@seams/wallet-server 0.7.1 → 0.8.0

package/dist/types/wallet-server/src/router/framework/registrationSetupDispatch.d.ts

@@ -0,0 +1,13 @@
+import type { WalletRegistrationSetupInput } from '../domains/walletRegistration/walletRegistrationInputs';
+import type { WalletRegistrationSetupResponseV2 } from '../../core/threeRouteRegistrationContracts';
+import type { RouteResponse } from './routeExecutionContext';
+export interface WalletRegistrationSetupDispatcher {
+    dispatch(input: WalletRegistrationSetupInput): Promise<RouteResponse | null>;
+}
+export declare function dispatchWalletRegistrationSetup(context: {
+    readonly dispatcher: WalletRegistrationSetupDispatcher | null;
+    readonly local: {
+        setupWalletRegistration(input: WalletRegistrationSetupInput): Promise<WalletRegistrationSetupResponseV2>;
+    };
+}, input: WalletRegistrationSetupInput): Promise<RouteResponse>;
+//# sourceMappingURL=registrationSetupDispatch.d.ts.map

package/dist/types/wallet-server/src/router/framework/ror/normalize.d.ts

@@ -1,14 +1,6 @@
-import { type SigningSessionSealProtocol } from '../../../../../shared-ts/src/utils/signingSessionSeal';
+import { type WellKnownSigningSessionSealCapabilities } from '../../../../../shared-ts/src/utils/signingSessionSeal';
 export declare function normalizeCsv(valuesRaw: unknown): string[];
 export declare function sanitizeRorOrigins(origins: unknown): string[];
 export declare function normalizeRorHost(hostRaw: unknown): string | null;
-type WellKnownSigningSessionSealCapabilities = {
-    mode: 'none';
-} | {
-    mode: 'sealed_refresh_v1';
-    protocol: SigningSessionSealProtocol;
-    currentKeyVersion: string;
-};
 export declare function resolveWellKnownSigningSessionSealCapabilities(signingSessionSealOptionsRaw: unknown): WellKnownSigningSessionSealCapabilities;
-export {};
 //# sourceMappingURL=normalize.d.ts.map

package/dist/types/wallet-server/src/router/transport/fetch/routes/deviceLinking.d.ts

@@ -14,7 +14,7 @@ import { type LinkDeviceSessionId } from '../../../../../../shared-ts/src/signin
 import type { WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
 export type DeviceLinkingAuthDeniedV1 = {
     readonly kind: 'denied';
-    readonly code: 'unauthorized' | 'expired' | 'invalid' | 'replayed';
+    readonly code: 'unauthorized' | 'expired' | 'invalid' | 'replayed' | 'unavailable';
     readonly message: string;
 };
 export type DeviceLinkingRequestBindingV1 = {

package/dist/types/wallet-server/src/router/transport/fetch/routes/deviceLinkingOwnerAuthorization.d.ts

@@ -10,6 +10,7 @@ import type { DeviceLinkingAuthDeniedV1, DeviceLinkingOwnerRequestInputV1 } from
 import type { WalletExecutionLaneAuthSource } from '../../../../core/signingLanes/WalletExecutionLaneProjection';
 import type { DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
 import type { ExactAdministeredSignerManifestV1 } from '../../../../../../shared-ts/src/device-linking/delegatedActivationPlan';
+import type { ReadonlyExclusiveUnion } from '../../../../../../shared-ts/src/utils/variant';
 export declare const LINKED_DEVICE_OWNER_AUTHORIZATION_PATH_V1: "/wallet/device-linking/v1/owner-authorization";
 export type DeviceLinkingOwnerAuthorizationAuthenticationV1 = {
     readonly kind: 'link_session_authenticated_request_v1';
@@ -23,7 +24,7 @@ export type DeviceLinkingOwnerAuthorizationResponseV1 = {
     readonly sourceSignerManifest: ExactAdministeredSignerManifestV1;
     readonly expiresAtMs: number;
 };
-export type DeviceLinkingOwnerWalletSessionContextV1 = {
+export type DeviceLinkingOwnerWalletSessionContextV1 = ReadonlyExclusiveUnion<{
     readonly walletId: WalletId;
     readonly walletSessionId: WalletSessionId;
     readonly authorizationId: WalletSessionAuthorizationId;
@@ -34,8 +35,6 @@ export type DeviceLinkingOwnerWalletSessionContextV1 = {
     readonly curve: 'ed25519';
     readonly authority: WalletAuthAuthority;
     readonly authorityScope: ThresholdEd25519AuthorityScope;
-    readonly walletAuthAuthorityRef?: never;
-    readonly authSource?: never;
 } | {
     readonly walletId: WalletId;
     readonly walletSessionId: WalletSessionId;
@@ -47,9 +46,7 @@ export type DeviceLinkingOwnerWalletSessionContextV1 = {
     readonly curve: 'ecdsa';
     readonly walletAuthAuthorityRef: WalletAuthAuthorityRef;
     readonly authSource: WalletExecutionLaneAuthSource;
-    readonly authority?: never;
-    readonly authorityScope?: never;
-};
+}>;
 type DeviceLinkingOwnerRequestAuthenticationV1 = {
     readonly kind: 'authorized';
     readonly body: unknown;

package/dist/types/wallet-server/src/router/transport/fetch/routes/deviceLinkingResponses.d.ts

@@ -0,0 +1,17 @@
+import type { DeviceLinkingAuthDeniedV1 } from './deviceLinking';
+import { type LinkSessionProjectionV1, type LinkedDeviceTargetCredentialRegistrationResultV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
+import type { LinkedDeviceSessionRecordV1 } from '../../../../core/deviceLinking/linkedDeviceSessionRecord';
+export declare function projectSession(record: LinkedDeviceSessionRecordV1): LinkSessionProjectionV1;
+export declare function invalidStateResponse(record: LinkedDeviceSessionRecordV1): Response;
+export declare function sessionProjectionResponse(record: LinkedDeviceSessionRecordV1, outcome: 'applied' | 'replayed'): Response;
+export declare function targetCredentialResultResponse(record: LinkedDeviceSessionRecordV1, outcome: 'applied' | 'replayed', targetCredential: LinkedDeviceTargetCredentialRegistrationResultV1): Response;
+export declare function exportRootWriteResponse(result: {
+    readonly outcome: 'applied' | 'replayed' | 'conflict';
+    readonly reason?: string;
+}): Response;
+export declare function invalidInputResponse(message: string): Response;
+export declare function notSupportedResponse(message?: string): Response;
+export declare function notFoundResponse(): Response;
+export declare function methodNotAllowedResponse(): Response;
+export declare function authDeniedResponse(result: DeviceLinkingAuthDeniedV1): Response;
+//# sourceMappingURL=deviceLinkingResponses.d.ts.map

package/dist/types/wallet-server/src/router/transport/fetch/routes/ecdsaOperationStepUpFactor.d.ts

@@ -0,0 +1,37 @@
+import type { CapabilityOperationEnvelope } from '../../../../../../shared-ts/src/authorization/operationFingerprint';
+import { type WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
+import type { WalletAuthAuthorityRef } from '../../../../../../shared-ts/src/utils/walletAuthAuthority';
+import type { RouterAbEcdsaOperationStepUpAuthorizationRequestV1Wire } from '../../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
+import { type VerifiedWalletOperationFactorResult } from '../../../../authorization/factorEvidence';
+import type { SessionOrigin } from '../../../../authorization/domain';
+import type { WalletExecutionLaneAuthSource } from '../../../../core/signingLanes/WalletExecutionLaneProjection';
+import type { RouterApiEmailOtpRouteService, RouterApiWebAuthnService } from '../../../framework/authServicePort';
+type StepUpUnseal = {
+    readonly kind: 'not_requested';
+} | {
+    readonly kind: 'email_otp_grant';
+    readonly grant: string;
+    readonly challenge_id: string;
+};
+type VerifiedStepUpFactorResult = {
+    readonly ok: true;
+    readonly factor: VerifiedWalletOperationFactorResult;
+    readonly unseal: StepUpUnseal;
+} | {
+    readonly ok: false;
+    readonly response: Response;
+};
+export declare function verifyEcdsaOperationStepUpFactor(input: {
+    readonly proof: RouterAbEcdsaOperationStepUpAuthorizationRequestV1Wire['proof'];
+    readonly operation: CapabilityOperationEnvelope;
+    readonly walletId: WalletId;
+    readonly authorityRef: WalletAuthAuthorityRef;
+    readonly authSource: WalletExecutionLaneAuthSource;
+    readonly requestOrigin: SessionOrigin;
+    readonly expectedChallenge: string;
+    readonly expiresAtMs: number;
+    readonly webAuthn: Pick<RouterApiWebAuthnService, 'verifyWebAuthnAuthenticationLite'>;
+    readonly emailOtp: Pick<RouterApiEmailOtpRouteService, 'verifyEmailOtpChallenge' | 'consumeEmailOtpGrant'>;
+}): Promise<VerifiedStepUpFactorResult>;
+export {};
+//# sourceMappingURL=ecdsaOperationStepUpFactor.d.ts.map

package/dist/types/wallet-server/src/router/transport/fetch/routes/syncAccountBootstrap.d.ts

@@ -13,6 +13,7 @@ import type { FetchRouterApiContext } from '../createFetchRouter';
 import type { WebAuthnSyncAccountVerificationResult } from '../../../../core/authService/webauthn';
 import type { WalletEcdsaSignerRecord } from '../../../../core/WalletStore';
 import type { RouterAbEd25519YaoActiveCapabilityDescriptorV1 } from '../../../domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery';
+import type { ReadonlyExclusiveUnion } from '../../../../../../shared-ts/src/utils/variant';
 type VerifiedSyncAccountResultV1 = Extract<WebAuthnSyncAccountVerificationResult, {
     readonly ok: true;
     readonly verified: true;
@@ -74,13 +75,10 @@ type SyncAccountExactBootstrapBodyBaseV1 = {
         readonly signers: readonly Pick<WalletEcdsaSignerRecord, 'chainTarget' | 'walletKey' | 'activationReceipt' | 'runtimePolicyScope'>[];
     };
 };
-type SyncAccountExactBootstrapBodyV1 = SyncAccountExactBootstrapBodyBaseV1 & ({
-    readonly ecdsaSession?: never;
-    readonly ecdsaActivationReceipt?: never;
-} | {
+type SyncAccountExactBootstrapBodyV1 = SyncAccountExactBootstrapBodyBaseV1 & ReadonlyExclusiveUnion<{} | {
     readonly ecdsaSession: RouterAbEcdsaCredentialFreeSessionActivationResponseV1;
     readonly ecdsaActivationReceipt: RouterAbEcdsaRegistrationActivationReceiptV1;
-});
+}>;
 type SyncAccountBootstrapInputV1 = {
     readonly ctx: FetchRouterApiContext;
     readonly result: VerifiedSyncAccountResultV1;

package/dist/types/wallet-server/src/router/transport/fetch/routes/thresholdEcdsa.d.ts

@@ -33,7 +33,6 @@ type RouterAbEcdsaPoolFillAuthorizationResult = {
     };
 };
 type EcdsaPresignGatewayTiming = {
-    queue: number | null;
     authenticate: number | null;
     material: number | null;
     admit: number | null;

package/dist/types/wallet-server/src/storage/d1Sql.d.ts

@@ -10,7 +10,6 @@ export declare function parseD1JsonColumn(value: unknown): unknown;
 export declare function parseD1JsonArrayColumn(value: unknown): readonly unknown[];
 export declare function parseD1JsonObjectColumn(value: unknown): Record<string, unknown>;
 export declare function isD1DatabaseLike(value: unknown): value is D1DatabaseLike;
-export declare function resolveD1DatabaseFromConfig(config: Record<string, unknown>): D1DatabaseLike | null;
 /**
  * Aborts the D1 batch it is in when the statement just before it changed no
  * row: it collides with the guard table's immutable singleton, and the

package/dist/types/wallet-server/src/threshold/session/signingSessionSeal/idempotencyRecords.d.ts

@@ -1,4 +1,3 @@
-import type { SigningSessionSealRouteResult } from './signingSessionSeal.types';
 type CurrentSigningSessionSealSuccessIdempotencyResultRecord = {
     ok: true;
     ciphertext: string;
@@ -15,7 +14,7 @@ type CurrentSigningSessionSealIdempotencyStoredEntry = {
     result: CurrentSigningSessionSealIdempotencyResultRecord;
     expiresAtMs: number;
 };
+export declare function parseCurrentSigningSessionSealIdempotencyResultRecord(raw: unknown): CurrentSigningSessionSealIdempotencyResultRecord | null;
 export declare function parseCurrentSigningSessionSealIdempotencyStoredEntry(raw: unknown): CurrentSigningSessionSealIdempotencyStoredEntry | null;
-export declare function parseCurrentSigningSessionSealIdempotencyRouteResult(raw: unknown): SigningSessionSealRouteResult | null;
 export {};
 //# sourceMappingURL=idempotencyRecords.d.ts.map

package/dist/types/wallet-server/src/threshold/session/signingSessionSeal/signingSessionSeal.types.d.ts

@@ -21,17 +21,16 @@ export type SigningSessionSealAuthorizeResult = {
     message?: string;
     status?: number;
 };
-export interface SigningSessionSealApplyServerSealRequest {
+/** Applying and removing the server seal take the same request. */
+export interface SigningSessionSealServerSealRequest {
     thresholdSessionId: string;
     ciphertext: string;
     keyVersion?: string;
     metadata?: Record<string, unknown>;
 }
-export interface SigningSessionSealRemoveServerSealRequest {
-    thresholdSessionId: string;
-    ciphertext: string;
-    keyVersion?: string;
-    metadata?: Record<string, unknown>;
+export interface SigningSessionSealApplyServerSealRequest extends SigningSessionSealServerSealRequest {
+}
+export interface SigningSessionSealRemoveServerSealRequest extends SigningSessionSealServerSealRequest {
 }
 type SigningSessionSealRouteSuccessBase = {
     ok: true;
@@ -77,7 +76,7 @@ export interface SigningSessionSealStartupCapabilities {
     currentKeyVersion: string;
 }
 export type SigningSessionSealOperation = 'apply-server-seal' | 'remove-server-seal';
-export type SigningSessionSealCurve = 'ecdsa' | 'ed25519';
+export type { SigningSessionSealCurve } from '../../../../../shared-ts/src/utils/signingSessionSeal';
 type SigningSessionSealAuthorizationSessionRecordBase = {
     userId: string;
     expiresAtMs: number;
@@ -144,5 +143,4 @@ export interface CreateSigningSessionSealServiceOptions {
     logger?: NormalizedLogger;
     nowMs?: () => number;
 }
-export {};
 //# sourceMappingURL=signingSessionSeal.types.d.ts.map

package/migrations/d1-signer/0040_namespace_home_challenges.sql

@@ -0,0 +1,16 @@
+CREATE TABLE namespace_home_challenges (
+  namespace TEXT NOT NULL,
+  challenge_id TEXT NOT NULL,
+  account_id TEXT NOT NULL,
+  database_id TEXT NOT NULL,
+  proof TEXT NOT NULL,
+  issued_at_ms INTEGER NOT NULL,
+  expires_at_ms INTEGER NOT NULL,
+  PRIMARY KEY (namespace, challenge_id),
+  CHECK (length(challenge_id) = 64),
+  CHECK (length(proof) = 64),
+  CHECK (issued_at_ms > 0),
+  CHECK (expires_at_ms > issued_at_ms AND expires_at_ms <= issued_at_ms + 300000)
+);
+
+CREATE INDEX namespace_home_challenges_expiry_idx ON namespace_home_challenges(expires_at_ms);

package/migrations/d1-signer/0041_step_up_admission_expiry.sql

@@ -0,0 +1,28 @@
+DROP TRIGGER authorized_operation_step_up_claim_atomic;
+
+CREATE TRIGGER authorized_operation_step_up_claim_atomic
+AFTER INSERT ON authorized_operations
+WHEN NEW.lifecycle_kind = 'claimed'
+  AND NEW.authorization_source_kind = 'verified_step_up'
+BEGIN
+  SELECT CASE
+    WHEN NOT EXISTS (
+        SELECT 1
+          FROM verified_wallet_operation_evidence_sets AS evidence
+         WHERE evidence.namespace = NEW.namespace
+           AND evidence.tenant_id = NEW.tenant_id
+           AND evidence.evidence_set_digest = NEW.evidence_set_digest
+           AND evidence.principal_id = NEW.principal_id
+           AND evidence.capability_kind = NEW.capability_kind
+           AND evidence.operation_kind = NEW.operation_kind
+           AND evidence.lane_digest = NEW.lane_digest
+           AND evidence.intent_digest = NEW.intent_digest
+           AND evidence.display_digest = NEW.display_digest
+           AND evidence.assurance = 'step_up'
+           AND evidence.expires_at_ms > NEW.claimed_at_ms
+           -- The database clock closes delays between verification and this write.
+           AND evidence.expires_at_ms > CAST(round(unixepoch('subsec') * 1000) AS INTEGER)
+      )
+    THEN RAISE(ABORT, 'authorization_evidence_claim_rejected')
+  END;
+END;

package/migrations/d1-signer/0042_deployment_resource_challenges.sql

@@ -0,0 +1,4 @@
+ALTER TABLE namespace_home_challenges RENAME TO deployment_resource_challenges;
+DROP INDEX namespace_home_challenges_expiry_idx;
+CREATE INDEX deployment_resource_challenges_expiry_idx
+  ON deployment_resource_challenges(expires_at_ms);

package/migrations/d1-signer/0043_google_registration_candidate_claim.sql

@@ -0,0 +1,2 @@
+ALTER TABLE email_otp_registration_attempts
+  ADD COLUMN selection_digest TEXT CHECK (selection_digest IS NULL OR length(selection_digest) > 0);

package/migrations/d1-signer/0044_linked_device_bootstrap_imports.sql

@@ -0,0 +1,6 @@
+-- This receipt survives session cleanup to prevent replayed imports from resurrecting sessions.
+CREATE TABLE linked_device_bootstrap_imports (
+ namespace TEXT NOT NULL, org_id TEXT NOT NULL, project_id TEXT NOT NULL, env_id TEXT NOT NULL,
+ link_session_id TEXT NOT NULL,
+ PRIMARY KEY (namespace, org_id, project_id, env_id, link_session_id)
+);

package/migrations/d1-signer/0045_wallet_owned_capability_receipts.sql

@@ -0,0 +1,29 @@
+-- Unowned receipts cannot be attributed from capability hashes. Require the
+-- disposable-wallet reset before replacing a populated receipt table.
+CREATE TABLE capability_receipt_reset_guard (
+  receipt_count INTEGER NOT NULL CHECK (receipt_count = 0)
+);
+INSERT INTO capability_receipt_reset_guard
+SELECT COUNT(*) FROM router_ab_yao_capability_replacements;
+DROP TABLE capability_receipt_reset_guard;
+DROP TABLE router_ab_yao_capability_replacements;
+CREATE TABLE router_ab_yao_capability_replacements (
+  namespace TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  project_id TEXT NOT NULL,
+  env_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL CHECK (length(wallet_id) > 0),
+  operation_id TEXT NOT NULL,
+  operation_fingerprint TEXT NOT NULL,
+  previous_capability_binding_json TEXT NOT NULL,
+  next_capability_binding_json TEXT NOT NULL,
+  created_at_ms INTEGER NOT NULL,
+  PRIMARY KEY (namespace, org_id, project_id, env_id, operation_id),
+  CHECK (length(operation_id) > 0),
+  CHECK (length(operation_fingerprint) > 0),
+  CHECK (json_valid(previous_capability_binding_json)),
+  CHECK (json_valid(next_capability_binding_json)),
+  CHECK (created_at_ms >= 0)
+);
+CREATE INDEX capability_replacements_wallet ON router_ab_yao_capability_replacements
+  (namespace, org_id, project_id, env_id, wallet_id);

package/migrations/d1-signer/0046_wallet_owned_signing_abuse.sql

@@ -0,0 +1,41 @@
+-- Require disposable-state cleanup before replacing unowned policy records.
+CREATE TABLE signing_admission_reset_guard (
+  record_count INTEGER NOT NULL CHECK (record_count = 0)
+);
+INSERT INTO signing_admission_reset_guard
+SELECT COUNT(*) FROM router_ab_normal_signing_admission_records;
+DROP TABLE signing_admission_reset_guard;
+DROP TABLE router_ab_normal_signing_admission_records;
+
+CREATE TABLE router_ab_normal_signing_admission_records (
+  namespace TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  project_id TEXT NOT NULL,
+  env_id TEXT NOT NULL,
+  signing_root_version TEXT NOT NULL,
+  record_kind TEXT NOT NULL CHECK (record_kind IN ('project_policy', 'abuse')),
+  record_key TEXT NOT NULL,
+  wallet_id TEXT,
+  decision TEXT NOT NULL,
+  retry_after_ms INTEGER,
+  updated_at_ms INTEGER NOT NULL CHECK (updated_at_ms >= 0),
+  PRIMARY KEY (
+    namespace, org_id, project_id, env_id, signing_root_version, record_kind, record_key
+  ),
+  CHECK (
+    (record_kind = 'project_policy' AND wallet_id IS NULL
+      AND decision IN ('allowed', 'rejected')
+      AND record_key = org_id || char(31) || project_id || char(31) || env_id || char(31) || signing_root_version)
+    OR
+    (record_kind = 'abuse' AND wallet_id IS NOT NULL AND length(wallet_id) > 0
+      AND decision IN ('allowed', 'rate_limited', 'rejected')
+      AND instr(record_key, org_id || char(31) || project_id || char(31) || env_id || char(31) ||
+        signing_root_version || char(31) || wallet_id || char(31)) = 1)
+  ),
+  CHECK (
+    (decision IN ('rejected', 'rate_limited') AND retry_after_ms IS NOT NULL AND retry_after_ms > 0)
+    OR (decision = 'allowed' AND retry_after_ms IS NULL)
+  )
+);
+CREATE INDEX signing_abuse_wallet ON router_ab_normal_signing_admission_records
+  (namespace, org_id, project_id, env_id, wallet_id) WHERE record_kind = 'abuse';

package/migrations/d1-signer/0047_remove_unused_near_public_keys.sql

@@ -0,0 +1,2 @@
+-- Wallet public key ownership is recorded by wallet_signers.
+DROP TABLE near_public_keys;

package/migrations/d1-signer/0048_operation_owner_scope.sql

@@ -0,0 +1,45 @@
+DROP TRIGGER authorized_operation_audit_claim;
+ALTER TABLE authorized_operations DROP COLUMN linked_wallet_id;
+ALTER TABLE authorized_operations DROP COLUMN linked_enrollment_id;
+ALTER TABLE authorized_operations DROP COLUMN linked_device_id;
+ALTER TABLE authorized_operations DROP COLUMN linked_wallet_key_id;
+ALTER TABLE authorized_operations DROP COLUMN linked_lane_id;
+ALTER TABLE authorized_operations DROP COLUMN linked_lane_share_epoch;
+ALTER TABLE authorized_operations DROP COLUMN linked_revocation_epoch;
+ALTER TABLE authorized_operations RENAME COLUMN linked_scope_org_id TO owner_scope_org_id;
+ALTER TABLE authorized_operations RENAME COLUMN linked_scope_project_id TO owner_scope_project_id;
+ALTER TABLE authorized_operations RENAME COLUMN linked_scope_env_id TO owner_scope_env_id;
+ALTER TABLE authorized_operation_audit_events DROP COLUMN linked_wallet_id;
+ALTER TABLE authorized_operation_audit_events DROP COLUMN linked_enrollment_id;
+ALTER TABLE authorized_operation_audit_events DROP COLUMN linked_device_id;
+ALTER TABLE authorized_operation_audit_events DROP COLUMN linked_wallet_key_id;
+ALTER TABLE authorized_operation_audit_events DROP COLUMN linked_lane_id;
+ALTER TABLE authorized_operation_audit_events DROP COLUMN linked_lane_share_epoch;
+ALTER TABLE authorized_operation_audit_events DROP COLUMN linked_revocation_epoch;
+ALTER TABLE authorized_operation_audit_events RENAME COLUMN linked_scope_org_id TO owner_scope_org_id;
+ALTER TABLE authorized_operation_audit_events RENAME COLUMN linked_scope_project_id TO owner_scope_project_id;
+ALTER TABLE authorized_operation_audit_events RENAME COLUMN linked_scope_env_id TO owner_scope_env_id;
+
+CREATE TRIGGER authorized_operation_audit_claim
+AFTER INSERT ON authorized_operations
+WHEN NEW.lifecycle_kind = 'claimed'
+BEGIN
+  INSERT INTO authorized_operation_audit_events (
+    namespace, tenant_id, audit_event_id, authorized_operation_id,
+    operation_fingerprint_digest, authorization_source_kind, authorization_id,
+    authorization_grant_kind, evidence_set_digest, quota_id, material_activation_id,
+    material_activation_capability, material_activation_owner,
+    material_activation_key_binding, material_activation_lifecycle_binding,
+    material_activation_signing_worker, owner_scope_org_id, owner_scope_project_id,
+    owner_scope_env_id, result_kind, claimed_at_ms, completed_at_ms
+  ) VALUES (
+    NEW.namespace, NEW.tenant_id, NEW.audit_event_id, NEW.authorized_operation_id,
+    NEW.operation_fingerprint_digest, NEW.authorization_source_kind, NEW.authorization_id,
+    NEW.authorization_grant_kind, NEW.evidence_set_digest, NEW.quota_id,
+    NEW.material_activation_id, NEW.material_activation_capability,
+    NEW.material_activation_owner, NEW.material_activation_key_binding,
+    NEW.material_activation_lifecycle_binding, NEW.material_activation_signing_worker,
+    NEW.owner_scope_org_id, NEW.owner_scope_project_id,
+    NEW.owner_scope_env_id, NEW.result_kind, NEW.claimed_at_ms, NEW.completed_at_ms
+  );
+END;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seams/wallet-server",
-  "version": "0.7.1",
+  "version": "0.8.0",
   "type": "module",
   "description": "Seams server TypeScript SDK for NEAR and EVM-family wallets",
   "main": "./dist/esm/index.js",
@@ -121,8 +121,7 @@
   "dependencies": {
     "@simplewebauthn/server": "^13.2.2",
     "bs58": "^6.0.0",
-    "express": "^4.21.2",
-    "tslib": "^2.8.1"
+    "express": "^4.21.2"
   },
   "devDependencies": {
     "@near-js/types": "^2.4.0",

package/src/README.md

@@ -1,8 +1,8 @@
 # Server Package
 
-`AuthService` and the Router API implement wallet registration, built-in owner
-verification, opaque Wallet Sessions, signing admission, and recovery. Wallet
-application authentication is intentionally outside this package.
+The Router API implements wallet registration, built-in owner verification,
+opaque Wallet Sessions, signing admission, and recovery. Wallet application
+authentication is intentionally outside this package.
 
 ## Authorization model
 
@@ -22,6 +22,14 @@ application authentication is intentionally outside this package.
 
 ## Primary wallet routes
 
+Wallet-management routes (registration, signer setup/inventory, auth-method
+management and implicit NEAR funding) require `X-Seams-Wallet-Protocol: 2`.
+Missing or unsupported values return HTTP 409, `wallet_protocol_mismatch`, with
+reload/upgrade instructions before parsing the body or invoking route services.
+The current Wallet SDK sends this header automatically. Direct HTTP clients,
+including deployment registration canaries, must send it explicitly. The header
+declares the wire contract and does not replace authentication.
+
 - `POST /wallets/register/setup`
 - `POST /wallets/register/respond`
 - `POST /wallets/register/activate`

package/dist/esm/core/AuthService.js

@@ -1,2 +0,0 @@
-import { AuthService } from "./authService/AuthService.js";
-export { AuthService };