@seams/wallet-server 0.7.1 → 0.8.0

package/dist/types/wallet-server/src/router/domains/passkeyCustody/passkeyCustodyEnvelopeRetrieval.d.ts

@@ -60,10 +60,8 @@ export type PasskeyCustodyEnvelopeRetrievalResult = {
     readonly kind: 'credential_mismatch';
 } | {
     readonly kind: 'retired';
-    readonly retiredAtMs: number;
 } | {
     readonly kind: 'revoked';
-    readonly revokedAtMs: number;
 } | {
     readonly kind: 'missing';
 } | {

package/dist/types/wallet-server/src/router/domains/passkeyCustody/walletCustodyRegistrationCommit.d.ts

@@ -1,5 +1,4 @@
 import { type WalletCustodyCeremonyCommitPayload } from '../../../../../shared-ts/src/passkey-custody';
-import { type WalletId } from '../../../../../shared-ts/src/utils/domainIds';
 export type { WalletCustodyCeremonyCommitPayload };
 import type { CloudflareD1WalletCustodyCommitStore, WalletCustodyRegistrationCommitResult } from '../../cloudflare/d1/passkeyCustody/d1WalletCustodyCommitStore';
 export type WalletCustodyRegistrationCommitOutcome = ({
@@ -8,7 +7,6 @@ export type WalletCustodyRegistrationCommitOutcome = ({
     kind: 'committed';
 }>, 'kind'>) | {
     readonly kind: 'already_exists';
-    readonly key: string;
 }
 /**
  * Another ceremony established this wallet's custody first. The route should
@@ -17,7 +15,6 @@ export type WalletCustodyRegistrationCommitOutcome = ({
  */
  | {
     readonly kind: 'custody_already_established';
-    readonly walletId: WalletId;
 } | {
     readonly kind: 'rejected';
     readonly reason: string;

package/dist/types/wallet-server/src/router/domains/passkeyCustody/walletRecoveryKeyManifest.d.ts

@@ -3,7 +3,6 @@ import type { EcdsaServerGeneration } from '../../../../../shared-ts/src/utils/e
 import type { RuntimePolicyScope } from '../../../../../shared-ts/src/threshold/signingRootScope';
 import type { WalletId } from '../../../../../shared-ts/src/utils/domainIds';
 import type { ThresholdEcdsaChainTarget } from '../../../core/thresholdEcdsaChainTarget';
-import type { RouterAbEd25519YaoApplicationBindingFactsV1, RouterAbEd25519YaoBytes32V1, RouterAbEd25519YaoLifecycleScopeV1 } from '../../../../../shared-ts/src/utils/routerAbEd25519Yao';
 import { type RouterAbEcdsaDerivationPublicCapabilityV1, type RouterAbEcdsaRegistrationActivationReceiptV1 } from '../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
 import { type WalletEcdsaSignerRecord, type WalletEd25519SignerRecord } from '../../../core/WalletStore';
 import type { D1WalletStore } from '../../../core/d1WalletStore';
@@ -11,6 +10,7 @@ import { type RecoveryCodeReservationId, type WalletRecoveryKeySetId } from '../
 import type { WalletRecoveryEcdsaPossessionChallengeV1 } from '../../../../../shared-ts/src/wallet-recovery/walletRecoveryEcdsaPossession';
 import { type WalletRecoveryEcdsaPossessionProofV1 } from '../../../../../shared-ts/src/wallet-recovery/walletRecoveryEcdsaPossession';
 import type { WalletAuthAuthorityRef } from '../../../../../shared-ts/src/utils/walletAuthAuthority';
+import type { WalletRecoveryPreparationNearRecoveryBasisV1 } from '../../../../../shared-ts/src/wallet-recovery/walletRecoveryPreparation';
 export type { WalletRecoveryKeySetId } from '../../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation';
 type WalletRecoveryKeyManifestEntryV1 = {
     readonly kind: 'near_ed25519';
@@ -79,18 +79,6 @@ type WalletRecoveryPreparationKeyManifestEntryV1 = {
     readonly recordedKeyManifestDigestB64u: string;
     readonly recoveryBasis: WalletRecoveryPreparationEcdsaRecoveryBasisV1;
 };
-type WalletRecoveryPreparationNearRecoveryBasisV1 = {
-    readonly capabilityKind: 'registration' | 'recovery';
-    readonly activeCapabilityBinding: RouterAbEd25519YaoBytes32V1;
-    readonly scope: RouterAbEd25519YaoLifecycleScopeV1;
-    readonly applicationBinding: RouterAbEd25519YaoApplicationBindingFactsV1;
-    readonly participantIds: readonly [number, number];
-    readonly registeredPublicKey: RouterAbEd25519YaoBytes32V1;
-    readonly runtimePolicyScope: RuntimePolicyScope;
-    readonly activationTranscript: RouterAbEd25519YaoBytes32V1;
-    readonly activationStateEpoch: number;
-    readonly signingWorkerVerifyingShare: RouterAbEd25519YaoBytes32V1;
-};
 type WalletRecoveryPreparationEcdsaRecoveryBasisV1 = {
     readonly publicCapability: RouterAbEcdsaDerivationPublicCapabilityV1;
     readonly activationReceipt: RouterAbEcdsaRegistrationActivationReceiptV1;

package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbEcdsaDerivationNormalSigningRoute.d.ts

@@ -1,9 +1,9 @@
-import type { EcdsaWalletSessionAdmission } from '../../../authorization/ecdsaWalletSessionAdmission';
+import type { EcdsaWalletSessionAdmissionInput, EcdsaWalletSessionPhaseAdmission } from '../../../authorization/ecdsaWalletSessionAdmission';
 import { type ThresholdEcdsaSessionInputs } from '../../auth/commonRouterUtils';
 import type { SessionAdapter } from '../../framework/routerApi';
 import { type RouterAbEcdsaDerivationEvmDigestSigningRequestV1Wire, type RouterAbEcdsaOperationStepUpPreparationV1Wire } from '../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
 import type { RuntimePolicyScope } from '../../../../../shared-ts/src/threshold/signingRootScope';
-import type { RouterApiAuthorizedOperationService, RouterApiAuthorizationSessionService, RouterApiWalletRegistrationService, RouterApiWalletSessionAuthorizationV2AdmissionContext, RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext } from '../../framework/authServicePort';
+import type { RouterApiAuthorizedOperationService, RouterApiAuthorizationSessionService, RouterApiWalletRegistrationService, RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext } from '../../framework/authServicePort';
 import { type AuthorizedOperation, type AuthorizedOperationReplayResponse, type OwnerOperationAuthorizationDecision, type SessionOrigin } from '../../../authorization/domain';
 import { type RouterAbMpcMaterialActivationRefWire } from '../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
 import { type AcceptedEcdsaRouteAdmission, type RouterAbEcdsaOperationAdmission, type RouterAbEcdsaOperationAdmissionKind, type RouterAbJsonRouteResult, type RouterAbNormalSigningAdmissionAdapter, type RouterAbNormalSigningRouteRuntime } from './routerAbNormalSigningAdmission';
@@ -88,21 +88,20 @@ export declare function resolveFreshRouterAbEcdsaMaterialActivation(input: {
 }>;
 type RouterAbEcdsaWalletSessionOperationBinding = {
     readonly kind: 'wallet_session_operation_credential_v1';
-    readonly context: RouterApiWalletSessionAuthorizationV2AdmissionContext;
+    readonly validated: Pick<RouterAbEcdsaV2WalletSessionValidationSuccess, 'admission'>;
 } | {
     readonly kind: 'wallet_session_operation_credential_exhausted_candidate_v1';
     readonly candidate: RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext;
 };
 export declare function admitRouterAbEcdsaReusableWalletSessionOperation(input: {
+    readonly phase: 'prepare' | 'finalize';
     request: RouterAbEcdsaOperationStepUpRequest;
-    materialActivation: RouterAbMpcMaterialActivationRefWire;
+    material: Pick<EcdsaWalletSessionAdmissionInput['material'], 'readSnapshot' | 'materialActivation' | 'keyHandle' | 'runtimePolicyScope'>;
     binding: RouterAbEcdsaWalletSessionOperationBinding;
-    authorizedOperations: Pick<RouterApiAuthorizedOperationService, 'tenantId' | 'admitEcdsaWalletSessionOperation'>;
-    resolveEcdsaMaterialActivation: RouterApiWalletRegistrationService['resolveEcdsaMaterialActivation'];
-}): Promise<{
+    authorizedOperations: Pick<RouterApiAuthorizedOperationService, 'tenantId' | 'admitEcdsaWalletSessionOperation' | 'resolveEcdsaWalletSessionOperation'>;
+}): Promise<({
     readonly ok: true;
-    readonly admission: EcdsaWalletSessionAdmission;
-} | {
+} & EcdsaWalletSessionPhaseAdmission) | {
     readonly ok: false;
     readonly error: RouterAbJsonRouteResult;
 }>;

package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbNormalSigningAdmission.d.ts

@@ -1,3 +1,4 @@
+import type { D1EcdsaAdmissionPolicyRead } from '../../cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore';
 import type { RouterAbNormalSigningAuthorizationIdentity } from '../../../core/routerAbSigning/RouterAbNormalSigningRuntime';
 import type { RouterAbNormalSigningRuntime } from '../../../core/routerAbSigning/RouterAbNormalSigningRuntime';
 import type { ThresholdEd25519AuthorityScope } from '../../../core/types';
@@ -277,8 +278,16 @@ export type RouterAbNormalSigningAdmissionFailure = {
 export type RouterAbNormalSigningAdmissionResult = {
     ok: true;
 } | RouterAbNormalSigningAdmissionFailure;
+type RouterAbNormalSigningPolicyReadSource = {
+    readonly kind: 'database';
+    readonly policyRead?: never;
+} | {
+    readonly kind: 'credential_snapshot';
+    readonly policyRead: D1EcdsaAdmissionPolicyRead;
+};
 export type RouterAbNormalSigningAdmissionInput = {
     curve: 'ed25519';
+    readonly policyReadSource?: never;
     authorityKind: 'wallet_authority_v1';
     authorityId: string;
     authorityScope?: never;
@@ -293,6 +302,7 @@ export type RouterAbNormalSigningAdmissionInput = {
     runtimePolicyScope: RuntimePolicyScope;
 } | {
     curve: 'ed25519';
+    readonly policyReadSource?: never;
     authorityKind?: never;
     authorityId?: never;
     phase: 'prepare' | 'finalize';
@@ -307,6 +317,7 @@ export type RouterAbNormalSigningAdmissionInput = {
     runtimePolicyScope: RuntimePolicyScope;
 } | {
     curve: 'ecdsa';
+    readonly policyReadSource: RouterAbNormalSigningPolicyReadSource;
     phase: 'prepare' | 'finalize';
     walletId: string;
     materialActivationId: MpcMaterialActivationId;
@@ -323,6 +334,7 @@ export interface RouterAbNormalSigningAdmissionAdapter {
 export type RouterAbNormalSigningAdmissionEvaluationInput = {
     adapter: RouterAbNormalSigningAdmissionAdapter | null | undefined;
     curve: 'ed25519';
+    readonly policyReadSource?: never;
     authorizationKind: 'wallet_session_operation_credential_v1';
     phase: 'prepare' | 'finalize';
     walletId: string;
@@ -337,6 +349,7 @@ export type RouterAbNormalSigningAdmissionEvaluationInput = {
 } | {
     adapter: RouterAbNormalSigningAdmissionAdapter | null | undefined;
     curve: 'ecdsa';
+    readonly policyReadSource: RouterAbNormalSigningPolicyReadSource;
     authorizationKind: 'wallet_session_operation_credential_v1';
     phase: 'prepare' | 'finalize';
     walletId: string;

package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbOperationStepUp.d.ts

@@ -9,6 +9,7 @@ import { type RouterAbMpcMaterialActivationRefWire } from '../../../../../shared
 import type { Ed25519OperationKind } from './ed25519AuthorizedOperationReceipt';
 import { type WalletAuthMethodId } from '../../../../../shared-ts/src/utils/domainIds';
 import { type RouterAbJsonRouteResult } from './routerAbNormalSigningAdmission';
+import type { ReadonlyExclusiveUnion } from '../../../../../shared-ts/src/utils/variant';
 export type ActiveEd25519MaterialActivation = Extract<Awaited<ReturnType<RouterApiWalletRegistrationService['resolveEd25519MaterialActivation']>>, {
     readonly ok: true;
 }>;
@@ -64,17 +65,15 @@ type RouterAbExactOperationStepUpIdentityInput = {
     readonly requestExpiresAtMs: number;
     readonly authorizedOperations: RouterApiAuthorizedOperationService | null | undefined;
     readonly authorizationSessions: RouterApiAuthorizationSessionService | null | undefined;
-} & ({
+} & ReadonlyExclusiveUnion<{
     readonly keyFamily: 'ed25519';
     readonly operationKind: Ed25519OperationKind;
     readonly resolveEd25519MaterialActivation: RouterApiWalletRegistrationService['resolveEd25519MaterialActivation'];
-    readonly resolveEcdsaMaterialActivation?: never;
 } | {
     readonly keyFamily: 'ecdsa_secp256k1';
     readonly operationKind: 'evm.sign_transaction' | 'evm.export_key';
-    readonly resolveEd25519MaterialActivation?: never;
     readonly resolveEcdsaMaterialActivation: RouterApiWalletRegistrationService['resolveEcdsaMaterialActivation'];
-});
+}>;
 type RouterAbVerifiedOwnerOperationStepUpIdentityInput = {
     readonly kind: 'verified_owner_proof';
     readonly headers: Record<string, string | string[] | undefined>;

package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbPrivateSigningWorker.d.ts

@@ -1,11 +1,12 @@
 import type { RouterAbSigningWorkerPrivateTransport } from '../../../core/routerAbSigning/RouterAbNormalSigningRuntime';
 import { type RouterAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestV1Wire, type RouterAbEcdsaDerivationEvmDigestSigningRequestV1Wire, type RouterAbPublicDigest32V1Wire } from '../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
 import type { RuntimePolicyScope } from '../../../../../shared-ts/src/threshold/signingRootScope';
-import type { SigningWorkerLaneMaterialIdentityV1 } from '../../../core/signingLanes/signingWorkerLaneMaterialIdentity';
 import type { AuthorizedOperationReplayResponse } from '../../../authorization/domain';
+import type { RouterAbNormalSigningAuthorizationWire } from '../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
 import type { MpcMaterialActivationId } from '../../../../../shared-ts/src/utils/domainIds';
 import { type RouterAbSigningWorkerJsonResult } from './routerAbNormalSigningAdmission';
 import type { RouterAbOperationStepUpWalletSession } from './routerAbOperationStepUp';
+import type { ReadonlyExclusiveUnion } from '../../../../../shared-ts/src/utils/variant';
 declare const PRIVATE_ED25519_SIGNING_PREPARE_PATH = "/router-ab/signing-worker/sign/prepare";
 declare const PRIVATE_ED25519_SIGNING_FINALIZE_PATH = "/router-ab/signing-worker/sign";
 declare const PRIVATE_ECDSA_DERIVATION_SIGNING_PREPARE_PATH = "/router-ab/signing-worker/ecdsa-derivation/sign/prepare";
@@ -23,14 +24,7 @@ export declare const ROUTER_AB_ECDSA_DERIVATION_PRIVATE_SIGNING_PATHS: {
 type RouterAbConfiguredSigningWorkerPrivateTransport = Extract<RouterAbSigningWorkerPrivateTransport, {
     readonly kind: 'configured';
 }>;
-export type RouterAbEd25519NormalSigningAuthorizationV2 = {
-    readonly kind: 'reusable_wallet_session';
-    readonly wallet_session_id: string;
-} | {
-    readonly kind: 'operation_step_up';
-    readonly evidence_set_digest?: never;
-    readonly wallet_session_id?: never;
-};
+export type RouterAbEd25519NormalSigningAuthorizationV2 = RouterAbNormalSigningAuthorizationWire;
 type RouterAbMpcMaterialActivationRefV1 = {
     readonly kind: 'mpc_material_activation_ref';
     readonly activation_id: MpcMaterialActivationId;
@@ -56,26 +50,22 @@ type RouterAbPrivateSigningAuthorization = {
     readonly kind: 'operation_step_up';
     readonly session: RouterAbOperationStepUpWalletSession;
 };
-type RouterAbOwnerAdmissionAuthV1 = {
+type RouterAbOwnerAdmissionAuthV1 = ReadonlyExclusiveUnion<{
     readonly auth: 'owner_wallet_session';
     readonly subject_id: string;
     readonly wallet_session_id: string;
-    readonly authorization_session_id?: never;
 } | {
     readonly auth: 'owner_operation_step_up';
     readonly subject_id: string;
     readonly authorization_session_id: string;
-    readonly wallet_session_id?: never;
-};
-type RouterAbNormalSigningPrivateAuthorizationV2 = {
+}>;
+type RouterAbNormalSigningPrivateAuthorizationV2 = ReadonlyExclusiveUnion<{
     readonly kind: 'reusable_wallet_session';
     readonly wallet_session_id: string;
-    readonly authorization_session_id?: never;
 } | {
     readonly kind: 'operation_step_up';
     readonly authorization_session_id: string;
-    readonly wallet_session_id?: never;
-};
+}>;
 type RouterAbNormalSigningTrustedMetadataV1 = {
     readonly org_id: string;
     readonly project_id: string;
@@ -155,20 +145,7 @@ export type RouterAbNormalSigningMaterialSourceV1 = {
         readonly material_activation_id: string;
         readonly signing_worker_id: string;
     };
-    readonly group_public_key?: never;
-} | {
-    readonly kind: 'rotatable_lane';
-    readonly lookup: {
-        readonly identity: SigningWorkerLaneMaterialIdentityV1;
-        readonly admittedLaneIdentityDigestB64u: string;
-    };
-    readonly group_public_key: string;
 };
-export declare function routerAbNormalSigningMaterialSourceFromActiveLaneV1(input: {
-    readonly identity: SigningWorkerLaneMaterialIdentityV1;
-    readonly admittedLaneIdentityDigestB64u: string;
-    readonly groupPublicKey: string;
-}): RouterAbNormalSigningMaterialSourceV1;
 export declare function replayResponseFromSigningWorkerResult(result: RouterAbSigningWorkerJsonResult): AuthorizedOperationReplayResponse;
 export declare function isRouterAbEcdsaSigningWorkerOperationInProgress(result: RouterAbSigningWorkerJsonResult): boolean;
 export declare function parseRouterAbEd25519NormalSigningScopeV2(value: unknown): RouterAbEd25519NormalSigningScopeV2;
@@ -186,7 +163,6 @@ type RouterAbEd25519PrivateSigningWorkerBuildInput = {
     readonly body: Record<string, unknown>;
     readonly authorization: RouterAbPrivateSigningAuthorization;
     readonly headers: Record<string, string | string[] | undefined>;
-    readonly materialSource?: RouterAbNormalSigningMaterialSourceV1;
     readonly effectClaim?: never;
 } | {
     readonly phase: 'finalize';
@@ -194,7 +170,6 @@ type RouterAbEd25519PrivateSigningWorkerBuildInput = {
     readonly authorization: RouterAbPrivateSigningAuthorization;
     readonly headers: Record<string, string | string[] | undefined>;
     readonly effectClaim: RouterAbNormalSigningEffectClaimV1;
-    readonly materialSource?: RouterAbNormalSigningMaterialSourceV1;
 };
 export declare function buildRouterAbEd25519PrivateSigningWorkerBody(input: RouterAbEd25519PrivateSigningWorkerBuildInput): Promise<RouterAbEd25519PrivateSigningWorkerBody>;
 export declare function buildRouterAbEcdsaDerivationPrivateSigningWorkerBody(input: {
@@ -202,7 +177,6 @@ export declare function buildRouterAbEcdsaDerivationPrivateSigningWorkerBody(inp
     body: Record<string, unknown>;
     authorization: RouterAbPrivateSigningAuthorization;
     headers: Record<string, string | string[] | undefined>;
-    materialSource?: RouterAbNormalSigningMaterialSourceV1;
 }): Promise<RouterAbEcdsaDerivationPrivateSigningWorkerBody>;
 export type RouterAbEcdsaOperationStepUpRequest = RouterAbEcdsaDerivationEvmDigestSigningRequestV1Wire | RouterAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestV1Wire;
 export declare function postRouterAbSigningWorkerJson(input: {

package/dist/types/wallet-server/src/router/domains/signingOperations/walletExecutionAdmission.d.ts

@@ -1,7 +1,7 @@
 import { EVM_ECDSA_MPC_OPERATION_KINDS, NEAR_ED25519_MPC_OPERATION_KINDS } from '../../../../../shared-ts/src/authorization/capabilityKinds';
 import { type LaneParticipantBindingDigestB64u, type PreparedOwnerWalletExecution, type SigningLaneRecord, type WalletKeyRecord } from '../../../../../shared-ts/src/signing-lanes';
 import { type DigestB64u } from '../../../../../shared-ts/src/utils/canonicalPrimitives';
-import { type MpcMaterialActivationRef, type WalletAuthorityId, type WalletId, type WalletKeyId } from '../../../../../shared-ts/src/utils/domainIds';
+import { type MpcMaterialActivationRef, type WalletId, type WalletKeyId } from '../../../../../shared-ts/src/utils/domainIds';
 import type { ActiveWalletAuthorityV1 } from '../../../../../shared-ts/src/authorization/walletAuthority';
 import type { ExactAdministeredEcdsaSignerV1, ExactAdministeredEd25519SignerV1 } from '../../../../../shared-ts/src/device-linking/delegatedActivationPlan';
 import type { WalletAuthMethodRecordV2 } from '../../../../../shared-ts/src/utils/walletAuthMethodRecord';
@@ -68,7 +68,6 @@ export type WalletSessionAuthorizationV2AdmissionResult = ({
 export type WalletSessionAuthorizationV2AdministrationAdmissionResult = {
     readonly ok: true;
     readonly operationKind: 'link_devices';
-    readonly authorityId: WalletAuthorityId;
 } | {
     readonly ok: false;
     readonly error: WalletSessionAuthorizationV2AdmissionError;

package/dist/types/wallet-server/src/router/domains/syncAccount/syncAccountRequestValidation.d.ts

@@ -1,14 +1,9 @@
-import type { WebAuthnAuthenticationCredential } from '../../../core/types';
+import type { PasskeyVerifyRequest } from '../../auth/authRequestValidation';
 type SyncAccountOptionsRequest = {
     rp_id: string;
     account_id?: string;
     ttl_ms?: number;
 };
-type SyncAccountVerifyRequest = {
-    challengeId: string;
-    webauthn_authentication: WebAuthnAuthenticationCredential;
-    expected_origin: string;
-};
 type SyncAccountRouteErrorBody = {
     ok: false;
     code: 'invalid_body';
@@ -26,6 +21,6 @@ export declare function parseSyncAccountOptionsRequest(raw: unknown): SyncAccoun
 export declare function parseSyncAccountVerifyRequest(input: {
     body: unknown;
     origin: unknown;
-}): SyncAccountRouteParseResult<SyncAccountVerifyRequest>;
+}): SyncAccountRouteParseResult<PasskeyVerifyRequest>;
 export {};
 //# sourceMappingURL=syncAccountRequestValidation.d.ts.map

package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationInputs.d.ts

@@ -6,6 +6,7 @@ import type { WalletRegistrationAuthorityInput, WalletRegistrationFinalizeSigner
 import type { ThresholdRuntimePolicyScope } from '../../../core/types';
 import type { WalletRegistrationSetupMinter, WalletRegistrationSetupVerifier } from './walletRegistrationSetupPayload';
 export type WalletRegistrationSetupRequest = {
+    readonly registrationOperationId: string;
     readonly wallet?: RegisterWalletInput;
     readonly signerSelection: RegistrationSignerSetSelection;
     readonly authMethod: RegistrationAuthMethodInput;

package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationReservation.d.ts

@@ -0,0 +1,51 @@
+import { type DeviceId } from '../../../../../shared-ts/src/authorization/capabilityKinds';
+import { type WalletAuthorityId, type WalletAuthMethodId, type WalletId } from '../../../../../shared-ts/src/utils/domainIds';
+import type { WalletRegistrationSetupInput } from './walletRegistrationInputs';
+export type WalletRegistrationSetupReservation = {
+    readonly walletId: WalletId;
+    readonly ceremonyId: string;
+    readonly preparationId: string;
+    readonly walletAuthorityId: WalletAuthorityId;
+    readonly deviceId: DeviceId;
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly reservedAtMs: number;
+};
+export type WalletRegistrationSetupReservationResult = {
+    readonly ok: true;
+    readonly reservation: WalletRegistrationSetupReservation;
+    readonly lifecycle: 'reserved' | 'established';
+    readonly code?: never;
+    readonly message?: never;
+} | {
+    readonly ok: false;
+    readonly code: string;
+    readonly message: string;
+    readonly reservation?: never;
+    readonly lifecycle?: never;
+};
+type ReservationOutcome = {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly code: string;
+    readonly message: string;
+};
+export interface WalletRegistrationReservationAuthority {
+    reserve(input: WalletRegistrationSetupInput): Promise<WalletRegistrationSetupReservationResult>;
+    admitHome(input: {
+        readonly ceremonyId: string;
+        readonly walletId: WalletId;
+    }): Promise<ReservationOutcome>;
+    complete(input: {
+        readonly ceremonyId: string;
+        readonly walletId: WalletId;
+        readonly outcome: 'established' | 'cancelled';
+    }): Promise<ReservationOutcome>;
+}
+export declare function parseWalletRegistrationSetupReservation(raw: unknown): WalletRegistrationSetupReservation;
+export declare function proposeWalletRegistrationSetup(input: WalletRegistrationSetupInput): WalletRegistrationSetupReservation;
+export declare function walletRegistrationSetupRequestDigest(namespace: string, input: WalletRegistrationSetupInput): Promise<string>;
+export declare function completeRegistrationReservation(authority: WalletRegistrationReservationAuthority | null, input: Parameters<WalletRegistrationReservationAuthority['complete']>[0]): Promise<ReservationOutcome>;
+export declare function admitRegistrationReservationHome(authority: WalletRegistrationReservationAuthority | null, input: Parameters<WalletRegistrationReservationAuthority['admitHome']>[0]): Promise<ReservationOutcome>;
+export {};
+//# sourceMappingURL=walletRegistrationReservation.d.ts.map

package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationRoutes.d.ts

@@ -1,4 +1,4 @@
-import type { WalletRegistrationNearProvisioningResponseV2, WalletRegistrationNearAdmissionResponseV2, WalletRegistrationActivateRouteResponseV2, WalletRegistrationRespondResponseV2, WalletRegistrationSetupResponseV2 } from '../../../core/threeRouteRegistrationContracts';
+import type { WalletRegistrationNearProvisioningResponseV2, WalletRegistrationNearAdmissionResponseV2, WalletRegistrationActivateRouteResponseV2, WalletRegistrationRespondResponseV2 } from '../../../core/threeRouteRegistrationContracts';
 import type { RouterApiPublishableKeyAuthAdapter } from '../../framework/routerApi';
 import type { RouterApiAuthorizationSessionService, RouterApiWalletRegistrationRouteService } from '../../framework/authServicePort';
 import type { FundImplicitNearAccountResult } from '../../../core/types';
@@ -33,15 +33,7 @@ type RouterApiWalletRegistrationInput = {
     signingSessionSeal?: SigningSessionSealRoutesOptions | null;
 };
 export declare function handleRouterApiWalletAddSignerIntent(input: RouterApiWalletRegistrationInput): Promise<RouteResponse<CreateAddSignerIntentResponse | RouteErrorBody>>;
-/**
- * `POST /wallets/register/setup` — the single admitted entry point that
- * replaces the bootstrap grant, the intent, and start.
- *
- * Authentication is the same API-credential plane the intent route used, so
- * origin and environment binding are unchanged; what is gone is the stored
- * grant that used to sit between the check and its only reader.
- */
-export declare function handleRouterApiWalletRegistrationSetup(input: RouterApiWalletRegistrationInput): Promise<RouteResponse<WalletRegistrationSetupResponseV2 | RouteErrorBody>>;
+export declare function handleRouterApiWalletRegistrationSetup(input: RouterApiWalletRegistrationInput): Promise<RouteResponse>;
 /**
  * `POST /wallets/register/respond` — the authenticated leg.
  *

package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationSetupPayload.d.ts

@@ -1,8 +1,8 @@
 /**
  * The opaque payload `/wallets/register/setup` mints and routes 2 and 3 verify.
  *
- * Setup admits the application, allocates the wallet, and runs the Router
- * preparation in one request. Routes 2 and 3 then need to know that the
+ * Setup admits the application, reserves the wallet, and persists the initial
+ * preparation facts in one request. Routes 2 and 3 then need to know that the
  * ceremony they are being driven with is the one setup admitted, and with the
  * parameters setup admitted — without paying another storage round trip to
  * find out. The client carries this string and never parses it.

package/dist/types/wallet-server/src/router/framework/apiCredentialPorts.d.ts

@@ -1,6 +1,7 @@
+import type { RouterApiKeyAuthFailureCode } from '../../../../shared-ts/src/utils/routerApiKeyAuth';
 export declare const ROUTER_API_CREDENTIAL_SCOPES: readonly ["accounts.create", "wallets.read", "wallets.auth_methods.create", "wallets.signers.create"];
 export type RouterApiCredentialScope = (typeof ROUTER_API_CREDENTIAL_SCOPES)[number];
-export type RouterApiKeyAuthFailureCode = 'secret_key_missing' | 'secret_key_invalid' | 'secret_key_revoked' | 'secret_key_forbidden_scope' | 'secret_key_ip_blocked' | 'secret_key_environment_mismatch';
+export type { RouterApiKeyAuthFailureCode };
 export interface RouterApiKeyAuthRequest {
     secret: string;
     endpoint: string;
@@ -56,6 +57,7 @@ export interface RouterApiUsageMeterEvent {
     action: RouterApiUsageMeterAction;
     succeeded: boolean;
     occurredAt?: string;
+    /** Producer-owned idempotency key; replays with the same id must not double-count. */
     sourceEventId?: string;
 }
 export interface RouterApiUsageMeterAdapter {

package/dist/types/wallet-server/src/router/framework/authServicePort.d.ts

@@ -1,8 +1,12 @@
+import type { RouteResponse } from './routeExecutionContext';
+import type { D1EcdsaAdmissionPolicyRead } from '../cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore';
+import type { EcdsaMaterialRead, EcdsaMaterialActivationReadInput } from '../../core/d1EcdsaSignerRead';
+import type { EcdsaMaterialReadSnapshot } from '../../core/ecdsaMaterialReadSnapshot';
 import type { DigestB64u } from '../../../../shared-ts/src/utils/canonicalPrimitives';
 import type { TenantRootIdentityV1 } from '../../../../shared-ts/src/tenant-root/tenantRootIdentity';
 import type { AddAuthMethodIntentCallerV1, AddAuthMethodIntentGrant } from '../../../../shared-ts/src/utils/registrationIntent';
 import type { ActiveEmailOtpWalletAuthMethodRecordV2, ActivePasskeyWalletAuthMethodRecordV2, ActiveWalletAuthMethodRecordV2 } from '../../../../shared-ts/src/utils/walletAuthMethodRecord';
-import type { WalletRegistrationNearProvisioningResponseV2, WalletRegistrationNearAdmissionResponseV2, WalletRegistrationActivateResponseV2, WalletRegistrationRespondResponseV2, WalletRegistrationSetupResponseV2 } from '../../core/threeRouteRegistrationContracts';
+import type { WalletRegistrationNearProvisioningResponseV2, WalletRegistrationNearAdmissionResponseV2, WalletRegistrationActivateResponseV2, WalletRegistrationRespondResponseV2 } from '../../core/threeRouteRegistrationContracts';
 import type { WalletRegistrationNearProvisioningInput, WalletRegistrationNearAdmissionInput, WalletRegistrationActivateInput, WalletRegistrationRespondInput, WalletRegistrationSetupInput } from '../domains/walletRegistration/walletRegistrationInputs';
 import type { WalletEmailOtpAction } from '../../../../shared-ts/src/utils/emailOtpDomain';
 import type { MpcMaterialActivationRef, OrgId, ProviderSubject, WalletAuthMethodId, WalletAuthorityId, WalletId, WebAuthnCredentialIdB64u, WebAuthnRpId } from '../../../../shared-ts/src/utils/domainIds';
@@ -16,7 +20,6 @@ import type { WalletExecutionLaneAuthSource, WalletExecutionLaneProjectionResult
 import type { RouterAbMpcMaterialActivationRefWire } from '../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
 import type { EmailOtpChannel, EmailOtpChallengeOperation, EmailOtpWalletEnrollmentRecord } from '../../core/EmailOtpStores';
 import type { LinkIdentityResult, UnlinkIdentityResult } from '../../core/IdentityStore';
-import type { NearPublicKeyAuthBinding, NearPublicKeyKind } from '../../core/NearPublicKeyStore';
 import type { ResolvedEd25519WalletBinding } from '../../core/authService/webauthnWalletBinding';
 import type { RouterAbEcdsaPresignRuntime } from '../../core/routerAbSigning/RouterAbEcdsaPresignRuntime';
 import type { DeviceLinkingRouteServiceV1 } from '../transport/fetch/routes/deviceLinking';
@@ -96,6 +99,19 @@ export type RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext = {
     readonly authMethod: ActiveWalletAuthMethodRecordV2;
     readonly retiredAtMs: null;
 };
+export type RouterApiWalletSessionSigningCandidate = {
+    readonly kind: 'active';
+    readonly materialRead: EcdsaMaterialRead;
+    readonly policyRead: D1EcdsaAdmissionPolicyRead;
+    readonly context: RouterApiWalletSessionAuthorizationV2AdmissionContext;
+    readonly candidate?: never;
+} | {
+    readonly kind: 'exhausted';
+    readonly materialRead: EcdsaMaterialRead;
+    readonly policyRead: D1EcdsaAdmissionPolicyRead;
+    readonly candidate: RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext;
+    readonly context?: never;
+};
 type RouterApiHostedWalletSessionAuthorizationV2AdmissionContext = RouterApiWalletSessionAuthorizationV2AdmissionContext & {
     readonly hostedCredentialId: HostedWalletSessionCredentialId;
     readonly appOrigin: SessionOrigin;
@@ -333,6 +349,17 @@ type GoogleEmailOtpResolutionResult = {
     readonly registrationAttemptId: string;
     readonly expiresAtMs: number;
     readonly offer: GoogleEmailOtpRegistrationOffer;
+} | {
+    readonly ok: false;
+    readonly mode: 'wallet_identity_mismatch';
+    readonly code: 'wallet_identity_mismatch';
+    readonly walletId: string;
+    readonly providerSubject: string;
+    readonly message: string;
+    readonly offer?: never;
+    readonly registrationAttemptId?: never;
+    readonly expiresAtMs?: never;
+    readonly hasEmailOtpEnrollment?: never;
 } | {
     readonly ok: false;
     readonly mode: 'wallet_id_collision' | 'registration_incomplete' | 'stale_identity_mapping';
@@ -587,24 +614,6 @@ type RouterApiMethodTypes = {
             readonly message?: string;
         };
     };
-    listNearPublicKeysForUser: {
-        readonly input: {
-            readonly userId: string;
-        };
-        readonly result: {
-            readonly ok: boolean;
-            readonly code?: string;
-            readonly message?: string;
-            readonly keys?: Array<{
-                readonly publicKey: string;
-                readonly kind: NearPublicKeyKind;
-                readonly signerSlot?: number;
-                readonly createdAtMs?: number;
-                readonly updatedAtMs?: number;
-                readonly authBinding?: NearPublicKeyAuthBinding;
-            }>;
-        };
-    };
     listWalletEcdsaKeyFactsInventory: {
         readonly input: {
             readonly walletId: string;
@@ -720,17 +729,6 @@ type RouterApiMethodTypes = {
         };
         readonly result: GoogleEmailOtpResolutionResult;
     };
-    resolveOidcWalletId: {
-        readonly input: {
-            readonly providerSubject?: string;
-            readonly sub?: string;
-            readonly email?: string;
-            readonly accountMode?: unknown;
-            readonly runtimePolicyScope?: ThresholdRuntimePolicyScope;
-            readonly restartRegistrationOffer?: unknown;
-        };
-        readonly result: string;
-    };
     revokeWalletAuthMethodWithFreshProof: {
         readonly input: RevokeWalletAuthMethodWithFreshProofCommand;
         readonly result: RevokeWalletAuthMethodWithFreshProofResult;
@@ -993,11 +991,9 @@ export interface RouterApiWalletRegistrationService {
         readonly code: 'not_found' | 'invalid_state' | 'internal';
         readonly message: string;
     }>;
-    resolveEcdsaMaterialActivation(input: {
-        readonly walletId: string;
-        readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
-    }): Promise<{
+    resolveEcdsaMaterialActivation(input: EcdsaMaterialActivationReadInput): Promise<{
         readonly ok: true;
+        readonly readSnapshot: EcdsaMaterialReadSnapshot;
         readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
         readonly keyHandle: string;
         readonly relayerKeyId: string;
@@ -1024,7 +1020,7 @@ export interface RouterApiWalletRegistrationService {
     }>;
     listWalletEcdsaKeyFactsInventory(input: RouterApiMethodTypes['listWalletEcdsaKeyFactsInventory']['input']): Promise<RouterApiMethodTypes['listWalletEcdsaKeyFactsInventory']['result']>;
     readActiveEmailOtpEnrollment(input: RouterApiMethodTypes['readActiveEmailOtpEnrollment']['input']): Promise<RouterApiMethodTypes['readActiveEmailOtpEnrollment']['result']>;
-    setupWalletRegistration(input: WalletRegistrationSetupInput): Promise<WalletRegistrationSetupResponseV2>;
+    setupWalletRegistration(input: WalletRegistrationSetupInput): Promise<RouteResponse>;
     respondWalletRegistration(input: WalletRegistrationRespondInput, traceContext?: RouterAbTraceContextV1, serverTiming?: Array<readonly [string, number]>): Promise<WalletRegistrationRespondResponseV2>;
     authorizeWalletRegistrationNearAdmission(input: WalletRegistrationNearAdmissionInput): Promise<WalletRegistrationNearAdmissionResponseV2>;
     activateWalletRegistration(input: WalletRegistrationActivateInput, traceContext?: RouterAbTraceContextV1, serverTiming?: Array<readonly [string, number]>): Promise<WalletRegistrationActivateResponseV2>;
@@ -1258,7 +1254,6 @@ export interface RouterApiIdentityService {
     linkIdentity(input: RouterApiMethodTypes['linkIdentity']['input']): Promise<RouterApiMethodTypes['linkIdentity']['result']>;
     listIdentities(input: RouterApiMethodTypes['listIdentities']['input']): Promise<RouterApiMethodTypes['listIdentities']['result']>;
     resolveGoogleEmailOtpSession(input: RouterApiMethodTypes['resolveGoogleEmailOtpSession']['input']): Promise<RouterApiMethodTypes['resolveGoogleEmailOtpSession']['result']>;
-    resolveOidcWalletId(input: RouterApiMethodTypes['resolveOidcWalletId']['input']): Promise<RouterApiMethodTypes['resolveOidcWalletId']['result']>;
     unlinkIdentity(input: RouterApiMethodTypes['unlinkIdentity']['input']): Promise<RouterApiMethodTypes['unlinkIdentity']['result']>;
     verifyGoogleLogin(input: RouterApiMethodTypes['verifyGoogleLogin']['input']): Promise<RouterApiMethodTypes['verifyGoogleLogin']['result']>;
     verifyGithubOAuthCode(input: RouterApiMethodTypes['verifyGithubOAuthCode']['input']): Promise<RouterApiMethodTypes['verifyGithubOAuthCode']['result']>;
@@ -1273,7 +1268,6 @@ export interface RouterApiWebAuthnService {
 }
 interface RouterApiNearFundingService {
     fundImplicitNearAccount(input: FundImplicitNearAccountRequest): Promise<FundImplicitNearAccountResult>;
-    listNearPublicKeysForUser(input: RouterApiMethodTypes['listNearPublicKeysForUser']['input']): Promise<RouterApiMethodTypes['listNearPublicKeysForUser']['result']>;
 }
 interface RouterApiRouterAccountService {
     getConfiguredRelayerAccount(): string;
@@ -1312,6 +1306,7 @@ export interface RouterApiServiceBag {
     deviceLinkingOwnerAuthorization?: DeviceLinkingOwnerAuthorizationRouteServiceV1;
 }
 export interface RouterApiAuthorizedOperationService {
+    resolveEcdsaWalletSessionOperation(input: import('../../authorization/ecdsaWalletSessionAdmission').EcdsaWalletSessionAdmissionInput): Promise<import('../../authorization/ecdsaWalletSessionAdmission').EcdsaWalletSessionResolutionResult>;
     admitEcdsaWalletSessionOperation(input: import('../../authorization/ecdsaWalletSessionAdmission').EcdsaWalletSessionAdmissionInput): Promise<import('../../authorization/ecdsaWalletSessionAdmission').EcdsaWalletSessionAdmissionResult>;
     readonly tenantId: TenantId;
     readPinnedOwnerWalletScope(input: {
@@ -1369,6 +1364,12 @@ export interface RouterApiAuthorizationSessionService {
         readonly token: string;
         readonly nowMs: number;
     }) => Promise<RouterApiWalletSessionAuthorizationV2AdmissionContext | null>;
+    readonly readWalletSessionSigningCandidateByOperationCredential: (input: {
+        readonly tenantId: TenantId;
+        readonly token: string;
+        readonly nowMs: number;
+        readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
+    }) => Promise<RouterApiWalletSessionSigningCandidate | null>;
     readonly readWalletSessionExactOperationContextByCredential: (input: {
         readonly tenantId: TenantId;
         readonly token: string;

package/dist/types/wallet-server/src/router/framework/googleLoginResolution.typecheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=googleLoginResolution.typecheck.d.ts.map

package/dist/types/wallet-server/src/router/framework/http.d.ts

@@ -1,5 +1,6 @@
 import type { RouterApiOptions } from './routerApi';
 export declare function json(body: unknown, init?: ResponseInit, extraHeaders?: Record<string, string>): Response;
+export declare function jsonFailure(status: number, code: string, message: string): Response;
 export declare function withCors(headers: Headers, opts?: RouterApiOptions, request?: Request): void;
 export declare function toResponse(out: {
     status: number;