils/nearRpcResults';
+import type { DecodedNearFinalExecutionOutcome, NearRpcErrorType } from '../../../../../shared-ts/src/utils/nearRpcResults';
 import { NearJsonRpcClient } from '../../../../../shared-ts/src/near/nearClient';
 export type { AccessKeyList } from '@near-js/types';
 export { SignedTransaction, type NearClient } from '../../../../../shared-ts/src/near/nearClient';
-type NearRpcErrorType = 'InvalidTxError' | 'ActionError' | 'TxExecutionError' | 'RpcError' | 'Failure' | 'Unknown';
 type NearRpcFailureKind = 'transaction_not_found' | 'account_not_found' | 'access_key_not_found' | 'invalid_nonce' | 'expired' | 'invalid_transaction' | 'action_error' | 'execution_failure' | 'infrastructure_failure' | 'unknown';
 export declare class NearRpcError extends Error {
     code?: number;

package/dist/types/wallet-server/src/core/signingLanes/WalletExecutionLaneProjection.d.ts

@@ -1,18 +1,9 @@
-import { type SigningLaneRecord, type WalletKeyRecord } from '../../../../shared-ts/src/signing-lanes';
-import { type DigestB64u } from '../../../../shared-ts/src/utils/canonicalPrimitives';
+import { type OwnerWalletExecutionLaneProjectionV1 } from '../../../../shared-ts/src/signing-lanes';
 import type { MpcMaterialActivationRef, ProviderSubject, WalletAuthMethodId, WalletId } from '../../../../shared-ts/src/utils/domainIds';
 import { type WalletAuthMethodRecordV2 } from '../../../../shared-ts/src/utils/walletAuthMethodRecord';
 import { type WalletAuthAuthorityRef } from '../../../../shared-ts/src/utils/walletAuthAuthority';
 import type { WalletSignerRecord } from '../WalletStore';
-export type ActiveOwnerWalletExecutionLaneProjection = {
-    readonly kind: 'active_owner_wallet_execution_lane_projection_v1';
-    readonly walletKey: WalletKeyRecord;
-    readonly lane: Extract<SigningLaneRecord, {
-        readonly laneKind: 'owner_passkey' | 'owner_email_otp';
-    }>;
-    readonly materialActivation: MpcMaterialActivationRef;
-    readonly verifiedActivationReceiptDigestB64u: DigestB64u;
-};
+export type ActiveOwnerWalletExecutionLaneProjection = OwnerWalletExecutionLaneProjectionV1;
 type WalletExecutionLaneProjectionRefusalReason = 'auth_method_missing' | 'auth_method_ambiguous' | 'auth_method_inactive' | 'auth_method_mismatch' | 'signer_missing' | 'signer_ambiguous' | 'signer_conflict' | 'signer_invalid';
 export type WalletExecutionLaneProjectionResult = {
     readonly kind: 'projected';

package/dist/types/wallet-server/src/core/threeRouteRegistrationContracts.d.ts

@@ -1,7 +1,5 @@
 import type { ActiveWalletAuthMethodRecordV2 } from '../../../shared-ts/src/utils/walletAuthMethodRecord';
-import type { CorrelationId } from '../../../shared-ts/src/utils/canonicalPrimitives';
-import type { RouterAbEcdsaVerifiedClientActivationFactsV1 } from '../../../shared-ts/src/utils/routerAbEcdsaDerivation';
-import type { WalletRegistrationEcdsaPreparePayload, WalletRegistrationFinalizeSuccess, WalletRegistrationStartRequest, WalletRegistrationAuthorityInput, WalletRegistrationStartResponse, WalletRegistrationFinalizeRequest, WalletRegistrationEcdsaActivationResponse, WalletRegistrationEcdsaWalletKey, WalletRegistrationEd25519YaoPublicResult, WalletRegistrationRouteDiagnostics } from './registrationContracts';
+import type { WalletRegistrationEcdsaPreparePayload, WalletRegistrationFinalizeSuccess, WalletRegistrationStartRequest, WalletRegistrationStartResponse, WalletRegistrationEcdsaActivationResponse, WalletRegistrationEcdsaWalletKey, WalletRegistrationEd25519YaoPublicResult, WalletRegistrationRouteDiagnostics } from './registrationContracts';
 import type { WalletRegistrationFinalizeAuthMethod } from '../../../shared-ts/src/utils/registrationContracts';
 import type { RegistrationEstablishedSessionProjectionV2, RegistrationEstablishedSessionResultV2 } from '../../../shared-ts/src/utils/registrationEstablishedSession';
 import type { WalletAuthMethodId, WalletId } from '../../../shared-ts/src/utils/domainIds';
@@ -50,8 +48,6 @@ type SetupEd25519Work = Extract<WalletRegistrationStartResponse, {
 }> extends {
     ed25519: infer T;
 } ? T : never;
-type ActivateIdempotencyKey = WalletRegistrationFinalizeRequest['idempotencyKey'];
-type FinalizeRequestBase = WalletRegistrationFinalizeRequest;
 type EcdsaFinalizeSuccess = Extract<WalletRegistrationFinalizeSuccess, {
     kind: 'evm_family_ecdsa';
 }>;
@@ -187,47 +183,6 @@ export type WalletRegistrationSetupResponseV2 = (WalletRegistrationSetupSuccessB
     kind: 'near_ed25519';
     ecdsa?: never;
 }) | WalletRegistrationRouteErrorV2;
-/**
- * Route 2 — authenticated respond.
- *
- * The request discriminates on the signer plan, exhaustively, because an
- * Ed25519-only ceremony has no ECDSA registration to send. A single object
- * type with a required `ecdsa` made that request impossible to construct.
- * The parser validates this discriminant against the plan the signed setup
- * and ceremony actually recorded, so a caller cannot pick an arm the ceremony
- * was not created for.
- */
-type WalletRegistrationRespondRequestBaseV2 = {
-    registrationCeremonyId: string;
-    signedSetup: SignedSetupPayloadB64u;
-};
-type WalletRegistrationRespondAuthorityProofV2 = {
-    webauthn_registration: Extract<WalletRegistrationAuthorityInput, {
-        kind: 'passkey';
-    }>['webauthnRegistration'];
-    emailOtpRegistrationProof?: never;
-} | {
-    emailOtpRegistrationProof: Extract<WalletRegistrationAuthorityInput, {
-        kind: 'email_otp';
-    }>['emailOtpRegistrationProof'];
-    webauthn_registration?: never;
-};
-export type RespondEcdsaRegistrationWorkV2 = {
-    kind: 'router_ab_ecdsa_registration_v1';
-    strictRegistration: unknown;
-    /** Canonical Router request digest produced by the client ceremony WASM. */
-    requestDigestB64u: string;
-};
-export type WalletRegistrationRespondRequestV2 = WalletRegistrationRespondAuthorityProofV2 & ((WalletRegistrationRespondRequestBaseV2 & {
-    kind: 'evm_family_ecdsa';
-    ecdsa: RespondEcdsaRegistrationWorkV2;
-}) | (WalletRegistrationRespondRequestBaseV2 & {
-    kind: 'near_ed25519_and_evm_family_ecdsa';
-    ecdsa: RespondEcdsaRegistrationWorkV2;
-}) | (WalletRegistrationRespondRequestBaseV2 & {
-    kind: 'near_ed25519';
-    ecdsa?: never;
-}));
 /**
  * What respond returns for the ceremony's signer plan.
  *
@@ -285,52 +240,6 @@ export type WalletRegistrationNearAdmissionResponseV2 = {
     readonly registrationCeremonyId: string;
     readonly ed25519: RespondEd25519DeferredWorkV2;
 } | WalletRegistrationRouteErrorV2;
-/**
- * Route 3 — activate-and-finalize; the operation row is the replay record.
- *
- * Two independent discriminants, because they vary independently: the signer
- * plan decides whether there is ECDSA activation to send, and the auth method
- * decides whether Email OTP enrollment is required. Enrollment is *not* an
- * ECDSA concern — an Ed25519-only wallet registered with Email OTP still
- * enrolls — so deriving those fields from the ECDSA work, as this type
- * previously did, mismodelled them.
- *
- * Passkey activation carrying enrollment fields fails to compile, and Email
- * OTP activation missing them fails to compile. Neither is optional, because
- * neither is genuinely optional at runtime.
- */
-type WalletRegistrationActivateAuthWorkV2 = {
-    authMethod: 'passkey';
-    emailOtpEnrollment?: never;
-} | {
-    authMethod: 'email_otp';
-    emailOtpEnrollment: NonNullable<FinalizeRequestBase['emailOtpEnrollment']>;
-};
-type WalletRegistrationActivateRequestBaseV2 = {
-    registrationCeremonyId: string;
-    signedSetup: SignedSetupPayloadB64u;
-    idempotencyKey: ActivateIdempotencyKey;
-};
-export type ActivateEcdsaWorkV2 = {
-    activationCorrelationId: CorrelationId;
-    clientActivation: RouterAbEcdsaVerifiedClientActivationFactsV1;
-};
-export type WalletRegistrationActivateRequestV2 = WalletRegistrationActivateRequestBaseV2 & WalletRegistrationActivateAuthWorkV2 & ({
-    kind: 'evm_family_ecdsa';
-    ecdsa: ActivateEcdsaWorkV2;
-} | {
-    kind: 'near_ed25519_and_evm_family_ecdsa';
-    ecdsa: ActivateEcdsaWorkV2;
-} | {
-    /**
-     * Ed25519-only activate persists the pending wallet and nothing else.
-     * It sends no ECDSA activation and — deliberately — no Ed25519
-     * activation reference either: Yao has not resolved yet, and its
-     * result arrives later at `/wallets/register/near-provisioning`.
-     */
-    kind: 'near_ed25519';
-    ecdsa?: never;
-});
 /**
  * Activate's terminal response is both legs merged.
  *

package/dist/types/wallet-server/src/core/threeRouteRegistrationContracts.typecheck.d.ts

@@ -1,60 +1,12 @@
 /**
- * Compile-time proof that the three-route request unions make invalid
- * registrations unrepresentable.
- *
- * These are the states a single object type with required `ecdsa` allowed and
- * shouldn't have: an Ed25519-only request carrying ECDSA work it has none of,
- * an ECDSA request missing the work it cannot run without, and Email OTP
- * enrollment attached to — or missing from — the wrong auth branch.
+ * Compile-time proof that the three-route commit receipt makes invalid
+ * committed states unrepresentable.
  *
  * Every `@ts-expect-error` here fails the build if the union ever stops
  * rejecting that shape.
  */
-import type { ActivateEcdsaWorkV2, RespondEcdsaRegistrationWorkV2, WalletRegistrationCommittedInstallationProjectionV1, WalletRegistrationActivateRequestV2, WalletRegistrationRespondRequestV2 } from './threeRouteRegistrationContracts';
-export type { WalletRegistrationActivateRequestV2 as _ActivateRequest, WalletRegistrationRespondRequestV2 as _RespondRequest, };
-export declare const _threeRouteRequestFixtures: readonly [{
-    webauthn_registration: Extract<import("./registrationContracts").WalletRegistrationAuthorityInput, {
-        kind: "passkey";
-    }>["webauthnRegistration"];
-    emailOtpRegistrationProof?: never;
-} & {
-    registrationCeremonyId: string;
-    signedSetup: import("./threeRouteRegistrationContracts").SignedSetupPayloadB64u;
-} & {
-    kind: "evm_family_ecdsa";
-    ecdsa: RespondEcdsaRegistrationWorkV2;
-}, {
-    webauthn_registration: Extract<import("./registrationContracts").WalletRegistrationAuthorityInput, {
-        kind: "passkey";
-    }>["webauthnRegistration"];
-    emailOtpRegistrationProof?: never;
-} & {
-    registrationCeremonyId: string;
-    signedSetup: import("./threeRouteRegistrationContracts").SignedSetupPayloadB64u;
-} & {
-    kind: "near_ed25519";
-    ecdsa?: never;
-}, {
-    registrationCeremonyId: string;
-    signedSetup: import("./threeRouteRegistrationContracts").SignedSetupPayloadB64u;
-    idempotencyKey: string;
-} & {
-    authMethod: "passkey";
-    emailOtpEnrollment?: never;
-} & {
-    kind: "evm_family_ecdsa";
-    ecdsa: ActivateEcdsaWorkV2;
-}, {
-    registrationCeremonyId: string;
-    signedSetup: import("./threeRouteRegistrationContracts").SignedSetupPayloadB64u;
-    idempotencyKey: string;
-} & {
-    authMethod: "email_otp";
-    emailOtpEnrollment: NonNullable<import("../../../shared-ts/src/utils").WalletEmailOtpEnrollmentMaterialV1 | undefined>;
-} & {
-    kind: "near_ed25519";
-    ecdsa?: never;
-}, WalletRegistrationRespondRequestV2, WalletRegistrationActivateRequestV2, WalletRegistrationRespondRequestV2, WalletRegistrationActivateRequestV2, WalletRegistrationActivateRequestV2, WalletRegistrationActivateRequestV2, WalletRegistrationCommittedInstallationProjectionV1, ({
+import type { WalletRegistrationCommittedInstallationProjectionV1 } from './threeRouteRegistrationContracts';
+export declare const _threeRouteRequestFixtures: readonly [WalletRegistrationCommittedInstallationProjectionV1, ({
     readonly kind: "ecdsa_ready";
     readonly ecdsa: {
         readonly walletKeys: readonly import("./registrationContracts").WalletRegistrationEcdsaWalletKey[];

package/dist/types/wallet-server/src/core/thresholdEcdsaChainTarget.d.ts

@@ -1,14 +1,5 @@
-export type ThresholdEcdsaChainTarget = {
-    kind: 'evm';
-    namespace: 'eip155';
-    chainId: number;
-    networkSlug?: string;
-} | {
-    kind: 'tempo';
-    chainId: number;
-    networkSlug?: string;
-};
+import { thresholdEcdsaChainTargetKey, type ThresholdEcdsaChainTargetWire } from '../../../shared-ts/src/utils/thresholdEcdsaChainTarget';
+export { thresholdEcdsaChainTargetKey };
+export type ThresholdEcdsaChainTarget = ThresholdEcdsaChainTargetWire;
 export declare function thresholdEcdsaChainTargetFromValue(value: unknown): ThresholdEcdsaChainTarget | null;
-export declare function thresholdEcdsaChainTargetKey(target: ThresholdEcdsaChainTarget): string;
-export declare function thresholdEcdsaChainTargetsEqual(left: ThresholdEcdsaChainTarget, right: ThresholdEcdsaChainTarget): boolean;
 //# sourceMappingURL=thresholdEcdsaChainTarget.d.ts.map