@seams/wallet-server 0.28.0 → 0.30.0

package/dist/types/wallet-server/src/auth/externalAuthService.d.ts

@@ -1,36 +1,55 @@
-import type { ExternalAuthResult, ExternalWalletAuthentication, ExternalWalletSettings } from '../../../shared-ts/src/auth/externalAuth';
+import type { ExternalAuthResult, ExternalWalletAuthentication, ExternalWalletSettings, ExternalIdentity, ExternalIdentityProof, ExternalAuthPurpose, ExternalAuthAttempt } from '../../../shared-ts/src/auth/externalAuth';
 import type { WalletId } from '../../../shared-ts/src/utils/domainIds';
 import type { D1WalletStore } from '../core/d1WalletStore';
 import type { WalletAuthMethodV2Store } from '../core/d1WalletAuthMethodStore';
 import { ExternalAuthStore, type ExternalAuthTrust } from './externalAuthStore';
+import type { Variant } from '../../../shared-ts/src/utils/variant';
 export declare class ExternalAuthService {
     readonly store: ExternalAuthStore;
     private readonly wallets;
     private readonly methods;
     constructor(store: ExternalAuthStore, wallets: D1WalletStore, methods: WalletAuthMethodV2Store);
-    verifyGoogle(trust: ExternalAuthTrust, idToken: string): Promise<ExternalAuthResult<{
-        subject: string;
+    verifyGoogle(trust: Variant<ExternalAuthTrust, 'kind', 'google'>, idToken: string): Promise<ExternalAuthResult<{
+        identity: ExternalIdentity;
         expiresAtMs: number;
-        trust: ExternalAuthTrust;
     }>>;
     prepare(input: {
+        purpose: ExternalAuthPurpose;
         walletId: WalletId;
         originBinding: string;
         binding: string;
         sessionToken: string;
-    }): Promise<ExternalAuthResult<{
-        attemptId: string;
-        walletId: WalletId;
-        expiresAtMs: number;
-    }>>;
+    }): Promise<ExternalAuthResult<ExternalAuthAttempt<ExternalAuthPurpose>>>;
     exchange(input: {
         walletId: WalletId;
         attemptId: string;
-        idToken: string;
+        proof: ExternalIdentityProof;
         trust: ExternalAuthTrust;
     }): Promise<ExternalAuthResult<{
         code: string;
     }>>;
+    prepareUnlink(input: {
+        walletId: WalletId;
+        associationId: string;
+        originBinding: string;
+        binding: string;
+        sessionToken: string;
+        trustRevision: number;
+    }): Promise<ExternalAuthResult<{
+        attemptId: string;
+        code: string;
+        expiresAtMs: number;
+    }>>;
+    verifyIdentity(input: {
+        readonly trust: ExternalAuthTrust;
+        readonly proof: ExternalIdentityProof;
+        readonly walletId: WalletId;
+        readonly attemptId: string;
+        readonly purpose: ExternalAuthPurpose;
+    }): Promise<ExternalAuthResult<{
+        identity: ExternalIdentity;
+        expiresAtMs: number;
+    }>>;
     settings(authentication: ExternalWalletAuthentication): Promise<ExternalWalletSettings>;
 }
 //# sourceMappingURL=externalAuthService.d.ts.map

package/dist/types/wallet-server/src/auth/externalAuthStore.d.ts

@@ -1,10 +1,14 @@
-import type { ExternalWalletAuthentication, ExternalAuthConfiguration } from '../../../shared-ts/src/auth/externalAuth';
-import type { Variant } from '../../../shared-ts/src/utils/variant';
+import type { ExternalWalletAuthentication, ExternalAuthConfiguration, ExternalIdentity, ExternalAuthPurpose } from '../../../shared-ts/src/auth/externalAuth';
 import type { WalletId, WalletAuthorityId } from '../../../shared-ts/src/utils/domainIds';
 import { type D1TenantScope } from '../core/d1TenantStore';
 import type { D1DatabaseLike } from '../storage/tenantRoute';
-export type ExternalAuthTrust = Variant<ExternalAuthConfiguration, 'kind', 'google'>;
+import type { ReadonlyExclusiveUnion } from '../../../shared-ts/src/utils/variant';
+import type { ActiveWalletAuthorityV1 } from '../../../shared-ts/src/authorization/walletAuthority';
+export type ExternalAuthTrust = Exclude<ExternalAuthConfiguration, {
+    kind: 'disabled';
+}>;
 type ExternalAuthPreparedAttempt = Readonly<{
+    purpose: ExternalAuthPurpose;
     attemptId: string;
     walletId: WalletId;
     originBinding: string;
@@ -12,6 +16,36 @@ type ExternalAuthPreparedAttempt = Readonly<{
     sessionTokenHash: string;
     expiresAtMs: number;
 }>;
+export type ExternalOwnerAttemptBinding = Readonly<{
+    walletId: WalletId;
+    attemptId: string;
+    originBinding: string;
+    bindingHash: string;
+    sessionTokenHash: string;
+    codeHash: string;
+    trustRevision: number;
+    nowMs: number;
+}>;
+export type ExternalOwnerAttempt = Readonly<{
+    walletId: WalletId;
+    attemptId: string;
+    identity: ExternalIdentity;
+    originBinding: string;
+    trustRevision: number;
+    expiresAtMs: number;
+    status: 'verified' | 'consumed';
+    challenge: {
+        kind: 'unprepared';
+    } | {
+        kind: 'ready';
+        expiresAtMs: number;
+    };
+}> & ReadonlyExclusiveUnion<{
+    purpose: 'associate';
+} | {
+    purpose: 'unlink';
+    associationId: string;
+}>;
 export declare class ExternalAuthStore {
     private readonly database;
     readonly scope: D1TenantScope;
@@ -20,20 +54,40 @@ export declare class ExternalAuthStore {
     consumeAuthenticationAllowance(rateKey: string, nowMs: number): Promise<boolean>;
     associate(input: {
         walletId: WalletId;
-        subject: string;
+        identity: ExternalIdentity;
         authorityId: WalletAuthorityId;
         authorityEpoch: number;
     }): Promise<boolean>;
-    revokeAssociation(walletId: WalletId, associationId: string): Promise<void>;
+    revokeAssociation(input: {
+        walletId: WalletId;
+        associationId: string;
+        owner: ActiveWalletAuthorityV1;
+    }): Promise<void>;
+    prepareUnlink(input: {
+        walletId: WalletId;
+        associationId: string;
+        attemptId: string;
+        originBinding: string;
+        bindingHash: string;
+        sessionTokenHash: string;
+        codeHash: string;
+        expiresAtMs: number;
+        trustRevision: number;
+    }): Promise<boolean>;
+    readOwnerAttempt(input: ExternalOwnerAttemptBinding): Promise<ExternalOwnerAttempt | null>;
+    prepareOwnerChallenge(input: ExternalOwnerAttemptBinding): Promise<ExternalOwnerAttempt | null>;
+    consumeOwnerAttempt(input: ExternalOwnerAttemptBinding, owner: ActiveWalletAuthorityV1): Promise<boolean>;
     prepareAttempt(input: ExternalAuthPreparedAttempt): Promise<void>;
+    readPreparedPurpose(walletId: WalletId, attemptId: string, nowMs: number): Promise<ExternalAuthPurpose | null>;
     verifyAttempt(input: {
         attemptId: string;
         walletId: WalletId;
-        subject: string;
+        identity: ExternalIdentity;
         trust: ExternalAuthTrust;
         codeHash: string;
         nowMs: number;
         sessionExpiresAtMs: number;
+        purpose: ExternalAuthPurpose;
     }): Promise<boolean>;
     redeem(input: {
         attemptId: string;

package/dist/types/wallet-server/src/auth/externalOwnerOperations.d.ts

@@ -0,0 +1,18 @@
+import { type ExternalAuthResult, type ExternalOwnerChallenge } from '../../../shared-ts/src/auth/externalAuth';
+import { type WalletOwnerAdminOperation } from '../../../shared-ts/src/authorization/walletOwnerOperation';
+import type { DigestB64u } from '../../../shared-ts/src/utils/canonicalPrimitives';
+import { ExternalAuthStore, type ExternalOwnerAttempt, type ExternalOwnerAttemptBinding } from './externalAuthStore';
+export type ExternalOwnerOperation = Readonly<{
+    attempt: ExternalOwnerAttempt;
+    operation: Extract<WalletOwnerAdminOperation, 'external_identity_associate' | 'external_identity_unlink'>;
+    payload: Readonly<Record<string, unknown>>;
+    challengeB64u: DigestB64u;
+}>;
+export declare function readExternalOwnerOperation(input: {
+    readonly store: ExternalAuthStore;
+    readonly binding: ExternalOwnerAttemptBinding;
+    readonly requestOrigin: string;
+    readonly phase: 'prepare' | 'complete';
+}): Promise<ExternalAuthResult<ExternalOwnerOperation>>;
+export declare function externalOwnerChallenge(operation: ExternalOwnerOperation): ExternalOwnerChallenge;
+//# sourceMappingURL=externalOwnerOperations.d.ts.map

package/dist/types/wallet-server/src/cloud-host.d.ts

@@ -1,4 +1,4 @@
-export { parseExternalAuthConfiguration, type ExternalAuthConfiguration, } from '../../shared-ts/src/auth/externalAuth';
+export { parseExternalAuthConfiguration, parseExternalAuthProvider, type ExternalAuthConfiguration, type ExternalAuthProvider, } from '../../shared-ts/src/auth/externalAuth';
 export * from './core/SessionService';
 export * from './core/ThresholdService/evmCryptoWasm';
 export * from './core/d1WalletStore';

package/dist/types/wallet-server/src/core/threeRouteRegistrationContracts.d.ts

@@ -94,6 +94,18 @@ type WalletRegistrationSessionCommitReadyBaseV2 = WalletRegistrationSessionCommi
     readonly walletCustody?: WalletCustodyRegistrationOutcome;
 };
 export type WalletRegistrationSessionCommitReceiptV2 = {
+    readonly kind: 'wallet_registration_session_commit_receipt_v2';
+    readonly operation: 'near_provisioning';
+    readonly operationFingerprint: string;
+    readonly registrationCeremonyId: string;
+    readonly committed: {
+        readonly kind: 'near_owner_ready';
+        readonly expectedOrigin: string;
+        readonly response: Extract<WalletRegistrationFinalizeSuccess, {
+            kind: 'near_ed25519';
+        }>;
+    };
+} | {
     readonly kind: 'wallet_registration_session_commit_receipt_v2';
     readonly operation: 'registration_activate' | 'near_provisioning';
     readonly operationFingerprint: string;

package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1AuthorizedOperationRouteService.d.ts

@@ -1,11 +1,15 @@
 import type { AuthorizationService } from '../../../../authorization/service';
+import type { D1WalletAuthMethodStore } from '../../../../core/d1WalletAuthMethodStore';
 import type { RouterApiServiceBag } from '../../../framework/authServicePort';
 import type { CloudflareD1AuthorizationStore } from '../authorization/d1AuthorizationStore';
+import type { CloudflareD1WalletAuthMethodService } from '../wallet/d1WalletAuthMethodService';
 import type { NormalizedCloudflareD1RouterApiAuthServiceOptions } from './d1RouterApiAuthConfig';
 type D1AuthorizedOperationRouteServiceAssembly = {
     readonly authorizationService: AuthorizationService;
     readonly authorizationStore: CloudflareD1AuthorizationStore;
-    readonly options: Pick<NormalizedCloudflareD1RouterApiAuthServiceOptions, 'orgId'>;
+    readonly options: Pick<NormalizedCloudflareD1RouterApiAuthServiceOptions, 'database' | 'namespace' | 'orgId' | 'projectId' | 'envId'>;
+    readonly walletAuthMethodStore: D1WalletAuthMethodStore;
+    readonly walletAuthMethods: CloudflareD1WalletAuthMethodService;
 };
 export declare function createD1AuthorizedOperationRouteService(assembly: D1AuthorizedOperationRouteServiceAssembly): RouterApiServiceBag['authorizedOperations'];
 export {};

package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1RecordedOwnerOperation.d.ts

@@ -0,0 +1,16 @@
+import { type TenantId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
+import type { AuthorizationService } from '../../../../authorization/service';
+import type { D1WalletAuthMethodStore } from '../../../../core/d1WalletAuthMethodStore';
+import type { RouterApiAuthorizedOperationService } from '../../../framework/authServicePort';
+import type { CloudflareD1WalletAuthMethodService } from '../wallet/d1WalletAuthMethodService';
+import type { NormalizedCloudflareD1RouterApiAuthServiceOptions } from './d1RouterApiAuthConfig';
+type RecordedOwnerOperationSource = {
+    readonly options: Pick<NormalizedCloudflareD1RouterApiAuthServiceOptions, 'database' | 'namespace' | 'orgId' | 'projectId' | 'envId'>;
+    readonly authorizationService: AuthorizationService;
+    readonly walletAuthMethodStore: D1WalletAuthMethodStore;
+    readonly walletAuthMethods: CloudflareD1WalletAuthMethodService;
+};
+/** A continuation uses only the factor digest and exact operation recorded after owner verification. */
+export declare function resolveRecordedPasskeyOwnerOperation(source: RecordedOwnerOperationSource, tenantId: TenantId, input: Parameters<RouterApiAuthorizedOperationService['resolveRecordedPasskeyOwnerOperation']>[0]): ReturnType<RouterApiAuthorizedOperationService['resolveRecordedPasskeyOwnerOperation']>;
+export {};
+//# sourceMappingURL=d1RecordedOwnerOperation.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationCeremonyRecords.d.ts

@@ -20,6 +20,7 @@ export declare function inferRuntimePolicyScopeFromSigningRoot(input: {
     readonly signingRootVersion?: string;
 }): RuntimePolicyScope | undefined;
 export declare function buildRegistrationIntent(input: {
+    readonly completion: RegistrationIntentV1['completion'];
     readonly nonceB64u: string;
     readonly walletId: WalletId;
     readonly authMethod: RegistrationAuthMethodInput;

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationSetup.d.ts

@@ -1,3 +1,4 @@
+import type { RegistrationIntentV1 } from '../../../../../../shared-ts/src/utils/registrationIntent';
 /**
  * `/wallets/register/setup` — one request replacing the bootstrap grant, the
  * registration intent, and registration start.
@@ -39,6 +40,7 @@ import type { WalletRegistrationSetupRequest } from '../../../domains/walletRegi
 import { mintSignedWalletRegistrationSetup, type WalletRegistrationSetupMinter } from '../../../domains/walletRegistration/walletRegistrationSetupPayload';
 export declare function normalizeWalletRegistrationSetupRequest(request: WalletRegistrationSetupRequest): {
     readonly ok: true;
+    readonly completion: RegistrationIntentV1['completion'];
     readonly signerSelection: RegistrationSignerSetSelection;
     readonly authMethod: RegistrationAuthMethodInput;
 } | {

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/walletRegistrationSessionCommitReceipt.d.ts

@@ -11,6 +11,12 @@ export type WalletRegistrationNearProvisioningFinalizeResponse = WalletRegistrat
     readonly registrationEstablishedSession: RegistrationEstablishedSessionResultV2;
 });
 export type RegistrationCommitExecution<T> = {
+    readonly kind: 'owner_registered';
+    readonly response: T;
+    readonly expectedOrigin: string;
+    readonly activation: RegistrationActivationWrite | null;
+    readonly custodyWrite: RouterAbEd25519YaoPreparedWriteV1 | null;
+} | {
     readonly kind: 'unissued';
     readonly response: T;
     readonly custodyWrite?: never;
@@ -47,7 +53,7 @@ export declare function projectWalletRegistrationSessionCommitReceiptV2(input: {
 }): WalletRegistrationSessionCommitReceiptV2;
 type WalletRegistrationIdentityCommitReceiptV2 = Exclude<WalletRegistrationSessionCommitReceiptV2, {
     readonly committed: {
-        readonly kind: 'error';
+        readonly kind: 'error' | 'near_owner_ready';
     };
 }>;
 type RegistrationReplayAuthMethodFields = {

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthMethodService.d.ts

@@ -311,6 +311,7 @@ export declare class CloudflareD1WalletAuthMethodService {
     }): Promise<{
         readonly ok: true;
         readonly authority: EmailOtpWalletAuthAuthority;
+        readonly walletAuthority: ActiveWalletAuthorityV1;
     } | WalletAuthMethodError>;
     /**
      * The exact active Email OTP authority a caller names. Several methods can

package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbEd25519NormalSigningRoute.d.ts

@@ -7,7 +7,7 @@ import type { AuthorizedOperation, OwnerOperationAuthorizationDecision } from '.
 import { type RouterAbEd25519OperationStepUpPreparationV1Wire } from '../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
 import { type Ed25519OperationKind } from './ed25519AuthorizedOperationReceipt';
 import { type RouterAbEcdsaOperationAdmissionKind, type RouterAbJsonRouteResult, type RouterAbNormalSigningAdmissionAdapter, type RouterAbNormalSigningRouteAdmission } from './routerAbNormalSigningAdmission';
-import { type ActiveEd25519MaterialActivation, type RouterAbExactOperationStepUpAuthenticationResult, type RouterAbOperationStepUpWalletSession } from './routerAbOperationStepUp';
+import { type ActiveEd25519MaterialActivation, type RouterAbExactOperationStepUpAuthenticationResult, type RouterAbVerifiedOwnerOperationStepUpAuthenticationResult, type RouterAbOperationStepUpWalletSession } from './routerAbOperationStepUp';
 import { type RouterAbEd25519NormalSigningScopeV2 } from './routerAbPrivateSigningWorker';
 export type RouterAbEd25519NormalSigningRoutePhase = 'prepare' | 'finalize';
 export declare function buildRouterAbEd25519OwnerOperationStepUpPreparation(input: {
@@ -81,7 +81,7 @@ export declare function authenticateRouterAbWalletOperationStepUp(input: {
     readonly authorizedOperations: RouterApiAuthorizedOperationService | null | undefined;
     readonly authorizationSessions: RouterApiAuthorizationSessionService | null | undefined;
     readonly resolveEd25519MaterialActivation: RouterApiWalletRegistrationService['resolveEd25519MaterialActivation'];
-}): Promise<RouterAbExactOperationStepUpAuthenticationResult>;
+}): Promise<RouterAbExactOperationStepUpAuthenticationResult | RouterAbVerifiedOwnerOperationStepUpAuthenticationResult>;
 export declare function parseRouterAbEd25519OperationStepUpScope(value: unknown): RouterAbEd25519NormalSigningScopeV2;
 export declare function parseRouterAbOperationStepUpOperation(value: unknown): {
     readonly ok: true;

package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbOperationStepUp.d.ts

@@ -104,7 +104,7 @@ type RouterAbOperationStepUpAuthenticationSuccess<TSession extends RouterAbOpera
     readonly expiresAtMs: number;
 };
 export type RouterAbExactOperationStepUpAuthenticationResult = RouterAbOperationStepUpAuthenticationSuccess<RouterAbExactOperationStepUpWalletSession> | RouterAbOperationStepUpAuthenticationFailure;
-type RouterAbVerifiedOwnerOperationStepUpAuthenticationResult = (RouterAbOperationStepUpAuthenticationSuccess<RouterAbVerifiedOwnerOperationStepUpWalletSession> & {
+export type RouterAbVerifiedOwnerOperationStepUpAuthenticationResult = (RouterAbOperationStepUpAuthenticationSuccess<RouterAbVerifiedOwnerOperationStepUpWalletSession> & {
     readonly authorityRef: WalletAuthAuthorityRef;
 }) | RouterAbOperationStepUpAuthenticationFailure;
 export declare function walletSessionUnavailableFailure(): RouterAbOperationStepUpAuthenticationFailure;

package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationInputs.d.ts

@@ -8,6 +8,7 @@ import type { WalletRegistrationAuthorityInput, WalletRegistrationFinalizeSigner
 import type { ThresholdRuntimePolicyScope } from '../../../core/types';
 import type { WalletRegistrationSetupMinter, WalletRegistrationSetupVerifier } from './walletRegistrationSetupPayload';
 export type WalletRegistrationSetupRequest = {
+    readonly completion: import('../../../../../shared-ts/src/utils/registrationIntent').RegistrationCompletion;
     readonly registrationOperationId: string;
     readonly wallet?: RegisterWalletInput;
     readonly signerSelection: RegistrationSignerSetSelection;

package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationReservation.d.ts

@@ -48,6 +48,14 @@ export type RegistrationWalletStartup = {
 });
 export type RegistrationPairStartup = Variant<RegistrationWalletStartup, 'kind', 'pair'>;
 export type RegistrationWalletStarter = (registration: RegistrationWalletStartup) => Promise<void>;
+export type RegistrationSessionPublication = {
+    readonly kind: 'none';
+    readonly walletId?: never;
+    readonly digest?: never;
+    readonly expiresAtMs?: never;
+} | (WalletSessionLocatorPublication & {
+    readonly kind: 'credential';
+});
 type ReservationOutcome = {
     readonly ok: true;
 } | {
@@ -84,9 +92,7 @@ export interface WalletRegistrationReservationAuthority {
         readonly walletId: WalletId;
     } & ({
         readonly outcome: 'established';
-        readonly session: WalletSessionLocatorPublication & {
-            readonly kind: 'credential';
-        };
+        readonly session: RegistrationSessionPublication;
     } | {
         readonly outcome: 'cancelled';
         readonly session?: never;
@@ -115,9 +121,7 @@ export interface WalletRegistrationHomeAuthority extends Pick<WalletRegistration
      */
     prepareEstablished(input: {
         readonly registration: CommittedWalletRegistration;
-        readonly session: WalletSessionLocatorPublication & {
-            readonly kind: 'credential';
-        };
+        readonly session: RegistrationSessionPublication;
     }): RegistrationActivationWrite | null;
     /** Fixes a definitive cancellation, publishes it, and retires the local home. */
     cancel(input: {
@@ -130,5 +134,6 @@ export declare function proposeWalletRegistrationSetup(input: Pick<WalletRegistr
 export declare function walletRegistrationSetupRequestDigest(namespace: string, input: Pick<WalletRegistrationSetupInput, 'request' | 'orgId' | 'expectedOrigin' | 'runtimePolicyScope'>): Promise<string>;
 export declare function cancelRegistrationHome(authority: Pick<WalletRegistrationHomeAuthority, 'cancel'> | null, input: Parameters<WalletRegistrationHomeAuthority['cancel']>[0]): Promise<ReservationOutcome>;
 export declare function admitRegistrationReservationHome(authority: Pick<WalletRegistrationReservationAuthority, 'admitHome'> | null, input: Parameters<WalletRegistrationReservationAuthority['admitHome']>[0]): Promise<RegistrationHomeAdmission>;
+export declare function parseRegistrationSessionPublication(raw: unknown, walletId: WalletId): RegistrationSessionPublication;
 export {};
 //# sourceMappingURL=walletRegistrationReservation.d.ts.map

package/dist/types/wallet-server/src/router/framework/authServicePort.d.ts

@@ -1120,6 +1120,7 @@ export interface RouterApiWalletAuthMethodService {
     }): Promise<{
         readonly ok: true;
         readonly authority: EmailOtpWalletAuthAuthority;
+        readonly walletAuthority: ActiveWalletAuthorityV1;
     } | {
         readonly ok: false;
         readonly code: string;
@@ -1331,6 +1332,16 @@ export interface RouterApiAuthorizedOperationService {
     admitEd25519WalletSessionOperation(input: import('../../authorization/ed25519WalletSessionAdmission').Ed25519WalletSessionAdmissionInput): Promise<import('../../authorization/ed25519WalletSessionAdmission').Ed25519WalletSessionAdmissionResult>;
     resolveEd25519WalletSessionOperation(input: import('../../authorization/ed25519WalletSessionAdmission').Ed25519WalletSessionResolutionInput): Promise<import('../../authorization/ed25519WalletSessionAdmission').Ed25519WalletSessionResolutionResult>;
     readonly tenantId: TenantId;
+    resolveRecordedPasskeyOwnerOperation(input: {
+        readonly authorizedOperationId: import('../../../../shared-ts/src/authorization/capabilityKinds').AuthorizedOperationId;
+        readonly walletId: WalletId;
+        readonly requestOrigin: import('../../authorization/domain').SessionOrigin;
+        readonly nowMs: number;
+    }): Promise<{
+        readonly operation: AuthorizedOperation;
+        readonly authority: import('../../../../shared-ts/src/utils/walletAuthAuthority').PasskeyWalletAuthAuthority;
+        readonly expiresAtMs: number;
+    } | null>;
     readPinnedOwnerWalletScope(input: {
         readonly operation: AuthorizedOperation;
         readonly walletId: WalletId;

package/dist/types/wallet-server/src/router/transport/fetch/walletOwnerOperationAuthorization.d.ts

@@ -0,0 +1,23 @@
+import type { ActiveWalletAuthorityV1 } from '../../../../../shared-ts/src/authorization/walletAuthority';
+import { type WalletOwnerAdminOperation } from '../../../../../shared-ts/src/authorization/walletOwnerOperation';
+import { type DigestB64u } from '../../../../../shared-ts/src/utils/canonicalPrimitives';
+import { type AuthorizedOperation } from '../../../authorization/domain';
+import type { FetchRouterApiContext } from './fetchRouter.types';
+export type WalletOwnerAuthorizationResult = {
+    readonly ok: true;
+    readonly operation: AuthorizedOperation;
+    readonly ownerAuthority: ActiveWalletAuthorityV1;
+} | {
+    readonly ok: false;
+    readonly response: Response;
+};
+export declare function walletOwnerOperationAuthorizationId(operation: WalletOwnerAdminOperation, challenge: DigestB64u): import("../../../../../shared-ts/src/authorization/capabilityKinds").AuthorizedOperationId;
+export declare function authorizeWalletOwnerOperation(input: {
+    readonly ctx: FetchRouterApiContext;
+    readonly walletId: string;
+    readonly operation: WalletOwnerAdminOperation;
+    readonly payload: Record<string, unknown>;
+    readonly factorProof: unknown;
+}): Promise<WalletOwnerAuthorizationResult>;
+export declare function completeWalletOwnerOperation(ctx: FetchRouterApiContext, operation: AuthorizedOperation, status: number, body: Record<string, unknown>, result?: 'succeeded' | 'failed_before_side_effect'): Promise<Response>;
+//# sourceMappingURL=walletOwnerOperationAuthorization.d.ts.map

package/migrations/d1-signer/0086_application_auth.sql

@@ -0,0 +1,67 @@
+-- Reject unfinished transfers. Completed receipts remain immutable.
+CREATE TABLE external_auth_relocation_upgrade_guard (count INTEGER NOT NULL CHECK (count = 0));
+INSERT INTO external_auth_relocation_upgrade_guard
+SELECT (SELECT COUNT(*) FROM wallet_relocation_authorization_snapshots AS snapshot
+        WHERE NOT EXISTS (
+          SELECT 1 FROM wallet_relocation_authorization_cleanups AS cleanup
+          WHERE cleanup.namespace = snapshot.namespace AND cleanup.org_id = snapshot.org_id
+            AND cleanup.project_id = snapshot.project_id AND cleanup.env_id = snapshot.env_id
+            AND cleanup.wallet_id = snapshot.wallet_id AND cleanup.move_id = snapshot.move_id
+            AND cleanup.request_digest_hex = snapshot.request_digest_hex
+            AND cleanup.source_generation = snapshot.source_generation
+            AND cleanup.state = 'cleaned'))
+     + (SELECT COUNT(*) FROM wallet_relocation_authorization_imports WHERE state != 'activated');
+DROP TABLE external_auth_relocation_upgrade_guard;
+
+
+-- Identity domains remain distinct across Google and application-issued subjects.
+UPDATE external_auth_associations
+SET provider_subject = json_array('google', 'https://accounts.google.com', provider_subject);
+
+ALTER TABLE external_auth_attempts RENAME TO external_auth_attempts_before_application;
+CREATE TABLE external_auth_attempts (
+  namespace TEXT NOT NULL, org_id TEXT NOT NULL, project_id TEXT NOT NULL, env_id TEXT NOT NULL,
+  attempt_id TEXT NOT NULL, wallet_id TEXT NOT NULL, origin TEXT NOT NULL,
+  binding_hash TEXT NOT NULL, session_token_hash TEXT NOT NULL, expires_at_ms INTEGER NOT NULL,
+  status TEXT NOT NULL CHECK (status IN ('prepared', 'verified', 'consumed', 'revoked')),
+  purpose TEXT NOT NULL CHECK (purpose IN ('authenticate', 'associate', 'unlink')),
+  association_id TEXT, trust_revision INTEGER, code_hash TEXT, session_expires_at_ms INTEGER,
+  identity_subject TEXT, owner_challenge_expires_at_ms INTEGER,
+  PRIMARY KEY (namespace, org_id, project_id, env_id, attempt_id),
+  CHECK (
+    status = 'revoked' OR
+    (status = 'prepared' AND purpose IN ('authenticate', 'associate')
+      AND association_id IS NULL AND trust_revision IS NULL AND code_hash IS NULL
+      AND session_expires_at_ms IS NULL AND identity_subject IS NULL
+      AND owner_challenge_expires_at_ms IS NULL) OR
+    (status IN ('verified', 'consumed') AND trust_revision IS NOT NULL AND code_hash IS NOT NULL
+      AND identity_subject IS NOT NULL AND (
+        (purpose = 'authenticate' AND association_id IS NOT NULL
+          AND session_expires_at_ms IS NOT NULL AND owner_challenge_expires_at_ms IS NULL) OR
+        (purpose = 'associate' AND session_expires_at_ms IS NOT NULL
+          AND (status = 'verified' OR owner_challenge_expires_at_ms IS NOT NULL)) OR
+        (purpose = 'unlink' AND association_id IS NOT NULL AND session_expires_at_ms IS NULL
+          AND (status = 'verified' OR owner_challenge_expires_at_ms IS NOT NULL))
+      ))
+  )
+);
+INSERT INTO external_auth_attempts
+  (namespace, org_id, project_id, env_id, attempt_id, wallet_id, origin, binding_hash,
+   session_token_hash, expires_at_ms, status, purpose, association_id, trust_revision,
+   code_hash, session_expires_at_ms, identity_subject)
+SELECT attempt.namespace, attempt.org_id, attempt.project_id, attempt.env_id, attempt.attempt_id,
+  attempt.wallet_id, attempt.origin, attempt.binding_hash, attempt.session_token_hash,
+  attempt.expires_at_ms,
+  CASE WHEN attempt.status IN ('verified', 'consumed') AND association.association_id IS NULL
+    THEN 'revoked' ELSE attempt.status END,
+  'authenticate', attempt.association_id, attempt.trust_revision, attempt.code_hash,
+  attempt.session_expires_at_ms, association.provider_subject
+FROM external_auth_attempts_before_application attempt
+LEFT JOIN external_auth_associations association
+  ON association.namespace = attempt.namespace AND association.org_id = attempt.org_id
+  AND association.project_id = attempt.project_id AND association.env_id = attempt.env_id
+  AND association.association_id = attempt.association_id;
+DROP TABLE external_auth_attempts_before_application;
+CREATE UNIQUE INDEX external_auth_session_token
+  ON external_auth_attempts(namespace, org_id, project_id, env_id, session_token_hash);
+CREATE INDEX external_auth_attempt_expiry ON external_auth_attempts(expires_at_ms);

package/migrations/d1-signer/0087_registration_without_session.sql

@@ -0,0 +1,43 @@
+-- Reject unfinished transfers. Completed receipts remain immutable.
+CREATE TABLE registration_publication_relocation_upgrade_guard (count INTEGER NOT NULL CHECK (count = 0));
+INSERT INTO registration_publication_relocation_upgrade_guard
+SELECT (SELECT COUNT(*) FROM wallet_relocation_authorization_snapshots AS snapshot
+        WHERE NOT EXISTS (
+          SELECT 1 FROM wallet_relocation_authorization_cleanups AS cleanup
+          WHERE cleanup.namespace = snapshot.namespace AND cleanup.org_id = snapshot.org_id
+            AND cleanup.project_id = snapshot.project_id AND cleanup.env_id = snapshot.env_id
+            AND cleanup.wallet_id = snapshot.wallet_id AND cleanup.move_id = snapshot.move_id
+            AND cleanup.request_digest_hex = snapshot.request_digest_hex
+            AND cleanup.source_generation = snapshot.source_generation
+            AND cleanup.state = 'cleaned'))
+     + (SELECT COUNT(*) FROM wallet_relocation_authorization_imports WHERE state != 'activated');
+DROP TABLE registration_publication_relocation_upgrade_guard;
+
+
+-- Keep the retryable registration publication independent of session issuance.
+DROP TRIGGER wallet_registration_directory_publication_identity;
+ALTER TABLE wallet_registration_directory_publications RENAME TO registration_publications_with_session;
+CREATE TABLE wallet_registration_directory_publications (
+  namespace TEXT NOT NULL, org_id TEXT NOT NULL, project_id TEXT NOT NULL, env_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL,
+  ceremony_id TEXT NOT NULL CHECK(length(ceremony_id) > 0),
+  session_json TEXT NOT NULL CHECK(json_valid(session_json) AND json_extract(session_json, '$.kind') IN ('none', 'credential')),
+  state TEXT NOT NULL DEFAULT 'pending' CHECK(state IN ('pending', 'refused')),
+  attempts INTEGER NOT NULL DEFAULT 0 CHECK(attempts >= 0),
+  next_attempt_at_ms INTEGER NOT NULL CHECK(next_attempt_at_ms > 0),
+  PRIMARY KEY(namespace, org_id, project_id, env_id, wallet_id)
+);
+INSERT INTO wallet_registration_directory_publications
+SELECT namespace, org_id, project_id, env_id, wallet_id, ceremony_id,
+  json_object('kind', 'credential', 'walletId', wallet_id, 'digest', session_digest, 'expiresAtMs', session_expires_at_ms),
+  state, attempts, next_attempt_at_ms
+FROM registration_publications_with_session;
+DROP TABLE registration_publications_with_session;
+CREATE INDEX wallet_registration_directory_publications_due
+  ON wallet_registration_directory_publications(namespace, org_id, project_id, env_id, state, next_attempt_at_ms);
+CREATE TRIGGER wallet_registration_directory_publication_identity
+BEFORE UPDATE ON wallet_registration_directory_publications
+WHEN NEW.wallet_id IS NOT OLD.wallet_id OR NEW.ceremony_id IS NOT OLD.ceremony_id
+  OR NEW.session_json IS NOT OLD.session_json
+  OR (OLD.state = 'refused' AND NEW.state != 'refused')
+BEGIN SELECT RAISE(ABORT, 'wallet_registration_directory_publication_conflicts'); END;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seams/wallet-server",
-  "version": "0.28.0",
+  "version": "0.30.0",
   "type": "module",
   "description": "Seams server TypeScript SDK for NEAR and EVM-family wallets",
   "main": "./dist/esm/index.js",
@@ -67,7 +67,12 @@
       "default": "./dist/esm/tenant-root.js"
     },
     "./local-runtime": "./cloudflare-router-ab/scripts/prepare-local-runtime-config.mjs",
-    "./local-runtime/*": "./cloudflare-router-ab/scripts/*"
+    "./local-runtime/*": "./cloudflare-router-ab/scripts/*",
+    "./application-auth": {
+      "types": "./dist/types/wallet-server/src/application-auth.d.ts",
+      "import": "./dist/esm/application-auth.js",
+      "default": "./dist/esm/application-auth.js"
+    }
   },
   "files": [
     "LICENSE.md",

package/dist/types/shared-ts/src/authorization/walletCustodyOperation.d.ts

@@ -1,10 +0,0 @@
-import { type DigestB64u } from '../utils/canonicalPrimitives';
-export type WalletCustodyAdminOperation = 'credentials_list' | 'credential_label' | 'recovery_rotate' | 'recovery_read' | 'recovery_status' | 'recovery_backup_acknowledge';
-/** Public challenge digest for a single wallet-administration factor proof. */
-export declare function computeWalletCustodyAdminChallengeDigest(input: {
-    readonly walletId: string;
-    readonly operation: WalletCustodyAdminOperation;
-    readonly payload: Record<string, unknown>;
-    readonly requestOrigin: string;
-}): Promise<DigestB64u>;
-//# sourceMappingURL=walletCustodyOperation.d.ts.map