@seams/wallet-server 0.7.3 → 0.8.0

package/dist/types/wallet-server/src/core/keyMaterialBrands.d.ts

@@ -1,8 +1,4 @@
 import type { EcdsaThresholdKeyId } from '../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap';
-import { type Brand } from '../../../shared-ts/src/threshold/keyMaterialBrands';
 export type { EcdsaThresholdKeyId };
-export { formatEcdsaClientVerifyingShareB64uForWire, formatEcdsaDerivationKeyVersionForWire, formatEcdsaKeyHandleForWire, formatEcdsaRelayerKeyIdForWire, formatEcdsaThresholdKeyIdForWire, formatEd25519RelayerKeyIdForWire, formatSigningSessionSealKeyVersionForWire, parseEcdsaClientVerifyingShareB64u, parseEcdsaDerivationKeyVersion, parseEcdsaKeyHandle, parseEcdsaRelayerKeyId, parseEd25519RelayerKeyId, parseSigningSessionSealKeyVersion, type EcdsaClientVerifyingShareB64u, type EcdsaDerivationKeyVersion, type EcdsaKeyHandle, type EcdsaRelayerKeyId, type Ed25519RelayerKeyId, type SigningSessionSealKeyVersion, } from '../../../shared-ts/src/threshold/keyMaterialBrands';
-export type Ed25519ClientVerifyingShareB64u = Brand<string, 'Ed25519ClientVerifyingShareB64u'>;
-export declare function parseEcdsaThresholdKeyId(value: unknown): EcdsaThresholdKeyId;
-export declare function formatEd25519ClientVerifyingShareB64uForWire(value: Ed25519ClientVerifyingShareB64u): string;
+export { formatEcdsaKeyHandleForWire, formatSigningSessionSealKeyVersionForWire, parseEcdsaClientVerifyingShareB64u, parseEcdsaKeyHandle, parseEcdsaRelayerKeyId, parseSigningSessionSealKeyVersion, type EcdsaClientVerifyingShareB64u, type EcdsaKeyHandle, type EcdsaRelayerKeyId, type SigningSessionSealKeyVersion, } from '../../../shared-ts/src/threshold/keyMaterialBrands';
 //# sourceMappingURL=keyMaterialBrands.d.ts.map

package/dist/types/wallet-server/src/core/nearRelayerAccountProvisioning.d.ts

@@ -39,7 +39,6 @@ type PrepareSponsoredNearAccountCreationResultV1 = {
     readonly prepared: PreparedSponsoredNearAccountCreationV1;
 } | {
     readonly ok: false;
-    readonly error: string;
     readonly message: string;
 };
 /**

package/dist/types/wallet-server/src/core/passkeyCredentialClaims.d.ts

@@ -0,0 +1,9 @@
+export interface PasskeyCredentialClaims {
+    claim(input: {
+        readonly walletId: string;
+        readonly rpId: string;
+        readonly credentialIdB64u: string;
+    }): Promise<boolean>;
+}
+export declare function reservePasskeyCredential(claims: PasskeyCredentialClaims | undefined, input: Parameters<PasskeyCredentialClaims['claim']>[0]): Promise<void>;
+//# sourceMappingURL=passkeyCredentialClaims.d.ts.map

package/dist/types/wallet-server/src/core/routerAbSigning/RouterAbEcdsaPresignRuntime.d.ts

@@ -1,10 +1,8 @@
-import { coerceThresholdNodeRole } from '../ThresholdService/config';
 import { RouterAbEcdsaDerivationPoolFillHandlers } from '../ThresholdService/routerAb/ecdsaDerivationPoolFillHandlers';
 import { type RouterAbLinkedDeviceEcdsaExportShareHttpResult, type RouterAbEcdsaPresignSessionHttpResult } from '../ThresholdService/routerAb/ecdsaDerivationPresignBridge';
 import type { RouterAbEcdsaSigningWorkerExportShareBindingV1 } from '../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
 import type { RouterAbConfiguredSigningWorkerPrivateTransport } from './RouterAbNormalSigningRuntime';
 export type RouterAbEcdsaPresignRuntimeConfig = {
-    readonly nodeRole: ReturnType<typeof coerceThresholdNodeRole>;
     readonly participantIds: {
         readonly clientParticipantId: number;
         readonly relayerParticipantId: number;

package/dist/types/wallet-server/src/core/routerAbSigning/RouterAbNormalSigningRuntime.d.ts

@@ -17,7 +17,6 @@ export type RouterAbSigningWorkerPrivateTransport = ReadonlyExclusiveUnion<{
 export type RouterAbConfiguredSigningWorkerPrivateTransport = Extract<RouterAbSigningWorkerPrivateTransport, {
     readonly kind: 'configured';
 }>;
-export declare function requireRouterAbConfiguredSigningWorkerPrivateTransport(transport: RouterAbSigningWorkerPrivateTransport): RouterAbConfiguredSigningWorkerPrivateTransport;
 type RouterAbNormalSigningRuntimeConfig = {
     readonly policy: RouterAbNormalSigningServerPolicy;
     readonly signingWorkerTransport: RouterAbSigningWorkerPrivateTransport;
@@ -47,7 +46,6 @@ type RouterAbClampedSessionPolicy = {
     readonly ttlMs: number;
     readonly remainingUses: number;
 };
-export declare function parseRouterAbNormalSigningRuntimeConfig(config: Readonly<Record<string, unknown>>): RouterAbNormalSigningRuntimeConfig;
 export declare class RouterAbNormalSigningRuntime {
     private readonly walletSessionStore;
     private readonly ecdsaWalletSessionStore;

package/dist/types/wallet-server/src/core/threeRouteRegistrationContracts.d.ts

@@ -1,7 +1,5 @@
 import type { ActiveWalletAuthMethodRecordV2 } from '../../../shared-ts/src/utils/walletAuthMethodRecord';
-import type { CorrelationId } from '../../../shared-ts/src/utils/canonicalPrimitives';
-import type { RouterAbEcdsaVerifiedClientActivationFactsV1 } from '../../../shared-ts/src/utils/routerAbEcdsaDerivation';
-import type { WalletRegistrationEcdsaPreparePayload, WalletRegistrationFinalizeSuccess, WalletRegistrationStartRequest, WalletRegistrationAuthorityInput, WalletRegistrationStartResponse, WalletRegistrationFinalizeRequest, WalletRegistrationEcdsaActivationResponse, WalletRegistrationEcdsaWalletKey, WalletRegistrationEd25519YaoPublicResult, WalletRegistrationRouteDiagnostics } from './registrationContracts';
+import type { WalletRegistrationEcdsaPreparePayload, WalletRegistrationFinalizeSuccess, WalletRegistrationStartRequest, WalletRegistrationStartResponse, WalletRegistrationEcdsaActivationResponse, WalletRegistrationEcdsaWalletKey, WalletRegistrationEd25519YaoPublicResult, WalletRegistrationRouteDiagnostics } from './registrationContracts';
 import type { WalletRegistrationFinalizeAuthMethod } from '../../../shared-ts/src/utils/registrationContracts';
 import type { RegistrationEstablishedSessionProjectionV2, RegistrationEstablishedSessionResultV2 } from '../../../shared-ts/src/utils/registrationEstablishedSession';
 import type { WalletAuthMethodId, WalletId } from '../../../shared-ts/src/utils/domainIds';
@@ -50,8 +48,6 @@ type SetupEd25519Work = Extract<WalletRegistrationStartResponse, {
 }> extends {
     ed25519: infer T;
 } ? T : never;
-type ActivateIdempotencyKey = WalletRegistrationFinalizeRequest['idempotencyKey'];
-type FinalizeRequestBase = WalletRegistrationFinalizeRequest;
 type EcdsaFinalizeSuccess = Extract<WalletRegistrationFinalizeSuccess, {
     kind: 'evm_family_ecdsa';
 }>;
@@ -187,47 +183,6 @@ export type WalletRegistrationSetupResponseV2 = (WalletRegistrationSetupSuccessB
     kind: 'near_ed25519';
     ecdsa?: never;
 }) | WalletRegistrationRouteErrorV2;
-/**
- * Route 2 — authenticated respond.
- *
- * The request discriminates on the signer plan, exhaustively, because an
- * Ed25519-only ceremony has no ECDSA registration to send. A single object
- * type with a required `ecdsa` made that request impossible to construct.
- * The parser validates this discriminant against the plan the signed setup
- * and ceremony actually recorded, so a caller cannot pick an arm the ceremony
- * was not created for.
- */
-type WalletRegistrationRespondRequestBaseV2 = {
-    registrationCeremonyId: string;
-    signedSetup: SignedSetupPayloadB64u;
-};
-type WalletRegistrationRespondAuthorityProofV2 = {
-    webauthn_registration: Extract<WalletRegistrationAuthorityInput, {
-        kind: 'passkey';
-    }>['webauthnRegistration'];
-    emailOtpRegistrationProof?: never;
-} | {
-    emailOtpRegistrationProof: Extract<WalletRegistrationAuthorityInput, {
-        kind: 'email_otp';
-    }>['emailOtpRegistrationProof'];
-    webauthn_registration?: never;
-};
-export type RespondEcdsaRegistrationWorkV2 = {
-    kind: 'router_ab_ecdsa_registration_v1';
-    strictRegistration: unknown;
-    /** Canonical Router request digest produced by the client ceremony WASM. */
-    requestDigestB64u: string;
-};
-export type WalletRegistrationRespondRequestV2 = WalletRegistrationRespondAuthorityProofV2 & ((WalletRegistrationRespondRequestBaseV2 & {
-    kind: 'evm_family_ecdsa';
-    ecdsa: RespondEcdsaRegistrationWorkV2;
-}) | (WalletRegistrationRespondRequestBaseV2 & {
-    kind: 'near_ed25519_and_evm_family_ecdsa';
-    ecdsa: RespondEcdsaRegistrationWorkV2;
-}) | (WalletRegistrationRespondRequestBaseV2 & {
-    kind: 'near_ed25519';
-    ecdsa?: never;
-}));
 /**
  * What respond returns for the ceremony's signer plan.
  *
@@ -285,52 +240,6 @@ export type WalletRegistrationNearAdmissionResponseV2 = {
     readonly registrationCeremonyId: string;
     readonly ed25519: RespondEd25519DeferredWorkV2;
 } | WalletRegistrationRouteErrorV2;
-/**
- * Route 3 — activate-and-finalize; the operation row is the replay record.
- *
- * Two independent discriminants, because they vary independently: the signer
- * plan decides whether there is ECDSA activation to send, and the auth method
- * decides whether Email OTP enrollment is required. Enrollment is *not* an
- * ECDSA concern — an Ed25519-only wallet registered with Email OTP still
- * enrolls — so deriving those fields from the ECDSA work, as this type
- * previously did, mismodelled them.
- *
- * Passkey activation carrying enrollment fields fails to compile, and Email
- * OTP activation missing them fails to compile. Neither is optional, because
- * neither is genuinely optional at runtime.
- */
-type WalletRegistrationActivateAuthWorkV2 = {
-    authMethod: 'passkey';
-    emailOtpEnrollment?: never;
-} | {
-    authMethod: 'email_otp';
-    emailOtpEnrollment: NonNullable<FinalizeRequestBase['emailOtpEnrollment']>;
-};
-type WalletRegistrationActivateRequestBaseV2 = {
-    registrationCeremonyId: string;
-    signedSetup: SignedSetupPayloadB64u;
-    idempotencyKey: ActivateIdempotencyKey;
-};
-export type ActivateEcdsaWorkV2 = {
-    activationCorrelationId: CorrelationId;
-    clientActivation: RouterAbEcdsaVerifiedClientActivationFactsV1;
-};
-export type WalletRegistrationActivateRequestV2 = WalletRegistrationActivateRequestBaseV2 & WalletRegistrationActivateAuthWorkV2 & ({
-    kind: 'evm_family_ecdsa';
-    ecdsa: ActivateEcdsaWorkV2;
-} | {
-    kind: 'near_ed25519_and_evm_family_ecdsa';
-    ecdsa: ActivateEcdsaWorkV2;
-} | {
-    /**
-     * Ed25519-only activate persists the pending wallet and nothing else.
-     * It sends no ECDSA activation and — deliberately — no Ed25519
-     * activation reference either: Yao has not resolved yet, and its
-     * result arrives later at `/wallets/register/near-provisioning`.
-     */
-    kind: 'near_ed25519';
-    ecdsa?: never;
-});
 /**
  * Activate's terminal response is both legs merged.
  *

package/dist/types/wallet-server/src/core/threeRouteRegistrationContracts.typecheck.d.ts

@@ -1,60 +1,12 @@
 /**
- * Compile-time proof that the three-route request unions make invalid
- * registrations unrepresentable.
- *
- * These are the states a single object type with required `ecdsa` allowed and
- * shouldn't have: an Ed25519-only request carrying ECDSA work it has none of,
- * an ECDSA request missing the work it cannot run without, and Email OTP
- * enrollment attached to — or missing from — the wrong auth branch.
+ * Compile-time proof that the three-route commit receipt makes invalid
+ * committed states unrepresentable.
  *
  * Every `@ts-expect-error` here fails the build if the union ever stops
  * rejecting that shape.
  */
-import type { ActivateEcdsaWorkV2, RespondEcdsaRegistrationWorkV2, WalletRegistrationCommittedInstallationProjectionV1, WalletRegistrationActivateRequestV2, WalletRegistrationRespondRequestV2 } from './threeRouteRegistrationContracts';
-export type { WalletRegistrationActivateRequestV2 as _ActivateRequest, WalletRegistrationRespondRequestV2 as _RespondRequest, };
-export declare const _threeRouteRequestFixtures: readonly [{
-    webauthn_registration: Extract<import("./registrationContracts").WalletRegistrationAuthorityInput, {
-        kind: "passkey";
-    }>["webauthnRegistration"];
-    emailOtpRegistrationProof?: never;
-} & {
-    registrationCeremonyId: string;
-    signedSetup: import("./threeRouteRegistrationContracts").SignedSetupPayloadB64u;
-} & {
-    kind: "evm_family_ecdsa";
-    ecdsa: RespondEcdsaRegistrationWorkV2;
-}, {
-    webauthn_registration: Extract<import("./registrationContracts").WalletRegistrationAuthorityInput, {
-        kind: "passkey";
-    }>["webauthnRegistration"];
-    emailOtpRegistrationProof?: never;
-} & {
-    registrationCeremonyId: string;
-    signedSetup: import("./threeRouteRegistrationContracts").SignedSetupPayloadB64u;
-} & {
-    kind: "near_ed25519";
-    ecdsa?: never;
-}, {
-    registrationCeremonyId: string;
-    signedSetup: import("./threeRouteRegistrationContracts").SignedSetupPayloadB64u;
-    idempotencyKey: string;
-} & {
-    authMethod: "passkey";
-    emailOtpEnrollment?: never;
-} & {
-    kind: "evm_family_ecdsa";
-    ecdsa: ActivateEcdsaWorkV2;
-}, {
-    registrationCeremonyId: string;
-    signedSetup: import("./threeRouteRegistrationContracts").SignedSetupPayloadB64u;
-    idempotencyKey: string;
-} & {
-    authMethod: "email_otp";
-    emailOtpEnrollment: NonNullable<import("../../../shared-ts/src/utils").WalletEmailOtpEnrollmentMaterialV1 | undefined>;
-} & {
-    kind: "near_ed25519";
-    ecdsa?: never;
-}, WalletRegistrationRespondRequestV2, WalletRegistrationActivateRequestV2, WalletRegistrationRespondRequestV2, WalletRegistrationActivateRequestV2, WalletRegistrationActivateRequestV2, WalletRegistrationActivateRequestV2, WalletRegistrationCommittedInstallationProjectionV1, ({
+import type { WalletRegistrationCommittedInstallationProjectionV1 } from './threeRouteRegistrationContracts';
+export declare const _threeRouteRequestFixtures: readonly [WalletRegistrationCommittedInstallationProjectionV1, ({
     readonly kind: "ecdsa_ready";
     readonly ecdsa: {
         readonly walletKeys: readonly import("./registrationContracts").WalletRegistrationEcdsaWalletKey[];

package/dist/types/wallet-server/src/core/thresholdEcdsaChainTarget.d.ts

@@ -2,5 +2,4 @@ import { thresholdEcdsaChainTargetKey, type ThresholdEcdsaChainTargetWire } from
 export { thresholdEcdsaChainTargetKey };
 export type ThresholdEcdsaChainTarget = ThresholdEcdsaChainTargetWire;
 export declare function thresholdEcdsaChainTargetFromValue(value: unknown): ThresholdEcdsaChainTarget | null;
-export declare function thresholdEcdsaChainTargetsEqual(left: ThresholdEcdsaChainTarget, right: ThresholdEcdsaChainTarget): boolean;
 //# sourceMappingURL=thresholdEcdsaChainTarget.d.ts.map

package/dist/types/wallet-server/src/core/types.d.ts

@@ -1,6 +1,5 @@
 import { AuthenticatorOptions, UserVerificationPolicy, OriginPolicyInput } from '../../../shared-ts/src/utils/authenticatorOptions';
 import type { InitInput } from '../../../../wasm/near_signer/pkg/wasm_signer_worker.js';
-import type { Logger } from './logger';
 import type { Ed25519AuthorityScope } from '../../../shared-ts/src/threshold/sessionPolicy';
 import type { RuntimePolicyScope } from '../../../shared-ts/src/threshold/signingRootScope';
 import type { EcdsaClientRootPublicKey33B64u, DerivationClientSharePublicKey33B64u, EcdsaDerivationRoleLocalPublicIdentity } from '../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap';
@@ -30,16 +29,6 @@ export interface ServerResponse {
     body: string;
 }
 export type SignerWasmModuleSupplier = InitInput | Promise<InitInput> | (() => InitInput | Promise<InitInput>);
-export interface SignerWasmConfig {
-    /**
-     * Optional override for locating the signer WASM module. Useful for serverless
-     * runtimes (e.g. Workers) where filesystem-relative URLs are unavailable.
-     * Accepts any value supported by `initSignerWasm({ module_or_path })` or a
-     * function that resolves to one.
-     */
-    moduleOrPath?: SignerWasmModuleSupplier;
-}
-export type ThresholdEd25519KeyStoreKind = 'in-memory' | 'upstash-redis-rest' | 'redis-tcp' | 'cloudflare-do';
 export interface CloudflareDurableObjectStubLike {
     fetch(input: RequestInfo, init?: RequestInit): Promise<Response>;
 }
@@ -47,226 +36,11 @@ export interface CloudflareDurableObjectNamespaceLike {
     idFromName(name: string): unknown;
     get(id: unknown): CloudflareDurableObjectStubLike;
 }
-export type ThresholdStoreConfig = {
-    kind: 'in-memory';
-} | {
-    kind: 'upstash-redis-rest';
-    url: string;
-    token: string;
-    keyPrefix?: string;
-} | {
-    kind: 'redis-tcp';
-    redisUrl: string;
-    keyPrefix?: string;
-} | {
-    kind: 'cloudflare-do';
-    /**
-     * Durable Object namespace binding (e.g. `env.THRESHOLD_STORE`).
-     * Must point to a DO class implementing the SDK's threshold store protocol.
-     */
-    namespace: CloudflareDurableObjectNamespaceLike;
-    /**
-     * Optional DO instance name. Defaults to `threshold-store`.
-     * Use different names to isolate environments within the same Worker script.
-     */
-    name?: string;
-};
-/**
- * Env-shaped input for threshold key store selection.
- * - Upstash REST (Cloudflare-friendly): UPSTASH_REDIS_REST_URL + UPSTASH_REDIS_REST_TOKEN
- * - Redis TCP (Node-only): REDIS_URL
- */
-export type ThresholdStoreEnvInput = {
-    UPSTASH_REDIS_REST_URL?: string;
-    UPSTASH_REDIS_REST_TOKEN?: string;
-    REDIS_URL?: string;
-    /**
-     * Optional global base prefix for all threshold keyspaces.
-     *
-     * When set, and the more specific `THRESHOLD_ED25519_*_PREFIX` variables are not set,
-     * the SDK derives:
-     * - `THRESHOLD_ED25519_WALLET_SESSION_PREFIX` = `${THRESHOLD_PREFIX}:threshold-ed25519:wallet-session:`
-     * - `THRESHOLD_ED25519_SESSION_PREFIX` = `${THRESHOLD_PREFIX}:threshold-ed25519:sess:`
-     * - `THRESHOLD_ED25519_KEYSTORE_PREFIX` = `${THRESHOLD_PREFIX}:threshold-ed25519:key:`
-     * - `THRESHOLD_WALLET_SIGNING_BUDGET_SESSION_PREFIX` = `${THRESHOLD_PREFIX}:wallet-session:budget:`
-     *
-     * Trailing `:` is optional.
-     */
-    THRESHOLD_PREFIX?: string;
-    THRESHOLD_ED25519_KEYSTORE_PREFIX?: string;
-    THRESHOLD_ED25519_SESSION_PREFIX?: string;
-    THRESHOLD_ED25519_WALLET_SESSION_PREFIX?: string;
-    THRESHOLD_WALLET_SIGNING_BUDGET_SESSION_PREFIX?: string;
-    /**
-     * Ed25519 relayer-share source mode. This remains Ed25519-specific because
-     * it controls the Ed25519 threshold signing protocol, not the shared store.
-     */
-    THRESHOLD_ED25519_SHARE_MODE?: string;
-    /**
-     * Optional prefixes for threshold ECDSA key/session/Wallet Session storage.
-     * Defaults derive from `THRESHOLD_PREFIX` with a `threshold-ecdsa:*` namespace when unset.
-     */
-    THRESHOLD_ECDSA_KEYSTORE_PREFIX?: string;
-    THRESHOLD_ECDSA_SESSION_PREFIX?: string;
-    THRESHOLD_ECDSA_WALLET_SESSION_PREFIX?: string;
-    /**
-     * Optional override for the client FROST participant identifier (u16, >= 1).
-     * Must be distinct from `THRESHOLD_ED25519_RELAYER_PARTICIPANT_ID`.
-     */
-    THRESHOLD_ED25519_CLIENT_PARTICIPANT_ID?: string;
-    /**
-     * Optional override for the relayer FROST participant identifier (u16, >= 1).
-     * Must be distinct from `THRESHOLD_ED25519_CLIENT_PARTICIPANT_ID`.
-     */
-    THRESHOLD_ED25519_RELAYER_PARTICIPANT_ID?: string;
-    /**
-     * Threshold node role.
-     * - "coordinator" (default): exposes public registration/session routes and Router A/B bridge handlers.
-     * - "cosigner": exposes internal relayer-fleet t-of-n cosigning endpoints when configured.
-     */
-    THRESHOLD_NODE_ROLE?: string;
-    /**
-     * 32-byte base64url shared secret used to authenticate coordinator→peer calls.
-     *
-     * When set, cosigner relayers can expose internal endpoints that accept
-     * coordinator-signed grants (HMAC-SHA256).
-     */
-    THRESHOLD_COORDINATOR_SHARED_SECRET_B64U?: string;
-    /**
-     * Stable identifier for this coordinator instance.
-     *
-     * Used to pin Router A/B ECDSA derivation pool-fill sessions to the instance that
-     * created the live in-memory WASM session object.
-     */
-    THRESHOLD_COORDINATOR_INSTANCE_ID?: string;
-    /**
-     * Optional coordinator peer list (JSON) for cross-instance presign-step forwarding.
-     *
-     * Example:
-     * `THRESHOLD_COORDINATOR_PEERS=[{"instanceId":"coordinator-a","relayerUrl":"https://relay-a.internal"},{"instanceId":"coordinator-b","relayerUrl":"https://relay-b.internal"}]`
-     */
-    THRESHOLD_COORDINATOR_PEERS?: string;
-    /**
-     * Optional relayer-fleet cosigner list (JSON) for internal t-of-n cosigning.
-     *
-     * When configured on a coordinator node, the coordinator can fan out to relayer cosigners
-     * (internal-only nodes) and combine their partials into a single outer relayer signature share.
-     *
-     * Example:
-     * `THRESHOLD_ED25519_RELAYER_COSIGNERS=[{"cosignerId":1,"relayerUrl":"https://cosigner-a.internal"},{"cosignerId":2,"relayerUrl":"https://cosigner-b.internal"},{"cosignerId":3,"relayerUrl":"https://cosigner-c.internal"}]`
-     */
-    THRESHOLD_ED25519_RELAYER_COSIGNERS?: string;
-    /**
-     * Internal relayer cosigner id for this node (u16, >= 1).
-     * Required when running `THRESHOLD_NODE_ROLE=cosigner`.
-     */
-    THRESHOLD_ED25519_RELAYER_COSIGNER_ID?: string;
-    /**
-     * Internal relayer cosigner threshold `T` (integer, >= 1).
-     * When set together with `THRESHOLD_ED25519_RELAYER_COSIGNERS`, the coordinator will wait for
-     * `T` cosigners per signing round.
-     */
-    THRESHOLD_ED25519_RELAYER_COSIGNER_T?: string;
-    /**
-     * Optional Router A/B Ed25519 normal-signing SigningWorker id accepted by
-     * threshold session policy. When unset, Router A/B normal-signing session
-     * policy is rejected.
-     */
-    ROUTER_AB_NORMAL_SIGNING_WORKER_ID?: string;
-    /** Private Router A/B SigningWorker base URL. */
-    ROUTER_AB_SIGNING_WORKER_URL?: string;
-    /** Secret value sent in `x-router-ab-internal-service-auth` to private workers. */
-    ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET?: string;
-    /** Fetch transport for hosted runtimes that reach the SigningWorker through a service binding. */
-    routerAbSigningWorkerFetch?: typeof globalThis.fetch;
-    /** Signing-session seal root plus public rotation configuration. */
-    SIGNING_SESSION_SEAL_ROOT_SECRET_B64U?: string;
-    SIGNING_SESSION_SEAL_CURRENT_KEY_VERSION?: string;
-    SIGNING_SESSION_SEAL_ACCEPTED_WARM_KEY_VERSIONS?: string;
-    /** Optional signing session-seal idempotency backend configuration. */
-    SIGNING_SESSION_SEAL_IDEMPOTENCY_KIND?: string;
-    SIGNING_SESSION_SEAL_IDEMPOTENCY_UPSTASH_URL?: string;
-    SIGNING_SESSION_SEAL_IDEMPOTENCY_UPSTASH_TOKEN?: string;
-    SIGNING_SESSION_SEAL_IDEMPOTENCY_REDIS_URL?: string;
-    SIGNING_SESSION_SEAL_IDEMPOTENCY_KEY_PREFIX?: string;
-    SIGNING_SESSION_SEAL_IDEMPOTENCY_TTL_MS?: string;
-};
-/**
- * Threshold key store config input.
- *
- * Accepts either:
- * - an env-shaped object (for ergonomics in server examples), or
- * - an explicit `kind` object, optionally augmented with env-shaped overrides
- *   (useful when wiring via code but still wanting env vars like THRESHOLD_NODE_ROLE).
- */
-export type ThresholdStoreConfigInput = ThresholdStoreEnvInput | (ThresholdStoreConfig & Partial<ThresholdStoreEnvInput>);
-export interface AuthServiceConfig {
-    relayerAccount: string;
-    relayerPrivateKey: string;
-    nearRpcUrl: string;
-    networkId: string;
-    accountInitialBalance: string;
-    createAccountAndRegisterGas: string;
-    signerWasm?: SignerWasmConfig;
-    /**
-     * Optional persistence for relayer-held threshold signing shares.
-     * Defaults to in-memory unless env-shaped config enables Redis/Upstash.
-     */
-    thresholdStore?: ThresholdStoreConfigInput;
-    /**
-     * Optional logger. When unset, the server SDK is silent (no `console.*`).
-     * Pass `logger: console` to enable default logging.
-     */
-    logger?: Logger | null;
-    /**
-     * Optional Google OIDC configuration for verifying Google `id_token` login sessions.
-     */
-    googleOidc?: GoogleOidcConfig;
-    /**
-     * Optional GitHub OAuth configuration for exchanging authorization codes.
-     */
-    githubOAuth?: GithubOAuthConfig;
-}
-export type GoogleOidcConfig = {
-    /** Allowed OAuth client ids (audiences) for Google ID tokens. */
-    clientIds: string[];
-    /** Optional hosted domain allowlist (the `hd` claim). */
-    hostedDomains?: string[];
-};
-export interface GoogleOidcConfigEnvInput {
-    /** Single client id convenience. */
-    GOOGLE_OIDC_CLIENT_ID?: string;
-    /** Comma-separated client ids. */
-    GOOGLE_OIDC_CLIENT_IDS?: string;
-    /** Optional comma-separated hosted domains (`hd` claim). */
-    GOOGLE_OIDC_HOSTED_DOMAINS?: string;
-}
-export type GoogleOidcConfigInput = GoogleOidcConfig | GoogleOidcConfigEnvInput;
 export type GithubOAuthConfig = {
     clientId: string;
     clientSecret: string;
     callbackUrl: string;
 };
-export interface GithubOAuthConfigEnvInput {
-    GITHUB_OAUTH_CLIENT_ID?: string;
-    GITHUB_OAUTH_CLIENT_SECRET?: string;
-    GITHUB_OAUTH_CALLBACK_URL?: string;
-}
-export type GithubOAuthConfigInput = GithubOAuthConfig | GithubOAuthConfigEnvInput;
-/**
- * User-facing input shape for `AuthService`. Fields that have SDK defaults are optional here.
- *
- * Defaults are applied by `createAuthServiceConfig(...)` and the AuthService constructor.
- */
-export type AuthServiceConfigInput = Omit<AuthServiceConfig, 'nearRpcUrl' | 'networkId' | 'accountInitialBalance' | 'createAccountAndRegisterGas' | 'thresholdStore' | 'googleOidc' | 'githubOAuth'> & {
-    nearRpcUrl?: string;
-    networkId?: string;
-    accountInitialBalance?: string;
-    createAccountAndRegisterGas?: string;
-    thresholdStore?: ThresholdStoreConfigInput;
-    googleOidc?: GoogleOidcConfigInput;
-    githubOAuth?: GithubOAuthConfigInput;
-};
 export interface AccountCreationRequest {
     accountId: string;
     publicKey: string;
@@ -438,53 +212,6 @@ export interface ThresholdEd25519SessionResponse {
     runtimePolicyScope?: ThresholdRuntimePolicyScope;
     routerAbNormalSigning?: RouterAbEd25519NormalSigningState;
 }
-export interface ThresholdEd25519CosignInitRequest {
-    coordinatorGrant: string;
-    signingSessionId: string;
-    /**
-     * Base64url-encoded 32-byte relayer cosigner signing share (a secret share; unweighted).
-     * The cosigner derives its effective outer-protocol share from this and the selected cosigner set.
-     */
-    cosignerShareB64u: string;
-    clientCommitments: {
-        hiding: string;
-        binding: string;
-    };
-}
-export interface ThresholdEd25519CosignInitResponse {
-    ok: boolean;
-    code?: string;
-    message?: string;
-    relayerCommitments?: {
-        hiding: string;
-        binding: string;
-    };
-}
-export interface ThresholdEd25519CosignFinalizeRequest {
-    coordinatorGrant: string;
-    signingSessionId: string;
-    /**
-     * The selected cosigner id set used for internal Lagrange interpolation.
-     * Must include this cosigner's configured id.
-     */
-    cosignerIds: number[];
-    /** NEAR ed25519 public key string (`ed25519:<base58>`). */
-    groupPublicKey: string;
-    /**
-     * The combined outer-protocol relayer commitments (sum across the selected cosigners).
-     * This must match what the client used for its signing transcript.
-     */
-    relayerCommitments: {
-        hiding: string;
-        binding: string;
-    };
-}
-export interface ThresholdEd25519CosignFinalizeResponse {
-    ok: boolean;
-    code?: string;
-    message?: string;
-    relayerSignatureShareB64u?: string;
-}
 export type ThresholdEcdsaPurpose = string;
 export type EcdsaThresholdKeyId = string;
 export type ThresholdEcdsaChainTarget = import('./thresholdEcdsaChainTarget').ThresholdEcdsaChainTarget;
@@ -600,7 +327,6 @@ export interface EcdsaDerivationServerBootstrapResponse {
     publicIdentity: EcdsaDerivationPublicIdentity;
     clientShareRetryCounter: number;
     relayerShareRetryCounter: number;
-    publicTranscriptDigest32B64u: string;
     keyHandle: string;
     signingRootId: string;
     signingRootVersion: string;
@@ -705,29 +431,4 @@ export type RouterAbEcdsaDerivationPoolFillStepResponse = {
     /** Base64url-encoded compressed secp256k1 point (33 bytes) for `R` (only present when `event==='presign_done'`). */
     bigRB64u?: string;
 };
-export interface ThresholdEcdsaCosignInitRequest {
-    coordinatorGrant: string;
-    signingSessionId: string;
-    cosignerShareB64u: string;
-    clientRound1?: unknown;
-}
-export interface ThresholdEcdsaCosignInitResponse {
-    ok: boolean;
-    code?: string;
-    message?: string;
-    relayerRound1?: unknown;
-}
-export interface ThresholdEcdsaCosignFinalizeRequest {
-    coordinatorGrant: string;
-    signingSessionId: string;
-    cosignerIds: number[];
-    groupPublicKey: string;
-    relayerRound1?: unknown;
-}
-export interface ThresholdEcdsaCosignFinalizeResponse {
-    ok: boolean;
-    code?: string;
-    message?: string;
-    relayerRound2?: unknown;
-}
 //# sourceMappingURL=types.d.ts.map

package/dist/types/wallet-server/src/hosted-wallet-gateway.d.ts

@@ -1,6 +1,7 @@
+import type { WalletLifecycleRoutingPublisher } from './authorization/lifecycleRouting';
 import { type D1DatabaseLike } from './cloud-host';
 import { type WalletConsoleServiceBinding } from './cloud-host';
-import { type WalletControlRuntimeBindings } from './cloud-host';
+import { type WalletControlRuntimeBindings, type WalletRuntimeWalletIdentitiesResult, type WalletRuntimeWalletIdentityRequest } from './cloud-host';
 import { createCloudflareD1RouterApiAuthService, type CloudflareD1RouterApiAuthServiceOptions } from './cloud-host';
 import type { SigningSessionSealRoutesOptions } from './cloud-host';
 import type { CfExecutionContext, FetchHandler } from './cloud-host';
@@ -35,8 +36,6 @@ export interface CloudflareD1GatewayBaseEnv extends Readonly<Record<string, unkn
     readonly GITHUB_OAUTH_CLIENT_ID?: string;
     readonly GITHUB_OAUTH_CLIENT_SECRET?: string;
     readonly GITHUB_OAUTH_CALLBACK_URL?: string;
-    readonly ACCOUNT_ID_DERIVATION_SECRET?: string;
-    readonly ROUTER_AB_NORMAL_SIGNING_WORKER_ID?: string;
     readonly SIGNING_WORKER_ID?: string;
     readonly ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET?: string;
     readonly ROUTER_AB_GATEWAY_TO_ROUTER_AUTH_SECRET?: string;
@@ -79,6 +78,18 @@ export interface CloudflareD1GatewayEnv extends CloudflareD1GatewayBaseEnv {
     readonly WALLET_CONSOLE: WalletConsoleServiceBinding;
 }
 export interface HostedWalletGatewayDependenciesV1 {
+    readonly identityStore?: CloudflareD1RouterApiAuthServiceOptions['identityStore'];
+    readonly emailOtpRateLimitCounter?: CloudflareD1RouterApiAuthServiceOptions['emailOtpRateLimitCounter'];
+    readonly googleRegistrationAttempts?: CloudflareD1RouterApiAuthServiceOptions['googleRegistrationAttempts'];
+    readonly sessionRouting?: CloudflareD1RouterApiAuthServiceOptions['sessionRouting'];
+    readonly lifecycleRouting?: WalletLifecycleRoutingPublisher;
+    readonly recoveryRouting?: CloudflareD1RouterApiAuthServiceOptions['recoveryRouting'];
+    readonly registrationSetupDispatcher?: CloudflareD1RouterApiAuthServiceOptions['registrationSetupDispatcher'];
+    readonly registrationAuthority?: CloudflareD1RouterApiAuthServiceOptions['registrationAuthority'];
+    readonly credentialClaims?: CloudflareD1RouterApiAuthServiceOptions['credentialClaims'];
+    readonly linkedDeviceBootstrap?: CloudflareD1RouterApiAuthServiceOptions['linkedDeviceBootstrap'];
+    readonly linkedDeviceProofNonces?: CloudflareD1RouterApiAuthServiceOptions['linkedDeviceProofNonces'];
+    readonly syncChallenges?: CloudflareD1RouterApiAuthServiceOptions['syncChallenges'];
     readonly emailOtpDeliveryProvider?: CloudflareD1RouterApiAuthServiceOptions['emailOtpDeliveryProvider'];
     /** Host loader for the signer WASM; defaults to the Workers module import. */
     readonly signerWasm?: CloudflareD1RouterApiAuthServiceOptions['signerWasmModuleOrPath'];
@@ -98,6 +109,7 @@ export declare function createHostedWalletGatewayCompositionV1(env: CloudflareD1
 }>;
 export declare function createSplitGatewayRouterHandler(env: CloudflareD1GatewayEnv, dependencies?: HostedWalletGatewayDependenciesV1): Promise<FetchHandler>;
 export declare function handleSplitGatewayWalletRuntimeRequest(request: Request, env: CloudflareD1GatewayEnv & WalletControlRuntimeBindings, dependencies?: HostedWalletGatewayDependenciesV1): Promise<Response | null>;
+export declare function readWalletRuntimeIdentities(env: CloudflareD1GatewayEnv, input: WalletRuntimeWalletIdentityRequest): Promise<WalletRuntimeWalletIdentitiesResult>;
 export declare function handleSplitGatewayRequest(request: Request, env: CloudflareD1GatewayEnv, ctx: CfExecutionContext, dependencies?: HostedWalletGatewayDependenciesV1): Promise<Response>;
 export declare function stagingSigningSessionSealOptions(env: Pick<CloudflareD1GatewayBaseEnv, 'SIGNING_SESSION_SEAL_ROOT_SECRET_B64U' | 'SIGNING_SESSION_SEAL_CURRENT_KEY_VERSION' | 'SIGNING_SESSION_SEAL_ACCEPTED_WARM_KEY_VERSIONS'>): SigningSessionSealRoutesOptions | undefined;
 declare function createStagingYaoPartitionedStateStore(env: CloudflareD1GatewayBaseEnv): ReturnType<typeof createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1>;