@seams/wallet-server 0.7.1 → 0.8.0

package/dist/types/wallet-server/src/router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.d.ts

@@ -1,4 +1,4 @@
-import type { RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
+import { type RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
 import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
 import type { RouterAbNormalSigningAdmissionInput } from '../../../domains/signingOperations/routerAbNormalSigningAdmission';
 import type { RouterAbNormalSigningAbuseDecision, RouterAbNormalSigningAdmissionStore, RouterAbNormalSigningProjectPolicyDecision, RouterAbNormalSigningPolicyDecision } from '../../../domains/signingOperations/routerAbNormalSigningAdmissionCore';
@@ -21,4 +21,17 @@ export declare class CloudflareD1RouterAbNormalSigningAdmissionStore implements
     private deleteRecord;
 }
 export declare function createCloudflareD1RouterAbNormalSigningAdmissionStore(options: CloudflareD1RouterAbNormalSigningAdmissionStoreOptions): CloudflareD1RouterAbNormalSigningAdmissionStore;
+export declare class D1EcdsaAdmissionPolicyRead {
+    #private;
+    private readonly database;
+    private readonly namespace;
+    private readonly walletId;
+    private readonly activationId;
+    private constructor();
+    static fromRows(database: D1DatabaseLike, namespace: string, walletId: string, activationId: string, rows: unknown): D1EcdsaAdmissionPolicyRead;
+    resolve(database: D1DatabaseLike, namespace: string, input: RouterAbNormalSigningAdmissionInput & {
+        readonly curve: 'ecdsa';
+    }): RouterAbNormalSigningPolicyDecision | null;
+}
+export declare const ECDSA_CREDENTIAL_POLICY_PROJECTION = "\n  (WITH candidates AS (\n     SELECT DISTINCT json_extract(signer.record_json, '$.runtimePolicyScope') AS scope_json\n       FROM wallet_signers AS signer\n      WHERE signer.namespace = session.namespace AND signer.org_id = session.org_id\n        AND signer.project_id = session.project_id AND signer.env_id = session.env_id\n        AND signer.wallet_id = session.wallet_id AND signer.signer_family = 'ecdsa'\n        AND json_valid(signer.record_json)\n   ), scopes AS (\n     SELECT scope_json,\n            json_extract(scope_json, '$.orgId') AS org_id,\n            json_extract(scope_json, '$.projectId') AS project_id,\n            json_extract(scope_json, '$.envId') AS env_id,\n            json_extract(scope_json, '$.signingRootVersion') AS signing_root_version,\n            json_extract(scope_json, '$.orgId') || char(31) ||\n            json_extract(scope_json, '$.projectId') || char(31) ||\n            json_extract(scope_json, '$.envId') || char(31) ||\n            json_extract(scope_json, '$.signingRootVersion') AS project_key\n       FROM candidates\n   )\n   SELECT json_group_array(json_object(\n     'scope_json', scopes.scope_json,\n     'project_key', project.record_key, 'project_decision', project.decision,\n     'project_retry_after_ms', project.retry_after_ms,\n     'abuse_key', abuse.record_key, 'abuse_decision', abuse.decision,\n     'abuse_retry_after_ms', abuse.retry_after_ms))\n     FROM scopes\n     LEFT JOIN router_ab_normal_signing_admission_records AS project\n       ON project.namespace = session.namespace AND project.org_id = scopes.org_id\n      AND project.project_id = scopes.project_id AND project.env_id = scopes.env_id\n      AND project.signing_root_version = scopes.signing_root_version\n      AND project.record_kind = 'project_policy' AND project.record_key = scopes.project_key\n     LEFT JOIN router_ab_normal_signing_admission_records AS abuse\n       ON abuse.namespace = session.namespace AND abuse.org_id = scopes.org_id\n      AND abuse.project_id = scopes.project_id AND abuse.env_id = scopes.env_id\n      AND abuse.signing_root_version = scopes.signing_root_version\n      AND abuse.record_kind = 'abuse'\n      AND abuse.record_key = scopes.project_key || char(31) || session.wallet_id || char(31) ||\n          'material_activation:' || ? || char(31) || 'ecdsa'\n  ) AS ecdsa_policy_records_json,";
 //# sourceMappingURL=d1RouterAbNormalSigningAdmissionStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAddSignerFinalizeRecord.d.ts

@@ -0,0 +1,27 @@
+import type { WalletId } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import type { WalletAddSignerFinalizeResponse } from '../../../../core/registrationContracts';
+import type { StoredWalletAddSignerFinalizeRequest, StoredWalletAddSignerCeremony } from '../../../../core/RegistrationCeremonyStore';
+import { type RouterAbEd25519YaoRegistrationSideEffectStoreV1, type RouterAbEd25519YaoRegistrationSideEffectRecordV1 } from '../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary';
+export type D1WalletAddSignerFinalizePreparedV1 = {
+    readonly walletId: WalletId;
+    readonly kind: 'd1_wallet_add_signer_finalize_ed25519_prepared_v1';
+    readonly finalizingAtMs: number;
+    readonly signerWriteAtMs?: never;
+} | {
+    readonly walletId: WalletId;
+    readonly kind: 'd1_wallet_add_signer_finalize_ecdsa_prepared_v1';
+    readonly signerWriteAtMs: number;
+    readonly finalizingAtMs?: never;
+};
+export type D1WalletAddSignerFinalizeSideEffectStore = RouterAbEd25519YaoRegistrationSideEffectStoreV1<WalletAddSignerFinalizeResponse, D1WalletAddSignerFinalizePreparedV1>;
+export type D1WalletAddSignerFinalizeSideEffectRecord = RouterAbEd25519YaoRegistrationSideEffectRecordV1<WalletAddSignerFinalizeResponse, D1WalletAddSignerFinalizePreparedV1>;
+export declare function parseD1WalletAddSignerFinalizeSideEffectRecord(raw: unknown): D1WalletAddSignerFinalizeSideEffectRecord | null;
+export declare function fingerprintD1WalletAddSignerFinalizePrepared(prepared: D1WalletAddSignerFinalizePreparedV1): Promise<string>;
+export declare function returnD1WalletAddSignerFinalizePrepared(prepared: D1WalletAddSignerFinalizePreparedV1): Promise<D1WalletAddSignerFinalizePreparedV1>;
+export declare function rejectUnexpectedWalletAddSignerFinalizePreparation(): Promise<never>;
+export declare function buildD1WalletAddSignerFinalizePrepared(input: {
+    readonly request: StoredWalletAddSignerFinalizeRequest;
+    readonly ceremony: StoredWalletAddSignerCeremony;
+    readonly nowMs: number;
+}): D1WalletAddSignerFinalizePreparedV1;
+//# sourceMappingURL=d1WalletAddSignerFinalizeRecord.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAddSignerService.d.ts

@@ -1,3 +1,4 @@
+import { type D1WalletAddSignerFinalizeSideEffectStore } from './d1WalletAddSignerFinalizeRecord';
 import type { WalletAddSignerStartSuccess } from '../../../../core/registrationContracts';
 import type { CloudflareD1Ed25519YaoLifecycleDecisionStoreV1 } from '../ed25519Yao/d1Ed25519YaoLifecycleDecisionStore';
 import type { WalletAddSignerFinalizeRequest, WalletAddSignerFinalizeResponse, WalletAddSignerEcdsaActivationRequest, WalletAddSignerEcdsaActivationResponse, WalletAddSignerEcdsaDerivationRespondRequest, WalletAddSignerEcdsaDerivationRespondResponse, WalletAddSignerStartRequest, WalletAddSignerStartResponse } from '../../../../core/registrationContracts';
@@ -56,17 +57,7 @@ type D1WalletAddSignerStartTerminalV1 = {
 };
 export type D1WalletAddSignerStartSideEffectStore = RouterAbEd25519YaoRegistrationSideEffectStoreV1<D1WalletAddSignerStartTerminalV1, D1WalletAddSignerStartPreparedV1>;
 export type D1WalletAddSignerStartSideEffectRecord = RouterAbEd25519YaoRegistrationSideEffectRecordV1<D1WalletAddSignerStartTerminalV1, D1WalletAddSignerStartPreparedV1>;
-export type D1WalletAddSignerFinalizePreparedV1 = {
-    readonly kind: 'd1_wallet_add_signer_finalize_ed25519_prepared_v1';
-    readonly finalizingAtMs: number;
-} | {
-    readonly kind: 'd1_wallet_add_signer_finalize_ecdsa_prepared_v1';
-    readonly signerWriteAtMs: number;
-};
-export type D1WalletAddSignerFinalizeSideEffectStore = RouterAbEd25519YaoRegistrationSideEffectStoreV1<WalletAddSignerFinalizeResponse, D1WalletAddSignerFinalizePreparedV1>;
-export type D1WalletAddSignerFinalizeSideEffectRecord = RouterAbEd25519YaoRegistrationSideEffectRecordV1<WalletAddSignerFinalizeResponse, D1WalletAddSignerFinalizePreparedV1>;
 export declare function parseD1WalletAddSignerStartSideEffectRecord(raw: unknown): D1WalletAddSignerStartSideEffectRecord | null;
-export declare function parseD1WalletAddSignerFinalizeSideEffectRecord(raw: unknown): D1WalletAddSignerFinalizeSideEffectRecord | null;
 export declare class CloudflareD1WalletAddSignerService {
     private readonly getRegistrationCeremonyIntentStore;
     private readonly getEd25519YaoProductRegistration;

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthMethodService.d.ts

@@ -11,7 +11,7 @@ import { EMAIL_OTP_CHANNEL } from '../../../../../../shared-ts/src/utils/emailOt
 import { CloudflareD1EmailOtpChallengeVerifier } from '../emailOtp/d1EmailOtpChallengeVerifier';
 import type { CloudflareD1EmailOtpRegistrationEnrollmentFinalizer } from '../emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer';
 import { CloudflareD1RegistrationCeremonyIntentStore } from '../registration/d1RegistrationCeremonyStore';
-import type { CloudflareD1GoogleEmailOtpRegistrationAttemptStore } from '../emailOtp/d1GoogleEmailOtpRegistrationAttemptStore';
+import type { GoogleEmailOtpRegistrationAttemptStore } from '../emailOtp/d1GoogleEmailOtpRegistrationAttemptStore';
 import { type D1FreshRevokeWebAuthnVerifierV1, type D1AddAuthMethodExistingAuthResolution, type D1AddSignerExistingAuthResolution } from './d1WalletAuthMethodBoundary';
 import type { CloudflareD1WebAuthnStore } from '../webauthn/d1WebAuthnStore';
 import type { WalletEd25519SignerRecord } from '../../../../core/WalletStore';
@@ -116,7 +116,7 @@ export declare class CloudflareD1WalletAuthMethodService {
         readonly emailOtpEnrollmentFinalizer: CloudflareD1EmailOtpRegistrationEnrollmentFinalizer;
         readonly getRegistrationCeremonyIntentStore: RegistrationCeremonyStoreProvider;
         readonly getWalletAuthMethodStore: WalletAuthMethodStoreProvider;
-        readonly googleEmailOtpRegistrationAttempts: CloudflareD1GoogleEmailOtpRegistrationAttemptStore;
+        readonly googleEmailOtpRegistrationAttempts: GoogleEmailOtpRegistrationAttemptStore;
         readonly passkeyCustodyEnvelopes: CloudflareD1PasskeyCustodyEnvelopeStore;
         readonly sha256Bytes: Sha256Bytes;
         readonly webAuthnStore: CloudflareD1WebAuthnStore;

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthorityStore.d.ts

@@ -101,8 +101,6 @@ export declare class WalletAuthorityCommitConflictError extends Error {
 export declare class D1WalletAuthorityStore {
     private readonly database;
     private readonly scope;
-    private readonly ensureSchemaOnUse;
-    private schemaReady;
     constructor(input: {
         readonly database: D1DatabaseLike;
         readonly scope?: D1WalletAuthorityStoreScope;
@@ -110,9 +108,7 @@ export declare class D1WalletAuthorityStore {
         readonly orgId?: string;
         readonly projectId?: string;
         readonly envId?: string;
-        readonly ensureSchema?: boolean;
     });
-    private ensureSchema;
     /**
      * Commits an added signer: its signer records, the authority extended with
      * its activation, and every live Wallet Session of that authority promoted to

package/dist/types/wallet-server/src/router/cloudflare/d1/webauthn/d1WebAuthnAuthService.d.ts

@@ -1,3 +1,4 @@
+import { type WalletLifecycleRoutingPublisher } from '../../../../authorization/lifecycleRouting';
 import { type WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
 import type { RouterApiWebAuthnService } from '../../../framework/authServicePort';
 import { CloudflareD1WebAuthnStore } from './d1WebAuthnStore';
@@ -23,10 +24,12 @@ type VerifyWebAuthnLoginResult = Awaited<ReturnType<RouterApiWebAuthnService['ve
 type VerifyWebAuthnSyncAccountInput = Parameters<RouterApiWebAuthnService['verifyWebAuthnSyncAccount']>[0];
 type VerifyWebAuthnSyncAccountResult = Awaited<ReturnType<RouterApiWebAuthnService['verifyWebAuthnSyncAccount']>>;
 export declare class CloudflareD1WebAuthnAuthService {
+    private readonly lifecycleRouting;
     private readonly webAuthnStore;
     private readonly walletManifestSource;
     private readonly walletAuthMethodStore;
     constructor(input: {
+        readonly lifecycleRouting?: WalletLifecycleRoutingPublisher;
         readonly webAuthnStore: CloudflareD1WebAuthnStore;
         readonly walletManifestSource: D1WebAuthnWalletManifestSource;
         readonly walletAuthMethodStore: D1WalletAuthMethodStore;

package/dist/types/wallet-server/src/router/cloudflare/d1/webauthn/d1WebAuthnRecords.d.ts

@@ -6,41 +6,16 @@ import { type ActiveWalletAuthMethodRecordV2 } from '../../../../../../shared-ts
 import { type RecoveryCodeReservationId } from '../../../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation';
 import { type WebAuthnAuthenticatorDeviceInfo } from '../../../../../../shared-ts/src/utils/webauthnDeviceInfo';
 import type { WebAuthnCredentialBindingRecord as CoreWebAuthnCredentialBindingRecord } from '../../../../core/WebAuthnCredentialBindingStore';
-export type D1AuthenticatorRow = {
-    readonly credential_id_b64u?: unknown;
-    readonly credential_public_key_b64u?: unknown;
-    readonly counter?: unknown;
-    readonly created_at_ms?: unknown;
-    readonly updated_at_ms?: unknown;
-    readonly device_info_json?: unknown;
-};
+import type { D1WebAuthnAuthenticatorRow } from '../../../../core/WebAuthnAuthenticatorStore';
+import type { WebAuthnLoginChallengeRecord as CoreWebAuthnLoginChallengeRecord } from '../../../../core/WebAuthnLoginChallengeStore';
+import type { WebAuthnSyncChallengeRecord as CoreWebAuthnSyncChallengeRecord } from '../../../../core/WebAuthnSyncChallengeStore';
+import type { ResolvedEd25519WalletBinding } from '../../../../core/authService/webauthnWalletBinding';
+export type D1AuthenticatorRow = D1WebAuthnAuthenticatorRow;
 export type D1RecordJsonRow = {
     readonly record_json?: unknown;
 };
 export type WebAuthnCredentialBindingRecord = CoreWebAuthnCredentialBindingRecord;
-export type WebAuthnSyncWalletBinding = {
-    readonly walletId: string;
-    readonly nearAccountId: string;
-    readonly nearEd25519SigningKeyId: string;
-    readonly rpId: string;
-    readonly credentialIdB64u: string;
-    readonly signerSlot: number;
-};
-export type NearPublicKeyAuthBinding = {
-    readonly kind: 'passkey';
-    readonly rpId: WebAuthnRpId;
-    readonly credentialIdB64u: string;
-};
-export type NearPublicKeyRecord = {
-    readonly publicKey: string;
-    readonly kind: 'threshold' | 'local' | 'backup' | 'ephemeral';
-    readonly signerSlot?: number;
-    readonly authBinding?: NearPublicKeyAuthBinding;
-    readonly credentialIdB64u?: never;
-    readonly rpId?: never;
-    readonly createdAtMs?: number;
-    readonly updatedAtMs?: number;
-};
+export type WebAuthnSyncWalletBinding = Readonly<ResolvedEd25519WalletBinding>;
 export type WebAuthnAuthenticatorRecord = {
     readonly credentialIdB64u: string;
     readonly credentialPublicKeyB64u: string;
@@ -50,24 +25,8 @@ export type WebAuthnAuthenticatorRecord = {
     readonly deviceInfo: WebAuthnAuthenticatorDeviceInfo;
 };
 export declare function parseWebAuthnAuthenticatorRowDeviceInfo(raw: unknown): WebAuthnAuthenticatorDeviceInfo;
-export type WebAuthnLoginChallengeRecord = {
-    readonly version: 'webauthn_login_challenge_v1';
-    readonly challengeId: string;
-    readonly userId: string;
-    readonly rpId: string;
-    readonly challengeB64u: string;
-    readonly createdAtMs: number;
-    readonly expiresAtMs: number;
-};
-export type WebAuthnSyncChallengeRecord = {
-    readonly version: 'webauthn_sync_challenge_v1';
-    readonly challengeId: string;
-    readonly rpId: string;
-    readonly expectedUserId?: string;
-    readonly challengeB64u: string;
-    readonly createdAtMs: number;
-    readonly expiresAtMs: number;
-};
+export type WebAuthnLoginChallengeRecord = Readonly<CoreWebAuthnLoginChallengeRecord>;
+export type WebAuthnSyncChallengeRecord = Readonly<CoreWebAuthnSyncChallengeRecord>;
 /**
  * The exact continuity snapshot selected by prepare. The snapshot is stored
  * inside the one-shot challenge so finalization cannot silently switch to a
@@ -127,5 +86,4 @@ export declare function buildWebAuthnRecoveryContinuityAnchorRecord(input: {
 export declare function parseWebAuthnAuthenticator(row: D1AuthenticatorRow | null): WebAuthnAuthenticatorRecord | null;
 export declare function parseWebAuthnBinding(row: D1RecordJsonRow): WebAuthnCredentialBindingRecord | null;
 export declare function webAuthnSyncWalletBindingFromCredentialBinding(binding: WebAuthnCredentialBindingRecord): WebAuthnSyncWalletBinding | null;
-export declare function parseNearPublicKey(row: D1RecordJsonRow): NearPublicKeyRecord | null;
 //# sourceMappingURL=d1WebAuthnRecords.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/webauthn/d1WebAuthnStore.d.ts

@@ -1,8 +1,23 @@
+import type { WebAuthnSyncChallengeStore } from '../../../../core/WebAuthnSyncChallengeStore';
+import { type PasskeyCredentialClaims } from '../../../../core/passkeyCredentialClaims';
 import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
 import { type D1TenantScope } from '../../../../core/d1TenantStore';
 import { type WebAuthnCredentialBindingRecord } from '../../../../core/WebAuthnCredentialBindingStore';
 import { type D1AuthenticatorRow, type WebAuthnAuthenticatorRecord, type WebAuthnRecoveryRegistrationChallengeRecord, type WebAuthnLoginChallengeRecord, type WebAuthnSyncChallengeRecord } from './d1WebAuthnRecords';
-type WebAuthnChallengeKind = 'login' | 'sync' | 'recovery_registration';
+type WebAuthnChallengeWrite = {
+    readonly challengeId: string;
+    readonly createdAtMs: number;
+    readonly expiresAtMs: number;
+} & ({
+    readonly challengeKind: 'login';
+    readonly record: WebAuthnLoginChallengeRecord;
+} | {
+    readonly challengeKind: 'sync';
+    readonly record: WebAuthnSyncChallengeRecord;
+} | {
+    readonly challengeKind: 'recovery_registration';
+    readonly record: WebAuthnRecoveryRegistrationChallengeRecord;
+});
 export type D1WebAuthnStoreScope = D1TenantScope;
 type AuthenticatorStatementInput = {
     readonly database: D1DatabaseLike;
@@ -16,24 +31,22 @@ export declare function prepareD1WebAuthnAuthenticatorPutStatement(input: Authen
  * existing authenticator's public key. */
 export declare function prepareD1WebAuthnAuthenticatorInsertStatement(input: AuthenticatorStatementInput): D1PreparedStatementLike;
 export declare class CloudflareD1WebAuthnStore {
+    private readonly syncChallenges;
     private readonly database;
     private readonly scope;
+    private readonly credentialClaims;
     constructor(input: {
+        readonly syncChallenges?: WebAuthnSyncChallengeStore;
+        readonly credentialClaims?: PasskeyCredentialClaims;
         readonly database: D1DatabaseLike;
         readonly namespace: string;
         readonly orgId: string;
         readonly projectId: string;
         readonly envId: string;
     });
-    writeChallenge(input: {
-        readonly challengeId: string;
-        readonly challengeKind: WebAuthnChallengeKind;
-        readonly record: WebAuthnLoginChallengeRecord | WebAuthnSyncChallengeRecord | WebAuthnRecoveryRegistrationChallengeRecord;
-        readonly createdAtMs: number;
-        readonly expiresAtMs: number;
-    }): Promise<void>;
+    writeChallenge(input: WebAuthnChallengeWrite): ReturnType<WebAuthnSyncChallengeStore['create']>;
     consumeLoginChallenge(challengeId: string): Promise<WebAuthnLoginChallengeRecord | null>;
-    consumeSyncChallenge(challengeId: string): Promise<WebAuthnSyncChallengeRecord | null>;
+    consumeSyncChallenge(challengeId: string, credentialIdB64u: string): ReturnType<WebAuthnSyncChallengeStore['consume']>;
     readRecoveryRegistrationChallenge(challengeId: string, nowMs: number): Promise<WebAuthnRecoveryRegistrationChallengeRecord | null>;
     /** Delete is paired with a CAS guard in the recovery commit batch. */
     prepareRecoveryRegistrationChallengeDeleteStatement(input: {
@@ -53,7 +66,7 @@ export declare class CloudflareD1WebAuthnStore {
         readonly userId: string;
         readonly record: WebAuthnAuthenticatorRecord;
     }): D1PreparedStatementLike;
-    prepareCredentialBindingInsertStatement(record: WebAuthnCredentialBindingRecord): D1PreparedStatementLike;
+    prepareCredentialBindingInsertStatement(record: WebAuthnCredentialBindingRecord): Promise<D1PreparedStatementLike>;
     updateAuthenticatorCounter(input: {
         readonly userId: string;
         readonly credentialIdB64u: string;

package/dist/types/wallet-server/src/router/cloudflare/d1/webauthn/d1WebAuthnStore.typecheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=d1WebAuthnStore.typecheck.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/runtime/cloudflare.types.d.ts

@@ -1,4 +1,3 @@
-import type { CloudflareDurableObjectNamespaceLike } from '../../../core/types';
 import type { D1DatabaseLike } from '../../../storage/tenantRoute';
 export type CfEnv = object;
 export interface RouterApiCloudflareSignerWorkerEnv {
@@ -15,7 +14,6 @@ export interface RouterApiCloudflareSignerWorkerEnv {
 }
 export interface SeamsD1SignerTenantStorageWorkerEnv {
     SIGNER_DB: D1DatabaseLike;
-    THRESHOLD_STORE: CloudflareDurableObjectNamespaceLike;
 }
 export interface CfExecutionContext {
     waitUntil(promise: Promise<unknown>): void;

package/dist/types/wallet-server/src/router/cloudflare/runtime/walletConsoleOps.d.ts

@@ -1,20 +1,17 @@
 import type { TenantRootIdentityFieldV1, TenantRootIdentityWireV1 } from '../../../../../shared-ts/src/tenant-root';
-import type { RouterApiCredentialScope } from '../../framework/apiCredentialPorts';
+import type { RouterApiCredentialScope, RouterApiKeyAuthRequest, RouterApiProjectEnvironment, RouterApiPublishableKeyAuthRequest, RouterApiUsageMeterEvent } from '../../framework/apiCredentialPorts';
+import type { ReadonlyExclusiveUnion } from '../../../../../shared-ts/src/utils/variant';
 export declare const WALLET_CONSOLE_OPS_BASE_PATH_V1 = "/internal/wallet-console/v1";
 export declare const WALLET_CONSOLE_SERVICE_ORIGIN_V1 = "https://wallet-console.internal";
 export declare const WALLET_CONSOLE_OP_PATHS_V1: {
     readonly secretKeyAuth: "/internal/wallet-console/v1/secret-key-auth";
     readonly publishableKeyAuth: "/internal/wallet-console/v1/publishable-key-auth";
     readonly usageEvents: "/internal/wallet-console/v1/usage-events";
+    readonly walletProjection: "/internal/wallet-console/v1/wallet-projections";
     readonly projectEnvironments: "/internal/wallet-console/v1/project-environments";
     readonly tenantRootActiveLineage: "/internal/wallet-console/v1/tenant-root/active-lineage";
 };
-export interface WalletConsoleSecretKeyAuthRequestV1 {
-    readonly secret: string;
-    readonly endpoint: string;
-    readonly requiredScopes: RouterApiCredentialScope[];
-    readonly sourceIp?: string;
-    readonly environmentId?: string;
+export interface WalletConsoleSecretKeyAuthRequestV1 extends Readonly<RouterApiKeyAuthRequest> {
 }
 export interface WalletConsolePrincipalV1 {
     readonly apiKeyId: string;
@@ -33,23 +30,10 @@ export type WalletConsoleSecretKeyAuthResponseV1 = {
     readonly code: string;
     readonly message: string;
 };
-export interface WalletConsolePublishableKeyAuthRequestV1 {
-    readonly secret: string;
-    readonly origin: string;
-    readonly environmentId: string;
+export interface WalletConsolePublishableKeyAuthRequestV1 extends Readonly<RouterApiPublishableKeyAuthRequest> {
 }
 export type WalletConsolePublishableKeyAuthResponseV1 = WalletConsoleSecretKeyAuthResponseV1;
-export interface WalletConsoleUsageEventV1 {
-    readonly orgId: string;
-    readonly environmentId: string;
-    readonly apiKeyId: string;
-    readonly endpoint: string;
-    readonly walletId: string;
-    readonly action: 'wallet_created';
-    readonly succeeded: boolean;
-    readonly occurredAt?: string;
-    /** Producer-owned idempotency key; replays with the same id must not double-count. */
-    readonly sourceEventId?: string;
+export interface WalletConsoleUsageEventV1 extends Readonly<RouterApiUsageMeterEvent> {
 }
 export interface WalletConsoleUsageEventsResponseV1 {
     readonly ok: boolean;
@@ -68,12 +52,7 @@ export interface WalletConsoleProjectEnvironmentsRequestV1 {
         readonly status?: string;
     };
 }
-export interface WalletConsoleProjectEnvironmentV1 {
-    readonly id: string;
-    readonly projectId: string;
-    readonly key: string;
-    readonly signingRootVersion: string;
-    readonly status?: string;
+export interface WalletConsoleProjectEnvironmentV1 extends Readonly<RouterApiProjectEnvironment> {
 }
 export interface WalletConsoleProjectEnvironmentsResponseV1 {
     readonly ok: boolean;
@@ -87,19 +66,15 @@ export interface WalletConsoleTenantRootActiveLineageV1 {
     readonly identityDigestB64u: string;
     readonly custodyLineageB64u: string;
 }
-export type WalletConsoleTenantRootActiveLineageResponseV1 = {
+export type WalletConsoleTenantRootActiveLineageResponseV1 = ReadonlyExclusiveUnion<{
     readonly ok: true;
     readonly identityDigestB64u: string;
     readonly custodyLineageB64u: string;
-    readonly code?: never;
-    readonly message?: never;
 } | {
     readonly ok: false;
     readonly code: 'invalid_body' | 'tenant_root_active_lineage_not_found';
     readonly message: string;
-    readonly identityDigestB64u?: never;
-    readonly custodyLineageB64u?: never;
-};
+}>;
 export type WalletConsoleDecodeResult<T, E> = {
     readonly ok: true;
     readonly value: T;

package/dist/types/wallet-server/src/router/cloudflare/runtime/walletConsoleOpsClient.d.ts

@@ -1,3 +1,4 @@
+import type { RouterApiWalletProjectionAdapter } from '../../framework/routerApi';
 import type { RouterApiKeyAuthAdapter, RouterApiPublishableKeyAuthAdapter, RouterApiProjectEnvironmentResolver, RouterApiUsageMeterAdapter } from '../../framework/apiCredentialPorts';
 import { type WalletConsoleTenantRootActiveLineageResolverV1 } from './walletConsoleOps';
 /** The shape of a Cloudflare service binding (`Fetcher`). */
@@ -8,6 +9,7 @@ export interface WalletConsoleOpsClient {
     readonly apiKeyAuth: RouterApiKeyAuthAdapter;
     readonly publishableKeyAuth: RouterApiPublishableKeyAuthAdapter;
     readonly usageMeter: RouterApiUsageMeterAdapter;
+    readonly walletProjection: RouterApiWalletProjectionAdapter;
     readonly projectEnvironments: RouterApiProjectEnvironmentResolver;
     readonly tenantRootActiveLineage: WalletConsoleTenantRootActiveLineageResolverV1;
 }

package/dist/types/wallet-server/src/router/cloudflare/runtime/walletGateway.d.ts

@@ -17,7 +17,7 @@ export declare function walletConsoleSignedDelegateRouteDefinitionV1(routePath:
 export declare function walletConsoleSponsoredEvmCallRouteDefinitionV1(routePath?: string): RouteDefinition;
 export declare function walletConsoleRelayRouteDefinitionsV1(): readonly RouteDefinition[];
 export declare function createWalletConsoleRelayProxyExtensionV1(binding: WalletConsoleServiceBinding): RouterApiRouteExtension;
-type WalletGatewayManagedRouterOption = 'apiKeyAuth' | 'publishableKeyAuth' | 'apiKeyUsageMeter' | 'orgProjectEnv' | 'routerAbNormalSigningAdmission' | 'routeExtensions';
+type WalletGatewayManagedRouterOption = 'apiKeyAuth' | 'publishableKeyAuth' | 'apiKeyUsageMeter' | 'walletProjection' | 'orgProjectEnv' | 'routerAbNormalSigningAdmission' | 'routeExtensions';
 export interface CloudflareWalletGatewayRouterOptionsV1 {
     readonly service: Parameters<typeof createCloudflareRouter>[0];
     readonly walletConsole: WalletConsoleServiceBinding;

package/dist/types/wallet-server/src/router/cloudflare/runtime/walletRuntimeOps.d.ts

@@ -31,10 +31,13 @@ export interface WalletRuntimeWalletIdentityRequest {
     readonly wallets: readonly {
         readonly walletId: string;
         readonly projectId: string;
+        readonly envId: string;
     }[];
 }
 export interface WalletRuntimeWalletIdentity {
     readonly walletId: string;
+    readonly projectId: string;
+    readonly envId: string;
     readonly nearAccountId: string;
     readonly evmAddress: `0x${string}`;
 }

package/dist/types/wallet-server/src/router/cloudflare-adaptor.d.ts

@@ -46,7 +46,6 @@ export { extractBearerCredential, extractRouterApiEnvironmentId, resolveSourceIp
 export { createCloudflareRouter } from './cloudflare/runtime/createCloudflareRouter';
 export type { SelfHostedCloudflareSigningWorkerFactoryInput } from './cloudflare/runtime/createSelfHostedCloudflareSigningWorker';
 export { createSelfHostedCloudflareSigningRouter, createSelfHostedCloudflareSigningWorker, } from './cloudflare/runtime/createSelfHostedCloudflareSigningWorker';
-export { ThresholdStoreDurableObject } from './cloudflare/durableObjects/thresholdStore';
 export { CloudflareDurableObjectVersionedJsonRecordStore, CloudflareVersionedJsonRecordStoreError, createCloudflareDurableObjectVersionedJsonRecordStore, } from './cloudflare/durableObjects/versionedJsonRecordStore';
 export type { CloudflareVersionedJsonRecordStoreOptions } from './cloudflare/durableObjects/versionedJsonRecordStore';
 export type { VersionedJsonObject, VersionedJsonRecordPutResult, VersionedJsonRecordReadResult, VersionedJsonValue, } from './framework/versionedJsonRecordStore';

package/dist/types/wallet-server/src/router/domains/ecdsa/thresholdEcdsaRequestValidation.d.ts

@@ -1,5 +1,4 @@
-import { type RouterAbEcdsaOperationStepUpPreparationV1Wire } from '../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
-import { type RouterAbNormalSigningAuthorizationWire } from '../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
+import { type RouterAbEcdsaDerivationPoolFillAuthorization } from '../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
 import type { RouterAbEcdsaDerivationPoolFillInitRequest, RouterAbEcdsaDerivationPoolFillStepRequest } from '../../../core/types';
 type ThresholdEcdsaRouteErrorBody = {
     ok: false;
@@ -13,19 +12,8 @@ type ThresholdEcdsaRouteParseResult<T> = {
     ok: false;
     body: ThresholdEcdsaRouteErrorBody;
 };
-type RouterAbEcdsaPoolFillAuthorization = {
-    readonly authorization: Extract<RouterAbNormalSigningAuthorizationWire, {
-        readonly kind: 'reusable_wallet_session';
-    }>;
-    readonly operation?: never;
-} | {
-    readonly authorization: Extract<RouterAbNormalSigningAuthorizationWire, {
-        readonly kind: 'operation_step_up';
-    }>;
-    readonly operation: RouterAbEcdsaOperationStepUpPreparationV1Wire;
-};
-export type RouterAbEcdsaPoolFillInitRouteRequest = RouterAbEcdsaDerivationPoolFillInitRequest & RouterAbEcdsaPoolFillAuthorization;
-export type RouterAbEcdsaPoolFillStepRouteRequest = RouterAbEcdsaDerivationPoolFillStepRequest & RouterAbEcdsaPoolFillAuthorization;
+export type RouterAbEcdsaPoolFillInitRouteRequest = RouterAbEcdsaDerivationPoolFillInitRequest & RouterAbEcdsaDerivationPoolFillAuthorization;
+export type RouterAbEcdsaPoolFillStepRouteRequest = RouterAbEcdsaDerivationPoolFillStepRequest & RouterAbEcdsaDerivationPoolFillAuthorization;
 export declare function parseRouterAbEcdsaDerivationPoolFillInitRouteRequest(raw: unknown): ThresholdEcdsaRouteParseResult<RouterAbEcdsaPoolFillInitRouteRequest>;
 export declare function parseRouterAbEcdsaDerivationPoolFillStepRouteRequest(raw: unknown): ThresholdEcdsaRouteParseResult<RouterAbEcdsaPoolFillStepRouteRequest>;
 export {};

package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.d.ts

@@ -8,7 +8,7 @@ import { InMemoryRouterAbEd25519YaoRegistrationStateV1, type RouterAbEd25519YaoR
 import { InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationStateV1, type RouterAbEd25519YaoVerifiedActivationIntentV1, type RouterAbEd25519YaoRegistrationIntentBindingResult } from '../registration/routerAbEd25519YaoRegistrationIntentAuthorization';
 import { type RouterApiModule } from '../../../framework/modules';
 import type { MpcWalletSigningQuotaId, WalletSessionAuthorizationId, WalletSessionId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
-import type { ThresholdEd25519SessionId } from '../../../../../../shared-ts/src/utils/domainIds';
+import { type ThresholdEd25519SessionId } from '../../../../../../shared-ts/src/utils/domainIds';
 import { type RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
 import type { WalletAuthAuthority } from '../../../../../../shared-ts/src/utils/walletAuthAuthority';
 import type { WalletSessionOperationCredentialV1 } from '../../../../../../shared-ts/src/device-linking';

package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitioning.d.ts

@@ -16,8 +16,8 @@ export type RouterAbEd25519YaoProductRegistrationSharedStateV1 = {
     readonly recoveryCapabilities: ReadonlyMap<string, RecoveryCapabilityState>;
     readonly recoveryIdentityCapabilities: ReadonlyMap<string, string>;
     readonly recoverySessions: ReadonlyMap<string, string>;
-    readonly exportAuthorizationNonces: ReadonlySet<string>;
-    readonly exportAuthorizationUncertain: ReadonlySet<string>;
+    readonly exportAuthorizationNonceOwners: ReadonlyMap<string, string>;
+    readonly exportAuthorizationUncertainOwners: ReadonlyMap<string, string>;
 };
 export type RouterAbEd25519YaoProductRegistrationCeremonyStateV1 = {
     readonly kind: 'router_ab_ed25519_yao_product_registration_ceremony_state_v1';

package/dist/types/wallet-server/src/router/domains/ed25519Yao/export/routerAbEd25519YaoExport.d.ts

@@ -225,8 +225,8 @@ type ExportCompletedState = ExportAuthorizationContext & {
 type ExportLifecycleState = ExportAuthorizedState | ExportAdmittingState | ExportAdmissionFailedState | ExportAdmittedState | ExportExecutingState | ExportExecutionFailedState | ExportCompletedState;
 export declare class InMemoryRouterAbEd25519YaoExportStateV1 {
     readonly exports: Map<string, ExportLifecycleState>;
-    readonly authorizationNonces: Set<string>;
-    readonly authorizationUncertain: Set<string>;
+    readonly authorizationNonceOwners: Map<string, string>;
+    readonly authorizationUncertainOwners: Map<string, string>;
 }
 export declare class InMemoryRouterAbEd25519YaoExportService implements RouterAbEd25519YaoExportService {
     private readonly backend;

package/dist/types/wallet-server/src/router/domains/ed25519Yao/export/routerAbEd25519YaoExport.typecheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=routerAbEd25519YaoExport.typecheck.d.ts.map

package/dist/types/wallet-server/src/router/domains/ed25519Yao/export/routerAbEd25519YaoExportRequestScopedCloudflare.d.ts

@@ -1,7 +1,9 @@
+import { type WalletLifecycleRoutingPublisher } from '../../../../authorization/lifecycleRouting';
 import { type RouterAbEd25519YaoExportAuthorizationAdapter, type RouterAbEd25519YaoExportBackend } from './routerAbEd25519YaoExport';
 import type { RouterAbEd25519YaoActiveCapabilityResolverV1 } from '../recovery/routerAbEd25519YaoRecovery';
 import type { RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1 } from '../capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore';
 export type RouterAbEd25519YaoExportRequestScopedCloudflareInputV1 = {
+    readonly lifecycleRouting?: WalletLifecycleRoutingPublisher;
     readonly request: Request;
     readonly store: RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1;
     readonly backend: RouterAbEd25519YaoExportBackend;

package/dist/types/wallet-server/src/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryRequestScopedCloudflare.d.ts

@@ -1,7 +1,9 @@
+import { type WalletLifecycleRoutingPublisher } from '../../../../authorization/lifecycleRouting';
 import { type RouterAbEd25519YaoCapabilityPersistenceV1, type RouterAbEd25519YaoRecoveryAuthorizationAdapter, type RouterAbEd25519YaoRecoveryBackend, type RouterAbEd25519YaoActiveCapabilityResolverV1, type WarmBootstrapLinkedEd25519AuthorityReaderV1 } from './routerAbEd25519YaoRecovery';
 export type { WarmBootstrapLinkedEd25519AuthorityReaderV1 } from './routerAbEd25519YaoRecovery';
 import type { RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1 } from '../capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore';
 export type RouterAbEd25519YaoRecoveryRequestScopedCloudflareInputV1 = {
+    readonly lifecycleRouting?: WalletLifecycleRoutingPublisher;
     readonly request: Request;
     readonly store: RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1;
     readonly backend: RouterAbEd25519YaoRecoveryBackend;

package/dist/types/wallet-server/src/router/domains/ed25519Yao/session/routerAbEd25519YaoWalletSession.d.ts

@@ -5,9 +5,11 @@ import type { WebAuthnAuthenticationCredential } from '../../../../core/types';
 import { thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from '../../../../core/ThresholdService/validation';
 import type { WalletRegistrationEd25519YaoBootstrapSession } from '../../../../../../shared-ts/src/utils/registrationContracts';
 import type { RouterAbEd25519YaoActiveCapabilityDescriptorV1 } from '../recovery/routerAbEd25519YaoRecovery';
-import type { MpcWalletSigningQuotaId, WalletSessionMintId, WalletSessionAuthorizationId, WalletSessionId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
+import type { MpcWalletSigningQuotaId, WalletSessionAuthorizationId, WalletSessionId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
+import type { WalletSessionAlreadyCommittedResponseV1, WalletSessionRejectionV1 } from '../../../../../../shared-ts/src/authorization/walletSessionIssuance';
 import type { WalletSessionOperationCredentialV1 } from '../../../../../../shared-ts/src/device-linking';
-import type { ThresholdEd25519SessionId, WalletAuthMethodId, WalletAuthorityId, WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
+import type { ThresholdEd25519SessionId } from '../../../../../../shared-ts/src/utils/domainIds';
+import type { RouterAbEd25519OperationStepUpMaterialRecoveryRequest, RouterAbEd25519OperationStepUpMaterialRecoveryResponse } from '../../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
 import type { VerifiedOwnerProof } from '../../../../authorization/factorEvidence';
 export type RouterAbEd25519YaoSessionPolicyV1 = {
     readonly version: 'threshold_session_v1';
@@ -35,23 +37,8 @@ export type RouterAbEd25519YaoSessionRouteCommandV1 = {
     };
     readonly sessionKind: 'opaque';
 };
-type RouterAbEd25519YaoOperationStepUpMaterialRecoveryRequest = {
-    readonly kind: 'not_requested';
-} | {
-    readonly kind: 'email_otp_factor_release_v1';
-    readonly workerEphemeralPublicKey65B64u: string;
-};
-export type RouterAbEd25519YaoOperationStepUpMaterialRecoveryResponse = {
-    readonly kind: 'not_requested';
-} | {
-    readonly kind: 'email_otp_factor_release_v1';
-    readonly challengeId: string;
-    readonly enrollmentId: string;
-    readonly enrollmentSealKeyVersion: string;
-    readonly serverEphemeralPublicKey65B64u: string;
-    readonly nonce12B64u: string;
-    readonly ciphertextB64u: string;
-};
+type RouterAbEd25519YaoOperationStepUpMaterialRecoveryRequest = Readonly<RouterAbEd25519OperationStepUpMaterialRecoveryRequest>;
+export type RouterAbEd25519YaoOperationStepUpMaterialRecoveryResponse = Readonly<RouterAbEd25519OperationStepUpMaterialRecoveryResponse>;
 type RouterAbEd25519YaoOperationStepUpGrantCommandBase = {
     readonly kind: 'router_ab_ed25519_yao_operation_step_up_grant_v1';
     readonly normalSigningRequest: Record<string, unknown>;
@@ -93,35 +80,7 @@ export type RouterAbEd25519YaoBudgetRefreshRequestV1 = {
     readonly sessionPolicy: RouterAbEd25519YaoSessionPolicyV1;
     readonly authorization: RouterAbEd25519YaoBudgetRefreshAuthorizationV1;
 };
-/**
- * The committed identity of one Wallet Session issuance attempt whose
- * credential is unreachable. It is credential-free by construction: a replay
- * reads a committed digest, and no digest reproduces plaintext.
- */
-type RouterAbEd25519YaoCommittedWalletSessionV1 = {
-    readonly kind: 'already_committed_wallet_session_v1';
-    readonly walletId: WalletId;
-    readonly authorityId: WalletAuthorityId;
-    readonly walletAuthMethodId: WalletAuthMethodId;
-    readonly mintId: WalletSessionMintId;
-    readonly authorizationId: WalletSessionAuthorizationId;
-    readonly walletSessionId: WalletSessionId;
-    readonly quotaId: MpcWalletSigningQuotaId;
-};
-export type RouterAbEd25519YaoAlreadyCommittedResponseV1 = {
-    readonly ok: false;
-    readonly code: 'already_committed';
-    readonly message: string;
-    readonly next: 'unlock_exact_method';
-    readonly committed: RouterAbEd25519YaoCommittedWalletSessionV1;
-};
-type RouterAbEd25519YaoWalletSessionRejectionV1 = {
-    readonly ok: false;
-    readonly code: string;
-    readonly message: string;
-    readonly next?: never;
-    readonly committed?: never;
-};
+export type RouterAbEd25519YaoAlreadyCommittedResponseV1 = WalletSessionAlreadyCommittedResponseV1;
 type RouterAbEd25519YaoBudgetRefreshSessionV1 = {
     readonly ok: true;
     readonly walletId: string;
@@ -145,7 +104,7 @@ export type RouterAbEd25519YaoBudgetRefreshResponseV1 = (RouterAbEd25519YaoBudge
 }) | (RouterAbEd25519YaoBudgetRefreshSessionV1 & {
     readonly sessionKind: 'already_committed_exact_wallet_session';
     readonly operationCredential?: never;
-}) | RouterAbEd25519YaoAlreadyCommittedResponseV1 | RouterAbEd25519YaoWalletSessionRejectionV1;
+}) | RouterAbEd25519YaoAlreadyCommittedResponseV1 | WalletSessionRejectionV1;
 type RouterAbEd25519YaoVerifiedWalletUnlockRequestBaseV1 = {
     readonly walletId: string;
     readonly signerSlot: number;
@@ -173,6 +132,6 @@ export type RouterAbEd25519YaoVerifiedWalletUnlockResponseV1 = {
     readonly ok: true;
     readonly session: WalletRegistrationEd25519YaoBootstrapSession;
     readonly capability: RouterAbEd25519YaoActiveCapabilityDescriptorV1;
-} | RouterAbEd25519YaoAlreadyCommittedResponseV1 | RouterAbEd25519YaoWalletSessionRejectionV1;
+} | RouterAbEd25519YaoAlreadyCommittedResponseV1 | WalletSessionRejectionV1;
 export {};
 //# sourceMappingURL=routerAbEd25519YaoWalletSession.d.ts.map