@seams/wallet-server 0.7.3 → 0.9.0

package/dist/esm/router/domains/signingOperations/routerAbEd25519NormalSigningRoute.js

@@ -1,10 +1,10 @@
 import { mpcMaterialActivationRefsEqual } from "../../../shared-ts/src/utils/domainIds.js";
 import { buildNearEd25519MpcOperationRef, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
+import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
 import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { buildCapabilityOperationEnvelope, computeCapabilityOperationFingerprintDigest, parseSigningOperationFingerprintDigest } from "../../../shared-ts/src/authorization/operationFingerprint.js";
 import "../../../shared-ts/src/utils/encoders.js";
-import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
 import { routerAbMpcMaterialActivationRefFromWire, routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { extractBearerCredential } from "../../auth/routerApiKeyAuth.js";
 import { validateRouterAbEd25519WalletSessionInputs } from "../../auth/commonRouterUtils.js";
@@ -327,30 +327,22 @@ function parseRouterAbEd25519NormalSigningOperationForAdmission(input) {
 	}
 	try {
 		switch (input.authorizationKind) {
-			case "reusable_wallet_session": {
-				const receipt = parseEd25519ReusableAuthorizedOperationReceipt(input.body.authorized_operation);
-				return {
-					ok: true,
-					operation: {
-						phase: "finalize",
-						operationKind: receipt.operation_kind,
-						authorizationKind: "reusable_wallet_session",
-						receipt
-					}
-				};
-			}
-			case "operation_step_up": {
-				const receipt = parseEd25519VerifiedStepUpAuthorizedOperationReceipt(input.body.authorized_operation);
-				return {
-					ok: true,
-					operation: {
-						phase: "finalize",
-						operationKind: receipt.operation_kind,
-						authorizationKind: "operation_step_up",
-						receipt
-					}
-				};
-			}
+			case "reusable_wallet_session": return {
+				ok: true,
+				operation: {
+					phase: "finalize",
+					operationKind: parseEd25519ReusableAuthorizedOperationReceipt(input.body.authorized_operation).operation_kind,
+					authorizationKind: "reusable_wallet_session"
+				}
+			};
+			case "operation_step_up": return {
+				ok: true,
+				operation: {
+					phase: "finalize",
+					operationKind: parseEd25519VerifiedStepUpAuthorizedOperationReceipt(input.body.authorized_operation).operation_kind,
+					authorizationKind: "operation_step_up"
+				}
+			};
 		}
 	} catch (error) {
 		return {
@@ -359,94 +351,7 @@ function parseRouterAbEd25519NormalSigningOperationForAdmission(input) {
 		};
 	}
 }
-async function validateRouterAbEd25519V2FinalizeAuthorizedOperation(input) {
-	if (!input.authorizedOperations) return {
-		ok: false,
-		result: routerAbEd25519OwnerOperationFailureResult({
-			status: 501,
-			code: "not_configured",
-			message: "Reusable Wallet Session authorization is not configured",
-			phase: input.phase
-		})
-	};
-	let authorizedOperationId;
-	try {
-		authorizedOperationId = requireAuthorizationValue(parseAuthorizedOperationId(input.receipt.authorized_operation_id));
-		requireAuthorizationValue(parseCapabilityOperationId(input.receipt.operation_id));
-	} catch (error) {
-		return {
-			ok: false,
-			result: routerAbEd25519OwnerOperationFailureResult({
-				status: 400,
-				code: "invalid_authorized_operation",
-				message: routerAbErrorMessage(error),
-				phase: input.phase
-			})
-		};
-	}
-	let operation;
-	try {
-		operation = await input.authorizedOperations.readAuthorizedOperationById({
-			tenantId: input.authorizedOperations.tenantId,
-			authorizedOperationId
-		});
-	} catch (error) {
-		return {
-			ok: false,
-			result: routerAbEd25519OwnerOperationFailureResult({
-				status: 500,
-				code: "internal",
-				message: routerAbErrorMessage(error),
-				phase: input.phase
-			})
-		};
-	}
-	if (!operation) return {
-		ok: false,
-		result: routerAbEd25519OwnerOperationFailureResult({
-			status: 409,
-			code: "authorized_operation_missing",
-			message: "Authorized operation is unavailable",
-			phase: input.phase
-		})
-	};
-	const operationRef = operation.operation.operation;
-	if (operation.tenantId !== input.authorizedOperations.tenantId || operation.authorizedOperationId !== authorizedOperationId || operation.operation.operationId !== input.receipt.operation_id || operation.operationFingerprintDigest !== input.receipt.operation_fingerprint_digest || operation.operation.digests.laneDigest !== input.receipt.lane_digest_b64u || operation.operation.digests.intentDigest !== input.receipt.intent_digest_b64u || operation.operation.digests.displayDigest !== input.receipt.display_digest_b64u || operationRef.capabilityKind !== "near_ed25519_mpc_signing" || operationRef.operationKind !== input.receipt.operation_kind) return {
-		ok: false,
-		result: routerAbEd25519OwnerOperationFailureResult({
-			status: 400,
-			code: "invalid_authorized_operation",
-			message: "Ed25519 authorized operation does not match its receipt",
-			phase: input.phase
-		})
-	};
-	switch (operationRef.operationKind) {
-		case "near.sign_transaction":
-		case "near.sign_delegate_action":
-		case "near.sign_nep413_message": return {
-			ok: true,
-			operationKind: operationRef.operationKind
-		};
-	}
-}
 async function authorizeRouterAbEd25519WalletSessionRequest(input) {
-	if (input.operation.phase === "finalize") {
-		const exactOperation = await validateRouterAbEd25519V2FinalizeAuthorizedOperation({
-			receipt: input.operation.receipt,
-			authorizedOperations: input.authorizedOperations,
-			phase: input.phase
-		});
-		if (!exactOperation.ok) return exactOperation;
-		if (exactOperation.operationKind !== input.admission.operationKind) return {
-			ok: false,
-			result: routerAbEd25519OwnerOperationFailureResult({
-				status: 403,
-				code: "wallet_session_scope_mismatch",
-				message: "Exact Wallet Session operation does not match the authorized operation",
-				phase: input.phase
-			})
-		};
-	}
 	const expectedMaterialActivation = routerAbMpcMaterialActivationRefFromWire(input.scope.material_activation);
 	const admittedMaterialActivation = routerAbMpcMaterialActivationRefToWire(input.admission.materialActivation);
 	const expiresAtMs = Number(input.body.expires_at_ms);
@@ -479,7 +384,8 @@ async function authorizeRouterAbEd25519WalletSessionRequest(input) {
 	};
 	const activeMaterial = await input.resolveEd25519MaterialActivation({
 		walletId: String(input.session.walletId),
-		materialActivation: admittedMaterialActivation
+		materialActivation: admittedMaterialActivation,
+		...input.signerRead ? { signerRead: input.signerRead } : {}
 	});
 	if (!activeMaterial.ok || !sameRouterAbMpcMaterialActivationRef(activeMaterial.materialActivation, admittedMaterialActivation) || activeMaterial.signingWorkerId !== input.scope.signing_worker_id || base64UrlEncode(Uint8Array.from(activeMaterial.exportIdentity.registered_public_key)) !== input.admission.signer.registeredPublicKeyB64u) return {
 		ok: false,
@@ -500,6 +406,7 @@ async function authorizeRouterAbEd25519WalletSessionRequest(input) {
 	const admissionDecision = await evaluateRouterAbNormalSigningAdmission({
 		adapter: input.admissionAdapter,
 		curve: "ed25519",
+		policyReadSource: input.policyReadSource,
 		authorizationKind: "wallet_session_operation_credential_v1",
 		phase: input.phase,
 		walletId: String(input.session.walletId),
@@ -557,13 +464,13 @@ async function resolveRouterAbEd25519ExhaustedCandidateAuthorization(input) {
 		phase: input.phase,
 		body: input.body,
 		scope: input.scope,
-		operation: input.operation,
 		session,
 		authorityId: String(candidate.authority.authorityId),
 		admission,
-		authorizedOperations: input.authorizedOperations,
 		admissionAdapter: input.admissionAdapter,
-		resolveEd25519MaterialActivation: input.resolveEd25519MaterialActivation
+		resolveEd25519MaterialActivation: input.resolveEd25519MaterialActivation,
+		signerRead: null,
+		policyReadSource: { kind: "database" }
 	});
 	if (!authorized.ok) return authorized;
 	return {
@@ -626,7 +533,8 @@ async function authorizeRouterAbEd25519NormalSigningRoute(input) {
 	const validated = await validateRouterAbEd25519WalletSessionInputs({
 		headers: input.headers,
 		authorizationSessions: input.authorizationSessions,
-		operationKind: operationForAdmission.operation.operationKind
+		operationKind: operationForAdmission.operation.operationKind,
+		materialActivation: scope.material_activation
 	});
 	if (!validated.ok) {
 		const operation = operationForAdmission.operation;
@@ -637,7 +545,6 @@ async function authorizeRouterAbEd25519NormalSigningRoute(input) {
 				scope,
 				phase: input.phase,
 				operation,
-				authorizedOperations: input.authorizedOperations,
 				authorizationSessions: input.authorizationSessions,
 				admissionAdapter: input.admissionAdapter,
 				resolveEd25519MaterialActivation: input.resolveEd25519MaterialActivation
@@ -675,13 +582,16 @@ async function authorizeRouterAbEd25519NormalSigningRoute(input) {
 		phase: input.phase,
 		body: input.body,
 		scope,
-		operation,
 		session: validated.admission.context.authorization.session,
 		authorityId: String(validated.admission.context.authority.authorityId),
 		admission: validated.admission.admission,
-		authorizedOperations: input.authorizedOperations,
 		admissionAdapter: input.admissionAdapter,
-		resolveEd25519MaterialActivation: input.resolveEd25519MaterialActivation
+		resolveEd25519MaterialActivation: input.resolveEd25519MaterialActivation,
+		signerRead: validated.signerRead,
+		policyReadSource: {
+			kind: "credential_snapshot",
+			policyRead: validated.policyRead
+		}
 	});
 	if (!authorized.ok) return authorized;
 	return {

package/dist/esm/router/domains/signingOperations/routerAbNormalSigningAdmission.js

@@ -1,98 +1,6 @@
 import { parseMpcMaterialActivationId } from "../../../shared-ts/src/utils/domainIds.js";
 import { walletSessionFailureStatus } from "../../auth/walletSessionFailure.js";
 //#region src/router/domains/signingOperations/routerAbNormalSigningAdmission.ts
-function buildRouterAbEd25519AcceptedAuthorizedOperationV1(input) {
-	const operation = input.operation;
-	const operationRef = operation.operation.operation;
-	if (operationRef.capabilityKind !== "near_ed25519_mpc_signing") throw new Error("Ed25519 authorized operation capability is invalid");
-	if (operationRef.operationKind === "near.export_key") throw new Error("Ed25519 export cannot use normal-signing admission");
-	return buildRouterAbAcceptedAuthorizedOperationV1({
-		operation,
-		operationKind: operationRef.operationKind,
-		capabilityKind: "near_ed25519_mpc_signing",
-		binding: input.binding
-	});
-}
-function buildRouterAbEcdsaAcceptedAuthorizedOperationV1(input) {
-	const operation = input.operation;
-	const operationRef = operation.operation.operation;
-	if (operationRef.capabilityKind !== "evm_ecdsa_mpc_signing" || operationRef.operationKind !== "evm.sign_transaction") throw new Error("ECDSA authorized operation capability or operation kind is invalid");
-	return buildRouterAbAcceptedAuthorizedOperationV1({
-		operation,
-		operationKind: "evm.sign_transaction",
-		capabilityKind: "evm_ecdsa_mpc_signing",
-		binding: input.binding
-	});
-}
-function buildRouterAbAcceptedAuthorizedOperationV1(input) {
-	const operation = input.operation;
-	const commonAuthorizedOperation = {
-		authorized_operation_id: operation.authorizedOperationId,
-		operation_id: operation.operation.operationId,
-		capability_kind: input.capabilityKind,
-		operation_kind: input.operationKind,
-		lane_digest_b64u: operation.operation.digests.laneDigest,
-		intent_digest_b64u: operation.operation.digests.intentDigest,
-		display_digest_b64u: operation.operation.digests.displayDigest,
-		operation_fingerprint_digest: operation.operationFingerprintDigest
-	};
-	switch (input.binding.kind) {
-		case "reusable_wallet_session":
-			if (operation.authorization.kind !== "authorization_grant" || operation.quota.kind !== "consume_reusable_wallet_session") throw new Error("Reusable Wallet Session authorized operation is invalid");
-			return {
-				binding: {
-					kind: "reusable_wallet_session",
-					authorization_id: operation.authorization.authorizationGrantRef.authorizationId,
-					wallet_session_id: input.binding.walletSessionId,
-					quota_id: input.binding.quotaId
-				},
-				authorized_operation: {
-					kind: "reusable_wallet_session_authorized_operation_v1",
-					...commonAuthorizedOperation
-				}
-			};
-		case "gateway_owner_wallet_session":
-			if (operation.authorization.kind !== "authorization_grant" || operation.quota.kind !== "consume_reusable_wallet_session") throw new Error("Gateway owner Wallet Session authorized operation is invalid");
-			return {
-				binding: {
-					kind: "gateway_owner_wallet_session",
-					subject_id: input.binding.subjectId,
-					account_id: input.binding.accountId,
-					authorization_id: input.binding.authorizationId,
-					wallet_session_id: input.binding.walletSessionId,
-					quota_id: input.binding.quotaId,
-					threshold_session_id: input.binding.thresholdSessionId,
-					org_id: input.binding.orgId,
-					project_id: input.binding.projectId,
-					environment: input.binding.environment,
-					signing_worker_id: input.binding.signingWorkerId,
-					expires_at_ms: input.binding.expiresAtMs
-				},
-				authorized_operation: {
-					kind: "reusable_wallet_session_authorized_operation_v1",
-					...commonAuthorizedOperation
-				}
-			};
-		case "operation_step_up":
-			if (operation.authorization.kind !== "verified_step_up" || operation.quota.kind !== "quota_neutral") throw new Error("Verified step-up authorized operation is invalid");
-			return {
-				binding: {
-					kind: "operation_step_up",
-					authorization_session_id: input.binding.authorizationSessionId,
-					org_id: input.binding.orgId,
-					project_id: input.binding.projectId,
-					environment: input.binding.environment,
-					subject_id: input.binding.subjectId
-				},
-				authorized_operation: {
-					kind: "verified_step_up_authorized_operation_v1",
-					authorization_session_id: input.binding.authorizationSessionId,
-					evidence_set_digest: operation.authorization.evidenceSetDigest,
-					...commonAuthorizedOperation
-				}
-			};
-	}
-}
 function routerAbOwnerOperationStepUpDecision(input) {
 	const reason = (() => {
 		switch (input.code) {
@@ -138,6 +46,7 @@ async function evaluateRouterAbNormalSigningAdmission(input) {
 	};
 	if (input.curve === "ed25519") return await input.adapter.evaluatePolicy({
 		curve: "ed25519",
+		policyReadSource: input.policyReadSource,
 		authorityKind: "wallet_authority_v1",
 		authorityId: input.authorityId,
 		phase: input.phase,
@@ -205,6 +114,6 @@ function routerAbErrorMessage(error) {
 	return String(error && typeof error === "object" && "message" in error ? error.message : error || "unknown error");
 }
 //#endregion
-export { buildRouterAbEcdsaAcceptedAuthorizedOperationV1, buildRouterAbEd25519AcceptedAuthorizedOperationV1, evaluateRouterAbNormalSigningAdmission, requireAuthorizationValue, requireMpcMaterialActivationId, routerAbErrorMessage, routerAbOwnerOperationFailureResult, routerAbOwnerOperationStepUpDecision, routerAbSigningError, routerAbStepUpError, routerAbWalletSessionValidationStatus };
+export { evaluateRouterAbNormalSigningAdmission, requireAuthorizationValue, requireMpcMaterialActivationId, routerAbErrorMessage, routerAbOwnerOperationFailureResult, routerAbOwnerOperationStepUpDecision, routerAbSigningError, routerAbStepUpError, routerAbWalletSessionValidationStatus };
 
 //# sourceMappingURL=routerAbNormalSigningAdmission.js.map

package/dist/esm/router/domains/signingOperations/routerAbPrivateSigningWorker.js

@@ -1,6 +1,6 @@
+import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import "../../../shared-ts/src/utils/encoders.js";
-import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
 import { parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1, parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1, routerAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestDigestV1, routerAbEcdsaDerivationEvmDigestSigningRequestDigestV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { postRouterAbInternalServiceJson } from "../../../core/ThresholdService/routerAb/internalServiceHttp.js";
 import { requireMpcMaterialActivationId, routerAbSigningError } from "./routerAbNormalSigningAdmission.js";
@@ -47,18 +47,6 @@ function registrationMaterialSourceV1(input) {
 		}
 	};
 }
-function routerAbNormalSigningMaterialSourceFromActiveLaneV1(input) {
-	const groupPublicKey = input.groupPublicKey.trim();
-	if (groupPublicKey.length === 0) throw new Error("active lane group public key is required");
-	return {
-		kind: "rotatable_lane",
-		lookup: {
-			identity: input.identity,
-			admittedLaneIdentityDigestB64u: input.admittedLaneIdentityDigestB64u
-		},
-		group_public_key: groupPublicKey
-	};
-}
 function nonEmptyString(value) {
 	return String(value || "").trim();
 }
@@ -395,7 +383,7 @@ async function buildRouterAbEd25519PrivateSigningWorkerBody(input) {
 	const scope = parseRouterAbEd25519NormalSigningScopeV2(input.body.scope);
 	const signingContext = privateSigningAuthorizationContext(scope, input.authorization);
 	const trustedSourceDigest = await privateSigningTrustedSourceDigest(input.headers);
-	const materialSource = input.materialSource ?? registrationMaterialSourceV1({
+	const materialSource = registrationMaterialSourceV1({
 		accountId: scope.account_id,
 		materialActivationId: scope.material_activation.activation_id,
 		signingWorkerId: scope.signing_worker_id
@@ -490,8 +478,7 @@ async function buildRouterAbEcdsaDerivationPrivateSigningWorkerBody(input) {
 			request,
 			requestDigest: await routerAbEcdsaDerivationEvmDigestSigningRequestDigestV1(request),
 			signingContext,
-			trustedSourceDigest,
-			materialSource: input.materialSource
+			trustedSourceDigest
 		});
 	}
 	const request = parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1(input.body);
@@ -500,8 +487,7 @@ async function buildRouterAbEcdsaDerivationPrivateSigningWorkerBody(input) {
 		request,
 		requestDigest: await routerAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestDigestV1(request),
 		signingContext,
-		trustedSourceDigest,
-		materialSource: input.materialSource
+		trustedSourceDigest
 	});
 }
 function privateEcdsaDerivationSigningWorkerBody(input) {
@@ -514,7 +500,7 @@ function privateEcdsaDerivationSigningWorkerBody(input) {
 			intentDigest: input.requestDigest,
 			trustedSourceDigest: input.trustedSourceDigest
 		}),
-		material_source: input.materialSource ?? registrationMaterialSourceV1({
+		material_source: registrationMaterialSourceV1({
 			accountId: input.request.scope.wallet_id,
 			materialActivationId: input.request.scope.material_activation.activation_id,
 			signingWorkerId: input.request.scope.signing_worker.server_id
@@ -544,6 +530,6 @@ async function postRouterAbSigningWorkerJson(input) {
 	};
 }
 //#endregion
-export { ROUTER_AB_ECDSA_DERIVATION_PRIVATE_SIGNING_PATHS, ROUTER_AB_ED25519_PRIVATE_SIGNING_PATHS, buildRouterAbEcdsaDerivationPrivateSigningWorkerBody, buildRouterAbEd25519PrivateSigningWorkerBody, computeRouterAbEd25519NormalSigningAdmissionMaterial, isRouterAbEcdsaSigningWorkerOperationInProgress, parseRouterAbEd25519NormalSigningScopeV2, postRouterAbSigningWorkerJson, replayResponseFromSigningWorkerResult, requirePrivateSigningDigest, routerAbNormalSigningMaterialSourceFromActiveLaneV1 };
+export { ROUTER_AB_ECDSA_DERIVATION_PRIVATE_SIGNING_PATHS, ROUTER_AB_ED25519_PRIVATE_SIGNING_PATHS, buildRouterAbEcdsaDerivationPrivateSigningWorkerBody, buildRouterAbEd25519PrivateSigningWorkerBody, computeRouterAbEd25519NormalSigningAdmissionMaterial, isRouterAbEcdsaSigningWorkerOperationInProgress, parseRouterAbEd25519NormalSigningScopeV2, postRouterAbSigningWorkerJson, replayResponseFromSigningWorkerResult, requirePrivateSigningDigest };
 
 //# sourceMappingURL=routerAbPrivateSigningWorker.js.map

package/dist/esm/router/domains/signingOperations/signingPrepareSession.js

@@ -0,0 +1,33 @@
+import { projectExactWalletSessionAuthorizationV1 } from "../../../authorization/domain.js";
+//#region src/router/domains/signingOperations/signingPrepareSession.ts
+/** The session snapshot validated for this admission, before its quota claim. */
+function signingPrepareSessionResponse(signing, authorization) {
+	switch (authorization.kind) {
+		case "operation_step_up": return {
+			kind: "operation_step_up",
+			signing
+		};
+		case "wallet_session_operation_credential_v1": {
+			const { session, quota } = authorization.validated.admission.context.authorization;
+			return {
+				kind: "reusable_wallet_session",
+				signing,
+				session_status: {
+					ok: true,
+					status: "active",
+					walletSessionId: session.walletSessionId,
+					quotaId: session.quotaId,
+					remainingUses: quota.remainingUses,
+					expiresAtMs: quota.expiresAtMs,
+					quotaLifecycle: "active",
+					authorization: projectExactWalletSessionAuthorizationV1(session)
+				}
+			};
+		}
+		case "wallet_session_operation_credential_exhausted_candidate_v1": throw new Error("An exhausted Wallet Session cannot publish a fresh prepare response");
+	}
+}
+//#endregion
+export { signingPrepareSessionResponse };
+
+//# sourceMappingURL=signingPrepareSession.js.map

package/dist/esm/router/domains/signingOperations/walletExecutionAdmission.js

@@ -1,8 +1,8 @@
 import { mpcMaterialActivationRefsEqual } from "../../../shared-ts/src/utils/domainIds.js";
 import { CAPABILITY_KINDS, EVM_ECDSA_MPC_OPERATION_KINDS, NEAR_ED25519_MPC_OPERATION_KINDS } from "../../../shared-ts/src/authorization/capabilityKinds.js";
 import { buildWalletSessionCapabilitySubjectsV1, walletSessionCapabilitySubjectsV1Equal } from "../../../authorization/domain.js";
-import { computeOwnerLaneParticipantBindingDigestV1 } from "../../../shared-ts/src/signing-lanes/ownerContinuity.js";
 import { buildPreparedOwnerWalletExecution } from "../../../shared-ts/src/signing-lanes/execution.js";
+import { computeOwnerLaneParticipantBindingDigestV1 } from "../../../shared-ts/src/signing-lanes/ownerContinuity.js";
 import "../../../shared-ts/src/signing-lanes/index.js";
 //#region src/router/domains/signingOperations/walletExecutionAdmission.ts
 function validateWalletSessionAuthorizationV2Context(input) {
@@ -74,8 +74,7 @@ function resolveWalletSessionAuthorizationV2AdministrationAdmission(input) {
 			if (!subject || subject.authorityId !== input.authority.authorityId) return admissionRefused("capability_subject_mismatch");
 			return {
 				ok: true,
-				operationKind: "link_devices",
-				authorityId: input.authority.authorityId
+				operationKind: "link_devices"
 			};
 		}
 		default: return assertNeverWalletSessionAuthorizationV2AdministrationOperation(input.operation.kind);

package/dist/esm/router/domains/walletRegistration/registrationSessionSeal.js

@@ -0,0 +1,121 @@
+import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
+//#region src/router/domains/walletRegistration/registrationSessionSeal.ts
+/** Holds one request's computation until registration can publish its response. */
+var RegistrationPreparedSessionSeal = class {
+	constructor(request, service) {
+		this.request = request;
+		this.service = service;
+		this.prepared = null;
+	}
+	async prepare(session) {
+		await this.finish(session);
+	}
+	async finish(session) {
+		const tokens = session.tokens;
+		const ed25519 = tokens.kind === "near_ed25519" || tokens.kind === "near_ed25519_and_evm_family_ecdsa" ? tokens.ed25519 : null;
+		if (!ed25519 || String(ed25519.thresholdSessionId) !== this.request.thresholdSessionId) return {
+			ok: false,
+			code: "invalid_session_seal",
+			message: "Prepared seal does not match the established Ed25519 session"
+		};
+		if (this.prepared === null) this.prepared = {
+			walletId: String(session.walletId),
+			walletSessionId: String(session.walletSessionId),
+			expiresAtMs: session.expiresAtMs,
+			result: applyRegistrationSessionSeal(this.service, this.request, session)
+		};
+		if (this.prepared.walletId !== String(session.walletId) || this.prepared.walletSessionId !== String(session.walletSessionId) || this.prepared.expiresAtMs !== session.expiresAtMs) return {
+			ok: false,
+			code: "invalid_session_seal",
+			message: "Prepared seal does not match the committed Wallet Session"
+		};
+		const sealed = await this.prepared.result;
+		if (!sealed.ok) return sealed;
+		const keyVersion = String(sealed.keyVersion || "").trim();
+		if (!keyVersion) return {
+			ok: false,
+			code: "invalid_session_seal",
+			message: "Signing-session seal response is missing its key version"
+		};
+		const expiresAtMs = Math.min(sealed.expiresAtMs ?? session.expiresAtMs, session.expiresAtMs);
+		if (expiresAtMs <= Date.now()) return {
+			ok: false,
+			code: "expired",
+			message: "threshold session expired"
+		};
+		return {
+			ok: true,
+			value: {
+				ciphertext: sealed.ciphertext,
+				keyVersion,
+				expiresAtMs,
+				remainingUses: session.remainingUses
+			}
+		};
+	}
+};
+async function applyRegistrationSessionSeal(service, request, session) {
+	if (!service) return {
+		ok: false,
+		code: "signing_session_seal_unavailable",
+		message: "Signing-session sealing is unavailable"
+	};
+	try {
+		return await service.applyServerSeal(request, {
+			userId: String(session.walletId),
+			session: {
+				kind: "exact_wallet_session_operation_credential",
+				curve: "ed25519",
+				thresholdSessionId: request.thresholdSessionId,
+				userId: String(session.walletId),
+				expiresAtMs: session.expiresAtMs
+			}
+		});
+	} catch {
+		return {
+			ok: false,
+			code: "signing_session_seal_unavailable",
+			message: "Signing-session sealing failed"
+		};
+	}
+}
+function parseRegistrationPreparedSessionSeal(raw, service) {
+	if (raw === void 0) return {
+		ok: true,
+		value: null
+	};
+	if (!isPlainObject(raw)) return {
+		ok: false,
+		code: "invalid_body",
+		message: "sessionSeal must be an object"
+	};
+	for (const field of Object.keys(raw)) if (![
+		"thresholdSessionId",
+		"ciphertext",
+		"keyVersion"
+	].includes(field)) return {
+		ok: false,
+		code: "invalid_body",
+		message: "sessionSeal has unknown fields"
+	};
+	const thresholdSessionId = String(raw.thresholdSessionId || "").trim();
+	const ciphertext = String(raw.ciphertext || "").trim();
+	const keyVersion = String(raw.keyVersion || "").trim();
+	if (!thresholdSessionId || !ciphertext) return {
+		ok: false,
+		code: "invalid_body",
+		message: "sessionSeal thresholdSessionId and ciphertext are required"
+	};
+	return {
+		ok: true,
+		value: new RegistrationPreparedSessionSeal({
+			thresholdSessionId,
+			ciphertext,
+			...keyVersion ? { keyVersion } : {}
+		}, service)
+	};
+}
+//#endregion
+export { parseRegistrationPreparedSessionSeal };
+
+//# sourceMappingURL=registrationSessionSeal.js.map

package/dist/esm/router/domains/walletRegistration/walletRegistrationReservation.js

@@ -0,0 +1,70 @@
+import { parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId } from "../../../shared-ts/src/utils/domainIds.js";
+import { parseDeviceId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
+import { isPlainObject, requireCanonicalString } from "../../../shared-ts/src/utils/validation.js";
+import { alphabetizeStringify, sha256HexUtf8 } from "../../../shared-ts/src/utils/digests.js";
+import { secureRandomBase64Url } from "../../../shared-ts/src/utils/secureRandomId.js";
+import { createServerAllocatedWalletId } from "../../../shared-ts/src/utils/registrationIds.js";
+//#region src/router/domains/walletRegistration/walletRegistrationReservation.ts
+function requireId(result) {
+	if (!result.ok) throw new Error(result.error.message);
+	return result.value;
+}
+function parseWalletRegistrationSetupReservation(raw) {
+	if (!isPlainObject(raw)) throw new Error("Registration reservation is invalid");
+	const ceremonyId = requireCanonicalString(raw.ceremonyId, "ceremonyId");
+	const preparationId = requireCanonicalString(raw.preparationId, "preparationId");
+	if (!/^wrc_[A-Za-z0-9_-]{43}$/u.test(ceremonyId) || !/^regprep_[A-Za-z0-9_-]{43}$/u.test(preparationId)) throw new Error("Registration reservation ceremony identity is invalid");
+	const reservedAtMs = raw.reservedAtMs;
+	if (typeof reservedAtMs !== "number" || !Number.isSafeInteger(reservedAtMs) || reservedAtMs <= 0) throw new Error("Registration reservation timestamp is invalid");
+	return {
+		walletId: requireId(parseWalletId(raw.walletId)),
+		ceremonyId,
+		preparationId,
+		walletAuthorityId: requireId(parseWalletAuthorityId(raw.walletAuthorityId)),
+		deviceId: requireId(parseDeviceId(raw.deviceId)),
+		walletAuthMethodId: requireId(parseWalletAuthMethodId(raw.walletAuthMethodId)),
+		reservedAtMs
+	};
+}
+function proposeWalletRegistrationSetup(input) {
+	return parseWalletRegistrationSetupReservation({
+		walletId: input.request.wallet?.kind === "provided" ? input.request.wallet.walletId : createServerAllocatedWalletId(),
+		ceremonyId: `wrc_${secureRandomBase64Url(32)}`,
+		preparationId: `regprep_${secureRandomBase64Url(32)}`,
+		walletAuthorityId: `wallet-authority:${secureRandomBase64Url(32)}`,
+		deviceId: `device:${secureRandomBase64Url(32)}`,
+		walletAuthMethodId: `wallet-auth-method:${secureRandomBase64Url(32)}`,
+		reservedAtMs: Date.now()
+	});
+}
+async function walletRegistrationSetupRequestDigest(namespace, input) {
+	if (!input.runtimePolicyScope || input.runtimePolicyScope.orgId !== input.orgId) throw new Error("Registration reservation requires an exact authenticated tenant scope");
+	return sha256HexUtf8(alphabetizeStringify({
+		namespace,
+		runtimePolicyScope: input.runtimePolicyScope,
+		expectedOrigin: input.expectedOrigin,
+		wallet: input.request.wallet ?? { kind: "server_allocated" },
+		authMethod: input.request.authMethod,
+		signerSelection: input.request.signerSelection
+	}));
+}
+async function cancelRegistrationHome(authority, input) {
+	if (!authority) return {
+		ok: false,
+		code: "registration_authority_unavailable",
+		message: "Registration reservation authority is required"
+	};
+	return authority.cancel(input);
+}
+async function admitRegistrationReservationHome(authority, input) {
+	if (!authority) return {
+		ok: false,
+		code: "registration_authority_unavailable",
+		message: "Registration reservation authority is required"
+	};
+	return authority.admitHome(input);
+}
+//#endregion
+export { admitRegistrationReservationHome, cancelRegistrationHome, parseWalletRegistrationSetupReservation, proposeWalletRegistrationSetup, walletRegistrationSetupRequestDigest };
+
+//# sourceMappingURL=walletRegistrationReservation.js.map