@seams/wallet 0.6.2 → 0.7.1

package/dist/types/wallet/src/core/signingEngine/session/persistence/sealedSessionRecords.d.ts

@@ -0,0 +1,212 @@
+import { type MpcMaterialActivationRef } from '../../../../../../shared-ts/src/utils/domainIds';
+import { SIGNING_SESSION_SEAL_ALG, SIGNING_SESSION_SEAL_GROUP_ID, SIGNING_SESSION_SEAL_STORAGE_SCOPE, SIGNING_SESSION_SECRET_KIND, type SealedSigningSessionEcdsaRestoreMetadata, type SealedSigningSessionEcdsaRestoreSource, type SealedSigningSessionRecord } from '../../../../../../shared-ts/src/utils/signingSessionSeal';
+import { normalizeRuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
+import { type ThresholdEcdsaChainTarget } from '../../interfaces/ecdsaChainTarget';
+import { type RouterAbEd25519NormalSigningState } from '../../threshold/ed25519/routerAbNormalSigningState';
+import { type RouterAbEcdsaDerivationNormalSigningStateV1, type RouterAbEcdsaDerivationPublicCapabilityV1 } from '../../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
+import { type EcdsaRoleLocalPersistedMaterialRef } from '../keyMaterialBrands';
+import { type EmailOtpWalletAuthAuthority, type WalletAuthAuthorityRef } from '../../../../../../shared-ts/src/utils/walletAuthAuthority';
+export type SigningSessionSealedStoreRecord = SealedSigningSessionRecord & {
+    storeKey: string;
+    curve: 'ed25519' | 'ecdsa';
+};
+type Ed25519SealedRecordThresholdSessionIds = {
+    ed25519: string;
+    ecdsa?: string;
+};
+type EcdsaSealedRecordThresholdSessionIds = {
+    ed25519?: string;
+    ecdsa: string;
+};
+type CurrentEd25519RestoreMetadataBase = {
+    nearAccountId: string;
+    nearEd25519SigningKeyId: string;
+    rpId: string;
+    relayerKeyId: string;
+    participantIds: number[];
+    runtimePolicyScope?: unknown;
+    signerSlot: number;
+    routerAbNormalSigning: RouterAbEd25519NormalSigningState;
+};
+export type CurrentEd25519RestoreMetadata = (CurrentEd25519RestoreMetadataBase & {
+    credentialIdB64u: string;
+    materialActivation: MpcMaterialActivationRef;
+    providerSubjectId?: never;
+    emailHashHex?: never;
+}) | (CurrentEd25519RestoreMetadataBase & {
+    provider: 'google' | 'email';
+    providerSubjectId: string;
+    emailHashHex: string;
+    materialActivation: MpcMaterialActivationRef;
+    credentialIdB64u?: never;
+});
+export type CurrentEd25519SealedSessionRecord = Omit<Extract<SigningSessionSealedStoreRecord, {
+    curve: 'ed25519';
+}>, 'curve' | 'thresholdSessionIds' | 'walletId' | 'relayerUrl' | 'ed25519Restore' | 'ecdsaRestore'> & {
+    curve: 'ed25519';
+    thresholdSessionIds: Ed25519SealedRecordThresholdSessionIds;
+    walletId: string;
+    relayerUrl: string;
+    ed25519Restore: CurrentEd25519RestoreMetadata;
+    ecdsaRestore?: SealedSigningSessionEcdsaRestoreMetadata;
+};
+export type CurrentEcdsaSealedSessionRecord = Omit<Extract<SigningSessionSealedStoreRecord, {
+    curve: 'ecdsa';
+}>, 'curve' | 'thresholdSessionIds' | 'walletId' | 'relayerUrl' | 'signingRootId' | 'signingRootVersion' | 'ecdsaRestore' | 'ed25519Restore'> & {
+    curve: 'ecdsa';
+    thresholdSessionIds: EcdsaSealedRecordThresholdSessionIds;
+    walletId: string;
+    signingRootId?: never;
+    signingRootVersion?: never;
+    relayerUrl: string;
+    ecdsaRestore: SealedSigningSessionEcdsaRestoreMetadata;
+    ed25519Restore?: CurrentEd25519RestoreMetadata;
+};
+declare const ECDSA_INACTIVE_SEALED_MATERIAL_RECORD_KIND: "ecdsa_inactive_sealed_material_v1";
+type EcdsaInactiveSealedMaterialRecordBase = {
+    recordKind: typeof ECDSA_INACTIVE_SEALED_MATERIAL_RECORD_KIND;
+    storeKey: string;
+    curve: 'ecdsa';
+    walletId: string;
+    relayerUrl: string;
+    alg: typeof SIGNING_SESSION_SEAL_ALG;
+    storageScope: typeof SIGNING_SESSION_SEAL_STORAGE_SCOPE;
+    secretKind: typeof SIGNING_SESSION_SECRET_KIND;
+    sealedSecretB64u: string;
+    keyVersion: string;
+    groupId: typeof SIGNING_SESSION_SEAL_GROUP_ID;
+    updatedAtMs: number;
+    issuedAtMs?: never;
+    expiresAtMs?: never;
+    remainingUses?: never;
+    thresholdSessionIds?: never;
+    authorizationRetirementReason: 'expired' | 'exhausted';
+    ed25519Restore?: never;
+};
+type EcdsaInactiveMaterialPublicRestoreBase = {
+    chainTarget: ThresholdEcdsaChainTarget;
+    signingRootId: string;
+    signingRootVersion: string;
+    keyHandle: string;
+    ecdsaThresholdKeyId: string;
+    ethereumAddress: string;
+    relayerKeyId: string;
+    thresholdEcdsaPublicKeyB64u: string;
+    participantIds: number[];
+    runtimePolicyScope: ReturnType<typeof normalizeRuntimePolicyScope>;
+    routerAbEcdsaDerivationNormalSigning: RouterAbEcdsaDerivationNormalSigningStateV1;
+    publicCapability: RouterAbEcdsaDerivationPublicCapabilityV1;
+    clientVerifyingShareB64u?: never;
+};
+export type EcdsaInactiveMaterialPublicRestore = (EcdsaInactiveMaterialPublicRestoreBase & {
+    source: Exclude<SealedSigningSessionEcdsaRestoreSource, 'email_otp'>;
+    authority: WalletAuthAuthorityRef;
+    rpId: string;
+    credentialIdB64u: string;
+    roleLocalMaterialRef: EcdsaRoleLocalPersistedMaterialRef;
+    providerSubjectId?: never;
+    emailHashHex?: never;
+}) | (EcdsaInactiveMaterialPublicRestoreBase & {
+    source: 'email_otp';
+    provider: 'google' | 'email';
+    providerSubjectId: string;
+    emailHashHex: string;
+    authority: WalletAuthAuthorityRef;
+    emailOtpAuthority: EmailOtpWalletAuthAuthority;
+    roleLocalMaterialRef: EcdsaRoleLocalPersistedMaterialRef;
+    rpId?: never;
+    credentialIdB64u?: never;
+});
+export type EcdsaInactiveSealedMaterialRecord = EcdsaInactiveSealedMaterialRecordBase & ({
+    authMethod: 'passkey';
+    ecdsaRestore: Exclude<EcdsaInactiveMaterialPublicRestore, {
+        source: 'email_otp';
+    }>;
+} | {
+    authMethod: 'email_otp';
+    ecdsaRestore: Extract<EcdsaInactiveMaterialPublicRestore, {
+        source: 'email_otp';
+    }>;
+});
+export type EcdsaDurableLaneRecord = SigningSessionSealedStoreRecord | EcdsaInactiveSealedMaterialRecord;
+export type CurrentSealedSessionRecord = CurrentEd25519SealedSessionRecord | CurrentEcdsaSealedSessionRecord;
+export type RawSealedSessionRecord = Record<string, unknown>;
+type SealedSessionRecordClassificationReason = 'invalid_payload' | 'invalid_header' | 'invalid_identity' | 'owned_by_lane_holder_store' | 'missing_participant_ids' | 'missing_restore_metadata';
+export type CurrentSealedSessionRecordClassification = {
+    kind: 'current';
+    record: CurrentSealedSessionRecord;
+};
+type EcdsaInactiveSealedMaterialRecordClassification = {
+    kind: 'ecdsa_inactive_material';
+    record: EcdsaInactiveSealedMaterialRecord;
+};
+type NonCurrentSealedSessionRecordClassificationKind = 'delete_required' | 'rebuild_required' | 'unrelated_record' | 'malformed';
+type NonCurrentSealedSessionRecordClassification = {
+    [K in NonCurrentSealedSessionRecordClassificationKind]: {
+        kind: K;
+        storeKey: string | null;
+        walletId: string | null;
+        reason: SealedSessionRecordClassificationReason;
+        safeSummary: Record<string, unknown>;
+    };
+}[NonCurrentSealedSessionRecordClassificationKind];
+export type SealedSessionRecordClassification = CurrentSealedSessionRecordClassification | EcdsaInactiveSealedMaterialRecordClassification | NonCurrentSealedSessionRecordClassification;
+type BuildCurrentSealedSessionRecordCommonInput = {
+    thresholdSessionId: string;
+    sealedSecretB64u: string;
+    authMethod: 'passkey' | 'email_otp';
+    keyVersion: string;
+    groupId: typeof SIGNING_SESSION_SEAL_GROUP_ID;
+    issuedAtMs: number;
+    expiresAtMs: number;
+    remainingUses: number;
+    updatedAtMs: number;
+};
+export type BuildCurrentEd25519SealedSessionRecordInput = BuildCurrentSealedSessionRecordCommonInput & {
+    curve: 'ed25519';
+    thresholdSessionIds: Ed25519SealedRecordThresholdSessionIds;
+    walletId: string;
+    signingRootId?: string;
+    signingRootVersion?: string;
+    relayerUrl: string;
+    ecdsaRestore?: SealedSigningSessionEcdsaRestoreMetadata;
+    ed25519Restore: CurrentEd25519RestoreMetadata;
+};
+export type BuildCurrentEcdsaSealedSessionRecordInput = BuildCurrentSealedSessionRecordCommonInput & {
+    curve: 'ecdsa';
+    thresholdSessionIds: EcdsaSealedRecordThresholdSessionIds;
+    walletId: string;
+    relayerUrl: string;
+    ecdsaRestore: SealedSigningSessionEcdsaRestoreMetadata;
+    ed25519Restore?: CurrentEd25519RestoreMetadata;
+};
+export type BuildCurrentSealedSessionRecordInput = BuildCurrentEd25519SealedSessionRecordInput | BuildCurrentEcdsaSealedSessionRecordInput;
+export declare function normalizeThresholdSessionIdsFromStoredRecord(value: unknown): {
+    ed25519?: string;
+    ecdsa?: string;
+};
+export declare function hasRetiredAuthorizationIdentityField(value: unknown): boolean;
+export declare function storagePayloadFromSealedStoreRow(value: unknown): unknown;
+export declare function inactiveEcdsaMaterialStorageRow(record: EcdsaInactiveSealedMaterialRecord): Record<string, unknown>;
+export declare function sealedRecordStorageRow(record: CurrentSealedSessionRecord): Record<string, unknown>;
+export declare function makeInactiveEcdsaMaterialStoreKey(args: {
+    walletId: string;
+    authMethod: 'passkey' | 'email_otp';
+    restore: EcdsaInactiveMaterialPublicRestore;
+}): string;
+export declare function classifyNonCurrentRecord(kind: NonCurrentSealedSessionRecordClassificationKind, obj: RawSealedSessionRecord | null, reason: SealedSessionRecordClassificationReason): NonCurrentSealedSessionRecordClassification;
+export declare function classifyRawSealedSessionRecord(raw: unknown): SealedSessionRecordClassification;
+export declare function normalizeSigningSessionSealedStoreRecord(value: unknown): CurrentSealedSessionRecord | null;
+export declare function logSealedSessionClassification(args: {
+    operation: string;
+    classification: Exclude<SealedSessionRecordClassification, CurrentSealedSessionRecordClassification>;
+}): void;
+export declare function buildCurrentSealedSessionRecord(args: BuildCurrentSealedSessionRecordInput): CurrentSealedSessionRecord | null;
+export declare function buildEcdsaInactiveMaterialPublicRestore(restore: SealedSigningSessionEcdsaRestoreMetadata, relayerUrlRaw: string): EcdsaInactiveMaterialPublicRestore | null;
+export declare function requireInactiveEcdsaSealedMaterial(args: {
+    record: CurrentEcdsaSealedSessionRecord;
+    retirement: 'expired' | 'exhausted';
+    updatedAtMs: number;
+}): EcdsaInactiveSealedMaterialRecord;
+export {};
+//# sourceMappingURL=sealedSessionRecords.d.ts.map

package/dist/types/wallet/src/core/signingEngine/session/persistence/sealedSessionStore.d.ts

@@ -1,14 +1,8 @@
-import { type MpcMaterialActivationRef } from '../../../../../../shared-ts/src/utils/domainIds';
 import type { Ed25519DurableMaterialLocator } from '../sealedRecovery/materialActivationKey';
-import { SIGNING_SESSION_SEAL_ALG, SIGNING_SESSION_SEAL_GROUP_ID, SIGNING_SESSION_SEAL_STORAGE_SCOPE, SIGNING_SESSION_SECRET_KIND, type SealedSigningSessionEcdsaRestoreMetadata, type SealedSigningSessionEcdsaRestoreSource, type SealedSigningSessionRecord } from '../../../../../../shared-ts/src/utils/signingSessionSeal';
-import { normalizeRuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
 import { type ThresholdEcdsaChainTarget } from '../../interfaces/ecdsaChainTarget';
-import { type RouterAbEd25519NormalSigningState } from '../../threshold/ed25519/routerAbNormalSigningState';
-import { type RouterAbEcdsaDerivationNormalSigningStateV1, type RouterAbEcdsaDerivationPublicCapabilityV1 } from '../../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
 import { type DeleteDurableSealedSessionCommand } from './durableSealedSessionCommands';
-import { type EcdsaRoleLocalPersistedMaterialRef } from '../keyMaterialBrands';
-import { type EmailOtpWalletAuthAuthority, type WalletAuthAuthorityRef } from '../../../../../../shared-ts/src/utils/walletAuthAuthority';
-export type SigningSessionRestoreLease = {
+import { type CurrentEd25519SealedSessionRecord, type CurrentSealedSessionRecord, type EcdsaDurableLaneRecord } from './sealedSessionRecords';
+type SigningSessionRestoreLease = {
     v: 1;
     leaseKey: string;
     ownerId: string;
@@ -16,154 +10,9 @@ export type SigningSessionRestoreLease = {
     startedAtMs: number;
     expiresAtMs: number;
 };
-export type SigningSessionRestoreLeaseHandle = SigningSessionRestoreLease & {
+type SigningSessionRestoreLeaseHandle = SigningSessionRestoreLease & {
     thresholdSessionId: string;
 };
-export type SigningSessionSealedStoreRecord = SealedSigningSessionRecord & {
-    storeKey: string;
-    curve: 'ed25519' | 'ecdsa';
-};
-export type Ed25519SealedRecordThresholdSessionIds = {
-    ed25519: string;
-    ecdsa?: string;
-};
-export type EcdsaSealedRecordThresholdSessionIds = {
-    ed25519?: string;
-    ecdsa: string;
-};
-type CurrentEd25519RestoreMetadataBase = {
-    nearAccountId: string;
-    nearEd25519SigningKeyId: string;
-    rpId: string;
-    relayerKeyId: string;
-    participantIds: number[];
-    runtimePolicyScope?: unknown;
-    signerSlot: number;
-    routerAbNormalSigning: RouterAbEd25519NormalSigningState;
-};
-export type CurrentEd25519RestoreMetadata = (CurrentEd25519RestoreMetadataBase & {
-    credentialIdB64u: string;
-    materialActivation: MpcMaterialActivationRef;
-    providerSubjectId?: never;
-    emailHashHex?: never;
-}) | (CurrentEd25519RestoreMetadataBase & {
-    provider: 'google' | 'email';
-    providerSubjectId: string;
-    emailHashHex: string;
-    materialActivation: MpcMaterialActivationRef;
-    credentialIdB64u?: never;
-});
-export type CurrentEd25519SealedSessionRecord = Omit<Extract<SigningSessionSealedStoreRecord, {
-    curve: 'ed25519';
-}>, 'curve' | 'thresholdSessionIds' | 'walletId' | 'relayerUrl' | 'ed25519Restore' | 'ecdsaRestore'> & {
-    curve: 'ed25519';
-    thresholdSessionIds: Ed25519SealedRecordThresholdSessionIds;
-    walletId: string;
-    relayerUrl: string;
-    ed25519Restore: CurrentEd25519RestoreMetadata;
-    ecdsaRestore?: SealedSigningSessionEcdsaRestoreMetadata;
-};
-export type CurrentEcdsaSealedSessionRecord = Omit<Extract<SigningSessionSealedStoreRecord, {
-    curve: 'ecdsa';
-}>, 'curve' | 'thresholdSessionIds' | 'walletId' | 'relayerUrl' | 'signingRootId' | 'signingRootVersion' | 'ecdsaRestore' | 'ed25519Restore'> & {
-    curve: 'ecdsa';
-    thresholdSessionIds: EcdsaSealedRecordThresholdSessionIds;
-    walletId: string;
-    signingRootId?: never;
-    signingRootVersion?: never;
-    relayerUrl: string;
-    ecdsaRestore: SealedSigningSessionEcdsaRestoreMetadata;
-    ed25519Restore?: CurrentEd25519RestoreMetadata;
-};
-declare const ECDSA_INACTIVE_SEALED_MATERIAL_RECORD_KIND: "ecdsa_inactive_sealed_material_v1";
-type EcdsaInactiveSealedMaterialRecordBase = {
-    recordKind: typeof ECDSA_INACTIVE_SEALED_MATERIAL_RECORD_KIND;
-    storeKey: string;
-    curve: 'ecdsa';
-    walletId: string;
-    relayerUrl: string;
-    alg: typeof SIGNING_SESSION_SEAL_ALG;
-    storageScope: typeof SIGNING_SESSION_SEAL_STORAGE_SCOPE;
-    secretKind: typeof SIGNING_SESSION_SECRET_KIND;
-    sealedSecretB64u: string;
-    keyVersion: string;
-    groupId: typeof SIGNING_SESSION_SEAL_GROUP_ID;
-    updatedAtMs: number;
-    issuedAtMs?: never;
-    expiresAtMs?: never;
-    remainingUses?: never;
-    thresholdSessionIds?: never;
-    authorizationRetirementReason: 'expired' | 'exhausted';
-    ed25519Restore?: never;
-};
-type EcdsaInactiveMaterialPublicRestoreBase = {
-    chainTarget: ThresholdEcdsaChainTarget;
-    signingRootId: string;
-    signingRootVersion: string;
-    keyHandle: string;
-    ecdsaThresholdKeyId: string;
-    ethereumAddress: string;
-    relayerKeyId: string;
-    thresholdEcdsaPublicKeyB64u: string;
-    participantIds: number[];
-    runtimePolicyScope: ReturnType<typeof normalizeRuntimePolicyScope>;
-    routerAbEcdsaDerivationNormalSigning: RouterAbEcdsaDerivationNormalSigningStateV1;
-    publicCapability: RouterAbEcdsaDerivationPublicCapabilityV1;
-    clientVerifyingShareB64u?: never;
-};
-export type EcdsaInactiveMaterialPublicRestore = (EcdsaInactiveMaterialPublicRestoreBase & {
-    source: Exclude<SealedSigningSessionEcdsaRestoreSource, 'email_otp'>;
-    authority: WalletAuthAuthorityRef;
-    rpId: string;
-    credentialIdB64u: string;
-    roleLocalMaterialRef: EcdsaRoleLocalPersistedMaterialRef;
-    providerSubjectId?: never;
-    emailHashHex?: never;
-}) | (EcdsaInactiveMaterialPublicRestoreBase & {
-    source: 'email_otp';
-    provider: 'google' | 'email';
-    providerSubjectId: string;
-    emailHashHex: string;
-    authority: WalletAuthAuthorityRef;
-    emailOtpAuthority: EmailOtpWalletAuthAuthority;
-    roleLocalMaterialRef: EcdsaRoleLocalPersistedMaterialRef;
-    rpId?: never;
-    credentialIdB64u?: never;
-});
-export type EcdsaInactiveSealedMaterialRecord = EcdsaInactiveSealedMaterialRecordBase & ({
-    authMethod: 'passkey';
-    ecdsaRestore: Exclude<EcdsaInactiveMaterialPublicRestore, {
-        source: 'email_otp';
-    }>;
-} | {
-    authMethod: 'email_otp';
-    ecdsaRestore: Extract<EcdsaInactiveMaterialPublicRestore, {
-        source: 'email_otp';
-    }>;
-});
-export type EcdsaDurableLaneRecord = SigningSessionSealedStoreRecord | EcdsaInactiveSealedMaterialRecord;
-export type CurrentSealedSessionRecord = CurrentEd25519SealedSessionRecord | CurrentEcdsaSealedSessionRecord;
-export type RawSealedSessionRecord = Record<string, unknown>;
-export type SealedSessionRecordClassificationReason = 'invalid_payload' | 'invalid_header' | 'invalid_identity' | 'owned_by_lane_holder_store' | 'missing_signing_root_id' | 'missing_participant_ids' | 'missing_restore_metadata';
-export type CurrentSealedSessionRecordClassification = {
-    kind: 'current';
-    record: CurrentSealedSessionRecord;
-};
-export type EcdsaInactiveSealedMaterialRecordClassification = {
-    kind: 'ecdsa_inactive_material';
-    record: EcdsaInactiveSealedMaterialRecord;
-};
-type NonCurrentSealedSessionRecordClassificationKind = 'delete_required' | 'rebuild_required' | 'user_action_required' | 'unrelated_record' | 'malformed';
-type NonCurrentSealedSessionRecordClassification = {
-    [K in NonCurrentSealedSessionRecordClassificationKind]: {
-        kind: K;
-        storeKey: string | null;
-        walletId: string | null;
-        reason: SealedSessionRecordClassificationReason;
-        safeSummary: Record<string, unknown>;
-    };
-}[NonCurrentSealedSessionRecordClassificationKind];
-export type SealedSessionRecordClassification = CurrentSealedSessionRecordClassification | EcdsaInactiveSealedMaterialRecordClassification | NonCurrentSealedSessionRecordClassification;
 export type SigningSessionSealedRecordFilter = {
     authMethod: 'passkey' | 'email_otp';
     curve: 'ed25519';
@@ -172,40 +21,10 @@ export type SigningSessionSealedRecordFilter = {
     curve: 'ecdsa';
     chainTarget: ThresholdEcdsaChainTarget;
 };
-export type ListEcdsaSigningSessionSealedRecordsForWalletFilter = {
+type ListEcdsaSigningSessionSealedRecordsForWalletFilter = {
     authMethod?: 'passkey' | 'email_otp';
     curve: 'ecdsa';
 };
-type BuildCurrentSealedSessionRecordCommonInput = {
-    thresholdSessionId: string;
-    sealedSecretB64u: string;
-    authMethod: 'passkey' | 'email_otp';
-    keyVersion: string;
-    groupId: typeof SIGNING_SESSION_SEAL_GROUP_ID;
-    issuedAtMs: number;
-    expiresAtMs: number;
-    remainingUses: number;
-    updatedAtMs: number;
-};
-export type BuildCurrentEd25519SealedSessionRecordInput = BuildCurrentSealedSessionRecordCommonInput & {
-    curve: 'ed25519';
-    thresholdSessionIds: Ed25519SealedRecordThresholdSessionIds;
-    walletId: string;
-    signingRootId?: string;
-    signingRootVersion?: string;
-    relayerUrl: string;
-    ecdsaRestore?: SealedSigningSessionEcdsaRestoreMetadata;
-    ed25519Restore: CurrentEd25519RestoreMetadata;
-};
-export type BuildCurrentEcdsaSealedSessionRecordInput = BuildCurrentSealedSessionRecordCommonInput & {
-    curve: 'ecdsa';
-    thresholdSessionIds: EcdsaSealedRecordThresholdSessionIds;
-    walletId: string;
-    relayerUrl: string;
-    ecdsaRestore: SealedSigningSessionEcdsaRestoreMetadata;
-    ed25519Restore?: CurrentEd25519RestoreMetadata;
-};
-export type BuildCurrentSealedSessionRecordInput = BuildCurrentEd25519SealedSessionRecordInput | BuildCurrentEcdsaSealedSessionRecordInput;
 export type UpdateExactSealedSessionPolicyInput = {
     thresholdSessionId: string;
     filter: SigningSessionSealedRecordFilter;
@@ -213,16 +32,6 @@ export type UpdateExactSealedSessionPolicyInput = {
     remainingUses?: number;
     updatedAtMs: number;
 };
-export type ResolvedIdentityDeleteReason = 'durable_record_deleted' | 'invalid_persisted_record' | 'same_lane_replaced' | 'same_scope_replaced';
-type DeleteExactSealedSessionOptions = {
-    deleteResolvedIdentity: true;
-    resolvedIdentityDeleteReason: ResolvedIdentityDeleteReason;
-} | {
-    deleteResolvedIdentity: false;
-    resolvedIdentityDeleteReason?: never;
-};
-export declare function classifyRawSealedSessionRecord(raw: unknown): SealedSessionRecordClassification;
-export declare function buildCurrentSealedSessionRecord(args: BuildCurrentSealedSessionRecordInput): CurrentSealedSessionRecord | null;
 export declare function readExactSealedSession(thresholdSessionIdRaw: string, filter: SigningSessionSealedRecordFilter): Promise<CurrentSealedSessionRecord | null>;
 export declare function readExactEd25519SealedSession(locator: Ed25519DurableMaterialLocator): Promise<CurrentEd25519SealedSessionRecord | null>;
 export declare function listExactSealedSessionsForWallet(args: {
@@ -234,7 +43,6 @@ export declare function listEcdsaSealedSessionsForWallet(args: {
     filter: ListEcdsaSigningSessionSealedRecordsForWalletFilter;
 }): Promise<EcdsaDurableLaneRecord[]>;
 export declare function writeExactSealedSession(record: CurrentSealedSessionRecord): Promise<void>;
-export declare function buildEcdsaInactiveMaterialPublicRestore(restore: SealedSigningSessionEcdsaRestoreMetadata, relayerUrlRaw: string): EcdsaInactiveMaterialPublicRestore | null;
 export declare function updateExactSealedSessionPolicy(args: UpdateExactSealedSessionPolicyInput): Promise<void>;
 export declare function updateExactEd25519SealedSessionPolicy(args: {
     locator: Ed25519DurableMaterialLocator;
@@ -242,8 +50,6 @@ export declare function updateExactEd25519SealedSessionPolicy(args: {
     remainingUses: number;
     updatedAtMs: number;
 }): Promise<void>;
-export declare function deleteExactSealedSession(thresholdSessionIdRaw: string, filter: SigningSessionSealedRecordFilter, options: DeleteExactSealedSessionOptions): Promise<void>;
-export declare function deleteExactEd25519SealedSession(locator: Ed25519DurableMaterialLocator, options: DeleteExactSealedSessionOptions): Promise<void>;
 export declare function deleteDurableSealedSessionRecord(command: DeleteDurableSealedSessionCommand): Promise<void>;
 export declare function acquireSigningSessionRestoreLease(args: {
     thresholdSessionId: string;
@@ -252,6 +58,5 @@ export declare function acquireSigningSessionRestoreLease(args: {
     ttlMs?: number;
 } & SigningSessionSealedRecordFilter): Promise<SigningSessionRestoreLeaseHandle | null>;
 export declare function releaseSigningSessionRestoreLease(lease: SigningSessionRestoreLeaseHandle | null | undefined): Promise<void>;
-export declare function clearAllSealedSessions(): Promise<void>;
 export {};
 //# sourceMappingURL=sealedSessionStore.d.ts.map

package/dist/types/wallet/src/core/signingEngine/session/postconditions/runtimePostconditions.d.ts

@@ -4,15 +4,15 @@ import type { AvailableSigningLanes } from '../availability/availableSigningLane
 import { type OwnerLaneScope } from '../identity/signingLaneAuthBinding';
 import type { SigningSessionSealAuthMethod } from '../../../../../../shared-ts/src/utils/signingSessionSeal';
 import type { MpcWalletSigningQuotaId, WalletSessionAuthorizationId, WalletSessionId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
-export type RuntimePostconditionSource = 'registration_finalize' | 'wallet_unlock';
-export type RuntimePostconditionTarget = {
+type RuntimePostconditionSource = 'registration_finalize' | 'wallet_unlock';
+type RuntimePostconditionTarget = {
     curve: 'ed25519';
     chainTarget?: never;
 } | {
     curve: 'ecdsa';
     chainTarget: ThresholdEcdsaChainTarget;
 };
-export type RuntimeLaneMaterial = {
+type RuntimeLaneMaterial = {
     kind: 'durable_sealed_record';
     sourceChainTarget?: never;
 } | {
@@ -25,7 +25,7 @@ export type RuntimeLaneMaterial = {
     kind: 'canonical_capability';
     sourceChainTarget?: never;
 };
-export type RestorableRuntimeLaneMaterial = Extract<RuntimeLaneMaterial, {
+type RestorableRuntimeLaneMaterial = Extract<RuntimeLaneMaterial, {
     kind: 'durable_sealed_record' | 'public_capability_reference';
 }>;
 type UsableRuntimeLaneIdentity = {
@@ -46,7 +46,6 @@ type UsableRuntimeLaneIdentity = {
     authorizationId: WalletSessionAuthorizationId;
     materialActivationId: string;
 };
-export type RuntimePostconditionLaneState = 'ready' | 'restorable';
 type ActiveUsableRuntimeLane = UsableRuntimeLaneIdentity & {
     readonly state: 'ready';
     readonly remainingSignatureUses: number;
@@ -63,24 +62,15 @@ type RestorableUsableRuntimeLane = Extract<UsableRuntimeLaneIdentity, {
     readonly expiresAtMs: number;
     readonly material: RestorableRuntimeLaneMaterial;
 };
-export type UsableRuntimeLane = ActiveUsableRuntimeLane | RestorableUsableRuntimeLane;
+type UsableRuntimeLane = ActiveUsableRuntimeLane | RestorableUsableRuntimeLane;
 export type WalletRuntimeInventory = {
     walletId: string;
     authMethod: SigningSessionSealAuthMethod;
     ed25519?: UsableRuntimeLane;
     ecdsaByTarget: ReadonlyMap<string, UsableRuntimeLane>;
 };
-export type WalletRuntimePostconditionFailureCode = 'wallet_missing' | 'auth_method_missing' | 'ed25519_lane_missing' | 'ecdsa_lane_missing' | 'lane_inventory_mismatch' | 'auth_method_route_mismatch' | 'lane_material_missing';
-export type WalletRuntimePostconditionResult = {
-    ok: true;
-    inventory: WalletRuntimeInventory;
-} | {
-    ok: false;
-    code: WalletRuntimePostconditionFailureCode;
-    details: Record<string, unknown>;
-};
 /**
- * R103C: the postcondition read is owner-scoped at the source. The reader
+ * The postcondition read is owner-scoped at the source. The reader
  * already filtered to the exact owner authority and signer slot, so the
  * canonical aggregate lane IS the owner's one operational lane per curve.
  * There is nothing to search, rank, or repair here — a lane is usable,
@@ -90,25 +80,6 @@ type ReadOwnerScopedSigningLanes = (args: {
     walletId: string | WalletId;
     ownerScope: OwnerLaneScope;
 }) => Promise<AvailableSigningLanes>;
-export declare class WalletRuntimePostconditionError extends Error {
-    readonly code: WalletRuntimePostconditionFailureCode;
-    readonly details: Record<string, unknown>;
-    constructor(result: Extract<WalletRuntimePostconditionResult, {
-        ok: false;
-    }>);
-}
-export declare function readWalletRuntimePostconditions(args: {
-    source: RuntimePostconditionSource;
-    walletId: string | WalletId;
-    ownerScope: OwnerLaneScope;
-    requiredTargets: readonly RuntimePostconditionTarget[];
-    readOwnerScopedSigningLanes: ReadOwnerScopedSigningLanes;
-    nowMs?: number;
-}): Promise<WalletRuntimePostconditionResult>;
-export declare function compareWalletRuntimeInventories(args: {
-    registration: WalletRuntimeInventory;
-    unlock: WalletRuntimeInventory;
-}): WalletRuntimePostconditionResult;
 export declare function assertWalletRuntimePostconditions(args: {
     source: RuntimePostconditionSource;
     walletId: string | WalletId;

package/dist/types/wallet/src/core/signingEngine/session/public.d.ts

@@ -27,7 +27,7 @@ export type SessionPublicDeps = {
 };
 export declare function discoverPersistedSessionsForWallet(deps: SessionPublicDeps, args: DiscoverPersistedSessionsForWalletInput): Promise<DiscoverPersistedSessionsForWalletResult>;
 export declare function readPersistedAvailableSigningLanes(deps: SessionPublicDeps, args: Omit<ReadAvailableSigningLanesInput, 'ecdsaChainTargets'>): Promise<AvailableSigningLanes>;
-/** R103C human operational read: one exact owner, configured ECDSA targets. */
+/** Human operational read: one exact owner, configured ECDSA targets. */
 export declare function readOwnerScopedSigningLanes(deps: SessionPublicDeps, args: {
     readonly walletId: WalletId | string;
     readonly ownerScope: OwnerLaneScope;

package/dist/types/wallet/src/core/signingEngine/session/routerAbSigningWalletSession.d.ts

@@ -22,15 +22,15 @@ export type RouterAbEd25519SigningWalletSession = {
     signingRootVersion: string;
     routerAbNormalSigning: RouterAbEd25519NormalSigningState;
 };
-export type RouterAbSigningWalletSessionParseFailureReason = 'missing_record' | 'cookie_session' | 'missing_session_identity' | 'missing_wallet_session_token' | 'missing_quota_id' | 'missing_threshold_session_id' | 'missing_signing_root' | 'signing_root_mismatch' | 'missing_client_verifying_share' | 'material_identity_mismatch' | 'wallet_binding_mismatch' | 'missing_runtime_policy_scope' | 'missing_router_ab_state' | 'invalid_router_ab_state' | 'invalid_budget' | 'expired' | 'exhausted';
-export type RouterAbSigningWalletSessionResult<T> = {
+type RouterAbSigningWalletSessionParseFailureReason = 'missing_record' | 'cookie_session' | 'missing_session_identity' | 'missing_wallet_session_token' | 'missing_quota_id' | 'missing_threshold_session_id' | 'missing_signing_root' | 'signing_root_mismatch' | 'missing_client_verifying_share' | 'material_identity_mismatch' | 'wallet_binding_mismatch' | 'missing_runtime_policy_scope' | 'missing_router_ab_state' | 'invalid_router_ab_state' | 'invalid_budget' | 'expired' | 'exhausted';
+type RouterAbSigningWalletSessionResult<T> = {
     ok: true;
     value: T;
 } | {
     ok: false;
     reason: RouterAbSigningWalletSessionParseFailureReason;
 };
-export type BuildRouterAbEd25519SigningWalletSessionInput = {
+type BuildRouterAbEd25519SigningWalletSessionInput = {
     walletId: string;
     nearAccountId: string;
     nearEd25519SigningKeyId: string;
@@ -48,4 +48,5 @@ export type BuildRouterAbEd25519SigningWalletSessionInput = {
     nowMs: number;
 };
 export declare function buildRouterAbEd25519SigningWalletSession(input: BuildRouterAbEd25519SigningWalletSessionInput): RouterAbSigningWalletSessionResult<RouterAbEd25519SigningWalletSession>;
+export {};
 //# sourceMappingURL=routerAbSigningWalletSession.d.ts.map

package/dist/types/wallet/src/core/signingEngine/session/sealedRecovery/recoveryRecord.d.ts

@@ -2,7 +2,7 @@ import type { ThresholdEcdsaChainTarget } from '../../interfaces/ecdsaChainTarge
 import { type ThresholdRuntimePolicyScope } from '../../threshold/sessionPolicy';
 import { type RouterAbEcdsaDerivationNormalSigningStateV1, type RouterAbEcdsaDerivationPublicCapabilityV1 } from '../../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
 import { type EmailOtpWalletAuthAuthority, type PasskeyWalletAuthAuthority, type WalletAuthAuthorityRef } from '../../../../../../shared-ts/src/utils/walletAuthAuthority';
-import type { RawSealedSessionRecord } from '../persistence/sealedSessionStore';
+import type { RawSealedSessionRecord } from '../persistence/sealedSessionRecords';
 import type { ThresholdEcdsaSessionStoreSource } from '../identity/laneIdentity';
 import { type EcdsaRoleLocalPersistedMaterialRef } from '../keyMaterialBrands';
 type RawThresholdSessionIds = {
@@ -117,7 +117,7 @@ export type EmailOtpEcdsaSealedRecoveryRecord = EcdsaSealedRecoveryRecordBase &
     rpId?: never;
 };
 export type SealedRecoveryRecord = PasskeyEcdsaSealedRecoveryRecord | EmailOtpEcdsaSealedRecoveryRecord;
-export type NormalizeSealedRecoveryRecordResult = {
+type NormalizeSealedRecoveryRecordResult = {
     kind: 'accepted';
     record: SealedRecoveryRecord;
 } | {

package/dist/types/wallet/src/core/signingEngine/session/userPreferences.d.ts

@@ -15,7 +15,7 @@ export type UserPreferencesStorePort = ProfileLastSelectionPort & {
         preferences: Partial<UserPreferences>;
     }) => Promise<unknown>;
 };
-export type UserPreferencesManagerDeps = {
+type UserPreferencesManagerDeps = {
     store: UserPreferencesStorePort;
 };
 export declare class UserPreferencesManager {
@@ -54,4 +54,5 @@ export declare class UserPreferencesManager {
     loadUserSettings(): Promise<void>;
     saveUserSettings(): Promise<void>;
 }
+export {};
 //# sourceMappingURL=userPreferences.d.ts.map

package/dist/types/wallet/src/core/signingEngine/session/warmCapabilities/capabilityReader.d.ts

@@ -1,5 +1,4 @@
 import type { WarmSessionStatusResult } from '../../uiConfirm/uiConfirm.types';
-import { type WarmSessionCapabilityReaderSeal } from './capabilityReaderCore';
 import { type WarmSessionStatusReaderDeps } from './statusReader';
 import { type WarmSessionReadPorts, type WarmSessionReadPortsInput } from './readModel';
 import type { WarmSessionCapabilityReader } from './types';
@@ -8,10 +7,10 @@ import type { WalletId } from '../../interfaces/ecdsaChainTarget';
 import type { ExactNearEd25519WalletSessionAuthorization } from '../material/nearEd25519YaoSigningPreparation';
 import type { EmailOtpWarmMaterialTarget } from '../../workerManager/workerTypes';
 import type { ActiveEcdsaCapabilityRuntimeForChainResolver, ActiveEcdsaCapabilityRuntimeResolver } from '../material/activeEcdsaCapabilityRuntime';
-export type WarmSessionCapabilityReaderSealInput = {
+type WarmSessionCapabilityReaderSealInput = {
     groupId: string;
 } | null;
-export type WarmSessionCapabilityReaderTouchConfirmInput = Exclude<WarmSessionReadPortsInput, undefined>;
+type WarmSessionCapabilityReaderTouchConfirmInput = Exclude<WarmSessionReadPortsInput, undefined>;
 export type WarmCapabilityReaderPortsConfigured = {
     runtimeStatus: 'configured';
     touchConfirm: WarmSessionReadPorts | null;
@@ -22,7 +21,6 @@ export type WarmCapabilityReaderPortsNoRuntimeStatus = {
     touchConfirm: null;
     getEmailOtpWarmSessionStatus: (target: EmailOtpWarmMaterialTarget) => Promise<WarmSessionStatusResult>;
 };
-export type WarmCapabilityReaderPorts = WarmCapabilityReaderPortsConfigured | WarmCapabilityReaderPortsNoRuntimeStatus;
 export type WarmSessionCapabilityReaderFactoryDeps = Omit<WarmSessionStatusReaderDeps, 'getEmailOtpWarmSessionStatus' | 'touchConfirm'> & {
     resolveActiveEcdsaCapabilityRuntime: ActiveEcdsaCapabilityRuntimeResolver;
     resolveActiveEcdsaCapabilityRuntimeForChain: ActiveEcdsaCapabilityRuntimeForChainResolver;
@@ -32,7 +30,6 @@ export type WarmSessionCapabilityReaderFactoryDeps = Omit<WarmSessionStatusReade
     resolveActiveEcdsaWalletSessionAuthorization?: ExactEcdsaWalletSessionAuthorizationResolver;
     resolveActiveEd25519WalletSessionAuthorization?: (walletId: WalletId) => Promise<ExactNearEd25519WalletSessionAuthorization | null>;
 };
-export declare function normalizeWarmCapabilityReaderPorts(deps: Pick<WarmSessionCapabilityReaderFactoryDeps, 'touchConfirm' | 'getEmailOtpWarmSessionStatus'>): WarmCapabilityReaderPorts;
-export declare function normalizeWarmSessionCapabilityReaderSeal(sealInput: WarmSessionCapabilityReaderSealInput): WarmSessionCapabilityReaderSeal;
 export declare function createWarmSessionCapabilityReader(deps: WarmSessionCapabilityReaderFactoryDeps): WarmSessionCapabilityReader;
+export {};
 //# sourceMappingURL=capabilityReader.d.ts.map