@seams/wallet-server 0.7.3 → 0.9.0

package/dist/types/wallet-server/src/core/authService/webauthn.d.ts

@@ -1,17 +1,10 @@
-import { type WebAuthnAuthenticatorDeviceInfo } from '../../../../shared-ts/src/utils/webauthnDeviceInfo';
 import type { WebAuthnRpId } from '../../../../shared-ts/src/utils/domainIds';
 import type { ThresholdEd25519AuthorityScope } from '../types';
 import type { NormalizedLogger } from '../logger';
 import type { WebAuthnAuthenticatorStore } from '../WebAuthnAuthenticatorStore';
-import type { WebAuthnLoginChallengeStore } from '../WebAuthnLoginChallengeStore';
-import type { WebAuthnSyncChallengeStore } from '../WebAuthnSyncChallengeStore';
-import type { WebAuthnCredentialBindingStore } from '../WebAuthnCredentialBindingStore';
-import type { IdentityStore } from '../IdentityStore';
 import type { WebAuthnAuthenticationCredential } from '../types';
 import { type ResolvedEd25519WalletBinding } from './webauthnWalletBinding';
 import type { DigestB64u } from '../../../../shared-ts/src/utils/canonicalPrimitives';
-import { type WalletId } from '../../../../shared-ts/src/utils/registrationIntent';
-import { type WebAuthnLoginEd25519 } from './webauthnVerificationOutcomes';
 type WebAuthnCredentialVerificationResult = {
     ok: true;
     credential: {
@@ -30,51 +23,6 @@ type WebAuthnAuthenticationLiteResult = {
     code?: string;
     message?: string;
 };
-/**
- * One listed authenticator. `device` is required: the published service
- * contract declares it, and a binding with no authenticator row still gets the
- * `Unknown device` fallback rather than an absent field.
- */
-type WebAuthnAuthenticatorListEntry = {
-    credentialIdB64u: string;
-    signerSlot?: number;
-    publicKey?: string;
-    createdAtMs?: number;
-    updatedAtMs?: number;
-    device: WebAuthnAuthenticatorDeviceInfo;
-};
-export type WebAuthnAuthenticatorListResult = {
-    ok: boolean;
-    code?: string;
-    message?: string;
-    authenticators?: WebAuthnAuthenticatorListEntry[];
-};
-type WebAuthnLoginOptionsResult = {
-    ok: boolean;
-    challengeId?: string;
-    challengeB64u?: string;
-    expiresAtMs?: number;
-    code?: string;
-    message?: string;
-};
-export type WebAuthnSyncAccountOptionsResult = {
-    ok: true;
-    challengeId: string;
-    challengeB64u: string;
-    expiresAtMs: number;
-    credentialIds?: string[];
-    walletBinding?: ResolvedEd25519WalletBinding;
-} | {
-    ok: false;
-    code: string;
-    message: string;
-};
-export type WebAuthnSyncAccountVerificationRequest = {
-    challengeId?: unknown;
-    challenge_id?: unknown;
-    webauthn_authentication: WebAuthnAuthenticationCredential;
-    expected_origin?: string;
-};
 export type WebAuthnSyncAccountVerificationResult = {
     ok: true;
     verified: true;
@@ -107,19 +55,6 @@ export type WebAuthnSyncAccountVerificationResult = {
     code: string;
     message: string;
 };
-export type WebAuthnLoginVerificationResult = {
-    ok: true;
-    verified: true;
-    userId: string;
-    rpId: string;
-    credentialIdB64u: string;
-    ed25519: WebAuthnLoginEd25519;
-} | {
-    ok: false;
-    verified?: false;
-    code: string;
-    message: string;
-};
 export declare function verifyWebAuthnRegistrationCredentialForIntent(input: {
     webauthnRegistration: unknown;
     expectedChallenge: string;
@@ -135,65 +70,5 @@ export declare function verifyWebAuthnAuthenticationLiteWithStore(input: {
     authenticatorStore: WebAuthnAuthenticatorStore;
     logger: NormalizedLogger;
 }): Promise<WebAuthnAuthenticationLiteResult>;
-export declare function listWebAuthnAuthenticatorsForUserWithStores(input: {
-    userId: string;
-    rpId: string;
-    authenticatorStore: WebAuthnAuthenticatorStore;
-    credentialBindingStore: WebAuthnCredentialBindingStore;
-}): Promise<WebAuthnAuthenticatorListResult>;
-export declare function createWebAuthnLoginOptionsWithStore(input: {
-    request: {
-        userId?: unknown;
-        user_id?: unknown;
-        rpId?: unknown;
-        rp_id?: unknown;
-        ttlMs?: unknown;
-        ttl_ms?: unknown;
-    };
-    loginChallengeStore: WebAuthnLoginChallengeStore;
-}): Promise<WebAuthnLoginOptionsResult>;
-export declare function createWebAuthnSyncAccountOptionsWithStores(input: {
-    request: {
-        rp_id?: unknown;
-        account_id?: unknown;
-        ttl_ms?: unknown;
-        ttlMs?: unknown;
-    };
-    syncChallengeStore: WebAuthnSyncChallengeStore;
-    credentialBindingStore: WebAuthnCredentialBindingStore;
-}): Promise<WebAuthnSyncAccountOptionsResult>;
-/**
- * The one signer read sync needs. Shaped as the wallet store's own reader so
- * the existing store satisfies it structurally, with no adapter.
- */
-type SyncAccountEd25519SignerReader = {
-    getEd25519SignerBySlot(input: {
-        walletId: WalletId;
-        signerSlot: number;
-    }): Promise<{
-        readonly custodyKeyManifestDigestB64u: string;
-    } | null>;
-};
-export declare function verifyWebAuthnSyncAccountWithStores(input: {
-    request: WebAuthnSyncAccountVerificationRequest;
-    syncChallengeStore: WebAuthnSyncChallengeStore;
-    credentialBindingStore: WebAuthnCredentialBindingStore;
-    authenticatorStore: WebAuthnAuthenticatorStore;
-    walletStore: SyncAccountEd25519SignerReader;
-    logger: NormalizedLogger;
-}): Promise<WebAuthnSyncAccountVerificationResult>;
-export declare function verifyWebAuthnLoginWithStores(input: {
-    request: {
-        challengeId?: unknown;
-        challenge_id?: unknown;
-        webauthn_authentication?: unknown;
-        expected_origin?: string;
-    };
-    loginChallengeStore: WebAuthnLoginChallengeStore;
-    authenticatorStore: WebAuthnAuthenticatorStore;
-    credentialBindingStore: WebAuthnCredentialBindingStore;
-    identityStore: IdentityStore;
-    logger: NormalizedLogger;
-}): Promise<WebAuthnLoginVerificationResult>;
 export {};
 //# sourceMappingURL=webauthn.d.ts.map

package/dist/types/wallet-server/src/core/authService/webauthnOidcHelpers.d.ts

@@ -45,8 +45,5 @@ export declare function parseClientDataJsonBase64url(clientDataJSONB64u: string)
 };
 export declare function originHostnameOrEmpty(origin: string): string;
 export declare function isHostWithinRpId(host: string, rpId: WebAuthnRpId): boolean;
-export declare function parseCacheControlMaxAgeSec(cacheControl: string | null): number | null;
-export declare function parseJwtSegmentJson(input: string): Record<string, unknown> | null;
-export declare function parseJwtAud(input: unknown): string[];
 export {};
 //# sourceMappingURL=webauthnOidcHelpers.d.ts.map

package/dist/types/wallet-server/src/core/authService/webauthnVerificationOutcomes.d.ts

@@ -6,7 +6,7 @@ type WebAuthnVerificationFailure = {
     code: string;
     message: string;
 };
-export type WebAuthnLoginEd25519 = {
+type WebAuthnLoginEd25519 = {
     readonly kind: 'absent';
 } | {
     readonly kind: 'active';

package/dist/types/wallet-server/src/core/authService/webauthnWalletBinding.d.ts

@@ -1,5 +1,3 @@
-import type { WebAuthnCredentialBindingRecord } from '../WebAuthnCredentialBindingStore';
-export declare function parseBoundaryWalletId(raw: unknown): string | null;
 export type ResolvedEd25519WalletBinding = {
     walletId: string;
     nearAccountId: string;
@@ -8,14 +6,4 @@ export type ResolvedEd25519WalletBinding = {
     credentialIdB64u: string;
     signerSlot: number;
 };
-/**
- * Returns `null` when the binding carries no Ed25519 identity, which is the
- * valid state for a wallet whose Ed25519 Yao ceremony has not settled yet.
- * Callers must surface that as a typed "not provisioned" outcome rather than
- * treating it as a missing credential.
- */
-export declare function resolvedEd25519WalletBindingFromCredentialBinding(args: {
-    binding: WebAuthnCredentialBindingRecord;
-    signerSlot?: number;
-}): ResolvedEd25519WalletBinding | null;
 //# sourceMappingURL=webauthnWalletBinding.d.ts.map

package/dist/types/wallet-server/src/core/config.d.ts

@@ -1,13 +1,3 @@
-import type { AuthServiceConfig, AuthServiceConfigInput } from './types';
-export declare const AUTH_SERVICE_CONFIG_DEFAULTS: {
-    readonly nearRpcUrlTestnet: "https://rpc.testnet.fastnear.com";
-    readonly nearRpcUrlMainnet: "https://rpc.mainnet.near.org";
-    readonly networkId: "testnet";
-    readonly accountInitialBalance: "30000000000000000000000";
-    readonly createAccountAndRegisterGas: "85000000000000";
-};
-export declare function createAuthServiceConfig(input: AuthServiceConfigInput): AuthServiceConfig;
-export declare function validateConfigs(config: AuthServiceConfig): void;
 export declare function parseBool(v: unknown): boolean;
 export declare function requireEnvVar<T extends object, K extends keyof T & string>(env: T, name: K): string;
 //# sourceMappingURL=config.d.ts.map

package/dist/types/wallet-server/src/core/d1Ed25519SignerRead.d.ts

@@ -0,0 +1,17 @@
+import type { WalletId } from '../../../shared-ts/src/utils/domainIds';
+import { type RouterAbMpcMaterialActivationRefWire } from '../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
+import type { WalletEd25519SignerRecord } from './WalletStore';
+import { type RouterAbEd25519YaoActiveCapabilityLookupV1 } from '../router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery';
+/** Signer rows read with a Wallet Session; a failure surfaces after session validation. */
+export declare class Ed25519SignerRead {
+    #private;
+    private readonly walletId;
+    private readonly activation;
+    private readonly capabilities;
+    private constructor();
+    static fromRows(walletId: WalletId, activation: RouterAbMpcMaterialActivationRefWire, rows: unknown, capabilityPartition: unknown): Ed25519SignerRead;
+    resolveActiveCapability(input: RouterAbEd25519YaoActiveCapabilityLookupV1): import("../router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery").RouterAbEd25519YaoActiveCapabilityLookupResultV1 | null;
+    /** The session wallet's signer for the activation this read selected, or null. */
+    resolve(walletId: WalletId, activation: RouterAbMpcMaterialActivationRefWire): WalletEd25519SignerRecord | null;
+}
+//# sourceMappingURL=d1Ed25519SignerRead.d.ts.map

package/dist/types/wallet-server/src/core/d1IdentityStore.d.ts

@@ -5,8 +5,6 @@ export interface D1IdentityStoreSchemaOptions extends D1SchemaOptions {
 export interface D1IdentityStoreOptions extends D1TenantStoreOptions {
     readonly now?: () => Date;
 }
-/** Names the identity store in D1 scope errors. */
-export declare const IDENTITY_D1_STORE = "identity store";
 export declare const IDENTITY_STORE_D1_SCHEMA_SQL: readonly ["\n    CREATE TABLE IF NOT EXISTS identity_links (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      subject TEXT NOT NULL,\n      user_id TEXT NOT NULL,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      updated_at_ms INTEGER NOT NULL,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, subject),\n      CHECK (length(namespace) > 0),\n      CHECK (length(org_id) > 0),\n      CHECK (length(project_id) > 0),\n      CHECK (length(env_id) > 0),\n      CHECK (length(subject) > 0),\n      CHECK (length(user_id) > 0),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms > 0),\n      CHECK (updated_at_ms >= created_at_ms),\n      CHECK (COALESCE(json_extract(record_json, '$.version') = 'identity_subject_v1', 0)),\n      CHECK (COALESCE(json_extract(record_json, '$.subject') = subject, 0)),\n      CHECK (COALESCE(json_extract(record_json, '$.userId') = user_id, 0)),\n      CHECK (COALESCE(json_extract(record_json, '$.createdAtMs') = created_at_ms, 0)),\n      CHECK (COALESCE(json_extract(record_json, '$.updatedAtMs') = updated_at_ms, 0))\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS identity_links_user_idx\n      ON identity_links (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        user_id,\n        created_at_ms\n      )\n  "];
 export declare function ensureIdentityStoreD1Schema(options: D1IdentityStoreSchemaOptions): Promise<void>;
 export declare class D1IdentityStore implements IdentityStore {

package/dist/types/wallet-server/src/core/d1TenantStore.d.ts

@@ -1,9 +1,4 @@
 import type { D1DatabaseLike, D1PreparedStatementLike } from '../storage/tenantRoute';
-/**
- * A store's key prefix, which is also its D1 namespace: the first of `explicitKeys` set in
- * `config`, else `<THRESHOLD_PREFIX>:<segment>`. It always ends with a colon.
- */
-export declare function resolveStorePrefix(config: Record<string, unknown>, explicitKeys: readonly string[], segment: string): string;
 /** The tenant scope that leads the key of every D1 table. */
 export type D1TenantScope = {
     readonly namespace: string;
@@ -22,8 +17,6 @@ export interface D1TenantStoreOptions {
     readonly envId: string;
     readonly ensureSchema?: boolean;
 }
-/** The scope env-shaped store config names (`orgId` or `ORG_ID`, and so on) under `namespace`. */
-export declare function d1TenantScopeFromConfig(config: Record<string, unknown>, namespace: string, store: string): D1TenantScope;
 export declare function ensureD1Schema(database: D1DatabaseLike, statements: readonly string[]): Promise<void>;
 /** A schema a store creates once, on first use, unless its caller manages it (`enabled: false`). */
 export declare class D1Schema {

package/dist/types/wallet-server/src/core/d1WalletAuthMethodStore.d.ts

@@ -72,7 +72,6 @@ export declare const WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL: readonly ["\n    CR
  */
 export declare const WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL: readonly ["\n    CREATE TABLE IF NOT EXISTS wallet_auth_methods (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      wallet_id TEXT NOT NULL,\n      wallet_authority_id TEXT NOT NULL,\n      rp_id TEXT NOT NULL DEFAULT '',\n      kind TEXT NOT NULL,\n      status TEXT NOT NULL,\n      wallet_auth_method_id TEXT NOT NULL,\n      auth_identifier_key TEXT NOT NULL,\n      credential_id_b64u TEXT,\n      credential_public_key_b64u TEXT,\n      email_hash_hex TEXT,\n      registration_authority_id TEXT,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      updated_at_ms INTEGER NOT NULL,\n      activated_at_ms INTEGER,\n      revoked_at_ms INTEGER,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_auth_method_id),\n      FOREIGN KEY (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        wallet_authority_id\n      ) REFERENCES wallet_authorities(\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        authority_id\n      ),\n      CHECK (length(wallet_id) > 0),\n      CHECK (length(wallet_authority_id) > 0),\n      CHECK (kind IN ('passkey', 'email_otp')),\n      CHECK (status IN ('pending_local_install', 'active', 'revoked')),\n      CHECK (length(wallet_auth_method_id) > 0),\n      CHECK (length(auth_identifier_key) > 0),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms >= 0),\n      CHECK (updated_at_ms >= created_at_ms),\n      CHECK (\n        (status = 'pending_local_install' AND activated_at_ms IS NULL AND revoked_at_ms IS NULL)\n        OR\n        (status = 'active' AND activated_at_ms IS NOT NULL AND revoked_at_ms IS NULL)\n        OR\n        (status = 'revoked' AND activated_at_ms IS NOT NULL AND revoked_at_ms IS NOT NULL)\n      ),\n      CHECK (\n        (kind = 'passkey'\n          AND length(rp_id) > 0\n          AND credential_id_b64u IS NOT NULL\n          AND length(credential_id_b64u) > 0\n          AND credential_public_key_b64u IS NOT NULL\n          AND length(credential_public_key_b64u) > 0\n          AND email_hash_hex IS NULL\n          AND registration_authority_id IS NULL\n          AND auth_identifier_key = credential_id_b64u)\n        OR\n        (kind = 'email_otp'\n          AND rp_id = ''\n          AND credential_id_b64u IS NULL\n          AND credential_public_key_b64u IS NULL\n          AND email_hash_hex IS NOT NULL\n          AND length(email_hash_hex) > 0\n          AND registration_authority_id IS NOT NULL\n          AND length(registration_authority_id) > 0\n          AND auth_identifier_key = email_hash_hex)\n      ),\n      CHECK (json_extract(record_json, '$.version') = 'wallet_auth_method_v2'),\n      CHECK (json_extract(record_json, '$.walletAuthMethodId') = wallet_auth_method_id),\n      CHECK (json_extract(record_json, '$.walletId') = wallet_id),\n      CHECK (json_extract(record_json, '$.walletAuthorityId') = wallet_authority_id),\n      CHECK (json_extract(record_json, '$.kind') = kind),\n      CHECK (json_extract(record_json, '$.status') = status),\n      CHECK (json_extract(record_json, '$.createdAtMs') = created_at_ms),\n      CHECK (json_extract(record_json, '$.updatedAtMs') = updated_at_ms),\n      CHECK (\n        (kind = 'passkey'\n          AND json_extract(record_json, '$.rpId') = rp_id\n          AND json_extract(record_json, '$.credentialIdB64u') = credential_id_b64u\n          AND json_extract(record_json, '$.credentialPublicKeyB64u') = credential_public_key_b64u\n          AND json_extract(record_json, '$.counter') >= 0)\n        OR\n        (kind = 'email_otp'\n          AND json_extract(record_json, '$.emailHashHex') = email_hash_hex\n          AND json_extract(record_json, '$.registrationAuthorityId') = registration_authority_id)\n      )\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS wallet_auth_methods_wallet_authority_status_idx\n      ON wallet_auth_methods (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        wallet_id,\n        wallet_authority_id,\n        status\n      )\n  ", "\n    CREATE UNIQUE INDEX IF NOT EXISTS wallet_auth_methods_v2_passkey_uidx\n      ON wallet_auth_methods (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        rp_id,\n        credential_id_b64u\n      )\n      WHERE kind = 'passkey' AND credential_id_b64u IS NOT NULL\n  "];
 export declare function ensureWalletAuthMethodStoreD1Schema(options: D1WalletAuthMethodStoreSchemaOptions): Promise<void>;
-export declare function ensureWalletAuthMethodStoreD1SchemaV2(options: D1WalletAuthMethodStoreSchemaOptions): Promise<void>;
 export declare function walletAuthMethodId(record: WalletAuthMethodRecord): WalletAuthMethodId;
 export declare function normalizeWalletAuthMethod(raw: unknown): WalletAuthMethodRecord | null;
 export declare function normalizeWalletAuthMethodV2(raw: unknown): WalletAuthMethodRecordV2 | null;

package/dist/types/wallet-server/src/core/d1WalletStore.d.ts

@@ -28,6 +28,12 @@ export type D1WalletStoreScope = {
 };
 export declare const WALLET_STORE_D1_SCHEMA_SQL: readonly ["\n    CREATE TABLE IF NOT EXISTS wallets (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      wallet_id TEXT NOT NULL,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      updated_at_ms INTEGER NOT NULL,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_id),\n      CHECK (length(wallet_id) > 0),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms >= 0),\n      CHECK (updated_at_ms >= created_at_ms),\n      CHECK (COALESCE(json_extract(record_json, '$.version') = 'wallet_v1', 0)),\n      CHECK (COALESCE(json_extract(record_json, '$.walletId') = wallet_id, 0))\n    )\n  ", "\n    CREATE TABLE IF NOT EXISTS wallet_signers (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      wallet_id TEXT NOT NULL,\n      signer_family TEXT NOT NULL,\n      signer_id TEXT NOT NULL,\n      chain_target_key TEXT,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      updated_at_ms INTEGER NOT NULL,\n      PRIMARY KEY (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        wallet_id,\n        signer_family,\n        signer_id\n      ),\n      CHECK (length(wallet_id) > 0),\n      CHECK (signer_family IN ('ed25519', 'ecdsa')),\n      CHECK (length(signer_id) > 0),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms >= 0),\n      CHECK (updated_at_ms >= created_at_ms),\n      CHECK (COALESCE(json_extract(record_json, '$.walletId') = wallet_id, 0)),\n      CHECK (COALESCE(json_extract(record_json, '$.signerId') = signer_id, 0)),\n      CHECK (\n        (\n          signer_family = 'ed25519'\n          AND chain_target_key IS NULL\n          AND substr(signer_id, 1, 8) = 'ed25519:'\n          AND COALESCE(\n            json_extract(record_json, '$.version') = 'wallet_signer_ed25519_v1',\n            0\n          )\n        )\n        OR\n        (\n          signer_family = 'ecdsa'\n          AND chain_target_key IS NOT NULL\n          AND length(chain_target_key) > 0\n          AND signer_id = 'ecdsa:' || chain_target_key\n          AND COALESCE(\n            json_extract(record_json, '$.version') = 'wallet_signer_ecdsa_v1',\n            0\n          )\n          AND COALESCE(json_extract(record_json, '$.chainTargetKey') = chain_target_key, 0)\n        )\n      )\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS wallet_signers_wallet_idx\n      ON wallet_signers (namespace, org_id, project_id, env_id, wallet_id, signer_family)\n  ", "\n    CREATE INDEX IF NOT EXISTS wallet_signers_chain_target_idx\n      ON wallet_signers (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        signer_family,\n        chain_target_key\n      )\n  ", "\n    CREATE TABLE IF NOT EXISTS wallet_ecdsa_pending_session_activations (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      wallet_id TEXT NOT NULL,\n      lifecycle_id TEXT NOT NULL,\n      request_id TEXT NOT NULL,\n      record_json TEXT NOT NULL,\n      expires_at_ms INTEGER NOT NULL,\n      PRIMARY KEY (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        wallet_id,\n        lifecycle_id,\n        request_id\n      ),\n      CHECK (json_valid(record_json)),\n      CHECK (expires_at_ms > 0)\n    )\n  "];
 export declare function ensureWalletStoreD1Schema(options: D1WalletStoreSchemaOptions): Promise<void>;
+/** Where an Ed25519 signer row names the material activation it serves. */
+export declare const ED25519_SIGNER_ACTIVATION_ID_PATH = "$.activeYaoCapability.admissionRequest.scope.material_activation.activation_id";
+/** The wallet's signer for one material activation, among the rows that name its id. */
+export declare function selectWalletEd25519Signer(rows: readonly {
+    readonly record_json?: unknown;
+}[], walletId: string, materialActivation: RouterAbMpcMaterialActivationRefWire): WalletEd25519SignerRecord | null;
 export declare function parseWalletEd25519SignerRecord(raw: unknown): WalletEd25519SignerRecord | null;
 export declare function prepareD1WalletPutSubjectStatement(input: {
     readonly database: D1DatabaseLike;

package/dist/types/wallet-server/src/core/deviceLinking/linkedDeviceBootstrap.d.ts

@@ -0,0 +1,19 @@
+import type { LinkDeviceSessionId } from '../../../../shared-ts/src/signing-lanes/ids';
+import type { LinkedDeviceSessionRecordV1 } from './linkedDeviceSessionRecord';
+export type LinkedDeviceBootstrapResult = {
+    readonly ok: true;
+    readonly record: LinkedDeviceSessionRecordV1 | null;
+} | {
+    readonly ok: false;
+    readonly code: 'home_conflict' | 'home_unavailable';
+    readonly record?: never;
+};
+export interface LinkedDeviceBootstrapStore {
+    read(linkSessionId: LinkDeviceSessionId): Promise<LinkedDeviceBootstrapResult>;
+    create(record: LinkedDeviceSessionRecordV1): Promise<LinkedDeviceBootstrapResult>;
+    claim(record: LinkedDeviceSessionRecordV1): Promise<LinkedDeviceBootstrapResult>;
+    finish(record: LinkedDeviceSessionRecordV1): Promise<LinkedDeviceBootstrapResult>;
+}
+export declare function requireLinkedDeviceBootstrapRecord(result: LinkedDeviceBootstrapResult): LinkedDeviceSessionRecordV1 | null;
+export declare function linkedDeviceBootstrapFailure(error: unknown): 'home_conflict' | 'home_unavailable' | null;
+//# sourceMappingURL=linkedDeviceBootstrap.d.ts.map

package/dist/types/wallet-server/src/core/deviceLinking/linkedDeviceSession.d.ts

@@ -144,18 +144,20 @@ export type LinkedDeviceSessionStoreV1 = {
         readonly nowMs: number;
     }): Promise<LinkedDeviceSessionMutationResultV1>;
 };
-export type LinkedDeviceSessionServiceResultV1 = LinkedDeviceSessionMutationResultV1 | {
-    readonly outcome: 'invalid_input';
+type LinkedDeviceSessionFailureV1 = {
+    readonly outcome: 'home_conflict' | 'home_unavailable';
     readonly message: string;
+    readonly record?: never;
 } | {
-    readonly outcome: 'unauthorized';
-    readonly code: string;
+    readonly outcome: 'invalid_input';
     readonly message: string;
 };
-type LinkedDeviceTargetCredentialMutationResultV1 = LinkedDeviceSessionMutationResultV1 | {
-    readonly outcome: 'invalid_input';
+export type LinkedDeviceSessionServiceResultV1 = LinkedDeviceSessionMutationResultV1 | LinkedDeviceSessionFailureV1 | {
+    readonly outcome: 'unauthorized';
+    readonly code: string;
     readonly message: string;
 };
+type LinkedDeviceTargetCredentialMutationResultV1 = LinkedDeviceSessionMutationResultV1 | LinkedDeviceSessionFailureV1;
 type LinkedDeviceSessionCreateInputV1 = {
     readonly payload: QrLinkedDeviceSessionPayloadV5;
     readonly nowMs: number;

package/dist/types/wallet-server/src/core/deviceLinking/requestProof.d.ts

@@ -21,17 +21,14 @@ export type LinkedDeviceRequestProofNonceStoreV1 = {
         readonly expiresAtMs: number;
         readonly consumedAtMs: number;
     }): Promise<{
-        readonly outcome: 'consumed';
-    } | {
-        readonly outcome: 'already_used';
+        readonly outcome: 'consumed' | 'already_used' | 'unavailable';
     }>;
 };
 type LinkedDeviceRequestProofVerificationResultV1 = {
     readonly kind: 'authorized';
-    readonly proofDigestB64u: DigestB64u;
 } | {
     readonly kind: 'denied';
-    readonly code: 'invalid' | 'expired' | 'replayed';
+    readonly code: 'invalid' | 'expired' | 'replayed' | 'unavailable';
     readonly message: string;
 };
 export declare class LinkedDeviceRequestProofVerifierV1 {

package/dist/types/wallet-server/src/core/emailOtpD1Statements.d.ts

@@ -5,16 +5,13 @@ export type ScopedD1Prepare = (sql: string, values: readonly unknown[]) => D1Pre
 /** Statements on `email_otp_challenges`. */
 export declare const emailOtpChallengeRows: {
     insert: (prepare: ScopedD1Prepare, record: EmailOtpChallengeRecord) => D1PreparedStatementLike;
-    upsert: (prepare: ScopedD1Prepare, record: EmailOtpChallengeRecord) => D1PreparedStatementLike;
+    insertIfAbsent: (prepare: ScopedD1Prepare, record: EmailOtpChallengeRecord) => D1PreparedStatementLike;
     delete: (prepare: ScopedD1Prepare, challengeId: string) => D1PreparedStatementLike;
 };
 /** Statements on `email_otp_grants`. */
 export declare const emailOtpGrantRows: {
     insert: (prepare: ScopedD1Prepare, record: EmailOtpGrantRecord) => D1PreparedStatementLike;
-    upsert: (prepare: ScopedD1Prepare, record: EmailOtpGrantRecord) => D1PreparedStatementLike;
-    select: (prepare: ScopedD1Prepare, grantToken: string) => D1PreparedStatementLike;
     consume: (prepare: ScopedD1Prepare, grantToken: string) => D1PreparedStatementLike;
-    delete: (prepare: ScopedD1Prepare, grantToken: string) => D1PreparedStatementLike;
 };
 /** Statements on `email_otp_wallet_enrollments`. */
 export declare const emailOtpWalletEnrollmentRows: {
@@ -30,12 +27,19 @@ export declare const emailOtpAuthStateRows: {
 /** Statements on `email_otp_unlock_challenges`. */
 export declare const emailOtpUnlockChallengeRows: {
     insert: (prepare: ScopedD1Prepare, record: EmailOtpUnlockChallengeRecord) => D1PreparedStatementLike;
-    upsert: (prepare: ScopedD1Prepare, record: EmailOtpUnlockChallengeRecord) => D1PreparedStatementLike;
     consume: (prepare: ScopedD1Prepare, challengeId: string) => D1PreparedStatementLike;
 };
 /** Statements on `email_otp_registration_attempts`. */
 export declare const emailOtpRegistrationAttemptRows: {
-    upsert: (prepare: ScopedD1Prepare, record: GoogleEmailOtpRegistrationAttemptRecord) => D1PreparedStatementLike;
+    insertPendingIfAbsent: (prepare: ScopedD1Prepare, record: GoogleEmailOtpRegistrationAttemptRecord) => D1PreparedStatementLike;
+    claimCandidate: (prepare: ScopedD1Prepare, input: {
+        readonly attemptId: string;
+        readonly candidateId: string;
+        readonly walletId: string;
+        readonly intentDigest: string;
+        readonly nowMs: number;
+    }) => D1PreparedStatementLike;
+    updatePending: (prepare: ScopedD1Prepare, record: GoogleEmailOtpRegistrationAttemptRecord) => D1PreparedStatementLike;
     select: (prepare: ScopedD1Prepare, attemptId: string) => D1PreparedStatementLike;
     /** The latest live attempt for the subject, email, owner binding and runtime scope. */
     selectStarted: (prepare: ScopedD1Prepare, input: Readonly<GoogleEmailOtpRegistrationAttemptScopeInput>) => D1PreparedStatementLike;
@@ -49,6 +53,6 @@ export declare const emailOtpRegistrationAttemptRows: {
     deleteExpired: (prepare: ScopedD1Prepare, nowMs: number) => D1PreparedStatementLike;
     /** Finds a live attempt that selected or offered the wallet. */
     selectLiveForWallet: (prepare: ScopedD1Prepare, walletId: string, nowMs: number) => D1PreparedStatementLike;
-    delete: (prepare: ScopedD1Prepare, attemptId: string) => D1PreparedStatementLike;
+    deleteUnclaimed: (prepare: ScopedD1Prepare, attemptId: string) => D1PreparedStatementLike;
 };
 //# sourceMappingURL=emailOtpD1Statements.d.ts.map

package/dist/types/wallet-server/src/core/keyMaterialBrands.d.ts

@@ -1,8 +1,4 @@
 import type { EcdsaThresholdKeyId } from '../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap';
-import { type Brand } from '../../../shared-ts/src/threshold/keyMaterialBrands';
 export type { EcdsaThresholdKeyId };
-export { formatEcdsaClientVerifyingShareB64uForWire, formatEcdsaDerivationKeyVersionForWire, formatEcdsaKeyHandleForWire, formatEcdsaRelayerKeyIdForWire, formatEcdsaThresholdKeyIdForWire, formatEd25519RelayerKeyIdForWire, formatSigningSessionSealKeyVersionForWire, parseEcdsaClientVerifyingShareB64u, parseEcdsaDerivationKeyVersion, parseEcdsaKeyHandle, parseEcdsaRelayerKeyId, parseEd25519RelayerKeyId, parseSigningSessionSealKeyVersion, type EcdsaClientVerifyingShareB64u, type EcdsaDerivationKeyVersion, type EcdsaKeyHandle, type EcdsaRelayerKeyId, type Ed25519RelayerKeyId, type SigningSessionSealKeyVersion, } from '../../../shared-ts/src/threshold/keyMaterialBrands';
-export type Ed25519ClientVerifyingShareB64u = Brand<string, 'Ed25519ClientVerifyingShareB64u'>;
-export declare function parseEcdsaThresholdKeyId(value: unknown): EcdsaThresholdKeyId;
-export declare function formatEd25519ClientVerifyingShareB64uForWire(value: Ed25519ClientVerifyingShareB64u): string;
+export { formatEcdsaKeyHandleForWire, formatSigningSessionSealKeyVersionForWire, parseEcdsaClientVerifyingShareB64u, parseEcdsaKeyHandle, parseEcdsaRelayerKeyId, parseSigningSessionSealKeyVersion, type EcdsaClientVerifyingShareB64u, type EcdsaKeyHandle, type EcdsaRelayerKeyId, type SigningSessionSealKeyVersion, } from '../../../shared-ts/src/threshold/keyMaterialBrands';
 //# sourceMappingURL=keyMaterialBrands.d.ts.map

package/dist/types/wallet-server/src/core/nearRelayerAccountProvisioning.d.ts

@@ -39,7 +39,6 @@ type PrepareSponsoredNearAccountCreationResultV1 = {
     readonly prepared: PreparedSponsoredNearAccountCreationV1;
 } | {
     readonly ok: false;
-    readonly error: string;
     readonly message: string;
 };
 /**

package/dist/types/wallet-server/src/core/passkeyCredentialClaims.d.ts

@@ -0,0 +1,9 @@
+export interface PasskeyCredentialClaims {
+    claim(input: {
+        readonly walletId: string;
+        readonly rpId: string;
+        readonly credentialIdB64u: string;
+    }): Promise<boolean>;
+}
+export declare function reservePasskeyCredential(claims: PasskeyCredentialClaims | undefined, input: Parameters<PasskeyCredentialClaims['claim']>[0]): Promise<void>;
+//# sourceMappingURL=passkeyCredentialClaims.d.ts.map

package/dist/types/wallet-server/src/core/routerAbSigning/RouterAbEcdsaPresignRuntime.d.ts

@@ -1,10 +1,8 @@
-import { coerceThresholdNodeRole } from '../ThresholdService/config';
 import { RouterAbEcdsaDerivationPoolFillHandlers } from '../ThresholdService/routerAb/ecdsaDerivationPoolFillHandlers';
-import { type RouterAbLinkedDeviceEcdsaExportShareHttpResult, type RouterAbEcdsaPresignSessionHttpResult } from '../ThresholdService/routerAb/ecdsaDerivationPresignBridge';
+import { type RouterAbLinkedDeviceEcdsaExportShareHttpResult, type RouterAbEcdsaPresignSessionHttpResult, type RouterAbEcdsaPresignAuthorityV1 } from '../ThresholdService/routerAb/ecdsaDerivationPresignBridge';
 import type { RouterAbEcdsaSigningWorkerExportShareBindingV1 } from '../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
 import type { RouterAbConfiguredSigningWorkerPrivateTransport } from './RouterAbNormalSigningRuntime';
 export type RouterAbEcdsaPresignRuntimeConfig = {
-    readonly nodeRole: ReturnType<typeof coerceThresholdNodeRole>;
     readonly participantIds: {
         readonly clientParticipantId: number;
         readonly relayerParticipantId: number;
@@ -30,12 +28,16 @@ export declare class RouterAbEcdsaPresignRuntime {
     initializePoolFill(input: RouterAbEcdsaPresignInitInput): Promise<RouterAbEcdsaPresignInitResult>;
     advancePoolFill(input: RouterAbEcdsaPresignStepInput): Promise<RouterAbEcdsaPresignStepResult>;
     initializeLinkedDevicePresign(input: {
+        readonly ownershipGeneration: number;
+        readonly walletScope: RouterAbEcdsaPresignAuthorityV1['wallet_scope'];
         readonly request: Record<string, unknown>;
         readonly materialSource: Record<string, unknown>;
         readonly presignSessionId: string;
         readonly expiresAtMs: number;
     }): Promise<RouterAbEcdsaPresignSessionHttpResult>;
     advanceLinkedDevicePresign(input: {
+        readonly ownershipGeneration: number;
+        readonly walletScope: RouterAbEcdsaPresignAuthorityV1['wallet_scope'];
         readonly request: Record<string, unknown>;
         readonly materialSource: Record<string, unknown>;
         readonly presignSessionId: string;

package/dist/types/wallet-server/src/core/routerAbSigning/RouterAbNormalSigningRuntime.d.ts

@@ -17,7 +17,6 @@ export type RouterAbSigningWorkerPrivateTransport = ReadonlyExclusiveUnion<{
 export type RouterAbConfiguredSigningWorkerPrivateTransport = Extract<RouterAbSigningWorkerPrivateTransport, {
     readonly kind: 'configured';
 }>;
-export declare function requireRouterAbConfiguredSigningWorkerPrivateTransport(transport: RouterAbSigningWorkerPrivateTransport): RouterAbConfiguredSigningWorkerPrivateTransport;
 type RouterAbNormalSigningRuntimeConfig = {
     readonly policy: RouterAbNormalSigningServerPolicy;
     readonly signingWorkerTransport: RouterAbSigningWorkerPrivateTransport;
@@ -47,7 +46,6 @@ type RouterAbClampedSessionPolicy = {
     readonly ttlMs: number;
     readonly remainingUses: number;
 };
-export declare function parseRouterAbNormalSigningRuntimeConfig(config: Readonly<Record<string, unknown>>): RouterAbNormalSigningRuntimeConfig;
 export declare class RouterAbNormalSigningRuntime {
     private readonly walletSessionStore;
     private readonly ecdsaWalletSessionStore;

package/dist/types/wallet-server/src/core/signingMaterial/ordinaryInactiveSignerMaterialReservation.d.ts

@@ -76,6 +76,7 @@ export type OrdinaryEd25519SignerMaterialReservationRequestV1 = OrdinarySignerMa
 export type OrdinaryEcdsaSignerMaterialReservationRequestV1 = OrdinarySignerMaterialReservationRequestV1<'ecdsa_secp256k1'>;
 export type OrdinaryInactiveSignerMaterialReservationRequestV1 = OrdinaryEd25519SignerMaterialReservationRequestV1 | OrdinaryEcdsaSignerMaterialReservationRequestV1;
 type OrdinarySignerMaterialReservationRequestV1<F extends OrdinarySignerFamilyV1> = {
+    readonly ownershipGeneration: number;
     readonly kind: OrdinaryRequestKindByFamilyV1[F];
     readonly keyFamily: F;
     readonly signer: OrdinarySignerByFamilyV1[F];