@seams/wallet 0.6.2 → 0.7.3

package/dist/types/wallet/src/core/indexedDB/seamsWalletDB/ecdsaCapabilityManifestRecords.d.ts

@@ -0,0 +1,155 @@
+import { type IsoTimestamp } from '../../../../../shared-ts/src/utils/canonicalPrimitives';
+import { type CapabilityInstanceRef } from '../../../../../shared-ts/src/utils/domainIds';
+import { parseEcdsaCiphertextB64u, parseEcdsaIv12B64u, type EcdsaCapabilityManifestId, type EcdsaCapabilityManifestRevision, type EcdsaMaterialSealingKeyId } from '../../../../../shared-ts/src/utils/ecdsaCapabilityActivation';
+import { type RuntimePolicyScope } from '../../../../../shared-ts/src/threshold/signingRootScope';
+import { type WalletAuthAuthorityRef } from '../../../../../shared-ts/src/utils/walletAuthAuthority';
+import { type EcdsaRoleLocalPublicFacts } from '../../platform';
+import { parseEcdsaRoleLocalBindingDigest, parseEcdsaRoleLocalDurableMaterialRef } from '../../signingEngine/session/keyMaterialBrands';
+import { type ActiveEcdsaCapabilityManifest, type BuildPreparedEcdsaActivationJournalInput, type DurableEcdsaMaterialBinding, type EcdsaActivationBinding, type EcdsaCapabilityActivationCommitJournal, type EcdsaCapabilityScope, type EcdsaRoleLocalMaterialBinding, type EncryptedEcdsaPendingCandidate, type EcdsaServerActivationCommit, type PreparedEcdsaActivationJournal, type ReplacedEcdsaCapabilityManifest, type ServerCommittedEcdsaActivationJournal, type ValidatedEncryptedEcdsaReadyMaterial } from '../../signingEngine/session/material/ecdsaCapabilityManifest';
+import type { VerifiedEcdsaPublicFacts } from '../../signingEngine/session/identity/evmFamilyEcdsaIdentity';
+export declare const MANIFEST_RECORD_VERSION: "ecdsa_capability_manifest_v3";
+export declare const MANIFEST_STORE: "ecdsa_capability_manifests";
+export declare const POINTER_STORE: "ecdsa_current_capability_manifests";
+export declare const MATERIAL_STORE: "ecdsa_role_local_material";
+export declare const JOURNAL_STORE: "ecdsa_activation_commit_journals";
+export declare const SEALING_KEY_STORE: "ecdsa_material_sealing_keys";
+export declare const PRESIGNATURE_STORE: "ecdsa_client_presignatures";
+export declare const AES_GCM_IV_BYTES = 12;
+export type EcdsaCapabilitySelector = {
+    readonly capability: CapabilityInstanceRef;
+    readonly authority: WalletAuthAuthorityRef;
+};
+type PreparedJournalInputWithoutCandidate<T> = T extends unknown ? Omit<T, 'candidate'> : never;
+export type PrepareEcdsaCapabilityActivationInput = PreparedJournalInputWithoutCandidate<BuildPreparedEcdsaActivationJournalInput> & {
+    readonly activationBinding: EcdsaActivationBinding;
+    readonly pendingPayloadB64u: string;
+};
+export type ParsedActiveManifestProof = {
+    readonly activationBinding: EcdsaActivationBinding;
+    readonly serverActivation: EcdsaServerActivationCommit;
+    readonly durableMaterial: DurableEcdsaMaterialBinding;
+    readonly activeManifest: ActiveEcdsaCapabilityManifest;
+    readonly committedAt: IsoTimestamp;
+};
+export type ParsedManifestRow = {
+    readonly state: 'active';
+    readonly selector: EcdsaCapabilitySelector;
+    readonly manifest: ActiveEcdsaCapabilityManifest;
+    readonly activeProof: ParsedActiveManifestProof;
+} | {
+    readonly state: 'replaced';
+    readonly selector: EcdsaCapabilitySelector;
+    readonly manifest: ReplacedEcdsaCapabilityManifest;
+    readonly activeProof: ParsedActiveManifestProof;
+    readonly replacementProof: ParsedActiveManifestProof;
+};
+export type ParsedPointerRow = {
+    readonly selector: EcdsaCapabilitySelector;
+    readonly manifestId: EcdsaCapabilityManifestId;
+    readonly manifestRevision: EcdsaCapabilityManifestRevision;
+};
+type ParsedSealingKeyRow = {
+    readonly keyId: EcdsaMaterialSealingKeyId;
+    readonly key: CryptoKey;
+};
+export declare function requireExactKeys(record: Record<string, unknown>, label: string, expectedKeys: readonly string[]): void;
+export declare function normalizeSelector(selector: EcdsaCapabilitySelector): EcdsaCapabilitySelector;
+export declare function selectorFromSigner(signer: EcdsaCapabilitySelector): EcdsaCapabilitySelector;
+export declare function selectorFromJournal(journal: EcdsaCapabilityActivationCommitJournal): EcdsaCapabilitySelector;
+export declare function selectorFromManifest(manifest: ActiveEcdsaCapabilityManifest): EcdsaCapabilitySelector;
+export declare function selectorKey(selector: EcdsaCapabilitySelector): readonly [string, string, string];
+export declare function selectorColumns(selector: EcdsaCapabilitySelector): {
+    capability_ref: CapabilityInstanceRef;
+    wallet_id: import("../../../../../shared-ts/src/utils").WalletId;
+    authority_digest: import("../../../../../shared-ts/src/utils").WalletAuthorityBindingDigest;
+    wallet_auth_method_id: import("../../../../../shared-ts/src/utils").WalletAuthMethodId;
+};
+export declare function walletAuthAuthorityRefsMatch(left: WalletAuthAuthorityRef, right: WalletAuthAuthorityRef): boolean;
+export declare function selectorsMatch(left: EcdsaCapabilitySelector, right: EcdsaCapabilitySelector): boolean;
+export declare function runtimePolicyScopesMatch(left: RuntimePolicyScope, right: RuntimePolicyScope): boolean;
+export declare function ecdsaCapabilityScopesMatch(left: EcdsaCapabilityScope, right: EcdsaCapabilityScope): boolean;
+export declare function ecdsaRoleLocalMaterialBindingsMatch(left: EcdsaRoleLocalMaterialBinding, right: EcdsaRoleLocalMaterialBinding): boolean;
+export declare function ecdsaRoleLocalPublicFactsMatch(left: EcdsaRoleLocalPublicFacts, right: EcdsaRoleLocalPublicFacts): boolean;
+export declare function ecdsaRegisteredPublicFactsMatch(left: VerifiedEcdsaPublicFacts, right: VerifiedEcdsaPublicFacts): boolean;
+export declare function ecdsaServerActivationCommitsMatch(left: EcdsaServerActivationCommit, right: EcdsaServerActivationCommit): boolean;
+export declare function ecdsaActivationCommitJournalsMatch(left: EcdsaCapabilityActivationCommitJournal, right: EcdsaCapabilityActivationCommitJournal): boolean;
+export declare function ecdsaDurableMaterialBindingsMatch(left: DurableEcdsaMaterialBinding, right: DurableEcdsaMaterialBinding): boolean;
+export declare function ecdsaActiveCapabilityManifestsMatch(left: ActiveEcdsaCapabilityManifest, right: ActiveEcdsaCapabilityManifest): boolean;
+export declare function buildPreparedJournalFromEncryptedCandidate(input: {
+    readonly preparation: PrepareEcdsaCapabilityActivationInput;
+    readonly encryptedPending: EncryptedEcdsaPendingCandidate;
+}): PreparedEcdsaActivationJournal;
+export declare function additionalData(projection: unknown): Uint8Array;
+export declare function generateMaterialSealingKey(): Promise<CryptoKey>;
+export declare function encryptStateBlob(input: {
+    readonly key: CryptoKey;
+    readonly stateBlobB64u: string;
+    readonly aadProjection: unknown;
+}): Promise<{
+    readonly iv12B64u: ReturnType<typeof parseEcdsaIv12B64u>;
+    readonly ciphertextB64u: ReturnType<typeof parseEcdsaCiphertextB64u>;
+    readonly digestB64u: string;
+}>;
+export declare function ciphertextDigestB64u(ciphertextB64u: string): Promise<string>;
+export declare function decryptStateBlob(input: {
+    readonly key: CryptoKey;
+    readonly iv12B64u: string;
+    readonly ciphertextB64u: string;
+    readonly aadProjection: unknown;
+}): Promise<string>;
+export declare function preparedJournalProjection(journal: EcdsaCapabilityActivationCommitJournal): PreparedEcdsaActivationJournal;
+export declare function parseCommittedJournal(value: unknown): ServerCommittedEcdsaActivationJournal;
+export declare function parseActiveProof(value: unknown): ParsedActiveManifestProof;
+export declare function parseManifestRow(value: unknown): ParsedManifestRow;
+export declare function storedPointerRow(manifest: ActiveEcdsaCapabilityManifest): {
+    manifest_id: EcdsaCapabilityManifestId;
+    manifest_revision: EcdsaCapabilityManifestRevision;
+    capability_ref: CapabilityInstanceRef;
+    wallet_id: import("../../../../../shared-ts/src/utils").WalletId;
+    authority_digest: import("../../../../../shared-ts/src/utils").WalletAuthorityBindingDigest;
+    wallet_auth_method_id: import("../../../../../shared-ts/src/utils").WalletAuthMethodId;
+    record_version: "ecdsa_current_capability_manifest_v2";
+};
+export declare function parsePointerRow(value: unknown): ParsedPointerRow;
+export declare function storedMaterialRow(material: ValidatedEncryptedEcdsaReadyMaterial, manifest: ActiveEcdsaCapabilityManifest): {
+    sealing_key_id: EcdsaMaterialSealingKeyId;
+    iv: import("../../../../../shared-ts/src/utils").EcdsaIv12B64u;
+    ciphertext: import("../../../../../shared-ts/src/utils").EcdsaCiphertextB64u;
+    capability_ref: CapabilityInstanceRef;
+    wallet_id: import("../../../../../shared-ts/src/utils").WalletId;
+    authority_digest: import("../../../../../shared-ts/src/utils").WalletAuthorityBindingDigest;
+    wallet_auth_method_id: import("../../../../../shared-ts/src/utils").WalletAuthMethodId;
+    record_version: "ecdsa_role_local_material_v2";
+    durable_material_ref: import("../../signingEngine/session/keyMaterialBrands").EcdsaRoleLocalDurableMaterialRef;
+    binding_digest: import("../../signingEngine/session/keyMaterialBrands").EcdsaRoleLocalBindingDigest;
+};
+export type ParsedMaterialLocator = {
+    readonly durableMaterialRef: ReturnType<typeof parseEcdsaRoleLocalDurableMaterialRef>;
+    readonly bindingDigest: ReturnType<typeof parseEcdsaRoleLocalBindingDigest>;
+    readonly selector: EcdsaCapabilitySelector;
+};
+export declare function parseMaterialLocator(value: unknown): ParsedMaterialLocator;
+export declare function parseMaterialRow(value: unknown, activeProof: ParsedActiveManifestProof): ValidatedEncryptedEcdsaReadyMaterial;
+export declare function materialMatchesManifest(material: ValidatedEncryptedEcdsaReadyMaterial, manifest: ActiveEcdsaCapabilityManifest): boolean;
+export declare function storedJournalRow(journal: EcdsaCapabilityActivationCommitJournal): {
+    journal: EcdsaCapabilityActivationCommitJournal;
+    capability_ref: CapabilityInstanceRef;
+    wallet_id: import("../../../../../shared-ts/src/utils").WalletId;
+    authority_digest: import("../../../../../shared-ts/src/utils").WalletAuthorityBindingDigest;
+    wallet_auth_method_id: import("../../../../../shared-ts/src/utils").WalletAuthMethodId;
+    record_version: "ecdsa_activation_commit_journal_v1";
+    journal_id: import("../../../../../shared-ts/src/utils").CorrelationId;
+};
+export declare function parseJournalRow(value: unknown): {
+    journal: EcdsaCapabilityActivationCommitJournal;
+    selector: EcdsaCapabilitySelector;
+};
+export declare function storedSealingKeyRow(keyId: EcdsaMaterialSealingKeyId, key: CryptoKey): {
+    record_version: "ecdsa_material_sealing_key_v1";
+    key_id: EcdsaMaterialSealingKeyId;
+    key: CryptoKey;
+};
+export declare function parseSealingKeyRow(value: unknown): ParsedSealingKeyRow;
+export declare function assertNever(value: never): never;
+export {};
+//# sourceMappingURL=ecdsaCapabilityManifestRecords.d.ts.map

package/dist/types/wallet/src/core/indexedDB/seamsWalletDB/ecdsaCapabilityManifestStore.d.ts

@@ -1,144 +1,19 @@
-import { type CorrelationId, type DigestB64u, type IsoTimestamp } from '../../../../../shared-ts/src/utils/canonicalPrimitives';
-import { type CapabilityInstanceRef, type MpcMaterialActivationRef, type WalletAuthMethodId, type WalletAuthorityId, type WalletId } from '../../../../../shared-ts/src/utils/domainIds';
-import { type EcdsaMaterialSealingKeyId } from '../../../../../shared-ts/src/utils/ecdsaCapabilityActivation';
-import { normalizeRuntimePolicyScope, type RuntimePolicyScope } from '../../../../../shared-ts/src/threshold/signingRootScope';
-import { type RouterAbEcdsaDerivationNormalSigningStateV1, type RouterAbEcdsaDerivationPublicCapabilityV1, type RouterAbEcdsaRegistrationActivationReceiptV1 } from '../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
-import { type WalletAuthAuthorityRef } from '../../../../../shared-ts/src/utils/walletAuthAuthority';
+import { type CorrelationId, type IsoTimestamp } from '../../../../../shared-ts/src/utils/canonicalPrimitives';
+import { type MpcMaterialActivationRef, type WalletId } from '../../../../../shared-ts/src/utils/domainIds';
+import { normalizeRuntimePolicyScope } from '../../../../../shared-ts/src/threshold/signingRootScope';
+import { type RouterAbEcdsaDerivationNormalSigningStateV1 } from '../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
+import type { WalletAuthAuthorityRef } from '../../../../../shared-ts/src/utils/walletAuthAuthority';
 import { type EcdsaRoleLocalPublicFacts } from '../../platform';
-import { parseEcdsaThresholdKeyId, type EcdsaRoleLocalPersistedMaterialRef } from '../../signingEngine/session/keyMaterialBrands';
-import { type ActiveEcdsaCapabilityManifest, type BuildPreparedEcdsaActivationJournalInput, type EcdsaActivationBinding, type EcdsaCapabilityActivationCommitJournal, type ServerReturnedEcdsaActivationCommit, type EcdsaServerActivationCommit, type PreparedEcdsaActivationJournal, type ReplacedEcdsaCapabilityManifest, type ServerCommittedEcdsaActivationJournal, type ValidatedEncryptedEcdsaReadyMaterial } from '../../signingEngine/session/material/ecdsaCapabilityManifest';
+import { type EcdsaRoleLocalPersistedMaterialRef } from '../../signingEngine/session/keyMaterialBrands';
+import { type ActiveEcdsaCapabilityManifest, type EcdsaActivationBinding, type ServerReturnedEcdsaActivationCommit, type EcdsaServerActivationCommit, type PreparedEcdsaActivationJournal, type ServerCommittedEcdsaActivationJournal, type ValidatedEncryptedEcdsaReadyMaterial } from '../../signingEngine/session/material/ecdsaCapabilityManifest';
 import type { VerifiedEcdsaPublicFacts } from '../../signingEngine/session/identity/evmFamilyEcdsaIdentity';
-import type { ThresholdEcdsaChainTarget } from '../../platform/types';
-import type { WalletCustodyEvmFamilyPublicFacts } from '../../../../../shared-ts/src/passkey-custody';
 import type { SeamsWalletDBManager, SeamsWalletTransactionContext } from './manager';
 import { type EcdsaClientPresignPoolIdentity } from '../../signingEngine/workerManager/ecdsaPresignPoolIdentity';
-import { type EcdsaClientPresignCleanupTarget, type EcdsaClientPresignUnavailableReason } from '../../signingEngine/workerManager/ecdsaPresignLifecycle';
-export type DurableClientPresignatureRecordId = string & {
-    readonly __brand: 'DurableClientPresignatureRecordId';
-};
-export type DurableClientPresignatureMetadata = {
-    readonly kind: 'sealed_available_client_presignature_v1';
-    readonly recordId: DurableClientPresignatureRecordId;
-    readonly poolIdentity: EcdsaClientPresignPoolIdentity;
-    readonly durableMaterialRef: EcdsaRoleLocalPersistedMaterialRef;
-    readonly presignatureId: string;
-    readonly groupPublicKey33B64u: string;
-    readonly bigR33B64u: string;
-    readonly createdAtMs: number;
-    readonly expiresAtMs: number;
-    readonly sealingKeyId: EcdsaMaterialSealingKeyId;
-};
-export type DurableClientPresignatureAdmissionResult = {
-    readonly kind: 'stored';
-    readonly metadata: DurableClientPresignatureMetadata;
-} | {
-    readonly kind: 'capacity_full';
-} | {
-    readonly kind: 'persistence_unavailable';
-} | {
-    readonly kind: 'persistence_ambiguous';
-};
-export type DurableClientPresignatureAdmissionInput = {
-    readonly poolIdentity: EcdsaClientPresignPoolIdentity;
-    readonly durableMaterialRef: EcdsaRoleLocalPersistedMaterialRef;
-    readonly presignatureId: string;
-    readonly groupPublicKey33: Uint8Array;
-    readonly bigR33: Uint8Array;
-    readonly plaintext97: Uint8Array;
-    readonly createdAtMs: number;
-    readonly expiresAtMs: number;
-};
-export type DurableClientPresignatureTakeResult = {
-    readonly kind: 'opened';
-    readonly metadata: DurableClientPresignatureMetadata;
-    readonly plaintext97: Uint8Array;
-} | {
-    readonly kind: Exclude<EcdsaClientPresignUnavailableReason, 'not_found'>;
-};
-export type EcdsaCapabilitySelector = {
-    readonly capability: CapabilityInstanceRef;
-    readonly authority: WalletAuthAuthorityRef;
-};
-export type ActiveEcdsaWalletCapabilitySubject = EcdsaCapabilitySelector & {
-    readonly ecdsaThresholdKeyId: ReturnType<typeof parseEcdsaThresholdKeyId>;
-};
-export type ActiveEcdsaWalletCapabilitySubjectListResult = {
-    readonly kind: 'resolved';
-    readonly subjects: readonly ActiveEcdsaWalletCapabilitySubject[];
-} | {
-    readonly kind: 'invalid_current_state';
-    readonly subjects?: never;
-} | {
-    readonly kind: 'persistence_unavailable';
-    readonly subjects?: never;
-};
-export type EcdsaWalletActivationSelectorListResult = {
-    readonly kind: 'resolved';
-    readonly selectors: readonly EcdsaCapabilitySelector[];
-} | {
-    readonly kind: 'invalid_current_state';
-    readonly selectors?: never;
-} | {
-    readonly kind: 'persistence_unavailable';
-    readonly selectors?: never;
-};
-type LookupFailureExclusions = {
-    readonly manifest?: never;
-    readonly material?: never;
-};
-export type EcdsaCapabilityManifestLookup = {
-    readonly kind: 'active';
-    readonly manifest: ActiveEcdsaCapabilityManifest;
-    readonly material: ValidatedEncryptedEcdsaReadyMaterial;
-} | {
-    readonly kind: 'retired';
-    readonly manifest: ReplacedEcdsaCapabilityManifest;
-    readonly material?: never;
-} | ({
-    readonly kind: 'missing';
-    readonly selector: EcdsaCapabilitySelector;
-    readonly subject: 'capability' | 'material';
-} & LookupFailureExclusions) | ({
-    readonly kind: 'exact_binding_mismatch';
-    readonly selector: EcdsaCapabilitySelector;
-    readonly failureDigest: DigestB64u;
-} & LookupFailureExclusions) | ({
-    readonly kind: 'exact_record_conflict';
-    readonly selector: EcdsaCapabilitySelector;
-    readonly conflictDigest: DigestB64u;
-} & LookupFailureExclusions) | ({
-    readonly kind: 'corrupt';
-    readonly selector: EcdsaCapabilitySelector;
-    readonly corruptionDigest: DigestB64u;
-} & LookupFailureExclusions) | ({
-    readonly kind: 'persistence_unavailable';
-    readonly selector: EcdsaCapabilitySelector;
-    readonly retryCorrelation: CorrelationId;
-} & LookupFailureExclusions);
-export type EcdsaActivationJournalWriteResult<TJournal extends EcdsaCapabilityActivationCommitJournal = EcdsaCapabilityActivationCommitJournal> = {
-    readonly kind: 'stored';
-    readonly journal: TJournal;
-} | {
-    readonly kind: 'exact_record_conflict';
-    readonly conflictDigest: DigestB64u;
-    readonly journal?: never;
-} | {
-    readonly kind: 'corrupt';
-    readonly corruptionDigest: DigestB64u;
-    readonly journal?: never;
-} | {
-    readonly kind: 'persistence_unavailable';
-    readonly retryCorrelation: CorrelationId;
-    readonly journal?: never;
-};
-export type EcdsaActivationJournalReadResult = {
-    readonly kind: 'found';
-    readonly journal: EcdsaCapabilityActivationCommitJournal;
-} | {
-    readonly kind: 'missing' | 'corrupt' | 'persistence_unavailable';
-    readonly journal?: never;
-};
-export type EcdsaPreparedActivationCancellationResult = {
+import { type EcdsaClientPresignCleanupTarget } from '../../signingEngine/workerManager/ecdsaPresignLifecycle';
+import { type EcdsaCapabilitySelector, type PrepareEcdsaCapabilityActivationInput } from './ecdsaCapabilityManifestRecords';
+import { type DurableClientPresignatureMetadata, type DurableClientPresignatureAdmissionResult, type DurableClientPresignatureAdmissionInput, type DurableClientPresignatureTakeResult } from './ecdsaClientPresignatures';
+import { type ActiveEcdsaWalletCapabilitySubjectListResult, type EcdsaWalletActivationSelectorListResult, type EcdsaCapabilityManifestLookup, type EcdsaActivationJournalWriteResult, type EcdsaActivationJournalReadResult, type EcdsaPreparedActivationOpenResult, type EcdsaActiveMaterialOpenResult, type EcdsaActiveMaterialRefOpenResult, type EcdsaCapabilityMaterialRefLookup, type EcdsaCapabilityActivationLookup, type EcdsaCapabilityActivationFinalizationResult } from './ecdsaCapabilityManifestLookups';
+type EcdsaPreparedActivationCancellationResult = {
     readonly kind: 'cancelled';
 } | {
     readonly kind: 'missing';
@@ -151,21 +26,11 @@ export type EcdsaPreparedActivationCancellationResult = {
 } | {
     readonly kind: 'persistence_unavailable';
 };
-export type FinalizeEcdsaCapabilityActivationInput = {
-    readonly committedJournal: ServerCommittedEcdsaActivationJournal;
-    readonly readyMaterial: ValidatedEncryptedEcdsaReadyMaterial;
-    readonly activeManifest: ActiveEcdsaCapabilityManifest;
-};
-type PreparedJournalInputWithoutCandidate<T> = T extends unknown ? Omit<T, 'candidate'> : never;
-export type PrepareEcdsaCapabilityActivationInput = PreparedJournalInputWithoutCandidate<BuildPreparedEcdsaActivationJournalInput> & {
-    readonly activationBinding: EcdsaActivationBinding;
-    readonly pendingPayloadB64u: string;
-};
-export type RecordEcdsaServerActivationInput = {
+type RecordEcdsaServerActivationInput = {
     readonly preparedJournal: PreparedEcdsaActivationJournal;
     readonly serverCommit: ServerReturnedEcdsaActivationCommit;
 };
-export type SealEcdsaCapabilityActivationInput = {
+type SealEcdsaCapabilityActivationInput = {
     readonly committedJournal: ServerCommittedEcdsaActivationJournal;
     readonly readyStateBlobB64u: string;
     readonly registeredPublicFacts: VerifiedEcdsaPublicFacts;
@@ -192,78 +57,9 @@ export type PreparedImportedWalletCustodyEcdsaContinuity = {
     readonly activeManifest: ActiveEcdsaCapabilityManifest;
     readonly roleLocalMaterialRef: EcdsaRoleLocalPersistedMaterialRef;
 };
-export type EcdsaPreparedActivationOpenResult = {
-    readonly kind: 'found';
-    readonly journal: EcdsaCapabilityActivationCommitJournal;
-    readonly pendingPayloadB64u: string;
-} | {
-    readonly kind: 'missing' | 'corrupt' | 'persistence_unavailable';
-    readonly journal?: never;
-    readonly pendingPayloadB64u?: never;
-};
-export type EcdsaActiveMaterialOpenResult = {
-    readonly kind: 'active';
-    readonly manifest: ActiveEcdsaCapabilityManifest;
-    readonly readyStateBlobB64u: string;
-} | Exclude<EcdsaCapabilityManifestLookup, {
-    readonly kind: 'active';
-}>;
-export type EcdsaActiveMaterialRefOpenResult = {
-    readonly kind: 'active';
-    readonly manifest: ActiveEcdsaCapabilityManifest;
-    readonly readyStateBlobB64u: string;
-} | {
-    readonly kind: 'missing' | 'binding_mismatch' | 'corrupt' | 'persistence_unavailable';
-    readonly manifest?: never;
-    readonly readyStateBlobB64u?: never;
-};
-type EcdsaCapabilityMaterialRefLookupFailure = {
-    readonly kind: 'missing';
-    readonly subject: 'capability' | 'material';
-    readonly capability: CapabilityInstanceRef;
-} | {
-    readonly kind: 'exact_binding_mismatch' | 'exact_record_conflict' | 'corrupt' | 'persistence_unavailable';
-    readonly capability: CapabilityInstanceRef;
-    readonly subject?: never;
-};
-export type EcdsaCapabilityMaterialRefLookup = Extract<EcdsaCapabilityManifestLookup, {
-    readonly kind: 'active' | 'retired';
-}> | EcdsaCapabilityMaterialRefLookupFailure;
-/**
- * R109C: one cryptographic activation can back several exact method-bound
- * access projections, one per wallet auth method installed on the same wallet
- * authority. A material activation therefore no longer names one manifest.
- * A caller that does not say which method it is acting as gets
- * `ambiguous_authority` and must ask again with the exact authority; picking a
- * sibling here would silently sign under a credential the caller never named.
- */
-export type EcdsaCapabilityActivationLookup = Extract<EcdsaCapabilityManifestLookup, {
-    readonly kind: 'active' | 'retired';
-}> | EcdsaCapabilityMaterialRefLookupFailure | {
-    readonly kind: 'ambiguous_authority';
-    readonly capability: CapabilityInstanceRef;
-    readonly authorities: readonly WalletAuthAuthorityRef[];
-    readonly subject?: never;
-};
-export type EcdsaCapabilityActivationFinalizationResult = {
-    readonly kind: 'committed';
-    readonly manifest: ActiveEcdsaCapabilityManifest;
-    readonly material: ValidatedEncryptedEcdsaReadyMaterial;
-} | ({
-    readonly kind: 'exact_record_conflict';
-    readonly selector: EcdsaCapabilitySelector;
-    readonly conflictDigest: DigestB64u;
-} & LookupFailureExclusions) | ({
-    readonly kind: 'corrupt';
-    readonly selector: EcdsaCapabilitySelector;
-    readonly corruptionDigest: DigestB64u;
-} & LookupFailureExclusions) | ({
-    readonly kind: 'persistence_unavailable';
-    readonly selector: EcdsaCapabilitySelector;
-    readonly retryCorrelation: CorrelationId;
-} & LookupFailureExclusions);
 export declare function prepareImportedWalletCustodyEcdsaContinuity(input: ImportCommittedWalletCustodyEcdsaActivationInput): Promise<PreparedImportedWalletCustodyEcdsaContinuity>;
 export declare function persistPreparedImportedWalletCustodyEcdsaContinuityInTransaction(context: SeamsWalletTransactionContext, prepared: PreparedImportedWalletCustodyEcdsaContinuity): Promise<void>;
+export declare function importCommittedActivation(store: IndexedDbEcdsaCapabilityManifestStore, input: ImportCommittedWalletCustodyEcdsaActivationInput, persist: (prepared: PreparedImportedWalletCustodyEcdsaContinuity) => Promise<void>): Promise<EcdsaCapabilityActivationFinalizationResult>;
 export declare class IndexedDbEcdsaCapabilityManifestStore {
     private readonly manager;
     constructor(manager?: SeamsWalletDBManager);
@@ -306,42 +102,5 @@ export declare class IndexedDbEcdsaCapabilityManifestStore {
     private readMaterialSealingKey;
     private finalizeActivation;
 }
-export type ImportWalletCustodyEcdsaContinuityInput = {
-    readonly store: IndexedDbEcdsaCapabilityManifestStore;
-    readonly authority: WalletAuthAuthorityRef;
-    readonly chainTargets: readonly [ThresholdEcdsaChainTarget, ...ThresholdEcdsaChainTarget[]];
-    readonly walletId: string;
-    readonly keyHandle: string;
-    readonly ecdsaThresholdKeyId: string;
-    readonly signingRootId: string;
-    readonly signingRootVersion: string;
-    readonly relayerKeyId: string;
-    readonly participantIds: readonly [number, number];
-    readonly publicCapability: RouterAbEcdsaDerivationPublicCapabilityV1;
-    readonly activationReceipt: RouterAbEcdsaRegistrationActivationReceiptV1;
-    readonly runtimePolicyScope: RuntimePolicyScope;
-    readonly readyStateBlobB64u: string;
-    readonly publicFacts: WalletCustodyEvmFamilyPublicFacts;
-};
-type WalletCustodyEcdsaContinuityInput = Omit<ImportWalletCustodyEcdsaContinuityInput, 'store'>;
-export declare function prepareWalletCustodyEcdsaContinuity(input: WalletCustodyEcdsaContinuityInput): Promise<PreparedImportedWalletCustodyEcdsaContinuity>;
-export declare function importWalletCustodyEcdsaContinuity(input: ImportWalletCustodyEcdsaContinuityInput): Promise<EcdsaCapabilityActivationFinalizationResult>;
-/**
- * R109C: give an added auth method its own encrypted access projection over the
- * activation the wallet already has. The activation is not re-created and the
- * source credential's authority is not widened; only a second method-bound
- * record over the same material appears.
- *
- * The membership check is the whole safety argument. Copying access to a method
- * on another wallet authority would hand that credential custody it was never
- * granted, so both methods are read back and required to be active members of
- * the exact same authority before anything is opened.
- */
-export declare function copyWalletCustodyEcdsaContinuityToAuthMethod(input: {
-    readonly walletId: WalletId;
-    readonly walletAuthorityId: WalletAuthorityId;
-    readonly sourceWalletAuthMethodId: WalletAuthMethodId;
-    readonly targetAuthority: WalletAuthAuthorityRef;
-}): Promise<void>;
 export {};
 //# sourceMappingURL=ecdsaCapabilityManifestStore.d.ts.map

package/dist/types/wallet/src/core/indexedDB/seamsWalletDB/ecdsaClientPresignatures.d.ts

@@ -0,0 +1,101 @@
+import { parseEcdsaCiphertextB64u, parseEcdsaCiphertextDigest, parseEcdsaIv12B64u, type EcdsaMaterialSealingKeyId } from '../../../../../shared-ts/src/utils/ecdsaCapabilityActivation';
+import { type EcdsaRoleLocalPersistedMaterialRef } from '../../signingEngine/session/keyMaterialBrands';
+import type { ValidatedEncryptedEcdsaReadyMaterial } from '../../signingEngine/session/material/ecdsaCapabilityManifest';
+import type { SeamsWalletTransactionContext } from './manager';
+import { type EcdsaClientPresignPoolIdentity } from '../../signingEngine/workerManager/ecdsaPresignPoolIdentity';
+import { type EcdsaClientPresignUnavailableReason } from '../../signingEngine/workerManager/ecdsaPresignLifecycle';
+export declare const MAX_DURABLE_CLIENT_PRESIGNATURE_FUTURE_SKEW_MS: number;
+type DurableClientPresignatureRecordId = string & {
+    readonly __brand: 'DurableClientPresignatureRecordId';
+};
+export type DurableClientPresignatureMetadata = {
+    readonly kind: 'sealed_available_client_presignature_v1';
+    readonly recordId: DurableClientPresignatureRecordId;
+    readonly poolIdentity: EcdsaClientPresignPoolIdentity;
+    readonly durableMaterialRef: EcdsaRoleLocalPersistedMaterialRef;
+    readonly presignatureId: string;
+    readonly groupPublicKey33B64u: string;
+    readonly bigR33B64u: string;
+    readonly createdAtMs: number;
+    readonly expiresAtMs: number;
+    readonly sealingKeyId: EcdsaMaterialSealingKeyId;
+};
+export type DurableClientPresignatureAdmissionResult = {
+    readonly kind: 'stored';
+    readonly metadata: DurableClientPresignatureMetadata;
+} | {
+    readonly kind: 'capacity_full';
+} | {
+    readonly kind: 'persistence_unavailable';
+} | {
+    readonly kind: 'persistence_ambiguous';
+};
+export type DurableClientPresignatureAdmissionInput = {
+    readonly poolIdentity: EcdsaClientPresignPoolIdentity;
+    readonly durableMaterialRef: EcdsaRoleLocalPersistedMaterialRef;
+    readonly presignatureId: string;
+    readonly groupPublicKey33: Uint8Array;
+    readonly bigR33: Uint8Array;
+    readonly plaintext97: Uint8Array;
+    readonly createdAtMs: number;
+    readonly expiresAtMs: number;
+};
+export type DurableClientPresignatureTakeResult = {
+    readonly kind: 'opened';
+    readonly metadata: DurableClientPresignatureMetadata;
+    readonly plaintext97: Uint8Array;
+} | {
+    readonly kind: Exclude<EcdsaClientPresignUnavailableReason, 'not_found'>;
+};
+export type SealedAvailableClientPresignatureRow = {
+    readonly kind: 'sealed_available_client_presignature_v1';
+    readonly record_id: DurableClientPresignatureRecordId;
+    readonly pool_identity: EcdsaClientPresignPoolIdentity;
+    readonly pool_identity_key: string;
+    readonly wallet_id: string;
+    readonly material_activation_id: string;
+    readonly durable_material_ref: EcdsaRoleLocalPersistedMaterialRef;
+    readonly presignature_id: string;
+    readonly group_public_key33_b64u: string;
+    readonly big_r33_b64u: string;
+    readonly created_at_ms: number;
+    readonly expires_at_ms: number;
+    readonly sealed: {
+        readonly kind: 'ecdsa_activation_aes_gcm_v1';
+        readonly sealing_key_id: EcdsaMaterialSealingKeyId;
+        readonly iv12_b64u: string;
+        readonly ciphertext_b64u: string;
+        readonly ciphertext_digest_b64u: string;
+    };
+};
+export declare function activeMaterialMatchesPresignature(material: ValidatedEncryptedEcdsaReadyMaterial, poolIdentity: EcdsaClientPresignPoolIdentity, materialRef: EcdsaRoleLocalPersistedMaterialRef): boolean;
+export declare function materialRefMatchesPoolIdentity(materialRef: EcdsaRoleLocalPersistedMaterialRef, poolIdentity: EcdsaClientPresignPoolIdentity): boolean;
+export declare function parseDurableClientPresignatureRecordId(value: unknown): DurableClientPresignatureRecordId;
+export declare function parsePresignatureTimestamp(value: unknown, label: string): number;
+export declare function rawRecordId(value: unknown): string | null;
+export declare function supportsStrictIndexedDbDurability(): boolean;
+type DeletableCursor = {
+    delete(): Promise<void>;
+    continue(): Promise<DeletableCursor | null>;
+};
+export declare function deleteCursorRows(cursor: DeletableCursor | null, limit?: number): Promise<number>;
+export declare function readAvailableClientPresignatureRows(context: SeamsWalletTransactionContext, poolIdentity: EcdsaClientPresignPoolIdentity, nowMs: number): Promise<SealedAvailableClientPresignatureRow[]>;
+export declare function parseSealedAvailableClientPresignatureRow(value: unknown): SealedAvailableClientPresignatureRow;
+export declare function metadataFromPresignatureRow(row: SealedAvailableClientPresignatureRow): DurableClientPresignatureMetadata;
+export declare function encryptPresignatureBytes(input: {
+    readonly key: CryptoKey;
+    readonly plaintext97: Uint8Array;
+    readonly metadata: DurableClientPresignatureMetadata;
+}): Promise<{
+    readonly iv12B64u: ReturnType<typeof parseEcdsaIv12B64u>;
+    readonly ciphertextB64u: ReturnType<typeof parseEcdsaCiphertextB64u>;
+    readonly ciphertextDigestB64u: ReturnType<typeof parseEcdsaCiphertextDigest>;
+}>;
+export declare function decryptPresignatureBytes(input: {
+    readonly key: CryptoKey;
+    readonly metadata: DurableClientPresignatureMetadata;
+    readonly sealed: SealedAvailableClientPresignatureRow['sealed'];
+}): Promise<Uint8Array>;
+export declare function retireClientPresignaturesForActivationInTransaction(context: SeamsWalletTransactionContext, walletId: string, materialActivationId: string): Promise<void>;
+export {};
+//# sourceMappingURL=ecdsaClientPresignatures.d.ts.map

package/dist/types/wallet/src/core/indexedDB/seamsWalletDB/laneHolderMaterialStore.d.ts

@@ -36,7 +36,6 @@ export type LaneSealedHolderMaterialRepositoryV1 = {
     }): Promise<readonly LaneSealedHolderRecordV1[]>;
     delete(input: LaneSealedHolderRecordLookupV1): Promise<void>;
 };
-export declare function parseLaneSealedHolderRecordV1(value: unknown): LaneSealedHolderRecordV1;
 export declare class LaneSealedHolderMaterialRepository implements LaneSealedHolderMaterialRepositoryV1 {
     private readonly seals;
     private readonly volatileRecords;

package/dist/types/wallet/src/core/indexedDB/seamsWalletDB/manager.d.ts

@@ -1,7 +1,7 @@
 import { type IDBPDatabase } from 'idb';
 import { type SeamsWalletDBConfig } from './schema';
 import { SEAMS_WALLET_DB_NAME, type SeamsWalletStoreName } from '../schemaNames';
-export type SeamsWalletTransactionMode = 'readonly' | 'readwrite';
+type SeamsWalletTransactionMode = 'readonly' | 'readwrite';
 export type SeamsWalletTransactionContext = {
     db: IDBPDatabase;
     tx: any;
@@ -22,4 +22,5 @@ export declare class SeamsWalletDBManager {
         readonly durability?: IDBTransactionDurability;
     }): Promise<T>;
 }
+export {};
 //# sourceMappingURL=manager.d.ts.map

package/dist/types/wallet/src/core/indexedDB/seamsWalletDB/pendingWalletRecoveryCodeBackup.d.ts

@@ -1,10 +1,10 @@
 import { type WalletRecoveryCodeSet } from '../../../../../shared-ts/src/wallet-recovery';
-export type PendingWalletRecoveryCodeBackup = {
+type PendingWalletRecoveryCodeBackup = {
     readonly walletId: string;
     readonly issuedAtMs: number;
     readonly recoveryCodes: WalletRecoveryCodeSet;
 };
-export declare class PendingWalletRecoveryCodeBackupRepository {
+declare class PendingWalletRecoveryCodeBackupRepository {
     write(input: {
         readonly walletId: string;
         readonly recoveryCodes: readonly string[];
@@ -15,4 +15,5 @@ export declare class PendingWalletRecoveryCodeBackupRepository {
     delete(walletIdInput: string): Promise<void>;
 }
 export declare const pendingWalletRecoveryCodeBackupRepository: PendingWalletRecoveryCodeBackupRepository;
+export {};
 //# sourceMappingURL=pendingWalletRecoveryCodeBackup.d.ts.map