@seams/wallet-server 0.15.6 → 0.18.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (174) hide show
  1. package/README.md +6 -6
  2. package/THIRD_PARTY_NOTICES.md +102 -1
  3. package/artifact-manifest.json +38 -33
  4. package/cloudflare-router-ab/build/deriver-a/build-stamp.json +1 -1
  5. package/cloudflare-router-ab/build/deriver-a/index.js +2 -2
  6. package/cloudflare-router-ab/build/deriver-a/index_bg.wasm +0 -0
  7. package/cloudflare-router-ab/build/deriver-b/build-stamp.json +1 -1
  8. package/cloudflare-router-ab/build/deriver-b/index.js +2 -2
  9. package/cloudflare-router-ab/build/deriver-b/index_bg.wasm +0 -0
  10. package/cloudflare-router-ab/build/local-tools/linux-x64/router_ab_local_init +0 -0
  11. package/cloudflare-router-ab/build/router/build-stamp.json +1 -1
  12. package/cloudflare-router-ab/build/router/index.js +2 -2
  13. package/cloudflare-router-ab/build/router/index_bg.wasm +0 -0
  14. package/cloudflare-router-ab/build/signing-worker/build-stamp.json +1 -1
  15. package/cloudflare-router-ab/build/signing-worker/index.js +2 -2
  16. package/cloudflare-router-ab/build/signing-worker/index_bg.wasm +0 -0
  17. package/cloudflare-router-ab/build/tenant-root-control-plane/build-stamp.json +1 -1
  18. package/cloudflare-router-ab/build/tenant-root-control-plane/index.js +2 -2
  19. package/cloudflare-router-ab/build/tenant-root-control-plane/index_bg.wasm +0 -0
  20. package/cloudflare-router-ab/migrations/postgres/0001_role_store.sql +567 -0
  21. package/dist/esm/authorization/factorEvidence.js +49 -8
  22. package/dist/esm/authorization/vaultProxyUse.js +15 -15
  23. package/dist/esm/core/SessionService.js +1 -0
  24. package/dist/esm/core/ThresholdService/kv.js +2 -0
  25. package/dist/esm/core/ThresholdService/routerAb/ecdsaDerivationPoolFillHandlers.js +3 -0
  26. package/dist/esm/core/d1IdentityStore.js +3 -1
  27. package/dist/esm/core/d1TenantStore.js +4 -1
  28. package/dist/esm/core/d1WalletAuthMethodStore.js +3 -1
  29. package/dist/esm/core/d1WalletStore.js +5 -2
  30. package/dist/esm/core/deviceLinking/linkedDeviceManagement.js +1 -4
  31. package/dist/esm/core/deviceLinking/linkedDeviceSession.js +2 -0
  32. package/dist/esm/core/deviceLinking/requestProof.js +1 -0
  33. package/dist/esm/core/routerAbSigning/RouterAbEcdsaPresignRuntime.js +2 -0
  34. package/dist/esm/core/routerAbSigning/RouterAbNormalSigningRuntime.js +3 -0
  35. package/dist/esm/core/rpcClients/near/NearClient.js +8 -0
  36. package/dist/esm/core/signingMaterial/ordinaryInactiveSignerMaterialReservation.js +0 -1
  37. package/dist/esm/localHostedWalletGatewayHandler.js +2 -2
  38. package/dist/esm/localIntendedEcdsaFinalizeFault.js +1 -1
  39. package/dist/esm/localIntendedLinkExecuteFault.js +1 -1
  40. package/dist/esm/localIntendedMaterialAdmissionFault.js +2 -2
  41. package/dist/esm/localIntendedRevokeFault.js +1 -1
  42. package/dist/esm/localIntendedSessionAdmissionFault.js +1 -1
  43. package/dist/esm/localIntendedYaoExportFault.js +1 -1
  44. package/dist/esm/localIntendedYaoFault.js +1 -1
  45. package/dist/esm/localIntendedYaoFinalizeFault.js +1 -1
  46. package/dist/esm/localIntendedYaoRecoveryFault.js +3 -3
  47. package/dist/esm/localIntendedYaoSigningFault.js +1 -1
  48. package/dist/esm/localRegistrationSetupAuthority.js +1 -0
  49. package/dist/esm/router/cloudflare/d1/auth/d1RouterApiAuthService.js +2 -2
  50. package/dist/esm/router/cloudflare/d1/authorization/d1AuthorizationStore.js +5 -0
  51. package/dist/esm/router/cloudflare/d1/authorization/d1VaultProxyStore.js +1 -0
  52. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService.js +1 -0
  53. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEd25519ExportRootStore.js +2 -0
  54. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEmailOtpGrantStore.js +2 -0
  55. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEmailOtpTargetFactor.js +3 -0
  56. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceOwnerAuthorizationProvider.js +2 -3
  57. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRequestProofNonceStore.js +2 -0
  58. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionStore.js +3 -0
  59. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSourceContributionPreparationPlanner.js +6 -2
  60. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetAuthenticatorStore.js +3 -0
  61. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetCredentialProvider.js +10 -2
  62. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetPlanner.js +3 -0
  63. package/dist/esm/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoCapabilityPersistence.js +6 -1
  64. package/dist/esm/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoLifecycleDecisionStore.js +2 -0
  65. package/dist/esm/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoProductRegistrationPartitionedStateStore.js +1 -1
  66. package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeIssuer.js +5 -0
  67. package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeService.js +8 -0
  68. package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeStore.js +6 -1
  69. package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeVerifier.js +4 -0
  70. package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpEnrollmentStore.js +1 -0
  71. package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpGrantStore.js +1 -0
  72. package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRecoveryService.js +4 -0
  73. package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer.js +2 -0
  74. package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpServerSealRuntime.js +1 -0
  75. package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationAttemptStore.js +3 -0
  76. package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpSessionResolver.js +6 -0
  77. package/dist/esm/router/cloudflare/d1/identity/d1IdentityService.js +1 -0
  78. package/dist/esm/router/cloudflare/d1/oidc/d1OidcBoundary.js +2 -4
  79. package/dist/esm/router/cloudflare/d1/oidc/d1OidcVerificationService.js +4 -0
  80. package/dist/esm/router/cloudflare/d1/passkeyCustody/d1PasskeyCustodyEnvelopeStore.js +4 -0
  81. package/dist/esm/router/cloudflare/d1/passkeyCustody/d1WalletCustodyCommitStore.js +7 -0
  82. package/dist/esm/router/cloudflare/d1/passkeyCustody/d1WalletRecoveryGoogleEmailOtpAttemptStore.js +1 -0
  83. package/dist/esm/router/cloudflare/d1/passkeyCustody/d1WalletRecoveryGoogleEmailOtpService.js +8 -0
  84. package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore.js +3 -0
  85. package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyStore.js +1 -0
  86. package/dist/esm/router/cloudflare/d1/registration/d1RegistrationIntentService.js +1 -0
  87. package/dist/esm/router/cloudflare/d1/registration/d1RegistrationSessionTransaction.js +1 -1
  88. package/dist/esm/router/cloudflare/d1/registration/d1WalletOperationStore.js +2 -0
  89. package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationCommitStore.js +3 -0
  90. package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationService.js +24 -0
  91. package/dist/esm/router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.js +3 -0
  92. package/dist/esm/router/cloudflare/d1/versionedJson/d1VersionedJsonRecordStore.js +6 -0
  93. package/dist/esm/router/cloudflare/d1/wallet/d1WalletAddSignerService.js +11 -0
  94. package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthMethodRevocationReplayStore.js +2 -0
  95. package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthMethodService.js +16 -0
  96. package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthorityStore.js +3 -1
  97. package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnAuthService.js +4 -0
  98. package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnStore.js +5 -1
  99. package/dist/esm/router/cloudflare/durableObjects/versionedJsonRecordStore.js +6 -0
  100. package/dist/esm/router/cloudflare/runtime/ed25519SessionAdapter.js +6 -0
  101. package/dist/esm/router/cloudflare/runtime/walletAuthorizationRelocationRoutes.js +117 -117
  102. package/dist/esm/router/cloudflare/runtime/walletPlacementRoutes.js +51 -51
  103. package/dist/esm/router/cloudflare/signingLanes/cloudflareOrdinaryInactiveSignerMaterialReservation.js +3 -3
  104. package/dist/esm/router/cloudflare.js +114 -61
  105. package/dist/esm/router/domains/ecdsa/routerAbEcdsaStrictRegistration.js +1 -1
  106. package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js +2 -1
  107. package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationRequestScopedRuntime.js +2 -1
  108. package/dist/esm/router/domains/ed25519Yao/export/routerAbEd25519YaoExport.js +6 -8
  109. package/dist/esm/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery.js +11 -9
  110. package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoHttpRegistrationBackend.js +2 -1
  111. package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistration.js +11 -9
  112. package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationIntentAuthorization.js +2 -3
  113. package/dist/esm/router/domains/signingOperations/routerAbNormalSigningAdmissionCore.js +2 -4
  114. package/dist/esm/router/domains/walletRegistration/registrationSessionSeal.js +1 -1
  115. package/dist/esm/router/framework/http.js +1 -1
  116. package/dist/esm/router/framework/ror/staticProvider.js +1 -0
  117. package/dist/esm/router/ror.js +1 -0
  118. package/dist/esm/shared-ts/src/authorization/delegatedAuthority.js +1 -1
  119. package/dist/esm/shared-ts/src/authorization/operationFingerprint.js +6 -0
  120. package/dist/esm/shared-ts/src/device-linking/sourceContribution.js +5 -5
  121. package/dist/esm/shared-ts/src/near/nearClient.js +6 -0
  122. package/dist/esm/shared-ts/src/tenant-root/tenantRootIdentity.js +5 -0
  123. package/dist/esm/shared-ts/src/utils/domainIds.js +7 -0
  124. package/dist/esm/shared-ts/src/utils/routerAbEd25519Yao.js +7 -6
  125. package/dist/esm/storage/tenantRoute.js +4 -0
  126. package/dist/esm/threshold/session/signingSessionSeal/crypto/cipher.js +1 -1
  127. package/dist/esm/threshold/session/signingSessionSeal/crypto/shamir3PassWasm.js +1 -1
  128. package/dist/esm/threshold/session/signingSessionSeal/guards/backends.js +2 -0
  129. package/dist/esm/threshold/session/signingSessionSeal/guards/index.js +2 -1
  130. package/dist/esm/threshold/session/signingSessionSeal/idempotencyBackends.js +3 -0
  131. package/dist/types/shared-ts/src/authorization/capabilityKinds.d.ts +14 -14
  132. package/dist/types/shared-ts/src/authorization/delegatedAuthority.d.ts +1 -1
  133. package/dist/types/shared-ts/src/device-linking/ed25519ExportRoot.d.ts +1 -1
  134. package/dist/types/shared-ts/src/device-linking/requestProof.d.ts +1 -1
  135. package/dist/types/shared-ts/src/device-linking/sourceContribution.d.ts +5 -5
  136. package/dist/types/shared-ts/src/passkey-custody/custodyEnvelope.d.ts +3 -3
  137. package/dist/types/shared-ts/src/passkey-custody/custodySecretBinding.d.ts +1 -1
  138. package/dist/types/shared-ts/src/tenant-root/tenantRootIdentity.d.ts +1 -1
  139. package/dist/types/shared-ts/src/tenant-root/tenantRootOperationRecord.d.ts +2 -2
  140. package/dist/types/shared-ts/src/utils/base64.d.ts +2 -2
  141. package/dist/types/shared-ts/src/utils/digestEncoding.d.ts +1 -1
  142. package/dist/types/shared-ts/src/utils/digests.d.ts +2 -2
  143. package/dist/types/shared-ts/src/utils/emailOtpDomain.d.ts +16 -16
  144. package/dist/types/shared-ts/src/utils/emailOtpRecoveryKey.d.ts +1 -1
  145. package/dist/types/shared-ts/src/utils/routerAbEcdsaDerivation.d.ts +10 -10
  146. package/dist/types/shared-ts/src/utils/routerAbEd25519Yao.d.ts +12 -11
  147. package/dist/types/shared-ts/src/utils/routerAbPublicKeyset.d.ts +3 -3
  148. package/dist/types/shared-ts/src/utils/routerAbTraceContext.d.ts +1 -1
  149. package/dist/types/shared-ts/src/utils/signerDomain.d.ts +15 -15
  150. package/dist/types/shared-ts/src/utils/signingSessionSeal.d.ts +11 -11
  151. package/dist/types/shared-ts/src/utils/walletSessionFailure.d.ts +8 -8
  152. package/dist/types/shared-ts/src/utils/webauthnDeviceInfo.d.ts +2 -2
  153. package/dist/types/shared-ts/src/utils/wireSchema.d.ts +1 -1
  154. package/dist/types/shared-ts/src/wallet-recovery/recoveryKeyId.d.ts +1 -1
  155. package/dist/types/wallet-server/src/authorization/factorEvidence.d.ts +6 -6
  156. package/dist/types/wallet-server/src/core/ecdsaMaterialReadSnapshot.d.ts +1 -1
  157. package/dist/types/wallet-server/src/core/threeRouteRegistrationContracts.typecheck.d.ts +6 -6
  158. package/dist/types/wallet-server/src/router/auth/webAuthnCredentialCodecs.d.ts +1 -1
  159. package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetCredentialProvider.d.ts +1 -1
  160. package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetPlanner.d.ts +3 -3
  161. package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationRead.d.ts +2 -2
  162. package/dist/types/wallet-server/src/router/cloudflare/d1/registration/walletRegistrationEstablishedSessionIssuer.d.ts +2 -2
  163. package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/authorizationSnapshotLayout.d.ts +1 -1
  164. package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletRelocationOwner.d.ts +9 -9
  165. package/dist/types/wallet-server/src/router/cloudflare/signingLanes/cloudflareOrdinaryInactiveSignerMaterialReservation.d.ts +6 -6
  166. package/dist/types/wallet-server/src/router/domains/signingOperations/signingPrepareSession.d.ts +2 -2
  167. package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationSetupPayload.d.ts +1 -1
  168. package/dist/types/wallet-server/src/router/domains/walletUnlock/walletUnlockRequestedCapabilitiesValidation.d.ts +3 -3
  169. package/dist/types/wallet-server/src/router/framework/apiCredentialPorts.d.ts +1 -1
  170. package/dist/types/wallet-server/src/router/framework/routeAuthPolicy.d.ts +2 -2
  171. package/dist/types/wallet-server/src/router/framework/routeExecutionContext.d.ts +1 -1
  172. package/dist/types/wallet-server/src/router/transport/fetch/routes/deviceLinkingOwnerAuthorization.d.ts +1 -1
  173. package/migrations/d1-signer/0082_wallet_signature_completions.sql +39 -0
  174. package/package.json +4 -5
@@ -14,132 +14,132 @@ import { D1WalletRelocationWriteBlock } from "../d1/wallet/d1WalletRelocationWri
14
14
  const BASE_PATH = "/internal/wallet-relocation/v1/authorization";
15
15
  const ORIGIN = "https://wallet-relocation.internal";
16
16
  var WalletAuthorizationRelocationRoutes = class {
17
- constructor(options) {
18
- this.options = options;
19
- this.kind = "fetch_route_extension";
20
- this.id = "wallet_authorization_relocation";
21
- this.routes = [
22
- {
23
- id: "wallet_authorization_block",
24
- surface: "relay",
25
- method: "POST",
26
- path: `${BASE_PATH}/block`,
27
- auth: {
28
- plane: "public",
29
- rationale: "The private Console binding holds a wallet-local capacity block after destination preparation."
30
- },
31
- metering: { kind: "none" },
32
- summary: "Reserve source snapshot capacity"
17
+ kind = "fetch_route_extension";
18
+ id = "wallet_authorization_relocation";
19
+ routes = [
20
+ {
21
+ id: "wallet_authorization_block",
22
+ surface: "relay",
23
+ method: "POST",
24
+ path: `${BASE_PATH}/block`,
25
+ auth: {
26
+ plane: "public",
27
+ rationale: "The private Console binding holds a wallet-local capacity block after destination preparation."
33
28
  },
34
- {
35
- id: "wallet_authorization_release",
36
- surface: "relay",
37
- method: "POST",
38
- path: `${BASE_PATH}/release`,
39
- auth: {
40
- plane: "public",
41
- rationale: "Console durably rejects admission before releasing the source block."
42
- },
43
- metering: { kind: "none" },
44
- summary: "Release an unadmitted source block"
29
+ metering: { kind: "none" },
30
+ summary: "Reserve source snapshot capacity"
31
+ },
32
+ {
33
+ id: "wallet_authorization_release",
34
+ surface: "relay",
35
+ method: "POST",
36
+ path: `${BASE_PATH}/release`,
37
+ auth: {
38
+ plane: "public",
39
+ rationale: "Console durably rejects admission before releasing the source block."
45
40
  },
46
- {
47
- id: "wallet_authorization_schema",
48
- surface: "relay",
49
- method: "POST",
50
- path: `${BASE_PATH}/schema`,
51
- auth: {
52
- plane: "public",
53
- rationale: "The private Console binding checks source schema before relocation preparation."
54
- },
55
- metering: { kind: "none" },
56
- summary: "Read authorization transfer schema identity"
41
+ metering: { kind: "none" },
42
+ summary: "Release an unadmitted source block"
43
+ },
44
+ {
45
+ id: "wallet_authorization_schema",
46
+ surface: "relay",
47
+ method: "POST",
48
+ path: `${BASE_PATH}/schema`,
49
+ auth: {
50
+ plane: "public",
51
+ rationale: "The private Console binding checks source schema before relocation preparation."
57
52
  },
58
- {
59
- id: "wallet_authorization_reserve",
60
- surface: "relay",
61
- method: "POST",
62
- path: `${BASE_PATH}/reserve`,
63
- auth: {
64
- plane: "public",
65
- rationale: "The private Console binding prepares an empty destination before source pause."
66
- },
67
- metering: { kind: "none" },
68
- summary: "Reserve inactive authorization destination"
53
+ metering: { kind: "none" },
54
+ summary: "Read authorization transfer schema identity"
55
+ },
56
+ {
57
+ id: "wallet_authorization_reserve",
58
+ surface: "relay",
59
+ method: "POST",
60
+ path: `${BASE_PATH}/reserve`,
61
+ auth: {
62
+ plane: "public",
63
+ rationale: "The private Console binding prepares an empty destination before source pause."
69
64
  },
70
- {
71
- id: "wallet_relocation_owner_approval",
72
- surface: "relay",
73
- method: "POST",
74
- path: `${BASE_PATH}/owner-approval`,
75
- auth: {
76
- plane: "public",
77
- rationale: "The internal binding reads fresh durable owner approval for Console admission."
78
- },
79
- metering: { kind: "none" },
80
- summary: "Read fresh owner approval for relocation admission"
65
+ metering: { kind: "none" },
66
+ summary: "Reserve inactive authorization destination"
67
+ },
68
+ {
69
+ id: "wallet_relocation_owner_approval",
70
+ surface: "relay",
71
+ method: "POST",
72
+ path: `${BASE_PATH}/owner-approval`,
73
+ auth: {
74
+ plane: "public",
75
+ rationale: "The internal binding reads fresh durable owner approval for Console admission."
81
76
  },
82
- {
83
- id: "wallet_authorization_cleanup",
84
- surface: "relay",
85
- method: "POST",
86
- path: `${BASE_PATH}/cleanup`,
87
- auth: {
88
- plane: "public",
89
- rationale: "Console must authorize cleanup after destination activation with the pinned authorization manifest."
90
- },
91
- metering: { kind: "none" },
92
- summary: "Delete one bounded batch of obsolete source authorization state"
77
+ metering: { kind: "none" },
78
+ summary: "Read fresh owner approval for relocation admission"
79
+ },
80
+ {
81
+ id: "wallet_authorization_cleanup",
82
+ surface: "relay",
83
+ method: "POST",
84
+ path: `${BASE_PATH}/cleanup`,
85
+ auth: {
86
+ plane: "public",
87
+ rationale: "Console must authorize cleanup after destination activation with the pinned authorization manifest."
93
88
  },
94
- {
95
- id: "wallet_authorization_activate",
96
- surface: "relay",
97
- method: "POST",
98
- path: `${BASE_PATH}/activate`,
99
- auth: {
100
- plane: "public",
101
- rationale: "Console must authorize activation after cutover with the pinned authorization manifest."
102
- },
103
- metering: { kind: "none" },
104
- summary: "Activate the verified authorization destination"
89
+ metering: { kind: "none" },
90
+ summary: "Delete one bounded batch of obsolete source authorization state"
91
+ },
92
+ {
93
+ id: "wallet_authorization_activate",
94
+ surface: "relay",
95
+ method: "POST",
96
+ path: `${BASE_PATH}/activate`,
97
+ auth: {
98
+ plane: "public",
99
+ rationale: "Console must authorize activation after cutover with the pinned authorization manifest."
105
100
  },
106
- {
107
- id: "wallet_authorization_freeze",
108
- surface: "relay",
109
- method: "POST",
110
- path: `${BASE_PATH}/freeze`,
111
- auth: {
112
- plane: "public",
113
- rationale: "The handler requires an internal origin and a live Console-authorized gateway freeze command."
114
- },
115
- metering: { kind: "none" },
116
- summary: "Freeze and capture admitted authorization history"
101
+ metering: { kind: "none" },
102
+ summary: "Activate the verified authorization destination"
103
+ },
104
+ {
105
+ id: "wallet_authorization_freeze",
106
+ surface: "relay",
107
+ method: "POST",
108
+ path: `${BASE_PATH}/freeze`,
109
+ auth: {
110
+ plane: "public",
111
+ rationale: "The handler requires an internal origin and a live Console-authorized gateway freeze command."
117
112
  },
118
- {
119
- id: "wallet_authorization_export",
120
- surface: "relay",
121
- method: "POST",
122
- path: `${BASE_PATH}/export`,
123
- auth: {
124
- plane: "public",
125
- rationale: "The handler requires an internal origin and a live Console-authorized source export command."
126
- },
127
- metering: { kind: "none" },
128
- summary: "Export the sealed authorization snapshot"
113
+ metering: { kind: "none" },
114
+ summary: "Freeze and capture admitted authorization history"
115
+ },
116
+ {
117
+ id: "wallet_authorization_export",
118
+ surface: "relay",
119
+ method: "POST",
120
+ path: `${BASE_PATH}/export`,
121
+ auth: {
122
+ plane: "public",
123
+ rationale: "The handler requires an internal origin and a live Console-authorized source export command."
129
124
  },
130
- {
131
- id: "wallet_authorization_import",
132
- surface: "relay",
133
- method: "POST",
134
- path: `${BASE_PATH}/import`,
135
- auth: {
136
- plane: "public",
137
- rationale: "Console authorizes an atomic import of the pinned snapshot."
138
- },
139
- metering: { kind: "none" },
140
- summary: "Import and verify the complete authorization snapshot"
141
- }
142
- ];
125
+ metering: { kind: "none" },
126
+ summary: "Export the sealed authorization snapshot"
127
+ },
128
+ {
129
+ id: "wallet_authorization_import",
130
+ surface: "relay",
131
+ method: "POST",
132
+ path: `${BASE_PATH}/import`,
133
+ auth: {
134
+ plane: "public",
135
+ rationale: "Console authorizes an atomic import of the pinned snapshot."
136
+ },
137
+ metering: { kind: "none" },
138
+ summary: "Import and verify the complete authorization snapshot"
139
+ }
140
+ ];
141
+ constructor(options) {
142
+ this.options = options;
143
143
  }
144
144
  async ownerApproval(body) {
145
145
  const walletId = parseWalletId(body.walletId);
@@ -11,60 +11,60 @@ import { WalletRelocationReadAccess } from "../d1/wallet/d1WalletRelocationReadA
11
11
  //#region src/router/cloudflare/runtime/walletPlacementRoutes.ts
12
12
  const BASE_PATH = "/wallet/placement/v1";
13
13
  var WalletPlacementRoutes = class {
14
- constructor(options) {
15
- this.options = options;
16
- this.kind = "fetch_route_extension";
17
- this.id = "wallet_placement";
18
- this.routes = [
19
- {
20
- id: "wallet_relocation_challenge",
21
- surface: "relay",
22
- method: "POST",
23
- path: `${BASE_PATH}/relocations/challenge`,
24
- auth: {
25
- plane: "public",
26
- rationale: "The handler requires an authenticated full-owner Wallet Session."
27
- },
28
- metering: { kind: "none" },
29
- summary: "Issue a fresh owner relocation challenge"
14
+ kind = "fetch_route_extension";
15
+ id = "wallet_placement";
16
+ routes = [
17
+ {
18
+ id: "wallet_relocation_challenge",
19
+ surface: "relay",
20
+ method: "POST",
21
+ path: `${BASE_PATH}/relocations/challenge`,
22
+ auth: {
23
+ plane: "public",
24
+ rationale: "The handler requires an authenticated full-owner Wallet Session."
30
25
  },
31
- {
32
- id: "wallet_relocation_post",
33
- surface: "relay",
34
- method: "POST",
35
- path: `${BASE_PATH}/relocations`,
36
- auth: {
37
- plane: "public",
38
- rationale: "The handler authenticates an owner or bounded move-read credential before exact replay."
39
- },
40
- metering: { kind: "none" },
41
- summary: "Admit or replay an exact wallet relocation"
26
+ metering: { kind: "none" },
27
+ summary: "Issue a fresh owner relocation challenge"
28
+ },
29
+ {
30
+ id: "wallet_relocation_post",
31
+ surface: "relay",
32
+ method: "POST",
33
+ path: `${BASE_PATH}/relocations`,
34
+ auth: {
35
+ plane: "public",
36
+ rationale: "The handler authenticates an owner or bounded move-read credential before exact replay."
42
37
  },
43
- {
44
- id: "wallet_placement_get",
45
- surface: "relay",
46
- method: "GET",
47
- path: BASE_PATH,
48
- auth: {
49
- plane: "public",
50
- rationale: "The handler authenticates the full-owner Wallet Session."
51
- },
52
- metering: { kind: "none" },
53
- summary: "Read wallet placement"
38
+ metering: { kind: "none" },
39
+ summary: "Admit or replay an exact wallet relocation"
40
+ },
41
+ {
42
+ id: "wallet_placement_get",
43
+ surface: "relay",
44
+ method: "GET",
45
+ path: BASE_PATH,
46
+ auth: {
47
+ plane: "public",
48
+ rationale: "The handler authenticates the full-owner Wallet Session."
54
49
  },
55
- {
56
- id: "wallet_relocation_get",
57
- surface: "relay",
58
- method: "GET",
59
- path: `${BASE_PATH}/relocations/:moveId`,
60
- auth: {
61
- plane: "public",
62
- rationale: "The handler authenticates a full owner or bounded move-read credential."
63
- },
64
- metering: { kind: "none" },
65
- summary: "Read wallet relocation progress"
66
- }
67
- ];
50
+ metering: { kind: "none" },
51
+ summary: "Read wallet placement"
52
+ },
53
+ {
54
+ id: "wallet_relocation_get",
55
+ surface: "relay",
56
+ method: "GET",
57
+ path: `${BASE_PATH}/relocations/:moveId`,
58
+ auth: {
59
+ plane: "public",
60
+ rationale: "The handler authenticates a full owner or bounded move-read credential."
61
+ },
62
+ metering: { kind: "none" },
63
+ summary: "Read wallet relocation progress"
64
+ }
65
+ ];
66
+ constructor(options) {
67
+ this.options = options;
68
68
  }
69
69
  async handleFetchRoute(input) {
70
70
  return this.handle(input.request);
@@ -344,10 +344,10 @@ function hasExactKeysV1(value, keys) {
344
344
  * silently changing the request while preserving the endpoint's exact result.
345
345
  */
346
346
  var CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1 = class {
347
+ ed25519Reservations = /* @__PURE__ */ new Map();
348
+ ecdsaReservations = /* @__PURE__ */ new Map();
347
349
  constructor(endpoint) {
348
350
  this.endpoint = endpoint;
349
- this.ed25519Reservations = /* @__PURE__ */ new Map();
350
- this.ecdsaReservations = /* @__PURE__ */ new Map();
351
351
  }
352
352
  async reserveInactiveEd25519SignerMaterialV1(input) {
353
353
  validateOrdinaryInactiveSignerMaterialReservationRequestV1(input);
@@ -386,9 +386,9 @@ function createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1(inpu
386
386
  return createOrdinaryInactiveSignerMaterialReservationServiceV1({ worker: new CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1(input.endpoint) });
387
387
  }
388
388
  var CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1 = class {
389
+ terminalOperations = /* @__PURE__ */ new Map();
389
390
  constructor(endpoint) {
390
391
  this.endpoint = endpoint;
391
- this.terminalOperations = /* @__PURE__ */ new Map();
392
392
  }
393
393
  async deactivateOrdinarySignerMaterialV1(input) {
394
394
  validateOrdinaryInactiveSignerMaterialDeactivationRequestV1(input);