@seams/wallet-server 0.7.3 → 0.9.0

package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbNormalSigningAdmission.d.ts

@@ -1,4 +1,4 @@
-import type { D1EcdsaAdmissionPolicyRead } from '../../cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore';
+import type { D1EcdsaAdmissionPolicyRead, D1Ed25519AdmissionPolicyRead } from '../../cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore';
 import type { RouterAbNormalSigningAuthorizationIdentity } from '../../../core/routerAbSigning/RouterAbNormalSigningRuntime';
 import type { RouterAbNormalSigningRuntime } from '../../../core/routerAbSigning/RouterAbNormalSigningRuntime';
 import type { ThresholdEd25519AuthorityScope } from '../../../core/types';
@@ -8,205 +8,6 @@ import type { AuthorizationParseResult } from '../../../../../shared-ts/src/auth
 import type { AuthorizedOperation, AuthorizedOperationReplayResponse, OwnerOperationStepUpReason } from '../../../authorization/domain';
 import type { RouterAbMpcMaterialActivationRefWire } from '../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
 import { type MpcMaterialActivationId } from '../../../../../shared-ts/src/utils/domainIds';
-type RouterAbAcceptedAuthorizedOperationBindingV1 = {
-    readonly kind: 'reusable_wallet_session';
-    readonly walletSessionId: string;
-    readonly quotaId: string;
-} | {
-    readonly kind: 'gateway_owner_wallet_session';
-    readonly subjectId: string;
-    readonly accountId: string;
-    readonly authorizationId: string;
-    readonly walletSessionId: string;
-    readonly quotaId: string;
-    readonly thresholdSessionId: string;
-    readonly orgId: string;
-    readonly projectId: string;
-    readonly environment: string;
-    readonly signingWorkerId: string;
-    readonly expiresAtMs: number;
-} | {
-    readonly kind: 'operation_step_up';
-    readonly authorizationSessionId: string;
-    readonly orgId: string;
-    readonly projectId: string;
-    readonly environment: string;
-    readonly subjectId: string;
-};
-export declare function buildRouterAbEd25519AcceptedAuthorizedOperationV1(input: {
-    readonly operation: AuthorizedOperation;
-    readonly binding: RouterAbAcceptedAuthorizedOperationBindingV1;
-}): {
-    binding: {
-        kind: "reusable_wallet_session";
-        authorization_id: import("../../../../../shared-ts/src/authorization/capabilityKinds").WalletSessionAuthorizationId;
-        wallet_session_id: string;
-        quota_id: string;
-        subject_id?: undefined;
-        account_id?: undefined;
-        threshold_session_id?: undefined;
-        org_id?: undefined;
-        project_id?: undefined;
-        environment?: undefined;
-        signing_worker_id?: undefined;
-        expires_at_ms?: undefined;
-        authorization_session_id?: undefined;
-    };
-    authorized_operation: {
-        authorized_operation_id: import("../../../../../shared-ts/src/authorization/capabilityKinds").AuthorizedOperationId;
-        operation_id: import("../../../../../shared-ts/src/authorization/capabilityKinds").CapabilityOperationId;
-        capability_kind: "near_ed25519_mpc_signing" | "evm_ecdsa_mpc_signing";
-        operation_kind: "near.sign_transaction" | "near.sign_delegate_action" | "near.sign_nep413_message" | "evm.sign_transaction";
-        lane_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
-        intent_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
-        display_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
-        operation_fingerprint_digest: import("../../../../../shared-ts/src/authorization").CapabilityOperationFingerprintDigest;
-        kind: "reusable_wallet_session_authorized_operation_v1";
-    };
-} | {
-    binding: {
-        kind: "gateway_owner_wallet_session";
-        subject_id: string;
-        account_id: string;
-        authorization_id: string;
-        wallet_session_id: string;
-        quota_id: string;
-        threshold_session_id: string;
-        org_id: string;
-        project_id: string;
-        environment: string;
-        signing_worker_id: string;
-        expires_at_ms: number;
-        authorization_session_id?: undefined;
-    };
-    authorized_operation: {
-        authorized_operation_id: import("../../../../../shared-ts/src/authorization/capabilityKinds").AuthorizedOperationId;
-        operation_id: import("../../../../../shared-ts/src/authorization/capabilityKinds").CapabilityOperationId;
-        capability_kind: "near_ed25519_mpc_signing" | "evm_ecdsa_mpc_signing";
-        operation_kind: "near.sign_transaction" | "near.sign_delegate_action" | "near.sign_nep413_message" | "evm.sign_transaction";
-        lane_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
-        intent_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
-        display_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
-        operation_fingerprint_digest: import("../../../../../shared-ts/src/authorization").CapabilityOperationFingerprintDigest;
-        kind: "reusable_wallet_session_authorized_operation_v1";
-    };
-} | {
-    binding: {
-        kind: "operation_step_up";
-        authorization_session_id: string;
-        org_id: string;
-        project_id: string;
-        environment: string;
-        subject_id: string;
-        authorization_id?: undefined;
-        wallet_session_id?: undefined;
-        quota_id?: undefined;
-        account_id?: undefined;
-        threshold_session_id?: undefined;
-        signing_worker_id?: undefined;
-        expires_at_ms?: undefined;
-    };
-    authorized_operation: {
-        authorized_operation_id: import("../../../../../shared-ts/src/authorization/capabilityKinds").AuthorizedOperationId;
-        operation_id: import("../../../../../shared-ts/src/authorization/capabilityKinds").CapabilityOperationId;
-        capability_kind: "near_ed25519_mpc_signing" | "evm_ecdsa_mpc_signing";
-        operation_kind: "near.sign_transaction" | "near.sign_delegate_action" | "near.sign_nep413_message" | "evm.sign_transaction";
-        lane_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
-        intent_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
-        display_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
-        operation_fingerprint_digest: import("../../../../../shared-ts/src/authorization").CapabilityOperationFingerprintDigest;
-        kind: "verified_step_up_authorized_operation_v1";
-        authorization_session_id: string;
-        evidence_set_digest: import("../../../../../shared-ts/src/utils").DigestB64u;
-    };
-};
-export declare function buildRouterAbEcdsaAcceptedAuthorizedOperationV1(input: {
-    readonly operation: AuthorizedOperation;
-    readonly binding: RouterAbAcceptedAuthorizedOperationBindingV1;
-}): {
-    binding: {
-        kind: "reusable_wallet_session";
-        authorization_id: import("../../../../../shared-ts/src/authorization/capabilityKinds").WalletSessionAuthorizationId;
-        wallet_session_id: string;
-        quota_id: string;
-        subject_id?: undefined;
-        account_id?: undefined;
-        threshold_session_id?: undefined;
-        org_id?: undefined;
-        project_id?: undefined;
-        environment?: undefined;
-        signing_worker_id?: undefined;
-        expires_at_ms?: undefined;
-        authorization_session_id?: undefined;
-    };
-    authorized_operation: {
-        authorized_operation_id: import("../../../../../shared-ts/src/authorization/capabilityKinds").AuthorizedOperationId;
-        operation_id: import("../../../../../shared-ts/src/authorization/capabilityKinds").CapabilityOperationId;
-        capability_kind: "near_ed25519_mpc_signing" | "evm_ecdsa_mpc_signing";
-        operation_kind: "near.sign_transaction" | "near.sign_delegate_action" | "near.sign_nep413_message" | "evm.sign_transaction";
-        lane_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
-        intent_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
-        display_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
-        operation_fingerprint_digest: import("../../../../../shared-ts/src/authorization").CapabilityOperationFingerprintDigest;
-        kind: "reusable_wallet_session_authorized_operation_v1";
-    };
-} | {
-    binding: {
-        kind: "gateway_owner_wallet_session";
-        subject_id: string;
-        account_id: string;
-        authorization_id: string;
-        wallet_session_id: string;
-        quota_id: string;
-        threshold_session_id: string;
-        org_id: string;
-        project_id: string;
-        environment: string;
-        signing_worker_id: string;
-        expires_at_ms: number;
-        authorization_session_id?: undefined;
-    };
-    authorized_operation: {
-        authorized_operation_id: import("../../../../../shared-ts/src/authorization/capabilityKinds").AuthorizedOperationId;
-        operation_id: import("../../../../../shared-ts/src/authorization/capabilityKinds").CapabilityOperationId;
-        capability_kind: "near_ed25519_mpc_signing" | "evm_ecdsa_mpc_signing";
-        operation_kind: "near.sign_transaction" | "near.sign_delegate_action" | "near.sign_nep413_message" | "evm.sign_transaction";
-        lane_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
-        intent_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
-        display_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
-        operation_fingerprint_digest: import("../../../../../shared-ts/src/authorization").CapabilityOperationFingerprintDigest;
-        kind: "reusable_wallet_session_authorized_operation_v1";
-    };
-} | {
-    binding: {
-        kind: "operation_step_up";
-        authorization_session_id: string;
-        org_id: string;
-        project_id: string;
-        environment: string;
-        subject_id: string;
-        authorization_id?: undefined;
-        wallet_session_id?: undefined;
-        quota_id?: undefined;
-        account_id?: undefined;
-        threshold_session_id?: undefined;
-        signing_worker_id?: undefined;
-        expires_at_ms?: undefined;
-    };
-    authorized_operation: {
-        authorized_operation_id: import("../../../../../shared-ts/src/authorization/capabilityKinds").AuthorizedOperationId;
-        operation_id: import("../../../../../shared-ts/src/authorization/capabilityKinds").CapabilityOperationId;
-        capability_kind: "near_ed25519_mpc_signing" | "evm_ecdsa_mpc_signing";
-        operation_kind: "near.sign_transaction" | "near.sign_delegate_action" | "near.sign_nep413_message" | "evm.sign_transaction";
-        lane_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
-        intent_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
-        display_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
-        operation_fingerprint_digest: import("../../../../../shared-ts/src/authorization").CapabilityOperationFingerprintDigest;
-        kind: "verified_step_up_authorized_operation_v1";
-        authorization_session_id: string;
-        evidence_set_digest: import("../../../../../shared-ts/src/utils").DigestB64u;
-    };
-};
 export type RouterAbSigningWorkerJsonResult = {
     ok: true;
     body: unknown;
@@ -278,16 +79,18 @@ export type RouterAbNormalSigningAdmissionFailure = {
 export type RouterAbNormalSigningAdmissionResult = {
     ok: true;
 } | RouterAbNormalSigningAdmissionFailure;
-type RouterAbNormalSigningPolicyReadSource = {
+/** Where a policy decision comes from: the store, or rows the credential read already holds. */
+type RouterAbNormalSigningPolicyReadSource<PolicyRead> = {
     readonly kind: 'database';
     readonly policyRead?: never;
 } | {
     readonly kind: 'credential_snapshot';
-    readonly policyRead: D1EcdsaAdmissionPolicyRead;
+    readonly policyRead: PolicyRead;
 };
+export type RouterAbEd25519PolicyReadSource = RouterAbNormalSigningPolicyReadSource<D1Ed25519AdmissionPolicyRead>;
 export type RouterAbNormalSigningAdmissionInput = {
     curve: 'ed25519';
-    readonly policyReadSource?: never;
+    readonly policyReadSource: RouterAbEd25519PolicyReadSource;
     authorityKind: 'wallet_authority_v1';
     authorityId: string;
     authorityScope?: never;
@@ -317,7 +120,7 @@ export type RouterAbNormalSigningAdmissionInput = {
     runtimePolicyScope: RuntimePolicyScope;
 } | {
     curve: 'ecdsa';
-    readonly policyReadSource: RouterAbNormalSigningPolicyReadSource;
+    readonly policyReadSource: RouterAbNormalSigningPolicyReadSource<D1EcdsaAdmissionPolicyRead>;
     phase: 'prepare' | 'finalize';
     walletId: string;
     materialActivationId: MpcMaterialActivationId;
@@ -334,7 +137,7 @@ export interface RouterAbNormalSigningAdmissionAdapter {
 export type RouterAbNormalSigningAdmissionEvaluationInput = {
     adapter: RouterAbNormalSigningAdmissionAdapter | null | undefined;
     curve: 'ed25519';
-    readonly policyReadSource?: never;
+    readonly policyReadSource: RouterAbEd25519PolicyReadSource;
     authorizationKind: 'wallet_session_operation_credential_v1';
     phase: 'prepare' | 'finalize';
     walletId: string;
@@ -349,7 +152,7 @@ export type RouterAbNormalSigningAdmissionEvaluationInput = {
 } | {
     adapter: RouterAbNormalSigningAdmissionAdapter | null | undefined;
     curve: 'ecdsa';
-    readonly policyReadSource: RouterAbNormalSigningPolicyReadSource;
+    readonly policyReadSource: RouterAbNormalSigningPolicyReadSource<D1EcdsaAdmissionPolicyRead>;
     authorizationKind: 'wallet_session_operation_credential_v1';
     phase: 'prepare' | 'finalize';
     walletId: string;

package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbPrivateSigningWorker.d.ts

@@ -1,7 +1,6 @@
 import type { RouterAbSigningWorkerPrivateTransport } from '../../../core/routerAbSigning/RouterAbNormalSigningRuntime';
 import { type RouterAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestV1Wire, type RouterAbEcdsaDerivationEvmDigestSigningRequestV1Wire, type RouterAbPublicDigest32V1Wire } from '../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
 import type { RuntimePolicyScope } from '../../../../../shared-ts/src/threshold/signingRootScope';
-import type { SigningWorkerLaneMaterialIdentityV1 } from '../../../core/signingLanes/signingWorkerLaneMaterialIdentity';
 import type { AuthorizedOperationReplayResponse } from '../../../authorization/domain';
 import type { RouterAbNormalSigningAuthorizationWire } from '../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
 import type { MpcMaterialActivationId } from '../../../../../shared-ts/src/utils/domainIds';
@@ -146,20 +145,7 @@ export type RouterAbNormalSigningMaterialSourceV1 = {
         readonly material_activation_id: string;
         readonly signing_worker_id: string;
     };
-    readonly group_public_key?: never;
-} | {
-    readonly kind: 'rotatable_lane';
-    readonly lookup: {
-        readonly identity: SigningWorkerLaneMaterialIdentityV1;
-        readonly admittedLaneIdentityDigestB64u: string;
-    };
-    readonly group_public_key: string;
 };
-export declare function routerAbNormalSigningMaterialSourceFromActiveLaneV1(input: {
-    readonly identity: SigningWorkerLaneMaterialIdentityV1;
-    readonly admittedLaneIdentityDigestB64u: string;
-    readonly groupPublicKey: string;
-}): RouterAbNormalSigningMaterialSourceV1;
 export declare function replayResponseFromSigningWorkerResult(result: RouterAbSigningWorkerJsonResult): AuthorizedOperationReplayResponse;
 export declare function isRouterAbEcdsaSigningWorkerOperationInProgress(result: RouterAbSigningWorkerJsonResult): boolean;
 export declare function parseRouterAbEd25519NormalSigningScopeV2(value: unknown): RouterAbEd25519NormalSigningScopeV2;
@@ -177,7 +163,6 @@ type RouterAbEd25519PrivateSigningWorkerBuildInput = {
     readonly body: Record<string, unknown>;
     readonly authorization: RouterAbPrivateSigningAuthorization;
     readonly headers: Record<string, string | string[] | undefined>;
-    readonly materialSource?: RouterAbNormalSigningMaterialSourceV1;
     readonly effectClaim?: never;
 } | {
     readonly phase: 'finalize';
@@ -185,7 +170,6 @@ type RouterAbEd25519PrivateSigningWorkerBuildInput = {
     readonly authorization: RouterAbPrivateSigningAuthorization;
     readonly headers: Record<string, string | string[] | undefined>;
     readonly effectClaim: RouterAbNormalSigningEffectClaimV1;
-    readonly materialSource?: RouterAbNormalSigningMaterialSourceV1;
 };
 export declare function buildRouterAbEd25519PrivateSigningWorkerBody(input: RouterAbEd25519PrivateSigningWorkerBuildInput): Promise<RouterAbEd25519PrivateSigningWorkerBody>;
 export declare function buildRouterAbEcdsaDerivationPrivateSigningWorkerBody(input: {
@@ -193,7 +177,6 @@ export declare function buildRouterAbEcdsaDerivationPrivateSigningWorkerBody(inp
     body: Record<string, unknown>;
     authorization: RouterAbPrivateSigningAuthorization;
     headers: Record<string, string | string[] | undefined>;
-    materialSource?: RouterAbNormalSigningMaterialSourceV1;
 }): Promise<RouterAbEcdsaDerivationPrivateSigningWorkerBody>;
 export type RouterAbEcdsaOperationStepUpRequest = RouterAbEcdsaDerivationEvmDigestSigningRequestV1Wire | RouterAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestV1Wire;
 export declare function postRouterAbSigningWorkerJson(input: {

package/dist/types/wallet-server/src/router/domains/signingOperations/signingPrepareSession.d.ts

@@ -0,0 +1,23 @@
+import type { Variant } from '../../../../../shared-ts/src/utils/variant';
+import type { RouterAbEd25519NormalSigningAuthorizationResult } from './routerAbEd25519NormalSigningRoute';
+import type { RouterAbEcdsaNormalSigningAuthorizationResult } from './routerAbEcdsaDerivationNormalSigningRoute';
+/** The session snapshot validated for this admission, before its quota claim. */
+export declare function signingPrepareSessionResponse(signing: unknown, authorization: Variant<RouterAbEcdsaNormalSigningAuthorizationResult | RouterAbEd25519NormalSigningAuthorizationResult, 'ok', true>): {
+    kind: "operation_step_up";
+    signing: unknown;
+    session_status?: undefined;
+} | {
+    kind: "reusable_wallet_session";
+    signing: unknown;
+    session_status: {
+        ok: boolean;
+        status: string;
+        walletSessionId: import("../../../../../shared-ts/src/authorization").WalletSessionId;
+        quotaId: import("../../../../../shared-ts/src/authorization").MpcWalletSigningQuotaId;
+        remainingUses: number;
+        expiresAtMs: number;
+        quotaLifecycle: string;
+        authorization: import("../../../../../shared-ts/src/device-linking").ActiveWalletSessionV1;
+    };
+};
+//# sourceMappingURL=signingPrepareSession.d.ts.map

package/dist/types/wallet-server/src/router/domains/signingOperations/walletExecutionAdmission.d.ts

@@ -1,7 +1,7 @@
 import { EVM_ECDSA_MPC_OPERATION_KINDS, NEAR_ED25519_MPC_OPERATION_KINDS } from '../../../../../shared-ts/src/authorization/capabilityKinds';
 import { type LaneParticipantBindingDigestB64u, type PreparedOwnerWalletExecution, type SigningLaneRecord, type WalletKeyRecord } from '../../../../../shared-ts/src/signing-lanes';
 import { type DigestB64u } from '../../../../../shared-ts/src/utils/canonicalPrimitives';
-import { type MpcMaterialActivationRef, type WalletAuthorityId, type WalletId, type WalletKeyId } from '../../../../../shared-ts/src/utils/domainIds';
+import { type MpcMaterialActivationRef, type WalletId, type WalletKeyId } from '../../../../../shared-ts/src/utils/domainIds';
 import type { ActiveWalletAuthorityV1 } from '../../../../../shared-ts/src/authorization/walletAuthority';
 import type { ExactAdministeredEcdsaSignerV1, ExactAdministeredEd25519SignerV1 } from '../../../../../shared-ts/src/device-linking/delegatedActivationPlan';
 import type { WalletAuthMethodRecordV2 } from '../../../../../shared-ts/src/utils/walletAuthMethodRecord';
@@ -68,7 +68,6 @@ export type WalletSessionAuthorizationV2AdmissionResult = ({
 export type WalletSessionAuthorizationV2AdministrationAdmissionResult = {
     readonly ok: true;
     readonly operationKind: 'link_devices';
-    readonly authorityId: WalletAuthorityId;
 } | {
     readonly ok: false;
     readonly error: WalletSessionAuthorizationV2AdmissionError;

package/dist/types/wallet-server/src/router/domains/walletRegistration/registrationSessionSeal.d.ts

@@ -0,0 +1,36 @@
+import type { RegistrationEstablishedSessionProjectionV2 } from '../../../../../shared-ts/src/utils/registrationEstablishedSession';
+import type { SigningSessionSealServerSealRequest, SigningSessionSealService } from '../../../threshold/session/signingSessionSeal/signingSessionSeal.types';
+type SealSession = Pick<RegistrationEstablishedSessionProjectionV2, 'walletId' | 'walletSessionId' | 'expiresAtMs' | 'remainingUses' | 'tokens'>;
+type SealFailure = {
+    readonly ok: false;
+    readonly code: string;
+    readonly message: string;
+};
+type SealResult = {
+    readonly ok: true;
+    readonly value: {
+        readonly ciphertext: string;
+        readonly keyVersion: string;
+        readonly expiresAtMs: number;
+        readonly remainingUses: number;
+    };
+} | SealFailure;
+/** Holds one request's computation until registration can publish its response. */
+declare class RegistrationPreparedSessionSeal {
+    private readonly request;
+    private readonly service;
+    private prepared;
+    constructor(request: SigningSessionSealServerSealRequest, service: SigningSessionSealService | null);
+    prepare(session: RegistrationEstablishedSessionProjectionV2): Promise<void>;
+    finish(session: SealSession): Promise<SealResult>;
+}
+export declare function parseRegistrationPreparedSessionSeal(raw: unknown, service: SigningSessionSealService | null): {
+    readonly ok: true;
+    readonly value: RegistrationPreparedSessionSeal | null;
+} | {
+    readonly ok: false;
+    readonly code: 'invalid_body';
+    readonly message: string;
+};
+export {};
+//# sourceMappingURL=registrationSessionSeal.d.ts.map

package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationInputs.d.ts

@@ -1,11 +1,13 @@
 import type { CorrelationId } from '../../../../../shared-ts/src/utils/canonicalPrimitives';
 import type { RegistrationSignerSetSelection } from '../../../../../shared-ts/src/utils/registrationSignerPlan';
+import type { RegistrationEstablishedSessionProjectionV2 } from '../../../../../shared-ts/src/utils/registrationEstablishedSession';
 import type { RegisterWalletInput, RegistrationAuthMethodInput } from '../../../../../shared-ts/src/utils/registrationAuthMethodInput';
 import type { RouterAbEcdsaRegistrationRequestV1, RouterAbEcdsaVerifiedClientActivationFactsV1 } from '../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
 import type { WalletRegistrationAuthorityInput, WalletRegistrationFinalizeSignerWork } from '../../../core/registrationContracts';
 import type { ThresholdRuntimePolicyScope } from '../../../core/types';
 import type { WalletRegistrationSetupMinter, WalletRegistrationSetupVerifier } from './walletRegistrationSetupPayload';
 export type WalletRegistrationSetupRequest = {
+    readonly registrationOperationId: string;
     readonly wallet?: RegisterWalletInput;
     readonly signerSelection: RegistrationSignerSetSelection;
     readonly authMethod: RegistrationAuthMethodInput;
@@ -54,9 +56,8 @@ export type WalletRegistrationActivateInput = {
      * request, so the client has nothing to cross-check against and asking it
      * to supply one would be theatre.
      */
-    readonly planKind: 'evm_family_ecdsa' | 'near_ed25519_and_evm_family_ecdsa' | 'near_ed25519';
-    /** Absent exactly when the plan is Ed25519-only. */
-    readonly ecdsa?: {
+    readonly planKind: 'evm_family_ecdsa' | 'near_ed25519_and_evm_family_ecdsa';
+    readonly ecdsa: {
         readonly activationCorrelationId: CorrelationId;
         readonly activationRequestDigestB64u: string;
         readonly clientActivation: RouterAbEcdsaVerifiedClientActivationFactsV1;
@@ -81,12 +82,12 @@ export type WalletRegistrationNearProvisioningInput = {
     }>['ed25519'];
     readonly emailOtpEnrollment?: unknown;
     /**
-     * The custody ceremony's sealed output. An Ed25519-only wallet establishes
-     * its custody *here* rather than at activate: activate returns
-     * `near_pending` with no Yao result yet, so this deferred leg is the first
-     * point at which that wallet has a key set to seal against.
+     * The custody ceremony's sealed output. NEAR-only registration commits its
+     * wallet and custody here after Yao and recovery backup complete.
      */
     readonly walletCustodyCommit?: unknown;
     readonly verifier: WalletRegistrationSetupVerifier;
+    /** Runs after session persistence, beside home publication. It exposes no response. */
+    readonly onSessionCommitted?: (session: RegistrationEstablishedSessionProjectionV2) => Promise<void>;
 };
 //# sourceMappingURL=walletRegistrationInputs.d.ts.map

package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationReservation.d.ts

@@ -0,0 +1,125 @@
+import type { WalletSessionLocatorPublication } from '../../../authorization/sessionRouting';
+import type { CommittedWalletRegistration } from '../../../authorization/domain';
+import type { D1PreparedStatementLike } from '../../../storage/tenantRoute';
+import { type DeviceId } from '../../../../../shared-ts/src/authorization/capabilityKinds';
+import { type WalletAuthorityId, type WalletAuthMethodId, type WalletId } from '../../../../../shared-ts/src/utils/domainIds';
+import type { WalletRegistrationSetupInput } from './walletRegistrationInputs';
+export type WalletRegistrationSetupReservation = {
+    readonly walletId: WalletId;
+    readonly ceremonyId: string;
+    readonly preparationId: string;
+    readonly walletAuthorityId: WalletAuthorityId;
+    readonly deviceId: DeviceId;
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly reservedAtMs: number;
+};
+export type WalletRegistrationSetupReservationResult = {
+    readonly ok: true;
+    readonly reservation: WalletRegistrationSetupReservation;
+    /** The ownership generation the reserved wallet's custody objects are named by. */
+    readonly ownershipGeneration: number;
+    readonly lifecycle: 'reserved' | 'established';
+    readonly code?: never;
+    readonly message?: never;
+} | {
+    readonly ok: false;
+    readonly code: string;
+    readonly message: string;
+    readonly reservation?: never;
+    readonly ownershipGeneration?: never;
+    readonly lifecycle?: never;
+};
+/** Persist custody addresses before setup completes, then start the reserved wallet objects. */
+export type RegistrationWalletStarter = (registration: {
+    readonly walletId: WalletId;
+    readonly ownershipGeneration: number;
+}) => Promise<void>;
+type ReservationOutcome = {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly code: string;
+    readonly message: string;
+};
+type RegistrationHomeAdmission<Purpose extends 'registration' | 'ordinary' = 'registration' | 'ordinary'> = {
+    readonly ok: true;
+    readonly ownershipGeneration: number;
+    readonly purpose: Purpose;
+    readonly code?: never;
+    readonly message?: never;
+} | {
+    readonly ok: false;
+    readonly code: string;
+    readonly message: string;
+    readonly ownershipGeneration?: never;
+    readonly purpose?: never;
+};
+export interface WalletExecutionAuthority {
+    admitEstablishedHome(input: {
+        readonly walletId: WalletId;
+    }): Promise<RegistrationHomeAdmission<'ordinary'>>;
+}
+export interface WalletRegistrationReservationAuthority {
+    reserve(input: WalletRegistrationSetupInput): Promise<WalletRegistrationSetupReservationResult>;
+    admitHome(input: {
+        readonly ceremonyId: string;
+        readonly walletId: WalletId;
+    }): Promise<RegistrationHomeAdmission>;
+    complete(input: {
+        readonly ceremonyId: string;
+        readonly walletId: WalletId;
+    } & ({
+        readonly outcome: 'established';
+        readonly session: WalletSessionLocatorPublication & {
+            readonly kind: 'credential';
+        };
+    } | {
+        readonly outcome: 'cancelled';
+        readonly session?: never;
+    })): Promise<ReservationOutcome>;
+}
+/**
+ * The local write that makes an established registration active. It follows
+ * the acknowledged directory write. It commits in the batch of the record
+ * that completes the registration operation, or it does not commit.
+ */
+export type RegistrationActivationWrite = {
+    readonly statements: readonly D1PreparedStatementLike[];
+};
+export type RegistrationEstablishedPublication = {
+    readonly ok: true;
+    /** None when an earlier completion already activated the registration. */
+    readonly activation: RegistrationActivationWrite | null;
+    readonly code?: never;
+    readonly message?: never;
+} | {
+    readonly ok: false;
+    readonly code: string;
+    readonly message: string;
+    readonly activation?: never;
+};
+/** The registration authority at the wallet's home, which owns the local activation. */
+export interface WalletRegistrationHomeAuthority extends Pick<WalletRegistrationReservationAuthority, 'reserve' | 'admitHome'> {
+    /**
+     * Publishes the committed registration decision to its directory and prepares the
+     * activation. The caller commits the activation with its completion record.
+     */
+    publishEstablished(input: {
+        readonly registration: CommittedWalletRegistration;
+        readonly session: WalletSessionLocatorPublication & {
+            readonly kind: 'credential';
+        };
+    }): Promise<RegistrationEstablishedPublication>;
+    /** Fixes a definitive cancellation, publishes it, and retires the local home. */
+    cancel(input: {
+        readonly ceremonyId: string;
+        readonly walletId: WalletId;
+    }): Promise<ReservationOutcome>;
+}
+export declare function parseWalletRegistrationSetupReservation(raw: unknown): WalletRegistrationSetupReservation;
+export declare function proposeWalletRegistrationSetup(input: Pick<WalletRegistrationSetupInput, 'request'>): WalletRegistrationSetupReservation;
+export declare function walletRegistrationSetupRequestDigest(namespace: string, input: Pick<WalletRegistrationSetupInput, 'request' | 'orgId' | 'expectedOrigin' | 'runtimePolicyScope'>): Promise<string>;
+export declare function cancelRegistrationHome(authority: Pick<WalletRegistrationHomeAuthority, 'cancel'> | null, input: Parameters<WalletRegistrationHomeAuthority['cancel']>[0]): Promise<ReservationOutcome>;
+export declare function admitRegistrationReservationHome(authority: Pick<WalletRegistrationReservationAuthority, 'admitHome'> | null, input: Parameters<WalletRegistrationReservationAuthority['admitHome']>[0]): Promise<RegistrationHomeAdmission>;
+export {};
+//# sourceMappingURL=walletRegistrationReservation.d.ts.map

package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationRoutes.d.ts

@@ -1,15 +1,17 @@
-import type { WalletRegistrationNearProvisioningResponseV2, WalletRegistrationNearAdmissionResponseV2, WalletRegistrationActivateRouteResponseV2, WalletRegistrationRespondResponseV2, WalletRegistrationSetupResponseV2 } from '../../../core/threeRouteRegistrationContracts';
+import type { WalletRegistrationContextResolver } from '../../framework/apiCredentialPorts';
+import type { WalletRegistrationNearProvisioningResponseV2, WalletRegistrationNearAdmissionResponseV2, WalletRegistrationActivateRouteResponseV2, WalletRegistrationRespondResponseV2 } from '../../../core/threeRouteRegistrationContracts';
 import type { RouterApiPublishableKeyAuthAdapter } from '../../framework/routerApi';
 import type { RouterApiAuthorizationSessionService, RouterApiWalletRegistrationRouteService } from '../../framework/authServicePort';
 import type { FundImplicitNearAccountResult } from '../../../core/types';
 import type { CreateAddAuthMethodIntentResponse, CreateAddSignerIntentResponse, WalletAddSignerFinalizeResponse, WalletAddSignerEcdsaActivationResponse, WalletAddSignerEcdsaDerivationRespondResponse, WalletAddSignerStartResponse, WalletAddAuthMethodFinalizeResponse, WalletRevokeAuthMethodResponse, WalletAddAuthMethodStartResponse } from '../../../core/registrationContracts';
 import type { NormalizedRouterLogger } from '../../framework/logger';
-import type { RouterApiKeyAuthAdapter, RouterApiProjectEnvironmentResolver, SessionAdapter, RouterApiWalletProjectionAdapter } from '../../framework/routerApi';
+import type { RouterApiKeyAuthAdapter, RouterApiProjectEnvironmentResolver, SessionAdapter } from '../../framework/routerApi';
 import type { HeaderRecord, RouteResponse } from '../../framework/routeExecutionContext';
 import type { RouteDefinition } from '../../framework/routeDefinitions';
 import type { SigningSessionSealRoutesOptions } from '../../../threshold/session/signingSessionSeal/signingSessionSeal.types';
 import type { RouteErrorBody } from '../../framework/routeResponses';
 import type { RouterAbPublicKeysetV2 } from '../../../../../shared-ts/src/utils/routerAbPublicKeyset';
+import type { WalletRegistrationSetupRequest } from './walletRegistrationInputs';
 type RouterApiWalletRegistrationServices = {
     walletRegistration: RouterApiWalletRegistrationRouteService;
     authorizationSessions: RouterApiAuthorizationSessionService;
@@ -18,7 +20,7 @@ type RouterApiWalletRegistrationServices = {
     routerAbPublicKeyset?: RouterAbPublicKeysetV2 | null;
     session?: SessionAdapter | null;
     publishableKeyAuth?: RouterApiPublishableKeyAuthAdapter | null;
-    walletProjection?: RouterApiWalletProjectionAdapter | null;
+    registrationContext?: WalletRegistrationContextResolver | null;
 };
 type RouterApiWalletRegistrationInput = {
     body: unknown;
@@ -31,17 +33,19 @@ type RouterApiWalletRegistrationInput = {
     services: RouterApiWalletRegistrationServices;
     sourceIp?: string;
     signingSessionSeal?: SigningSessionSealRoutesOptions | null;
+    waitUntil?: (promise: Promise<unknown>) => void;
 };
+type ParseResult<T> = {
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    code: 'invalid_body';
+    message: string;
+};
+export declare function parseWalletRegistrationSetupRequest(body: Record<string, unknown>): ParseResult<WalletRegistrationSetupRequest>;
 export declare function handleRouterApiWalletAddSignerIntent(input: RouterApiWalletRegistrationInput): Promise<RouteResponse<CreateAddSignerIntentResponse | RouteErrorBody>>;
-/**
- * `POST /wallets/register/setup` — the single admitted entry point that
- * replaces the bootstrap grant, the intent, and start.
- *
- * Authentication is the same API-credential plane the intent route used, so
- * origin and environment binding are unchanged; what is gone is the stored
- * grant that used to sit between the check and its only reader.
- */
-export declare function handleRouterApiWalletRegistrationSetup(input: RouterApiWalletRegistrationInput): Promise<RouteResponse<WalletRegistrationSetupResponseV2 | RouteErrorBody>>;
+export declare function handleRouterApiWalletRegistrationSetup(input: RouterApiWalletRegistrationInput): Promise<RouteResponse>;
 /**
  * `POST /wallets/register/respond` — the authenticated leg.
  *
@@ -57,9 +61,7 @@ export declare function handleRouterApiWalletRegistrationNearAdmission(input: Ro
  */
 export declare function handleRouterApiWalletRegistrationActivate(input: RouterApiWalletRegistrationInput): Promise<RouteResponse<WalletRegistrationActivateRouteResponseV2 | RouteErrorBody>>;
 /**
- * `POST /wallets/register/near-provisioning` — the non-blocking completion
- * the client calls after activate, once its already-running Yao computation
- * produces an activation.
+ * Commits a NEAR-only wallet or completes a mixed wallet's deferred signer.
  */
 export declare function handleRouterApiWalletRegistrationNearProvisioning(input: RouterApiWalletRegistrationInput): Promise<RouteResponse<WalletRegistrationNearProvisioningResponseV2 | RouteErrorBody>>;
 export declare function handleRouterApiWalletAddSignerStart(input: RouterApiWalletRegistrationInput): Promise<RouteResponse<WalletAddSignerStartResponse | RouteErrorBody>>;

package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationSetupPayload.d.ts

@@ -1,8 +1,8 @@
 /**
  * The opaque payload `/wallets/register/setup` mints and routes 2 and 3 verify.
  *
- * Setup admits the application, allocates the wallet, and runs the Router
- * preparation in one request. Routes 2 and 3 then need to know that the
+ * Setup admits the application, reserves the wallet, and persists the initial
+ * preparation facts in one request. Routes 2 and 3 then need to know that the
  * ceremony they are being driven with is the one setup admitted, and with the
  * parameters setup admitted — without paying another storage round trip to
  * find out. The client carries this string and never parses it.