@seams/wallet-server 0.5.0

package/dist/types/wallet-server/src/router/transport/fetch/fetchRouter.types.d.ts

@@ -0,0 +1,23 @@
+import type { NormalizedRouterLogger } from '../../framework/logger';
+import type { RouterApiServiceBag } from '../../framework/authServicePort';
+import type { RouterApiOptions } from '../../framework/routerApi';
+import type { RouteDefinition } from '../../framework/routeDefinitions';
+export type FetchRouterRuntime = {
+    readonly kind: 'inline';
+} | {
+    readonly kind: 'background';
+    readonly waitUntil: (promise: Promise<unknown>) => void;
+};
+export interface FetchRouterApiContext {
+    request: Request;
+    url: URL;
+    pathname: string;
+    method: string;
+    runtime: FetchRouterRuntime;
+    service: RouterApiServiceBag;
+    opts: RouterApiOptions;
+    logger: NormalizedRouterLogger;
+    routeDefinitions: readonly RouteDefinition[];
+}
+export type FetchRouterHandler = (request: Request, runtime?: FetchRouterRuntime) => Promise<Response>;
+//# sourceMappingURL=fetchRouter.types.d.ts.map

package/dist/types/wallet-server/src/router/transport/fetch/routes/auth.d.ts

@@ -0,0 +1,3 @@
+import type { FetchRouterApiContext } from '../createFetchRouter';
+export declare function handleAuth(ctx: FetchRouterApiContext): Promise<Response | null>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/types/wallet-server/src/router/transport/fetch/routes/deviceLinking.d.ts

@@ -0,0 +1,202 @@
+import type { LinkedDeviceApprovalV1, LinkedDeviceEmailOtpBaseFactorRequestV1, LinkedDeviceEmailOtpBaseFactorResolutionV1, LinkedDeviceEmailOtpFactorReleaseEnvelopeV1, LinkedDeviceEmailOtpVerificationGrantV1, LinkedDeviceTargetCredentialRegistrationV1, LinkedDeviceTargetCredentialRegistrationResultV1, LinkedDeviceTargetPreparationV1, LocalAuthorityActivationFinalAckV1, LocalAuthorityInstallationReceiptV1, QrLinkedDeviceSessionPayloadV5, VerifiedLinkInputV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
+import type { LinkedDeviceActivationCleanupReceiptV1 } from '../../../../../../shared-ts/src/device-linking/walletSessionCredentialDelivery';
+import type { CommittedAuthorityPackagesV1 } from '../../../../../../shared-ts/src/device-linking/committedSignerPackages';
+import type { LinkedDeviceEd25519ExportRootPortV1 } from '../../../../core/deviceLinking/linkedDeviceEd25519ExportRoot';
+import { type LinkedDeviceEd25519SourceContributionPreparationV1 } from '../../../../../../shared-ts/src/device-linking/sourceContribution';
+import { type RouterAbEd25519YaoActivationExecuteRequestV1 } from '../../../../../../shared-ts/src/utils/routerAbEd25519Yao';
+import type { ActivateInstalledAuthorityResultV1 as D1ActivateInstalledAuthorityResultV1, CommitPendingAuthorityResultV1, LocalAuthorityActivationAcknowledgementAuthenticationV1 } from '../../../../router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService';
+import { type LinkedDeviceRequestProofV1 } from '../../../../core/deviceLinking/requestProof';
+import type { LinkedDeviceOwnerAuthorizationContextV1, LinkedDeviceSessionRecordV1, LinkedDeviceSessionServiceResultV1, LinkedDeviceSessionServiceV1 } from '../../../../core/deviceLinking/linkedDeviceSession';
+import type { FetchRouterApiContext } from '../createFetchRouter';
+import { type DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
+import { type LinkDeviceSessionId } from '../../../../../../shared-ts/src/signing-lanes/ids';
+import type { WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
+export declare const DEVICE_LINKING_REQUEST_PROOF_HEADER_V1 = "x-seams-linked-device-proof-v1";
+export type DeviceLinkingAuthDeniedV1 = {
+    readonly kind: 'denied';
+    readonly code: 'unauthorized' | 'expired' | 'invalid' | 'replayed';
+    readonly message: string;
+};
+export type DeviceLinkingRequestBindingV1 = {
+    readonly kind: 'linked_device_owner_request_binding_v1';
+    readonly method: 'GET' | 'POST';
+    readonly pathname: string;
+    readonly bodyDigestB64u: DigestB64u;
+    readonly expiresAtMs: number;
+};
+export type DeviceLinkingOwnerRequestInputV1 = {
+    readonly request: Request;
+    readonly method: string;
+    readonly pathname: string;
+    readonly bodyDigestB64u: DigestB64u;
+    readonly requestedAtMs: number;
+};
+export type DeviceLinkingAuthenticatedRequestV1 = {
+    readonly kind: 'authorized';
+    readonly body: unknown;
+    readonly owner: LinkedDeviceOwnerAuthorizationContextV1;
+    readonly binding: DeviceLinkingRequestBindingV1;
+};
+export type DeviceLinkingRequestProofV1 = LinkedDeviceRequestProofV1;
+export type DeviceLinkingDeviceAuthenticatedRequestV1 = {
+    readonly kind: 'authorized';
+    readonly body: unknown;
+    readonly proof: DeviceLinkingRequestProofV1;
+};
+export type DeviceLinkingRouteMutationResultV1 = LinkedDeviceSessionServiceResultV1;
+export type DeviceLinkingTargetCredentialProviderV1 = {
+    getTargetPreparationV1(input: {
+        readonly session: LinkedDeviceSessionRecordV1;
+        readonly approval: LinkedDeviceApprovalV1;
+        readonly requestedAtMs: number;
+    } & ({
+        readonly access: 'create_or_replay';
+        readonly expectedOrigin: string;
+        readonly deliveryRecipientPublicKey65B64u: string;
+    } | {
+        readonly access: 'replay_only';
+        readonly expectedOrigin?: never;
+        readonly deliveryRecipientPublicKey65B64u?: never;
+    })): Promise<LinkedDeviceTargetPreparationResultV1>;
+    registerTargetCredentialV1(input: {
+        readonly registration: LinkedDeviceTargetCredentialRegistrationV1;
+        readonly preparation: LinkedDeviceTargetPreparationV1;
+        readonly session: LinkedDeviceSessionRecordV1;
+        readonly approval: LinkedDeviceApprovalV1;
+        readonly expectedOrigin: string;
+        readonly requestedAtMs: number;
+    }): Promise<{
+        readonly outcome: 'applied' | 'replayed';
+        readonly keyManifestDigestB64u: DigestB64u;
+        readonly targetCredential: LinkedDeviceTargetCredentialRegistrationResultV1;
+    } | {
+        readonly outcome: 'invalid_input';
+        readonly message: string;
+    }>;
+    buildVerifiedLinkInputV1(input: {
+        readonly session: LinkedDeviceSessionRecordV1;
+        readonly approval: LinkedDeviceApprovalV1;
+        readonly requestedAtMs: number;
+    }): Promise<VerifiedLinkInputV1>;
+};
+export type LinkedDeviceTargetPreparationResultV1 = LinkedDeviceTargetPreparationV1 | {
+    readonly kind: 'conflict';
+    readonly message: string;
+};
+export type DeviceLinkingEmailOtpTargetFactorProviderV1 = {
+    resolveBaseFactorSelectionV1(input: {
+        readonly walletId: WalletId;
+        readonly request: LinkedDeviceEmailOtpBaseFactorRequestV1;
+    }): Promise<LinkedDeviceEmailOtpBaseFactorResolutionV1>;
+    startChallengeV1(input: {
+        readonly session: LinkedDeviceSessionRecordV1;
+        readonly approval: LinkedDeviceApprovalV1;
+        readonly preparation: LinkedDeviceTargetPreparationV1;
+        readonly resend: false;
+        readonly requestedAtMs: number;
+    } | {
+        readonly session: LinkedDeviceSessionRecordV1;
+        readonly approval: LinkedDeviceApprovalV1;
+        readonly preparation: LinkedDeviceTargetPreparationV1;
+        readonly resend: true;
+        readonly requestedAtMs: number;
+    }): Promise<{
+        readonly kind: 'sent';
+        readonly challengeId: string;
+        readonly maskedEmailHint: string;
+        readonly expiresAtMs: number;
+        readonly resendAvailableAtMs: number;
+    } | {
+        readonly kind: 'refused';
+        readonly code: string;
+        readonly message: string;
+    }>;
+    verifyChallengeV1(input: {
+        readonly session: LinkedDeviceSessionRecordV1;
+        readonly approval: LinkedDeviceApprovalV1;
+        readonly preparation: LinkedDeviceTargetPreparationV1;
+        readonly challengeId: string;
+        readonly otpCode: string;
+        readonly requestedAtMs: number;
+    }): Promise<{
+        readonly kind: 'verified';
+        readonly grant: LinkedDeviceEmailOtpVerificationGrantV1;
+        readonly factorRelease: LinkedDeviceEmailOtpFactorReleaseEnvelopeV1 | null;
+    } | {
+        readonly kind: 'refused';
+        readonly code: string;
+        readonly message: string;
+    }>;
+};
+export type DeviceLinkingInstallationReceiptPortV1 = {
+    commitPendingAuthorityV1(input: {
+        readonly input: VerifiedLinkInputV1;
+        readonly nowMs: number;
+        readonly ed25519ExportRootPackage: CommittedAuthorityPackagesV1['ed25519ExportRootPackage'];
+    }): Promise<CommitPendingAuthorityResultV1>;
+    readCommittedAuthorityPackagesV1(input: {
+        readonly session: LinkedDeviceSessionRecordV1;
+        readonly requestedAtMs: number;
+    }): Promise<CommittedAuthorityPackagesV1 | null>;
+    activateInstalledAuthorityV1(input: {
+        readonly receipt: LocalAuthorityInstallationReceiptV1;
+        readonly session: LinkedDeviceSessionRecordV1;
+        readonly requestedAtMs: number;
+    }): Promise<D1ActivateInstalledAuthorityResultV1>;
+    acknowledgeLocalAuthorityActivationV1(input: {
+        readonly acknowledgement: LocalAuthorityActivationFinalAckV1;
+        readonly authentication: LocalAuthorityActivationAcknowledgementAuthenticationV1;
+        readonly requestedAtMs: number;
+    }): Promise<void>;
+    readActivationCleanupReceiptV1(input: {
+        readonly linkSessionId: LinkDeviceSessionId;
+        readonly requestedAtMs: number;
+    }): Promise<LinkedDeviceActivationCleanupReceiptV1 | null>;
+};
+/** Owner-authenticated bridge to the Router's private source-preserving lane. */
+export type DeviceLinkingEd25519SourcePreservingRouterPortV1 = {
+    executeEd25519SourcePreservingV1(input: {
+        readonly sourceBinding: LinkedDeviceEd25519SourceContributionPreparationV1['sourceBinding'];
+        readonly targetRequest: RouterAbEd25519YaoActivationExecuteRequestV1<'registration'>;
+        readonly targetAdmission: LinkedDeviceEd25519SourceContributionPreparationV1['targetAdmission'];
+        readonly applicationBinding: LinkedDeviceEd25519SourceContributionPreparationV1['applicationBinding'];
+        readonly participantIds: readonly [number, number];
+    }): Promise<unknown>;
+};
+export type DeviceLinkingRouteServiceV1 = {
+    readonly sessionService: Pick<LinkedDeviceSessionServiceV1, 'createUnclaimedSessionV1' | 'claimSessionV1' | 'recordOwnerApprovalV1' | 'recordTargetCredentialV1' | 'recordSourceContributionV1' | 'recordEmailOtpChallengeStateV1' | 'failBeforeCommitV1' | 'cancelSessionV1' | 'getSessionV1'> & {
+        readonly listSessionsForWalletV1: LinkedDeviceSessionServiceV1['listSessionsForWalletV1'];
+    };
+    readonly emailOtpTargetFactor?: DeviceLinkingEmailOtpTargetFactorProviderV1;
+    readonly nowV1: () => number;
+    verifyPublicSessionProofV1(input: {
+        readonly payload: QrLinkedDeviceSessionPayloadV5;
+        readonly proof: DeviceLinkingRequestProofV1;
+        readonly method: string;
+        readonly canonicalPath: string;
+        readonly bodyDigestB64u: DigestB64u;
+        readonly devicePublicKeyDigestB64u: DigestB64u;
+        readonly requestedAtMs: number;
+    }): Promise<{
+        readonly kind: 'authorized';
+    } | DeviceLinkingAuthDeniedV1>;
+    authenticateOwnerRequestV1(input: DeviceLinkingOwnerRequestInputV1): Promise<DeviceLinkingAuthenticatedRequestV1 | DeviceLinkingAuthDeniedV1>;
+    authenticateDeviceRequestV1(input: {
+        readonly request: Request;
+        readonly method: string;
+        readonly pathname: string;
+        readonly linkSessionId: string;
+        readonly bodyDigestB64u: DigestB64u;
+        readonly expectedDevicePublicKeyB64u: string;
+        readonly expectedDevicePublicKeyDigestB64u: DigestB64u;
+        readonly proof: DeviceLinkingRequestProofV1;
+        readonly requestedAtMs: number;
+    }): Promise<DeviceLinkingDeviceAuthenticatedRequestV1 | DeviceLinkingAuthDeniedV1>;
+    readonly targetCredential: DeviceLinkingTargetCredentialProviderV1;
+    readonly installationReceipt?: DeviceLinkingInstallationReceiptPortV1;
+    readonly ed25519ExportRoot?: LinkedDeviceEd25519ExportRootPortV1;
+    readonly sourceContributionRouter?: DeviceLinkingEd25519SourcePreservingRouterPortV1;
+};
+export declare function handleDeviceLinking(ctx: FetchRouterApiContext): Promise<Response | null>;
+export declare function targetCredentialResultResponse(record: LinkedDeviceSessionRecordV1, outcome: 'applied' | 'replayed', targetCredential: LinkedDeviceTargetCredentialRegistrationResultV1): Response;
+//# sourceMappingURL=deviceLinking.d.ts.map

package/dist/types/wallet-server/src/router/transport/fetch/routes/deviceLinkingOwnerAuthorization.d.ts

@@ -0,0 +1,92 @@
+import type { LinkedDeviceOwnerAuthorizationSourceV1, QrLinkedDeviceSessionPayloadV5 } from '../../../../../../shared-ts/src/device-linking';
+import type { WalletSessionAuthorizationId, WalletSessionId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
+import type { WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
+import { type WalletAuthAuthority, type WalletAuthAuthorityRef } from '../../../../../../shared-ts/src/utils/walletAuthAuthority';
+import type { ThresholdEd25519AuthorityScope } from '../../../../core/types';
+import { type DelegatedWalletAuthorityV1 } from '../../../../../../shared-ts/src/authorization/delegatedAuthority';
+import type { RouterApiAuthorizationSessionService } from '../../../framework/authServicePort';
+import type { FetchRouterApiContext } from '../createFetchRouter';
+import type { DeviceLinkingAuthDeniedV1, DeviceLinkingOwnerRequestInputV1 } from './deviceLinking';
+import type { WalletExecutionLaneAuthSource } from '../../../../core/signingLanes/WalletExecutionLaneProjection';
+import { type DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
+import type { ExactAdministeredSignerManifestV1 } from '../../../../../../shared-ts/src/device-linking/delegatedActivationPlan';
+export declare const LINKED_DEVICE_OWNER_AUTHORIZATION_PATH_V1: "/wallet/device-linking/v1/owner-authorization";
+export type DeviceLinkingOwnerAuthorizationAuthenticationV1 = {
+    readonly kind: 'link_session_authenticated_request_v1';
+    readonly source: LinkedDeviceOwnerAuthorizationSourceV1;
+    readonly proofDigestB64u: DigestB64u;
+};
+export type DeviceLinkingOwnerAuthorizationResponseV1 = {
+    readonly authentication: DeviceLinkingOwnerAuthorizationAuthenticationV1;
+    readonly walletId: WalletId;
+    readonly ownerAuthorization: LinkedDeviceOwnerAuthorizationSourceV1;
+    readonly sourceSignerManifest: ExactAdministeredSignerManifestV1;
+    readonly expiresAtMs: number;
+};
+export type DeviceLinkingOwnerWalletSessionContextV1 = {
+    readonly walletId: WalletId;
+    readonly walletSessionId: WalletSessionId;
+    readonly authorizationId: WalletSessionAuthorizationId;
+    readonly expiresAtMs: number;
+    readonly permission: DelegatedWalletAuthorityV1;
+    /** The manifest this owner session's key set was registered against. */
+    readonly keyManifestDigestB64u: DigestB64u;
+    readonly curve: 'ed25519';
+    readonly authority: WalletAuthAuthority;
+    readonly authorityScope: ThresholdEd25519AuthorityScope;
+    readonly walletAuthAuthorityRef?: never;
+    readonly authSource?: never;
+} | {
+    readonly walletId: WalletId;
+    readonly walletSessionId: WalletSessionId;
+    readonly authorizationId: WalletSessionAuthorizationId;
+    readonly expiresAtMs: number;
+    readonly permission: DelegatedWalletAuthorityV1;
+    /** The manifest this owner session's key set was registered against. */
+    readonly keyManifestDigestB64u: DigestB64u;
+    readonly curve: 'ecdsa';
+    readonly walletAuthAuthorityRef: WalletAuthAuthorityRef;
+    readonly authSource: WalletExecutionLaneAuthSource;
+    readonly authority?: never;
+    readonly authorityScope?: never;
+};
+export type DeviceLinkingOwnerRequestAuthenticationV1 = {
+    readonly kind: 'authorized';
+    readonly body: unknown;
+    readonly binding: {
+        readonly kind: 'linked_device_owner_request_binding_v1';
+        readonly method: 'GET' | 'POST';
+        readonly pathname: string;
+        readonly bodyDigestB64u: DigestB64u;
+        readonly expiresAtMs: number;
+    };
+    readonly owner: DeviceLinkingOwnerWalletSessionContextV1;
+} | DeviceLinkingAuthDeniedV1;
+export type DeviceLinkingOwnerAuthorizationRouteServiceV1 = {
+    authorizeOwnerForLinkingV1(input: {
+        readonly payload: QrLinkedDeviceSessionPayloadV5;
+        readonly requestedAtMs: number;
+        readonly bodyDigestB64u: DigestB64u;
+        readonly owner: DeviceLinkingOwnerWalletSessionContextV1;
+    }): Promise<DeviceLinkingOwnerAuthorizationResponseV1>;
+};
+/**
+ * Request-scoped owner bearer verifier used by claim, approval, and the owner
+ * authorization metadata route. The returned binding is valid only until the
+ * verified Wallet Session expires and is bound to the exact request bytes.
+ */
+export declare function createDeviceLinkingOwnerRequestAuthenticatorV1(input: {
+    readonly authorizationSessions: RouterApiAuthorizationSessionService;
+    readonly nowV1?: () => number;
+}): (input: DeviceLinkingOwnerRequestInputV1) => Promise<DeviceLinkingOwnerRequestAuthenticationV1>;
+export declare function authenticateDeviceLinkingOwnerWalletSessionRequestV1(input: {
+    readonly request: Request;
+    readonly method: string;
+    readonly pathname: string;
+    readonly bodyDigestB64u: DigestB64u;
+    readonly requestedAtMs: number;
+    readonly authorizationSessions: RouterApiAuthorizationSessionService | null | undefined;
+    readonly nowV1?: () => number;
+}): Promise<DeviceLinkingOwnerRequestAuthenticationV1>;
+export declare function handleDeviceLinkingOwnerAuthorization(ctx: FetchRouterApiContext, service: DeviceLinkingOwnerAuthorizationRouteServiceV1 | undefined): Promise<Response | null>;
+//# sourceMappingURL=deviceLinkingOwnerAuthorization.d.ts.map

package/dist/types/wallet-server/src/router/transport/fetch/routes/deviceManagement.d.ts

@@ -0,0 +1,29 @@
+import { type DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
+import { type WalletAuthMethodId, type WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
+import type { DeviceLinkingAuthDeniedV1, DeviceLinkingAuthenticatedRequestV1, DeviceLinkingOwnerRequestInputV1 } from './deviceLinking';
+import { type LinkedDeviceManagementServiceV1 } from '../../../../core/deviceLinking/linkedDeviceManagement';
+import type { D1LinkedDeviceFreshRevokeProofV1 } from '../../../cloudflare/d1/wallet/d1WalletAuthMethodBoundary';
+import type { FetchRouterApiContext } from '../createFetchRouter';
+export declare const LINKED_DEVICE_MANAGEMENT_BASE_V1 = "/wallet/device-linking/v1/devices";
+export declare const LINKED_DEVICE_MANAGEMENT_MAX_PAGE_SIZE_V1 = 50;
+export type DeviceManagementRouteServiceV1 = {
+    readonly management: Pick<LinkedDeviceManagementServiceV1, 'listLinkedDevicesV1' | 'revokeLinkedDeviceV1'>;
+    readonly nowV1: () => number;
+    authenticateOwnerRequestV1(input: DeviceLinkingOwnerRequestInputV1): Promise<DeviceLinkingAuthenticatedRequestV1 | DeviceLinkingAuthDeniedV1>;
+    verifyFreshRevokeProofV1(input: {
+        readonly walletId: WalletId;
+        readonly targetWalletAuthMethodId: WalletAuthMethodId;
+        readonly proof: D1LinkedDeviceFreshRevokeProofV1;
+        readonly request: Request;
+        readonly method: string;
+        readonly pathname: string;
+        readonly bodyDigestB64u: DigestB64u;
+        readonly requestedAtMs: number;
+    }): Promise<{
+        readonly kind: 'authorized';
+        readonly walletAuthMethodId: WalletAuthMethodId;
+        readonly verifiedAtMs: number;
+    } | DeviceLinkingAuthDeniedV1>;
+};
+export declare function handleDeviceManagement(ctx: FetchRouterApiContext, service: DeviceManagementRouteServiceV1): Promise<Response | null>;
+//# sourceMappingURL=deviceManagement.d.ts.map

package/dist/types/wallet-server/src/router/transport/fetch/routes/health.d.ts

@@ -0,0 +1,4 @@
+import type { FetchRouterApiContext } from '../createFetchRouter';
+export declare function handleHealth(ctx: FetchRouterApiContext): Promise<Response | null>;
+export declare function handleReady(ctx: FetchRouterApiContext): Promise<Response | null>;
+//# sourceMappingURL=health.d.ts.map

package/dist/types/wallet-server/src/router/transport/fetch/routes/nearPublicKeys.d.ts

@@ -0,0 +1,3 @@
+import type { FetchRouterApiContext } from '../createFetchRouter';
+export declare function handleNearPublicKeys(ctx: FetchRouterApiContext): Promise<Response | null>;
+//# sourceMappingURL=nearPublicKeys.d.ts.map

package/dist/types/wallet-server/src/router/transport/fetch/routes/normalSigningRouterProxy.d.ts

@@ -0,0 +1,33 @@
+import type { RouterAbNormalSigningRouterProxy } from '../../../framework/routerApi';
+import type { RouterApiWalletRegistrationService } from '../../../framework/authServicePort';
+import type { AuthorizedOperation } from '../../../../authorization/domain';
+import type { RouterAbNormalSigningMaterialSourceV1 } from '../../../domains/signingOperations/routerAbPrivateSigningWorker';
+import type { RouterAbMpcMaterialActivationRefWire } from '../../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
+export declare const ROUTER_AB_ECDSA_DERIVATION_LINKED_DEVICE_SIGN_PATH: "/router-ab/ecdsa-derivation/linked-device/sign";
+export declare function proxyNormalSigningRequestToMpcRouter(input: {
+    readonly request: Request;
+    readonly proxy: RouterAbNormalSigningRouterProxy | null | undefined;
+    readonly body?: Record<string, unknown>;
+    readonly targetPath?: string;
+}): Promise<Response>;
+export declare function proxyOwnerLaneAdmittedNormalSigningRequest(input: {
+    readonly request: Request;
+    readonly proxy: RouterAbNormalSigningRouterProxy | null | undefined;
+    readonly body: Record<string, unknown>;
+    readonly authorizedOperation: AuthorizedOperation;
+    readonly walletId: Parameters<RouterApiWalletRegistrationService['resolveActiveOwnerWalletExecutionLane']>[0]['walletId'];
+    readonly expectedMaterialActivation: RouterAbMpcMaterialActivationRefWire;
+    readonly authorization: Parameters<RouterApiWalletRegistrationService['resolveActiveOwnerWalletExecutionLane']>[0]['authorization'];
+    readonly walletRegistration: Pick<RouterApiWalletRegistrationService, 'resolveActiveOwnerWalletExecutionLane'>;
+}): Promise<Response>;
+/** Forwards a Gateway-admitted rotatable lane source to the private Router. */
+export declare function proxyRotatableLaneAdmittedNormalSigningRequest(input: {
+    readonly request: Request;
+    readonly proxy: RouterAbNormalSigningRouterProxy | null | undefined;
+    readonly body: Record<string, unknown>;
+    readonly materialSource: Extract<RouterAbNormalSigningMaterialSourceV1, {
+        readonly kind: 'rotatable_lane';
+    }>;
+    readonly targetPath?: string;
+}): Promise<Response>;
+//# sourceMappingURL=normalSigningRouterProxy.d.ts.map

package/dist/types/wallet-server/src/router/transport/fetch/routes/passkeyCustody.d.ts

@@ -0,0 +1,66 @@
+import type { FetchRouterApiContext } from '../createFetchRouter';
+export declare function handlePasskeyCustody(ctx: FetchRouterApiContext): Promise<Response | null>;
+/** Issues one operation-bound Email OTP challenge without exposing authority metadata. */
+export declare function handleWalletCustodyEmailOtpChallenge(ctx: FetchRouterApiContext): Promise<Response | null>;
+/** Lists public passkey envelope identities with their sibling activity rows. */
+export declare function handleWalletCustodyCredentialsList(ctx: FetchRouterApiContext): Promise<Response | null>;
+/**
+ * Refactor 109C: binds a pre-109C custody envelope to the method that opened it.
+ *
+ * The exact operation credential names the auth method that opened the
+ * envelope. Unlock already proved that method, so finishing the ownership
+ * upgrade requires no second user assertion.
+ */
+export declare function handleWalletCustodyEnvelopeOwnershipUpgrade(ctx: FetchRouterApiContext): Promise<Response | null>;
+/** Renames one passkey credential; the label is metadata and never AAD. */
+export declare function handleWalletCustodyCredentialLabel(ctx: FetchRouterApiContext): Promise<Response | null>;
+/**
+ * Spending a recovery code.
+ *
+ * The refusal is one shape for every cause — unknown wallet, unknown code,
+ * spent code. The domain deliberately makes them indistinguishable so the
+ * route cannot be used to count how many of a user's ten codes remain, and
+ * this must not helpfully re-separate them on the way out.
+ */
+export declare function handleWalletRecoveryPrepare(ctx: FetchRouterApiContext): Promise<Response | null>;
+export declare function handleWalletRecoveryGoogleVerify(ctx: FetchRouterApiContext): Promise<Response | null>;
+export declare function handleWalletRecoveryEmailOtpVerify(ctx: FetchRouterApiContext): Promise<Response | null>;
+export declare function handleWalletRecoveryEmailOtpRelease(ctx: FetchRouterApiContext): Promise<Response | null>;
+/**
+ * Installs the Google/Email OTP recovery target selected by the persisted
+ * `otp_verified` attempt. Recovery identity and enrollment identifiers stay
+ * server-side; the body can add only a new-enrollment material bundle.
+ */
+export declare function handleWalletRecoveryGoogleEmailOtpFinalize(ctx: FetchRouterApiContext): Promise<Response | null>;
+/**
+ * Installing the credential a recovery enrolled.
+ *
+ * The envelope arrives sealed, but its complete wire shape is parsed here.
+ * The server has no seed and cannot open the ciphertext. Exact key coverage
+ * comes from its signer registry and durable activation receipts.
+ */
+export declare function handleWalletRecoveryFinalize(ctx: FetchRouterApiContext): Promise<Response | null>;
+export declare function handleWalletRecoveryBackupAcknowledge(ctx: FetchRouterApiContext): Promise<Response | null>;
+/**
+ * Rotating a wallet's recovery codes.
+ *
+ * The wraps pass through as opaque records — the server cannot check that
+ * they wrap the right KEK, because it has neither. What it does check is the
+ * set's shape, and it does so before writing: a set that reaches the store
+ * with the wrong number of wraps leaves a wallet holding fewer codes than its
+ * owner wrote down, and nothing surfaces that until someone counts.
+ */
+export declare function handleWalletRecoveryRotate(ctx: FetchRouterApiContext): Promise<Response | null>;
+export declare function handleWalletRecoveryRead(ctx: FetchRouterApiContext): Promise<Response | null>;
+/**
+ * Reporting recovery status to the wallet's owner.
+ *
+ * The wallet comes from the path. Origin binding keeps this count endpoint
+ * scoped to browser callers without exposing recovery identifiers.
+ *
+ * Counts only, never identifiers. Which codes remain is not something even
+ * the owner's browser needs, and a list would be one leak away from being
+ * useful to someone else.
+ */
+export declare function handleWalletRecoveryStatus(ctx: FetchRouterApiContext): Promise<Response | null>;
+//# sourceMappingURL=passkeyCustody.d.ts.map

package/dist/types/wallet-server/src/router/transport/fetch/routes/sessions.d.ts

@@ -0,0 +1,31 @@
+import type { FetchRouterApiContext } from '../createFetchRouter';
+import { type WalletUnlockEcdsaCustodySignerV1 } from '../../../domains/walletUnlock/walletUnlockRouteHandlers';
+import { parseRouterAbEcdsaPostRegistrationSessionActivationPolicyV1, type RouterAbEcdsaPostRegistrationSessionActivationRequestV1 } from '../../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
+export declare function handleHostedWalletSessionExchangeIssue(ctx: FetchRouterApiContext): Promise<Response | null>;
+export declare function handleHostedWalletSessionExchangeRedeem(ctx: FetchRouterApiContext): Promise<Response | null>;
+export type WalletUnlockEcdsaAuthoredRequest = {
+    readonly request: RouterAbEcdsaPostRegistrationSessionActivationRequestV1;
+    readonly activationReceipt: WalletUnlockEcdsaCustodySignerV1['activationReceipt'];
+    readonly continuity: {
+        readonly kind: 'wallet_custody_ecdsa_sync_continuity_v1';
+        readonly signers: readonly WalletUnlockEcdsaCustodySignerV1[];
+    };
+};
+export declare function authorWalletUnlockEcdsaRequest(ctx: FetchRouterApiContext, walletId: string, policy: ReturnType<typeof parseRouterAbEcdsaPostRegistrationSessionActivationPolicyV1>): Promise<{
+    readonly ok: true;
+    readonly value: WalletUnlockEcdsaAuthoredRequest;
+} | {
+    readonly ok: false;
+    readonly status: number;
+    readonly code: string;
+    readonly message: string;
+}>;
+export declare function handleExactWalletSessionStatus(ctx: FetchRouterApiContext): Promise<Response | null>;
+export declare function handleWalletUnlockChallenge(ctx: FetchRouterApiContext): Promise<Response | null>;
+export declare function handleWalletEmailOtpChallenge(ctx: FetchRouterApiContext): Promise<Response | null>;
+export declare function handleWalletEmailOtpFactorRelease(ctx: FetchRouterApiContext): Promise<Response | null>;
+export declare function handleWalletUnlockVerify(ctx: FetchRouterApiContext): Promise<Response | null>;
+export declare function handleWalletEmailOtpDevCleanupGoogleRegistration(ctx: FetchRouterApiContext): Promise<Response | null>;
+export declare function handleWalletEmailOtpRegistrationSeal(ctx: FetchRouterApiContext): Promise<Response | null>;
+export declare function handleWalletEmailOtpDevOutbox(ctx: FetchRouterApiContext): Promise<Response | null>;
+//# sourceMappingURL=sessions.d.ts.map

package/dist/types/wallet-server/src/router/transport/fetch/routes/syncAccount.d.ts

@@ -0,0 +1,3 @@
+import type { FetchRouterApiContext } from '../createFetchRouter';
+export declare function handleSyncAccount(ctx: FetchRouterApiContext): Promise<Response | null>;
+//# sourceMappingURL=syncAccount.d.ts.map

package/dist/types/wallet-server/src/router/transport/fetch/routes/syncAccountBootstrap.d.ts

@@ -0,0 +1,128 @@
+import type { PasskeyCustodyEnvelopeRecord } from '../../../../../../shared-ts/src/passkey-custody';
+import { type WalletSessionMintId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
+import { type WalletAuthMethodId, type WalletAuthorityId } from '../../../../../../shared-ts/src/utils/domainIds';
+import type { WalletAuthAuthority, WalletAuthAuthorityRef } from '../../../../../../shared-ts/src/utils/walletAuthAuthority';
+import type { ActiveWalletAuthorityV1 } from '../../../../../../shared-ts/src/authorization/walletAuthority';
+import { type WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import type { MpcWalletSigningQuotaId, WalletSessionId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
+import type { ActiveWalletSessionV1, WalletSessionOperationCredentialV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
+import type { RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
+import { type RouterAbEcdsaCredentialFreeSessionActivationResponseV1, type RouterAbEcdsaRegistrationActivationReceiptV1 } from '../../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
+import { type DirectV2IssueResult, type VerifiedOwnerProof } from '../../../../authorization/domain';
+import type { FetchRouterApiContext } from '../createFetchRouter';
+import type { WebAuthnSyncAccountVerificationResult } from '../../../../core/authService/webauthn';
+import type { WalletEcdsaSignerRecord } from '../../../../core/WalletStore';
+import type { RouterAbEd25519YaoActiveCapabilityDescriptorV1 } from '../../../domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery';
+export type VerifiedSyncAccountResultV1 = Extract<WebAuthnSyncAccountVerificationResult, {
+    readonly ok: true;
+    readonly verified: true;
+}>;
+type SyncAccountExactThresholdEd25519SessionV1 = {
+    readonly walletId: string;
+    readonly nearAccountId: string;
+    readonly nearEd25519SigningKeyId: string;
+    readonly thresholdSessionId: string;
+    readonly walletSessionId: WalletSessionId;
+    readonly quotaId: MpcWalletSigningQuotaId;
+    readonly expiresAtMs: number;
+    readonly remainingUses: number;
+    readonly runtimePolicyScope: RuntimePolicyScope;
+    readonly routerAbNormalSigning: {
+        readonly kind: 'router_ab_ed25519_normal_signing_v1';
+        readonly signingWorkerId: string;
+    };
+};
+type SyncAccountExactBootstrapBodyBaseV1 = {
+    readonly ok: true;
+    readonly verified: true;
+    readonly accountId: string;
+    readonly walletId: string;
+    readonly nearAccountId: string;
+    readonly nearEd25519SigningKeyId: string;
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly walletAuthorityId: WalletAuthorityId;
+    readonly foundingAuthority: ActiveWalletAuthorityV1;
+    readonly foundingAuthMethod: Extract<WalletAuthMethodRecordV2, {
+        readonly kind: 'passkey';
+        readonly status: 'active';
+    }>;
+    readonly custodyKeyManifestDigestB64u: VerifiedSyncAccountResultV1['custodyKeyManifestDigestB64u'];
+    readonly walletBinding: VerifiedSyncAccountResultV1['walletBinding'];
+    readonly rpId: string;
+    readonly signerSlot: number;
+    readonly publicKey: string;
+    readonly relayerKeyId: string;
+    readonly credentialIdB64u: string;
+    readonly credentialPublicKeyB64u: string;
+    readonly thresholdEd25519: {
+        readonly relayerKeyId: string;
+        readonly keyVersion: string;
+        readonly participantIds: readonly [number, number];
+        readonly session: SyncAccountExactThresholdEd25519SessionV1;
+    };
+    readonly walletSession: ActiveWalletSessionV1;
+    readonly operationCredential: WalletSessionOperationCredentialV1;
+    readonly ed25519YaoRecovery: {
+        readonly kind: 'router_ab_ed25519_yao_sync_recovery_v1';
+        readonly authorityRef: WalletAuthAuthorityRef;
+        readonly capability: RouterAbEd25519YaoActiveCapabilityDescriptorV1;
+    };
+    readonly walletCustody: {
+        readonly kind: 'wallet_custody_sync_bootstrap_v1';
+        readonly envelope: PasskeyCustodyEnvelopeRecord;
+        readonly storeVersion: string;
+    };
+    readonly ecdsaCustody: {
+        readonly kind: 'wallet_custody_ecdsa_sync_continuity_v1';
+        readonly signers: readonly Pick<WalletEcdsaSignerRecord, 'chainTarget' | 'walletKey' | 'activationReceipt' | 'runtimePolicyScope'>[];
+    };
+};
+export type SyncAccountExactBootstrapBodyV1 = SyncAccountExactBootstrapBodyBaseV1 & ({
+    readonly ecdsaSession?: never;
+    readonly ecdsaActivationReceipt?: never;
+} | {
+    readonly ecdsaSession: RouterAbEcdsaCredentialFreeSessionActivationResponseV1;
+    readonly ecdsaActivationReceipt: RouterAbEcdsaRegistrationActivationReceiptV1;
+});
+export type SyncAccountBootstrapInputV1 = {
+    readonly ctx: FetchRouterApiContext;
+    readonly result: VerifiedSyncAccountResultV1;
+    readonly authority: WalletAuthAuthority;
+    readonly activeAuthority: ActiveWalletAuthorityV1;
+    readonly foundingAuthMethod: Extract<WalletAuthMethodRecordV2, {
+        readonly kind: 'passkey';
+        readonly status: 'active';
+    }>;
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly authorityRef: WalletAuthAuthorityRef;
+    readonly proof: Extract<VerifiedOwnerProof, {
+        readonly purpose: 'wallet_session';
+    }>;
+    readonly mintId: WalletSessionMintId;
+    readonly issuedAtMs: number;
+    readonly ecdsaThresholdSessionId: string;
+    readonly custody: {
+        readonly kind: 'read_verified_factor';
+    } | {
+        readonly kind: 'provided';
+        readonly envelope: PasskeyCustodyEnvelopeRecord;
+        readonly storeVersion: string;
+    };
+};
+export type SyncAccountBootstrapResultV1 = {
+    readonly kind: 'ok';
+    readonly body: SyncAccountExactBootstrapBodyV1;
+} | {
+    readonly kind: 'already_committed';
+    readonly committed: Extract<DirectV2IssueResult, {
+        readonly kind: 'already_committed';
+    }>;
+} | {
+    readonly kind: 'error';
+    readonly code: string;
+    readonly message: string;
+    readonly status: number;
+};
+export declare function issueSyncAccountBootstrapV1(input: SyncAccountBootstrapInputV1): Promise<SyncAccountBootstrapResultV1>;
+export {};
+//# sourceMappingURL=syncAccountBootstrap.d.ts.map