@seams/wallet-server 0.7.3 → 0.9.0

package/dist/types/wallet-server/src/core/threeRouteRegistrationContracts.d.ts

@@ -1,7 +1,6 @@
+import type { WalletSessionHome } from '../../../shared-ts/src/device-linking/contracts';
 import type { ActiveWalletAuthMethodRecordV2 } from '../../../shared-ts/src/utils/walletAuthMethodRecord';
-import type { CorrelationId } from '../../../shared-ts/src/utils/canonicalPrimitives';
-import type { RouterAbEcdsaVerifiedClientActivationFactsV1 } from '../../../shared-ts/src/utils/routerAbEcdsaDerivation';
-import type { WalletRegistrationEcdsaPreparePayload, WalletRegistrationFinalizeSuccess, WalletRegistrationStartRequest, WalletRegistrationAuthorityInput, WalletRegistrationStartResponse, WalletRegistrationFinalizeRequest, WalletRegistrationEcdsaActivationResponse, WalletRegistrationEcdsaWalletKey, WalletRegistrationEd25519YaoPublicResult, WalletRegistrationRouteDiagnostics } from './registrationContracts';
+import type { WalletRegistrationEcdsaPreparePayload, WalletRegistrationFinalizeSuccess, WalletRegistrationStartRequest, WalletRegistrationStartResponse, WalletRegistrationEcdsaActivationResponse, WalletRegistrationEcdsaWalletKey, WalletRegistrationEd25519YaoPublicResult, WalletRegistrationRouteDiagnostics } from './registrationContracts';
 import type { WalletRegistrationFinalizeAuthMethod } from '../../../shared-ts/src/utils/registrationContracts';
 import type { RegistrationEstablishedSessionProjectionV2, RegistrationEstablishedSessionResultV2 } from '../../../shared-ts/src/utils/registrationEstablishedSession';
 import type { WalletAuthMethodId, WalletId } from '../../../shared-ts/src/utils/domainIds';
@@ -12,6 +11,7 @@ import type { RegistrationAuthority } from '../../../shared-ts/src/utils/registr
 import type { WalletAuthAuthority } from '../../../shared-ts/src/utils/walletAuthAuthority';
 import type { WalletCustodyRegistrationOutcome } from '../../../shared-ts/src/passkey-custody';
 import type { DigestB64u } from '../../../shared-ts/src/utils/canonicalPrimitives';
+import type { RouterAbEd25519YaoActivationAdmissionReceiptV1 } from '../../../shared-ts/src/utils/routerAbEd25519Yao';
 import type { ThresholdEd25519AuthorityScope, EcdsaDerivationServerBootstrapResponse } from './types';
 import type { StoredWalletRegistrationNearEd25519YaoAuthorizedBranch, StoredWalletRegistrationPreparedContext } from './RegistrationCeremonyStore';
 /**
@@ -50,8 +50,6 @@ type SetupEd25519Work = Extract<WalletRegistrationStartResponse, {
 }> extends {
     ed25519: infer T;
 } ? T : never;
-type ActivateIdempotencyKey = WalletRegistrationFinalizeRequest['idempotencyKey'];
-type FinalizeRequestBase = WalletRegistrationFinalizeRequest;
 type EcdsaFinalizeSuccess = Extract<WalletRegistrationFinalizeSuccess, {
     kind: 'evm_family_ecdsa';
 }>;
@@ -104,14 +102,7 @@ export type WalletRegistrationSessionCommitReceiptV2 = {
         readonly kind: 'error';
         readonly error: WalletRegistrationRouteErrorV2;
     };
-} | (WalletRegistrationSessionCommitReceiptMetadataV2 & {
-    readonly committed: {
-        readonly kind: 'near_pending';
-        readonly nearProvisioning: {
-            readonly status: 'near_pending';
-        };
-    };
-}) | (WalletRegistrationSessionCommitReadyBaseV2 & {
+} | (WalletRegistrationSessionCommitReadyBaseV2 & {
     readonly committed: WalletRegistrationEcdsaReadyCommitV2;
 }) | (WalletRegistrationSessionCommitReadyBaseV2 & {
     readonly committed: {
@@ -162,6 +153,7 @@ export type WalletRegistrationRouteErrorV2 = {
  * both methods.
  */
 type WalletRegistrationSetupSuccessBase = {
+    readonly home: WalletSessionHome;
     ok: true;
     registrationCeremonyId: string;
     walletId: string;
@@ -187,47 +179,6 @@ export type WalletRegistrationSetupResponseV2 = (WalletRegistrationSetupSuccessB
     kind: 'near_ed25519';
     ecdsa?: never;
 }) | WalletRegistrationRouteErrorV2;
-/**
- * Route 2 — authenticated respond.
- *
- * The request discriminates on the signer plan, exhaustively, because an
- * Ed25519-only ceremony has no ECDSA registration to send. A single object
- * type with a required `ecdsa` made that request impossible to construct.
- * The parser validates this discriminant against the plan the signed setup
- * and ceremony actually recorded, so a caller cannot pick an arm the ceremony
- * was not created for.
- */
-type WalletRegistrationRespondRequestBaseV2 = {
-    registrationCeremonyId: string;
-    signedSetup: SignedSetupPayloadB64u;
-};
-type WalletRegistrationRespondAuthorityProofV2 = {
-    webauthn_registration: Extract<WalletRegistrationAuthorityInput, {
-        kind: 'passkey';
-    }>['webauthnRegistration'];
-    emailOtpRegistrationProof?: never;
-} | {
-    emailOtpRegistrationProof: Extract<WalletRegistrationAuthorityInput, {
-        kind: 'email_otp';
-    }>['emailOtpRegistrationProof'];
-    webauthn_registration?: never;
-};
-export type RespondEcdsaRegistrationWorkV2 = {
-    kind: 'router_ab_ecdsa_registration_v1';
-    strictRegistration: unknown;
-    /** Canonical Router request digest produced by the client ceremony WASM. */
-    requestDigestB64u: string;
-};
-export type WalletRegistrationRespondRequestV2 = WalletRegistrationRespondAuthorityProofV2 & ((WalletRegistrationRespondRequestBaseV2 & {
-    kind: 'evm_family_ecdsa';
-    ecdsa: RespondEcdsaRegistrationWorkV2;
-}) | (WalletRegistrationRespondRequestBaseV2 & {
-    kind: 'near_ed25519_and_evm_family_ecdsa';
-    ecdsa: RespondEcdsaRegistrationWorkV2;
-}) | (WalletRegistrationRespondRequestBaseV2 & {
-    kind: 'near_ed25519';
-    ecdsa?: never;
-}));
 /**
  * What respond returns for the ceremony's signer plan.
  *
@@ -237,9 +188,9 @@ export type WalletRegistrationRespondRequestV2 = WalletRegistrationRespondAuthor
  * `ed25519` field: a mixed plan always carries its deferred NEAR work, and an
  * ECDSA-only plan has no arm to omit.
  *
- * The NEAR work is deferred, not pending-in-progress. The client starts it
- * asynchronously and must not await it: the wallet is usable on ECDSA alone,
- * and blocking registration on Yao is the coupling this refactor removes.
+ * Mixed wallets defer NEAR work because their ECDSA signer is already usable.
+ * NEAR-only wallets receive an admitted Yao session and complete it before
+ * finalization.
  */
 type WalletRegistrationRespondSignerPlanV2 = {
     kind: 'evm_family_ecdsa';
@@ -251,19 +202,14 @@ type WalletRegistrationRespondSignerPlanV2 = {
     /** Authority-bound admission, derived here because the proof now exists. */
     ed25519: RespondEd25519DeferredWorkV2;
 } | {
-    /**
-     * Ed25519-only: no ECDSA leg ran, so there is no proof bundle — `ecdsa`
-     * is `never`, not an empty object.
-     *
-     * The admission is deferred, exactly as on a mixed plan. Yao being the
-     * wallet's sole signer is not a reason to block on it: the client starts
-     * the computation and calls activate without awaiting it, and the wallet
-     * exists in `near_pending` until Yao produces its signer. There is
-     * deliberately no second, blocking Yao lifecycle.
-     */
+    /** The client completes Yao and recovery backup before committing this wallet. */
     kind: 'near_ed25519';
     ecdsa?: never;
-    ed25519: RespondEd25519DeferredWorkV2;
+    ed25519: {
+        readonly status: 'admitted';
+        readonly admissionRequest: RespondEd25519DeferredWorkV2['admissionRequest'];
+        readonly admissionReceipt: RouterAbEd25519YaoActivationAdmissionReceiptV1<'registration'>;
+    };
 };
 /** Exact A/B role bundles, unchanged from the derivation respond leg. */
 type RespondEcdsaProofBundles = {
@@ -285,52 +231,6 @@ export type WalletRegistrationNearAdmissionResponseV2 = {
     readonly registrationCeremonyId: string;
     readonly ed25519: RespondEd25519DeferredWorkV2;
 } | WalletRegistrationRouteErrorV2;
-/**
- * Route 3 — activate-and-finalize; the operation row is the replay record.
- *
- * Two independent discriminants, because they vary independently: the signer
- * plan decides whether there is ECDSA activation to send, and the auth method
- * decides whether Email OTP enrollment is required. Enrollment is *not* an
- * ECDSA concern — an Ed25519-only wallet registered with Email OTP still
- * enrolls — so deriving those fields from the ECDSA work, as this type
- * previously did, mismodelled them.
- *
- * Passkey activation carrying enrollment fields fails to compile, and Email
- * OTP activation missing them fails to compile. Neither is optional, because
- * neither is genuinely optional at runtime.
- */
-type WalletRegistrationActivateAuthWorkV2 = {
-    authMethod: 'passkey';
-    emailOtpEnrollment?: never;
-} | {
-    authMethod: 'email_otp';
-    emailOtpEnrollment: NonNullable<FinalizeRequestBase['emailOtpEnrollment']>;
-};
-type WalletRegistrationActivateRequestBaseV2 = {
-    registrationCeremonyId: string;
-    signedSetup: SignedSetupPayloadB64u;
-    idempotencyKey: ActivateIdempotencyKey;
-};
-export type ActivateEcdsaWorkV2 = {
-    activationCorrelationId: CorrelationId;
-    clientActivation: RouterAbEcdsaVerifiedClientActivationFactsV1;
-};
-export type WalletRegistrationActivateRequestV2 = WalletRegistrationActivateRequestBaseV2 & WalletRegistrationActivateAuthWorkV2 & ({
-    kind: 'evm_family_ecdsa';
-    ecdsa: ActivateEcdsaWorkV2;
-} | {
-    kind: 'near_ed25519_and_evm_family_ecdsa';
-    ecdsa: ActivateEcdsaWorkV2;
-} | {
-    /**
-     * Ed25519-only activate persists the pending wallet and nothing else.
-     * It sends no ECDSA activation and — deliberately — no Ed25519
-     * activation reference either: Yao has not resolved yet, and its
-     * result arrives later at `/wallets/register/near-provisioning`.
-     */
-    kind: 'near_ed25519';
-    ecdsa?: never;
-});
 /**
  * Activate's terminal response is both legs merged.
  *
@@ -344,32 +244,7 @@ type ActivateEcdsaTerminalPayload = EcdsaFinalizeSuccess['ecdsa'] & {
     activation: EcdsaActivationSuccess['ecdsa']['activation'];
     bootstrap: EcdsaActivationSuccess['ecdsa']['bootstrap'];
 };
-type Ed25519FinalizeSuccess = Extract<WalletRegistrationFinalizeSuccess, {
-    kind: 'near_ed25519';
-}>;
 type DistributiveOmit<T, K extends keyof any> = T extends unknown ? Omit<T, K> : never;
-/**
- * Activate's Ed25519-only terminal result: a wallet that exists and cannot
- * yet sign.
- *
- * Activate does not wait for Yao. It persists the wallet, profile, and
- * authentication state plus the `near_pending` provisioning record, and that
- * pending response is the committed terminal projection, and a retry
- * reconstructs that projection from the receipt. Every field that only
- * completed Yao can produce is `never`, so a caller cannot read a signer, a
- * resolved account, or a key identity that does not exist yet. The wallet
- * becomes signable when deferred Yao reaches `near_ready`.
- */
-export type WalletRegistrationActivateEd25519PendingV2 = DistributiveOmit<Ed25519FinalizeSuccess, 'ed25519' | 'resolvedAccount' | 'accountProvisioning' | 'authorityScope' | 'foundingAuthority' | 'foundingAuthMethod' | 'custodyKeyManifestDigestB64u'> & {
-    nearProvisioning: {
-        status: 'near_pending';
-    };
-    ed25519?: never;
-    resolvedAccount?: never;
-    accountProvisioning?: never;
-    authorityScope?: never;
-    ecdsa?: never;
-};
 export type WalletRegistrationActivateResponseV2 = (DistributiveOmit<EcdsaFinalizeSuccess, 'ecdsa'> & {
     ecdsa: ActivateEcdsaTerminalPayload;
     registrationEstablishedSession: RegistrationEstablishedSessionResultV2;
@@ -377,7 +252,7 @@ export type WalletRegistrationActivateResponseV2 = (DistributiveOmit<EcdsaFinali
     nearProvisioning?: {
         status: 'near_pending';
     };
-}) | WalletRegistrationActivateEd25519PendingV2 | WalletRegistrationRouteErrorV2;
+}) | WalletRegistrationRouteErrorV2;
 type ActivateSuccessV2 = Exclude<WalletRegistrationActivateResponseV2, WalletRegistrationRouteErrorV2>;
 export type WalletRegistrationActivateRouteResponseV2 = ActivateSuccessV2 | WalletRegistrationRouteErrorV2;
 type WalletRegistrationNearProvisioningFinalizeSuccessV2 = Extract<WalletRegistrationFinalizeSuccess, {

package/dist/types/wallet-server/src/core/threeRouteRegistrationContracts.typecheck.d.ts

@@ -1,60 +1,12 @@
 /**
- * Compile-time proof that the three-route request unions make invalid
- * registrations unrepresentable.
- *
- * These are the states a single object type with required `ecdsa` allowed and
- * shouldn't have: an Ed25519-only request carrying ECDSA work it has none of,
- * an ECDSA request missing the work it cannot run without, and Email OTP
- * enrollment attached to — or missing from — the wrong auth branch.
+ * Compile-time proof that the three-route commit receipt makes invalid
+ * committed states unrepresentable.
  *
  * Every `@ts-expect-error` here fails the build if the union ever stops
  * rejecting that shape.
  */
-import type { ActivateEcdsaWorkV2, RespondEcdsaRegistrationWorkV2, WalletRegistrationCommittedInstallationProjectionV1, WalletRegistrationActivateRequestV2, WalletRegistrationRespondRequestV2 } from './threeRouteRegistrationContracts';
-export type { WalletRegistrationActivateRequestV2 as _ActivateRequest, WalletRegistrationRespondRequestV2 as _RespondRequest, };
-export declare const _threeRouteRequestFixtures: readonly [{
-    webauthn_registration: Extract<import("./registrationContracts").WalletRegistrationAuthorityInput, {
-        kind: "passkey";
-    }>["webauthnRegistration"];
-    emailOtpRegistrationProof?: never;
-} & {
-    registrationCeremonyId: string;
-    signedSetup: import("./threeRouteRegistrationContracts").SignedSetupPayloadB64u;
-} & {
-    kind: "evm_family_ecdsa";
-    ecdsa: RespondEcdsaRegistrationWorkV2;
-}, {
-    webauthn_registration: Extract<import("./registrationContracts").WalletRegistrationAuthorityInput, {
-        kind: "passkey";
-    }>["webauthnRegistration"];
-    emailOtpRegistrationProof?: never;
-} & {
-    registrationCeremonyId: string;
-    signedSetup: import("./threeRouteRegistrationContracts").SignedSetupPayloadB64u;
-} & {
-    kind: "near_ed25519";
-    ecdsa?: never;
-}, {
-    registrationCeremonyId: string;
-    signedSetup: import("./threeRouteRegistrationContracts").SignedSetupPayloadB64u;
-    idempotencyKey: string;
-} & {
-    authMethod: "passkey";
-    emailOtpEnrollment?: never;
-} & {
-    kind: "evm_family_ecdsa";
-    ecdsa: ActivateEcdsaWorkV2;
-}, {
-    registrationCeremonyId: string;
-    signedSetup: import("./threeRouteRegistrationContracts").SignedSetupPayloadB64u;
-    idempotencyKey: string;
-} & {
-    authMethod: "email_otp";
-    emailOtpEnrollment: NonNullable<import("../../../shared-ts/src/utils").WalletEmailOtpEnrollmentMaterialV1 | undefined>;
-} & {
-    kind: "near_ed25519";
-    ecdsa?: never;
-}, WalletRegistrationRespondRequestV2, WalletRegistrationActivateRequestV2, WalletRegistrationRespondRequestV2, WalletRegistrationActivateRequestV2, WalletRegistrationActivateRequestV2, WalletRegistrationActivateRequestV2, WalletRegistrationCommittedInstallationProjectionV1, ({
+import type { WalletRegistrationCommittedInstallationProjectionV1 } from './threeRouteRegistrationContracts';
+export declare const _threeRouteRequestFixtures: readonly [WalletRegistrationCommittedInstallationProjectionV1, ({
     readonly kind: "ecdsa_ready";
     readonly ecdsa: {
         readonly walletKeys: readonly import("./registrationContracts").WalletRegistrationEcdsaWalletKey[];

package/dist/types/wallet-server/src/core/thresholdEcdsaChainTarget.d.ts

@@ -2,5 +2,4 @@ import { thresholdEcdsaChainTargetKey, type ThresholdEcdsaChainTargetWire } from
 export { thresholdEcdsaChainTargetKey };
 export type ThresholdEcdsaChainTarget = ThresholdEcdsaChainTargetWire;
 export declare function thresholdEcdsaChainTargetFromValue(value: unknown): ThresholdEcdsaChainTarget | null;
-export declare function thresholdEcdsaChainTargetsEqual(left: ThresholdEcdsaChainTarget, right: ThresholdEcdsaChainTarget): boolean;
 //# sourceMappingURL=thresholdEcdsaChainTarget.d.ts.map

package/dist/types/wallet-server/src/core/types.d.ts

@@ -1,6 +1,5 @@
 import { AuthenticatorOptions, UserVerificationPolicy, OriginPolicyInput } from '../../../shared-ts/src/utils/authenticatorOptions';
 import type { InitInput } from '../../../../wasm/near_signer/pkg/wasm_signer_worker.js';
-import type { Logger } from './logger';
 import type { Ed25519AuthorityScope } from '../../../shared-ts/src/threshold/sessionPolicy';
 import type { RuntimePolicyScope } from '../../../shared-ts/src/threshold/signingRootScope';
 import type { EcdsaClientRootPublicKey33B64u, DerivationClientSharePublicKey33B64u, EcdsaDerivationRoleLocalPublicIdentity } from '../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap';
@@ -30,16 +29,6 @@ export interface ServerResponse {
     body: string;
 }
 export type SignerWasmModuleSupplier = InitInput | Promise<InitInput> | (() => InitInput | Promise<InitInput>);
-export interface SignerWasmConfig {
-    /**
-     * Optional override for locating the signer WASM module. Useful for serverless
-     * runtimes (e.g. Workers) where filesystem-relative URLs are unavailable.
-     * Accepts any value supported by `initSignerWasm({ module_or_path })` or a
-     * function that resolves to one.
-     */
-    moduleOrPath?: SignerWasmModuleSupplier;
-}
-export type ThresholdEd25519KeyStoreKind = 'in-memory' | 'upstash-redis-rest' | 'redis-tcp' | 'cloudflare-do';
 export interface CloudflareDurableObjectStubLike {
     fetch(input: RequestInfo, init?: RequestInit): Promise<Response>;
 }
@@ -47,226 +36,11 @@ export interface CloudflareDurableObjectNamespaceLike {
     idFromName(name: string): unknown;
     get(id: unknown): CloudflareDurableObjectStubLike;
 }
-export type ThresholdStoreConfig = {
-    kind: 'in-memory';
-} | {
-    kind: 'upstash-redis-rest';
-    url: string;
-    token: string;
-    keyPrefix?: string;
-} | {
-    kind: 'redis-tcp';
-    redisUrl: string;
-    keyPrefix?: string;
-} | {
-    kind: 'cloudflare-do';
-    /**
-     * Durable Object namespace binding (e.g. `env.THRESHOLD_STORE`).
-     * Must point to a DO class implementing the SDK's threshold store protocol.
-     */
-    namespace: CloudflareDurableObjectNamespaceLike;
-    /**
-     * Optional DO instance name. Defaults to `threshold-store`.
-     * Use different names to isolate environments within the same Worker script.
-     */
-    name?: string;
-};
-/**
- * Env-shaped input for threshold key store selection.
- * - Upstash REST (Cloudflare-friendly): UPSTASH_REDIS_REST_URL + UPSTASH_REDIS_REST_TOKEN
- * - Redis TCP (Node-only): REDIS_URL
- */
-export type ThresholdStoreEnvInput = {
-    UPSTASH_REDIS_REST_URL?: string;
-    UPSTASH_REDIS_REST_TOKEN?: string;
-    REDIS_URL?: string;
-    /**
-     * Optional global base prefix for all threshold keyspaces.
-     *
-     * When set, and the more specific `THRESHOLD_ED25519_*_PREFIX` variables are not set,
-     * the SDK derives:
-     * - `THRESHOLD_ED25519_WALLET_SESSION_PREFIX` = `${THRESHOLD_PREFIX}:threshold-ed25519:wallet-session:`
-     * - `THRESHOLD_ED25519_SESSION_PREFIX` = `${THRESHOLD_PREFIX}:threshold-ed25519:sess:`
-     * - `THRESHOLD_ED25519_KEYSTORE_PREFIX` = `${THRESHOLD_PREFIX}:threshold-ed25519:key:`
-     * - `THRESHOLD_WALLET_SIGNING_BUDGET_SESSION_PREFIX` = `${THRESHOLD_PREFIX}:wallet-session:budget:`
-     *
-     * Trailing `:` is optional.
-     */
-    THRESHOLD_PREFIX?: string;
-    THRESHOLD_ED25519_KEYSTORE_PREFIX?: string;
-    THRESHOLD_ED25519_SESSION_PREFIX?: string;
-    THRESHOLD_ED25519_WALLET_SESSION_PREFIX?: string;
-    THRESHOLD_WALLET_SIGNING_BUDGET_SESSION_PREFIX?: string;
-    /**
-     * Ed25519 relayer-share source mode. This remains Ed25519-specific because
-     * it controls the Ed25519 threshold signing protocol, not the shared store.
-     */
-    THRESHOLD_ED25519_SHARE_MODE?: string;
-    /**
-     * Optional prefixes for threshold ECDSA key/session/Wallet Session storage.
-     * Defaults derive from `THRESHOLD_PREFIX` with a `threshold-ecdsa:*` namespace when unset.
-     */
-    THRESHOLD_ECDSA_KEYSTORE_PREFIX?: string;
-    THRESHOLD_ECDSA_SESSION_PREFIX?: string;
-    THRESHOLD_ECDSA_WALLET_SESSION_PREFIX?: string;
-    /**
-     * Optional override for the client FROST participant identifier (u16, >= 1).
-     * Must be distinct from `THRESHOLD_ED25519_RELAYER_PARTICIPANT_ID`.
-     */
-    THRESHOLD_ED25519_CLIENT_PARTICIPANT_ID?: string;
-    /**
-     * Optional override for the relayer FROST participant identifier (u16, >= 1).
-     * Must be distinct from `THRESHOLD_ED25519_CLIENT_PARTICIPANT_ID`.
-     */
-    THRESHOLD_ED25519_RELAYER_PARTICIPANT_ID?: string;
-    /**
-     * Threshold node role.
-     * - "coordinator" (default): exposes public registration/session routes and Router A/B bridge handlers.
-     * - "cosigner": exposes internal relayer-fleet t-of-n cosigning endpoints when configured.
-     */
-    THRESHOLD_NODE_ROLE?: string;
-    /**
-     * 32-byte base64url shared secret used to authenticate coordinator→peer calls.
-     *
-     * When set, cosigner relayers can expose internal endpoints that accept
-     * coordinator-signed grants (HMAC-SHA256).
-     */
-    THRESHOLD_COORDINATOR_SHARED_SECRET_B64U?: string;
-    /**
-     * Stable identifier for this coordinator instance.
-     *
-     * Used to pin Router A/B ECDSA derivation pool-fill sessions to the instance that
-     * created the live in-memory WASM session object.
-     */
-    THRESHOLD_COORDINATOR_INSTANCE_ID?: string;
-    /**
-     * Optional coordinator peer list (JSON) for cross-instance presign-step forwarding.
-     *
-     * Example:
-     * `THRESHOLD_COORDINATOR_PEERS=[{"instanceId":"coordinator-a","relayerUrl":"https://relay-a.internal"},{"instanceId":"coordinator-b","relayerUrl":"https://relay-b.internal"}]`
-     */
-    THRESHOLD_COORDINATOR_PEERS?: string;
-    /**
-     * Optional relayer-fleet cosigner list (JSON) for internal t-of-n cosigning.
-     *
-     * When configured on a coordinator node, the coordinator can fan out to relayer cosigners
-     * (internal-only nodes) and combine their partials into a single outer relayer signature share.
-     *
-     * Example:
-     * `THRESHOLD_ED25519_RELAYER_COSIGNERS=[{"cosignerId":1,"relayerUrl":"https://cosigner-a.internal"},{"cosignerId":2,"relayerUrl":"https://cosigner-b.internal"},{"cosignerId":3,"relayerUrl":"https://cosigner-c.internal"}]`
-     */
-    THRESHOLD_ED25519_RELAYER_COSIGNERS?: string;
-    /**
-     * Internal relayer cosigner id for this node (u16, >= 1).
-     * Required when running `THRESHOLD_NODE_ROLE=cosigner`.
-     */
-    THRESHOLD_ED25519_RELAYER_COSIGNER_ID?: string;
-    /**
-     * Internal relayer cosigner threshold `T` (integer, >= 1).
-     * When set together with `THRESHOLD_ED25519_RELAYER_COSIGNERS`, the coordinator will wait for
-     * `T` cosigners per signing round.
-     */
-    THRESHOLD_ED25519_RELAYER_COSIGNER_T?: string;
-    /**
-     * Optional Router A/B Ed25519 normal-signing SigningWorker id accepted by
-     * threshold session policy. When unset, Router A/B normal-signing session
-     * policy is rejected.
-     */
-    ROUTER_AB_NORMAL_SIGNING_WORKER_ID?: string;
-    /** Private Router A/B SigningWorker base URL. */
-    ROUTER_AB_SIGNING_WORKER_URL?: string;
-    /** Secret value sent in `x-router-ab-internal-service-auth` to private workers. */
-    ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET?: string;
-    /** Fetch transport for hosted runtimes that reach the SigningWorker through a service binding. */
-    routerAbSigningWorkerFetch?: typeof globalThis.fetch;
-    /** Signing-session seal root plus public rotation configuration. */
-    SIGNING_SESSION_SEAL_ROOT_SECRET_B64U?: string;
-    SIGNING_SESSION_SEAL_CURRENT_KEY_VERSION?: string;
-    SIGNING_SESSION_SEAL_ACCEPTED_WARM_KEY_VERSIONS?: string;
-    /** Optional signing session-seal idempotency backend configuration. */
-    SIGNING_SESSION_SEAL_IDEMPOTENCY_KIND?: string;
-    SIGNING_SESSION_SEAL_IDEMPOTENCY_UPSTASH_URL?: string;
-    SIGNING_SESSION_SEAL_IDEMPOTENCY_UPSTASH_TOKEN?: string;
-    SIGNING_SESSION_SEAL_IDEMPOTENCY_REDIS_URL?: string;
-    SIGNING_SESSION_SEAL_IDEMPOTENCY_KEY_PREFIX?: string;
-    SIGNING_SESSION_SEAL_IDEMPOTENCY_TTL_MS?: string;
-};
-/**
- * Threshold key store config input.
- *
- * Accepts either:
- * - an env-shaped object (for ergonomics in server examples), or
- * - an explicit `kind` object, optionally augmented with env-shaped overrides
- *   (useful when wiring via code but still wanting env vars like THRESHOLD_NODE_ROLE).
- */
-export type ThresholdStoreConfigInput = ThresholdStoreEnvInput | (ThresholdStoreConfig & Partial<ThresholdStoreEnvInput>);
-export interface AuthServiceConfig {
-    relayerAccount: string;
-    relayerPrivateKey: string;
-    nearRpcUrl: string;
-    networkId: string;
-    accountInitialBalance: string;
-    createAccountAndRegisterGas: string;
-    signerWasm?: SignerWasmConfig;
-    /**
-     * Optional persistence for relayer-held threshold signing shares.
-     * Defaults to in-memory unless env-shaped config enables Redis/Upstash.
-     */
-    thresholdStore?: ThresholdStoreConfigInput;
-    /**
-     * Optional logger. When unset, the server SDK is silent (no `console.*`).
-     * Pass `logger: console` to enable default logging.
-     */
-    logger?: Logger | null;
-    /**
-     * Optional Google OIDC configuration for verifying Google `id_token` login sessions.
-     */
-    googleOidc?: GoogleOidcConfig;
-    /**
-     * Optional GitHub OAuth configuration for exchanging authorization codes.
-     */
-    githubOAuth?: GithubOAuthConfig;
-}
-export type GoogleOidcConfig = {
-    /** Allowed OAuth client ids (audiences) for Google ID tokens. */
-    clientIds: string[];
-    /** Optional hosted domain allowlist (the `hd` claim). */
-    hostedDomains?: string[];
-};
-export interface GoogleOidcConfigEnvInput {
-    /** Single client id convenience. */
-    GOOGLE_OIDC_CLIENT_ID?: string;
-    /** Comma-separated client ids. */
-    GOOGLE_OIDC_CLIENT_IDS?: string;
-    /** Optional comma-separated hosted domains (`hd` claim). */
-    GOOGLE_OIDC_HOSTED_DOMAINS?: string;
-}
-export type GoogleOidcConfigInput = GoogleOidcConfig | GoogleOidcConfigEnvInput;
 export type GithubOAuthConfig = {
     clientId: string;
     clientSecret: string;
     callbackUrl: string;
 };
-export interface GithubOAuthConfigEnvInput {
-    GITHUB_OAUTH_CLIENT_ID?: string;
-    GITHUB_OAUTH_CLIENT_SECRET?: string;
-    GITHUB_OAUTH_CALLBACK_URL?: string;
-}
-export type GithubOAuthConfigInput = GithubOAuthConfig | GithubOAuthConfigEnvInput;
-/**
- * User-facing input shape for `AuthService`. Fields that have SDK defaults are optional here.
- *
- * Defaults are applied by `createAuthServiceConfig(...)` and the AuthService constructor.
- */
-export type AuthServiceConfigInput = Omit<AuthServiceConfig, 'nearRpcUrl' | 'networkId' | 'accountInitialBalance' | 'createAccountAndRegisterGas' | 'thresholdStore' | 'googleOidc' | 'githubOAuth'> & {
-    nearRpcUrl?: string;
-    networkId?: string;
-    accountInitialBalance?: string;
-    createAccountAndRegisterGas?: string;
-    thresholdStore?: ThresholdStoreConfigInput;
-    googleOidc?: GoogleOidcConfigInput;
-    githubOAuth?: GithubOAuthConfigInput;
-};
 export interface AccountCreationRequest {
     accountId: string;
     publicKey: string;
@@ -438,53 +212,6 @@ export interface ThresholdEd25519SessionResponse {
     runtimePolicyScope?: ThresholdRuntimePolicyScope;
     routerAbNormalSigning?: RouterAbEd25519NormalSigningState;
 }
-export interface ThresholdEd25519CosignInitRequest {
-    coordinatorGrant: string;
-    signingSessionId: string;
-    /**
-     * Base64url-encoded 32-byte relayer cosigner signing share (a secret share; unweighted).
-     * The cosigner derives its effective outer-protocol share from this and the selected cosigner set.
-     */
-    cosignerShareB64u: string;
-    clientCommitments: {
-        hiding: string;
-        binding: string;
-    };
-}
-export interface ThresholdEd25519CosignInitResponse {
-    ok: boolean;
-    code?: string;
-    message?: string;
-    relayerCommitments?: {
-        hiding: string;
-        binding: string;
-    };
-}
-export interface ThresholdEd25519CosignFinalizeRequest {
-    coordinatorGrant: string;
-    signingSessionId: string;
-    /**
-     * The selected cosigner id set used for internal Lagrange interpolation.
-     * Must include this cosigner's configured id.
-     */
-    cosignerIds: number[];
-    /** NEAR ed25519 public key string (`ed25519:<base58>`). */
-    groupPublicKey: string;
-    /**
-     * The combined outer-protocol relayer commitments (sum across the selected cosigners).
-     * This must match what the client used for its signing transcript.
-     */
-    relayerCommitments: {
-        hiding: string;
-        binding: string;
-    };
-}
-export interface ThresholdEd25519CosignFinalizeResponse {
-    ok: boolean;
-    code?: string;
-    message?: string;
-    relayerSignatureShareB64u?: string;
-}
 export type ThresholdEcdsaPurpose = string;
 export type EcdsaThresholdKeyId = string;
 export type ThresholdEcdsaChainTarget = import('./thresholdEcdsaChainTarget').ThresholdEcdsaChainTarget;
@@ -600,7 +327,6 @@ export interface EcdsaDerivationServerBootstrapResponse {
     publicIdentity: EcdsaDerivationPublicIdentity;
     clientShareRetryCounter: number;
     relayerShareRetryCounter: number;
-    publicTranscriptDigest32B64u: string;
     keyHandle: string;
     signingRootId: string;
     signingRootVersion: string;
@@ -705,29 +431,4 @@ export type RouterAbEcdsaDerivationPoolFillStepResponse = {
     /** Base64url-encoded compressed secp256k1 point (33 bytes) for `R` (only present when `event==='presign_done'`). */
     bigRB64u?: string;
 };
-export interface ThresholdEcdsaCosignInitRequest {
-    coordinatorGrant: string;
-    signingSessionId: string;
-    cosignerShareB64u: string;
-    clientRound1?: unknown;
-}
-export interface ThresholdEcdsaCosignInitResponse {
-    ok: boolean;
-    code?: string;
-    message?: string;
-    relayerRound1?: unknown;
-}
-export interface ThresholdEcdsaCosignFinalizeRequest {
-    coordinatorGrant: string;
-    signingSessionId: string;
-    cosignerIds: number[];
-    groupPublicKey: string;
-    relayerRound1?: unknown;
-}
-export interface ThresholdEcdsaCosignFinalizeResponse {
-    ok: boolean;
-    code?: string;
-    message?: string;
-    relayerRound2?: unknown;
-}
 //# sourceMappingURL=types.d.ts.map