@seams/wallet-server 0.7.3 → 0.8.0

package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js

@@ -1,13 +1,14 @@
+import { parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
 import { routerAbMpcMaterialActivationRefToWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { deriveSigningRootId } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { ROUTER_AB_ED25519_NORMAL_SIGNING_STATE_KIND } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
-import { thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
 import { computeAddSignerNearEd25519SigningKeyId, computeRegistrationNearEd25519SigningKeyId } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { registrationNearEd25519BranchKey } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
 import "../../../../shared-ts/src/threshold/sessionPolicy.js";
+import { thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
 import { createRouterApiModule } from "../../../framework/modules.js";
 import { InMemoryRouterAbEd25519YaoRegistrationStateV1, createRouterAbEd25519YaoRegistrationModule } from "../registration/routerAbEd25519YaoRegistration.js";
 import { InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationStateV1 } from "../registration/routerAbEd25519YaoRegistrationIntentAuthorization.js";
@@ -83,9 +84,12 @@ function isDispatchRootMap(input) {
 	for (const [key, value] of input) if (typeof key !== "string" || parseRouterAbEd25519YaoTenantRootWireV1(value) === null) return false;
 	return true;
 }
-function isStringSet(input) {
-	if (!(input instanceof Set)) return false;
-	for (const value of input) if (typeof value !== "string") return false;
+function isWalletOwnershipMap(input) {
+	if (!isStringMap(input)) return false;
+	for (const [key, walletId] of input) {
+		const parsed = parseWalletId(walletId);
+		if (!key || !parsed.ok || parsed.value !== walletId) return false;
+	}
 	return true;
 }
 function hasProductStateCollections(input) {
@@ -96,7 +100,7 @@ function hasProductStateCollections(input) {
 	const recovery = input.recovery;
 	const exportState = input.export;
 	if (!isPlainObject(registration) || !isPlainObject(authorization) || !isPlainObject(recovery) || !isPlainObject(exportState)) return false;
-	return isStringMapWithStateKinds(registration.states, REGISTRATION_STATE_KINDS) && isStringMap(registration.lifecycleSessions) && (registration.admissionClaims === void 0 || isStringMapWithStateKinds(registration.admissionClaims, REGISTRATION_ADMISSION_CLAIM_KINDS)) && isDispatchRootMap(registration.dispatchRoots) && Array.isArray(authorization.authorities) && authorization.authorities.every((authority) => isPlainObject(authority) && INTENT_AUTHORITY_KINDS.has(String(authority.kind))) && isStringMapWithStateKinds(recovery.capabilities, CAPABILITY_STATE_KINDS) && isStringMap(recovery.identityCapabilities) && isStringMapWithStateKinds(recovery.recoveries, RECOVERY_STATE_KINDS) && isStringMap(recovery.recoverySessions) && isStringMapWithStateKinds(exportState.exports, EXPORT_STATE_KINDS) && isStringSet(exportState.authorizationNonces) && (exportState.authorizationUncertain === void 0 || isStringSet(exportState.authorizationUncertain));
+	return isStringMapWithStateKinds(registration.states, REGISTRATION_STATE_KINDS) && isStringMap(registration.lifecycleSessions) && (registration.admissionClaims === void 0 || isStringMapWithStateKinds(registration.admissionClaims, REGISTRATION_ADMISSION_CLAIM_KINDS)) && isDispatchRootMap(registration.dispatchRoots) && Array.isArray(authorization.authorities) && authorization.authorities.every((authority) => isPlainObject(authority) && INTENT_AUTHORITY_KINDS.has(String(authority.kind))) && isStringMapWithStateKinds(recovery.capabilities, CAPABILITY_STATE_KINDS) && isStringMap(recovery.identityCapabilities) && isStringMapWithStateKinds(recovery.recoveries, RECOVERY_STATE_KINDS) && isStringMap(recovery.recoverySessions) && isStringMapWithStateKinds(exportState.exports, EXPORT_STATE_KINDS) && isWalletOwnershipMap(exportState.authorizationNonceOwners) && isWalletOwnershipMap(exportState.authorizationUncertainOwners);
 }
 function parseRouterAbEd25519YaoProductRegistrationStateV1(input) {
 	if (!hasProductStateCollections(input)) return {
@@ -105,7 +109,6 @@ function parseRouterAbEd25519YaoProductRegistrationStateV1(input) {
 	};
 	const registration = input.registration;
 	const admissionClaims = registration.admissionClaims === void 0 ? /* @__PURE__ */ new Map() : registration.admissionClaims;
-	const authorizationUncertain = input.export.authorizationUncertain === void 0 ? /* @__PURE__ */ new Set() : input.export.authorizationUncertain;
 	return {
 		ok: true,
 		value: {
@@ -120,8 +123,8 @@ function parseRouterAbEd25519YaoProductRegistrationStateV1(input) {
 			recovery: input.recovery,
 			export: {
 				exports: input.export.exports,
-				authorizationNonces: input.export.authorizationNonces,
-				authorizationUncertain
+				authorizationNonceOwners: input.export.authorizationNonceOwners,
+				authorizationUncertainOwners: input.export.authorizationUncertainOwners
 			}
 		}
 	};

package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore.js

@@ -122,15 +122,16 @@ function parseRouterAbEd25519YaoProductRegistrationPartitionRecordJsonV1(input)
 	return isVersionedJsonObject(input) ? input : null;
 }
 function isEmptyCeremonyState(state) {
-	return state.registration.states.size === 0 && state.registration.lifecycleSessions.size === 0 && state.registration.admissionClaims.size === 0 && state.authorization.authorities.length === 0 && state.recovery.recoveries.size === 0 && state.export.exports.size === 0;
+	return state.registration.states.size === 0 && state.registration.lifecycleSessions.size === 0 && state.registration.admissionClaims.size === 0 && state.registration.dispatchRoots.size === 0 && state.authorization.authorities.length === 0 && state.recovery.recoveries.size === 0 && state.export.exports.size === 0;
 }
 function isEmptySharedState(state) {
-	return state.recovery.capabilities.size === 0 && state.recovery.identityCapabilities.size === 0 && state.recovery.recoverySessions.size === 0 && state.export.authorizationNonces.size === 0 && state.export.authorizationUncertain.size === 0;
+	return state.recovery.capabilities.size === 0 && state.recovery.identityCapabilities.size === 0 && state.recovery.recoverySessions.size === 0 && state.export.authorizationNonceOwners.size === 0 && state.export.authorizationUncertainOwners.size === 0;
 }
 function isCeremonyStateOwnedByLifecycle(state, lifecycleId) {
 	for (const value of state.registration.states.values()) if (value.admissionRequest.scope.lifecycle_id !== lifecycleId) return false;
 	for (const key of state.registration.lifecycleSessions.keys()) if (key !== lifecycleId) return false;
 	for (const key of state.registration.admissionClaims.keys()) if (key !== lifecycleId) return false;
+	for (const key of state.registration.dispatchRoots.keys()) if (key !== lifecycleId) return false;
 	for (const authority of state.authorization.authorities) if (authority.admissionRequest.scope.lifecycle_id !== lifecycleId) return false;
 	for (const value of state.recovery.recoveries.values()) if (value.context.admissionRequest.scope.lifecycle_id !== lifecycleId) return false;
 	for (const value of state.export.exports.values()) if (value.request.scope.lifecycle_id !== lifecycleId) return false;

package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitioning.js

@@ -19,8 +19,8 @@ function partitionRouterAbEd25519YaoProductRegistrationStateV1(state, lifecycleI
 			recoveryCapabilities: new Map(state.recovery.capabilities),
 			recoveryIdentityCapabilities: new Map(state.recovery.identityCapabilities),
 			recoverySessions: new Map(state.recovery.recoverySessions),
-			exportAuthorizationNonces: new Set(state.export.authorizationNonces),
-			exportAuthorizationUncertain: new Set(state.export.authorizationUncertain)
+			exportAuthorizationNonceOwners: new Map(state.export.authorizationNonceOwners),
+			exportAuthorizationUncertainOwners: new Map(state.export.authorizationUncertainOwners)
 		},
 		ceremony: {
 			kind: "router_ab_ed25519_yao_product_registration_ceremony_state_v1",
@@ -75,8 +75,8 @@ function mergeRouterAbEd25519YaoProductRegistrationStatePartitionV1(base, partit
 		},
 		export: {
 			exports,
-			authorizationNonces: new Set(partition.shared.exportAuthorizationNonces),
-			authorizationUncertain: new Set(partition.shared.exportAuthorizationUncertain)
+			authorizationNonceOwners: new Map(partition.shared.exportAuthorizationNonceOwners),
+			authorizationUncertainOwners: new Map(partition.shared.exportAuthorizationUncertainOwners)
 		}
 	});
 }
@@ -102,8 +102,8 @@ function boundedRouterAbEd25519YaoProductRegistrationSharedStateV1(source) {
 		recoveryCapabilities,
 		recoveryIdentityCapabilities: retainedRecoveryIdentityCapabilities(source.recoveryIdentityCapabilities, recoveryCapabilities),
 		recoverySessions: new Map(source.recoverySessions),
-		exportAuthorizationNonces: new Set(source.exportAuthorizationNonces),
-		exportAuthorizationUncertain: new Set(source.exportAuthorizationUncertain)
+		exportAuthorizationNonceOwners: new Map(source.exportAuthorizationNonceOwners),
+		exportAuthorizationUncertainOwners: new Map(source.exportAuthorizationUncertainOwners)
 	};
 }
 function boundedRecoveryCapabilities(source) {

package/dist/esm/router/domains/ed25519Yao/export/routerAbEd25519YaoExport.js

@@ -45,8 +45,8 @@ function resolveTraceContext(request) {
 var InMemoryRouterAbEd25519YaoExportStateV1 = class {
 	constructor() {
 		this.exports = /* @__PURE__ */ new Map();
-		this.authorizationNonces = /* @__PURE__ */ new Set();
-		this.authorizationUncertain = /* @__PURE__ */ new Set();
+		this.authorizationNonceOwners = /* @__PURE__ */ new Map();
+		this.authorizationUncertainOwners = /* @__PURE__ */ new Map();
 	}
 };
 function bytesToHex(bytes) {
@@ -177,10 +177,10 @@ var InMemoryRouterAbEd25519YaoExportService = class {
 		this.state = state;
 	}
 	authorizationIsUncertain(request) {
-		return this.state.authorizationUncertain.has(exportKey(request));
+		return this.state.authorizationUncertainOwners.has(exportKey(request));
 	}
 	recordAuthorizationUncertain(request) {
-		this.state.authorizationUncertain.add(exportKey(request));
+		this.state.authorizationUncertainOwners.set(exportKey(request), request.scope.account_id);
 	}
 	async admitExport(request, authorizationIdentity, admission, factorRelease, traceContext) {
 		const admitted = await admission.admit();
@@ -256,11 +256,11 @@ var InMemoryRouterAbEd25519YaoExportService = class {
 			}
 		}
 		const nonce = bytesToHex(request.authorization.nonce);
-		if (this.state.authorizationNonces.has(nonce)) return {
+		if (this.state.authorizationNonceOwners.has(nonce)) return {
 			kind: "completed",
 			value: authorizationConflict("export_authorization_replayed", "Ed25519 Yao export authorization was already used")
 		};
-		this.state.authorizationNonces.add(nonce);
+		this.state.authorizationNonceOwners.set(nonce, request.scope.account_id);
 		this.state.exports.set(key, {
 			kind: "authorized",
 			request,

package/dist/esm/router/domains/ed25519Yao/export/routerAbEd25519YaoExportRequestScopedCloudflare.js

@@ -2,6 +2,7 @@ import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import "../../../../shared-ts/src/utils/encoders.js";
 import "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
+import { publishWalletLifecycleHome } from "../../../../authorization/lifecycleRouting.js";
 import { normalizeCorsOrigin } from "../../../../core/SessionService.js";
 import { ROUTER_AB_TRACE_ID_HEADER_V1, createRouterAbTraceContextV1, parseRouterAbTraceContextV1 } from "../../../../shared-ts/src/utils/routerAbTraceContext.js";
 import { json, readJson } from "../../../framework/http.js";
@@ -159,6 +160,8 @@ async function handleAdmissionRequest(context, raw) {
 	}, { status: 403 });
 	const admission = await runAuthorization(context, parsed, expectedOrigin);
 	if (!admission.ok) return exportResponse(admission);
+	const published = await publishWalletLifecycleHome(context.input.lifecycleRouting ?? null, "yao_export", parsed.protocol);
+	if (!published.ok) return exportResponse(published);
 	const result = await runAdmission(context, parsed.protocol, admission.authorizationIdentity);
 	if (result.ok) return json({
 		protocol: result.value,

package/dist/esm/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryRequestScopedCloudflare.js

@@ -1,4 +1,5 @@
 import { parseRouterAbEd25519YaoRecoveryActivationExecuteRequestV1, parseRouterAbEd25519YaoRecoveryActivationRequestV1, parseRouterAbEd25519YaoRecoveryAdmissionRequestV1, parseRouterAbEd25519YaoRecoveryStatusRequestV1, parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
+import { publishWalletLifecycleHome } from "../../../../authorization/lifecycleRouting.js";
 import { ROUTER_AB_TRACE_ID_HEADER_V1, createRouterAbTraceContextV1, parseRouterAbTraceContextV1 } from "../../../../shared-ts/src/utils/routerAbTraceContext.js";
 import { json, readJson } from "../../../framework/http.js";
 import { InMemoryRouterAbEd25519YaoRecoveryService, buildWarmRecoveryBootstrapResponse, recoveryAuthorizationBinding } from "./routerAbEd25519YaoRecovery.js";
@@ -20,6 +21,13 @@ var RecoveryAdmissionRequestRun = class {
 			value: authorized
 		};
 		const prepared = this.service(state).prepareAdmitRecovery(this.request, recoveryAuthorizationBinding(authorized.authorization), await this.context.input.backend.resolveRecoveryDispatchRoot(this.request), Date.now());
+		if (prepared.kind !== "failed") {
+			const published = await publishWalletLifecycleHome(this.context.input.lifecycleRouting ?? null, "yao_recovery", this.request);
+			if (!published.ok) return {
+				kind: "rejected",
+				value: published
+			};
+		}
 		switch (prepared.kind) {
 			case "claimed": return {
 				kind: "claimed",

package/dist/esm/router/domains/emailOtp/emailOtpRequestValidation.js

@@ -1,5 +1,4 @@
 import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
-import "../../../shared-ts/src/utils/validation.js";
 import { WALLET_EMAIL_OTP_UNLOCK_OPERATION, isWalletEmailOtpLoginOperation, isWalletUnlockBackend } from "../../../shared-ts/src/utils/emailOtpDomain.js";
 //#region src/router/domains/emailOtp/emailOtpRequestValidation.ts
 function parseWalletUnlockBackend(raw) {

package/dist/esm/router/domains/passkeyCustody/passkeyCustodyEnvelopeRetrieval.js

@@ -84,14 +84,8 @@ async function retrievePasskeyCustodyEnvelope(input) {
 			envelope: lookup.envelope,
 			storeVersion: lookup.storeVersion
 		};
-		case "retired": return {
-			kind: "retired",
-			retiredAtMs: lookup.retiredAtMs
-		};
-		case "revoked": return {
-			kind: "revoked",
-			revokedAtMs: lookup.revokedAtMs
-		};
+		case "retired": return { kind: "retired" };
+		case "revoked": return { kind: "revoked" };
 		case "digest_mismatch":
 			input.logger.error("[passkey-custody] stored envelope failed its ciphertext digest", {
 				walletId: String(request.locator.walletId),

package/dist/esm/router/domains/passkeyCustody/walletCustodyRegistrationCommit.js

@@ -150,14 +150,8 @@ async function commitWalletCustodyRegistration(input) {
 			envelopeStoreVersion: stored.envelopeStoreVersion,
 			recoverySetStoreVersion: stored.recoverySetStoreVersion
 		};
-		case "already_exists": return {
-			kind: "already_exists",
-			key: stored.key
-		};
-		case "custody_already_established": return {
-			kind: "custody_already_established",
-			walletId: stored.walletId
-		};
+		case "already_exists": return { kind: "already_exists" };
+		case "custody_already_established": return { kind: "custody_already_established" };
 		case "inconsistent": return {
 			kind: "rejected",
 			reason: stored.reason

package/dist/esm/router/domains/signingOperations/routerAbPrivateSigningWorker.js

@@ -47,18 +47,6 @@ function registrationMaterialSourceV1(input) {
 		}
 	};
 }
-function routerAbNormalSigningMaterialSourceFromActiveLaneV1(input) {
-	const groupPublicKey = input.groupPublicKey.trim();
-	if (groupPublicKey.length === 0) throw new Error("active lane group public key is required");
-	return {
-		kind: "rotatable_lane",
-		lookup: {
-			identity: input.identity,
-			admittedLaneIdentityDigestB64u: input.admittedLaneIdentityDigestB64u
-		},
-		group_public_key: groupPublicKey
-	};
-}
 function nonEmptyString(value) {
 	return String(value || "").trim();
 }
@@ -395,7 +383,7 @@ async function buildRouterAbEd25519PrivateSigningWorkerBody(input) {
 	const scope = parseRouterAbEd25519NormalSigningScopeV2(input.body.scope);
 	const signingContext = privateSigningAuthorizationContext(scope, input.authorization);
 	const trustedSourceDigest = await privateSigningTrustedSourceDigest(input.headers);
-	const materialSource = input.materialSource ?? registrationMaterialSourceV1({
+	const materialSource = registrationMaterialSourceV1({
 		accountId: scope.account_id,
 		materialActivationId: scope.material_activation.activation_id,
 		signingWorkerId: scope.signing_worker_id
@@ -490,8 +478,7 @@ async function buildRouterAbEcdsaDerivationPrivateSigningWorkerBody(input) {
 			request,
 			requestDigest: await routerAbEcdsaDerivationEvmDigestSigningRequestDigestV1(request),
 			signingContext,
-			trustedSourceDigest,
-			materialSource: input.materialSource
+			trustedSourceDigest
 		});
 	}
 	const request = parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1(input.body);
@@ -500,8 +487,7 @@ async function buildRouterAbEcdsaDerivationPrivateSigningWorkerBody(input) {
 		request,
 		requestDigest: await routerAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestDigestV1(request),
 		signingContext,
-		trustedSourceDigest,
-		materialSource: input.materialSource
+		trustedSourceDigest
 	});
 }
 function privateEcdsaDerivationSigningWorkerBody(input) {
@@ -514,7 +500,7 @@ function privateEcdsaDerivationSigningWorkerBody(input) {
 			intentDigest: input.requestDigest,
 			trustedSourceDigest: input.trustedSourceDigest
 		}),
-		material_source: input.materialSource ?? registrationMaterialSourceV1({
+		material_source: registrationMaterialSourceV1({
 			accountId: input.request.scope.wallet_id,
 			materialActivationId: input.request.scope.material_activation.activation_id,
 			signingWorkerId: input.request.scope.signing_worker.server_id
@@ -544,6 +530,6 @@ async function postRouterAbSigningWorkerJson(input) {
 	};
 }
 //#endregion
-export { ROUTER_AB_ECDSA_DERIVATION_PRIVATE_SIGNING_PATHS, ROUTER_AB_ED25519_PRIVATE_SIGNING_PATHS, buildRouterAbEcdsaDerivationPrivateSigningWorkerBody, buildRouterAbEd25519PrivateSigningWorkerBody, computeRouterAbEd25519NormalSigningAdmissionMaterial, isRouterAbEcdsaSigningWorkerOperationInProgress, parseRouterAbEd25519NormalSigningScopeV2, postRouterAbSigningWorkerJson, replayResponseFromSigningWorkerResult, requirePrivateSigningDigest, routerAbNormalSigningMaterialSourceFromActiveLaneV1 };
+export { ROUTER_AB_ECDSA_DERIVATION_PRIVATE_SIGNING_PATHS, ROUTER_AB_ED25519_PRIVATE_SIGNING_PATHS, buildRouterAbEcdsaDerivationPrivateSigningWorkerBody, buildRouterAbEd25519PrivateSigningWorkerBody, computeRouterAbEd25519NormalSigningAdmissionMaterial, isRouterAbEcdsaSigningWorkerOperationInProgress, parseRouterAbEd25519NormalSigningScopeV2, postRouterAbSigningWorkerJson, replayResponseFromSigningWorkerResult, requirePrivateSigningDigest };
 
 //# sourceMappingURL=routerAbPrivateSigningWorker.js.map

package/dist/esm/router/domains/signingOperations/walletExecutionAdmission.js

@@ -1,8 +1,8 @@
 import { mpcMaterialActivationRefsEqual } from "../../../shared-ts/src/utils/domainIds.js";
 import { CAPABILITY_KINDS, EVM_ECDSA_MPC_OPERATION_KINDS, NEAR_ED25519_MPC_OPERATION_KINDS } from "../../../shared-ts/src/authorization/capabilityKinds.js";
 import { buildWalletSessionCapabilitySubjectsV1, walletSessionCapabilitySubjectsV1Equal } from "../../../authorization/domain.js";
-import { computeOwnerLaneParticipantBindingDigestV1 } from "../../../shared-ts/src/signing-lanes/ownerContinuity.js";
 import { buildPreparedOwnerWalletExecution } from "../../../shared-ts/src/signing-lanes/execution.js";
+import { computeOwnerLaneParticipantBindingDigestV1 } from "../../../shared-ts/src/signing-lanes/ownerContinuity.js";
 import "../../../shared-ts/src/signing-lanes/index.js";
 //#region src/router/domains/signingOperations/walletExecutionAdmission.ts
 function validateWalletSessionAuthorizationV2Context(input) {
@@ -74,8 +74,7 @@ function resolveWalletSessionAuthorizationV2AdministrationAdmission(input) {
 			if (!subject || subject.authorityId !== input.authority.authorityId) return admissionRefused("capability_subject_mismatch");
 			return {
 				ok: true,
-				operationKind: "link_devices",
-				authorityId: input.authority.authorityId
+				operationKind: "link_devices"
 			};
 		}
 		default: return assertNeverWalletSessionAuthorizationV2AdministrationOperation(input.operation.kind);

package/dist/esm/router/domains/walletRegistration/walletRegistrationReservation.js

@@ -0,0 +1,70 @@
+import { parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId } from "../../../shared-ts/src/utils/domainIds.js";
+import { parseDeviceId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
+import { alphabetizeStringify, sha256HexUtf8 } from "../../../shared-ts/src/utils/digests.js";
+import { isPlainObject, requireCanonicalString } from "../../../shared-ts/src/utils/validation.js";
+import { secureRandomBase64Url } from "../../../shared-ts/src/utils/secureRandomId.js";
+import { createServerAllocatedWalletId } from "../../../shared-ts/src/utils/registrationIds.js";
+//#region src/router/domains/walletRegistration/walletRegistrationReservation.ts
+function requireId(result) {
+	if (!result.ok) throw new Error(result.error.message);
+	return result.value;
+}
+function parseWalletRegistrationSetupReservation(raw) {
+	if (!isPlainObject(raw)) throw new Error("Registration reservation is invalid");
+	const ceremonyId = requireCanonicalString(raw.ceremonyId, "ceremonyId");
+	const preparationId = requireCanonicalString(raw.preparationId, "preparationId");
+	if (!/^wrc_[A-Za-z0-9_-]{43}$/u.test(ceremonyId) || !/^regprep_[A-Za-z0-9_-]{43}$/u.test(preparationId)) throw new Error("Registration reservation ceremony identity is invalid");
+	const reservedAtMs = raw.reservedAtMs;
+	if (typeof reservedAtMs !== "number" || !Number.isSafeInteger(reservedAtMs) || reservedAtMs <= 0) throw new Error("Registration reservation timestamp is invalid");
+	return {
+		walletId: requireId(parseWalletId(raw.walletId)),
+		ceremonyId,
+		preparationId,
+		walletAuthorityId: requireId(parseWalletAuthorityId(raw.walletAuthorityId)),
+		deviceId: requireId(parseDeviceId(raw.deviceId)),
+		walletAuthMethodId: requireId(parseWalletAuthMethodId(raw.walletAuthMethodId)),
+		reservedAtMs
+	};
+}
+function proposeWalletRegistrationSetup(input) {
+	return parseWalletRegistrationSetupReservation({
+		walletId: input.request.wallet?.kind === "provided" ? input.request.wallet.walletId : createServerAllocatedWalletId(),
+		ceremonyId: `wrc_${secureRandomBase64Url(32)}`,
+		preparationId: `regprep_${secureRandomBase64Url(32)}`,
+		walletAuthorityId: `wallet-authority:${secureRandomBase64Url(32)}`,
+		deviceId: `device:${secureRandomBase64Url(32)}`,
+		walletAuthMethodId: `wallet-auth-method:${secureRandomBase64Url(32)}`,
+		reservedAtMs: Date.now()
+	});
+}
+async function walletRegistrationSetupRequestDigest(namespace, input) {
+	if (!input.runtimePolicyScope || input.runtimePolicyScope.orgId !== input.orgId) throw new Error("Registration reservation requires an exact authenticated tenant scope");
+	return sha256HexUtf8(alphabetizeStringify({
+		namespace,
+		runtimePolicyScope: input.runtimePolicyScope,
+		expectedOrigin: input.expectedOrigin,
+		wallet: input.request.wallet ?? { kind: "server_allocated" },
+		authMethod: input.request.authMethod,
+		signerSelection: input.request.signerSelection
+	}));
+}
+async function completeRegistrationReservation(authority, input) {
+	if (!authority) return {
+		ok: false,
+		code: "registration_authority_unavailable",
+		message: "Registration reservation authority is required"
+	};
+	return authority.complete(input);
+}
+async function admitRegistrationReservationHome(authority, input) {
+	if (!authority) return {
+		ok: false,
+		code: "registration_authority_unavailable",
+		message: "Registration reservation authority is required"
+	};
+	return authority.admitHome(input);
+}
+//#endregion
+export { admitRegistrationReservationHome, completeRegistrationReservation, parseWalletRegistrationSetupReservation, proposeWalletRegistrationSetup, walletRegistrationSetupRequestDigest };
+
+//# sourceMappingURL=walletRegistrationReservation.js.map

package/dist/esm/router/domains/walletRegistration/walletRegistrationRoutes.js

@@ -4,7 +4,6 @@ import { base64UrlDecode } from "../../../shared-ts/src/utils/base64.js";
 import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { base58Encode } from "../../../shared-ts/src/utils/base58.js";
 import "../../../shared-ts/src/utils/encoders.js";
-import { deriveImplicitNearAccountIdFromEd25519PublicKey, parseImplicitNearAccountId } from "../../../shared-ts/src/utils/near.js";
 import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
 import { ecdsaClientRootPublicKey33B64uFromString } from "../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { normalizeRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
@@ -15,6 +14,7 @@ import { normalizeCorsOrigin } from "../../../core/SessionService.js";
 import { thresholdEcdsaChainTargetFromValue } from "../../../core/thresholdEcdsaChainTarget.js";
 import { walletIdFromString } from "../../../shared-ts/src/utils/registrationIds.js";
 import { parseRouterAbTraceContextV1 } from "../../../shared-ts/src/utils/routerAbTraceContext.js";
+import { parseRegistrationSetupOperationId } from "../../../shared-ts/src/utils/registrationSetupOperation.js";
 import { extractBearerCredential, extractRouterApiEnvironmentId } from "../../auth/routerApiKeyAuth.js";
 import { resolvePublishableKeyApiCredentialAuth } from "../../auth/routerApiCredentialAuth.js";
 import { resolveActiveRuntimePolicyScopeForEnvironment, resolveWalletSessionAdministrationAdmission, resolveWalletSessionOperationCredentialAdmission, resolveWalletSessionOperationCredentialAdmissionFromContext } from "../../auth/commonRouterUtils.js";
@@ -24,6 +24,7 @@ import { parsePasskeyCustodyEnvelopeRecord } from "../../../shared-ts/src/passke
 import "../../../shared-ts/src/passkey-custody/index.js";
 import { verifyWalletRegistrationSetupClaims } from "./walletRegistrationSetupPayload.js";
 import { computeWalletEcdsaKeyFactsInventoryChallengeDigestB64u } from "../../../shared-ts/src/utils/ecdsaKeyFactsInventory.js";
+import { deriveImplicitNearAccountIdFromEd25519PublicKey, parseImplicitNearAccountId } from "../../../shared-ts/src/utils/near.js";
 import { normalizeRegistrationSignerPlan, registrationSignerSetSelectionFromPlan } from "../../../shared-ts/src/utils/registrationSignerPlan.js";
 import { addAuthMethodIntentGrantFromString, addSignerIntentGrantFromString, computeAddAuthMethodIntentDigestB64u, computeAddSignerIntentDigestB64u, normalizeAddAuthMethodIntentCaller } from "../../../shared-ts/src/utils/registrationIntent.js";
 //#region src/router/domains/walletRegistration/walletRegistrationRoutes.ts
@@ -326,6 +327,12 @@ function parseWalletRegistrationSetupWallet(raw) {
 	};
 }
 function parseWalletRegistrationSetupRequest(body) {
+	const registrationOperationId = parseRegistrationSetupOperationId(body.registrationOperationId);
+	if (!registrationOperationId) return {
+		ok: false,
+		code: "invalid_body",
+		message: "registrationOperationId is required"
+	};
 	const signerSelection = parseRegistrationSignerSet(body.signerSelection);
 	if (!signerSelection.ok) return signerSelection;
 	const authMethod = normalizeRegistrationAuthMethodInput(body.authMethod);
@@ -339,6 +346,7 @@ function parseWalletRegistrationSetupRequest(body) {
 	return {
 		ok: true,
 		value: {
+			registrationOperationId,
 			...wallet.value ? { wallet: wallet.value } : {},
 			signerSelection: signerSelection.value.selection,
 			authMethod
@@ -1556,14 +1564,6 @@ async function handleRouterApiWalletAddSignerIntent(input) {
 	});
 	return routeJson(result.ok ? 200 : 400, result);
 }
-/**
-* `POST /wallets/register/setup` — the single admitted entry point that
-* replaces the bootstrap grant, the intent, and start.
-*
-* Authentication is the same API-credential plane the intent route used, so
-* origin and environment binding are unchanged; what is gone is the stored
-* grant that used to sit between the check and its only reader.
-*/
 async function handleRouterApiWalletRegistrationSetup(input) {
 	if (!isPlainObject(input.body)) return routeError(400, "invalid_body", "JSON body required");
 	const origin = normalizeCorsOrigin(input.origin);
@@ -1606,7 +1606,7 @@ async function handleRouterApiWalletRegistrationSetup(input) {
 	if (!session) return routeError(500, "internal", "wallet registration setup requires session signing");
 	const request = parseWalletRegistrationSetupRequest(input.body);
 	if (!request.ok) return routeError(400, request.code, request.message);
-	const result = await input.services.walletRegistration.setupWalletRegistration({
+	return input.services.walletRegistration.setupWalletRegistration({
 		request: request.value,
 		orgId: principal.orgId,
 		expectedOrigin: origin,
@@ -1617,7 +1617,6 @@ async function handleRouterApiWalletRegistrationSetup(input) {
 			signingRootVersion: runtimePolicyScope.signingRootVersion
 		} : {}
 	});
-	return routeJson(result.ok ? 200 : 400, result);
 }
 /**
 * `POST /wallets/register/respond` — the authenticated leg.

package/dist/esm/router/domains/walletRegistration/walletRegistrationSetupPayload.js

@@ -2,14 +2,13 @@ import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../shared-ts/src/utils/digests.js";
 import "../../../shared-ts/src/utils/encoders.js";
 import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
-import "../../../shared-ts/src/utils/validation.js";
 import { normalizeRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
 //#region src/router/domains/walletRegistration/walletRegistrationSetupPayload.ts
 /**
 * The opaque payload `/wallets/register/setup` mints and routes 2 and 3 verify.
 *
-* Setup admits the application, allocates the wallet, and runs the Router
-* preparation in one request. Routes 2 and 3 then need to know that the
+* Setup admits the application, reserves the wallet, and persists the initial
+* preparation facts in one request. Routes 2 and 3 then need to know that the
 * ceremony they are being driven with is the one setup admitted, and with the
 * parameters setup admitted — without paying another storage round trip to
 * find out. The client carries this string and never parses it.

package/dist/esm/router/domains/walletUnlock/walletUnlockRouteHandlers.js

@@ -454,6 +454,20 @@ async function handleWalletUnlockChallengeRoute(input) {
 		orgId: body.orgId,
 		ttlMs: body.ttlMs
 	});
+	if (!result.ok && result.code === "wallet_home_unavailable") return {
+		status: 503,
+		body: {
+			...result,
+			unlockBackend
+		}
+	};
+	if (!result.ok && result.code === "wallet_home_conflict") return {
+		status: 409,
+		body: {
+			...result,
+			unlockBackend
+		}
+	};
 	return {
 		status: result.ok ? 200 : result.code === "internal" ? 500 : 400,
 		body: {