@seams/wallet-server 0.7.1 → 0.8.0

package/dist/types/wallet-server/src/core/types.d.ts

@@ -1,9 +1,8 @@
 import { AuthenticatorOptions, UserVerificationPolicy, OriginPolicyInput } from '../../../shared-ts/src/utils/authenticatorOptions';
 import type { InitInput } from '../../../../wasm/near_signer/pkg/wasm_signer_worker.js';
-import type { Logger } from './logger';
 import type { Ed25519AuthorityScope } from '../../../shared-ts/src/threshold/sessionPolicy';
 import type { RuntimePolicyScope } from '../../../shared-ts/src/threshold/signingRootScope';
-import type { EcdsaClientRootPublicKey33B64u, DerivationClientSharePublicKey33B64u, EcdsaDerivationRelayerPublicKey33B64u } from '../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap';
+import type { EcdsaClientRootPublicKey33B64u, DerivationClientSharePublicKey33B64u, EcdsaDerivationRoleLocalPublicIdentity } from '../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap';
 import type { RouterAbEd25519NormalSigningState } from '../../../shared-ts/src/utils/signingSessionSeal';
 import type { RouterAbEcdsaDerivationNormalSigningScopeV1, RouterAbEcdsaDerivationNormalSigningStateV1 } from '../../../shared-ts/src/utils/routerAbEcdsaDerivation';
 import type { WalletAuthAuthority } from '../../../shared-ts/src/utils/walletAuthAuthority';
@@ -30,16 +29,6 @@ export interface ServerResponse {
     body: string;
 }
 export type SignerWasmModuleSupplier = InitInput | Promise<InitInput> | (() => InitInput | Promise<InitInput>);
-export interface SignerWasmConfig {
-    /**
-     * Optional override for locating the signer WASM module. Useful for serverless
-     * runtimes (e.g. Workers) where filesystem-relative URLs are unavailable.
-     * Accepts any value supported by `initSignerWasm({ module_or_path })` or a
-     * function that resolves to one.
-     */
-    moduleOrPath?: SignerWasmModuleSupplier;
-}
-export type ThresholdEd25519KeyStoreKind = 'in-memory' | 'upstash-redis-rest' | 'redis-tcp' | 'cloudflare-do';
 export interface CloudflareDurableObjectStubLike {
     fetch(input: RequestInfo, init?: RequestInit): Promise<Response>;
 }
@@ -47,226 +36,11 @@ export interface CloudflareDurableObjectNamespaceLike {
     idFromName(name: string): unknown;
     get(id: unknown): CloudflareDurableObjectStubLike;
 }
-export type ThresholdStoreConfig = {
-    kind: 'in-memory';
-} | {
-    kind: 'upstash-redis-rest';
-    url: string;
-    token: string;
-    keyPrefix?: string;
-} | {
-    kind: 'redis-tcp';
-    redisUrl: string;
-    keyPrefix?: string;
-} | {
-    kind: 'cloudflare-do';
-    /**
-     * Durable Object namespace binding (e.g. `env.THRESHOLD_STORE`).
-     * Must point to a DO class implementing the SDK's threshold store protocol.
-     */
-    namespace: CloudflareDurableObjectNamespaceLike;
-    /**
-     * Optional DO instance name. Defaults to `threshold-store`.
-     * Use different names to isolate environments within the same Worker script.
-     */
-    name?: string;
-};
-/**
- * Env-shaped input for threshold key store selection.
- * - Upstash REST (Cloudflare-friendly): UPSTASH_REDIS_REST_URL + UPSTASH_REDIS_REST_TOKEN
- * - Redis TCP (Node-only): REDIS_URL
- */
-export type ThresholdStoreEnvInput = {
-    UPSTASH_REDIS_REST_URL?: string;
-    UPSTASH_REDIS_REST_TOKEN?: string;
-    REDIS_URL?: string;
-    /**
-     * Optional global base prefix for all threshold keyspaces.
-     *
-     * When set, and the more specific `THRESHOLD_ED25519_*_PREFIX` variables are not set,
-     * the SDK derives:
-     * - `THRESHOLD_ED25519_WALLET_SESSION_PREFIX` = `${THRESHOLD_PREFIX}:threshold-ed25519:wallet-session:`
-     * - `THRESHOLD_ED25519_SESSION_PREFIX` = `${THRESHOLD_PREFIX}:threshold-ed25519:sess:`
-     * - `THRESHOLD_ED25519_KEYSTORE_PREFIX` = `${THRESHOLD_PREFIX}:threshold-ed25519:key:`
-     * - `THRESHOLD_WALLET_SIGNING_BUDGET_SESSION_PREFIX` = `${THRESHOLD_PREFIX}:wallet-session:budget:`
-     *
-     * Trailing `:` is optional.
-     */
-    THRESHOLD_PREFIX?: string;
-    THRESHOLD_ED25519_KEYSTORE_PREFIX?: string;
-    THRESHOLD_ED25519_SESSION_PREFIX?: string;
-    THRESHOLD_ED25519_WALLET_SESSION_PREFIX?: string;
-    THRESHOLD_WALLET_SIGNING_BUDGET_SESSION_PREFIX?: string;
-    /**
-     * Ed25519 relayer-share source mode. This remains Ed25519-specific because
-     * it controls the Ed25519 threshold signing protocol, not the shared store.
-     */
-    THRESHOLD_ED25519_SHARE_MODE?: string;
-    /**
-     * Optional prefixes for threshold ECDSA key/session/Wallet Session storage.
-     * Defaults derive from `THRESHOLD_PREFIX` with a `threshold-ecdsa:*` namespace when unset.
-     */
-    THRESHOLD_ECDSA_KEYSTORE_PREFIX?: string;
-    THRESHOLD_ECDSA_SESSION_PREFIX?: string;
-    THRESHOLD_ECDSA_WALLET_SESSION_PREFIX?: string;
-    /**
-     * Optional override for the client FROST participant identifier (u16, >= 1).
-     * Must be distinct from `THRESHOLD_ED25519_RELAYER_PARTICIPANT_ID`.
-     */
-    THRESHOLD_ED25519_CLIENT_PARTICIPANT_ID?: string;
-    /**
-     * Optional override for the relayer FROST participant identifier (u16, >= 1).
-     * Must be distinct from `THRESHOLD_ED25519_CLIENT_PARTICIPANT_ID`.
-     */
-    THRESHOLD_ED25519_RELAYER_PARTICIPANT_ID?: string;
-    /**
-     * Threshold node role.
-     * - "coordinator" (default): exposes public registration/session routes and Router A/B bridge handlers.
-     * - "cosigner": exposes internal relayer-fleet t-of-n cosigning endpoints when configured.
-     */
-    THRESHOLD_NODE_ROLE?: string;
-    /**
-     * 32-byte base64url shared secret used to authenticate coordinator→peer calls.
-     *
-     * When set, cosigner relayers can expose internal endpoints that accept
-     * coordinator-signed grants (HMAC-SHA256).
-     */
-    THRESHOLD_COORDINATOR_SHARED_SECRET_B64U?: string;
-    /**
-     * Stable identifier for this coordinator instance.
-     *
-     * Used to pin Router A/B ECDSA derivation pool-fill sessions to the instance that
-     * created the live in-memory WASM session object.
-     */
-    THRESHOLD_COORDINATOR_INSTANCE_ID?: string;
-    /**
-     * Optional coordinator peer list (JSON) for cross-instance presign-step forwarding.
-     *
-     * Example:
-     * `THRESHOLD_COORDINATOR_PEERS=[{"instanceId":"coordinator-a","relayerUrl":"https://relay-a.internal"},{"instanceId":"coordinator-b","relayerUrl":"https://relay-b.internal"}]`
-     */
-    THRESHOLD_COORDINATOR_PEERS?: string;
-    /**
-     * Optional relayer-fleet cosigner list (JSON) for internal t-of-n cosigning.
-     *
-     * When configured on a coordinator node, the coordinator can fan out to relayer cosigners
-     * (internal-only nodes) and combine their partials into a single outer relayer signature share.
-     *
-     * Example:
-     * `THRESHOLD_ED25519_RELAYER_COSIGNERS=[{"cosignerId":1,"relayerUrl":"https://cosigner-a.internal"},{"cosignerId":2,"relayerUrl":"https://cosigner-b.internal"},{"cosignerId":3,"relayerUrl":"https://cosigner-c.internal"}]`
-     */
-    THRESHOLD_ED25519_RELAYER_COSIGNERS?: string;
-    /**
-     * Internal relayer cosigner id for this node (u16, >= 1).
-     * Required when running `THRESHOLD_NODE_ROLE=cosigner`.
-     */
-    THRESHOLD_ED25519_RELAYER_COSIGNER_ID?: string;
-    /**
-     * Internal relayer cosigner threshold `T` (integer, >= 1).
-     * When set together with `THRESHOLD_ED25519_RELAYER_COSIGNERS`, the coordinator will wait for
-     * `T` cosigners per signing round.
-     */
-    THRESHOLD_ED25519_RELAYER_COSIGNER_T?: string;
-    /**
-     * Optional Router A/B Ed25519 normal-signing SigningWorker id accepted by
-     * threshold session policy. When unset, Router A/B normal-signing session
-     * policy is rejected.
-     */
-    ROUTER_AB_NORMAL_SIGNING_WORKER_ID?: string;
-    /** Private Router A/B SigningWorker base URL. */
-    ROUTER_AB_SIGNING_WORKER_URL?: string;
-    /** Secret value sent in `x-router-ab-internal-service-auth` to private workers. */
-    ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET?: string;
-    /** Fetch transport for hosted runtimes that reach the SigningWorker through a service binding. */
-    routerAbSigningWorkerFetch?: typeof globalThis.fetch;
-    /** Signing-session seal root plus public rotation configuration. */
-    SIGNING_SESSION_SEAL_ROOT_SECRET_B64U?: string;
-    SIGNING_SESSION_SEAL_CURRENT_KEY_VERSION?: string;
-    SIGNING_SESSION_SEAL_ACCEPTED_WARM_KEY_VERSIONS?: string;
-    /** Optional signing session-seal idempotency backend configuration. */
-    SIGNING_SESSION_SEAL_IDEMPOTENCY_KIND?: string;
-    SIGNING_SESSION_SEAL_IDEMPOTENCY_UPSTASH_URL?: string;
-    SIGNING_SESSION_SEAL_IDEMPOTENCY_UPSTASH_TOKEN?: string;
-    SIGNING_SESSION_SEAL_IDEMPOTENCY_REDIS_URL?: string;
-    SIGNING_SESSION_SEAL_IDEMPOTENCY_KEY_PREFIX?: string;
-    SIGNING_SESSION_SEAL_IDEMPOTENCY_TTL_MS?: string;
-};
-/**
- * Threshold key store config input.
- *
- * Accepts either:
- * - an env-shaped object (for ergonomics in server examples), or
- * - an explicit `kind` object, optionally augmented with env-shaped overrides
- *   (useful when wiring via code but still wanting env vars like THRESHOLD_NODE_ROLE).
- */
-export type ThresholdStoreConfigInput = ThresholdStoreEnvInput | (ThresholdStoreConfig & Partial<ThresholdStoreEnvInput>);
-export interface AuthServiceConfig {
-    relayerAccount: string;
-    relayerPrivateKey: string;
-    nearRpcUrl: string;
-    networkId: string;
-    accountInitialBalance: string;
-    createAccountAndRegisterGas: string;
-    signerWasm?: SignerWasmConfig;
-    /**
-     * Optional persistence for relayer-held threshold signing shares.
-     * Defaults to in-memory unless env-shaped config enables Redis/Upstash.
-     */
-    thresholdStore?: ThresholdStoreConfigInput;
-    /**
-     * Optional logger. When unset, the server SDK is silent (no `console.*`).
-     * Pass `logger: console` to enable default logging.
-     */
-    logger?: Logger | null;
-    /**
-     * Optional Google OIDC configuration for verifying Google `id_token` login sessions.
-     */
-    googleOidc?: GoogleOidcConfig;
-    /**
-     * Optional GitHub OAuth configuration for exchanging authorization codes.
-     */
-    githubOAuth?: GithubOAuthConfig;
-}
-export type GoogleOidcConfig = {
-    /** Allowed OAuth client ids (audiences) for Google ID tokens. */
-    clientIds: string[];
-    /** Optional hosted domain allowlist (the `hd` claim). */
-    hostedDomains?: string[];
-};
-export interface GoogleOidcConfigEnvInput {
-    /** Single client id convenience. */
-    GOOGLE_OIDC_CLIENT_ID?: string;
-    /** Comma-separated client ids. */
-    GOOGLE_OIDC_CLIENT_IDS?: string;
-    /** Optional comma-separated hosted domains (`hd` claim). */
-    GOOGLE_OIDC_HOSTED_DOMAINS?: string;
-}
-export type GoogleOidcConfigInput = GoogleOidcConfig | GoogleOidcConfigEnvInput;
 export type GithubOAuthConfig = {
     clientId: string;
     clientSecret: string;
     callbackUrl: string;
 };
-export interface GithubOAuthConfigEnvInput {
-    GITHUB_OAUTH_CLIENT_ID?: string;
-    GITHUB_OAUTH_CLIENT_SECRET?: string;
-    GITHUB_OAUTH_CALLBACK_URL?: string;
-}
-export type GithubOAuthConfigInput = GithubOAuthConfig | GithubOAuthConfigEnvInput;
-/**
- * User-facing input shape for `AuthService`. Fields that have SDK defaults are optional here.
- *
- * Defaults are applied by `createAuthServiceConfig(...)` and the AuthService constructor.
- */
-export type AuthServiceConfigInput = Omit<AuthServiceConfig, 'nearRpcUrl' | 'networkId' | 'accountInitialBalance' | 'createAccountAndRegisterGas' | 'thresholdStore' | 'googleOidc' | 'githubOAuth'> & {
-    nearRpcUrl?: string;
-    networkId?: string;
-    accountInitialBalance?: string;
-    createAccountAndRegisterGas?: string;
-    thresholdStore?: ThresholdStoreConfigInput;
-    googleOidc?: GoogleOidcConfigInput;
-    githubOAuth?: GithubOAuthConfigInput;
-};
 export interface AccountCreationRequest {
     accountId: string;
     publicKey: string;
@@ -438,53 +212,6 @@ export interface ThresholdEd25519SessionResponse {
     runtimePolicyScope?: ThresholdRuntimePolicyScope;
     routerAbNormalSigning?: RouterAbEd25519NormalSigningState;
 }
-export interface ThresholdEd25519CosignInitRequest {
-    coordinatorGrant: string;
-    signingSessionId: string;
-    /**
-     * Base64url-encoded 32-byte relayer cosigner signing share (a secret share; unweighted).
-     * The cosigner derives its effective outer-protocol share from this and the selected cosigner set.
-     */
-    cosignerShareB64u: string;
-    clientCommitments: {
-        hiding: string;
-        binding: string;
-    };
-}
-export interface ThresholdEd25519CosignInitResponse {
-    ok: boolean;
-    code?: string;
-    message?: string;
-    relayerCommitments?: {
-        hiding: string;
-        binding: string;
-    };
-}
-export interface ThresholdEd25519CosignFinalizeRequest {
-    coordinatorGrant: string;
-    signingSessionId: string;
-    /**
-     * The selected cosigner id set used for internal Lagrange interpolation.
-     * Must include this cosigner's configured id.
-     */
-    cosignerIds: number[];
-    /** NEAR ed25519 public key string (`ed25519:<base58>`). */
-    groupPublicKey: string;
-    /**
-     * The combined outer-protocol relayer commitments (sum across the selected cosigners).
-     * This must match what the client used for its signing transcript.
-     */
-    relayerCommitments: {
-        hiding: string;
-        binding: string;
-    };
-}
-export interface ThresholdEd25519CosignFinalizeResponse {
-    ok: boolean;
-    code?: string;
-    message?: string;
-    relayerSignatureShareB64u?: string;
-}
 export type ThresholdEcdsaPurpose = string;
 export type EcdsaThresholdKeyId = string;
 export type ThresholdEcdsaChainTarget = import('./thresholdEcdsaChainTarget').ThresholdEcdsaChainTarget;
@@ -544,11 +271,7 @@ export type EcdsaDerivationRouteResult<T> = {
 };
 export type EcdsaDerivationRoleLocalFormatVersion = 'ecdsa-derivation-role-local';
 export type EcdsaDerivationKeyScope = 'evm-family';
-export interface EcdsaDerivationPublicIdentity {
-    derivationClientSharePublicKey33B64u: DerivationClientSharePublicKey33B64u;
-    relayerPublicKey33B64u: EcdsaDerivationRelayerPublicKey33B64u;
-    groupPublicKey33B64u: string;
-    ethereumAddress: string;
+export interface EcdsaDerivationPublicIdentity extends EcdsaDerivationRoleLocalPublicIdentity {
 }
 export interface EcdsaDerivationClientRootProof {
     version: 'ecdsa-derivation:role-local:first-bootstrap-root-proof:v2';
@@ -604,7 +327,6 @@ export interface EcdsaDerivationServerBootstrapResponse {
     publicIdentity: EcdsaDerivationPublicIdentity;
     clientShareRetryCounter: number;
     relayerShareRetryCounter: number;
-    publicTranscriptDigest32B64u: string;
     keyHandle: string;
     signingRootId: string;
     signingRootVersion: string;
@@ -709,29 +431,4 @@ export type RouterAbEcdsaDerivationPoolFillStepResponse = {
     /** Base64url-encoded compressed secp256k1 point (33 bytes) for `R` (only present when `event==='presign_done'`). */
     bigRB64u?: string;
 };
-export interface ThresholdEcdsaCosignInitRequest {
-    coordinatorGrant: string;
-    signingSessionId: string;
-    cosignerShareB64u: string;
-    clientRound1?: unknown;
-}
-export interface ThresholdEcdsaCosignInitResponse {
-    ok: boolean;
-    code?: string;
-    message?: string;
-    relayerRound1?: unknown;
-}
-export interface ThresholdEcdsaCosignFinalizeRequest {
-    coordinatorGrant: string;
-    signingSessionId: string;
-    cosignerIds: number[];
-    groupPublicKey: string;
-    relayerRound1?: unknown;
-}
-export interface ThresholdEcdsaCosignFinalizeResponse {
-    ok: boolean;
-    code?: string;
-    message?: string;
-    relayerRound2?: unknown;
-}
 //# sourceMappingURL=types.d.ts.map

package/dist/types/wallet-server/src/hosted-wallet-gateway.d.ts

@@ -1,6 +1,7 @@
+import type { WalletLifecycleRoutingPublisher } from './authorization/lifecycleRouting';
 import { type D1DatabaseLike } from './cloud-host';
 import { type WalletConsoleServiceBinding } from './cloud-host';
-import { type WalletControlRuntimeBindings } from './cloud-host';
+import { type WalletControlRuntimeBindings, type WalletRuntimeWalletIdentitiesResult, type WalletRuntimeWalletIdentityRequest } from './cloud-host';
 import { createCloudflareD1RouterApiAuthService, type CloudflareD1RouterApiAuthServiceOptions } from './cloud-host';
 import type { SigningSessionSealRoutesOptions } from './cloud-host';
 import type { CfExecutionContext, FetchHandler } from './cloud-host';
@@ -35,8 +36,6 @@ export interface CloudflareD1GatewayBaseEnv extends Readonly<Record<string, unkn
     readonly GITHUB_OAUTH_CLIENT_ID?: string;
     readonly GITHUB_OAUTH_CLIENT_SECRET?: string;
     readonly GITHUB_OAUTH_CALLBACK_URL?: string;
-    readonly ACCOUNT_ID_DERIVATION_SECRET?: string;
-    readonly ROUTER_AB_NORMAL_SIGNING_WORKER_ID?: string;
     readonly SIGNING_WORKER_ID?: string;
     readonly ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET?: string;
     readonly ROUTER_AB_GATEWAY_TO_ROUTER_AUTH_SECRET?: string;
@@ -79,6 +78,18 @@ export interface CloudflareD1GatewayEnv extends CloudflareD1GatewayBaseEnv {
     readonly WALLET_CONSOLE: WalletConsoleServiceBinding;
 }
 export interface HostedWalletGatewayDependenciesV1 {
+    readonly identityStore?: CloudflareD1RouterApiAuthServiceOptions['identityStore'];
+    readonly emailOtpRateLimitCounter?: CloudflareD1RouterApiAuthServiceOptions['emailOtpRateLimitCounter'];
+    readonly googleRegistrationAttempts?: CloudflareD1RouterApiAuthServiceOptions['googleRegistrationAttempts'];
+    readonly sessionRouting?: CloudflareD1RouterApiAuthServiceOptions['sessionRouting'];
+    readonly lifecycleRouting?: WalletLifecycleRoutingPublisher;
+    readonly recoveryRouting?: CloudflareD1RouterApiAuthServiceOptions['recoveryRouting'];
+    readonly registrationSetupDispatcher?: CloudflareD1RouterApiAuthServiceOptions['registrationSetupDispatcher'];
+    readonly registrationAuthority?: CloudflareD1RouterApiAuthServiceOptions['registrationAuthority'];
+    readonly credentialClaims?: CloudflareD1RouterApiAuthServiceOptions['credentialClaims'];
+    readonly linkedDeviceBootstrap?: CloudflareD1RouterApiAuthServiceOptions['linkedDeviceBootstrap'];
+    readonly linkedDeviceProofNonces?: CloudflareD1RouterApiAuthServiceOptions['linkedDeviceProofNonces'];
+    readonly syncChallenges?: CloudflareD1RouterApiAuthServiceOptions['syncChallenges'];
     readonly emailOtpDeliveryProvider?: CloudflareD1RouterApiAuthServiceOptions['emailOtpDeliveryProvider'];
     /** Host loader for the signer WASM; defaults to the Workers module import. */
     readonly signerWasm?: CloudflareD1RouterApiAuthServiceOptions['signerWasmModuleOrPath'];
@@ -98,6 +109,7 @@ export declare function createHostedWalletGatewayCompositionV1(env: CloudflareD1
 }>;
 export declare function createSplitGatewayRouterHandler(env: CloudflareD1GatewayEnv, dependencies?: HostedWalletGatewayDependenciesV1): Promise<FetchHandler>;
 export declare function handleSplitGatewayWalletRuntimeRequest(request: Request, env: CloudflareD1GatewayEnv & WalletControlRuntimeBindings, dependencies?: HostedWalletGatewayDependenciesV1): Promise<Response | null>;
+export declare function readWalletRuntimeIdentities(env: CloudflareD1GatewayEnv, input: WalletRuntimeWalletIdentityRequest): Promise<WalletRuntimeWalletIdentitiesResult>;
 export declare function handleSplitGatewayRequest(request: Request, env: CloudflareD1GatewayEnv, ctx: CfExecutionContext, dependencies?: HostedWalletGatewayDependenciesV1): Promise<Response>;
 export declare function stagingSigningSessionSealOptions(env: Pick<CloudflareD1GatewayBaseEnv, 'SIGNING_SESSION_SEAL_ROOT_SECRET_B64U' | 'SIGNING_SESSION_SEAL_CURRENT_KEY_VERSION' | 'SIGNING_SESSION_SEAL_ACCEPTED_WARM_KEY_VERSIONS'>): SigningSessionSealRoutesOptions | undefined;
 declare function createStagingYaoPartitionedStateStore(env: CloudflareD1GatewayBaseEnv): ReturnType<typeof createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1>;

package/dist/types/wallet-server/src/index.d.ts

@@ -1,28 +1,23 @@
 export * from './core/types';
 export * from './core/config';
-export * from './core/defaultConfigsServer';
 export { formatSigningSessionSealKeyVersionForWire, parseSigningSessionSealKeyVersion, type SigningSessionSealKeyVersion, } from './core/keyMaterialBrands';
-export { AuthService } from './core/AuthService';
 export * from './authorization/domain';
 export * from './authorization/service';
 export * from './authorization/vaultProxyUse';
 export { SessionService, parseCsvList, buildCorsOrigins } from './core/SessionService';
 export type { SessionConfig } from './core/SessionService';
-export { createThresholdEd25519KeyStore, createThresholdEd25519SessionStore, createEd25519WalletSessionStore, createEcdsaWalletSessionStore, } from './core/ThresholdService';
-export { createRouterAbSigningRuntimes, type RouterAbSigningRuntimeBundle, } from './core/routerAbSigning/createRouterAbSigningRuntimes';
 export { RouterAbEcdsaPresignRuntime } from './core/routerAbSigning/RouterAbEcdsaPresignRuntime';
 export { ensureEvmCryptoWasm, computeEip1559TxHash, signSecp256k1Recoverable, encodeEip1559SignedTxFromSignature65, secp256k1PrivateKey32ToPublicKey33, secp256k1PublicKey33ToEthereumAddress, } from './core/ThresholdService/evmCryptoWasm';
 export type { ServerEip1559UnsignedTx } from './core/ThresholdService/evmCryptoWasm';
-export type { ThresholdEd25519KeyStore, ThresholdEd25519KeyRecord, ThresholdEd25519SessionStore, ThresholdEd25519MpcSessionRecord, ThresholdEd25519SigningSessionRecord, ThresholdEd25519Commitments, Ed25519WalletSessionStore, Ed25519WalletSessionRecord, } from './core/ThresholdService';
+export type { Ed25519WalletSessionStore, Ed25519WalletSessionRecord, } from './core/ThresholdService';
 export * from './core/signingMaterial/ordinaryInactiveSignerMaterialReservation';
-export { D1WalletAuthMethodStore, createWalletAuthMethodStore, ensureWalletAuthMethodStoreD1Schema, normalizeWalletAuthMethod, resolveWalletAuthMethodStoreNamespace, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, type D1WalletAuthMethodStoreOptions, type D1WalletAuthMethodStoreSchemaOptions, type WalletAuthMethodRecord, type WalletAuthMethodStore, } from './core/WalletAuthMethodStore';
-export { D1WalletStore, WALLET_STORE_D1_SCHEMA_SQL, buildWalletEcdsaSignerRecord, buildWalletEd25519SignerId, createWalletStore, ensureWalletStoreD1Schema, resolveWalletStoreNamespace, type D1WalletStoreOptions, type D1WalletStoreSchemaOptions, type WalletEcdsaSignerRecord, type WalletEd25519SignerRecord, type WalletRecord, type WalletSignerRecord, type WalletStore, } from './core/WalletStore';
-export { D1WebAuthnAuthenticatorStore, WEBAUTHN_AUTHENTICATOR_STORE_D1_SCHEMA_SQL, createWebAuthnAuthenticatorStore, ensureWebAuthnAuthenticatorStoreD1Schema, resolveWebAuthnAuthenticatorStoreNamespace, type D1WebAuthnAuthenticatorStoreOptions, type D1WebAuthnAuthenticatorStoreSchemaOptions, type WebAuthnAuthenticatorRecord, type WebAuthnAuthenticatorStore, } from './core/WebAuthnAuthenticatorStore';
-export { D1WebAuthnCredentialBindingStore, WEBAUTHN_CREDENTIAL_BINDING_STORE_D1_SCHEMA_SQL, createWebAuthnCredentialBindingStore, ensureWebAuthnCredentialBindingStoreD1Schema, resolveWebAuthnCredentialBindingStoreNamespace, type D1WebAuthnCredentialBindingStoreOptions, type D1WebAuthnCredentialBindingStoreSchemaOptions, type WebAuthnCredentialBindingRecord, type WebAuthnCredentialBindingStore, } from './core/WebAuthnCredentialBindingStore';
-export { D1WebAuthnLoginChallengeStore, WEBAUTHN_LOGIN_CHALLENGE_STORE_D1_SCHEMA_SQL, createWebAuthnLoginChallengeStore, ensureWebAuthnLoginChallengeStoreD1Schema, type D1WebAuthnLoginChallengeStoreOptions, type D1WebAuthnLoginChallengeStoreSchemaOptions, type WebAuthnLoginChallengeRecord, type WebAuthnLoginChallengeStore, } from './core/WebAuthnLoginChallengeStore';
-export { D1WebAuthnSyncChallengeStore, WEBAUTHN_SYNC_CHALLENGE_STORE_D1_SCHEMA_SQL, createWebAuthnSyncChallengeStore, ensureWebAuthnSyncChallengeStoreD1Schema, type D1WebAuthnSyncChallengeStoreOptions, type D1WebAuthnSyncChallengeStoreSchemaOptions, type WebAuthnSyncChallengeRecord, type WebAuthnSyncChallengeStore, } from './core/WebAuthnSyncChallengeStore';
-export { D1IdentityStore, IDENTITY_STORE_D1_SCHEMA_SQL, createIdentityStore, ensureIdentityStoreD1Schema, resolveIdentityStoreNamespace, type D1IdentityStoreOptions, type D1IdentityStoreSchemaOptions, type IdentityStore, type IdentitySubjectRecord, type IdentityUserRecord, type LinkIdentityResult, type UnlinkIdentityResult, } from './core/IdentityStore';
-export { D1NearPublicKeyStore, NEAR_PUBLIC_KEY_STORE_D1_SCHEMA_SQL, createNearPublicKeyStore, ensureNearPublicKeyStoreD1Schema, type D1NearPublicKeyStoreOptions, type D1NearPublicKeyStoreSchemaOptions, type NearPublicKeyKind, type NearPublicKeyRecord, type NearPublicKeyStore, } from './core/NearPublicKeyStore';
+export { D1WalletAuthMethodStore, ensureWalletAuthMethodStoreD1Schema, normalizeWalletAuthMethod, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, type D1WalletAuthMethodStoreOptions, type D1WalletAuthMethodStoreSchemaOptions, type WalletAuthMethodRecord, type WalletAuthMethodStore, } from './core/WalletAuthMethodStore';
+export { D1WalletStore, WALLET_STORE_D1_SCHEMA_SQL, buildWalletEcdsaSignerRecord, buildWalletEd25519SignerId, ensureWalletStoreD1Schema, type D1WalletStoreOptions, type D1WalletStoreSchemaOptions, type WalletEcdsaSignerRecord, type WalletEd25519SignerRecord, type WalletRecord, type WalletSignerRecord, type WalletStore, } from './core/WalletStore';
+export { type WebAuthnAuthenticatorRecord, type WebAuthnAuthenticatorStore, } from './core/WebAuthnAuthenticatorStore';
+export { type WebAuthnCredentialBindingRecord, type WebAuthnCredentialBindingStore, } from './core/WebAuthnCredentialBindingStore';
+export { type WebAuthnLoginChallengeRecord } from './core/WebAuthnLoginChallengeStore';
+export { type WebAuthnSyncChallengeRecord } from './core/WebAuthnSyncChallengeStore';
+export { D1IdentityStore, IDENTITY_STORE_D1_SCHEMA_SQL, ensureIdentityStoreD1Schema, type D1IdentityStoreOptions, type D1IdentityStoreSchemaOptions, type IdentityStore, type IdentitySubjectRecord, type LinkIdentityResult, type UnlinkIdentityResult, } from './core/IdentityStore';
 export { InMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createRouterAbNormalSigningAdmissionAdapter, type RouterAbNormalSigningAbuseDecision, type RouterAbNormalSigningPolicyDecision, type RouterAbNormalSigningAdmissionStore, type RouterAbNormalSigningProjectPolicyDecision, } from './router/domains/signingOperations/routerAbNormalSigningAdmissionCore';
 export { CloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1RouterAbNormalSigningAdmissionStore, type CloudflareD1RouterAbNormalSigningAdmissionStoreOptions, } from './router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore';
 export * from './threshold/session/signingSessionSeal';

package/dist/types/wallet-server/src/localIntendedMaterialAdmissionFault.d.ts

@@ -0,0 +1,38 @@
+import type { D1DatabaseLike, D1PreparedStatementLike, D1ResultLike } from './storage/tenantRoute';
+type Mode = 'canonical_claim' | 'canonical_existing' | 'linked_claim' | 'linked_existing';
+type Role = 'material' | 'claim' | 'existing';
+type LocalMaterialAdmissionFault = {
+    readonly database: LocalMaterialAdmissionFaultDatabase;
+    readonly request: Request;
+    readonly token: string;
+};
+export declare function localMaterialAdmissionFault(request: Request, database: D1DatabaseLike): LocalMaterialAdmissionFault | Response | null;
+/** Retire material after resolution and before one admission statement, then restore it. */
+declare class LocalMaterialAdmissionFaultDatabase implements D1DatabaseLike {
+    private readonly base;
+    private readonly mode;
+    private scope;
+    private state;
+    constructor(base: D1DatabaseLike, mode: Mode);
+    prepare(query: string): D1PreparedStatementLike;
+    captureScope(values: readonly unknown[]): void;
+    batch<T = unknown>(statements: readonly D1PreparedStatementLike[]): Promise<readonly T[]>;
+    exec(query: string): Promise<unknown>;
+    first<T>(statement: FaultStatement, columnName: string | undefined): Promise<T | null>;
+    private shouldRetire;
+    private execute;
+    response(response: Response, token: string): Response;
+    private target;
+}
+declare class FaultStatement implements D1PreparedStatementLike {
+    private readonly database;
+    readonly inner: D1PreparedStatementLike;
+    readonly role: Role;
+    constructor(database: LocalMaterialAdmissionFaultDatabase, inner: D1PreparedStatementLike, role: Role);
+    bind(...values: readonly unknown[]): D1PreparedStatementLike;
+    first<T = unknown>(columnName?: string): Promise<T | null>;
+    all<T = unknown>(): Promise<D1ResultLike<T>>;
+    run<T = unknown>(): Promise<D1ResultLike<T>>;
+}
+export {};
+//# sourceMappingURL=localIntendedMaterialAdmissionFault.d.ts.map

package/dist/types/wallet-server/src/localIntendedPresignCancellation.d.ts

@@ -0,0 +1,4 @@
+import { type CloudflareD1GatewayEnv, type HostedWalletGatewayDependenciesV1 } from './hosted-wallet-gateway';
+import type { CfExecutionContext } from './router/cloudflare/runtime/cloudflare.types';
+export declare function localPresignCancellationProbe(request: Request, env: CloudflareD1GatewayEnv, ctx: CfExecutionContext, dependencies: HostedWalletGatewayDependenciesV1 | undefined): Promise<Response | null>;
+//# sourceMappingURL=localIntendedPresignCancellation.d.ts.map

package/dist/types/wallet-server/src/localRegistrationSetupAuthority.d.ts

@@ -0,0 +1,13 @@
+import type { D1DatabaseLike } from './storage/tenantRoute';
+import type { D1TenantScope } from './core/d1TenantStore';
+import { type WalletRegistrationReservationAuthority, type WalletRegistrationSetupReservationResult } from './router/domains/walletRegistration/walletRegistrationReservation';
+import type { WalletRegistrationSetupInput } from './router/domains/walletRegistration/walletRegistrationInputs';
+export declare class LocalRegistrationSetupAuthority implements WalletRegistrationReservationAuthority {
+    private readonly scope;
+    private readonly storage;
+    constructor(database: D1DatabaseLike, scope: D1TenantScope);
+    reserve(input: WalletRegistrationSetupInput): Promise<WalletRegistrationSetupReservationResult>;
+    admitHome(input: Parameters<WalletRegistrationReservationAuthority['admitHome']>[0]): Promise<Awaited<ReturnType<WalletRegistrationReservationAuthority['admitHome']>>>;
+    complete(input: Parameters<WalletRegistrationReservationAuthority['complete']>[0]): Promise<Awaited<ReturnType<WalletRegistrationReservationAuthority['admitHome']>>>;
+}
+//# sourceMappingURL=localRegistrationSetupAuthority.d.ts.map

package/dist/types/wallet-server/src/router/auth/authRequestValidation.d.ts

@@ -15,7 +15,7 @@ type PasskeyLoginOptionsRequest = {
     rp_id: string;
     ttl_ms?: number;
 };
-type PasskeyLoginVerifyRequest = {
+export type PasskeyVerifyRequest = {
     challengeId: string;
     webauthn_authentication: WebAuthnAuthenticationCredential;
     expected_origin: string;
@@ -34,19 +34,14 @@ type GoogleLoginVerifyRequest = {
      */
     restartRegistrationOffer: boolean;
 };
-export type AuthPasskeyStepUpRequest = {
-    challengeId: string;
-    webauthn_authentication: WebAuthnAuthenticationCredential;
-    expected_origin: string;
-};
 type AuthLinkIdentityRequest = {
     provider: 'google';
     idToken: string;
-    stepUp: AuthPasskeyStepUpRequest;
+    stepUp: PasskeyVerifyRequest;
 };
 type AuthUnlinkIdentityRequest = {
     subject: string;
-    stepUp: AuthPasskeyStepUpRequest;
+    stepUp: PasskeyVerifyRequest;
 };
 type AuthIdentityMutationRequest = {
     kind: 'link';
@@ -75,7 +70,7 @@ export declare function parsePasskeyLoginOptionsRequest(raw: unknown): AuthRoute
 export declare function parsePasskeyLoginVerifyRequest(input: {
     body: unknown;
     origin: unknown;
-}): AuthRouteParseResult<PasskeyLoginVerifyRequest>;
+}): AuthRouteParseResult<PasskeyVerifyRequest>;
 export declare function parseGoogleLoginVerifyRequest(raw: unknown): AuthRouteParseResult<GoogleLoginVerifyRequest>;
 export declare function parseAuthIdentityMutationRequest(input: {
     pathname: unknown;

package/dist/types/wallet-server/src/router/auth/commonRouterUtils.d.ts

@@ -1,6 +1,8 @@
+import type { D1EcdsaAdmissionPolicyRead } from '../cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore';
+import type { EcdsaMaterialRead } from '../../core/d1EcdsaSignerRead';
 import type { ThresholdRuntimePolicyScope } from '../../core/types';
 import type { RouterApiAuthorizationSessionService } from '../framework/authServicePort';
-import type { RouterApiWalletSessionAuthorizationV2AdmissionContext, RouterApiWalletSessionExactOperationContext } from '../framework/authServicePort';
+import type { RouterApiWalletSessionAuthorizationV2AdmissionContext, RouterApiWalletSessionExactOperationContext, RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext } from '../framework/authServicePort';
 import type { RouterApiProjectEnvironmentResolver, RouterApiPublishableKeyAuthAdapter } from '../framework/routerApi';
 import { type WalletSessionFailureCode } from './walletSessionFailure';
 import { type WalletSessionAuthorizationV2AdministrationAdmissionResult, type WalletSessionAuthorizationV2AdministrationOperation, type WalletSessionAuthorizationV2AdmissionResult, type WalletSessionAuthorizationV2RequestedOperation } from '../domains/signingOperations/walletExecutionAdmission';
@@ -93,11 +95,22 @@ export declare function validateRouterAbEd25519WalletSessionInputs(input: {
 }): Promise<ThresholdEd25519SessionInputs>;
 export type ThresholdEcdsaSessionInputs = {
     readonly ok: true;
+    readonly materialRead: EcdsaMaterialRead;
+    readonly policyRead: D1EcdsaAdmissionPolicyRead;
     readonly kind: 'wallet_session_operation_credential_v1';
     readonly admission: Extract<WalletSessionOperationCredentialAdmission, {
         readonly curve: 'ecdsa';
     }>;
     readonly context: RouterApiWalletSessionAuthorizationV2AdmissionContext;
+    readonly candidate?: never;
+} | {
+    readonly ok: true;
+    readonly materialRead: EcdsaMaterialRead;
+    readonly policyRead: D1EcdsaAdmissionPolicyRead;
+    readonly kind: 'wallet_session_operation_credential_exhausted_candidate_v1';
+    readonly candidate: RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext;
+    readonly admission?: never;
+    readonly context?: never;
 } | AuthorizeErr;
 export declare function validateEcdsaPreprocessingSession(input: {
     readonly headers: Record<string, string | string[] | undefined>;
@@ -117,6 +130,7 @@ export declare function validateEcdsaPreprocessingSession(input: {
     }>['materialActivation'];
 }>;
 export declare function validateRouterAbEcdsaDerivationWalletSessionInputs(input: {
+    materialActivation: import('../../../../shared-ts/src/utils/routerAbNormalSigningIdentity').RouterAbMpcMaterialActivationRefWire;
     headers: Record<string, string | string[] | undefined>;
     authorizationSessions: RouterApiAuthorizationSessionService | null | undefined;
     nowMs?: () => number;

package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1AuthorizationAssembly.d.ts

@@ -0,0 +1,23 @@
+import { CloudflareD1EmailOtpRateLimitStore } from '../emailOtp/d1EmailOtpRateLimitStore';
+import type { ScopedD1Prepare } from '../../../../core/emailOtpD1Statements';
+import { CloudflareD1WebAuthnAuthService, type D1WebAuthnWalletManifestSource } from '../webauthn/d1WebAuthnAuthService';
+import { CloudflareD1WebAuthnStore } from '../webauthn/d1WebAuthnStore';
+import type { D1WalletAuthMethodStore } from '../../../../core/d1WalletAuthMethodStore';
+import { CloudflareD1WalletCustodyCommitStore } from '../passkeyCustody/d1WalletCustodyCommitStore';
+import type { NormalizedCloudflareD1RouterApiAuthServiceOptions } from './d1RouterApiAuthConfig';
+import { AuthorizationService } from '../../../../authorization/service';
+import type { WalletSessionRoutingPublisher } from '../../../../authorization/sessionRouting';
+import { CloudflareD1AuthorizationStore, type D1AuthorizationStoreOptions } from '../authorization/d1AuthorizationStore';
+export declare function createD1AuthorizationAssembly(options: D1AuthorizationStoreOptions, sessionRouting: WalletSessionRoutingPublisher | undefined): {
+    authorizationStore: CloudflareD1AuthorizationStore;
+    authorizationService: AuthorizationService;
+};
+export declare function createD1WalletCustodyStore(options: NormalizedCloudflareD1RouterApiAuthServiceOptions): CloudflareD1WalletCustodyCommitStore;
+export declare function createD1WebAuthnAssembly(options: NormalizedCloudflareD1RouterApiAuthServiceOptions, walletAuthMethodStore: D1WalletAuthMethodStore, walletManifestSource: D1WebAuthnWalletManifestSource): {
+    webAuthnStore: CloudflareD1WebAuthnStore;
+    webAuthnAuthService: CloudflareD1WebAuthnAuthService;
+};
+export declare function createD1IdentityStore(options: NormalizedCloudflareD1RouterApiAuthServiceOptions): import("../../../..").IdentityStore;
+export declare function createD1GoogleRegistrationAttempts(options: NormalizedCloudflareD1RouterApiAuthServiceOptions, prepare: ScopedD1Prepare): import("../emailOtp/d1GoogleEmailOtpRegistrationAttemptStore").GoogleEmailOtpRegistrationAttemptStore;
+export declare function createD1EmailOtpRateLimits(options: NormalizedCloudflareD1RouterApiAuthServiceOptions, prepare: ScopedD1Prepare): CloudflareD1EmailOtpRateLimitStore;
+//# sourceMappingURL=d1AuthorizationAssembly.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1RouterApiAuthBoundary.d.ts

@@ -23,7 +23,6 @@ type D1MutationResultLike = {
 };
 export declare function parseD1NonNegativeCount(input: unknown): number;
 export declare function d1MutationChanges(result: D1MutationResultLike): number;
-export declare function toArrayBufferCopy(bytes: Uint8Array): ArrayBuffer;
 export declare function sha256BytesPortable(input: Uint8Array): Promise<Uint8Array>;
 export {};
 //# sourceMappingURL=d1RouterApiAuthBoundary.d.ts.map