@seams/wallet-server 0.5.0

package/dist/types/wallet-server/src/router/domains/signingOperations/walletExecutionAdmission.d.ts

@@ -0,0 +1,104 @@
+import { EVM_ECDSA_MPC_OPERATION_KINDS, NEAR_ED25519_MPC_OPERATION_KINDS } from '../../../../../shared-ts/src/authorization/capabilityKinds';
+import { type LaneParticipantBindingDigestB64u, type PreparedOwnerWalletExecution, type SigningLaneRecord, type WalletKeyRecord } from '../../../../../shared-ts/src/signing-lanes';
+import { type DigestB64u } from '../../../../../shared-ts/src/utils/canonicalPrimitives';
+import { type MpcMaterialActivationRef, type WalletAuthorityId, type WalletId, type WalletKeyId } from '../../../../../shared-ts/src/utils/domainIds';
+import type { ActiveWalletAuthorityV1 } from '../../../../../shared-ts/src/authorization/walletAuthority';
+import type { ExactAdministeredEcdsaSignerV1, ExactAdministeredEd25519SignerV1 } from '../../../../../shared-ts/src/device-linking/delegatedActivationPlan';
+import type { WalletAuthMethodRecordV2 } from '../../../../../shared-ts/src/utils/registrationIntent';
+import type { AuthorizedOperation, WalletSessionAuthorizationV2 } from '../../../authorization/domain';
+import type { PrincipalId, TenantId } from '../../../../../shared-ts/src/authorization/capabilityKinds';
+export type ClaimedAuthorizedOperation = AuthorizedOperation & {
+    readonly lifecycle: 'claimed';
+    readonly result?: never;
+    readonly response?: never;
+    readonly resultDigest?: never;
+    readonly completedAtMs?: never;
+};
+export type WalletExecutionAdmissionRefusalReason = 'operation_not_claimed' | 'wallet_key_inactive' | 'lane_inactive' | 'unsupported_lane' | 'wallet_mismatch' | 'wallet_key_mismatch' | 'curve_mismatch' | 'capability_mismatch' | 'material_activation_mismatch' | 'participant_binding_mismatch' | 'activation_receipt_mismatch';
+export type WalletExecutionAdmissionResult = {
+    readonly kind: 'prepared';
+    readonly execution: PreparedOwnerWalletExecution;
+} | {
+    readonly kind: 'refused';
+    readonly reason: WalletExecutionAdmissionRefusalReason;
+};
+export type OwnerWalletExecutionEvidence = {
+    readonly walletId: WalletId;
+    readonly walletKey: WalletKeyRecord;
+    readonly lane: SigningLaneRecord;
+    readonly materialActivation: MpcMaterialActivationRef;
+    readonly expectedMaterialActivation: MpcMaterialActivationRef;
+    readonly verifiedLaneParticipantBindingDigestB64u: LaneParticipantBindingDigestB64u;
+    readonly verifiedActivationReceiptDigestB64u: DigestB64u;
+};
+type WalletSessionAuthorizationV2Ed25519OperationKind = (typeof NEAR_ED25519_MPC_OPERATION_KINDS)['signTransaction'] | (typeof NEAR_ED25519_MPC_OPERATION_KINDS)['signDelegateAction'] | (typeof NEAR_ED25519_MPC_OPERATION_KINDS)['signNep413Message'] | (typeof NEAR_ED25519_MPC_OPERATION_KINDS)['exportKey'];
+type WalletSessionAuthorizationV2EcdsaOperationKind = (typeof EVM_ECDSA_MPC_OPERATION_KINDS)['signTransaction'] | (typeof EVM_ECDSA_MPC_OPERATION_KINDS)['exportKey'];
+export type WalletSessionAuthorizationV2RequestedOperation = {
+    readonly tenantId: TenantId;
+    readonly principalId: PrincipalId;
+    readonly walletId: WalletId;
+    readonly keyFamily: 'ed25519';
+    readonly operationKind: WalletSessionAuthorizationV2Ed25519OperationKind;
+} | {
+    readonly tenantId: TenantId;
+    readonly principalId: PrincipalId;
+    readonly walletId: WalletId;
+    readonly keyFamily: 'ecdsa_secp256k1';
+    readonly operationKind: WalletSessionAuthorizationV2EcdsaOperationKind;
+};
+export type WalletSessionAuthorizationV2AdministrationOperation = {
+    readonly kind: 'link_devices';
+    readonly tenantId: TenantId;
+    readonly principalId: PrincipalId;
+    readonly walletId: WalletId;
+};
+export type WalletSessionAuthorizationV2AdmissionError = 'invalid_time' | 'authorization_retired' | 'authorization_expired' | 'operation_identity_mismatch' | 'wallet_mismatch' | 'authority_inactive' | 'authority_mismatch' | 'authority_digest_mismatch' | 'authority_revocation_epoch_mismatch' | 'auth_method_inactive' | 'auth_method_mismatch' | 'permission_mismatch' | 'capability_subject_mismatch' | 'signer_family_mismatch' | 'signer_activation_mismatch';
+type WalletSessionAuthorizationV2AdmittedSigner = {
+    readonly keyFamily: 'ed25519';
+    readonly operationKind: WalletSessionAuthorizationV2Ed25519OperationKind;
+    readonly walletKeyId: WalletKeyId;
+    readonly signer: ExactAdministeredEd25519SignerV1;
+    readonly materialActivation: MpcMaterialActivationRef;
+} | {
+    readonly keyFamily: 'ecdsa_secp256k1';
+    readonly operationKind: WalletSessionAuthorizationV2EcdsaOperationKind;
+    readonly walletKeyId: WalletKeyId;
+    readonly signer: ExactAdministeredEcdsaSignerV1;
+    readonly materialActivation: MpcMaterialActivationRef;
+};
+export type WalletSessionAuthorizationV2AdmissionResult = ({
+    readonly ok: true;
+} & WalletSessionAuthorizationV2AdmittedSigner) | {
+    readonly ok: false;
+    readonly error: WalletSessionAuthorizationV2AdmissionError;
+};
+export type WalletSessionAuthorizationV2AdministrationAdmissionResult = {
+    readonly ok: true;
+    readonly operationKind: 'link_devices';
+    readonly authorityId: WalletAuthorityId;
+} | {
+    readonly ok: false;
+    readonly error: WalletSessionAuthorizationV2AdmissionError;
+};
+export declare function resolveWalletSessionAuthorizationV2Admission(input: {
+    readonly authorization: WalletSessionAuthorizationV2;
+    readonly authority: ActiveWalletAuthorityV1;
+    readonly authMethod: WalletAuthMethodRecordV2;
+    readonly operation: WalletSessionAuthorizationV2RequestedOperation;
+    readonly retiredAtMs: number | null;
+    readonly nowMs: number;
+}): WalletSessionAuthorizationV2AdmissionResult;
+export declare function resolveWalletSessionAuthorizationV2AdministrationAdmission(input: {
+    readonly authorization: WalletSessionAuthorizationV2;
+    readonly authority: ActiveWalletAuthorityV1;
+    readonly authMethod: WalletAuthMethodRecordV2;
+    readonly operation: WalletSessionAuthorizationV2AdministrationOperation;
+    readonly retiredAtMs: number | null;
+    readonly nowMs: number;
+}): WalletSessionAuthorizationV2AdministrationAdmissionResult;
+export declare function prepareOwnerWalletExecution(input: {
+    readonly authorizedOperation: AuthorizedOperation;
+    readonly evidence: OwnerWalletExecutionEvidence;
+}): Promise<WalletExecutionAdmissionResult>;
+export {};
+//# sourceMappingURL=walletExecutionAdmission.d.ts.map

package/dist/types/wallet-server/src/router/domains/syncAccount/syncAccountRequestValidation.d.ts

@@ -0,0 +1,30 @@
+import type { WebAuthnAuthenticationCredential } from '../../../core/types';
+export type SyncAccountOptionsRequest = {
+    rp_id: string;
+    account_id?: string;
+    ttl_ms?: number;
+};
+export type SyncAccountVerifyRequest = {
+    challengeId: string;
+    webauthn_authentication: WebAuthnAuthenticationCredential;
+    expected_origin: string;
+};
+export type SyncAccountRouteErrorBody = {
+    ok: false;
+    code: 'invalid_body';
+    message: string;
+};
+export type SyncAccountRouteParseResult<T> = {
+    ok: true;
+    request: T;
+} | {
+    ok: false;
+    status: 400;
+    body: SyncAccountRouteErrorBody;
+};
+export declare function parseSyncAccountOptionsRequest(raw: unknown): SyncAccountRouteParseResult<SyncAccountOptionsRequest>;
+export declare function parseSyncAccountVerifyRequest(input: {
+    body: unknown;
+    origin: unknown;
+}): SyncAccountRouteParseResult<SyncAccountVerifyRequest>;
+//# sourceMappingURL=syncAccountRequestValidation.d.ts.map

package/dist/types/wallet-server/src/router/domains/tenantRoot/tenantRootCustodyLineage.d.ts

@@ -0,0 +1,14 @@
+import type { RuntimePolicyScope } from '../../../../../shared-ts/src/threshold/signingRootScope';
+import type { TenantRootIdentityV1 } from './tenantRootIdentityResolution';
+export type TenantRootActiveLineageV1 = {
+    readonly identityDigestB64u: string;
+    readonly custodyLineageB64u: string;
+};
+export interface TenantRootCustodyLineageResolverV1 {
+    /** Runtime envId is an environment key; resolve its Console ID before root lookup. */
+    resolveActiveLineageForRuntimeScope(scope: RuntimePolicyScope & {
+        readonly signingRootId: string;
+    }): Promise<TenantRootActiveLineageV1 | null>;
+    resolveActiveLineage(identity: TenantRootIdentityV1): Promise<TenantRootActiveLineageV1 | null>;
+}
+//# sourceMappingURL=tenantRootCustodyLineage.d.ts.map

package/dist/types/wallet-server/src/router/domains/tenantRoot/tenantRootEcdsaWalletSessionComposition.d.ts

@@ -0,0 +1,35 @@
+import type { WalletSessionOperationCredentialAdmission } from '../../auth/commonRouterUtils';
+import type { RouterApiWalletRegistrationService } from '../../framework/authServicePort';
+import { EVM_ECDSA_MPC_OPERATION_KINDS } from '../../../../../shared-ts/src/authorization/capabilityKinds';
+import { type ForbiddenTenantRootSelectorFieldsV1, type TenantRootIdentityResolutionErrorCodeV1, type TenantRootIdentityV1 } from './tenantRootIdentityResolution';
+type EcdsaWalletSessionOperationAdmissionV1 = Extract<WalletSessionOperationCredentialAdmission, {
+    readonly curve: 'ecdsa';
+}>;
+export type TenantRootEcdsaWalletSessionExportAdmissionV1 = Omit<EcdsaWalletSessionOperationAdmissionV1, 'admission'> & {
+    readonly admission: Omit<EcdsaWalletSessionOperationAdmissionV1['admission'], 'operationKind'> & {
+        readonly operationKind: (typeof EVM_ECDSA_MPC_OPERATION_KINDS)['exportKey'];
+    };
+};
+export type TenantRootEcdsaMaterialActivationResolverV1 = RouterApiWalletRegistrationService['resolveEcdsaMaterialActivation'];
+export type TenantRootEcdsaMaterialActivationResolutionV1 = Awaited<ReturnType<TenantRootEcdsaMaterialActivationResolverV1>>;
+export type TenantRootEcdsaActiveMaterialV1 = Extract<TenantRootEcdsaMaterialActivationResolutionV1, {
+    readonly ok: true;
+}>;
+export type TenantRootEcdsaWalletSessionCompositionInputV1 = ForbiddenTenantRootSelectorFieldsV1 & {
+    readonly admission: TenantRootEcdsaWalletSessionExportAdmissionV1;
+    readonly resolveEcdsaMaterialActivation: TenantRootEcdsaMaterialActivationResolverV1;
+};
+export type TenantRootEcdsaWalletSessionCompositionErrorCodeV1 = 'not_found' | 'internal' | 'material_activation_mismatch' | 'wallet_mismatch' | 'threshold_public_key_mismatch' | TenantRootIdentityResolutionErrorCodeV1;
+export type TenantRootEcdsaWalletSessionCompositionResultV1 = {
+    readonly ok: true;
+    readonly admission: TenantRootEcdsaWalletSessionExportAdmissionV1;
+    readonly activeMaterial: TenantRootEcdsaActiveMaterialV1;
+    readonly tenantRootIdentity: TenantRootIdentityV1;
+} | {
+    readonly ok: false;
+    readonly code: TenantRootEcdsaWalletSessionCompositionErrorCodeV1;
+    readonly message: string;
+};
+export declare function resolveTenantRootEcdsaWalletSessionCompositionV1(input: TenantRootEcdsaWalletSessionCompositionInputV1): Promise<TenantRootEcdsaWalletSessionCompositionResultV1>;
+export {};
+//# sourceMappingURL=tenantRootEcdsaWalletSessionComposition.d.ts.map

package/dist/types/wallet-server/src/router/domains/tenantRoot/tenantRootEd25519WalletSessionComposition.d.ts

@@ -0,0 +1,35 @@
+import type { WalletSessionOperationCredentialAdmission } from '../../auth/commonRouterUtils';
+import type { RouterApiWalletRegistrationService } from '../../framework/authServicePort';
+import { NEAR_ED25519_MPC_OPERATION_KINDS } from '../../../../../shared-ts/src/authorization/capabilityKinds';
+import { type ForbiddenTenantRootSelectorFieldsV1, type TenantRootIdentityResolutionErrorCodeV1, type TenantRootIdentityV1 } from './tenantRootIdentityResolution';
+type Ed25519WalletSessionOperationAdmissionV1 = Extract<WalletSessionOperationCredentialAdmission, {
+    readonly curve: 'ed25519';
+}>;
+export type TenantRootEd25519WalletSessionExportAdmissionV1 = Omit<Ed25519WalletSessionOperationAdmissionV1, 'admission'> & {
+    readonly admission: Omit<Ed25519WalletSessionOperationAdmissionV1['admission'], 'operationKind'> & {
+        readonly operationKind: (typeof NEAR_ED25519_MPC_OPERATION_KINDS)['exportKey'];
+    };
+};
+export type TenantRootEd25519MaterialActivationResolverV1 = RouterApiWalletRegistrationService['resolveEd25519MaterialActivation'];
+export type TenantRootEd25519MaterialActivationResolutionV1 = Awaited<ReturnType<TenantRootEd25519MaterialActivationResolverV1>>;
+export type TenantRootEd25519ActiveMaterialV1 = Extract<TenantRootEd25519MaterialActivationResolutionV1, {
+    readonly ok: true;
+}>;
+export type TenantRootEd25519WalletSessionCompositionInputV1 = ForbiddenTenantRootSelectorFieldsV1 & {
+    readonly admission: TenantRootEd25519WalletSessionExportAdmissionV1;
+    readonly resolveEd25519MaterialActivation: TenantRootEd25519MaterialActivationResolverV1;
+};
+export type TenantRootEd25519WalletSessionCompositionErrorCodeV1 = 'not_found' | 'internal' | 'material_activation_mismatch' | 'wallet_mismatch' | 'registered_public_key_mismatch' | TenantRootIdentityResolutionErrorCodeV1;
+export type TenantRootEd25519WalletSessionCompositionResultV1 = {
+    readonly ok: true;
+    readonly admission: TenantRootEd25519WalletSessionExportAdmissionV1;
+    readonly activeMaterial: TenantRootEd25519ActiveMaterialV1;
+    readonly tenantRootIdentity: TenantRootIdentityV1;
+} | {
+    readonly ok: false;
+    readonly code: TenantRootEd25519WalletSessionCompositionErrorCodeV1;
+    readonly message: string;
+};
+export declare function resolveTenantRootEd25519WalletSessionCompositionV1(input: TenantRootEd25519WalletSessionCompositionInputV1): Promise<TenantRootEd25519WalletSessionCompositionResultV1>;
+export {};
+//# sourceMappingURL=tenantRootEd25519WalletSessionComposition.d.ts.map

package/dist/types/wallet-server/src/router/domains/tenantRoot/tenantRootIdentityResolution.d.ts

@@ -0,0 +1,56 @@
+import { type TenantRootIdentityV1 } from '../../../../../shared-ts/src/tenant-root/tenantRootIdentity';
+import type { RouterApiWalletRegistrationService } from '../../framework/authServicePort';
+export type { TenantRootIdentityV1 } from '../../../../../shared-ts/src/tenant-root/tenantRootIdentity';
+export type ActiveEd25519MaterialActivationV1 = Extract<Awaited<ReturnType<RouterApiWalletRegistrationService['resolveEd25519MaterialActivation']>>, {
+    readonly ok: true;
+}>;
+export type ActiveEcdsaMaterialActivationV1 = Extract<Awaited<ReturnType<RouterApiWalletRegistrationService['resolveEcdsaMaterialActivation']>>, {
+    readonly ok: true;
+}>;
+export type ForbiddenTenantRootSelectorFieldsV1 = {
+    readonly orgId?: never;
+    readonly projectId?: never;
+    readonly envId?: never;
+    readonly signingRootId?: never;
+    readonly signingRootVersion?: never;
+    readonly walletId?: never;
+    readonly materialActivation?: never;
+    readonly tenantRootIdentity?: never;
+    readonly tenantRootId?: never;
+    readonly tenantRootShareEpoch?: never;
+    readonly rootShareEpoch?: never;
+    readonly epoch?: never;
+    readonly role?: never;
+    readonly walletSession?: never;
+    readonly walletSessionId?: never;
+    readonly authorization?: never;
+    readonly authorizationId?: never;
+    readonly credential?: never;
+    readonly credentialIdB64u?: never;
+    readonly browser?: never;
+    readonly browserRecord?: never;
+    readonly requestBody?: never;
+    readonly requestId?: never;
+    readonly diagnostics?: never;
+};
+declare const FORBIDDEN_TENANT_ROOT_SELECTOR_FIELDS_V1: readonly ["orgId", "projectId", "envId", "signingRootId", "signingRootVersion", "walletId", "materialActivation", "tenantRootIdentity", "tenantRootId", "tenantRootShareEpoch", "rootShareEpoch", "epoch", "role", "walletSession", "walletSessionId", "authorization", "authorizationId", "credential", "credentialIdB64u", "browser", "browserRecord", "requestBody", "requestId", "diagnostics"];
+export type ForbiddenTenantRootSelectorFieldV1 = (typeof FORBIDDEN_TENANT_ROOT_SELECTOR_FIELDS_V1)[number];
+export type ServerResolvedTenantRootMaterialV1 = (ForbiddenTenantRootSelectorFieldsV1 & {
+    readonly kind: 'ed25519_b5_active_material';
+    readonly activeMaterial: ActiveEd25519MaterialActivationV1;
+}) | (ForbiddenTenantRootSelectorFieldsV1 & {
+    readonly kind: 'ecdsa_b5_active_material';
+    readonly activeMaterial: ActiveEcdsaMaterialActivationV1;
+});
+export type TenantRootIdentityResolutionErrorCodeV1 = 'caller_selected_tenant_root' | 'material_activation_mismatch' | 'non_canonical_tenant_root_field' | 'signing_root_id_mismatch' | 'signing_root_version_mismatch';
+export type TenantRootIdentityResolutionResultV1 = {
+    readonly ok: true;
+    readonly identity: TenantRootIdentityV1;
+} | {
+    readonly ok: false;
+    readonly code: TenantRootIdentityResolutionErrorCodeV1;
+    readonly message: string;
+};
+export declare function findForbiddenTenantRootSelectorFieldV1(input: object): ForbiddenTenantRootSelectorFieldV1 | null;
+export declare function resolveTenantRootIdentityV1(input: ServerResolvedTenantRootMaterialV1): TenantRootIdentityResolutionResultV1;
+//# sourceMappingURL=tenantRootIdentityResolution.d.ts.map

package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationInputs.d.ts

@@ -0,0 +1,78 @@
+import type { CorrelationId } from '../../../../../shared-ts/src/utils/canonicalPrimitives';
+import type { RegisterWalletInput, RegistrationAuthMethodInput, RegistrationSignerSetSelection } from '../../../../../shared-ts/src/utils/registrationIntent';
+import type { RouterAbEcdsaRegistrationRequestV1, RouterAbEcdsaVerifiedClientActivationFactsV1 } from '../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
+import type { WalletRegistrationAuthorityInput, WalletRegistrationFinalizeSignerWork } from '../../../core/registrationContracts';
+import type { ThresholdRuntimePolicyScope } from '../../../core/types';
+import type { WalletRegistrationSetupMinter, WalletRegistrationSetupVerifier } from './walletRegistrationSetupPayload';
+export type WalletRegistrationSetupRequest = {
+    readonly wallet?: RegisterWalletInput;
+    readonly signerSelection: RegistrationSignerSetSelection;
+    readonly authMethod: RegistrationAuthMethodInput;
+};
+export type WalletRegistrationSetupInput = {
+    readonly request: WalletRegistrationSetupRequest;
+    readonly orgId: string;
+    readonly expectedOrigin: string;
+    readonly signer: WalletRegistrationSetupMinter;
+    readonly runtimePolicyScope?: ThresholdRuntimePolicyScope;
+    readonly signingRootId?: string;
+    readonly signingRootVersion?: string;
+};
+export type WalletRegistrationRespondInput = {
+    readonly registrationCeremonyId: string;
+    readonly signedSetup: unknown;
+    readonly authority: WalletRegistrationAuthorityInput;
+    /** Checked against the plan the ceremony recorded before anything runs. */
+    readonly planKind: 'evm_family_ecdsa' | 'near_ed25519_and_evm_family_ecdsa' | 'near_ed25519';
+    /** Absent exactly when the plan is Ed25519-only. */
+    readonly ecdsa?: {
+        readonly kind: 'router_ab_ecdsa_registration_v1';
+        readonly strictRegistration: RouterAbEcdsaRegistrationRequestV1;
+        readonly requestDigestB64u: string;
+    };
+    /** Verifies the opaque setup token before authority-bound work begins. */
+    readonly verifier: WalletRegistrationSetupVerifier;
+    readonly userAgent?: string;
+};
+export type WalletRegistrationActivateInput = {
+    readonly registrationCeremonyId: string;
+    readonly signedSetup: unknown;
+    readonly idempotencyKey: string;
+    /**
+     * No `expectedKeyHandles`. That field was the client's cross-check between
+     * two separate requests: activate returned the key handle, and the client
+     * echoed it to finalize so a mismatched pair could be caught. With both
+     * legs in one call the handle is produced and consumed inside the same
+     * request, so the client has nothing to cross-check against and asking it
+     * to supply one would be theatre.
+     */
+    readonly planKind: 'evm_family_ecdsa' | 'near_ed25519_and_evm_family_ecdsa' | 'near_ed25519';
+    /** Absent exactly when the plan is Ed25519-only. */
+    readonly ecdsa?: {
+        readonly activationCorrelationId: CorrelationId;
+        readonly activationRequestDigestB64u: string;
+        readonly clientActivation: RouterAbEcdsaVerifiedClientActivationFactsV1;
+    };
+    readonly emailOtpEnrollment?: unknown;
+    /** The custody ceremony's sealed output; the admission gate owns validation. */
+    readonly walletCustodyCommit?: unknown;
+    readonly verifier: WalletRegistrationSetupVerifier;
+};
+export type WalletRegistrationNearProvisioningInput = {
+    readonly registrationCeremonyId: string;
+    readonly signedSetup: unknown;
+    readonly idempotencyKey: string;
+    readonly ed25519: Extract<WalletRegistrationFinalizeSignerWork, {
+        readonly kind: 'near_ed25519';
+    }>['ed25519'];
+    readonly emailOtpEnrollment?: unknown;
+    /**
+     * The custody ceremony's sealed output. An Ed25519-only wallet establishes
+     * its custody *here* rather than at activate: activate returns
+     * `near_pending` with no Yao result yet, so this deferred leg is the first
+     * point at which that wallet has a key set to seal against.
+     */
+    readonly walletCustodyCommit?: unknown;
+    readonly verifier: WalletRegistrationSetupVerifier;
+};
+//# sourceMappingURL=walletRegistrationInputs.d.ts.map

package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationRoutes.d.ts

@@ -0,0 +1,91 @@
+import type { WalletRegistrationNearProvisioningResponseV2, WalletRegistrationActivateRouteResponseV2, WalletRegistrationRespondResponseV2, WalletRegistrationSetupResponseV2 } from '../../../core/threeRouteRegistrationContracts';
+import type { RouterApiPublishableKeyAuthAdapter } from '../../framework/routerApi';
+import type { RouterApiAuthorizationSessionService, RouterApiWalletRegistrationRouteService } from '../../framework/authServicePort';
+import type { FundImplicitNearAccountResult } from '../../../core/types';
+import type { CreateAddAuthMethodIntentResponse, CreateAddSignerIntentResponse, WalletAddSignerFinalizeResponse, WalletAddSignerEcdsaActivationResponse, WalletAddSignerEcdsaDerivationRespondResponse, WalletAddSignerStartResponse, WalletAddAuthMethodFinalizeResponse, WalletRevokeAuthMethodResponse, WalletAddAuthMethodStartResponse } from '../../../core/registrationContracts';
+import type { NormalizedRouterLogger } from '../../framework/logger';
+import type { RouterApiKeyAuthAdapter, RouterApiProjectEnvironmentResolver, SessionAdapter, RouterApiWalletProjectionAdapter } from '../../framework/routerApi';
+import type { HeaderRecord, RouteResponse } from '../../framework/routeExecutionContext';
+import type { RouteDefinition } from '../../framework/routeDefinitions';
+import type { RouteErrorBody } from '../../framework/routeResponses';
+import type { RouterAbPublicKeysetV2 } from '../../../../../shared-ts/src/utils/routerAbPublicKeyset';
+type RouterApiWalletRegistrationServices = {
+    walletRegistration: RouterApiWalletRegistrationRouteService;
+    authorizationSessions: RouterApiAuthorizationSessionService;
+    apiKeyAuth?: RouterApiKeyAuthAdapter | null;
+    orgProjectEnv?: RouterApiProjectEnvironmentResolver | null;
+    routerAbPublicKeyset?: RouterAbPublicKeysetV2 | null;
+    session?: SessionAdapter | null;
+    publishableKeyAuth?: RouterApiPublishableKeyAuthAdapter | null;
+    walletProjection?: RouterApiWalletProjectionAdapter | null;
+};
+type RouterApiWalletRegistrationInput = {
+    body: unknown;
+    headers: HeaderRecord;
+    hostedWalletOrigins: readonly (string | undefined)[];
+    logger: NormalizedRouterLogger;
+    origin?: string;
+    pathParams?: Record<string, string | undefined>;
+    route: RouteDefinition;
+    services: RouterApiWalletRegistrationServices;
+    sourceIp?: string;
+};
+export declare function handleRouterApiWalletAddSignerIntent(input: RouterApiWalletRegistrationInput): Promise<RouteResponse<CreateAddSignerIntentResponse | RouteErrorBody>>;
+/**
+ * Refactor 94C. `POST /wallets/register/setup` — the single admitted entry
+ * point that replaces the bootstrap grant, the intent, and start.
+ *
+ * Authentication is the same API-credential plane the intent route used, so
+ * origin and environment binding are unchanged; what is gone is the stored
+ * grant that used to sit between the check and its only reader.
+ */
+export declare function handleRouterApiWalletRegistrationSetup(input: RouterApiWalletRegistrationInput): Promise<RouteResponse<WalletRegistrationSetupResponseV2 | RouteErrorBody>>;
+/**
+ * Refactor 94C. `POST /wallets/register/respond` — the authenticated leg.
+ *
+ * Bearing the proof, so it is a public-plane route authorized by the signed
+ * setup payload plus the WebAuthn or Email OTP proof, exactly as the
+ * derivation respond leg it replaces was.
+ */
+export declare function handleRouterApiWalletRegistrationRespond(input: RouterApiWalletRegistrationInput): Promise<RouteResponse<WalletRegistrationRespondResponseV2 | RouteErrorBody>>;
+/**
+ * Refactor 94C. `POST /wallets/register/activate` — activation and
+ * finalization behind one Gateway operation row.
+ */
+export declare function handleRouterApiWalletRegistrationActivate(input: RouterApiWalletRegistrationInput): Promise<RouteResponse<WalletRegistrationActivateRouteResponseV2 | RouteErrorBody>>;
+/**
+ * Refactor 94C. `POST /wallets/register/near-provisioning` — the non-blocking
+ * completion the client calls after activate, once its already-running Yao
+ * computation produces an activation.
+ */
+export declare function handleRouterApiWalletRegistrationNearProvisioning(input: RouterApiWalletRegistrationInput): Promise<RouteResponse<WalletRegistrationNearProvisioningResponseV2 | RouteErrorBody>>;
+export declare function handleRouterApiWalletAddSignerStart(input: RouterApiWalletRegistrationInput): Promise<RouteResponse<WalletAddSignerStartResponse | RouteErrorBody>>;
+export declare function handleRouterApiWalletAddSignerEcdsaDerivationRespond(input: RouterApiWalletRegistrationInput): Promise<RouteResponse<WalletAddSignerEcdsaDerivationRespondResponse | RouteErrorBody>>;
+export declare function handleRouterApiWalletAddSignerEcdsaActivation(input: RouterApiWalletRegistrationInput): Promise<RouteResponse<WalletAddSignerEcdsaActivationResponse | RouteErrorBody>>;
+export declare function handleRouterApiWalletAddSignerFinalize(input: RouterApiWalletRegistrationInput): Promise<RouteResponse<WalletAddSignerFinalizeResponse | RouteErrorBody>>;
+export declare function handleRouterApiWalletAddAuthMethodIntent(input: RouterApiWalletRegistrationInput): Promise<RouteResponse<CreateAddAuthMethodIntentResponse | RouteErrorBody>>;
+/**
+ * Sends the enrollment code for an Email OTP addition.
+ *
+ * The intent grant is the whole gate. The address is read from the intent the
+ * grant names rather than taken from the body: a caller able to name the
+ * recipient could send any wallet's enrollment code anywhere, and the grant is
+ * the only evidence this addition was authorized at all.
+ */
+export declare function handleRouterApiWalletAddAuthMethodEmailOtpChallenge(input: RouterApiWalletRegistrationInput): Promise<RouteResponse<{
+    readonly ok: true;
+    readonly challengeId: string;
+    readonly expiresAtMs: number;
+    readonly emailHint: string;
+} | {
+    readonly ok: false;
+    readonly code: string;
+    readonly message: string;
+}>>;
+export declare function handleRouterApiWalletAddAuthMethodStart(input: RouterApiWalletRegistrationInput): Promise<RouteResponse<WalletAddAuthMethodStartResponse | RouteErrorBody>>;
+export declare function handleRouterApiWalletAddAuthMethodFinalize(input: RouterApiWalletRegistrationInput): Promise<RouteResponse<WalletAddAuthMethodFinalizeResponse | RouteErrorBody>>;
+export declare function handleRouterApiWalletRevokeAuthMethod(input: RouterApiWalletRegistrationInput): Promise<RouteResponse<WalletRevokeAuthMethodResponse | RouteErrorBody>>;
+export declare function handleRouterApiWalletEcdsaKeyFactsInventory(input: RouterApiWalletRegistrationInput): Promise<RouteResponse<RouteErrorBody | Record<string, unknown>>>;
+export declare function handleRouterApiWalletNearImplicitAccountFund(input: RouterApiWalletRegistrationInput): Promise<RouteResponse<RouteErrorBody | FundImplicitNearAccountResult>>;
+export {};
+//# sourceMappingURL=walletRegistrationRoutes.d.ts.map

package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationSetupPayload.d.ts

@@ -0,0 +1,105 @@
+/**
+ * Refactor 94C. The opaque payload `/wallets/register/setup` mints and routes
+ * 2 and 3 verify.
+ *
+ * Setup admits the application, allocates the wallet, and runs the Router
+ * preparation in one request. Routes 2 and 3 then need to know that the
+ * ceremony they are being driven with is the one setup admitted, and with the
+ * parameters setup admitted — without paying another storage round trip to
+ * find out. The client carries this string and never parses it.
+ *
+ * The claims bind the route's canonical request digest, so a payload minted
+ * for one ceremony cannot drive another, and a ceremony cannot be driven with
+ * mutated parameters. Policy never appears here: it does not cross the public
+ * wire at all. The Gateway mints a separate internal Router-policy JWT per
+ * concrete Router call.
+ *
+ * Minting and verification both go through the Gateway session signer, which
+ * is the sole minting authority and verifies locally against pinned key
+ * material. Nothing here performs a JWKS fetch or any other I/O.
+ */
+import type { RegistrationIntentV1 } from '../../../../../shared-ts/src/utils/registrationIntent';
+import { type RuntimePolicyScope } from '../../../../../shared-ts/src/threshold/signingRootScope';
+import type { SignedSetupPayloadB64u } from '../../../core/threeRouteRegistrationContracts';
+export type WalletRegistrationSetupMinter = {
+    signJwt(sub: string, extra?: Record<string, unknown>): Promise<string>;
+};
+export type WalletRegistrationSetupVerifier = {
+    verifyJwt(token: string): Promise<{
+        readonly valid: true;
+        readonly payload: Record<string, unknown>;
+    } | {
+        readonly valid: false;
+    }>;
+};
+export declare const WALLET_REGISTRATION_SETUP_CLAIM_KIND: "wallet_registration_setup_v1";
+export type WalletRegistrationSetupClaimsV1 = {
+    readonly kind: typeof WALLET_REGISTRATION_SETUP_CLAIM_KIND;
+    readonly registrationCeremonyId: string;
+    readonly walletId: string;
+    readonly orgId: string;
+    readonly signingRootId: string;
+    readonly signingRootVersion: string;
+    readonly policy: {
+        readonly kind: 'runtime_policy_scope';
+        readonly scope: RuntimePolicyScope;
+    } | {
+        readonly kind: 'signing_root_only';
+        readonly scope?: never;
+    };
+    /** Canonical digest of setup's own request bytes. */
+    readonly setupDigestB64u: string;
+    readonly expiresAtMs: number;
+};
+/**
+ * Setup's canonical request digest, over canonically encoded bytes rather than
+ * raw JSON, so property order cannot change the value.
+ *
+ * This is setup's own digest. Respond and activate each compute their own over
+ * their own bytes, so a payload minted for one route can never satisfy
+ * another.
+ */
+export declare function computeWalletRegistrationSetupDigestB64u(input: {
+    readonly registrationCeremonyId: string;
+    readonly intent: RegistrationIntentV1;
+    readonly intentDigestB64u: string;
+    readonly orgId: string;
+    readonly signingRootId: string;
+    readonly signingRootVersion: string;
+    readonly expectedOrigin: string;
+}): Promise<string>;
+export declare function mintSignedWalletRegistrationSetup(signer: WalletRegistrationSetupMinter, claims: WalletRegistrationSetupClaimsV1): Promise<SignedSetupPayloadB64u>;
+export type WalletRegistrationSetupVerification = {
+    readonly ok: true;
+    readonly claims: WalletRegistrationSetupClaimsV1;
+} | {
+    readonly ok: false;
+    readonly code: string;
+    readonly message: string;
+};
+/**
+ * Verifies the payload and binds it to the ceremony the caller is driving.
+ * A payload that verifies cryptographically but names a different ceremony,
+ * wallet, or setup digest is rejected — signature validity alone is not
+ * authorization for this request.
+ */
+/**
+ * Verifies the payload's signature, ceremony binding, and expiry, and returns
+ * its claims — without needing the ceremony row.
+ *
+ * Activate depends on this: a successful activation deletes the ceremony, so
+ * an exact replay must be answerable from the operation row alone. The claims
+ * are Gateway-signed, so the `setupDigestB64u` they carry is trustworthy
+ * without recomputing it from storage.
+ */
+export declare function verifyWalletRegistrationSetupClaims(signer: WalletRegistrationSetupVerifier, token: unknown, expected: {
+    readonly registrationCeremonyId: string;
+    readonly nowMs: number;
+}): Promise<WalletRegistrationSetupVerification>;
+export declare function verifySignedWalletRegistrationSetup(signer: WalletRegistrationSetupVerifier, token: unknown, expected: {
+    readonly registrationCeremonyId: string;
+    readonly setupDigestB64u: string;
+    readonly nowMs: number;
+}): Promise<WalletRegistrationSetupVerification>;
+export declare function parseWalletRegistrationSetupClaims(value: unknown): WalletRegistrationSetupClaimsV1 | null;
+//# sourceMappingURL=walletRegistrationSetupPayload.d.ts.map

package/dist/types/wallet-server/src/router/domains/walletUnlock/walletUnlockRequestedCapabilitiesValidation.d.ts

@@ -0,0 +1,39 @@
+export declare const EMAIL_OTP_NO_REQUESTED_CAPABILITIES_KIND: "none";
+export declare const EMAIL_OTP_WALLET_SESSION_REQUESTED_CAPABILITIES_KIND: "wallet_session";
+export declare const EMAIL_OTP_ED25519_YAO_REQUESTED_CAPABILITIES_KIND: "ed25519_yao";
+type WalletUnlockEmailOtpRequestedCapabilitiesBase = {
+    readonly signerSlot: number;
+    readonly remainingUses: number;
+};
+export type WalletUnlockEmailOtpRequestedCapabilitiesV1 = {
+    readonly kind: typeof EMAIL_OTP_NO_REQUESTED_CAPABILITIES_KIND;
+} | {
+    readonly kind: typeof EMAIL_OTP_WALLET_SESSION_REQUESTED_CAPABILITIES_KIND;
+} | (WalletUnlockEmailOtpRequestedCapabilitiesBase & {
+    readonly kind: typeof EMAIL_OTP_ED25519_YAO_REQUESTED_CAPABILITIES_KIND;
+});
+export type WalletUnlockEmailOtpRequestedCapabilitiesRequestV1 = {
+    readonly walletId: string;
+    readonly orgId: string;
+    readonly challengeId: string;
+    readonly requestedCapabilities: WalletUnlockEmailOtpRequestedCapabilitiesV1;
+};
+type WalletUnlockRequestedCapabilitiesParseFailure = {
+    readonly ok: false;
+    readonly status: 400;
+    readonly body: {
+        readonly ok: false;
+        readonly code: 'invalid_body';
+        readonly message: string;
+    };
+};
+export type WalletUnlockRequestedCapabilitiesParseResult = {
+    readonly ok: true;
+    readonly request: null;
+} | {
+    readonly ok: true;
+    readonly request: WalletUnlockEmailOtpRequestedCapabilitiesRequestV1;
+} | WalletUnlockRequestedCapabilitiesParseFailure;
+export declare function parseWalletUnlockRequestedCapabilitiesRequest(raw: unknown): WalletUnlockRequestedCapabilitiesParseResult;
+export {};
+//# sourceMappingURL=walletUnlockRequestedCapabilitiesValidation.d.ts.map