@seams/wallet 0.6.1 → 0.7.1

package/dist/types/wallet/src/core/indexedDB/seamsWalletDB/ecdsaCapabilityManifestStore.d.ts

@@ -1,144 +1,19 @@
-import { type CorrelationId, type DigestB64u, type IsoTimestamp } from '../../../../../shared-ts/src/utils/canonicalPrimitives';
-import { type CapabilityInstanceRef, type MpcMaterialActivationRef, type WalletAuthMethodId, type WalletAuthorityId, type WalletId } from '../../../../../shared-ts/src/utils/domainIds';
-import { type EcdsaMaterialSealingKeyId } from '../../../../../shared-ts/src/utils/ecdsaCapabilityActivation';
-import { normalizeRuntimePolicyScope, type RuntimePolicyScope } from '../../../../../shared-ts/src/threshold/signingRootScope';
-import { type RouterAbEcdsaDerivationNormalSigningStateV1, type RouterAbEcdsaDerivationPublicCapabilityV1, type RouterAbEcdsaRegistrationActivationReceiptV1 } from '../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
-import { type WalletAuthAuthorityRef } from '../../../../../shared-ts/src/utils/walletAuthAuthority';
+import { type CorrelationId, type IsoTimestamp } from '../../../../../shared-ts/src/utils/canonicalPrimitives';
+import { type MpcMaterialActivationRef, type WalletId } from '../../../../../shared-ts/src/utils/domainIds';
+import { normalizeRuntimePolicyScope } from '../../../../../shared-ts/src/threshold/signingRootScope';
+import { type RouterAbEcdsaDerivationNormalSigningStateV1 } from '../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
+import type { WalletAuthAuthorityRef } from '../../../../../shared-ts/src/utils/walletAuthAuthority';
 import { type EcdsaRoleLocalPublicFacts } from '../../platform';
-import { parseEcdsaThresholdKeyId, type EcdsaRoleLocalPersistedMaterialRef } from '../../signingEngine/session/keyMaterialBrands';
-import { type ActiveEcdsaCapabilityManifest, type BuildPreparedEcdsaActivationJournalInput, type EcdsaActivationBinding, type EcdsaCapabilityActivationCommitJournal, type ServerReturnedEcdsaActivationCommit, type EcdsaServerActivationCommit, type PreparedEcdsaActivationJournal, type ReplacedEcdsaCapabilityManifest, type ServerCommittedEcdsaActivationJournal, type ValidatedEncryptedEcdsaReadyMaterial } from '../../signingEngine/session/material/ecdsaCapabilityManifest';
+import { type EcdsaRoleLocalPersistedMaterialRef } from '../../signingEngine/session/keyMaterialBrands';
+import { type ActiveEcdsaCapabilityManifest, type EcdsaActivationBinding, type ServerReturnedEcdsaActivationCommit, type EcdsaServerActivationCommit, type PreparedEcdsaActivationJournal, type ServerCommittedEcdsaActivationJournal, type ValidatedEncryptedEcdsaReadyMaterial } from '../../signingEngine/session/material/ecdsaCapabilityManifest';
 import type { VerifiedEcdsaPublicFacts } from '../../signingEngine/session/identity/evmFamilyEcdsaIdentity';
-import type { ThresholdEcdsaChainTarget } from '../../platform/types';
-import type { WalletCustodyEvmFamilyPublicFacts } from '../../../../../shared-ts/src/passkey-custody';
 import type { SeamsWalletDBManager, SeamsWalletTransactionContext } from './manager';
 import { type EcdsaClientPresignPoolIdentity } from '../../signingEngine/workerManager/ecdsaPresignPoolIdentity';
-import { type EcdsaClientPresignCleanupTarget, type EcdsaClientPresignUnavailableReason } from '../../signingEngine/workerManager/ecdsaPresignLifecycle';
-export type DurableClientPresignatureRecordId = string & {
-    readonly __brand: 'DurableClientPresignatureRecordId';
-};
-export type DurableClientPresignatureMetadata = {
-    readonly kind: 'sealed_available_client_presignature_v1';
-    readonly recordId: DurableClientPresignatureRecordId;
-    readonly poolIdentity: EcdsaClientPresignPoolIdentity;
-    readonly durableMaterialRef: EcdsaRoleLocalPersistedMaterialRef;
-    readonly presignatureId: string;
-    readonly groupPublicKey33B64u: string;
-    readonly bigR33B64u: string;
-    readonly createdAtMs: number;
-    readonly expiresAtMs: number;
-    readonly sealingKeyId: EcdsaMaterialSealingKeyId;
-};
-export type DurableClientPresignatureAdmissionResult = {
-    readonly kind: 'stored';
-    readonly metadata: DurableClientPresignatureMetadata;
-} | {
-    readonly kind: 'capacity_full';
-} | {
-    readonly kind: 'persistence_unavailable';
-} | {
-    readonly kind: 'persistence_ambiguous';
-};
-export type DurableClientPresignatureAdmissionInput = {
-    readonly poolIdentity: EcdsaClientPresignPoolIdentity;
-    readonly durableMaterialRef: EcdsaRoleLocalPersistedMaterialRef;
-    readonly presignatureId: string;
-    readonly groupPublicKey33: Uint8Array;
-    readonly bigR33: Uint8Array;
-    readonly plaintext97: Uint8Array;
-    readonly createdAtMs: number;
-    readonly expiresAtMs: number;
-};
-export type DurableClientPresignatureTakeResult = {
-    readonly kind: 'opened';
-    readonly metadata: DurableClientPresignatureMetadata;
-    readonly plaintext97: Uint8Array;
-} | {
-    readonly kind: Exclude<EcdsaClientPresignUnavailableReason, 'not_found'>;
-};
-export type EcdsaCapabilitySelector = {
-    readonly capability: CapabilityInstanceRef;
-    readonly authority: WalletAuthAuthorityRef;
-};
-export type ActiveEcdsaWalletCapabilitySubject = EcdsaCapabilitySelector & {
-    readonly ecdsaThresholdKeyId: ReturnType<typeof parseEcdsaThresholdKeyId>;
-};
-export type ActiveEcdsaWalletCapabilitySubjectListResult = {
-    readonly kind: 'resolved';
-    readonly subjects: readonly ActiveEcdsaWalletCapabilitySubject[];
-} | {
-    readonly kind: 'invalid_current_state';
-    readonly subjects?: never;
-} | {
-    readonly kind: 'persistence_unavailable';
-    readonly subjects?: never;
-};
-export type EcdsaWalletActivationSelectorListResult = {
-    readonly kind: 'resolved';
-    readonly selectors: readonly EcdsaCapabilitySelector[];
-} | {
-    readonly kind: 'invalid_current_state';
-    readonly selectors?: never;
-} | {
-    readonly kind: 'persistence_unavailable';
-    readonly selectors?: never;
-};
-type LookupFailureExclusions = {
-    readonly manifest?: never;
-    readonly material?: never;
-};
-export type EcdsaCapabilityManifestLookup = {
-    readonly kind: 'active';
-    readonly manifest: ActiveEcdsaCapabilityManifest;
-    readonly material: ValidatedEncryptedEcdsaReadyMaterial;
-} | {
-    readonly kind: 'retired';
-    readonly manifest: ReplacedEcdsaCapabilityManifest;
-    readonly material?: never;
-} | ({
-    readonly kind: 'missing';
-    readonly selector: EcdsaCapabilitySelector;
-    readonly subject: 'capability' | 'material';
-} & LookupFailureExclusions) | ({
-    readonly kind: 'exact_binding_mismatch';
-    readonly selector: EcdsaCapabilitySelector;
-    readonly failureDigest: DigestB64u;
-} & LookupFailureExclusions) | ({
-    readonly kind: 'exact_record_conflict';
-    readonly selector: EcdsaCapabilitySelector;
-    readonly conflictDigest: DigestB64u;
-} & LookupFailureExclusions) | ({
-    readonly kind: 'corrupt';
-    readonly selector: EcdsaCapabilitySelector;
-    readonly corruptionDigest: DigestB64u;
-} & LookupFailureExclusions) | ({
-    readonly kind: 'persistence_unavailable';
-    readonly selector: EcdsaCapabilitySelector;
-    readonly retryCorrelation: CorrelationId;
-} & LookupFailureExclusions);
-export type EcdsaActivationJournalWriteResult<TJournal extends EcdsaCapabilityActivationCommitJournal = EcdsaCapabilityActivationCommitJournal> = {
-    readonly kind: 'stored';
-    readonly journal: TJournal;
-} | {
-    readonly kind: 'exact_record_conflict';
-    readonly conflictDigest: DigestB64u;
-    readonly journal?: never;
-} | {
-    readonly kind: 'corrupt';
-    readonly corruptionDigest: DigestB64u;
-    readonly journal?: never;
-} | {
-    readonly kind: 'persistence_unavailable';
-    readonly retryCorrelation: CorrelationId;
-    readonly journal?: never;
-};
-export type EcdsaActivationJournalReadResult = {
-    readonly kind: 'found';
-    readonly journal: EcdsaCapabilityActivationCommitJournal;
-} | {
-    readonly kind: 'missing' | 'corrupt' | 'persistence_unavailable';
-    readonly journal?: never;
-};
-export type EcdsaPreparedActivationCancellationResult = {
+import { type EcdsaClientPresignCleanupTarget } from '../../signingEngine/workerManager/ecdsaPresignLifecycle';
+import { type EcdsaCapabilitySelector, type PrepareEcdsaCapabilityActivationInput } from './ecdsaCapabilityManifestRecords';
+import { type DurableClientPresignatureMetadata, type DurableClientPresignatureAdmissionResult, type DurableClientPresignatureAdmissionInput, type DurableClientPresignatureTakeResult } from './ecdsaClientPresignatures';
+import { type ActiveEcdsaWalletCapabilitySubjectListResult, type EcdsaWalletActivationSelectorListResult, type EcdsaCapabilityManifestLookup, type EcdsaActivationJournalWriteResult, type EcdsaActivationJournalReadResult, type EcdsaPreparedActivationOpenResult, type EcdsaActiveMaterialOpenResult, type EcdsaActiveMaterialRefOpenResult, type EcdsaCapabilityMaterialRefLookup, type EcdsaCapabilityActivationLookup, type EcdsaCapabilityActivationFinalizationResult } from './ecdsaCapabilityManifestLookups';
+type EcdsaPreparedActivationCancellationResult = {
     readonly kind: 'cancelled';
 } | {
     readonly kind: 'missing';
@@ -151,21 +26,11 @@ export type EcdsaPreparedActivationCancellationResult = {
 } | {
     readonly kind: 'persistence_unavailable';
 };
-export type FinalizeEcdsaCapabilityActivationInput = {
-    readonly committedJournal: ServerCommittedEcdsaActivationJournal;
-    readonly readyMaterial: ValidatedEncryptedEcdsaReadyMaterial;
-    readonly activeManifest: ActiveEcdsaCapabilityManifest;
-};
-type PreparedJournalInputWithoutCandidate<T> = T extends unknown ? Omit<T, 'candidate'> : never;
-export type PrepareEcdsaCapabilityActivationInput = PreparedJournalInputWithoutCandidate<BuildPreparedEcdsaActivationJournalInput> & {
-    readonly activationBinding: EcdsaActivationBinding;
-    readonly pendingPayloadB64u: string;
-};
-export type RecordEcdsaServerActivationInput = {
+type RecordEcdsaServerActivationInput = {
     readonly preparedJournal: PreparedEcdsaActivationJournal;
     readonly serverCommit: ServerReturnedEcdsaActivationCommit;
 };
-export type SealEcdsaCapabilityActivationInput = {
+type SealEcdsaCapabilityActivationInput = {
     readonly committedJournal: ServerCommittedEcdsaActivationJournal;
     readonly readyStateBlobB64u: string;
     readonly registeredPublicFacts: VerifiedEcdsaPublicFacts;
@@ -192,78 +57,9 @@ export type PreparedImportedWalletCustodyEcdsaContinuity = {
     readonly activeManifest: ActiveEcdsaCapabilityManifest;
     readonly roleLocalMaterialRef: EcdsaRoleLocalPersistedMaterialRef;
 };
-export type EcdsaPreparedActivationOpenResult = {
-    readonly kind: 'found';
-    readonly journal: EcdsaCapabilityActivationCommitJournal;
-    readonly pendingPayloadB64u: string;
-} | {
-    readonly kind: 'missing' | 'corrupt' | 'persistence_unavailable';
-    readonly journal?: never;
-    readonly pendingPayloadB64u?: never;
-};
-export type EcdsaActiveMaterialOpenResult = {
-    readonly kind: 'active';
-    readonly manifest: ActiveEcdsaCapabilityManifest;
-    readonly readyStateBlobB64u: string;
-} | Exclude<EcdsaCapabilityManifestLookup, {
-    readonly kind: 'active';
-}>;
-export type EcdsaActiveMaterialRefOpenResult = {
-    readonly kind: 'active';
-    readonly manifest: ActiveEcdsaCapabilityManifest;
-    readonly readyStateBlobB64u: string;
-} | {
-    readonly kind: 'missing' | 'binding_mismatch' | 'corrupt' | 'persistence_unavailable';
-    readonly manifest?: never;
-    readonly readyStateBlobB64u?: never;
-};
-type EcdsaCapabilityMaterialRefLookupFailure = {
-    readonly kind: 'missing';
-    readonly subject: 'capability' | 'material';
-    readonly capability: CapabilityInstanceRef;
-} | {
-    readonly kind: 'exact_binding_mismatch' | 'exact_record_conflict' | 'corrupt' | 'persistence_unavailable';
-    readonly capability: CapabilityInstanceRef;
-    readonly subject?: never;
-};
-export type EcdsaCapabilityMaterialRefLookup = Extract<EcdsaCapabilityManifestLookup, {
-    readonly kind: 'active' | 'retired';
-}> | EcdsaCapabilityMaterialRefLookupFailure;
-/**
- * R109C: one cryptographic activation can back several exact method-bound
- * access projections, one per wallet auth method installed on the same wallet
- * authority. A material activation therefore no longer names one manifest.
- * A caller that does not say which method it is acting as gets
- * `ambiguous_authority` and must ask again with the exact authority; picking a
- * sibling here would silently sign under a credential the caller never named.
- */
-export type EcdsaCapabilityActivationLookup = Extract<EcdsaCapabilityManifestLookup, {
-    readonly kind: 'active' | 'retired';
-}> | EcdsaCapabilityMaterialRefLookupFailure | {
-    readonly kind: 'ambiguous_authority';
-    readonly capability: CapabilityInstanceRef;
-    readonly authorities: readonly WalletAuthAuthorityRef[];
-    readonly subject?: never;
-};
-export type EcdsaCapabilityActivationFinalizationResult = {
-    readonly kind: 'committed';
-    readonly manifest: ActiveEcdsaCapabilityManifest;
-    readonly material: ValidatedEncryptedEcdsaReadyMaterial;
-} | ({
-    readonly kind: 'exact_record_conflict';
-    readonly selector: EcdsaCapabilitySelector;
-    readonly conflictDigest: DigestB64u;
-} & LookupFailureExclusions) | ({
-    readonly kind: 'corrupt';
-    readonly selector: EcdsaCapabilitySelector;
-    readonly corruptionDigest: DigestB64u;
-} & LookupFailureExclusions) | ({
-    readonly kind: 'persistence_unavailable';
-    readonly selector: EcdsaCapabilitySelector;
-    readonly retryCorrelation: CorrelationId;
-} & LookupFailureExclusions);
 export declare function prepareImportedWalletCustodyEcdsaContinuity(input: ImportCommittedWalletCustodyEcdsaActivationInput): Promise<PreparedImportedWalletCustodyEcdsaContinuity>;
 export declare function persistPreparedImportedWalletCustodyEcdsaContinuityInTransaction(context: SeamsWalletTransactionContext, prepared: PreparedImportedWalletCustodyEcdsaContinuity): Promise<void>;
+export declare function importCommittedActivation(store: IndexedDbEcdsaCapabilityManifestStore, input: ImportCommittedWalletCustodyEcdsaActivationInput, persist: (prepared: PreparedImportedWalletCustodyEcdsaContinuity) => Promise<void>): Promise<EcdsaCapabilityActivationFinalizationResult>;
 export declare class IndexedDbEcdsaCapabilityManifestStore {
     private readonly manager;
     constructor(manager?: SeamsWalletDBManager);
@@ -306,42 +102,5 @@ export declare class IndexedDbEcdsaCapabilityManifestStore {
     private readMaterialSealingKey;
     private finalizeActivation;
 }
-export type ImportWalletCustodyEcdsaContinuityInput = {
-    readonly store: IndexedDbEcdsaCapabilityManifestStore;
-    readonly authority: WalletAuthAuthorityRef;
-    readonly chainTargets: readonly [ThresholdEcdsaChainTarget, ...ThresholdEcdsaChainTarget[]];
-    readonly walletId: string;
-    readonly keyHandle: string;
-    readonly ecdsaThresholdKeyId: string;
-    readonly signingRootId: string;
-    readonly signingRootVersion: string;
-    readonly relayerKeyId: string;
-    readonly participantIds: readonly [number, number];
-    readonly publicCapability: RouterAbEcdsaDerivationPublicCapabilityV1;
-    readonly activationReceipt: RouterAbEcdsaRegistrationActivationReceiptV1;
-    readonly runtimePolicyScope: RuntimePolicyScope;
-    readonly readyStateBlobB64u: string;
-    readonly publicFacts: WalletCustodyEvmFamilyPublicFacts;
-};
-type WalletCustodyEcdsaContinuityInput = Omit<ImportWalletCustodyEcdsaContinuityInput, 'store'>;
-export declare function prepareWalletCustodyEcdsaContinuity(input: WalletCustodyEcdsaContinuityInput): Promise<PreparedImportedWalletCustodyEcdsaContinuity>;
-export declare function importWalletCustodyEcdsaContinuity(input: ImportWalletCustodyEcdsaContinuityInput): Promise<EcdsaCapabilityActivationFinalizationResult>;
-/**
- * R109C: give an added auth method its own encrypted access projection over the
- * activation the wallet already has. The activation is not re-created and the
- * source credential's authority is not widened; only a second method-bound
- * record over the same material appears.
- *
- * The membership check is the whole safety argument. Copying access to a method
- * on another wallet authority would hand that credential custody it was never
- * granted, so both methods are read back and required to be active members of
- * the exact same authority before anything is opened.
- */
-export declare function copyWalletCustodyEcdsaContinuityToAuthMethod(input: {
-    readonly walletId: WalletId;
-    readonly walletAuthorityId: WalletAuthorityId;
-    readonly sourceWalletAuthMethodId: WalletAuthMethodId;
-    readonly targetAuthority: WalletAuthAuthorityRef;
-}): Promise<void>;
 export {};
 //# sourceMappingURL=ecdsaCapabilityManifestStore.d.ts.map

package/dist/types/wallet/src/core/indexedDB/seamsWalletDB/ecdsaClientPresignatures.d.ts

@@ -0,0 +1,101 @@
+import { parseEcdsaCiphertextB64u, parseEcdsaCiphertextDigest, parseEcdsaIv12B64u, type EcdsaMaterialSealingKeyId } from '../../../../../shared-ts/src/utils/ecdsaCapabilityActivation';
+import { type EcdsaRoleLocalPersistedMaterialRef } from '../../signingEngine/session/keyMaterialBrands';
+import type { ValidatedEncryptedEcdsaReadyMaterial } from '../../signingEngine/session/material/ecdsaCapabilityManifest';
+import type { SeamsWalletTransactionContext } from './manager';
+import { type EcdsaClientPresignPoolIdentity } from '../../signingEngine/workerManager/ecdsaPresignPoolIdentity';
+import { type EcdsaClientPresignUnavailableReason } from '../../signingEngine/workerManager/ecdsaPresignLifecycle';
+export declare const MAX_DURABLE_CLIENT_PRESIGNATURE_FUTURE_SKEW_MS: number;
+type DurableClientPresignatureRecordId = string & {
+    readonly __brand: 'DurableClientPresignatureRecordId';
+};
+export type DurableClientPresignatureMetadata = {
+    readonly kind: 'sealed_available_client_presignature_v1';
+    readonly recordId: DurableClientPresignatureRecordId;
+    readonly poolIdentity: EcdsaClientPresignPoolIdentity;
+    readonly durableMaterialRef: EcdsaRoleLocalPersistedMaterialRef;
+    readonly presignatureId: string;
+    readonly groupPublicKey33B64u: string;
+    readonly bigR33B64u: string;
+    readonly createdAtMs: number;
+    readonly expiresAtMs: number;
+    readonly sealingKeyId: EcdsaMaterialSealingKeyId;
+};
+export type DurableClientPresignatureAdmissionResult = {
+    readonly kind: 'stored';
+    readonly metadata: DurableClientPresignatureMetadata;
+} | {
+    readonly kind: 'capacity_full';
+} | {
+    readonly kind: 'persistence_unavailable';
+} | {
+    readonly kind: 'persistence_ambiguous';
+};
+export type DurableClientPresignatureAdmissionInput = {
+    readonly poolIdentity: EcdsaClientPresignPoolIdentity;
+    readonly durableMaterialRef: EcdsaRoleLocalPersistedMaterialRef;
+    readonly presignatureId: string;
+    readonly groupPublicKey33: Uint8Array;
+    readonly bigR33: Uint8Array;
+    readonly plaintext97: Uint8Array;
+    readonly createdAtMs: number;
+    readonly expiresAtMs: number;
+};
+export type DurableClientPresignatureTakeResult = {
+    readonly kind: 'opened';
+    readonly metadata: DurableClientPresignatureMetadata;
+    readonly plaintext97: Uint8Array;
+} | {
+    readonly kind: Exclude<EcdsaClientPresignUnavailableReason, 'not_found'>;
+};
+export type SealedAvailableClientPresignatureRow = {
+    readonly kind: 'sealed_available_client_presignature_v1';
+    readonly record_id: DurableClientPresignatureRecordId;
+    readonly pool_identity: EcdsaClientPresignPoolIdentity;
+    readonly pool_identity_key: string;
+    readonly wallet_id: string;
+    readonly material_activation_id: string;
+    readonly durable_material_ref: EcdsaRoleLocalPersistedMaterialRef;
+    readonly presignature_id: string;
+    readonly group_public_key33_b64u: string;
+    readonly big_r33_b64u: string;
+    readonly created_at_ms: number;
+    readonly expires_at_ms: number;
+    readonly sealed: {
+        readonly kind: 'ecdsa_activation_aes_gcm_v1';
+        readonly sealing_key_id: EcdsaMaterialSealingKeyId;
+        readonly iv12_b64u: string;
+        readonly ciphertext_b64u: string;
+        readonly ciphertext_digest_b64u: string;
+    };
+};
+export declare function activeMaterialMatchesPresignature(material: ValidatedEncryptedEcdsaReadyMaterial, poolIdentity: EcdsaClientPresignPoolIdentity, materialRef: EcdsaRoleLocalPersistedMaterialRef): boolean;
+export declare function materialRefMatchesPoolIdentity(materialRef: EcdsaRoleLocalPersistedMaterialRef, poolIdentity: EcdsaClientPresignPoolIdentity): boolean;
+export declare function parseDurableClientPresignatureRecordId(value: unknown): DurableClientPresignatureRecordId;
+export declare function parsePresignatureTimestamp(value: unknown, label: string): number;
+export declare function rawRecordId(value: unknown): string | null;
+export declare function supportsStrictIndexedDbDurability(): boolean;
+type DeletableCursor = {
+    delete(): Promise<void>;
+    continue(): Promise<DeletableCursor | null>;
+};
+export declare function deleteCursorRows(cursor: DeletableCursor | null, limit?: number): Promise<number>;
+export declare function readAvailableClientPresignatureRows(context: SeamsWalletTransactionContext, poolIdentity: EcdsaClientPresignPoolIdentity, nowMs: number): Promise<SealedAvailableClientPresignatureRow[]>;
+export declare function parseSealedAvailableClientPresignatureRow(value: unknown): SealedAvailableClientPresignatureRow;
+export declare function metadataFromPresignatureRow(row: SealedAvailableClientPresignatureRow): DurableClientPresignatureMetadata;
+export declare function encryptPresignatureBytes(input: {
+    readonly key: CryptoKey;
+    readonly plaintext97: Uint8Array;
+    readonly metadata: DurableClientPresignatureMetadata;
+}): Promise<{
+    readonly iv12B64u: ReturnType<typeof parseEcdsaIv12B64u>;
+    readonly ciphertextB64u: ReturnType<typeof parseEcdsaCiphertextB64u>;
+    readonly ciphertextDigestB64u: ReturnType<typeof parseEcdsaCiphertextDigest>;
+}>;
+export declare function decryptPresignatureBytes(input: {
+    readonly key: CryptoKey;
+    readonly metadata: DurableClientPresignatureMetadata;
+    readonly sealed: SealedAvailableClientPresignatureRow['sealed'];
+}): Promise<Uint8Array>;
+export declare function retireClientPresignaturesForActivationInTransaction(context: SeamsWalletTransactionContext, walletId: string, materialActivationId: string): Promise<void>;
+export {};
+//# sourceMappingURL=ecdsaClientPresignatures.d.ts.map

package/dist/types/wallet/src/core/indexedDB/seamsWalletDB/laneHolderMaterialStore.d.ts

@@ -36,7 +36,6 @@ export type LaneSealedHolderMaterialRepositoryV1 = {
     }): Promise<readonly LaneSealedHolderRecordV1[]>;
     delete(input: LaneSealedHolderRecordLookupV1): Promise<void>;
 };
-export declare function parseLaneSealedHolderRecordV1(value: unknown): LaneSealedHolderRecordV1;
 export declare class LaneSealedHolderMaterialRepository implements LaneSealedHolderMaterialRepositoryV1 {
     private readonly seals;
     private readonly volatileRecords;

package/dist/types/wallet/src/core/indexedDB/seamsWalletDB/manager.d.ts

@@ -1,7 +1,7 @@
 import { type IDBPDatabase } from 'idb';
 import { type SeamsWalletDBConfig } from './schema';
 import { SEAMS_WALLET_DB_NAME, type SeamsWalletStoreName } from '../schemaNames';
-export type SeamsWalletTransactionMode = 'readonly' | 'readwrite';
+type SeamsWalletTransactionMode = 'readonly' | 'readwrite';
 export type SeamsWalletTransactionContext = {
     db: IDBPDatabase;
     tx: any;
@@ -22,4 +22,5 @@ export declare class SeamsWalletDBManager {
         readonly durability?: IDBTransactionDurability;
     }): Promise<T>;
 }
+export {};
 //# sourceMappingURL=manager.d.ts.map

package/dist/types/wallet/src/core/indexedDB/seamsWalletDB/pendingWalletRecoveryCodeBackup.d.ts

@@ -1,10 +1,10 @@
 import { type WalletRecoveryCodeSet } from '../../../../../shared-ts/src/wallet-recovery';
-export type PendingWalletRecoveryCodeBackup = {
+type PendingWalletRecoveryCodeBackup = {
     readonly walletId: string;
     readonly issuedAtMs: number;
     readonly recoveryCodes: WalletRecoveryCodeSet;
 };
-export declare class PendingWalletRecoveryCodeBackupRepository {
+declare class PendingWalletRecoveryCodeBackupRepository {
     write(input: {
         readonly walletId: string;
         readonly recoveryCodes: readonly string[];
@@ -15,4 +15,5 @@ export declare class PendingWalletRecoveryCodeBackupRepository {
     delete(walletIdInput: string): Promise<void>;
 }
 export declare const pendingWalletRecoveryCodeBackupRepository: PendingWalletRecoveryCodeBackupRepository;
+export {};
 //# sourceMappingURL=pendingWalletRecoveryCodeBackup.d.ts.map

package/dist/types/wallet/src/core/indexedDB/seamsWalletDB/repositories.d.ts

@@ -1,9 +1,9 @@
-import { type WalletRecoveryOperationId, type WalletAuthMethodId, type WalletAuthorityId, type WalletId } from '../../../../../shared-ts/src/utils/domainIds';
-import { type WalletAuthMethodRecordV2 } from '../../../../../shared-ts/src/utils/registrationIntent';
-import { type ActiveRecoveredWalletAuthorityV1, type PendingWalletAuthorityV1, type WalletAuthorityV1 } from '../../../../../shared-ts/src/authorization/walletAuthority';
+import { type WalletRecoveryOperationId, type MpcMaterialActivationRef, type WalletAuthMethodId, type WalletAuthorityId, type WalletId } from '../../../../../shared-ts/src/utils/domainIds';
+import { type ActiveWalletAuthMethodRecordV2, type PendingWalletAuthMethodRecordV2, type WalletAuthMethodRecordV2 } from '../../../../../shared-ts/src/utils/walletAuthMethodRecord';
+import { type ActiveRecoveredWalletAuthorityV1, type ActiveWalletAuthorityV1, type PendingWalletAuthorityV1, type WalletAuthorityV1 } from '../../../../../shared-ts/src/authorization/walletAuthority';
 import { type WalletAuthAuthority } from '../../../../../shared-ts/src/utils/walletAuthAuthority';
 import type { KeyMaterialKind, KeyMaterialRecord } from '../keyMaterial.types';
-import type { AccountRef, AccountSignerRecord, AccountSignerStatus, ChainAccountRecord, DBConstraintErrorCode, EnqueueSignerOperationInput, LastProfileState, LocalAuthorityInstallationReceiptV1, LocalWalletAuthMethodRecord, LocalWalletAuthMethodProjectionV2, NonceLaneLeaseStoreRecord, ProfileAuthenticatorRecord, ProfileContinuitySnapshot, ProfileRecord, RetainVerifiedEmailOtpLocalPresentationInputV1, RetainVerifiedEmailOtpLocalPresentationResultV1, SignerMutationOptions, SignerOperationStatus, SignerOpOutboxRecord, UpsertChainAccountInput, UpsertProfileInput, UserPreferences, WalletAuthorityExportRootRecordV1, WalletAuthoritySignerMaterialRecordV1, WalletSelectionRecordV1, WalletSignerLookup } from '../passkeyClientDB.types';
+import type { AccountRef, AccountSignerRecord, AccountSignerStatus, ChainAccountRecord, EnqueueSignerOperationInput, LastProfileState, LocalAuthorityInstallationReceiptV1, LocalWalletAuthMethodRecord, LocalWalletAuthMethodProjectionV2, NonceLaneLeaseStoreRecord, ProfileAuthenticatorRecord, ProfileContinuitySnapshot, ProfileRecord, RetainVerifiedEmailOtpLocalPresentationInputV1, RetainVerifiedEmailOtpLocalPresentationResultV1, SignerMutationOptions, SignerOperationStatus, SignerOpOutboxRecord, UpsertChainAccountInput, UpsertProfileInput, UserPreferences, WalletAuthorityExportRootRecordV1, WalletAuthoritySignerMaterialRecordV1, WalletSelectionRecordV1, WalletSignerLookup } from '../passkeyClientDB.types';
 import type { ThresholdEcdsaChainTarget } from '../../signingEngine/interfaces/ecdsaChainTarget';
 import { type ActivateAccountSignerInput, type ActivateAccountSignerResult, type StageAccountSignerInput, type StageAccountSignerResult } from '../accountSignerLifecycle';
 import { type PendingWalletRegistrationCommitV1 } from '../pendingWalletRegistrationCommit';
@@ -19,9 +19,7 @@ type AppStateRow<T = unknown> = {
 };
 export type LocalAuthorityInstallationInputV1 = {
     readonly authority: PendingWalletAuthorityV1;
-    readonly authMethod: Extract<WalletAuthMethodRecordV2, {
-        status: 'pending_local_install';
-    }>;
+    readonly authMethod: PendingWalletAuthMethodRecordV2;
     readonly profile: UpsertProfileInput;
     readonly authenticator: ProfileAuthenticatorRecord | null;
     readonly localAuthMethod: Extract<LocalWalletAuthMethodRecord, {
@@ -47,23 +45,15 @@ export type LocalAuthorityInstallationResultV1 = {
     readonly reason: string;
 };
 export type LocalAuthorityActivationFinalizationInputV1 = {
-    readonly authority: Extract<WalletAuthorityV1, {
-        readonly state: 'active';
-    }>;
-    readonly authMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly status: 'active';
-    }>;
+    readonly authority: ActiveWalletAuthorityV1;
+    readonly authMethod: ActiveWalletAuthMethodRecordV2;
     readonly walletSession: ActiveWalletSessionV1;
     readonly operationCredential: WalletSessionOperationCredentialV1;
     readonly expectedLockGeneration: number;
 };
 export type LocalAuthorityActivationPublicationInputV1 = {
-    readonly authority: Extract<WalletAuthorityV1, {
-        readonly state: 'active';
-    }>;
-    readonly authMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly status: 'active';
-    }>;
+    readonly authority: ActiveWalletAuthorityV1;
+    readonly authMethod: ActiveWalletAuthMethodRecordV2;
     readonly expectedLockGeneration: number;
 };
 export type LocalAuthorityActivationPublicationResultV1 = {
@@ -92,9 +82,7 @@ export type WalletLockGenerationAdvanceInputV1 = {
 };
 export type RecoveredWalletAuthorityProjectionInputV1 = {
     readonly authority: ActiveRecoveredWalletAuthorityV1;
-    readonly authMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly status: 'active';
-    }>;
+    readonly authMethod: ActiveWalletAuthMethodRecordV2;
     readonly recoveredAtMs: number;
 };
 export type ResolveSelectedWalletAuthorityResultV1 = {
@@ -117,12 +105,8 @@ export type ResolveSelectedWalletAuthorityResultV1 = {
     readonly reason: string;
 };
 export type PersistFoundingWalletAuthorityInputV1 = {
-    readonly authority: Extract<WalletAuthorityV1, {
-        readonly state: 'active';
-    }>;
-    readonly authMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly status: 'active';
-    }>;
+    readonly authority: ActiveWalletAuthorityV1;
+    readonly authMethod: ActiveWalletAuthMethodRecordV2;
 };
 export type StoreWalletRegistrationFinalizeBatchInput = {
     profiles: readonly UpsertProfileInput[];
@@ -136,7 +120,7 @@ export type StoreWalletRegistrationFinalizeBatchInput = {
         scope?: string | null;
     };
 };
-export type WalletRegistrationCommitPublicationRequestV1 = {
+type WalletRegistrationCommitPublicationRequestV1 = {
     readonly operation: PendingWalletRegistrationCommitV1['operation'];
     readonly registrationCeremonyId: string;
     readonly idempotencyKey: string;
@@ -150,7 +134,7 @@ export type StoreWalletRegistrationPublicationInputV1 = Omit<StoreWalletRegistra
         readonly scope: string | null;
     };
 };
-export type WalletRegistrationSessionPublicationV1 = {
+type WalletRegistrationSessionPublicationV1 = {
     readonly kind: 'issued';
     readonly walletSession: ActiveWalletSessionV1;
     readonly operationCredential: WalletSessionOperationCredentialV1;
@@ -172,9 +156,7 @@ export type PublishPendingWalletRecoveryCommitInputV1 = {
         readonly stage: 'server_promoted';
     }>;
     readonly authority: ActiveRecoveredWalletAuthorityV1;
-    readonly authMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly status: 'active';
-    }>;
+    readonly authMethod: ActiveWalletAuthMethodRecordV2;
     readonly registration: StoreWalletRegistrationPublicationInputV1;
     readonly ecdsaContinuity: readonly PreparedImportedWalletCustodyEcdsaContinuity[];
     readonly ed25519PublicCapabilityReferences: readonly Ed25519YaoPublicCapabilityReferenceV1[];
@@ -189,23 +171,23 @@ export type StoreWalletSignerFinalizeBatchInput = {
         scope?: string | null;
     };
 };
-export type AccountSignerRollbackMetadataBaselineV1 = {
+type AccountSignerRollbackMetadataBaselineV1 = {
     readonly kind: 'account_signer_rollback_metadata_absent_v1';
 } | {
     readonly kind: 'account_signer_rollback_metadata_json_v1';
     readonly json: string;
 };
-export type KeyMaterialRollbackPayloadBaselineV1 = {
+type KeyMaterialRollbackPayloadBaselineV1 = {
     readonly kind: 'key_material_rollback_payload_absent_v1';
 } | {
     readonly kind: 'key_material_rollback_payload_json_v1';
     readonly json: string;
 };
-export type AccountSignerRollbackEntryV1 = {
+type AccountSignerRollbackEntryV1 = {
     readonly committed: AccountSignerRecord;
     readonly metadataBaseline: AccountSignerRollbackMetadataBaselineV1;
 };
-export type KeyMaterialRollbackEntryV1 = {
+type KeyMaterialRollbackEntryV1 = {
     readonly committed: KeyMaterialRecord;
     readonly payloadBaseline: KeyMaterialRollbackPayloadBaselineV1;
 };
@@ -230,11 +212,6 @@ export type StoreWalletSignerFinalizeBatchResult = StoreWalletRegistrationFinali
 export type StoreWalletRegistrationFinalizeBatchResult = {
     signerActivations: ActivateAccountSignerResult[];
 };
-export declare class SeamsWalletDBConstraintError extends Error {
-    readonly code: DBConstraintErrorCode;
-    readonly details?: Record<string, unknown>;
-    constructor(code: DBConstraintErrorCode, message: string, details?: Record<string, unknown>);
-}
 export declare class SeamsWalletRepositories {
     private readonly manager;
     constructor(manager: SeamsWalletDBManager);
@@ -268,8 +245,7 @@ export declare class SeamsWalletRepositories {
     retainVerifiedEmailOtpLocalPresentation(input: RetainVerifiedEmailOtpLocalPresentationInputV1): Promise<RetainVerifiedEmailOtpLocalPresentationResultV1>;
     resolveSelectedWalletAuthority(walletId: string): Promise<ResolveSelectedWalletAuthorityResultV1>;
     /**
-     * R109C: resolve the authority as a named method rather than as the selected
-     * one.
+     * Resolve the authority as a named method rather than as the selected one.
      *
      * Unlocking a sibling is how an added method comes into use - invariant 9
      * makes lock and unlock the route - and the unlock moves the selection to it.
@@ -304,6 +280,35 @@ export declare class SeamsWalletRepositories {
         registrationCeremonyId: string;
         operation: PendingWalletRegistrationCommitV1['operation'];
     }): Promise<void>;
+    /**
+     * Adopts the authority the Gateway returned after this wallet added an ECDSA
+     * signer: the local authority extended with exactly the activation this
+     * device made, nothing else changed. The Gateway promoted the wallet's live
+     * Wallet Sessions to it; the next exact status read carries that promotion
+     * into the local session, which keeps its operation credential.
+     */
+    adoptAddedEcdsaSignerAuthority(input: {
+        readonly authority: WalletAuthorityV1;
+        readonly materialActivation: MpcMaterialActivationRef;
+    }): Promise<void>;
+    /**
+     * Replaces the exact active Wallet Session with the one a status read
+     * returned, only while it still binds the wallet's stored authority and its
+     * unlocked selection. The status crosses the network, and a publication
+     * can commit meanwhile: deferred NEAR provisioning extends the authority
+     * and rebinds the session in one transaction. Writing the older status
+     * after it would bind the session to an authority digest no longer stored,
+     * and every exact-session check would refuse it until another status read.
+     */
+    replaceExactActiveWalletSessionFromStatus(input: {
+        readonly active: ActiveWalletSessionV1;
+        readonly operationCredential: WalletSessionOperationCredentialV1;
+    }): Promise<{
+        readonly kind: 'replaced';
+    } | {
+        readonly kind: 'superseded';
+    }>;
+    private replaceExactActiveWalletSessionFromStatusInTransaction;
     reconcilePendingNearRegistrationAuthority(input: {
         readonly walletSession: ActiveWalletSessionV1;
         readonly operationCredential: WalletSessionOperationCredentialV1;

package/dist/types/wallet/src/core/indexedDB/seamsWalletDB/signingSessionSeals.d.ts

@@ -2,7 +2,7 @@ export type StoredRawSealedRecordEntry = {
     primaryKey: unknown;
     value: unknown;
 };
-export type SigningSessionRestoreLeaseTransaction = {
+type SigningSessionRestoreLeaseTransaction = {
     entries: StoredRawSealedRecordEntry[];
     getRawRestoreLease(leaseKey: string): Promise<unknown>;
     putRestoreLease(row: Record<string, unknown>): void;
@@ -33,4 +33,5 @@ export declare class SigningSessionSealsRepository {
     clearAll(): Promise<void>;
 }
 export declare const signingSessionSealsRepository: SigningSessionSealsRepository;
+export {};
 //# sourceMappingURL=signingSessionSeals.d.ts.map