@seams/wallet-server 0.7.3 → 0.9.0

package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistration.js

@@ -187,7 +187,7 @@ var RouterAbEd25519YaoRegistrationRouteExtension = class {
 			body: parsed.value
 		});
 		if (!authorization.ok) return routeFailureResponse(authorization);
-		const result = await this.service.execute(parsed.value, traceContext.value);
+		const result = await this.service.execute(parsed.value, authorization.ownershipGeneration, traceContext.value);
 		if (!result.ok) return routeFailureResponse(result);
 		return json(result.value, { status: result.status });
 	}
@@ -324,7 +324,7 @@ var InMemoryRouterAbEd25519YaoRegistrationService = class {
 			value: parsed.value
 		};
 	}
-	async execute(request, traceContext) {
+	async execute(request, ownershipGeneration, traceContext) {
 		const preparation = this.prepareExecute(request);
 		switch (preparation.kind) {
 			case "completed": return {
@@ -338,7 +338,7 @@ var InMemoryRouterAbEd25519YaoRegistrationService = class {
 				try {
 					outcome = {
 						kind: "backend_response",
-						result: await this.backend.execute(request, preparation.claim.admissionRequest, traceContext)
+						result: await this.backend.execute(request, preparation.claim.admissionRequest, ownershipGeneration, traceContext)
 					};
 				} catch (error) {
 					outcome = {

package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationExecutionRecord.js

@@ -9,8 +9,9 @@ import { routerAbEd25519YaoCredentialDigestHexV1 } from "./routerAbEd25519YaoReg
 */
 function buildRouterAbEd25519YaoRegistrationExecutionAuthorityV1(input) {
 	const { lifecycleId, registration, authority, dispatchRoot } = input;
-	if (dispatchRoot === void 0 || dispatchRoot.identity.signingRootId !== registration.admissionRequest.application_binding.signing_root_id || dispatchRoot.identity.signingRootVersion !== registration.admissionRequest.scope.root_share_epoch || registration.admissionRequest.scope.lifecycle_id !== lifecycleId || registration.admissionReceipt.binding.lifecycle.lifecycle_id !== lifecycleId || authority.admissionRequest.scope.lifecycle_id !== lifecycleId || authority.admissionFingerprint !== encodeRouterAbEd25519YaoRegistrationAdmissionFingerprintV1(authority.admissionRequest) || authority.admissionFingerprint !== encodeRouterAbEd25519YaoRegistrationAdmissionFingerprintV1(registration.admissionRequest) || !Number.isSafeInteger(authority.expiresAtMs) || authority.expiresAtMs <= 0) return null;
+	if (!Number.isSafeInteger(authority.ownershipGeneration) || authority.ownershipGeneration < 1 || dispatchRoot === void 0 || dispatchRoot.identity.signingRootId !== registration.admissionRequest.application_binding.signing_root_id || dispatchRoot.identity.signingRootVersion !== registration.admissionRequest.scope.root_share_epoch || registration.admissionRequest.scope.lifecycle_id !== lifecycleId || registration.admissionReceipt.binding.lifecycle.lifecycle_id !== lifecycleId || authority.admissionRequest.scope.lifecycle_id !== lifecycleId || authority.admissionFingerprint !== encodeRouterAbEd25519YaoRegistrationAdmissionFingerprintV1(authority.admissionRequest) || authority.admissionFingerprint !== encodeRouterAbEd25519YaoRegistrationAdmissionFingerprintV1(registration.admissionRequest) || !Number.isSafeInteger(authority.expiresAtMs) || authority.expiresAtMs <= 0) return null;
 	return {
+		ownershipGeneration: authority.ownershipGeneration,
 		lifecycleId,
 		admissionRequest: registration.admissionRequest,
 		admissionReceipt: registration.admissionReceipt,

package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationIntentAuthorization.js

@@ -180,6 +180,7 @@ function admittedAuthority(authority) {
 	return {
 		kind: "admitted",
 		purpose: authority.purpose,
+		ownershipGeneration: authority.ownershipGeneration,
 		credentialDigestSha256: authority.credentialDigestSha256,
 		admissionRequest: authority.admissionRequest,
 		admissionFingerprint: authority.admissionFingerprint,
@@ -217,6 +218,7 @@ var InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter = class {
 		this.authorities = state.authorities;
 	}
 	async bindVerifiedIntent(verified) {
+		if (!Number.isSafeInteger(verified.ownershipGeneration) || verified.ownershipGeneration < 1) return failure("invalid_registration_intent", "Wallet ownership generation is invalid");
 		const credential = activationIntentCredential(verified);
 		if (!VERIFIED_INTENT_CREDENTIAL.test(credential)) return failure("invalid_registration_intent", "registration intent grant is not a canonical Bearer credential");
 		if (!Number.isSafeInteger(verified.expiresAtMs) || verified.expiresAtMs <= Date.now()) return failure("invalid_registration_intent", "registration intent authority is expired");
@@ -229,7 +231,7 @@ var InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter = class {
 		const existingLifecycle = findAuthorityByLifecycleId(this.authorities, verified.admissionRequest.scope.lifecycle_id);
 		if (existingCredential || existingLifecycle) {
 			const existing = existingCredential?.authority ?? existingLifecycle?.authority;
-			const exactRetry = existing !== void 0 && existing.purpose === purpose && credentialDigestsEqual(existing.credentialDigestSha256, credentialDigest) && (existing.admissionFingerprint === admissionFingerprint || purpose === "wallet_registration" && sameAdmissionSubject(existing.admissionRequest, copiedAdmissionRequest)) && existing.expiresAtMs === verified.expiresAtMs;
+			const exactRetry = existing !== void 0 && existing.purpose === purpose && existing.ownershipGeneration === verified.ownershipGeneration && credentialDigestsEqual(existing.credentialDigestSha256, credentialDigest) && (existing.admissionFingerprint === admissionFingerprint || purpose === "wallet_registration" && sameAdmissionSubject(existing.admissionRequest, copiedAdmissionRequest)) && existing.expiresAtMs === verified.expiresAtMs;
 			credentialDigest.fill(0);
 			return exactRetry ? {
 				ok: true,
@@ -238,6 +240,7 @@ var InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter = class {
 		}
 		this.authorities.push({
 			kind: "available",
+			ownershipGeneration: verified.ownershipGeneration,
 			purpose,
 			credentialDigestSha256: credentialDigest,
 			admissionRequest: copiedAdmissionRequest,
@@ -255,6 +258,7 @@ var InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter = class {
 		this.authorities[existing.index] = {
 			kind: existing.authority.kind,
 			purpose: existing.authority.purpose,
+			ownershipGeneration: existing.authority.ownershipGeneration,
 			admissionRequest: existing.authority.admissionRequest,
 			admissionFingerprint: existing.authority.admissionFingerprint,
 			credentialDigestSha256: await credentialDigestSha256(verified.credential),
@@ -265,6 +269,17 @@ var InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter = class {
 			admissionRequest: copyAdmissionRequest(existing.authority.admissionRequest)
 		};
 	}
+	async bindAndAuthorizeAdmission(input) {
+		const bound = await this.bindVerifiedIntent(input);
+		if (!bound.ok) return bound;
+		const digest = await credentialDigestSha256(input.kind === "verified_registration_intent" ? input.registrationIntentGrant : input.addSignerIntentGrant);
+		try {
+			const authorized = this.authorizeAdmission(bound.admissionRequest, digest);
+			return authorized.ok ? bound : authorized;
+		} finally {
+			digest.fill(0);
+		}
+	}
 	async authorize(input) {
 		const bearer = extractStrictBearerCredential(input.request);
 		if (!bearer.ok) return bearer.result;
@@ -296,7 +311,10 @@ var InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter = class {
 			message: "registration intent credential does not authorize this admission subject"
 		});
 		if (matched.authority.kind === "available") this.authorities[matched.index] = admittedAuthority(matched.authority);
-		return { ok: true };
+		return {
+			ok: true,
+			ownershipGeneration: matched.authority.ownershipGeneration
+		};
 	}
 	async authorizeExecution(binding, credentialDigest) {
 		const matched = findAuthorityByLifecycleId(this.authorities, binding.lifecycle.lifecycle_id);
@@ -331,7 +349,10 @@ var InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter = class {
 			code: "registration_intent_binding_mismatch",
 			message: "registration execution context does not match its admitted application"
 		});
-		return { ok: true };
+		return {
+			ok: true,
+			ownershipGeneration: matched.authority.ownershipGeneration
+		};
 	}
 };
 //#endregion

package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationRequestScopedCloudflare.js

@@ -4,6 +4,7 @@ import { json, readJson } from "../../../framework/http.js";
 import { InMemoryRouterAbEd25519YaoRegistrationService, routerAbEd25519YaoExecutionMatchesAdmissionV1 } from "./routerAbEd25519YaoRegistration.js";
 import { InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter, routerAbEd25519YaoBearerCredentialDigestV1 } from "./routerAbEd25519YaoRegistrationIntentAuthorization.js";
 import { pinRouterAbEd25519YaoRegistrationDispatchRootV1, routerAbEd25519YaoRegistrationResultFromRouterAnswerV1 } from "./routerAbEd25519YaoRegistrationExecutionRecord.js";
+import { routerAbEd25519YaoRegistrationSigningRootIdV1 } from "../routerAbEd25519YaoGatewayEnvelope.js";
 import { routerAbEd25519YaoAdmittedRegistrationAuthorityV1 } from "../capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore.js";
 import { runRouterAbEd25519YaoRegistrationTwoPhaseV1 } from "./routerAbEd25519YaoRegistrationTwoPhaseRunner.js";
 //#region src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationRequestScopedCloudflare.ts
@@ -109,7 +110,7 @@ async function runAdmissionRequest(input, request, trace) {
 				};
 				case "claimed":
 					try {
-						dispatchRoot = await input.backend.resolveRegistrationDispatchRoot(request);
+						dispatchRoot = await input.backend.resolveRegistrationDispatchRoot(routerAbEd25519YaoRegistrationSigningRootIdV1(request));
 					} catch (error) {
 						return {
 							kind: "rejected",
@@ -183,7 +184,7 @@ async function runExecutionRequest(input, request, trace) {
 	};
 	if (!credential.ok) return timedExecutionResult(credential.result, timing);
 	const admissionStartedAt = performance.now();
-	const authority = routerAbEd25519YaoAdmittedRegistrationAuthorityV1((await input.store.load(lifecycleId)).state, lifecycleId);
+	const authority = routerAbEd25519YaoAdmittedRegistrationAuthorityV1((await input.store.loadRegistration(lifecycleId)).state, lifecycleId);
 	const timingBeforeRouter = {
 		...timing,
 		d1AdmissionReadMs: elapsedMs(admissionStartedAt)
@@ -195,7 +196,7 @@ async function runExecutionRequest(input, request, trace) {
 	let backend;
 	const routerExecutionStartedAt = performance.now();
 	try {
-		backend = await input.backend.executePinnedRegistration(request, authority.admissionRequest, authority.dispatchRoot, trace);
+		backend = await input.backend.executePinnedRegistration(request, authority, trace);
 	} catch (error) {
 		return timedExecutionResult({
 			ok: false,

package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js

@@ -104,13 +104,16 @@ function parseRouterAbEd25519YaoRegistrationSideEffectClaimFields(record, parseP
 * or allowing a network effect.
 */
 async function runRouterAbEd25519YaoRegistrationSideEffectV1(store, input) {
+	return runRegistrationSideEffect(store, input, store.read.bind(store));
+}
+async function runRegistrationSideEffect(store, input, readInitial) {
 	const key = requireOpaqueKey(input.key);
 	const requestFingerprint = requireRequestFingerprint(input.requestFingerprint);
 	const resumeAfterMs = requirePositiveDuration(input.resumeAfterMs, "resumeAfterMs");
 	let existing;
 	let disposition;
 	try {
-		existing = await store.read(key);
+		existing = await readInitial(key);
 		disposition = await existingDisposition(existing, requestFingerprint, input.derivePreparedArtifactFingerprint);
 	} catch (error) {
 		return uncertainResult("claim", error);
@@ -233,7 +236,8 @@ async function runRouterAbEd25519YaoRegistrationSideEffectV1(store, input) {
 * from its digest, so replay never reconstructs one.
 */
 async function runRouterAbEd25519YaoRegistrationSideEffectV2(store, input) {
-	const result = await runRouterAbEd25519YaoRegistrationSideEffectV1(new RegistrationV2StoreAdapter(store, input.projectReceipt), {
+	const adaptedStore = new RegistrationV2StoreAdapter(store, input.initialRecord, input.projectReceipt, input.completionWrite);
+	const result = await runRegistrationSideEffect(adaptedStore, {
 		kind: input.kind,
 		operation: input.operation,
 		key: input.key,
@@ -246,7 +250,7 @@ async function runRouterAbEd25519YaoRegistrationSideEffectV2(store, input) {
 			kind: "executed_response",
 			response: await input.execute(prepared, attempt)
 		})
-	});
+	}, adaptedStore.readInitial.bind(adaptedStore));
 	switch (result.kind) {
 		case "executed":
 			if (result.value.kind !== "executed_response") return {
@@ -280,12 +284,19 @@ async function resolveRegistrationV2AdapterReplay(value, input) {
 	}
 }
 var RegistrationV2StoreAdapter = class {
-	constructor(store, projectReceipt) {
+	constructor(store, initialRecord, projectReceipt, completionWrite) {
 		this.store = store;
+		this.initialRecord = initialRecord;
 		this.projectReceipt = projectReceipt;
+		this.completionWrite = completionWrite;
+	}
+	async readInitial() {
+		return this.adaptRead(this.initialRecord);
 	}
 	async read(key) {
-		const result = await this.store.read(key);
+		return this.adaptRead(await this.store.read(key));
+	}
+	adaptRead(result) {
 		if (result.kind === "missing") return { kind: "missing" };
 		switch (result.value.kind) {
 			case "router_ab_ed25519_yao_registration_side_effect_claim_v1": return {
@@ -319,7 +330,7 @@ var RegistrationV2StoreAdapter = class {
 			case "router_ab_ed25519_yao_registration_side_effect_completion_v1": {
 				if (value.response.kind !== "executed_response") throw new Error("registration side-effect cannot persist a replay response");
 				const receipt = requireReceipt(await this.projectReceipt(value.response.response));
-				return await this.store.put(key, {
+				const completion = {
 					kind: "router_ab_ed25519_yao_registration_side_effect_completion_v2",
 					operation: value.operation,
 					requestFingerprint: value.requestFingerprint,
@@ -328,7 +339,9 @@ var RegistrationV2StoreAdapter = class {
 					completedAtMs: value.completedAtMs,
 					prepared: value.prepared,
 					receipt
-				}, expectedVersion);
+				};
+				const companionWrite = this.completionWrite(value.response.response);
+				return companionWrite ? await this.store.putWithCompanion(key, completion, expectedVersion, companionWrite) : await this.store.put(key, completion, expectedVersion);
 			}
 			default: return assertNever(value);
 		}

package/dist/esm/router/domains/ed25519Yao/routerAbEd25519YaoGatewayEnvelope.js

@@ -39,7 +39,13 @@ async function routerAbEd25519YaoTenantRootWireV1(root) {
 		custody_lineage_b64u: root.custodyLineageB64u
 	};
 }
+function routerAbEd25519YaoRegistrationSigningRootIdV1(admissionRequest) {
+	return {
+		signing_root_id: admissionRequest.application_binding.signing_root_id,
+		root_share_epoch: admissionRequest.scope.root_share_epoch
+	};
+}
 //#endregion
-export { parseRouterAbEd25519YaoTenantRootWireV1, routerAbEd25519YaoTenantRootWireV1 };
+export { parseRouterAbEd25519YaoTenantRootWireV1, routerAbEd25519YaoRegistrationSigningRootIdV1, routerAbEd25519YaoTenantRootWireV1 };
 
 //# sourceMappingURL=routerAbEd25519YaoGatewayEnvelope.js.map

package/dist/esm/router/domains/emailOtp/emailOtpRequestValidation.js

@@ -1,5 +1,4 @@
 import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
-import "../../../shared-ts/src/utils/validation.js";
 import { WALLET_EMAIL_OTP_UNLOCK_OPERATION, isWalletEmailOtpLoginOperation, isWalletUnlockBackend } from "../../../shared-ts/src/utils/emailOtpDomain.js";
 //#region src/router/domains/emailOtp/emailOtpRequestValidation.ts
 function parseWalletUnlockBackend(raw) {

package/dist/esm/router/domains/emailOtp/emailOtpRouteHandlers.js

@@ -1,7 +1,7 @@
-import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
-import "../../../shared-ts/src/utils/encoders.js";
 import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
 import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
+import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
+import "../../../shared-ts/src/utils/encoders.js";
 import { failure } from "../../../shared-ts/src/utils/failure.js";
 import { emailOtpStatusCode } from "./emailOtpSessionRouteHelpers.js";
 import { EMAIL_OTP_FACTOR_RELEASE_AAD_DOMAIN_V1 } from "../../../shared-ts/src/utils/emailOtpDomain.js";

package/dist/esm/router/domains/passkeyCustody/passkeyCustodyEnvelopeRetrieval.js

@@ -1,5 +1,5 @@
-import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
+import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { decodeBase64UrlOrBase64 } from "../../../core/authService/webauthnOidcHelpers.js";
 import { verifyWebAuthnAuthenticationLiteWithStore } from "../../../core/authService/webauthn.js";
 //#region src/router/domains/passkeyCustody/passkeyCustodyEnvelopeRetrieval.ts
@@ -84,14 +84,8 @@ async function retrievePasskeyCustodyEnvelope(input) {
 			envelope: lookup.envelope,
 			storeVersion: lookup.storeVersion
 		};
-		case "retired": return {
-			kind: "retired",
-			retiredAtMs: lookup.retiredAtMs
-		};
-		case "revoked": return {
-			kind: "revoked",
-			revokedAtMs: lookup.revokedAtMs
-		};
+		case "retired": return { kind: "retired" };
+		case "revoked": return { kind: "revoked" };
 		case "digest_mismatch":
 			input.logger.error("[passkey-custody] stored envelope failed its ciphertext digest", {
 				walletId: String(request.locator.walletId),

package/dist/esm/router/domains/passkeyCustody/registrationCustodyOutcome.js

@@ -1,31 +1,47 @@
 import { admitWalletCustodyRegistrationCommit } from "./walletCustodyRegistrationAdmission.js";
 import { verifiedCustodyFactorFromAuthority } from "./verifiedCustodyFactor.js";
 //#region src/router/domains/passkeyCustody/registrationCustodyOutcome.ts
-async function commitRegistrationCustody(input) {
-	if (!input.payload) return { status: "not_requested" };
-	const factor = verifiedCustodyFactorFromAuthority({
-		authority: input.verifiedAuthority,
-		...input.verifiedEmailOtpEnrollment ? { emailOtpEnrollment: input.verifiedEmailOtpEnrollment } : {}
-	});
-	if (!factor.ok) return {
-		status: "rejected",
-		reason: factor.reason
-	};
+/** Admits the custody payload and claims its routes. It never throws either. */
+async function reserveRegistrationCustody(input) {
+	const payload = input.payload;
+	if (!payload) return settled({ status: "not_requested" });
 	try {
-		return toOutcome(await admitWalletCustodyRegistrationCommit({
-			payload: input.payload,
+		const factor = verifiedCustodyFactorFromAuthority({
+			authority: input.verifiedAuthority,
+			...input.verifiedEmailOtpEnrollment ? { emailOtpEnrollment: input.verifiedEmailOtpEnrollment } : {}
+		});
+		if (!factor.ok) return settled({
+			status: "rejected",
+			reason: factor.reason
+		});
+		const admitted = await admitWalletCustodyRegistrationCommit({
+			payload,
 			verifiedWalletId: input.verifiedWalletId,
 			verifiedFactor: factor.factor,
 			nowMs: input.nowMs,
 			store: input.store
-		}));
-	} catch (error) {
-		return {
-			status: "rejected",
-			reason: error instanceof Error ? error.message : "wallet custody commit failed"
+		});
+		if (admitted.kind !== "reserved") return settled(toOutcome(admitted));
+		return async () => {
+			try {
+				return toOutcome(await admitted.commit());
+			} catch (error) {
+				return storeFailure(error);
+			}
 		};
+	} catch (error) {
+		return settled(storeFailure(error));
 	}
 }
+function settled(outcome) {
+	return () => Promise.resolve(outcome);
+}
+function storeFailure(error) {
+	return {
+		status: "rejected",
+		reason: error instanceof Error ? error.message : "wallet custody commit failed"
+	};
+}
 function toOutcome(admitted) {
 	switch (admitted.kind) {
 		case "committed": return { status: "committed" };
@@ -42,6 +58,6 @@ function toOutcome(admitted) {
 	}
 }
 //#endregion
-export { commitRegistrationCustody };
+export { reserveRegistrationCustody };
 
 //# sourceMappingURL=registrationCustodyOutcome.js.map

package/dist/esm/router/domains/passkeyCustody/walletCustodyRegistrationAdmission.js

@@ -1,4 +1,4 @@
-import { commitWalletCustodyRegistration } from "./walletCustodyRegistrationCommit.js";
+import { reserveWalletCustodyRegistration } from "./walletCustodyRegistrationCommit.js";
 //#region src/router/domains/passkeyCustody/walletCustodyRegistrationAdmission.ts
 async function admitWalletCustodyRegistrationCommit(input) {
 	const payloadWalletId = String(input.payload.walletId ?? "").trim();
@@ -19,7 +19,7 @@ async function admitWalletCustodyRegistrationCommit(input) {
 		kind: "no_custody_records",
 		keyManifestDigestB64u: digest
 	};
-	return await commitWalletCustodyRegistration({
+	return await reserveWalletCustodyRegistration({
 		payload: input.payload,
 		factor: input.verifiedFactor,
 		nowMs: input.nowMs,

package/dist/esm/router/domains/passkeyCustody/walletCustodyRegistrationCommit.js

@@ -126,14 +126,14 @@ function buildWalletCustodyRegistrationRecords(args) {
 	};
 }
 /**
-* Builds and commits in one call.
+* Builds the records and claims their recovery-code routes.
 *
 * A payload this server cannot parse becomes `rejected` rather than an
 * exception, so a malformed ceremony result is a request outcome and not a
-* route crash. Nothing is written in that case: the records are built before
-* the store is touched.
+* route crash. Nothing is claimed or written in that case: the records are
+* built before the store is touched.
 */
-async function commitWalletCustodyRegistration(input) {
+async function reserveWalletCustodyRegistration(input) {
 	let records;
 	try {
 		records = buildWalletCustodyRegistrationRecords(input);
@@ -143,21 +143,25 @@ async function commitWalletCustodyRegistration(input) {
 			reason: error instanceof Error ? error.message : "invalid wallet custody commit payload"
 		};
 	}
-	const stored = await input.store.commitRegistration(records);
+	const reserved = await input.store.reserveRegistration(records);
+	if (reserved.kind === "inconsistent") return {
+		kind: "rejected",
+		reason: reserved.reason
+	};
+	return {
+		kind: "reserved",
+		commit: async () => commitOutcome(await reserved.commit())
+	};
+}
+function commitOutcome(stored) {
 	switch (stored.kind) {
 		case "committed": return {
 			kind: "committed",
 			envelopeStoreVersion: stored.envelopeStoreVersion,
 			recoverySetStoreVersion: stored.recoverySetStoreVersion
 		};
-		case "already_exists": return {
-			kind: "already_exists",
-			key: stored.key
-		};
-		case "custody_already_established": return {
-			kind: "custody_already_established",
-			walletId: stored.walletId
-		};
+		case "already_exists": return { kind: "already_exists" };
+		case "custody_already_established": return { kind: "custody_already_established" };
 		case "inconsistent": return {
 			kind: "rejected",
 			reason: stored.reason
@@ -165,6 +169,6 @@ async function commitWalletCustodyRegistration(input) {
 	}
 }
 //#endregion
-export { commitWalletCustodyRegistration };
+export { reserveWalletCustodyRegistration };
 
 //# sourceMappingURL=walletCustodyRegistrationCommit.js.map

package/dist/esm/router/domains/signingOperations/authorizedOperationWire.js

@@ -0,0 +1,73 @@
+//#region src/router/domains/signingOperations/authorizedOperationWire.ts
+function buildAuthorizedOperationWire(input, commonAuthorizedOperation) {
+	const operation = input.operation;
+	switch (input.binding.kind) {
+		case "reusable_wallet_session":
+			if (operation.authorization.kind !== "authorization_grant" || operation.quota.kind !== "consume_reusable_wallet_session") throw new Error("Reusable Wallet Session authorized operation is invalid");
+			return {
+				binding: {
+					kind: "reusable_wallet_session",
+					authorization_id: operation.authorization.authorizationGrantRef.authorizationId,
+					wallet_session_id: input.binding.walletSessionId,
+					quota_id: input.binding.quotaId
+				},
+				authorized_operation: {
+					kind: "reusable_wallet_session_authorized_operation_v1",
+					...commonAuthorizedOperation
+				}
+			};
+		case "gateway_owner_wallet_session":
+			if (operation.authorization.kind !== "authorization_grant" || operation.quota.kind !== "consume_reusable_wallet_session") throw new Error("Gateway owner Wallet Session authorized operation is invalid");
+			return {
+				binding: {
+					kind: "gateway_owner_wallet_session",
+					ownership_generation: input.binding.ownershipGeneration,
+					subject_id: input.binding.subjectId,
+					account_id: input.binding.accountId,
+					authorization_id: input.binding.authorizationId,
+					wallet_session_id: input.binding.walletSessionId,
+					quota_id: input.binding.quotaId,
+					threshold_session_id: input.binding.thresholdSessionId,
+					org_id: input.binding.orgId,
+					project_id: input.binding.projectId,
+					environment: input.binding.environment,
+					project_environment_id: input.binding.projectEnvironmentId,
+					signing_worker_id: input.binding.signingWorkerId,
+					expires_at_ms: input.binding.expiresAtMs
+				},
+				authorized_operation: {
+					kind: "reusable_wallet_session_authorized_operation_v1",
+					...commonAuthorizedOperation
+				}
+			};
+		case "operation_step_up":
+			if (operation.authorization.kind !== "verified_step_up" || operation.quota.kind !== "quota_neutral") throw new Error("Verified step-up authorized operation is invalid");
+			return {
+				binding: {
+					kind: "operation_step_up",
+					ownership_generation: input.binding.ownershipGeneration,
+					authorization_session_id: input.binding.authorizationSessionId,
+					org_id: input.binding.orgId,
+					project_id: input.binding.projectId,
+					environment: input.binding.environment,
+					project_environment_id: input.binding.projectEnvironmentId,
+					subject_id: input.binding.subjectId,
+					account_id: input.binding.accountId
+				},
+				authorized_operation: {
+					kind: "verified_step_up_authorized_operation_v1",
+					authorization_session_id: input.binding.authorizationSessionId,
+					evidence_set_digest: operation.authorization.evidenceSetDigest,
+					...commonAuthorizedOperation
+				}
+			};
+		default: return assertNeverOperationBinding(input.binding);
+	}
+}
+function assertNeverOperationBinding(_binding) {
+	throw new Error("Unsupported authorized-operation binding");
+}
+//#endregion
+export { buildAuthorizedOperationWire };
+
+//# sourceMappingURL=authorizedOperationWire.js.map

package/dist/esm/router/domains/signingOperations/ecdsaSigningResponse.js

@@ -0,0 +1,31 @@
+import { completeRouterAbEcdsaOperation } from "./routerAbEcdsaDerivationNormalSigningRoute.js";
+//#region src/router/domains/signingOperations/ecdsaSigningResponse.ts
+async function finishRouterAbEcdsaSigningResponse(input) {
+	const upstream = input.upstream;
+	const upstreamBodyText = await upstream.clone().text().catch(() => "");
+	input.timing.proxy = performance.now() - input.proxyStartedAt;
+	if (isRouterAbEcdsaOperationInProgressResponse({
+		status: upstream.status,
+		bodyText: upstreamBodyText
+	})) return upstream;
+	const completionStartedAt = performance.now();
+	await completeRouterAbEcdsaOperation({
+		authorizedOperations: input.authorizedOperations,
+		operation: input.operation,
+		result: upstream.ok ? "succeeded" : upstream.status < 500 ? "failed_before_side_effect" : "failed_after_side_effect",
+		response: {
+			status: upstream.status,
+			contentType: upstream.headers.get("content-type") || "application/json",
+			bodyText: upstreamBodyText
+		}
+	});
+	input.timing.complete = performance.now() - completionStartedAt;
+	return upstream;
+}
+function isRouterAbEcdsaOperationInProgressResponse(input) {
+	return input.status === 409 && input.bodyText.includes("ReplayedLocalRequest:") && input.bodyText.includes("SigningWorker ECDSA effect is already in progress");
+}
+//#endregion
+export { finishRouterAbEcdsaSigningResponse };
+
+//# sourceMappingURL=ecdsaSigningResponse.js.map

package/dist/esm/router/domains/signingOperations/ed25519AuthorizedOperationReceipt.js

@@ -1,6 +1,6 @@
+import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
 import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { parseCapabilityOperationFingerprintDigest } from "../../../shared-ts/src/authorization/operationFingerprint.js";
-import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
 //#region src/router/domains/signingOperations/ed25519AuthorizedOperationReceipt.ts
 function requireEd25519OperationKind(value) {
 	if (value !== "near.sign_transaction" && value !== "near.sign_delegate_action" && value !== "near.sign_nep413_message") throw new Error("authorized_operation.operation_kind is invalid");

package/dist/esm/router/domains/signingOperations/routerAbEcdsaDerivationNormalSigningRoute.js

@@ -9,6 +9,7 @@ import { WALLET_SESSION_FAILURE_CODES } from "../../../shared-ts/src/utils/walle
 import { extractBearerCredential } from "../../auth/routerApiKeyAuth.js";
 import { walletSessionFailure, walletSessionFailureStatus } from "../../auth/walletSessionFailure.js";
 import { validateRouterAbEcdsaDerivationWalletSessionInputs } from "../../auth/commonRouterUtils.js";
+import { signingPrepareSessionResponse } from "./signingPrepareSession.js";
 import { evaluateRouterAbNormalSigningAdmission, requireAuthorizationValue, requireMpcMaterialActivationId, routerAbErrorMessage, routerAbOwnerOperationFailureResult, routerAbOwnerOperationStepUpDecision, routerAbSigningError, routerAbStepUpError, routerAbWalletSessionValidationStatus } from "./routerAbNormalSigningAdmission.js";
 import { ecdsaStepUpActiveMaterial, exactOperationStepUpSession, parseStepUpRequestOrigin, recordedStepUpOperationClaim, routerAbOperationStepUpClaimFailure, walletSessionCandidateAdmission, walletSessionScopeInvalidFailure, walletSessionUnavailableFailure } from "./routerAbOperationStepUp.js";
 import { buildRouterAbEcdsaDerivationPrivateSigningWorkerBody, isRouterAbEcdsaSigningWorkerOperationInProgress, postRouterAbSigningWorkerJson, replayResponseFromSigningWorkerResult } from "./routerAbPrivateSigningWorker.js";
@@ -805,7 +806,7 @@ async function handleRouterAbEcdsaDerivationNormalSigningRouteCore(input) {
 		});
 		return forwarded.ok ? {
 			status: 200,
-			body: forwarded.body
+			body: signingPrepareSessionResponse(forwarded.body, authorization)
 		} : {
 			status: forwarded.status,
 			body: forwarded.body