@seams/wallet-server 0.7.3 → 0.8.0

package/dist/types/wallet-server/src/router/cloudflare/runtime/walletConsoleOpsClient.d.ts

@@ -1,3 +1,4 @@
+import type { RouterApiWalletProjectionAdapter } from '../../framework/routerApi';
 import type { RouterApiKeyAuthAdapter, RouterApiPublishableKeyAuthAdapter, RouterApiProjectEnvironmentResolver, RouterApiUsageMeterAdapter } from '../../framework/apiCredentialPorts';
 import { type WalletConsoleTenantRootActiveLineageResolverV1 } from './walletConsoleOps';
 /** The shape of a Cloudflare service binding (`Fetcher`). */
@@ -8,6 +9,7 @@ export interface WalletConsoleOpsClient {
     readonly apiKeyAuth: RouterApiKeyAuthAdapter;
     readonly publishableKeyAuth: RouterApiPublishableKeyAuthAdapter;
     readonly usageMeter: RouterApiUsageMeterAdapter;
+    readonly walletProjection: RouterApiWalletProjectionAdapter;
     readonly projectEnvironments: RouterApiProjectEnvironmentResolver;
     readonly tenantRootActiveLineage: WalletConsoleTenantRootActiveLineageResolverV1;
 }

package/dist/types/wallet-server/src/router/cloudflare/runtime/walletGateway.d.ts

@@ -17,7 +17,7 @@ export declare function walletConsoleSignedDelegateRouteDefinitionV1(routePath:
 export declare function walletConsoleSponsoredEvmCallRouteDefinitionV1(routePath?: string): RouteDefinition;
 export declare function walletConsoleRelayRouteDefinitionsV1(): readonly RouteDefinition[];
 export declare function createWalletConsoleRelayProxyExtensionV1(binding: WalletConsoleServiceBinding): RouterApiRouteExtension;
-type WalletGatewayManagedRouterOption = 'apiKeyAuth' | 'publishableKeyAuth' | 'apiKeyUsageMeter' | 'orgProjectEnv' | 'routerAbNormalSigningAdmission' | 'routeExtensions';
+type WalletGatewayManagedRouterOption = 'apiKeyAuth' | 'publishableKeyAuth' | 'apiKeyUsageMeter' | 'walletProjection' | 'orgProjectEnv' | 'routerAbNormalSigningAdmission' | 'routeExtensions';
 export interface CloudflareWalletGatewayRouterOptionsV1 {
     readonly service: Parameters<typeof createCloudflareRouter>[0];
     readonly walletConsole: WalletConsoleServiceBinding;

package/dist/types/wallet-server/src/router/cloudflare/runtime/walletRuntimeOps.d.ts

@@ -31,10 +31,13 @@ export interface WalletRuntimeWalletIdentityRequest {
     readonly wallets: readonly {
         readonly walletId: string;
         readonly projectId: string;
+        readonly envId: string;
     }[];
 }
 export interface WalletRuntimeWalletIdentity {
     readonly walletId: string;
+    readonly projectId: string;
+    readonly envId: string;
     readonly nearAccountId: string;
     readonly evmAddress: `0x${string}`;
 }

package/dist/types/wallet-server/src/router/cloudflare-adaptor.d.ts

@@ -46,7 +46,6 @@ export { extractBearerCredential, extractRouterApiEnvironmentId, resolveSourceIp
 export { createCloudflareRouter } from './cloudflare/runtime/createCloudflareRouter';
 export type { SelfHostedCloudflareSigningWorkerFactoryInput } from './cloudflare/runtime/createSelfHostedCloudflareSigningWorker';
 export { createSelfHostedCloudflareSigningRouter, createSelfHostedCloudflareSigningWorker, } from './cloudflare/runtime/createSelfHostedCloudflareSigningWorker';
-export { ThresholdStoreDurableObject } from './cloudflare/durableObjects/thresholdStore';
 export { CloudflareDurableObjectVersionedJsonRecordStore, CloudflareVersionedJsonRecordStoreError, createCloudflareDurableObjectVersionedJsonRecordStore, } from './cloudflare/durableObjects/versionedJsonRecordStore';
 export type { CloudflareVersionedJsonRecordStoreOptions } from './cloudflare/durableObjects/versionedJsonRecordStore';
 export type { VersionedJsonObject, VersionedJsonRecordPutResult, VersionedJsonRecordReadResult, VersionedJsonValue, } from './framework/versionedJsonRecordStore';

package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.d.ts

@@ -8,7 +8,7 @@ import { InMemoryRouterAbEd25519YaoRegistrationStateV1, type RouterAbEd25519YaoR
 import { InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationStateV1, type RouterAbEd25519YaoVerifiedActivationIntentV1, type RouterAbEd25519YaoRegistrationIntentBindingResult } from '../registration/routerAbEd25519YaoRegistrationIntentAuthorization';
 import { type RouterApiModule } from '../../../framework/modules';
 import type { MpcWalletSigningQuotaId, WalletSessionAuthorizationId, WalletSessionId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
-import type { ThresholdEd25519SessionId } from '../../../../../../shared-ts/src/utils/domainIds';
+import { type ThresholdEd25519SessionId } from '../../../../../../shared-ts/src/utils/domainIds';
 import { type RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
 import type { WalletAuthAuthority } from '../../../../../../shared-ts/src/utils/walletAuthAuthority';
 import type { WalletSessionOperationCredentialV1 } from '../../../../../../shared-ts/src/device-linking';

package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitioning.d.ts

@@ -16,8 +16,8 @@ export type RouterAbEd25519YaoProductRegistrationSharedStateV1 = {
     readonly recoveryCapabilities: ReadonlyMap<string, RecoveryCapabilityState>;
     readonly recoveryIdentityCapabilities: ReadonlyMap<string, string>;
     readonly recoverySessions: ReadonlyMap<string, string>;
-    readonly exportAuthorizationNonces: ReadonlySet<string>;
-    readonly exportAuthorizationUncertain: ReadonlySet<string>;
+    readonly exportAuthorizationNonceOwners: ReadonlyMap<string, string>;
+    readonly exportAuthorizationUncertainOwners: ReadonlyMap<string, string>;
 };
 export type RouterAbEd25519YaoProductRegistrationCeremonyStateV1 = {
     readonly kind: 'router_ab_ed25519_yao_product_registration_ceremony_state_v1';

package/dist/types/wallet-server/src/router/domains/ed25519Yao/export/routerAbEd25519YaoExport.d.ts

@@ -225,8 +225,8 @@ type ExportCompletedState = ExportAuthorizationContext & {
 type ExportLifecycleState = ExportAuthorizedState | ExportAdmittingState | ExportAdmissionFailedState | ExportAdmittedState | ExportExecutingState | ExportExecutionFailedState | ExportCompletedState;
 export declare class InMemoryRouterAbEd25519YaoExportStateV1 {
     readonly exports: Map<string, ExportLifecycleState>;
-    readonly authorizationNonces: Set<string>;
-    readonly authorizationUncertain: Set<string>;
+    readonly authorizationNonceOwners: Map<string, string>;
+    readonly authorizationUncertainOwners: Map<string, string>;
 }
 export declare class InMemoryRouterAbEd25519YaoExportService implements RouterAbEd25519YaoExportService {
     private readonly backend;

package/dist/types/wallet-server/src/router/domains/ed25519Yao/export/routerAbEd25519YaoExport.typecheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=routerAbEd25519YaoExport.typecheck.d.ts.map

package/dist/types/wallet-server/src/router/domains/ed25519Yao/export/routerAbEd25519YaoExportRequestScopedCloudflare.d.ts

@@ -1,7 +1,9 @@
+import { type WalletLifecycleRoutingPublisher } from '../../../../authorization/lifecycleRouting';
 import { type RouterAbEd25519YaoExportAuthorizationAdapter, type RouterAbEd25519YaoExportBackend } from './routerAbEd25519YaoExport';
 import type { RouterAbEd25519YaoActiveCapabilityResolverV1 } from '../recovery/routerAbEd25519YaoRecovery';
 import type { RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1 } from '../capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore';
 export type RouterAbEd25519YaoExportRequestScopedCloudflareInputV1 = {
+    readonly lifecycleRouting?: WalletLifecycleRoutingPublisher;
     readonly request: Request;
     readonly store: RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1;
     readonly backend: RouterAbEd25519YaoExportBackend;

package/dist/types/wallet-server/src/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryRequestScopedCloudflare.d.ts

@@ -1,7 +1,9 @@
+import { type WalletLifecycleRoutingPublisher } from '../../../../authorization/lifecycleRouting';
 import { type RouterAbEd25519YaoCapabilityPersistenceV1, type RouterAbEd25519YaoRecoveryAuthorizationAdapter, type RouterAbEd25519YaoRecoveryBackend, type RouterAbEd25519YaoActiveCapabilityResolverV1, type WarmBootstrapLinkedEd25519AuthorityReaderV1 } from './routerAbEd25519YaoRecovery';
 export type { WarmBootstrapLinkedEd25519AuthorityReaderV1 } from './routerAbEd25519YaoRecovery';
 import type { RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1 } from '../capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore';
 export type RouterAbEd25519YaoRecoveryRequestScopedCloudflareInputV1 = {
+    readonly lifecycleRouting?: WalletLifecycleRoutingPublisher;
     readonly request: Request;
     readonly store: RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1;
     readonly backend: RouterAbEd25519YaoRecoveryBackend;

package/dist/types/wallet-server/src/router/domains/passkeyCustody/passkeyCustodyEnvelopeRetrieval.d.ts

@@ -60,10 +60,8 @@ export type PasskeyCustodyEnvelopeRetrievalResult = {
     readonly kind: 'credential_mismatch';
 } | {
     readonly kind: 'retired';
-    readonly retiredAtMs: number;
 } | {
     readonly kind: 'revoked';
-    readonly revokedAtMs: number;
 } | {
     readonly kind: 'missing';
 } | {

package/dist/types/wallet-server/src/router/domains/passkeyCustody/walletCustodyRegistrationCommit.d.ts

@@ -1,5 +1,4 @@
 import { type WalletCustodyCeremonyCommitPayload } from '../../../../../shared-ts/src/passkey-custody';
-import { type WalletId } from '../../../../../shared-ts/src/utils/domainIds';
 export type { WalletCustodyCeremonyCommitPayload };
 import type { CloudflareD1WalletCustodyCommitStore, WalletCustodyRegistrationCommitResult } from '../../cloudflare/d1/passkeyCustody/d1WalletCustodyCommitStore';
 export type WalletCustodyRegistrationCommitOutcome = ({
@@ -8,7 +7,6 @@ export type WalletCustodyRegistrationCommitOutcome = ({
     kind: 'committed';
 }>, 'kind'>) | {
     readonly kind: 'already_exists';
-    readonly key: string;
 }
 /**
  * Another ceremony established this wallet's custody first. The route should
@@ -17,7 +15,6 @@ export type WalletCustodyRegistrationCommitOutcome = ({
  */
  | {
     readonly kind: 'custody_already_established';
-    readonly walletId: WalletId;
 } | {
     readonly kind: 'rejected';
     readonly reason: string;

package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbPrivateSigningWorker.d.ts

@@ -1,7 +1,6 @@
 import type { RouterAbSigningWorkerPrivateTransport } from '../../../core/routerAbSigning/RouterAbNormalSigningRuntime';
 import { type RouterAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestV1Wire, type RouterAbEcdsaDerivationEvmDigestSigningRequestV1Wire, type RouterAbPublicDigest32V1Wire } from '../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
 import type { RuntimePolicyScope } from '../../../../../shared-ts/src/threshold/signingRootScope';
-import type { SigningWorkerLaneMaterialIdentityV1 } from '../../../core/signingLanes/signingWorkerLaneMaterialIdentity';
 import type { AuthorizedOperationReplayResponse } from '../../../authorization/domain';
 import type { RouterAbNormalSigningAuthorizationWire } from '../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
 import type { MpcMaterialActivationId } from '../../../../../shared-ts/src/utils/domainIds';
@@ -146,20 +145,7 @@ export type RouterAbNormalSigningMaterialSourceV1 = {
         readonly material_activation_id: string;
         readonly signing_worker_id: string;
     };
-    readonly group_public_key?: never;
-} | {
-    readonly kind: 'rotatable_lane';
-    readonly lookup: {
-        readonly identity: SigningWorkerLaneMaterialIdentityV1;
-        readonly admittedLaneIdentityDigestB64u: string;
-    };
-    readonly group_public_key: string;
 };
-export declare function routerAbNormalSigningMaterialSourceFromActiveLaneV1(input: {
-    readonly identity: SigningWorkerLaneMaterialIdentityV1;
-    readonly admittedLaneIdentityDigestB64u: string;
-    readonly groupPublicKey: string;
-}): RouterAbNormalSigningMaterialSourceV1;
 export declare function replayResponseFromSigningWorkerResult(result: RouterAbSigningWorkerJsonResult): AuthorizedOperationReplayResponse;
 export declare function isRouterAbEcdsaSigningWorkerOperationInProgress(result: RouterAbSigningWorkerJsonResult): boolean;
 export declare function parseRouterAbEd25519NormalSigningScopeV2(value: unknown): RouterAbEd25519NormalSigningScopeV2;
@@ -177,7 +163,6 @@ type RouterAbEd25519PrivateSigningWorkerBuildInput = {
     readonly body: Record<string, unknown>;
     readonly authorization: RouterAbPrivateSigningAuthorization;
     readonly headers: Record<string, string | string[] | undefined>;
-    readonly materialSource?: RouterAbNormalSigningMaterialSourceV1;
     readonly effectClaim?: never;
 } | {
     readonly phase: 'finalize';
@@ -185,7 +170,6 @@ type RouterAbEd25519PrivateSigningWorkerBuildInput = {
     readonly authorization: RouterAbPrivateSigningAuthorization;
     readonly headers: Record<string, string | string[] | undefined>;
     readonly effectClaim: RouterAbNormalSigningEffectClaimV1;
-    readonly materialSource?: RouterAbNormalSigningMaterialSourceV1;
 };
 export declare function buildRouterAbEd25519PrivateSigningWorkerBody(input: RouterAbEd25519PrivateSigningWorkerBuildInput): Promise<RouterAbEd25519PrivateSigningWorkerBody>;
 export declare function buildRouterAbEcdsaDerivationPrivateSigningWorkerBody(input: {
@@ -193,7 +177,6 @@ export declare function buildRouterAbEcdsaDerivationPrivateSigningWorkerBody(inp
     body: Record<string, unknown>;
     authorization: RouterAbPrivateSigningAuthorization;
     headers: Record<string, string | string[] | undefined>;
-    materialSource?: RouterAbNormalSigningMaterialSourceV1;
 }): Promise<RouterAbEcdsaDerivationPrivateSigningWorkerBody>;
 export type RouterAbEcdsaOperationStepUpRequest = RouterAbEcdsaDerivationEvmDigestSigningRequestV1Wire | RouterAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestV1Wire;
 export declare function postRouterAbSigningWorkerJson(input: {

package/dist/types/wallet-server/src/router/domains/signingOperations/walletExecutionAdmission.d.ts

@@ -1,7 +1,7 @@
 import { EVM_ECDSA_MPC_OPERATION_KINDS, NEAR_ED25519_MPC_OPERATION_KINDS } from '../../../../../shared-ts/src/authorization/capabilityKinds';
 import { type LaneParticipantBindingDigestB64u, type PreparedOwnerWalletExecution, type SigningLaneRecord, type WalletKeyRecord } from '../../../../../shared-ts/src/signing-lanes';
 import { type DigestB64u } from '../../../../../shared-ts/src/utils/canonicalPrimitives';
-import { type MpcMaterialActivationRef, type WalletAuthorityId, type WalletId, type WalletKeyId } from '../../../../../shared-ts/src/utils/domainIds';
+import { type MpcMaterialActivationRef, type WalletId, type WalletKeyId } from '../../../../../shared-ts/src/utils/domainIds';
 import type { ActiveWalletAuthorityV1 } from '../../../../../shared-ts/src/authorization/walletAuthority';
 import type { ExactAdministeredEcdsaSignerV1, ExactAdministeredEd25519SignerV1 } from '../../../../../shared-ts/src/device-linking/delegatedActivationPlan';
 import type { WalletAuthMethodRecordV2 } from '../../../../../shared-ts/src/utils/walletAuthMethodRecord';
@@ -68,7 +68,6 @@ export type WalletSessionAuthorizationV2AdmissionResult = ({
 export type WalletSessionAuthorizationV2AdministrationAdmissionResult = {
     readonly ok: true;
     readonly operationKind: 'link_devices';
-    readonly authorityId: WalletAuthorityId;
 } | {
     readonly ok: false;
     readonly error: WalletSessionAuthorizationV2AdmissionError;

package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationInputs.d.ts

@@ -6,6 +6,7 @@ import type { WalletRegistrationAuthorityInput, WalletRegistrationFinalizeSigner
 import type { ThresholdRuntimePolicyScope } from '../../../core/types';
 import type { WalletRegistrationSetupMinter, WalletRegistrationSetupVerifier } from './walletRegistrationSetupPayload';
 export type WalletRegistrationSetupRequest = {
+    readonly registrationOperationId: string;
     readonly wallet?: RegisterWalletInput;
     readonly signerSelection: RegistrationSignerSetSelection;
     readonly authMethod: RegistrationAuthMethodInput;

package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationReservation.d.ts

@@ -0,0 +1,51 @@
+import { type DeviceId } from '../../../../../shared-ts/src/authorization/capabilityKinds';
+import { type WalletAuthorityId, type WalletAuthMethodId, type WalletId } from '../../../../../shared-ts/src/utils/domainIds';
+import type { WalletRegistrationSetupInput } from './walletRegistrationInputs';
+export type WalletRegistrationSetupReservation = {
+    readonly walletId: WalletId;
+    readonly ceremonyId: string;
+    readonly preparationId: string;
+    readonly walletAuthorityId: WalletAuthorityId;
+    readonly deviceId: DeviceId;
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly reservedAtMs: number;
+};
+export type WalletRegistrationSetupReservationResult = {
+    readonly ok: true;
+    readonly reservation: WalletRegistrationSetupReservation;
+    readonly lifecycle: 'reserved' | 'established';
+    readonly code?: never;
+    readonly message?: never;
+} | {
+    readonly ok: false;
+    readonly code: string;
+    readonly message: string;
+    readonly reservation?: never;
+    readonly lifecycle?: never;
+};
+type ReservationOutcome = {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly code: string;
+    readonly message: string;
+};
+export interface WalletRegistrationReservationAuthority {
+    reserve(input: WalletRegistrationSetupInput): Promise<WalletRegistrationSetupReservationResult>;
+    admitHome(input: {
+        readonly ceremonyId: string;
+        readonly walletId: WalletId;
+    }): Promise<ReservationOutcome>;
+    complete(input: {
+        readonly ceremonyId: string;
+        readonly walletId: WalletId;
+        readonly outcome: 'established' | 'cancelled';
+    }): Promise<ReservationOutcome>;
+}
+export declare function parseWalletRegistrationSetupReservation(raw: unknown): WalletRegistrationSetupReservation;
+export declare function proposeWalletRegistrationSetup(input: WalletRegistrationSetupInput): WalletRegistrationSetupReservation;
+export declare function walletRegistrationSetupRequestDigest(namespace: string, input: WalletRegistrationSetupInput): Promise<string>;
+export declare function completeRegistrationReservation(authority: WalletRegistrationReservationAuthority | null, input: Parameters<WalletRegistrationReservationAuthority['complete']>[0]): Promise<ReservationOutcome>;
+export declare function admitRegistrationReservationHome(authority: WalletRegistrationReservationAuthority | null, input: Parameters<WalletRegistrationReservationAuthority['admitHome']>[0]): Promise<ReservationOutcome>;
+export {};
+//# sourceMappingURL=walletRegistrationReservation.d.ts.map

package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationRoutes.d.ts

@@ -1,4 +1,4 @@
-import type { WalletRegistrationNearProvisioningResponseV2, WalletRegistrationNearAdmissionResponseV2, WalletRegistrationActivateRouteResponseV2, WalletRegistrationRespondResponseV2, WalletRegistrationSetupResponseV2 } from '../../../core/threeRouteRegistrationContracts';
+import type { WalletRegistrationNearProvisioningResponseV2, WalletRegistrationNearAdmissionResponseV2, WalletRegistrationActivateRouteResponseV2, WalletRegistrationRespondResponseV2 } from '../../../core/threeRouteRegistrationContracts';
 import type { RouterApiPublishableKeyAuthAdapter } from '../../framework/routerApi';
 import type { RouterApiAuthorizationSessionService, RouterApiWalletRegistrationRouteService } from '../../framework/authServicePort';
 import type { FundImplicitNearAccountResult } from '../../../core/types';
@@ -33,15 +33,7 @@ type RouterApiWalletRegistrationInput = {
     signingSessionSeal?: SigningSessionSealRoutesOptions | null;
 };
 export declare function handleRouterApiWalletAddSignerIntent(input: RouterApiWalletRegistrationInput): Promise<RouteResponse<CreateAddSignerIntentResponse | RouteErrorBody>>;
-/**
- * `POST /wallets/register/setup` — the single admitted entry point that
- * replaces the bootstrap grant, the intent, and start.
- *
- * Authentication is the same API-credential plane the intent route used, so
- * origin and environment binding are unchanged; what is gone is the stored
- * grant that used to sit between the check and its only reader.
- */
-export declare function handleRouterApiWalletRegistrationSetup(input: RouterApiWalletRegistrationInput): Promise<RouteResponse<WalletRegistrationSetupResponseV2 | RouteErrorBody>>;
+export declare function handleRouterApiWalletRegistrationSetup(input: RouterApiWalletRegistrationInput): Promise<RouteResponse>;
 /**
  * `POST /wallets/register/respond` — the authenticated leg.
  *

package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationSetupPayload.d.ts

@@ -1,8 +1,8 @@
 /**
  * The opaque payload `/wallets/register/setup` mints and routes 2 and 3 verify.
  *
- * Setup admits the application, allocates the wallet, and runs the Router
- * preparation in one request. Routes 2 and 3 then need to know that the
+ * Setup admits the application, reserves the wallet, and persists the initial
+ * preparation facts in one request. Routes 2 and 3 then need to know that the
  * ceremony they are being driven with is the one setup admitted, and with the
  * parameters setup admitted — without paying another storage round trip to
  * find out. The client carries this string and never parses it.

package/dist/types/wallet-server/src/router/framework/authServicePort.d.ts

@@ -1,3 +1,4 @@
+import type { RouteResponse } from './routeExecutionContext';
 import type { D1EcdsaAdmissionPolicyRead } from '../cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore';
 import type { EcdsaMaterialRead, EcdsaMaterialActivationReadInput } from '../../core/d1EcdsaSignerRead';
 import type { EcdsaMaterialReadSnapshot } from '../../core/ecdsaMaterialReadSnapshot';
@@ -5,7 +6,7 @@ import type { DigestB64u } from '../../../../shared-ts/src/utils/canonicalPrimit
 import type { TenantRootIdentityV1 } from '../../../../shared-ts/src/tenant-root/tenantRootIdentity';
 import type { AddAuthMethodIntentCallerV1, AddAuthMethodIntentGrant } from '../../../../shared-ts/src/utils/registrationIntent';
 import type { ActiveEmailOtpWalletAuthMethodRecordV2, ActivePasskeyWalletAuthMethodRecordV2, ActiveWalletAuthMethodRecordV2 } from '../../../../shared-ts/src/utils/walletAuthMethodRecord';
-import type { WalletRegistrationNearProvisioningResponseV2, WalletRegistrationNearAdmissionResponseV2, WalletRegistrationActivateResponseV2, WalletRegistrationRespondResponseV2, WalletRegistrationSetupResponseV2 } from '../../core/threeRouteRegistrationContracts';
+import type { WalletRegistrationNearProvisioningResponseV2, WalletRegistrationNearAdmissionResponseV2, WalletRegistrationActivateResponseV2, WalletRegistrationRespondResponseV2 } from '../../core/threeRouteRegistrationContracts';
 import type { WalletRegistrationNearProvisioningInput, WalletRegistrationNearAdmissionInput, WalletRegistrationActivateInput, WalletRegistrationRespondInput, WalletRegistrationSetupInput } from '../domains/walletRegistration/walletRegistrationInputs';
 import type { WalletEmailOtpAction } from '../../../../shared-ts/src/utils/emailOtpDomain';
 import type { MpcMaterialActivationRef, OrgId, ProviderSubject, WalletAuthMethodId, WalletAuthorityId, WalletId, WebAuthnCredentialIdB64u, WebAuthnRpId } from '../../../../shared-ts/src/utils/domainIds';
@@ -19,7 +20,6 @@ import type { WalletExecutionLaneAuthSource, WalletExecutionLaneProjectionResult
 import type { RouterAbMpcMaterialActivationRefWire } from '../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
 import type { EmailOtpChannel, EmailOtpChallengeOperation, EmailOtpWalletEnrollmentRecord } from '../../core/EmailOtpStores';
 import type { LinkIdentityResult, UnlinkIdentityResult } from '../../core/IdentityStore';
-import type { NearPublicKeyAuthBinding, NearPublicKeyKind } from '../../core/NearPublicKeyStore';
 import type { ResolvedEd25519WalletBinding } from '../../core/authService/webauthnWalletBinding';
 import type { RouterAbEcdsaPresignRuntime } from '../../core/routerAbSigning/RouterAbEcdsaPresignRuntime';
 import type { DeviceLinkingRouteServiceV1 } from '../transport/fetch/routes/deviceLinking';
@@ -349,6 +349,17 @@ type GoogleEmailOtpResolutionResult = {
     readonly registrationAttemptId: string;
     readonly expiresAtMs: number;
     readonly offer: GoogleEmailOtpRegistrationOffer;
+} | {
+    readonly ok: false;
+    readonly mode: 'wallet_identity_mismatch';
+    readonly code: 'wallet_identity_mismatch';
+    readonly walletId: string;
+    readonly providerSubject: string;
+    readonly message: string;
+    readonly offer?: never;
+    readonly registrationAttemptId?: never;
+    readonly expiresAtMs?: never;
+    readonly hasEmailOtpEnrollment?: never;
 } | {
     readonly ok: false;
     readonly mode: 'wallet_id_collision' | 'registration_incomplete' | 'stale_identity_mapping';
@@ -603,24 +614,6 @@ type RouterApiMethodTypes = {
             readonly message?: string;
         };
     };
-    listNearPublicKeysForUser: {
-        readonly input: {
-            readonly userId: string;
-        };
-        readonly result: {
-            readonly ok: boolean;
-            readonly code?: string;
-            readonly message?: string;
-            readonly keys?: Array<{
-                readonly publicKey: string;
-                readonly kind: NearPublicKeyKind;
-                readonly signerSlot?: number;
-                readonly createdAtMs?: number;
-                readonly updatedAtMs?: number;
-                readonly authBinding?: NearPublicKeyAuthBinding;
-            }>;
-        };
-    };
     listWalletEcdsaKeyFactsInventory: {
         readonly input: {
             readonly walletId: string;
@@ -736,17 +729,6 @@ type RouterApiMethodTypes = {
         };
         readonly result: GoogleEmailOtpResolutionResult;
     };
-    resolveOidcWalletId: {
-        readonly input: {
-            readonly providerSubject?: string;
-            readonly sub?: string;
-            readonly email?: string;
-            readonly accountMode?: unknown;
-            readonly runtimePolicyScope?: ThresholdRuntimePolicyScope;
-            readonly restartRegistrationOffer?: unknown;
-        };
-        readonly result: string;
-    };
     revokeWalletAuthMethodWithFreshProof: {
         readonly input: RevokeWalletAuthMethodWithFreshProofCommand;
         readonly result: RevokeWalletAuthMethodWithFreshProofResult;
@@ -1038,7 +1020,7 @@ export interface RouterApiWalletRegistrationService {
     }>;
     listWalletEcdsaKeyFactsInventory(input: RouterApiMethodTypes['listWalletEcdsaKeyFactsInventory']['input']): Promise<RouterApiMethodTypes['listWalletEcdsaKeyFactsInventory']['result']>;
     readActiveEmailOtpEnrollment(input: RouterApiMethodTypes['readActiveEmailOtpEnrollment']['input']): Promise<RouterApiMethodTypes['readActiveEmailOtpEnrollment']['result']>;
-    setupWalletRegistration(input: WalletRegistrationSetupInput): Promise<WalletRegistrationSetupResponseV2>;
+    setupWalletRegistration(input: WalletRegistrationSetupInput): Promise<RouteResponse>;
     respondWalletRegistration(input: WalletRegistrationRespondInput, traceContext?: RouterAbTraceContextV1, serverTiming?: Array<readonly [string, number]>): Promise<WalletRegistrationRespondResponseV2>;
     authorizeWalletRegistrationNearAdmission(input: WalletRegistrationNearAdmissionInput): Promise<WalletRegistrationNearAdmissionResponseV2>;
     activateWalletRegistration(input: WalletRegistrationActivateInput, traceContext?: RouterAbTraceContextV1, serverTiming?: Array<readonly [string, number]>): Promise<WalletRegistrationActivateResponseV2>;
@@ -1272,7 +1254,6 @@ export interface RouterApiIdentityService {
     linkIdentity(input: RouterApiMethodTypes['linkIdentity']['input']): Promise<RouterApiMethodTypes['linkIdentity']['result']>;
     listIdentities(input: RouterApiMethodTypes['listIdentities']['input']): Promise<RouterApiMethodTypes['listIdentities']['result']>;
     resolveGoogleEmailOtpSession(input: RouterApiMethodTypes['resolveGoogleEmailOtpSession']['input']): Promise<RouterApiMethodTypes['resolveGoogleEmailOtpSession']['result']>;
-    resolveOidcWalletId(input: RouterApiMethodTypes['resolveOidcWalletId']['input']): Promise<RouterApiMethodTypes['resolveOidcWalletId']['result']>;
     unlinkIdentity(input: RouterApiMethodTypes['unlinkIdentity']['input']): Promise<RouterApiMethodTypes['unlinkIdentity']['result']>;
     verifyGoogleLogin(input: RouterApiMethodTypes['verifyGoogleLogin']['input']): Promise<RouterApiMethodTypes['verifyGoogleLogin']['result']>;
     verifyGithubOAuthCode(input: RouterApiMethodTypes['verifyGithubOAuthCode']['input']): Promise<RouterApiMethodTypes['verifyGithubOAuthCode']['result']>;
@@ -1287,7 +1268,6 @@ export interface RouterApiWebAuthnService {
 }
 interface RouterApiNearFundingService {
     fundImplicitNearAccount(input: FundImplicitNearAccountRequest): Promise<FundImplicitNearAccountResult>;
-    listNearPublicKeysForUser(input: RouterApiMethodTypes['listNearPublicKeysForUser']['input']): Promise<RouterApiMethodTypes['listNearPublicKeysForUser']['result']>;
 }
 interface RouterApiRouterAccountService {
     getConfiguredRelayerAccount(): string;

package/dist/types/wallet-server/src/router/framework/googleLoginResolution.typecheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=googleLoginResolution.typecheck.d.ts.map

package/dist/types/wallet-server/src/router/framework/registrationSetupDispatch.d.ts

@@ -0,0 +1,13 @@
+import type { WalletRegistrationSetupInput } from '../domains/walletRegistration/walletRegistrationInputs';
+import type { WalletRegistrationSetupResponseV2 } from '../../core/threeRouteRegistrationContracts';
+import type { RouteResponse } from './routeExecutionContext';
+export interface WalletRegistrationSetupDispatcher {
+    dispatch(input: WalletRegistrationSetupInput): Promise<RouteResponse | null>;
+}
+export declare function dispatchWalletRegistrationSetup(context: {
+    readonly dispatcher: WalletRegistrationSetupDispatcher | null;
+    readonly local: {
+        setupWalletRegistration(input: WalletRegistrationSetupInput): Promise<WalletRegistrationSetupResponseV2>;
+    };
+}, input: WalletRegistrationSetupInput): Promise<RouteResponse>;
+//# sourceMappingURL=registrationSetupDispatch.d.ts.map

package/dist/types/wallet-server/src/router/transport/fetch/routes/deviceLinking.d.ts

@@ -14,7 +14,7 @@ import { type LinkDeviceSessionId } from '../../../../../../shared-ts/src/signin
 import type { WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
 export type DeviceLinkingAuthDeniedV1 = {
     readonly kind: 'denied';
-    readonly code: 'unauthorized' | 'expired' | 'invalid' | 'replayed';
+    readonly code: 'unauthorized' | 'expired' | 'invalid' | 'replayed' | 'unavailable';
     readonly message: string;
 };
 export type DeviceLinkingRequestBindingV1 = {

package/dist/types/wallet-server/src/router/transport/fetch/routes/deviceLinkingResponses.d.ts

@@ -0,0 +1,17 @@
+import type { DeviceLinkingAuthDeniedV1 } from './deviceLinking';
+import { type LinkSessionProjectionV1, type LinkedDeviceTargetCredentialRegistrationResultV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
+import type { LinkedDeviceSessionRecordV1 } from '../../../../core/deviceLinking/linkedDeviceSessionRecord';
+export declare function projectSession(record: LinkedDeviceSessionRecordV1): LinkSessionProjectionV1;
+export declare function invalidStateResponse(record: LinkedDeviceSessionRecordV1): Response;
+export declare function sessionProjectionResponse(record: LinkedDeviceSessionRecordV1, outcome: 'applied' | 'replayed'): Response;
+export declare function targetCredentialResultResponse(record: LinkedDeviceSessionRecordV1, outcome: 'applied' | 'replayed', targetCredential: LinkedDeviceTargetCredentialRegistrationResultV1): Response;
+export declare function exportRootWriteResponse(result: {
+    readonly outcome: 'applied' | 'replayed' | 'conflict';
+    readonly reason?: string;
+}): Response;
+export declare function invalidInputResponse(message: string): Response;
+export declare function notSupportedResponse(message?: string): Response;
+export declare function notFoundResponse(): Response;
+export declare function methodNotAllowedResponse(): Response;
+export declare function authDeniedResponse(result: DeviceLinkingAuthDeniedV1): Response;
+//# sourceMappingURL=deviceLinkingResponses.d.ts.map

package/dist/types/wallet-server/src/router/transport/fetch/routes/ecdsaOperationStepUpFactor.d.ts

@@ -0,0 +1,37 @@
+import type { CapabilityOperationEnvelope } from '../../../../../../shared-ts/src/authorization/operationFingerprint';
+import { type WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
+import type { WalletAuthAuthorityRef } from '../../../../../../shared-ts/src/utils/walletAuthAuthority';
+import type { RouterAbEcdsaOperationStepUpAuthorizationRequestV1Wire } from '../../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
+import { type VerifiedWalletOperationFactorResult } from '../../../../authorization/factorEvidence';
+import type { SessionOrigin } from '../../../../authorization/domain';
+import type { WalletExecutionLaneAuthSource } from '../../../../core/signingLanes/WalletExecutionLaneProjection';
+import type { RouterApiEmailOtpRouteService, RouterApiWebAuthnService } from '../../../framework/authServicePort';
+type StepUpUnseal = {
+    readonly kind: 'not_requested';
+} | {
+    readonly kind: 'email_otp_grant';
+    readonly grant: string;
+    readonly challenge_id: string;
+};
+type VerifiedStepUpFactorResult = {
+    readonly ok: true;
+    readonly factor: VerifiedWalletOperationFactorResult;
+    readonly unseal: StepUpUnseal;
+} | {
+    readonly ok: false;
+    readonly response: Response;
+};
+export declare function verifyEcdsaOperationStepUpFactor(input: {
+    readonly proof: RouterAbEcdsaOperationStepUpAuthorizationRequestV1Wire['proof'];
+    readonly operation: CapabilityOperationEnvelope;
+    readonly walletId: WalletId;
+    readonly authorityRef: WalletAuthAuthorityRef;
+    readonly authSource: WalletExecutionLaneAuthSource;
+    readonly requestOrigin: SessionOrigin;
+    readonly expectedChallenge: string;
+    readonly expiresAtMs: number;
+    readonly webAuthn: Pick<RouterApiWebAuthnService, 'verifyWebAuthnAuthenticationLite'>;
+    readonly emailOtp: Pick<RouterApiEmailOtpRouteService, 'verifyEmailOtpChallenge' | 'consumeEmailOtpGrant'>;
+}): Promise<VerifiedStepUpFactorResult>;
+export {};
+//# sourceMappingURL=ecdsaOperationStepUpFactor.d.ts.map

package/dist/types/wallet-server/src/storage/d1Sql.d.ts

@@ -10,7 +10,6 @@ export declare function parseD1JsonColumn(value: unknown): unknown;
 export declare function parseD1JsonArrayColumn(value: unknown): readonly unknown[];
 export declare function parseD1JsonObjectColumn(value: unknown): Record<string, unknown>;
 export declare function isD1DatabaseLike(value: unknown): value is D1DatabaseLike;
-export declare function resolveD1DatabaseFromConfig(config: Record<string, unknown>): D1DatabaseLike | null;
 /**
  * Aborts the D1 batch it is in when the statement just before it changed no
  * row: it collides with the guard table's immutable singleton, and the

package/migrations/d1-signer/0040_namespace_home_challenges.sql

@@ -0,0 +1,16 @@
+CREATE TABLE namespace_home_challenges (
+  namespace TEXT NOT NULL,
+  challenge_id TEXT NOT NULL,
+  account_id TEXT NOT NULL,
+  database_id TEXT NOT NULL,
+  proof TEXT NOT NULL,
+  issued_at_ms INTEGER NOT NULL,
+  expires_at_ms INTEGER NOT NULL,
+  PRIMARY KEY (namespace, challenge_id),
+  CHECK (length(challenge_id) = 64),
+  CHECK (length(proof) = 64),
+  CHECK (issued_at_ms > 0),
+  CHECK (expires_at_ms > issued_at_ms AND expires_at_ms <= issued_at_ms + 300000)
+);
+
+CREATE INDEX namespace_home_challenges_expiry_idx ON namespace_home_challenges(expires_at_ms);

package/migrations/d1-signer/0041_step_up_admission_expiry.sql

@@ -0,0 +1,28 @@
+DROP TRIGGER authorized_operation_step_up_claim_atomic;
+
+CREATE TRIGGER authorized_operation_step_up_claim_atomic
+AFTER INSERT ON authorized_operations
+WHEN NEW.lifecycle_kind = 'claimed'
+  AND NEW.authorization_source_kind = 'verified_step_up'
+BEGIN
+  SELECT CASE
+    WHEN NOT EXISTS (
+        SELECT 1
+          FROM verified_wallet_operation_evidence_sets AS evidence
+         WHERE evidence.namespace = NEW.namespace
+           AND evidence.tenant_id = NEW.tenant_id
+           AND evidence.evidence_set_digest = NEW.evidence_set_digest
+           AND evidence.principal_id = NEW.principal_id
+           AND evidence.capability_kind = NEW.capability_kind
+           AND evidence.operation_kind = NEW.operation_kind
+           AND evidence.lane_digest = NEW.lane_digest
+           AND evidence.intent_digest = NEW.intent_digest
+           AND evidence.display_digest = NEW.display_digest
+           AND evidence.assurance = 'step_up'
+           AND evidence.expires_at_ms > NEW.claimed_at_ms
+           -- The database clock closes delays between verification and this write.
+           AND evidence.expires_at_ms > CAST(round(unixepoch('subsec') * 1000) AS INTEGER)
+      )
+    THEN RAISE(ABORT, 'authorization_evidence_claim_rejected')
+  END;
+END;

package/migrations/d1-signer/0042_deployment_resource_challenges.sql

@@ -0,0 +1,4 @@
+ALTER TABLE namespace_home_challenges RENAME TO deployment_resource_challenges;
+DROP INDEX namespace_home_challenges_expiry_idx;
+CREATE INDEX deployment_resource_challenges_expiry_idx
+  ON deployment_resource_challenges(expires_at_ms);

package/migrations/d1-signer/0043_google_registration_candidate_claim.sql

@@ -0,0 +1,2 @@
+ALTER TABLE email_otp_registration_attempts
+  ADD COLUMN selection_digest TEXT CHECK (selection_digest IS NULL OR length(selection_digest) > 0);

package/migrations/d1-signer/0044_linked_device_bootstrap_imports.sql

@@ -0,0 +1,6 @@
+-- This receipt survives session cleanup to prevent replayed imports from resurrecting sessions.
+CREATE TABLE linked_device_bootstrap_imports (
+ namespace TEXT NOT NULL, org_id TEXT NOT NULL, project_id TEXT NOT NULL, env_id TEXT NOT NULL,
+ link_session_id TEXT NOT NULL,
+ PRIMARY KEY (namespace, org_id, project_id, env_id, link_session_id)
+);

package/migrations/d1-signer/0045_wallet_owned_capability_receipts.sql

@@ -0,0 +1,29 @@
+-- Unowned receipts cannot be attributed from capability hashes. Require the
+-- disposable-wallet reset before replacing a populated receipt table.
+CREATE TABLE capability_receipt_reset_guard (
+  receipt_count INTEGER NOT NULL CHECK (receipt_count = 0)
+);
+INSERT INTO capability_receipt_reset_guard
+SELECT COUNT(*) FROM router_ab_yao_capability_replacements;
+DROP TABLE capability_receipt_reset_guard;
+DROP TABLE router_ab_yao_capability_replacements;
+CREATE TABLE router_ab_yao_capability_replacements (
+  namespace TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  project_id TEXT NOT NULL,
+  env_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL CHECK (length(wallet_id) > 0),
+  operation_id TEXT NOT NULL,
+  operation_fingerprint TEXT NOT NULL,
+  previous_capability_binding_json TEXT NOT NULL,
+  next_capability_binding_json TEXT NOT NULL,
+  created_at_ms INTEGER NOT NULL,
+  PRIMARY KEY (namespace, org_id, project_id, env_id, operation_id),
+  CHECK (length(operation_id) > 0),
+  CHECK (length(operation_fingerprint) > 0),
+  CHECK (json_valid(previous_capability_binding_json)),
+  CHECK (json_valid(next_capability_binding_json)),
+  CHECK (created_at_ms >= 0)
+);
+CREATE INDEX capability_replacements_wallet ON router_ab_yao_capability_replacements
+  (namespace, org_id, project_id, env_id, wallet_id);