@seams/wallet-server 0.7.3 → 0.9.0

package/dist/types/wallet-server/src/router/framework/apiCredentialPorts.d.ts

@@ -1,4 +1,6 @@
 import type { RouterApiKeyAuthFailureCode } from '../../../../shared-ts/src/utils/routerApiKeyAuth';
+import type { WalletRegistrationSetupRequest } from '../domains/walletRegistration/walletRegistrationInputs';
+import type { ReadonlyExclusiveUnion } from '../../../../shared-ts/src/utils/variant';
 export declare const ROUTER_API_CREDENTIAL_SCOPES: readonly ["accounts.create", "wallets.read", "wallets.auth_methods.create", "wallets.signers.create"];
 export type RouterApiCredentialScope = (typeof ROUTER_API_CREDENTIAL_SCOPES)[number];
 export type { RouterApiKeyAuthFailureCode };
@@ -47,6 +49,28 @@ export type RouterApiPublishableKeyAuthResult = {
 export interface RouterApiPublishableKeyAuthAdapter {
     authenticate(input: RouterApiPublishableKeyAuthRequest): Promise<RouterApiPublishableKeyAuthResult>;
 }
+export type WalletRegistrationContextResult = ReadonlyExclusiveUnion<{
+    ok: true;
+    principal: RouterApiKeyPrincipal;
+    environment: RouterApiProjectEnvironment & {
+        readonly status: 'ACTIVE';
+    };
+} | {
+    ok: false;
+    status: 401 | 403;
+    code: RouterApiPublishableKeyAuthFailureCode;
+    message: string;
+} | {
+    ok: false;
+    status: 500;
+    code: 'registration_environment_unavailable';
+    message: string;
+}>;
+export interface WalletRegistrationContextResolver {
+    resolve(input: RouterApiPublishableKeyAuthRequest & {
+        readonly registration: WalletRegistrationSetupRequest;
+    }): Promise<WalletRegistrationContextResult>;
+}
 export type RouterApiUsageMeterAction = 'wallet_created';
 export interface RouterApiUsageMeterEvent {
     orgId: string;

package/dist/types/wallet-server/src/router/framework/authServicePort.d.ts

@@ -1,11 +1,13 @@
-import type { D1EcdsaAdmissionPolicyRead } from '../cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore';
+import type { RouteResponse } from './routeExecutionContext';
+import type { D1EcdsaAdmissionPolicyRead, D1Ed25519AdmissionPolicyRead } from '../cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore';
 import type { EcdsaMaterialRead, EcdsaMaterialActivationReadInput } from '../../core/d1EcdsaSignerRead';
+import type { Ed25519SignerRead } from '../../core/d1Ed25519SignerRead';
 import type { EcdsaMaterialReadSnapshot } from '../../core/ecdsaMaterialReadSnapshot';
 import type { DigestB64u } from '../../../../shared-ts/src/utils/canonicalPrimitives';
 import type { TenantRootIdentityV1 } from '../../../../shared-ts/src/tenant-root/tenantRootIdentity';
 import type { AddAuthMethodIntentCallerV1, AddAuthMethodIntentGrant } from '../../../../shared-ts/src/utils/registrationIntent';
 import type { ActiveEmailOtpWalletAuthMethodRecordV2, ActivePasskeyWalletAuthMethodRecordV2, ActiveWalletAuthMethodRecordV2 } from '../../../../shared-ts/src/utils/walletAuthMethodRecord';
-import type { WalletRegistrationNearProvisioningResponseV2, WalletRegistrationNearAdmissionResponseV2, WalletRegistrationActivateResponseV2, WalletRegistrationRespondResponseV2, WalletRegistrationSetupResponseV2 } from '../../core/threeRouteRegistrationContracts';
+import type { WalletRegistrationNearProvisioningResponseV2, WalletRegistrationNearAdmissionResponseV2, WalletRegistrationActivateResponseV2, WalletRegistrationRespondResponseV2 } from '../../core/threeRouteRegistrationContracts';
 import type { WalletRegistrationNearProvisioningInput, WalletRegistrationNearAdmissionInput, WalletRegistrationActivateInput, WalletRegistrationRespondInput, WalletRegistrationSetupInput } from '../domains/walletRegistration/walletRegistrationInputs';
 import type { WalletEmailOtpAction } from '../../../../shared-ts/src/utils/emailOtpDomain';
 import type { MpcMaterialActivationRef, OrgId, ProviderSubject, WalletAuthMethodId, WalletAuthorityId, WalletId, WebAuthnCredentialIdB64u, WebAuthnRpId } from '../../../../shared-ts/src/utils/domainIds';
@@ -19,7 +21,6 @@ import type { WalletExecutionLaneAuthSource, WalletExecutionLaneProjectionResult
 import type { RouterAbMpcMaterialActivationRefWire } from '../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
 import type { EmailOtpChannel, EmailOtpChallengeOperation, EmailOtpWalletEnrollmentRecord } from '../../core/EmailOtpStores';
 import type { LinkIdentityResult, UnlinkIdentityResult } from '../../core/IdentityStore';
-import type { NearPublicKeyAuthBinding, NearPublicKeyKind } from '../../core/NearPublicKeyStore';
 import type { ResolvedEd25519WalletBinding } from '../../core/authService/webauthnWalletBinding';
 import type { RouterAbEcdsaPresignRuntime } from '../../core/routerAbSigning/RouterAbEcdsaPresignRuntime';
 import type { DeviceLinkingRouteServiceV1 } from '../transport/fetch/routes/deviceLinking';
@@ -112,6 +113,12 @@ export type RouterApiWalletSessionSigningCandidate = {
     readonly candidate: RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext;
     readonly context?: never;
 };
+/** An active session with the Ed25519 signer and policy rows its statement also read. */
+export type RouterApiEd25519WalletSessionSigningRead = {
+    readonly context: RouterApiWalletSessionAuthorizationV2AdmissionContext;
+    readonly signerRead: Ed25519SignerRead;
+    readonly policyRead: D1Ed25519AdmissionPolicyRead;
+};
 type RouterApiHostedWalletSessionAuthorizationV2AdmissionContext = RouterApiWalletSessionAuthorizationV2AdmissionContext & {
     readonly hostedCredentialId: HostedWalletSessionCredentialId;
     readonly appOrigin: SessionOrigin;
@@ -349,6 +356,17 @@ type GoogleEmailOtpResolutionResult = {
     readonly registrationAttemptId: string;
     readonly expiresAtMs: number;
     readonly offer: GoogleEmailOtpRegistrationOffer;
+} | {
+    readonly ok: false;
+    readonly mode: 'wallet_identity_mismatch';
+    readonly code: 'wallet_identity_mismatch';
+    readonly walletId: string;
+    readonly providerSubject: string;
+    readonly message: string;
+    readonly offer?: never;
+    readonly registrationAttemptId?: never;
+    readonly expiresAtMs?: never;
+    readonly hasEmailOtpEnrollment?: never;
 } | {
     readonly ok: false;
     readonly mode: 'wallet_id_collision' | 'registration_incomplete' | 'stale_identity_mapping';
@@ -603,24 +621,6 @@ type RouterApiMethodTypes = {
             readonly message?: string;
         };
     };
-    listNearPublicKeysForUser: {
-        readonly input: {
-            readonly userId: string;
-        };
-        readonly result: {
-            readonly ok: boolean;
-            readonly code?: string;
-            readonly message?: string;
-            readonly keys?: Array<{
-                readonly publicKey: string;
-                readonly kind: NearPublicKeyKind;
-                readonly signerSlot?: number;
-                readonly createdAtMs?: number;
-                readonly updatedAtMs?: number;
-                readonly authBinding?: NearPublicKeyAuthBinding;
-            }>;
-        };
-    };
     listWalletEcdsaKeyFactsInventory: {
         readonly input: {
             readonly walletId: string;
@@ -736,17 +736,6 @@ type RouterApiMethodTypes = {
         };
         readonly result: GoogleEmailOtpResolutionResult;
     };
-    resolveOidcWalletId: {
-        readonly input: {
-            readonly providerSubject?: string;
-            readonly sub?: string;
-            readonly email?: string;
-            readonly accountMode?: unknown;
-            readonly runtimePolicyScope?: ThresholdRuntimePolicyScope;
-            readonly restartRegistrationOffer?: unknown;
-        };
-        readonly result: string;
-    };
     revokeWalletAuthMethodWithFreshProof: {
         readonly input: RevokeWalletAuthMethodWithFreshProofCommand;
         readonly result: RevokeWalletAuthMethodWithFreshProofResult;
@@ -982,6 +971,8 @@ export interface RouterApiWalletRegistrationService {
     resolveEd25519MaterialActivation(input: {
         readonly walletId: string;
         readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
+        /** Signer rows the caller's session statement already read for this wallet and activation. */
+        readonly signerRead?: Ed25519SignerRead;
     }): Promise<{
         readonly ok: true;
         readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
@@ -1028,6 +1019,7 @@ export interface RouterApiWalletRegistrationService {
         readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
     }): Promise<{
         readonly ok: true;
+        readonly ownershipGeneration: number;
         readonly identityDigestB64u: string;
         readonly custodyLineageB64u: string;
         readonly projectEnvironmentId: string;
@@ -1038,11 +1030,11 @@ export interface RouterApiWalletRegistrationService {
     }>;
     listWalletEcdsaKeyFactsInventory(input: RouterApiMethodTypes['listWalletEcdsaKeyFactsInventory']['input']): Promise<RouterApiMethodTypes['listWalletEcdsaKeyFactsInventory']['result']>;
     readActiveEmailOtpEnrollment(input: RouterApiMethodTypes['readActiveEmailOtpEnrollment']['input']): Promise<RouterApiMethodTypes['readActiveEmailOtpEnrollment']['result']>;
-    setupWalletRegistration(input: WalletRegistrationSetupInput): Promise<WalletRegistrationSetupResponseV2>;
+    setupWalletRegistration(input: WalletRegistrationSetupInput): Promise<RouteResponse>;
     respondWalletRegistration(input: WalletRegistrationRespondInput, traceContext?: RouterAbTraceContextV1, serverTiming?: Array<readonly [string, number]>): Promise<WalletRegistrationRespondResponseV2>;
     authorizeWalletRegistrationNearAdmission(input: WalletRegistrationNearAdmissionInput): Promise<WalletRegistrationNearAdmissionResponseV2>;
     activateWalletRegistration(input: WalletRegistrationActivateInput, traceContext?: RouterAbTraceContextV1, serverTiming?: Array<readonly [string, number]>): Promise<WalletRegistrationActivateResponseV2>;
-    completeWalletRegistrationNearProvisioning(input: WalletRegistrationNearProvisioningInput, serverTiming?: Array<readonly [string, number]>): Promise<WalletRegistrationNearProvisioningResponseV2>;
+    completeWalletRegistrationNearProvisioning(input: WalletRegistrationNearProvisioningInput, serverTiming?: Array<readonly [string, number]>, waitUntil?: (promise: Promise<unknown>) => void): Promise<WalletRegistrationNearProvisioningResponseV2>;
     refreshEd25519YaoWalletSession(input: RouterAbEd25519YaoBudgetRefreshRequestV1): Promise<RouterAbEd25519YaoBudgetRefreshResponseV1>;
     provisionEd25519YaoWalletSession(input: RouterAbEd25519YaoVerifiedWalletUnlockRequestV1): Promise<RouterAbEd25519YaoVerifiedWalletUnlockResponseV1>;
     recordEcdsaPostRegistrationProof(input: {
@@ -1272,7 +1264,6 @@ export interface RouterApiIdentityService {
     linkIdentity(input: RouterApiMethodTypes['linkIdentity']['input']): Promise<RouterApiMethodTypes['linkIdentity']['result']>;
     listIdentities(input: RouterApiMethodTypes['listIdentities']['input']): Promise<RouterApiMethodTypes['listIdentities']['result']>;
     resolveGoogleEmailOtpSession(input: RouterApiMethodTypes['resolveGoogleEmailOtpSession']['input']): Promise<RouterApiMethodTypes['resolveGoogleEmailOtpSession']['result']>;
-    resolveOidcWalletId(input: RouterApiMethodTypes['resolveOidcWalletId']['input']): Promise<RouterApiMethodTypes['resolveOidcWalletId']['result']>;
     unlinkIdentity(input: RouterApiMethodTypes['unlinkIdentity']['input']): Promise<RouterApiMethodTypes['unlinkIdentity']['result']>;
     verifyGoogleLogin(input: RouterApiMethodTypes['verifyGoogleLogin']['input']): Promise<RouterApiMethodTypes['verifyGoogleLogin']['result']>;
     verifyGithubOAuthCode(input: RouterApiMethodTypes['verifyGithubOAuthCode']['input']): Promise<RouterApiMethodTypes['verifyGithubOAuthCode']['result']>;
@@ -1287,7 +1278,6 @@ export interface RouterApiWebAuthnService {
 }
 interface RouterApiNearFundingService {
     fundImplicitNearAccount(input: FundImplicitNearAccountRequest): Promise<FundImplicitNearAccountResult>;
-    listNearPublicKeysForUser(input: RouterApiMethodTypes['listNearPublicKeysForUser']['input']): Promise<RouterApiMethodTypes['listNearPublicKeysForUser']['result']>;
 }
 interface RouterApiRouterAccountService {
     getConfiguredRelayerAccount(): string;
@@ -1328,15 +1318,13 @@ export interface RouterApiServiceBag {
 export interface RouterApiAuthorizedOperationService {
     resolveEcdsaWalletSessionOperation(input: import('../../authorization/ecdsaWalletSessionAdmission').EcdsaWalletSessionAdmissionInput): Promise<import('../../authorization/ecdsaWalletSessionAdmission').EcdsaWalletSessionResolutionResult>;
     admitEcdsaWalletSessionOperation(input: import('../../authorization/ecdsaWalletSessionAdmission').EcdsaWalletSessionAdmissionInput): Promise<import('../../authorization/ecdsaWalletSessionAdmission').EcdsaWalletSessionAdmissionResult>;
+    admitEd25519WalletSessionOperation(input: import('../../authorization/ed25519WalletSessionAdmission').Ed25519WalletSessionAdmissionInput): Promise<import('../../authorization/ed25519WalletSessionAdmission').Ed25519WalletSessionAdmissionResult>;
+    resolveEd25519WalletSessionOperation(input: import('../../authorization/ed25519WalletSessionAdmission').Ed25519WalletSessionResolutionInput): Promise<import('../../authorization/ed25519WalletSessionAdmission').Ed25519WalletSessionResolutionResult>;
     readonly tenantId: TenantId;
     readPinnedOwnerWalletScope(input: {
         readonly operation: AuthorizedOperation;
         readonly walletId: WalletId;
-    }): Promise<{
-        readonly orgId: string;
-        readonly projectId: string;
-        readonly projectEnvironmentId: string;
-    }>;
+    }): Promise<import('../../authorization/ecdsaWalletSessionAdmission').PinnedOwnerWalletScope>;
     buildVerifiedOwnerProof(input: VerifiedOwnerProofInput): Promise<VerifiedOwnerProof>;
     recordVerifiedWalletOperationFactorEvidenceSet(input: VerifiedWalletOperationFactorEvidenceSetInput): Promise<VerifiedAuthorizationEvidenceSet>;
     readAuthorizedOperationById(input: {
@@ -1390,6 +1378,12 @@ export interface RouterApiAuthorizationSessionService {
         readonly nowMs: number;
         readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
     }) => Promise<RouterApiWalletSessionSigningCandidate | null>;
+    readonly readEd25519WalletSessionSigningReadByOperationCredential: (input: {
+        readonly tenantId: TenantId;
+        readonly token: string;
+        readonly nowMs: number;
+        readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
+    }) => Promise<RouterApiEd25519WalletSessionSigningRead | null>;
     readonly readWalletSessionExactOperationContextByCredential: (input: {
         readonly tenantId: TenantId;
         readonly token: string;

package/dist/types/wallet-server/src/router/framework/googleLoginResolution.typecheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=googleLoginResolution.typecheck.d.ts.map

package/dist/types/wallet-server/src/router/framework/registrationSetupDispatch.d.ts

@@ -0,0 +1,13 @@
+import type { WalletRegistrationSetupInput } from '../domains/walletRegistration/walletRegistrationInputs';
+import type { WalletRegistrationSetupResponseV2 } from '../../core/threeRouteRegistrationContracts';
+import type { RouteResponse } from './routeExecutionContext';
+export interface WalletRegistrationSetupDispatcher {
+    dispatch(input: WalletRegistrationSetupInput): Promise<RouteResponse | null>;
+}
+export declare function dispatchWalletRegistrationSetup(context: {
+    readonly dispatcher: WalletRegistrationSetupDispatcher | null;
+    readonly local: {
+        setupWalletRegistration(input: WalletRegistrationSetupInput): Promise<WalletRegistrationSetupResponseV2>;
+    };
+}, input: WalletRegistrationSetupInput): Promise<RouteResponse>;
+//# sourceMappingURL=registrationSetupDispatch.d.ts.map

package/dist/types/wallet-server/src/router/framework/routerApi.d.ts

@@ -9,18 +9,9 @@ import type { RouterAbPublicKeysetV2 } from '../../../../shared-ts/src/utils/rou
 import type { RouterAbNormalSigningAdmissionAdapter } from '../domains/signingOperations/routerAbNormalSigningAdmission';
 import type { RouterAbEd25519YaoProductRegistrationRuntimeV1 } from '../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration';
 import type { RouterAbEcdsaStrictPostRegistrationPort } from '../domains/ecdsa/routerAbEcdsaStrictRegistration';
-import type { RouterApiKeyAuthAdapter, RouterApiProjectEnvironmentResolver, RouterApiPublishableKeyAuthAdapter, RouterApiUsageMeterAdapter } from './apiCredentialPorts';
+import type { RouterApiKeyAuthAdapter, RouterApiProjectEnvironmentResolver, RouterApiPublishableKeyAuthAdapter, RouterApiUsageMeterAdapter, WalletRegistrationContextResolver } from './apiCredentialPorts';
 import type { SessionParseResult } from '../../core/sessionValidation';
 export type { RouterApiCredentialScope, RouterApiKeyAuthAdapter, RouterApiKeyAuthFailureCode, RouterApiKeyAuthRequest, RouterApiKeyAuthResult, RouterApiKeyPrincipal, RouterApiProjectEnvironment, RouterApiProjectEnvironmentResolver, RouterApiPublishableKeyAuthAdapter, RouterApiPublishableKeyAuthFailureCode, RouterApiPublishableKeyAuthRequest, RouterApiPublishableKeyAuthResult, RouterApiUsageMeterAction, RouterApiUsageMeterAdapter, RouterApiUsageMeterEvent, } from './apiCredentialPorts';
-export interface RouterApiWalletProjectionEvent {
-    readonly orgId: string;
-    readonly runtimePolicyScope: RuntimePolicyScope;
-    readonly walletId: string;
-    readonly occurredAt: string;
-}
-export interface RouterApiWalletProjectionAdapter {
-    recordCreatedWallet(input: RouterApiWalletProjectionEvent): Promise<void>;
-}
 export type SessionClaims = Record<string, unknown>;
 export declare const DEFAULT_SESSION_COOKIE_NAME = "seams-jwt";
 /**
@@ -164,6 +155,8 @@ export interface RouterApiOptions {
      * API credential routes like signed delegate execution.
      */
     publishableKeyAuth?: RouterApiPublishableKeyAuthAdapter | null;
+    /** Fresh credential and active-environment resolution for registration setup. */
+    registrationContext?: WalletRegistrationContextResolver | null;
     /**
      * Optional Router API usage-meter adapter used to emit host runtime events.
      */
@@ -214,8 +207,6 @@ export interface RouterApiOptions {
      * Optional org/project/environment service used to resolve environment -> project scope.
      */
     orgProjectEnv?: RouterApiProjectEnvironmentResolver | null;
-    /** Projects successfully created wallets into the customer Console index. */
-    walletProjection?: RouterApiWalletProjectionAdapter | null;
     logger?: RouterLogger | null;
 }
 //# sourceMappingURL=routerApi.d.ts.map

package/dist/types/wallet-server/src/router/transport/fetch/routes/deviceLinking.d.ts

@@ -14,7 +14,7 @@ import { type LinkDeviceSessionId } from '../../../../../../shared-ts/src/signin
 import type { WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
 export type DeviceLinkingAuthDeniedV1 = {
     readonly kind: 'denied';
-    readonly code: 'unauthorized' | 'expired' | 'invalid' | 'replayed';
+    readonly code: 'unauthorized' | 'expired' | 'invalid' | 'replayed' | 'unavailable';
     readonly message: string;
 };
 export type DeviceLinkingRequestBindingV1 = {

package/dist/types/wallet-server/src/router/transport/fetch/routes/deviceLinkingResponses.d.ts

@@ -0,0 +1,17 @@
+import type { DeviceLinkingAuthDeniedV1 } from './deviceLinking';
+import { type LinkSessionProjectionV1, type LinkedDeviceTargetCredentialRegistrationResultV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
+import type { LinkedDeviceSessionRecordV1 } from '../../../../core/deviceLinking/linkedDeviceSessionRecord';
+export declare function projectSession(record: LinkedDeviceSessionRecordV1): LinkSessionProjectionV1;
+export declare function invalidStateResponse(record: LinkedDeviceSessionRecordV1): Response;
+export declare function sessionProjectionResponse(record: LinkedDeviceSessionRecordV1, outcome: 'applied' | 'replayed'): Response;
+export declare function targetCredentialResultResponse(record: LinkedDeviceSessionRecordV1, outcome: 'applied' | 'replayed', targetCredential: LinkedDeviceTargetCredentialRegistrationResultV1): Response;
+export declare function exportRootWriteResponse(result: {
+    readonly outcome: 'applied' | 'replayed' | 'conflict';
+    readonly reason?: string;
+}): Response;
+export declare function invalidInputResponse(message: string): Response;
+export declare function notSupportedResponse(message?: string): Response;
+export declare function notFoundResponse(): Response;
+export declare function methodNotAllowedResponse(): Response;
+export declare function authDeniedResponse(result: DeviceLinkingAuthDeniedV1): Response;
+//# sourceMappingURL=deviceLinkingResponses.d.ts.map

package/dist/types/wallet-server/src/router/transport/fetch/routes/ecdsaOperationStepUpFactor.d.ts

@@ -0,0 +1,37 @@
+import type { CapabilityOperationEnvelope } from '../../../../../../shared-ts/src/authorization/operationFingerprint';
+import { type WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
+import type { WalletAuthAuthorityRef } from '../../../../../../shared-ts/src/utils/walletAuthAuthority';
+import type { RouterAbEcdsaOperationStepUpAuthorizationRequestV1Wire } from '../../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
+import { type VerifiedWalletOperationFactorResult } from '../../../../authorization/factorEvidence';
+import type { SessionOrigin } from '../../../../authorization/domain';
+import type { WalletExecutionLaneAuthSource } from '../../../../core/signingLanes/WalletExecutionLaneProjection';
+import type { RouterApiEmailOtpRouteService, RouterApiWebAuthnService } from '../../../framework/authServicePort';
+type StepUpUnseal = {
+    readonly kind: 'not_requested';
+} | {
+    readonly kind: 'email_otp_grant';
+    readonly grant: string;
+    readonly challenge_id: string;
+};
+type VerifiedStepUpFactorResult = {
+    readonly ok: true;
+    readonly factor: VerifiedWalletOperationFactorResult;
+    readonly unseal: StepUpUnseal;
+} | {
+    readonly ok: false;
+    readonly response: Response;
+};
+export declare function verifyEcdsaOperationStepUpFactor(input: {
+    readonly proof: RouterAbEcdsaOperationStepUpAuthorizationRequestV1Wire['proof'];
+    readonly operation: CapabilityOperationEnvelope;
+    readonly walletId: WalletId;
+    readonly authorityRef: WalletAuthAuthorityRef;
+    readonly authSource: WalletExecutionLaneAuthSource;
+    readonly requestOrigin: SessionOrigin;
+    readonly expectedChallenge: string;
+    readonly expiresAtMs: number;
+    readonly webAuthn: Pick<RouterApiWebAuthnService, 'verifyWebAuthnAuthenticationLite'>;
+    readonly emailOtp: Pick<RouterApiEmailOtpRouteService, 'verifyEmailOtpChallenge' | 'consumeEmailOtpGrant'>;
+}): Promise<VerifiedStepUpFactorResult>;
+export {};
+//# sourceMappingURL=ecdsaOperationStepUpFactor.d.ts.map

package/dist/types/wallet-server/src/router/transport/fetch/routes/ed25519AuthorizedOperationRevalidation.d.ts

@@ -0,0 +1,37 @@
+import type { AuthorizedOperationId, TenantId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
+import type { CapabilityOperationFingerprintDigest } from '../../../../../../shared-ts/src/authorization/operationFingerprint';
+import type { WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
+import type { AuthorizedOperation } from '../../../../authorization/domain';
+import type { PinnedOwnerWalletScope } from '../../../../authorization/ecdsaWalletSessionAdmission';
+import type { FetchRouterApiContext } from '../createFetchRouter';
+type Revalidated<Result> = Result | {
+    readonly ok: false;
+    readonly response: Response;
+};
+export declare function revalidateEd25519StepUpOperation(input: {
+    readonly ctx: FetchRouterApiContext;
+    readonly operation: AuthorizedOperation;
+}): Promise<Revalidated<{
+    readonly ok: true;
+    readonly operation: AuthorizedOperation;
+}>>;
+/**
+ * Finds the operation a reusable Wallet Session prepared and checks that its
+ * grant is still active. A live operation returns the owner scope its
+ * admission row pinned. A completed operation returns none: it replays its
+ * stored response. The operation is read by its fingerprint, so a receipt
+ * that names another operation ID has no stored operation.
+ */
+export declare function resolveEd25519WalletSessionOperation(input: {
+    readonly ctx: FetchRouterApiContext;
+    readonly tenantId: TenantId;
+    readonly authorizedOperationId: AuthorizedOperationId;
+    readonly operationFingerprintDigest: CapabilityOperationFingerprintDigest;
+    readonly walletId: WalletId;
+}): Promise<Revalidated<{
+    readonly ok: true;
+    readonly operation: AuthorizedOperation;
+    readonly ownerScope: PinnedOwnerWalletScope | null;
+}>>;
+export {};
+//# sourceMappingURL=ed25519AuthorizedOperationRevalidation.d.ts.map

package/dist/types/wallet-server/src/router/transport/fetch/routes/thresholdEcdsa.d.ts

@@ -1,27 +1,11 @@
 import type { FetchRouterApiContext } from '../createFetchRouter';
 import { type RouterAbEcdsaPoolFillInitRouteRequest, type RouterAbEcdsaPoolFillStepRouteRequest } from '../../../domains/ecdsa/thresholdEcdsaRequestValidation';
 import type { RouterAbEcdsaDerivationPoolFillBinding } from '../../../../core/ThresholdService/routerAb/ecdsaDerivationPoolFillHandlers';
-import type { RouterApiAuthorizedOperationService } from '../../../framework/authServicePort';
 import type { WalletSessionOperationCredentialV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
-import { type AuthorizedOperation, type VerifiedOwnerProof } from '../../../../authorization/domain';
+import { type VerifiedOwnerProof } from '../../../../authorization/domain';
 type VerifiedOwnerWalletSessionProof = Extract<VerifiedOwnerProof, {
     readonly purpose: 'wallet_session';
 }>;
-type EcdsaSigningGatewayTiming = {
-    authorize: number | null;
-    admit: number | null;
-    proxy: number | null;
-    complete: number | null;
-    total: number | null;
-};
-export declare function finishRouterAbEcdsaSigningResponse(input: {
-    readonly phase: 'prepare' | 'finalize';
-    readonly upstream: Response;
-    readonly operation: AuthorizedOperation;
-    readonly authorizedOperations: RouterApiAuthorizedOperationService;
-    readonly timing: Pick<EcdsaSigningGatewayTiming, 'proxy' | 'complete'>;
-    readonly proxyStartedAt: number;
-}): Promise<Response>;
 type RouterAbEcdsaPoolFillAuthorizationResult = {
     readonly ok: true;
     readonly binding: RouterAbEcdsaDerivationPoolFillBinding;

package/dist/types/wallet-server/src/storage/d1Sql.d.ts

@@ -10,7 +10,6 @@ export declare function parseD1JsonColumn(value: unknown): unknown;
 export declare function parseD1JsonArrayColumn(value: unknown): readonly unknown[];
 export declare function parseD1JsonObjectColumn(value: unknown): Record<string, unknown>;
 export declare function isD1DatabaseLike(value: unknown): value is D1DatabaseLike;
-export declare function resolveD1DatabaseFromConfig(config: Record<string, unknown>): D1DatabaseLike | null;
 /**
  * Aborts the D1 batch it is in when the statement just before it changed no
  * row: it collides with the guard table's immutable singleton, and the

package/dist/types/wallet-server/src/storage/tenantRoute.d.ts

@@ -2,7 +2,7 @@ import type { OrgId } from '../../../shared-ts/src/utils/domainIds';
 export type { OrgId } from '../../../shared-ts/src/utils/domainIds';
 export type TenantStorageBackendFamily = 'cloudflare_d1_do' | 'postgres';
 export type CloudflareTenantTopology = 'shared' | 'dedicated_tenant';
-export type TenantDataJurisdiction = 'automatic' | 'wnam' | 'enam' | 'weur' | 'eeur' | 'apac';
+export type TenantDataJurisdiction = 'automatic' | 'wnam' | 'enam' | 'weur' | 'eeur' | 'apac' | 'oc';
 export type PostgresMigrationReason = 'd1_size_limit' | 'd1_throughput_limit' | 'logical_database_required';
 export type NamespaceId = string;
 export type RouteVersion = number;

package/migrations/d1-signer/0040_namespace_home_challenges.sql

@@ -0,0 +1,16 @@
+CREATE TABLE namespace_home_challenges (
+  namespace TEXT NOT NULL,
+  challenge_id TEXT NOT NULL,
+  account_id TEXT NOT NULL,
+  database_id TEXT NOT NULL,
+  proof TEXT NOT NULL,
+  issued_at_ms INTEGER NOT NULL,
+  expires_at_ms INTEGER NOT NULL,
+  PRIMARY KEY (namespace, challenge_id),
+  CHECK (length(challenge_id) = 64),
+  CHECK (length(proof) = 64),
+  CHECK (issued_at_ms > 0),
+  CHECK (expires_at_ms > issued_at_ms AND expires_at_ms <= issued_at_ms + 300000)
+);
+
+CREATE INDEX namespace_home_challenges_expiry_idx ON namespace_home_challenges(expires_at_ms);

package/migrations/d1-signer/0041_step_up_admission_expiry.sql

@@ -0,0 +1,28 @@
+DROP TRIGGER authorized_operation_step_up_claim_atomic;
+
+CREATE TRIGGER authorized_operation_step_up_claim_atomic
+AFTER INSERT ON authorized_operations
+WHEN NEW.lifecycle_kind = 'claimed'
+  AND NEW.authorization_source_kind = 'verified_step_up'
+BEGIN
+  SELECT CASE
+    WHEN NOT EXISTS (
+        SELECT 1
+          FROM verified_wallet_operation_evidence_sets AS evidence
+         WHERE evidence.namespace = NEW.namespace
+           AND evidence.tenant_id = NEW.tenant_id
+           AND evidence.evidence_set_digest = NEW.evidence_set_digest
+           AND evidence.principal_id = NEW.principal_id
+           AND evidence.capability_kind = NEW.capability_kind
+           AND evidence.operation_kind = NEW.operation_kind
+           AND evidence.lane_digest = NEW.lane_digest
+           AND evidence.intent_digest = NEW.intent_digest
+           AND evidence.display_digest = NEW.display_digest
+           AND evidence.assurance = 'step_up'
+           AND evidence.expires_at_ms > NEW.claimed_at_ms
+           -- The database clock closes delays between verification and this write.
+           AND evidence.expires_at_ms > CAST(round(unixepoch('subsec') * 1000) AS INTEGER)
+      )
+    THEN RAISE(ABORT, 'authorization_evidence_claim_rejected')
+  END;
+END;

package/migrations/d1-signer/0042_deployment_resource_challenges.sql

@@ -0,0 +1,4 @@
+ALTER TABLE namespace_home_challenges RENAME TO deployment_resource_challenges;
+DROP INDEX namespace_home_challenges_expiry_idx;
+CREATE INDEX deployment_resource_challenges_expiry_idx
+  ON deployment_resource_challenges(expires_at_ms);

package/migrations/d1-signer/0043_google_registration_candidate_claim.sql

@@ -0,0 +1,2 @@
+ALTER TABLE email_otp_registration_attempts
+  ADD COLUMN selection_digest TEXT CHECK (selection_digest IS NULL OR length(selection_digest) > 0);

package/migrations/d1-signer/0044_linked_device_bootstrap_imports.sql

@@ -0,0 +1,6 @@
+-- This receipt survives session cleanup to prevent replayed imports from resurrecting sessions.
+CREATE TABLE linked_device_bootstrap_imports (
+ namespace TEXT NOT NULL, org_id TEXT NOT NULL, project_id TEXT NOT NULL, env_id TEXT NOT NULL,
+ link_session_id TEXT NOT NULL,
+ PRIMARY KEY (namespace, org_id, project_id, env_id, link_session_id)
+);

package/migrations/d1-signer/0045_wallet_owned_capability_receipts.sql

@@ -0,0 +1,29 @@
+-- Unowned receipts cannot be attributed from capability hashes. Require the
+-- disposable-wallet reset before replacing a populated receipt table.
+CREATE TABLE capability_receipt_reset_guard (
+  receipt_count INTEGER NOT NULL CHECK (receipt_count = 0)
+);
+INSERT INTO capability_receipt_reset_guard
+SELECT COUNT(*) FROM router_ab_yao_capability_replacements;
+DROP TABLE capability_receipt_reset_guard;
+DROP TABLE router_ab_yao_capability_replacements;
+CREATE TABLE router_ab_yao_capability_replacements (
+  namespace TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  project_id TEXT NOT NULL,
+  env_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL CHECK (length(wallet_id) > 0),
+  operation_id TEXT NOT NULL,
+  operation_fingerprint TEXT NOT NULL,
+  previous_capability_binding_json TEXT NOT NULL,
+  next_capability_binding_json TEXT NOT NULL,
+  created_at_ms INTEGER NOT NULL,
+  PRIMARY KEY (namespace, org_id, project_id, env_id, operation_id),
+  CHECK (length(operation_id) > 0),
+  CHECK (length(operation_fingerprint) > 0),
+  CHECK (json_valid(previous_capability_binding_json)),
+  CHECK (json_valid(next_capability_binding_json)),
+  CHECK (created_at_ms >= 0)
+);
+CREATE INDEX capability_replacements_wallet ON router_ab_yao_capability_replacements
+  (namespace, org_id, project_id, env_id, wallet_id);

package/migrations/d1-signer/0046_wallet_owned_signing_abuse.sql

@@ -0,0 +1,41 @@
+-- Require disposable-state cleanup before replacing unowned policy records.
+CREATE TABLE signing_admission_reset_guard (
+  record_count INTEGER NOT NULL CHECK (record_count = 0)
+);
+INSERT INTO signing_admission_reset_guard
+SELECT COUNT(*) FROM router_ab_normal_signing_admission_records;
+DROP TABLE signing_admission_reset_guard;
+DROP TABLE router_ab_normal_signing_admission_records;
+
+CREATE TABLE router_ab_normal_signing_admission_records (
+  namespace TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  project_id TEXT NOT NULL,
+  env_id TEXT NOT NULL,
+  signing_root_version TEXT NOT NULL,
+  record_kind TEXT NOT NULL CHECK (record_kind IN ('project_policy', 'abuse')),
+  record_key TEXT NOT NULL,
+  wallet_id TEXT,
+  decision TEXT NOT NULL,
+  retry_after_ms INTEGER,
+  updated_at_ms INTEGER NOT NULL CHECK (updated_at_ms >= 0),
+  PRIMARY KEY (
+    namespace, org_id, project_id, env_id, signing_root_version, record_kind, record_key
+  ),
+  CHECK (
+    (record_kind = 'project_policy' AND wallet_id IS NULL
+      AND decision IN ('allowed', 'rejected')
+      AND record_key = org_id || char(31) || project_id || char(31) || env_id || char(31) || signing_root_version)
+    OR
+    (record_kind = 'abuse' AND wallet_id IS NOT NULL AND length(wallet_id) > 0
+      AND decision IN ('allowed', 'rate_limited', 'rejected')
+      AND instr(record_key, org_id || char(31) || project_id || char(31) || env_id || char(31) ||
+        signing_root_version || char(31) || wallet_id || char(31)) = 1)
+  ),
+  CHECK (
+    (decision IN ('rejected', 'rate_limited') AND retry_after_ms IS NOT NULL AND retry_after_ms > 0)
+    OR (decision = 'allowed' AND retry_after_ms IS NULL)
+  )
+);
+CREATE INDEX signing_abuse_wallet ON router_ab_normal_signing_admission_records
+  (namespace, org_id, project_id, env_id, wallet_id) WHERE record_kind = 'abuse';

package/migrations/d1-signer/0047_remove_unused_near_public_keys.sql

@@ -0,0 +1,2 @@
+-- Wallet public key ownership is recorded by wallet_signers.
+DROP TABLE near_public_keys;

package/migrations/d1-signer/0048_operation_owner_scope.sql

@@ -0,0 +1,45 @@
+DROP TRIGGER authorized_operation_audit_claim;
+ALTER TABLE authorized_operations DROP COLUMN linked_wallet_id;
+ALTER TABLE authorized_operations DROP COLUMN linked_enrollment_id;
+ALTER TABLE authorized_operations DROP COLUMN linked_device_id;
+ALTER TABLE authorized_operations DROP COLUMN linked_wallet_key_id;
+ALTER TABLE authorized_operations DROP COLUMN linked_lane_id;
+ALTER TABLE authorized_operations DROP COLUMN linked_lane_share_epoch;
+ALTER TABLE authorized_operations DROP COLUMN linked_revocation_epoch;
+ALTER TABLE authorized_operations RENAME COLUMN linked_scope_org_id TO owner_scope_org_id;
+ALTER TABLE authorized_operations RENAME COLUMN linked_scope_project_id TO owner_scope_project_id;
+ALTER TABLE authorized_operations RENAME COLUMN linked_scope_env_id TO owner_scope_env_id;
+ALTER TABLE authorized_operation_audit_events DROP COLUMN linked_wallet_id;
+ALTER TABLE authorized_operation_audit_events DROP COLUMN linked_enrollment_id;
+ALTER TABLE authorized_operation_audit_events DROP COLUMN linked_device_id;
+ALTER TABLE authorized_operation_audit_events DROP COLUMN linked_wallet_key_id;
+ALTER TABLE authorized_operation_audit_events DROP COLUMN linked_lane_id;
+ALTER TABLE authorized_operation_audit_events DROP COLUMN linked_lane_share_epoch;
+ALTER TABLE authorized_operation_audit_events DROP COLUMN linked_revocation_epoch;
+ALTER TABLE authorized_operation_audit_events RENAME COLUMN linked_scope_org_id TO owner_scope_org_id;
+ALTER TABLE authorized_operation_audit_events RENAME COLUMN linked_scope_project_id TO owner_scope_project_id;
+ALTER TABLE authorized_operation_audit_events RENAME COLUMN linked_scope_env_id TO owner_scope_env_id;
+
+CREATE TRIGGER authorized_operation_audit_claim
+AFTER INSERT ON authorized_operations
+WHEN NEW.lifecycle_kind = 'claimed'
+BEGIN
+  INSERT INTO authorized_operation_audit_events (
+    namespace, tenant_id, audit_event_id, authorized_operation_id,
+    operation_fingerprint_digest, authorization_source_kind, authorization_id,
+    authorization_grant_kind, evidence_set_digest, quota_id, material_activation_id,
+    material_activation_capability, material_activation_owner,
+    material_activation_key_binding, material_activation_lifecycle_binding,
+    material_activation_signing_worker, owner_scope_org_id, owner_scope_project_id,
+    owner_scope_env_id, result_kind, claimed_at_ms, completed_at_ms
+  ) VALUES (
+    NEW.namespace, NEW.tenant_id, NEW.audit_event_id, NEW.authorized_operation_id,
+    NEW.operation_fingerprint_digest, NEW.authorization_source_kind, NEW.authorization_id,
+    NEW.authorization_grant_kind, NEW.evidence_set_digest, NEW.quota_id,
+    NEW.material_activation_id, NEW.material_activation_capability,
+    NEW.material_activation_owner, NEW.material_activation_key_binding,
+    NEW.material_activation_lifecycle_binding, NEW.material_activation_signing_worker,
+    NEW.owner_scope_org_id, NEW.owner_scope_project_id,
+    NEW.owner_scope_env_id, NEW.result_kind, NEW.claimed_at_ms, NEW.completed_at_ms
+  );
+END;

package/migrations/d1-signer/0049_wallet_relocation_challenges.sql

@@ -0,0 +1,16 @@
+CREATE TABLE wallet_relocation_challenges (
+  namespace TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  project_id TEXT NOT NULL,
+  env_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL,
+  move_id TEXT NOT NULL,
+  binding_json TEXT NOT NULL CHECK (json_valid(binding_json)),
+  challenge_b64u TEXT NOT NULL,
+  created_at_ms INTEGER NOT NULL CHECK (created_at_ms > 0),
+  expires_at_ms INTEGER NOT NULL,
+  consumed_at_ms INTEGER,
+  PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_id, move_id),
+  CHECK (expires_at_ms > created_at_ms AND expires_at_ms - created_at_ms <= 300000),
+  CHECK (consumed_at_ms IS NULL OR (consumed_at_ms >= created_at_ms AND consumed_at_ms < expires_at_ms))
+);