@seams/wallet-server 0.27.0 → 0.29.0

package/dist/esm/router/domains/ecdsa/routerAbEcdsaStrictRegistration.js

@@ -1,7 +1,7 @@
 import { parseRouterAbEcdsaDerivationActivationRefreshCommitRequestV1, parseRouterAbEcdsaDerivationActivationRefreshResponseV1, parseRouterAbEcdsaDerivationExplicitExportRequestV1, parseRouterAbEcdsaExplicitExportProtocolForwardedResponseV1, parseRouterAbEcdsaRegistrationActivationReceiptV1, parseRouterAbEcdsaStrictForwardedRegistrationResponseV1, projectRouterAbEcdsaDerivationExplicitExportRequestToProtocolV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { ROUTER_AB_TRACE_ID_HEADER_V1 } from "../../../shared-ts/src/utils/routerAbTraceContext.js";
 import { walletObjectIdentity, walletObjectIdentityHeaders } from "../../cloudflare/runtime/walletObjectAddresses.js";
 import { ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1, normalizeRouterAbInternalServiceAuthSecret } from "../../../core/ThresholdService/routerAb/internalServiceHttp.js";
-import { ROUTER_AB_TRACE_ID_HEADER_V1 } from "../../../shared-ts/src/utils/routerAbTraceContext.js";
 //#region src/router/domains/ecdsa/routerAbEcdsaStrictRegistration.ts
 const STRICT_ECDSA_REGISTRATION_PATH = "/router-ab/ecdsa-derivation/register";
 const STRICT_ECDSA_ADD_SIGNER_PATH = "/router-ab/ecdsa-derivation/add-signer";

package/dist/esm/router/domains/ed25519Yao/export/routerAbEd25519YaoExport.js

@@ -1,23 +1,23 @@
 import { parseEmailOtpChallengeId, parseThresholdEd25519SessionId, parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseAuthFactorId, parseAuthorizationAuditEventId, parseAuthorizationEvidenceId, parseAuthorizationEvidenceSetId, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parsePrincipalId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { buildCapabilityOperationEnvelope } from "../../../../shared-ts/src/authorization/operationFingerprint.js";
 import "../../../../shared-ts/src/utils/encoders.js";
+import { parseAuthFactorId, parseAuthorizationAuditEventId, parseAuthorizationEvidenceId, parseAuthorizationEvidenceSetId, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parsePrincipalId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { buildCapabilityOperationEnvelope } from "../../../../shared-ts/src/authorization/operationFingerprint.js";
 import { sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { deriveRouterAbEd25519YaoExportAuthorizationDigestV1, deriveRouterAbEd25519YaoExportConfirmationDigestV1, deriveRouterAbEd25519YaoRuntimePolicyBindingV1 } from "../../../../shared-ts/src/utils/routerAbEd25519YaoDigests.js";
 import { ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, parseRouterAbEd25519YaoExportAdmissionReceiptV1, parseRouterAbEd25519YaoExportAdmissionRequestV1, parseRouterAbEd25519YaoExportExecuteRequestV1, parseRouterAbEd25519YaoExportResultV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseSessionOrigin, parseVerifiedOwnerProofId } from "../../../../authorization/domain.js";
 import { buildVerifiedWalletOperationEmailOtpFactorResult, buildVerifiedWalletOperationPasskeyFactorResult } from "../../../../authorization/factorEvidence.js";
-import { defineRoute } from "../../../framework/routeDefinitions.js";
+import { WALLET_EMAIL_OTP_EXPORT_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
+import { parseWebAuthnAuthenticationCredential, webAuthnCredentialIdB64uFromCredential } from "../../../auth/webAuthnCredentialCodecs.js";
 import { normalizeCorsOrigin } from "../../../../core/SessionService.js";
 import { ROUTER_AB_TRACE_ID_HEADER_V1, createRouterAbTraceContextV1, parseRouterAbTraceContextV1 } from "../../../../shared-ts/src/utils/routerAbTraceContext.js";
 import { json, readJson } from "../../../framework/http.js";
-import { parseWebAuthnAuthenticationCredential, webAuthnCredentialIdB64uFromCredential } from "../../../auth/webAuthnCredentialCodecs.js";
-import { WALLET_EMAIL_OTP_EXPORT_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
+import { defineRoute } from "../../../framework/routeDefinitions.js";
 import { createRouterApiModule } from "../../../framework/modules.js";
 //#region src/router/domains/ed25519Yao/export/routerAbEd25519YaoExport.ts
 const EXPORT_AUTH_MAX_TTL_MS = 6e4;

package/dist/esm/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery.js

@@ -2,10 +2,10 @@ import { parseThresholdEd25519SessionId } from "../../../../shared-ts/src/utils/
 import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, parseRouterAbEd25519YaoRecoveryActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRecoveryActivationExecuteRequestV1, parseRouterAbEd25519YaoRecoveryActivationReceiptV1, parseRouterAbEd25519YaoRecoveryActivationRequestV1, parseRouterAbEd25519YaoRecoveryActivationResultV1, parseRouterAbEd25519YaoRecoveryAdmissionRequestV1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationActivationResultV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1, parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1, sameRouterAbEd25519YaoActivationBindingV1, sameRouterAbEd25519YaoActivationPublicReceiptV1, sameRouterAbEd25519YaoRecoveryAdmissionRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { normalizeRuntimePolicyScope, signingRootScopeFromRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
-import { ROUTER_AB_ED25519_NORMAL_SIGNING_STATE_KIND } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
-import { defineRoute } from "../../../framework/routeDefinitions.js";
 import { ROUTER_AB_TRACE_ID_HEADER_V1, createRouterAbTraceContextV1, parseRouterAbTraceContextV1 } from "../../../../shared-ts/src/utils/routerAbTraceContext.js";
 import { json, readJson } from "../../../framework/http.js";
+import { ROUTER_AB_ED25519_NORMAL_SIGNING_STATE_KIND } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
+import { defineRoute } from "../../../framework/routeDefinitions.js";
 import { createRouterApiModule } from "../../../framework/modules.js";
 //#region src/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery.ts
 function requireThresholdEd25519SessionId(value, label) {

package/dist/esm/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryWalletSessionAuthorization.js

@@ -1,6 +1,6 @@
 import { parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { NEAR_ED25519_MPC_OPERATION_KINDS } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
+import { NEAR_ED25519_MPC_OPERATION_KINDS } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { sameRouterAbEd25519YaoByteSequence } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";

package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoHttpRegistrationBackend.js

@@ -1,8 +1,8 @@
 import { requireRecord } from "../../../../shared-ts/src/utils/validation.js";
 import { deriveRouterAbEd25519YaoStableContextBindingV1 } from "../../../../shared-ts/src/utils/routerAbEd25519YaoDigests.js";
 import { parseRouterAbEd25519YaoActivationKeysetV1, parseRouterAbEd25519YaoActivationResultV1, parseRouterAbEd25519YaoExportResultV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
-import { walletObjectIdentity, walletObjectIdentityHeaders } from "../../../cloudflare/runtime/walletObjectAddresses.js";
 import { createRouterAbTraceContextV1 } from "../../../../shared-ts/src/utils/routerAbTraceContext.js";
+import { walletObjectIdentity, walletObjectIdentityHeaders } from "../../../cloudflare/runtime/walletObjectAddresses.js";
 import { routerAbEd25519YaoRegistrationSigningRootIdV1, routerAbEd25519YaoTenantRootWireV1 } from "../routerAbEd25519YaoGatewayEnvelope.js";
 //#region src/router/domains/ed25519Yao/registration/routerAbEd25519YaoHttpRegistrationBackend.ts
 const INTERNAL_AUTH_HEADER = "x-router-ab-internal-service-auth";

package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistration.js

@@ -1,8 +1,8 @@
 import { sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationActivationExecuteRequestV1, parseRouterAbEd25519YaoRegistrationActivationResultV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1, sameRouterAbEd25519YaoActivationBindingV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
-import { defineRoute } from "../../../framework/routeDefinitions.js";
 import { ROUTER_AB_TRACE_ID_HEADER_V1, createRouterAbTraceContextV1, parseRouterAbTraceContextV1 } from "../../../../shared-ts/src/utils/routerAbTraceContext.js";
 import { json, readJson } from "../../../framework/http.js";
+import { defineRoute } from "../../../framework/routeDefinitions.js";
 import { createRouterApiModule } from "../../../framework/modules.js";
 //#region src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistration.ts
 function resolveTraceContext(request) {

package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationIntentAuthorization.js

@@ -1,7 +1,7 @@
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { deriveRouterAbEd25519YaoStableContextBindingV1 } from "../../../../shared-ts/src/utils/routerAbEd25519YaoDigests.js";
 import { deriveSigningRootId } from "../../../../shared-ts/src/threshold/signingRootScope.js";
-import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { computeAddSignerNearEd25519SigningKeyId } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { findRegistrationSignerPlanNearEd25519Branch, registrationNearEd25519BranchKey, registrationSignerPlanFromSelection } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
 //#region src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationIntentAuthorization.ts

package/dist/esm/router/domains/emailOtp/emailOtpRouteHandlers.js

@@ -1,10 +1,10 @@
 import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
 import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
-import "../../../shared-ts/src/utils/encoders.js";
 import { failure } from "../../../shared-ts/src/utils/failure.js";
-import { emailOtpStatusCode } from "./emailOtpSessionRouteHelpers.js";
+import "../../../shared-ts/src/utils/encoders.js";
 import { EMAIL_OTP_FACTOR_RELEASE_AAD_DOMAIN_V1 } from "../../../shared-ts/src/utils/emailOtpDomain.js";
+import { emailOtpStatusCode } from "./emailOtpSessionRouteHelpers.js";
 //#region src/router/domains/emailOtp/emailOtpRouteHandlers.ts
 function decodeEmailOtpFactorSecret32(value) {
 	const magnitude = base64UrlDecode(value);

package/dist/esm/router/domains/passkeyCustody/walletCustodyRegistrationCommit.js

@@ -4,11 +4,11 @@ import { parseDigestField, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u,
 import { parsePasskeyCustodySecretBinding } from "../../../shared-ts/src/passkey-custody/custodySecretBinding.js";
 import { buildActiveEnvelopeLifecycle, buildPasskeyCustodyEnvelopeRecord, parseWalletCustodyEnvelopeFactor, parseWalletCustodyEnvelopeOwnershipWireV1 } from "../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import "../../../shared-ts/src/passkey-custody/index.js";
+import { parseRecoveryCodeLocatorV1 } from "../../../shared-ts/src/wallet-recovery/recoveryCodeLocator.js";
 import { parseDerivedWalletRecoveryKeyId } from "../../../shared-ts/src/wallet-recovery/recoveryKeyId.js";
 import { buildWalletRecoveryBackupAcknowledgementV1 } from "../../../shared-ts/src/wallet-recovery/backupAcknowledgement.js";
 import "../../../shared-ts/src/wallet-recovery/recoveryCodes.js";
 import { buildWalletCustodySeedRecoveryEntry, buildWalletRecoveryEnvelopeSetRecord, buildWalletRecoveryManifestKekWrap } from "../../../shared-ts/src/wallet-recovery/walletRecoveryEnvelopeSet.js";
-import { parseRecoveryCodeLocatorV1 } from "../../../shared-ts/src/wallet-recovery/recoveryCodeLocator.js";
 import "../../../shared-ts/src/wallet-recovery/index.js";
 //#region src/router/domains/passkeyCustody/walletCustodyRegistrationCommit.ts
 function requireNonEmpty(value, label) {

package/dist/esm/router/domains/signingOperations/routerAbEcdsaDerivationNormalSigningRoute.js

@@ -1,12 +1,12 @@
 import { parseWalletId } from "../../../shared-ts/src/utils/domainIds.js";
-import { buildAuthorizationGrantRef, buildEvmEcdsaMpcOperationRef, parseAuthorizationAuditEventId, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
 import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { buildAuthorizationGrantRef, buildEvmEcdsaMpcOperationRef, parseAuthorizationAuditEventId, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
 import { buildCapabilityOperationEnvelope, computeCapabilityOperationFingerprintDigest } from "../../../shared-ts/src/authorization/operationFingerprint.js";
 import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1, parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1, parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1, routerAbEcdsaDerivationActiveStateId, sameRouterAbEcdsaDerivationNormalSigningScopeV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { authorizedOperationReplayBodyInit } from "../../../authorization/domain.js";
-import { WALLET_SESSION_FAILURE_CODES } from "../../../shared-ts/src/utils/walletSessionFailure.js";
 import { extractBearerCredential } from "../../auth/routerApiKeyAuth.js";
+import { WALLET_SESSION_FAILURE_CODES } from "../../../shared-ts/src/utils/walletSessionFailure.js";
 import { walletSessionFailure, walletSessionFailureStatus } from "../../auth/walletSessionFailure.js";
 import { validateRouterAbEcdsaDerivationWalletSessionInputs } from "../../auth/commonRouterUtils.js";
 import { signingPrepareSessionResponse } from "./signingPrepareSession.js";

package/dist/esm/router/domains/signingOperations/routerAbEd25519NormalSigningRoute.js

@@ -1,10 +1,10 @@
-import { mpcMaterialActivationRefsEqual } from "../../../shared-ts/src/utils/domainIds.js";
-import { buildNearEd25519MpcOperationRef, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
+import { mpcMaterialActivationRefsEqual, parseWalletId } from "../../../shared-ts/src/utils/domainIds.js";
 import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
 import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { buildCapabilityOperationEnvelope, computeCapabilityOperationFingerprintDigest, parseSigningOperationFingerprintDigest } from "../../../shared-ts/src/authorization/operationFingerprint.js";
 import "../../../shared-ts/src/utils/encoders.js";
+import { buildNearEd25519MpcOperationRef, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
+import { buildCapabilityOperationEnvelope, computeCapabilityOperationFingerprintDigest, parseSigningOperationFingerprintDigest } from "../../../shared-ts/src/authorization/operationFingerprint.js";
 import { routerAbMpcMaterialActivationRefFromWire, routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { extractBearerCredential } from "../../auth/routerApiKeyAuth.js";
 import { validateRouterAbEd25519WalletSessionInputs } from "../../auth/commonRouterUtils.js";
@@ -263,6 +263,40 @@ function isWalletSessionUnavailableStepUpError(result) {
 	return isPlainObject(result.body) && result.body.code === "wallet_session_unavailable";
 }
 async function authenticateRouterAbWalletOperationStepUp(input) {
+	if (!extractBearerCredential(input.headers) && input.authorizedOperations) {
+		const origin = parseStepUpRequestOrigin(input.headers);
+		if (!origin.ok) return origin;
+		const operationId = requireAuthorizationValue(parseAuthorizedOperationId(`normal-signing-operation:${input.scope.request_id}`));
+		const parsedWalletId = parseWalletId(input.scope.account_id);
+		if (!parsedWalletId.ok) return walletSessionScopeInvalidFailure();
+		const walletId = parsedWalletId.value;
+		const recorded = await input.authorizedOperations.resolveRecordedPasskeyOwnerOperation({
+			authorizedOperationId: operationId,
+			walletId,
+			requestOrigin: origin.requestOrigin,
+			nowMs: Date.now()
+		});
+		if (!recorded || input.requestExpiresAtMs > recorded.expiresAtMs) return {
+			ok: false,
+			error: routerAbStepUpError(403, "unauthorized", "Recorded owner approval is unavailable")
+		};
+		const activeMaterial = await input.resolveEd25519MaterialActivation({
+			walletId,
+			materialActivation: input.scope.material_activation
+		});
+		if (!activeMaterial.ok) return walletSessionScopeInvalidFailure();
+		return authenticateRouterAbWalletOperationStepUpIdentity({
+			kind: "verified_owner_proof",
+			headers: input.headers,
+			walletId,
+			materialOwner: input.scope.material_activation.material_owner,
+			operationId: recorded.operation.operation.operationId,
+			authority: recorded.authority,
+			runtimePolicyScope: activeMaterial.runtimePolicyScope,
+			expiresAtMs: recorded.expiresAtMs,
+			authorizedOperations: input.authorizedOperations
+		});
+	}
 	return authenticateRouterAbWalletOperationStepUpIdentity({
 		kind: "wallet_session_operation_credential_v1",
 		headers: input.headers,

package/dist/esm/router/domains/signingOperations/routerAbOperationStepUp.js

@@ -1,7 +1,7 @@
 import { parseProviderSubject } from "../../../shared-ts/src/utils/domainIds.js";
-import { parsePrincipalId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import "../../../shared-ts/src/utils/encoders.js";
+import { parsePrincipalId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
 import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { walletAuthAuthorityRef } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseSessionOrigin } from "../../../authorization/domain.js";

package/dist/esm/router/domains/tenantRoot/tenantRootIdentityResolution.js

@@ -1,6 +1,6 @@
+import { failure } from "../../../shared-ts/src/utils/failure.js";
 import { sameRouterAbMpcMaterialActivationRef } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { signingRootScopeFromRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
-import { failure } from "../../../shared-ts/src/utils/failure.js";
 import { buildTenantRootIdentityFromAuthenticatedDeploymentV1, isTenantRootIdentityFieldCanonicalV1 } from "../../../shared-ts/src/tenant-root/tenantRootIdentity.js";
 //#region src/router/domains/tenantRoot/tenantRootIdentityResolution.ts
 const FORBIDDEN_TENANT_ROOT_SELECTOR_FIELDS_V1 = [

package/dist/esm/router/domains/walletRegistration/walletRegistrationReservation.js

@@ -1,7 +1,8 @@
 import { parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId } from "../../../shared-ts/src/utils/domainIds.js";
-import { parseDeviceId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
-import { isPlainObject, requireCanonicalString } from "../../../shared-ts/src/utils/validation.js";
+import { isPlainObject, requireCanonicalString, requireRecord } from "../../../shared-ts/src/utils/validation.js";
 import { alphabetizeStringify, sha256HexUtf8 } from "../../../shared-ts/src/utils/digests.js";
+import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { parseDeviceId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
 import { secureRandomBase64Url } from "../../../shared-ts/src/utils/secureRandomId.js";
 import { createServerAllocatedWalletId } from "../../../shared-ts/src/utils/registrationIds.js";
 //#region src/router/domains/walletRegistration/walletRegistrationReservation.ts
@@ -44,6 +45,7 @@ async function walletRegistrationSetupRequestDigest(namespace, input) {
 		runtimePolicyScope: input.runtimePolicyScope,
 		expectedOrigin: input.expectedOrigin,
 		wallet: input.request.wallet ?? { kind: "server_allocated" },
+		completion: input.request.completion,
 		authMethod: input.request.authMethod,
 		signerSelection: input.request.signerSelection
 	}));
@@ -64,7 +66,20 @@ async function admitRegistrationReservationHome(authority, input) {
 	};
 	return authority.admitHome(input);
 }
+function parseRegistrationSessionPublication(raw, walletId) {
+	const value = requireRecord(raw, "registration session publication");
+	if (value.kind === "none") return { kind: "none" };
+	if (value.kind !== "credential" || value.walletId !== String(walletId)) throw new Error("Invalid registration session publication");
+	const expiresAtMs = value.expiresAtMs;
+	if (typeof expiresAtMs !== "number" || !Number.isSafeInteger(expiresAtMs) || expiresAtMs <= 0) throw new Error("Invalid registration session publication expiry");
+	return {
+		kind: "credential",
+		walletId,
+		digest: parseDigestB64u(value.digest),
+		expiresAtMs
+	};
+}
 //#endregion
-export { admitRegistrationReservationHome, cancelRegistrationHome, parseWalletRegistrationSetupReservation, proposeWalletRegistrationSetup, walletRegistrationSetupRequestDigest };
+export { admitRegistrationReservationHome, cancelRegistrationHome, parseRegistrationSessionPublication, parseWalletRegistrationSetupReservation, proposeWalletRegistrationSetup, walletRegistrationSetupRequestDigest };
 
 //# sourceMappingURL=walletRegistrationReservation.js.map

package/dist/esm/router/domains/walletRegistration/walletRegistrationRoutes.js

@@ -1,34 +1,34 @@
 import { parseWalletAuthMethodId, parseWalletId, parseWebAuthnRpId } from "../../../shared-ts/src/utils/domainIds.js";
-import { EVM_ECDSA_MPC_OPERATION_KINDS, NEAR_ED25519_MPC_OPERATION_KINDS, parseWalletSessionId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
 import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
 import { base64UrlDecode } from "../../../shared-ts/src/utils/base64.js";
 import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { base58Encode } from "../../../shared-ts/src/utils/base58.js";
 import "../../../shared-ts/src/utils/encoders.js";
+import { EVM_ECDSA_MPC_OPERATION_KINDS, NEAR_ED25519_MPC_OPERATION_KINDS, parseWalletSessionId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
 import { parseRouterAbEd25519YaoRegistrationActivationExecuteRequestV1 } from "../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { ecdsaClientRootPublicKey33B64uFromString } from "../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { normalizeRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
 import { parseRouterAbEcdsaRegistrationActivationRequestV1, parseRouterAbEcdsaRegistrationRequestV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { normalizeAddAuthMethodInput, normalizeEmailOtpRegistrationProof, normalizeRegistrationAuthMethodInput } from "../../../shared-ts/src/utils/registrationAuthMethodInput.js";
 import { parseHostedWalletSessionOperationCredentialToken, parsePrimaryWalletSessionOperationCredentialToken, parseSessionOrigin } from "../../../authorization/domain.js";
+import { routeError, routeJson } from "../../framework/routeResponses.js";
+import { extractBearerCredential, extractRouterApiEnvironmentId } from "../../auth/routerApiKeyAuth.js";
 import { normalizeCorsOrigin } from "../../../core/SessionService.js";
+import { parseRouterAbTraceContextV1 } from "../../../shared-ts/src/utils/routerAbTraceContext.js";
 import { thresholdEcdsaChainTargetFromValue } from "../../../core/thresholdEcdsaChainTarget.js";
 import { walletIdFromString } from "../../../shared-ts/src/utils/registrationIds.js";
 import { recordRegistrationServerTiming, registrationServerTimingHeaders } from "../../framework/registrationTiming.js";
 import { parseRegistrationSetupOperationId } from "../../../shared-ts/src/utils/registrationSetupOperation.js";
-import { extractBearerCredential, extractRouterApiEnvironmentId } from "../../auth/routerApiKeyAuth.js";
 import { publishableKeyRoutePrincipal, resolvePublishableKeyApiCredentialAuth, resolveWalletRegistrationContext } from "../../auth/routerApiCredentialAuth.js";
 import { resolveActiveRuntimePolicyScopeForEnvironment, resolveWalletSessionAdministrationAdmission, resolveWalletSessionOperationCredentialAdmission, resolveWalletSessionOperationCredentialAdmissionFromContext } from "../../auth/commonRouterUtils.js";
 import { enforceRoutePolicy } from "../../framework/enforceRoutePolicy.js";
 import { parseRegistrationPreparedSessionSeal } from "./registrationSessionSeal.js";
-import { routeError, routeJson } from "../../framework/routeResponses.js";
 import { parsePasskeyCustodyEnvelopeRecord } from "../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import "../../../shared-ts/src/passkey-custody/index.js";
 import { computeWalletEcdsaKeyFactsInventoryChallengeDigestB64u } from "../../../shared-ts/src/utils/ecdsaKeyFactsInventory.js";
 import { deriveImplicitNearAccountIdFromEd25519PublicKey, parseImplicitNearAccountId } from "../../../shared-ts/src/utils/near.js";
 import { normalizeRegistrationSignerPlan, registrationSignerSetSelectionFromPlan } from "../../../shared-ts/src/utils/registrationSignerPlan.js";
 import { addAuthMethodIntentGrantFromString, addSignerIntentGrantFromString, computeAddAuthMethodIntentDigestB64u, computeAddSignerIntentDigestB64u, normalizeAddAuthMethodIntentCaller } from "../../../shared-ts/src/utils/registrationIntent.js";
-import { parseRouterAbTraceContextV1 } from "../../../shared-ts/src/utils/routerAbTraceContext.js";
 //#region src/router/domains/walletRegistration/walletRegistrationRoutes.ts
 function parseRegistrationTraceContext(headers) {
 	const parsed = parseRouterAbTraceContextV1(headers["x-seams-trace-id"] ?? headers["X-Seams-Trace-Id"]);
@@ -343,12 +343,19 @@ function parseWalletRegistrationSetupRequest(body) {
 		code: "invalid_body",
 		message: "authMethod is required"
 	};
+	const completion = body.completion ?? "wallet_session";
+	if (completion !== "wallet_session" && completion !== "owner_operations") return {
+		ok: false,
+		code: "invalid_body",
+		message: "Invalid registration completion"
+	};
 	const wallet = parseWalletRegistrationSetupWallet(body.wallet);
 	if (!wallet.ok) return wallet;
 	return {
 		ok: true,
 		value: {
 			registrationOperationId,
+			completion,
 			...wallet.value ? { wallet: wallet.value } : {},
 			signerSelection: signerSelection.value.selection,
 			authMethod
@@ -1928,6 +1935,7 @@ async function handleRouterApiWalletRegistrationNearProvisioning(input) {
 	if (sessionSeal.value) {
 		if (!isPasskeyWalletRegistrationNearProvisioningSuccessV2(result)) return routeError(400, "invalid_body", "Registration session sealing requires a passkey authority");
 		const sealStartedAt = Date.now();
+		if (result.registrationEstablishedSession.kind === "owner_operations") return routeError(400, "invalid_body", "Owner registration has no session seal");
 		const sealed = await sessionSeal.value.finish(result.registrationEstablishedSession.session);
 		serverTiming.push(["near_finalize_session_seal", Math.max(0, Date.now() - sealStartedAt)]);
 		if (!sealed.ok) return routeJson(503, {

package/dist/esm/router/domains/walletUnlock/walletUnlockRouteHandlers.js

@@ -1,14 +1,14 @@
 import { parseEmailOtpChallengeId, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../shared-ts/src/utils/domainIds.js";
-import { parseAuthFactorId, parsePrincipalId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
 import { alphabetizeStringify } from "../../../shared-ts/src/utils/digests.js";
 import { sha256Utf8DigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { failure } from "../../../shared-ts/src/utils/failure.js";
+import { parseAuthFactorId, parsePrincipalId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
 import { ROUTER_AB_ED25519_YAO_EMAIL_OTP_RECOVERY_BOOTSTRAP_KIND_V1 } from "../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { walletAuthAuthorityRef } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseSessionOrigin, parseVerifiedOwnerProofId, projectActiveWalletSession } from "../../../authorization/domain.js";
 import { buildVerifiedWalletSessionEmailOtpFactorResult, buildVerifiedWalletSessionPasskeyFactorResult } from "../../../authorization/factorEvidence.js";
-import { failure } from "../../../shared-ts/src/utils/failure.js";
-import { emailOtpFailureWebhookEventDescriptors, emailOtpLoggedInWebhookEventDescriptor } from "../emailOtp/emailOtpSessionRouteHelpers.js";
 import { EMAIL_OTP_CHANNEL } from "../../../shared-ts/src/utils/emailOtpDomain.js";
+import { emailOtpFailureWebhookEventDescriptors, emailOtpLoggedInWebhookEventDescriptor } from "../emailOtp/emailOtpSessionRouteHelpers.js";
 import { thresholdEd25519StatusCode } from "../../../threshold/statusCodes.js";
 import { parseWalletUnlockBackend } from "../emailOtp/emailOtpRequestValidation.js";
 //#region src/router/domains/walletUnlock/walletUnlockRouteHandlers.ts

package/dist/esm/router/framework/http.js

@@ -1,7 +1,7 @@
+import { failure } from "../../shared-ts/src/utils/failure.js";
 import { ROUTER_AB_ED25519_YAO_RECOVERY_CHALLENGE_ID_HEADER_V1 } from "../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { LINKED_DEVICE_REQUEST_PROOF_HEADER_V1 } from "../../shared-ts/src/device-linking/requestProof.js";
 import "../../shared-ts/src/device-linking/index.js";
-import { failure } from "../../shared-ts/src/utils/failure.js";
 import { buildCorsOrigins, normalizeCorsOrigin } from "../../core/SessionService.js";
 import { ROUTER_AB_TRACE_ID_HEADER_V1 } from "../../shared-ts/src/utils/routerAbTraceContext.js";
 import { WALLET_MANAGEMENT_PROTOCOL_HEADER } from "../../shared-ts/src/utils/walletManagementProtocol.js";

package/dist/esm/router/framework/routeDefinitions.js

@@ -1,5 +1,6 @@
 import { ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH } from "../../shared-ts/src/utils/routerAbPublicKeyset.js";
 import { ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH, ROUTER_AB_ECDSA_DERIVATION_HEALTH_PATH, ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_PATH, ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_PREPARE_PATH, ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_INIT_PATH, ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_STEP_PATH, ROUTER_AB_ECDSA_DERIVATION_REFRESH_PATH, ROUTER_AB_ECDSA_DERIVATION_SESSION_ACTIVATION_PATH } from "../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { externalAuthRoutes } from "../transport/fetch/routes/externalAuth.js";
 import { ROUTER_AB_ED25519_HEALTH_PATH, ROUTER_AB_ED25519_NORMAL_SIGNING_PATH, ROUTER_AB_ED25519_NORMAL_SIGNING_PREPARE_PATH, ROUTER_AB_ED25519_WALLET_SESSION_PATH } from "../../shared-ts/src/utils/signingSessionSeal.js";
 import { buildSigningSessionSealApplyPath, buildSigningSessionSealRemovePath, resolveSigningSessionSealBasePath } from "../../threshold/session/signingSessionSeal/transport/shared.js";
 import { API_CREDENTIAL_ROUTE_SCOPES, API_CREDENTIAL_TYPES, PUBLIC_PROOF_TYPES } from "./routeAuthPolicy.js";
@@ -222,7 +223,7 @@ function apiCredentialRoute(id, method, path, summary, auth, metering, requiredS
 }
 function createRouterApiRouteDefinitions(options = {}) {
 	const signingSessionSealBasePath = resolveSigningSessionSealBasePath(options.signingSessionSealBasePath);
-	const definitions = [];
+	const definitions = externalAuthRoutes();
 	if (options.enableHealthz) definitions.push(publicRoute("router_api_healthz", "GET", "/healthz", "Router API health probe", {
 		plane: "public",
 		rationale: "Health probes are intentionally public diagnostics."

package/dist/esm/router/transport/fetch/createFetchRouter.js

@@ -1,13 +1,14 @@
-import { EVM_ECDSA_MPC_OPERATION_KINDS, NEAR_ED25519_MPC_OPERATION_KINDS } from "../../../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
+import { EVM_ECDSA_MPC_OPERATION_KINDS, NEAR_ED25519_MPC_OPERATION_KINDS } from "../../../shared-ts/src/authorization/capabilityKinds.js";
 import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { routerAbEcdsaDerivationActiveStateId } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { findRouteDefinitionForRequest } from "../../framework/routeDefinitions.js";
 import { extractBearerCredential } from "../../auth/routerApiKeyAuth.js";
+import { json, jsonFailure, withCors } from "../../framework/http.js";
+import { handleExternalAuth } from "./routes/externalAuth.js";
+import { findRouteDefinitionForRequest } from "../../framework/routeDefinitions.js";
 import { resolveWalletSessionOperationCredentialAdmissionFromContext } from "../../auth/commonRouterUtils.js";
 import { getRouterApiRouteExtensionRoutes, getRouterApiRouteExtensionsForTransport } from "../../framework/routeExtensions.js";
 import { coerceRouterLogger } from "../../framework/logger.js";
-import { json, jsonFailure, withCors } from "../../framework/http.js";
 import { handleHealth, handleReady } from "./routes/health.js";
 import { handleWalletRegistration } from "./routes/walletRegistration.js";
 import { handleWalletVoiceIdActivation } from "./routes/walletVoiceIdActivation.js";
@@ -224,6 +225,7 @@ function createFetchRouter(service, opts, runtime) {
 		handleWalletRecoveryRotate,
 		handleWalletRecoveryRead,
 		handleWalletRecoveryStatus,
+		handleExternalAuth,
 		handleAuth,
 		handleSyncAccount,
 		handleOwnerWalletExecutionLanePreflight,

package/dist/esm/router/transport/fetch/routes/auth.js

@@ -1,7 +1,7 @@
 import { buildDelegatedWalletAuthorityV1, buildFullOwnerPermissionsV1, sameDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";
-import { resolveThresholdRuntimePolicyScope } from "../../../auth/commonRouterUtils.js";
 import { json, jsonFailure, readJson } from "../../../framework/http.js";
+import { resolveThresholdRuntimePolicyScope } from "../../../auth/commonRouterUtils.js";
 import { parseAuthIdentityMutationRequest, parseAuthProviderActionPath, parseGoogleLoginVerifyRequest, parsePasskeyLoginOptionsRequest, parsePasskeyLoginVerifyRequest } from "../../../auth/authRequestValidation.js";
 //#region src/router/transport/fetch/routes/auth.ts
 function assertNeverAuthProviderAction(route) {

package/dist/esm/router/transport/fetch/routes/deviceLinking.js

@@ -11,11 +11,11 @@ import { parseLinkedDeviceEd25519SourcePreservingReservationV1, parseLinkedDevic
 import { parseLinkedDeviceApprovalDeliveryV1, parseLinkedDeviceApprovalV1, parseLinkedDeviceEmailOtpBaseFactorRequestV1, parseLinkedDeviceEmailOtpChallengeResendRequestV1, parseLinkedDeviceEmailOtpChallengeResultV1, parseLinkedDeviceEmailOtpChallengeStartRequestV1, parseLinkedDeviceEmailOtpChallengeVerifyRequestV1, parseLinkedDeviceEmailOtpVerificationResultV1, parseLinkedDeviceSessionClaimRequestV1, parseLinkedDeviceSessionTransportRequestV1, parseLinkedDeviceTargetCredentialRegistrationV1, parseLinkedDeviceTargetPreparationRequestV1, parseLinkedDeviceTargetPreparationV1, parseQrLinkedDeviceSessionPayloadV5 } from "../../../../shared-ts/src/device-linking/parsers.js";
 import { parseLocalAuthorityActivationFinalAckV1, parseLocalAuthorityInstallationReceiptV1 } from "../../../../shared-ts/src/device-linking/authorityActivation.js";
 import { LINKED_DEVICE_REQUEST_PROOF_HEADER_V1, computeLinkedDevicePublicKeyDigestV1 } from "../../../../shared-ts/src/device-linking/requestProof.js";
-import { findRouteDefinitionById } from "../../../framework/routeDefinitions.js";
-import { normalizeCorsOrigin } from "../../../../core/SessionService.js";
 import { extractBearerCredential, extractRouterApiEnvironmentId } from "../../../auth/routerApiKeyAuth.js";
-import { resolvePublishableKeyApiCredentialAuth } from "../../../auth/routerApiCredentialAuth.js";
+import { normalizeCorsOrigin } from "../../../../core/SessionService.js";
 import { json, readJson } from "../../../framework/http.js";
+import { findRouteDefinitionById } from "../../../framework/routeDefinitions.js";
+import { resolvePublishableKeyApiCredentialAuth } from "../../../auth/routerApiCredentialAuth.js";
 import { authDeniedResponse, exportRootWriteResponse, invalidInputResponse, invalidStateResponse, methodNotAllowedResponse, notFoundResponse, notSupportedResponse, projectSession, sessionProjectionResponse, targetCredentialResultResponse } from "./deviceLinkingResponses.js";
 import { linkedDeviceBootstrapFailure } from "../../../../core/deviceLinking/linkedDeviceBootstrap.js";
 import { parseLinkedDeviceRequestProofV1 } from "../../../../core/deviceLinking/requestProof.js";

package/dist/esm/router/transport/fetch/routes/deviceLinkingOwnerAuthorization.js

@@ -1,6 +1,6 @@
 import { parseProviderSubject } from "../../../../shared-ts/src/utils/domainIds.js";
-import { buildDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { sha256DigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { buildDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { buildEmailOtpWalletAuthAuthority, buildPasskeyWalletAuthAuthority, buildVoiceIdWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseLinkedDeviceOwnerAuthorizationRequestV1 } from "../../../../shared-ts/src/device-linking/parsers.js";
 import { buildWalletSessionCapabilitySubjectsV1, walletSessionCapabilitySubjectsV1Equal } from "../../../../authorization/domain.js";

package/dist/esm/router/transport/fetch/routes/ecdsaOperationStepUpFactor.js

@@ -1,13 +1,13 @@
 import { parseEmailOtpChallengeId, parseOrgId, parseProviderSubject } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseAuthFactorId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import "../../../../shared-ts/src/utils/encoders.js";
+import { parseAuthFactorId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { buildVerifiedWalletOperationEmailOtpFactorResult, buildVerifiedWalletOperationPasskeyFactorResult } from "../../../../authorization/factorEvidence.js";
-import { json } from "../../../framework/http.js";
-import { hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_EXPORT_OPERATION, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
+import { hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
+import { json } from "../../../framework/http.js";
 //#region src/router/transport/fetch/routes/ecdsaOperationStepUpFactor.ts
 async function verifyEcdsaOperationStepUpFactor(input) {
 	const proof = input.proof;