@seams/wallet-server 0.8.0 → 0.9.0

package/dist/esm/shared-ts/src/device-linking/ed25519ExportRoot.js

@@ -1,7 +1,7 @@
 import { parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseWalletId, parseWalletKeyId } from "../utils/domainIds.js";
-import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
 import { requireRecord } from "../utils/validation.js";
 import { rejectUnknownFields } from "../utils/exactRecord.js";
+import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
 import { parseDigestField, parseEd25519PublicKeyB64u, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, requireParsed } from "../passkey-custody/primitives.js";
 //#region ../shared-ts/src/device-linking/ed25519ExportRoot.ts
 /**

package/dist/esm/shared-ts/src/device-linking/index.js

@@ -1,5 +1,5 @@
-import "./contracts.js";
 import "./activeWalletSession.js";
+import "./contracts.js";
 import "./ed25519ExportRoot.js";
 import "./delegatedActivationPlan.js";
 import "./sourceContribution.js";

package/dist/esm/shared-ts/src/device-linking/parsers.js

@@ -1,8 +1,8 @@
-import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
 import { requireArray, requireRecord } from "../utils/validation.js";
 import { exactRecord } from "../utils/exactRecord.js";
 import { wireLiteral, wireNullable, wireObject, wireUnion } from "../utils/wireSchema.js";
 import "../authorization/delegatedAuthority.js";
+import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
 import { parseEd25519PublicKeyB64u } from "../passkey-custody/primitives.js";
 import { authorizationDeviceId, credentialId, digest, enrollmentId, linkedDeviceId, parseDelegatedWalletAuthority, parseNonEmptyToken, parseNonNegativeSafeInteger, parseTargetEmail, parseUnixTime, rpId, sessionId, walletAuthMethodId, walletAuthorityId, walletId, walletKeyId, walletSessionAuthorizationId, walletSessionId } from "./wireFields.js";
 import { parseWalletAddAuthMethodRegistrationOptions } from "../utils/addAuthMethodRegistration.js";

package/dist/esm/shared-ts/src/device-linking/sourceContribution.js

@@ -1,8 +1,8 @@
 import { mpcMaterialActivationRefsEqual, parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseMpcMaterialActivationRef, parseWalletAuthorityId, parseWalletKeyId } from "../utils/domainIds.js";
 import { parseDeviceId } from "../authorization/capabilityKinds.js";
+import { requireRecordCopy } from "../utils/validation.js";
 import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
 import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
-import { requireRecordCopy } from "../utils/validation.js";
 import { parseEd25519PublicKeyB64u, parseEnvelopeCiphertextB64u, parseSecp256k1CompressedPublicKeyB64u } from "../passkey-custody/primitives.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../utils/routerAbNormalSigningIdentity.js";
 import { parseRouterAbEd25519YaoActivationPublicReceiptV1, parseRouterAbEd25519YaoApplicationBindingFactsV1, parseRouterAbEd25519YaoCeremonyBindingV1, parseRouterAbEd25519YaoEncryptedPackageV1, parseRouterAbEd25519YaoParticipantIdsV1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, sameRouterAbEd25519YaoByteSequence } from "../utils/routerAbEd25519Yao.js";

package/dist/esm/shared-ts/src/device-linking/wireFields.js

@@ -1,8 +1,8 @@
 import { parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseMpcMaterialActivationRef, parseVerifiedEmailAddress, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWalletKeyId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../utils/domainIds.js";
 import { parseDeviceId, parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId } from "../authorization/capabilityKinds.js";
-import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
 import { wireLabeled, wireNullable, wireResult } from "../utils/wireSchema.js";
 import { parseDelegatedWalletAuthorityV1 } from "../authorization/delegatedAuthority.js";
+import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
 import { parseUnixMs } from "../passkey-custody/primitives.js";
 //#region ../shared-ts/src/device-linking/wireFields.ts
 const sessionId = /* @__PURE__ */ wireResult(parseLinkDeviceSessionId);

package/dist/esm/shared-ts/src/near/nearClient.js

@@ -1,5 +1,5 @@
-import { base64Decode, base64Encode } from "../utils/base64.js";
 import { isFunction } from "../utils/validation.js";
+import { base64Decode, base64Encode } from "../utils/base64.js";
 import { secureRandomId } from "../utils/secureRandomId.js";
 import { errorMessage } from "../utils/errors.js";
 import { decodeJsonRpcEnvelope } from "../utils/jsonRpc.js";

package/dist/esm/shared-ts/src/signing-lanes/ownerContinuity.js

@@ -1,8 +1,8 @@
 import { hasWhitespaceOrControlCharacters, parseMpcSigningWorkerRef } from "../utils/domainIds.js";
-import { base64UrlEncode } from "../utils/base64.js";
-import { sha256Bytes } from "../utils/digests.js";
 import { requireRecord } from "../utils/validation.js";
 import { rejectUnknownFields } from "../utils/exactRecord.js";
+import { base64UrlEncode } from "../utils/base64.js";
+import { sha256Bytes } from "../utils/digests.js";
 import { parseDigestField, requireParsed } from "../passkey-custody/primitives.js";
 import { concat } from "../utils/digestEncoding.js";
 import { parseLaneParticipantBindingDigestB64u } from "./participants.js";

package/dist/esm/shared-ts/src/utils/ecdsaServerTiming.js

@@ -1,5 +1,9 @@
 //#region ../shared-ts/src/utils/ecdsaServerTiming.ts
 const ECDSA_TIMING_METRICS = new Set([
+	"wallet_gateway_binding",
+	"wallet_gateway_total",
+	"wallet_console_binding_d1",
+	"wallet_console_binding_sql",
 	"ecdsa_sign_authorize",
 	"ecdsa_sign_admit",
 	"ecdsa_sign_proxy",
@@ -12,7 +16,8 @@ const ECDSA_TIMING_METRICS = new Set([
 	"ecdsa_presign_total",
 	"ecdsa_presign_sw_material",
 	"ecdsa_presign_sw_session",
-	"ecdsa_presign_sw_do_total",
+	"ecdsa_presign_sw_do_response_headers",
+	"ecdsa_presign_sw_do_response_body",
 	"ecdsa_presign_sw_admit",
 	"ecdsa_presign_sw_total"
 ]);

package/dist/esm/shared-ts/src/utils/emailOtpDomain.js

@@ -18,12 +18,14 @@ const WALLET_EMAIL_OTP_REGISTRATION_OPERATION = "registration";
 /** Linked-device enrollment: prove control of the wallet's enrolled email
 * destination to complete one device link. */
 const WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION = "device_link";
+const WALLET_EMAIL_OTP_RELOCATION_OPERATION = "wallet_relocation";
 const WALLET_EMAIL_OTP_ACTIONS = {
 	login: "wallet_email_otp_login",
 	registration: "wallet_email_otp_registration",
 	recoveryBootstrap: "wallet_email_otp_recovery_bootstrap",
 	unseal: "wallet_email_otp_unseal",
-	deviceLink: "wallet_email_otp_device_link"
+	deviceLink: "wallet_email_otp_device_link",
+	relocation: "wallet_email_otp_relocation"
 };
 const WALLET_EMAIL_OTP_EXPORT_OPERATION = "export_key";
 const WALLET_EMAIL_OTP_UNLOCK_OPERATION = "wallet_unlock";
@@ -35,6 +37,6 @@ function isWalletEmailOtpLoginOperation(value) {
 	return WALLET_EMAIL_OTP_LOGIN_OPERATIONS.includes(value);
 }
 //#endregion
-export { EMAIL_OTP_CHANNEL, EMAIL_OTP_FACTOR_RELEASE_AAD_DOMAIN_V1, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION, WALLET_EMAIL_OTP_EXPORT_OPERATION, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION, emailOtpDeviceEnrollmentId, isWalletEmailOtpLoginOperation, isWalletUnlockBackend };
+export { EMAIL_OTP_CHANNEL, EMAIL_OTP_FACTOR_RELEASE_AAD_DOMAIN_V1, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION, WALLET_EMAIL_OTP_EXPORT_OPERATION, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_RELOCATION_OPERATION, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION, emailOtpDeviceEnrollmentId, isWalletEmailOtpLoginOperation, isWalletUnlockBackend };
 
 //# sourceMappingURL=emailOtpDomain.js.map

package/dist/esm/shared-ts/src/utils/routerAbEcdsaDerivation.js

@@ -1,9 +1,9 @@
 import { parseEcdsaActiveStateId, parseRootShareEpoch, parseThresholdEcdsaSessionId } from "./domainIds.js";
 import { EVM_ECDSA_MPC_OPERATION_KINDS, parseEcdsaAuthorizationSessionId, parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId, parseWalletSessionMintId } from "../authorization/capabilityKinds.js";
+import { requireRecord } from "./validation.js";
 import { base64UrlDecode, base64UrlEncode } from "./base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "./digests.js";
 import { parseCorrelationId } from "./canonicalPrimitives.js";
-import { requireRecord } from "./validation.js";
 import { parseActiveWalletSessionV1, parseWalletSessionOperationCredentialV1 } from "../device-linking/activeWalletSession.js";
 import { requireRouterAbX25519PublicKey } from "./routerAbPublicKeyset.js";
 import { canonicalRouterAbMpcMaterialActivationRefBytes, canonicalRouterAbNormalSigningAuthorizationBytes, parseRouterAbMpcMaterialActivationRef, parseRouterAbNormalSigningAuthorization, routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "./routerAbNormalSigningIdentity.js";

package/dist/esm/shared-ts/src/utils/routerAbPublicKeyset.js

@@ -20,11 +20,6 @@ function requireSignerRole(value, label) {
 		default: throw new Error(`${label} must be signer_a or signer_b`);
 	}
 }
-function requireLowerHex(value, label, byteLength) {
-	const hex = coerceNonEmptyString(value, label);
-	if (!new RegExp(`^[0-9a-f]{${byteLength * 2}}$`).test(hex)) throw new Error(`${label} must be ${byteLength} lowercase-hex bytes`);
-	return hex;
-}
 function requireRouterAbX25519PublicKey(value, label) {
 	const publicKey = coerceNonEmptyString(value, label);
 	if (!/^x25519:[0-9a-f]{64}$/.test(publicKey)) throw new Error(`${label} must use x25519:<64 lowercase hex chars> encoding`);
@@ -79,26 +74,6 @@ function parseSignerEnvelopeHpkeRotationPublicKeySet(value, label) {
 		previous_retire_at_ms: requirePositiveInteger(record.previous_retire_at_ms, `${label}.previous_retire_at_ms`)
 	};
 }
-function parseSignerPeerVerifyingKey(value, label) {
-	const record = requireRecord(value, label);
-	requireExactKeys(record, ["role", "verifying_key_hex"], label);
-	return {
-		role: requireSignerRole(record.role, `${label}.role`),
-		verifying_key_hex: requireLowerHex(record.verifying_key_hex, `${label}.verifying_key_hex`, 32)
-	};
-}
-function parseSignerPeerVerifyingKeySet(value, label) {
-	const record = requireRecord(value, label);
-	requireExactKeys(record, ["deriver_a", "deriver_b"], label);
-	const deriverA = parseSignerPeerVerifyingKey(record.deriver_a, `${label}.deriver_a`);
-	const deriverB = parseSignerPeerVerifyingKey(record.deriver_b, `${label}.deriver_b`);
-	if (deriverA.role !== "signer_a") throw new Error(`${label}.deriver_a.role must be signer_a`);
-	if (deriverB.role !== "signer_b") throw new Error(`${label}.deriver_b.role must be signer_b`);
-	return {
-		deriver_a: deriverA,
-		deriver_b: deriverB
-	};
-}
 function parsePublicHpkeKeyDescriptor(value, label) {
 	const record = requireRecord(value, label);
 	requireExactKeys(record, ["key_epoch", "public_key"], label);
@@ -112,7 +87,6 @@ function parseRouterAbPublicKeysetV2(value) {
 	requireExactKeys(record, [
 		"keyset_version",
 		"signer_envelope_hpke",
-		"signer_peer_verifying_keys",
 		"signing_worker_server_output_hpke"
 	], "Router A/B public keyset");
 	const keysetVersion = coerceNonEmptyString(record.keyset_version, "keyset_version");
@@ -120,7 +94,6 @@ function parseRouterAbPublicKeysetV2(value) {
 	return {
 		keyset_version: ROUTER_AB_PUBLIC_KEYSET_VERSION_V2,
 		signer_envelope_hpke: parseSignerEnvelopeHpkeRotationPublicKeySet(record.signer_envelope_hpke, "signer_envelope_hpke"),
-		signer_peer_verifying_keys: parseSignerPeerVerifyingKeySet(record.signer_peer_verifying_keys, "signer_peer_verifying_keys"),
 		signing_worker_server_output_hpke: parsePublicHpkeKeyDescriptor(record.signing_worker_server_output_hpke, "signing_worker_server_output_hpke")
 	};
 }

package/dist/esm/shared-ts/src/wallet-recovery/walletRecoveryEcdsaPossession.js

@@ -1,6 +1,6 @@
+import { requireRecord } from "../utils/validation.js";
 import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
 import { parseDigestB64u, sha256DigestB64u } from "../utils/canonicalPrimitives.js";
-import { requireRecord } from "../utils/validation.js";
 //#region ../shared-ts/src/wallet-recovery/walletRecoveryEcdsaPossession.ts
 const POSSESSION_CHALLENGE_DOMAIN_V1 = "seams/wallet-recovery/ecdsa-existing-material-possession/v1";
 const POSSESSION_PROOF_SCHEME_V1 = "secp256k1_bip340_sha256_v1";

package/dist/esm/threshold/session/signingSessionSeal/options.js

@@ -1,6 +1,6 @@
+import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
 import { base64UrlDecode } from "../../../shared-ts/src/utils/base64.js";
 import "../../../shared-ts/src/utils/encoders.js";
-import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
 import { SIGNING_SESSION_SEAL_ALG, SIGNING_SESSION_SEAL_GROUP_ID } from "../../../shared-ts/src/utils/signingSessionSeal.js";
 import { parseSigningSessionSealKeyVersion } from "../../../shared-ts/src/threshold/keyMaterialBrands.js";
 import { createSigningSessionSealShamir3PassCipherAdapter } from "./crypto/cipher.js";

package/dist/types/shared-ts/src/device-linking/activeWalletSession.d.ts

@@ -1,6 +1,7 @@
-import type { ActiveWalletSessionV1, WalletSessionOperationCredentialV1 } from './contracts';
+import type { ActiveWalletSessionV1, WalletSessionOperationCredentialV1, WalletSessionHome } from './contracts';
 export declare function activeWalletSessionV1RecordsEqual(left: ActiveWalletSessionV1, right: ActiveWalletSessionV1): boolean;
 export declare function walletSessionPreservesCapabilities(previous: ActiveWalletSessionV1, next: ActiveWalletSessionV1): boolean;
+export declare function parseWalletSessionHome(raw: unknown): WalletSessionHome;
 export declare function parseWalletSessionOperationCredentialV1(raw: unknown): WalletSessionOperationCredentialV1;
 export declare function parseActiveWalletSessionV1(raw: unknown): ActiveWalletSessionV1;
 //# sourceMappingURL=activeWalletSession.d.ts.map

package/dist/types/shared-ts/src/device-linking/contracts.d.ts

@@ -670,9 +670,19 @@ export type ActiveWalletSessionV1 = {
     readonly issuedAtMs: number;
     readonly expiresAtMs: number;
 };
+/** Routing metadata selects an endpoint and grants no execution authority. */
+export type WalletSessionHome = {
+    readonly kind: 'direct';
+    readonly region?: never;
+} | {
+    readonly kind: 'regional';
+    readonly region: 'US' | 'WEUR' | 'APAC' | 'OC';
+};
 /** The bearer used to authenticate ordinary operations for an active session. */
 export type WalletSessionOperationCredentialV1 = {
     readonly kind: 'opaque_wallet_session_operation_credential_v1';
+    readonly ownershipGeneration: number;
+    readonly home: WalletSessionHome;
     readonly token: string;
     readonly walletSessionId: WalletSessionId;
 };

package/dist/types/shared-ts/src/threshold/ed25519OperationFingerprint.d.ts

@@ -81,7 +81,8 @@ type ThresholdEd25519Nep413FingerprintInput = ThresholdEd25519CanonicalScope & {
     message: string;
     recipient: string;
     nonce: string;
-    state?: string | null;
+    callbackUrl: string | null;
+    state?: never;
 };
 type ThresholdEd25519DelegateActionFingerprintInput = ThresholdEd25519CanonicalScope & {
     delegate: {

package/dist/types/shared-ts/src/utils/emailOtpDomain.d.ts

@@ -12,13 +12,15 @@ export declare const WALLET_EMAIL_OTP_REGISTRATION_OPERATION: "registration";
 /** Linked-device enrollment: prove control of the wallet's enrolled email
  * destination to complete one device link. */
 export declare const WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION: "device_link";
-export type WalletEmailOtpOperation = WalletEmailOtpLoginOperation | typeof WALLET_EMAIL_OTP_REGISTRATION_OPERATION | typeof WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION;
+export declare const WALLET_EMAIL_OTP_RELOCATION_OPERATION: "wallet_relocation";
+export type WalletEmailOtpOperation = WalletEmailOtpLoginOperation | typeof WALLET_EMAIL_OTP_REGISTRATION_OPERATION | typeof WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION | typeof WALLET_EMAIL_OTP_RELOCATION_OPERATION;
 export declare const WALLET_EMAIL_OTP_ACTIONS: {
     readonly login: "wallet_email_otp_login";
     readonly registration: "wallet_email_otp_registration";
     readonly recoveryBootstrap: "wallet_email_otp_recovery_bootstrap";
     readonly unseal: "wallet_email_otp_unseal";
     readonly deviceLink: "wallet_email_otp_device_link";
+    readonly relocation: "wallet_email_otp_relocation";
 };
 export type WalletEmailOtpAction = (typeof WALLET_EMAIL_OTP_ACTIONS)[keyof typeof WALLET_EMAIL_OTP_ACTIONS];
 export declare const WALLET_EMAIL_OTP_EXPORT_OPERATION: "export_key";

package/dist/types/shared-ts/src/utils/routerAbPublicKeyset.d.ts

@@ -22,14 +22,6 @@ type RouterAbSignerEnvelopeHpkeRotatingPublicKeySetV1 = {
     previous_retire_at_ms: number;
 };
 type RouterAbSignerEnvelopeHpkeRotationPublicKeySetV1 = RouterAbSignerEnvelopeHpkeCurrentPublicKeySetV1 | RouterAbSignerEnvelopeHpkeRotatingPublicKeySetV1;
-type RouterAbSignerPeerVerifyingKeyHexV1 = {
-    role: RouterAbSignerRoleV1;
-    verifying_key_hex: string;
-};
-type RouterAbSignerPeerVerifyingKeyHexSetV1 = {
-    deriver_a: RouterAbSignerPeerVerifyingKeyHexV1;
-    deriver_b: RouterAbSignerPeerVerifyingKeyHexV1;
-};
 type RouterAbPublicHpkeKeyDescriptorV1 = {
     key_epoch: string;
     public_key: string;
@@ -37,7 +29,6 @@ type RouterAbPublicHpkeKeyDescriptorV1 = {
 export type RouterAbPublicKeysetV2 = {
     keyset_version: typeof ROUTER_AB_PUBLIC_KEYSET_VERSION_V2;
     signer_envelope_hpke: RouterAbSignerEnvelopeHpkeRotationPublicKeySetV1;
-    signer_peer_verifying_keys: RouterAbSignerPeerVerifyingKeyHexSetV1;
     signing_worker_server_output_hpke: RouterAbPublicHpkeKeyDescriptorV1;
 };
 export declare function requireRouterAbX25519PublicKey(value: unknown, label: string): string;

package/dist/types/shared-ts/src/utils/walletManagementProtocol.d.ts

@@ -1,3 +1,3 @@
 export declare const WALLET_MANAGEMENT_PROTOCOL_HEADER = "X-Seams-Wallet-Protocol";
-export declare const WALLET_MANAGEMENT_PROTOCOL_VERSION = "2";
+export declare const WALLET_MANAGEMENT_PROTOCOL_VERSION = "3";
 //# sourceMappingURL=walletManagementProtocol.d.ts.map

package/dist/types/wallet-server/src/authorization/domain.d.ts

@@ -1,3 +1,4 @@
+import type { WalletSessionHome } from '../../../shared-ts/src/device-linking/contracts';
 import type { Variant } from '../../../shared-ts/src/utils/variant';
 import type { ActiveWalletAuthMethodRecordV2, WalletAuthMethodRecordV2 } from '../../../shared-ts/src/utils/walletAuthMethodRecord';
 import { CAPABILITY_KINDS, EVM_ECDSA_MPC_OPERATION_KINDS, NEAR_ED25519_MPC_OPERATION_KINDS } from '../../../shared-ts/src/authorization/capabilityKinds';
@@ -78,6 +79,7 @@ export type IssuedHostedWalletSeamsSessionExchangeV2 = {
 };
 export type HostedWalletSeamsSessionExchangeDeliveryV2 = {
     readonly kind: 'hosted_wallet_session_exchange_delivery_v2';
+    readonly home: WalletSessionHome;
     readonly exchangeCode: HostedWalletSeamsSessionExchangeCode;
     readonly nonce: HostedWalletSeamsSessionExchangeNonce;
     readonly appOrigin: SessionOrigin;
@@ -112,6 +114,7 @@ export type RedeemHostedWalletSeamsSessionExchangeV2Input = {
 };
 export type HostedWalletSessionOperationCredentialV1 = {
     readonly kind: 'opaque_hosted_wallet_session_operation_credential_v1';
+    readonly home: WalletSessionHome;
     readonly token: HostedWalletSessionOperationCredentialToken;
     readonly walletSessionId: WalletSessionId;
 };
@@ -213,6 +216,7 @@ export type WalletSessionExactOperationContext = {
     readonly authMethod: ActiveWalletAuthMethodRecordV2;
     readonly retiredAtMs: null;
     readonly ownerWalletScope: {
+        readonly ownershipGeneration: number;
         readonly orgId: string;
         readonly projectId: string;
         readonly projectEnvironmentId: string;
@@ -318,12 +322,24 @@ export type WalletSessionAuthorizationV2MintRead = {
     readonly primaryOperationCredentialDigestB64u: DigestB64u;
     readonly retiredAtMs: number | null;
 };
+/** The registration decision fixed in the Wallet Session transaction. */
+export type CommittedWalletRegistration = {
+    readonly ceremonyId: string;
+    readonly walletId: WalletId;
+    readonly state: 'registering' | 'active';
+};
 export type DirectV2CommitResult = {
+    /** Ordinary session issuance has no registration decision. */
+    readonly registration: CommittedWalletRegistration | null;
+} & ({
     readonly kind: 'inserted';
+    readonly ownershipGeneration: number;
+    readonly committed?: never;
 } | {
     readonly kind: 'already_committed';
+    readonly ownershipGeneration?: never;
     readonly committed: WalletSessionAuthorizationV2MintRead;
-};
+});
 export type DirectV2IssueResult = {
     readonly kind: 'issued';
     readonly session: WalletSessionAuthorizationV2;

package/dist/types/wallet-server/src/authorization/ecdsaWalletSessionAdmission.d.ts

@@ -21,6 +21,7 @@ export type EcdsaWalletSessionAdmissionInput = {
     };
 };
 export type PinnedOwnerWalletScope = {
+    readonly ownershipGeneration: number;
     readonly orgId: string;
     readonly projectId: string;
     readonly projectEnvironmentId: string;

package/dist/types/wallet-server/src/authorization/ed25519WalletSessionAdmission.d.ts

@@ -0,0 +1,35 @@
+import type { TenantId } from '../../../shared-ts/src/authorization/capabilityKinds';
+import type { CapabilityOperationEnvelope, CapabilityOperationFingerprintDigest } from '../../../shared-ts/src/authorization/operationFingerprint';
+import type { WalletId } from '../../../shared-ts/src/utils/domainIds';
+import type { AuthorizedOperationInput } from './domain';
+import type { EcdsaWalletSessionAdmissionResult, EcdsaWalletSessionResolutionResult } from './ecdsaWalletSessionAdmission';
+/** An Ed25519 signing operation a reusable Wallet Session admits for the wallet it signs for. */
+export type Ed25519WalletSessionAdmissionInput = {
+    readonly operation: AuthorizedOperationInput & {
+        readonly operation: CapabilityOperationEnvelope<{
+            readonly capabilityKind: 'near_ed25519_mpc_signing';
+            readonly operationKind: 'near.sign_transaction' | 'near.sign_delegate_action' | 'near.sign_nep413_message';
+        }>;
+        readonly authorization: {
+            readonly kind: 'authorization_grant';
+        };
+        readonly quota: {
+            readonly kind: 'consume_reusable_wallet_session';
+        };
+    };
+    readonly walletId: WalletId;
+};
+/**
+ * The outcomes of the ECDSA admission: a live operation carries the owner
+ * scope its own admission row pinned, so dispatch needs no second read.
+ */
+export type Ed25519WalletSessionAdmissionResult = EcdsaWalletSessionAdmissionResult;
+/** The operation a finalize request names, found by the fingerprint its prepare claimed. */
+export type Ed25519WalletSessionResolutionInput = {
+    readonly tenantId: TenantId;
+    readonly operationFingerprintDigest: CapabilityOperationFingerprintDigest;
+    readonly walletId: WalletId;
+    readonly nowMs: number;
+};
+export type Ed25519WalletSessionResolutionResult = EcdsaWalletSessionResolutionResult;
+//# sourceMappingURL=ed25519WalletSessionAdmission.d.ts.map

package/dist/types/wallet-server/src/authorization/ed25519WalletSessionAdmission.typecheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ed25519WalletSessionAdmission.typecheck.d.ts.map

package/dist/types/wallet-server/src/authorization/service.d.ts

@@ -1,6 +1,7 @@
-import type { WalletSessionRoutingPublisher } from './sessionRouting';
-import type { D1EcdsaAdmissionPolicyRead } from '../router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore';
+import type { WalletSessionLocatorPublication, WalletSessionRoutingPublisher } from './sessionRouting';
+import type { D1EcdsaAdmissionPolicyRead, D1Ed25519AdmissionPolicyRead } from '../router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore';
 import type { EcdsaMaterialRead } from '../core/d1EcdsaSignerRead';
+import type { Ed25519SignerRead } from '../core/d1Ed25519SignerRead';
 import type { D1PreparedStatementLike } from '../storage/tenantRoute';
 import type { WalletAuthMethodId, WalletId } from '../../../shared-ts/src/utils/domainIds';
 import type { ActiveWalletAuthorityV1 } from '../../../shared-ts/src/authorization/walletAuthority';
@@ -18,6 +19,11 @@ export type EcdsaWalletSessionAdmissionRead = {
     readonly materialRead: EcdsaMaterialRead;
     readonly policyRead: D1EcdsaAdmissionPolicyRead;
 };
+export type Ed25519WalletSessionAdmissionRead = {
+    readonly snapshot: WalletSessionAdmissionSnapshotV2;
+    readonly signerRead: Ed25519SignerRead;
+    readonly policyRead: D1Ed25519AdmissionPolicyRead;
+};
 export interface AuthorizationSessionPort {
     putIssuedHostedWalletSeamsSessionExchange(exchange: IssuedHostedWalletSeamsSessionExchangeV2): Promise<void>;
     redeemHostedWalletSeamsSessionExchange(input: RedeemHostedWalletSeamsSessionExchangeV2Input, publishCredentialLocator?: () => Promise<void>): Promise<PersistedHostedWalletSeamsSessionExchangeV2Result>;
@@ -33,6 +39,7 @@ export interface AuthorizationEvidencePort {
     consumeVerifiedOwnerProof(proof: VerifiedOwnerProof, consumedAtMs: number, consumptionScopeId: string): Promise<boolean>;
 }
 export interface AuthorizationGrantPort {
+    readWalletSessionIssuanceGeneration(walletId: WalletId): Promise<number>;
     retireWalletSessionAuthorizationsForAuthMethod(input: {
         readonly tenantId: TenantId;
         readonly walletId: WalletId;
@@ -54,6 +61,7 @@ export interface AuthorizationGrantPort {
     /** Inserted confirms readback of the exact session identity and primary credential digest. */
     commitDirectReplayableWalletSessionAuthorizationV2(input: {
         readonly persisted: PersistedActiveWalletSessionAuthorizationV2;
+        readonly purpose: DirectWalletSessionCommitPurpose;
     }): Promise<DirectV2CommitResult>;
     readWalletSessionAuthorizationV2ByAuthorizationId(input: {
         readonly expected: WalletSessionAuthorizationV2;
@@ -82,6 +90,12 @@ export interface AuthorizationGrantPort {
         readonly nowMs: number;
         readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
     }): Promise<EcdsaWalletSessionAdmissionRead | null>;
+    readEd25519WalletSessionAdmissionSnapshotByOperationCredential(input: {
+        readonly tenantId: TenantId;
+        readonly tokenHash: DigestB64u;
+        readonly nowMs: number;
+        readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
+    }): Promise<Ed25519WalletSessionAdmissionRead | null>;
     readWalletSessionExactOperationContextByCredential(input: {
         readonly tenantId: TenantId;
         readonly tokenHash: DigestB64u;
@@ -182,6 +196,18 @@ type IssueWalletSessionAuthorizationV2InputBase = {
     readonly expiresAtMs: number;
 };
 export type IssueWalletSessionAuthorizationV2Input = IssueWalletSessionAuthorizationV2InputBase;
+export type DirectWalletSessionCommitPurpose = {
+    readonly kind: 'ordinary';
+    readonly ceremonyId?: never;
+} | {
+    readonly kind: 'registration';
+    readonly ceremonyId: string;
+};
+type DirectWalletSessionReplayMode = {
+    readonly kind: 'strict';
+} | {
+    readonly kind: 'validated_registration_authority_projection';
+};
 export type PreparedWalletSessionAuthorizationV2 = {
     readonly session: WalletSessionAuthorizationV2;
     readonly quota: ActiveWalletSessionQuota;
@@ -239,13 +265,19 @@ export declare class AuthorizationService {
      * committed digest cannot reproduce plaintext.
      */
     issueDirectWalletSessionAuthorizationV2(input: IssueWalletSessionAuthorizationV2Input): Promise<DirectV2IssueResult>;
-    /** The Ed25519 registration caller validates current authority and owner proof first. */
-    issueDirectRegistrationPromotedWalletSessionAuthorizationV2(input: IssueWalletSessionAuthorizationV2Input): Promise<DirectV2IssueResult>;
-    private issueDirectWalletSessionAuthorizationV2WithReplayMode;
+    /** Commits locally. Registration publishes the locator with home completion. */
+    commitDirectWalletSessionAuthorizationV2(input: IssueWalletSessionAuthorizationV2Input, replayMode: DirectWalletSessionReplayMode, purpose: DirectWalletSessionCommitPurpose, commitSession?: AuthorizationGrantPort['commitDirectReplayableWalletSessionAuthorizationV2']): Promise<{
+        readonly result: DirectV2IssueResult;
+        readonly publication: WalletSessionLocatorPublication & {
+            readonly kind: 'credential';
+        };
+        readonly registration: DirectV2CommitResult['registration'];
+    }>;
     prepareDirectWalletSessionCredential(prepared: PreparedWalletSessionAuthorizationV2): Promise<{
         persisted: PersistedActiveWalletSessionAuthorizationV2;
         operationCredential: import("../../../shared-ts/src/device-linking").WalletSessionOperationCredentialV1;
     }>;
+    private prepareDirectWalletSessionIssuance;
     refreshWalletSessionAuthorizationV2AuthorityProjection(input: {
         readonly existing: IssuedWalletSessionAuthorizationV2;
         readonly authority: ActiveWalletAuthorityV1;
@@ -286,6 +318,12 @@ export declare class AuthorizationService {
         readonly nowMs: number;
         readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
     }): Promise<EcdsaWalletSessionAdmissionRead | null>;
+    readEd25519WalletSessionAdmissionSnapshotByOperationCredential(input: {
+        readonly tenantId: TenantId;
+        readonly token: string;
+        readonly nowMs: number;
+        readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
+    }): Promise<Ed25519WalletSessionAdmissionRead | null>;
     readLiveWalletSessionAuthorizationProjectionByCredential(input: {
         readonly tenantId: TenantId;
         readonly token: string;

package/dist/types/wallet-server/src/authorization/sessionRouting.d.ts

@@ -1,3 +1,4 @@
+import type { WalletSessionHome } from '../../../shared-ts/src/device-linking/contracts';
 import type { WalletId } from '../../../shared-ts/src/utils/domainIds';
 import type { DigestB64u } from '../../../shared-ts/src/utils/canonicalPrimitives';
 export type WalletSessionLocatorPublication = {
@@ -15,6 +16,7 @@ export type WalletSessionLocatorPublication = {
 };
 /** Publishes digest-to-wallet metadata; home-local storage authorizes its use. */
 export interface WalletSessionRoutingPublisher {
+    home(): WalletSessionHome;
     publish(input: WalletSessionLocatorPublication): Promise<void>;
 }
 //# sourceMappingURL=sessionRouting.d.ts.map

package/dist/types/wallet-server/src/cloud-host.d.ts

@@ -7,6 +7,8 @@ export * from './core/routerAbSigning/RouterAbEcdsaPresignRuntime';
 export * from './core/types';
 export * from './delegateAction';
 export * from './router/framework/apiCredentialPorts';
+export { createWalletRegistrationContextResolver, unavailableRegistrationContext, walletRegistrationContext, } from './router/auth/walletRegistrationContext';
+export { parseWalletRegistrationSetupRequest } from './router/domains/walletRegistration/walletRegistrationRoutes';
 export * from './router/framework/applyRouteMetering';
 export * from './router/cloudflare-adaptor';
 export type { CfEnv, CfExecutionContext, CfScheduledEvent, FetchHandler, RouterApiCloudflareSignerWorkerEnv, ScheduledHandler, SeamsD1SignerTenantStorageWorkerEnv, } from './router/cloudflare/runtime/cloudflare.types';
@@ -29,6 +31,7 @@ export * from './router/cloudflare/runtime/sessionAdapterRuntime';
 export * from './router/cloudflare/runtime/walletConsoleOps';
 export * from './router/cloudflare/runtime/walletConsoleOpsClient';
 export * from './router/cloudflare/runtime/walletGateway';
+export { WalletPlacementRoutes } from './router/cloudflare/runtime/walletPlacementRoutes';
 export * from './router/cloudflare/runtime/walletRuntimeOps';
 export * from './router/cloudflare/runtime/walletRuntimeOpsHandler';
 export * from './router/cloudflare/runtime/walletControlOps';
@@ -57,7 +60,7 @@ export * from './router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryRe
 export * from './router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryWalletSessionAuthorization';
 export * from './router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationRequestScopedCloudflare';
 export * from './router/domains/signingOperations/routerAbNormalSigningAdmissionCore';
-export { buildRouterAbEcdsaAcceptedAuthorizedOperationV1, buildRouterAbEd25519AcceptedAuthorizedOperationV1, evaluateRouterAbNormalSigningAdmission, type RouterAbEcdsaOperationAdmission, type RouterAbEcdsaOperationAdmissionKind, type RouterAbJsonRouteResult, type RouterAbNormalSigningAdmissionAdapter, type RouterAbNormalSigningAdmissionEvaluationInput, type RouterAbNormalSigningAdmissionFailure, type RouterAbNormalSigningAdmissionFailureCode, type RouterAbNormalSigningAdmissionInput, type RouterAbNormalSigningAdmissionResult, type RouterAbNormalSigningRouteAdmission, type RouterAbNormalSigningRouteRuntime, type RouterAbSigningWorkerJsonResult, } from './router/domains/signingOperations/routerAbNormalSigningAdmission';
+export { evaluateRouterAbNormalSigningAdmission, type RouterAbEcdsaOperationAdmission, type RouterAbEcdsaOperationAdmissionKind, type RouterAbJsonRouteResult, type RouterAbNormalSigningAdmissionAdapter, type RouterAbNormalSigningAdmissionEvaluationInput, type RouterAbNormalSigningAdmissionFailure, type RouterAbNormalSigningAdmissionFailureCode, type RouterAbNormalSigningAdmissionInput, type RouterAbNormalSigningAdmissionResult, type RouterAbNormalSigningRouteAdmission, type RouterAbNormalSigningRouteRuntime, type RouterAbSigningWorkerJsonResult, } from './router/domains/signingOperations/routerAbNormalSigningAdmission';
 export { authenticateRouterAbWalletOperationStepUpIdentity } from './router/domains/signingOperations/routerAbOperationStepUp';
 export { buildRouterAbEcdsaDerivationPrivateSigningWorkerBody, buildRouterAbEd25519PrivateSigningWorkerBody, computeRouterAbEd25519NormalSigningAdmissionMaterial, parseRouterAbEd25519NormalSigningScopeV2, postRouterAbSigningWorkerJson, ROUTER_AB_ECDSA_DERIVATION_PRIVATE_SIGNING_PATHS, ROUTER_AB_ED25519_PRIVATE_SIGNING_PATHS, type RouterAbEcdsaDerivationPrivateSigningPath, type RouterAbEcdsaDerivationPrivateSigningWorkerBody, type RouterAbEd25519NormalSigningScopeV2, type RouterAbEd25519PrivateSigningPath, type RouterAbEd25519PrivateSigningWorkerBody, type RouterAbNormalSigningMaterialSourceV1, } from './router/domains/signingOperations/routerAbPrivateSigningWorker';
 export * from './router/domains/signingOperations/routerAbEd25519NormalSigningRoute';
@@ -104,8 +107,6 @@ export { CloudflareD1GoogleEmailOtpRegistrationAttemptStore } from './router/clo
 export type { GoogleEmailOtpRegistrationAttemptStore } from './router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationAttemptStore';
 export { parseGoogleEmailOtpRegistrationAttemptRecord, parseGoogleEmailOtpRegistrationOfferCandidates, requireRuntimePolicyScope, } from './router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationRecords';
 export { prepareD1TenantStatement } from './core/d1TenantStore';
-export { D1EmailOtpRateLimitCounter } from './router/cloudflare/d1/emailOtp/d1EmailOtpRateLimitStore';
-export type { EmailOtpRateLimitCounter } from './router/cloudflare/d1/emailOtp/d1EmailOtpRateLimitStore';
 export type { PasskeyCredentialClaims } from './core/passkeyCredentialClaims';
 export type { WebAuthnSyncChallengeStore, WebAuthnSyncChallengeRecord, } from './core/WebAuthnSyncChallengeStore';
 export { parseWebAuthnSyncChallengeRecord } from './router/cloudflare/d1/webauthn/d1WebAuthnRecords';
@@ -117,4 +118,7 @@ export type { LinkedDeviceBootstrapStore, LinkedDeviceBootstrapResult, } from '.
 export { parseLinkedDeviceSessionRecordV1 } from './core/deviceLinking/linkedDeviceSessionRecord';
 export type { LinkedDeviceSessionRecordV1 } from './core/deviceLinking/linkedDeviceSessionRecord';
 export { computeLinkedDeviceSessionClaimDigestV1 } from '../../shared-ts/src/device-linking/digests';
+export { admitD1EstablishedWalletHome } from './router/cloudflare/d1/registration/d1WalletExecutionAuthority';
+export { D1WalletObjectAddresses } from './router/cloudflare/d1/walletObjectAddresses';
+export { walletObjectIdentity, WalletObjectAddressSnapshot, type WalletObjectIdentity } from './router/cloudflare/runtime/walletObjectAddresses';
 //# sourceMappingURL=cloud-host.d.ts.map

package/dist/types/wallet-server/src/core/EmailOtpRecords.d.ts

@@ -1,5 +1,6 @@
 import type { ThresholdRuntimePolicyScope } from './types';
-import type { EmailOtpChallengeRecord, EmailOtpGrantRecord, EmailOtpUnlockChallengeRecord, GoogleEmailOtpRegistrationAttemptRecord, GoogleEmailOtpRegistrationAttemptScopeInput, PendingGoogleEmailOtpRegistrationAttemptRecord } from './EmailOtpStores';
+import type { EmailOtpChallengeRecord, EmailOtpChallengePurpose, EmailOtpGrantRecord, EmailOtpUnlockChallengeRecord, GoogleEmailOtpRegistrationAttemptRecord, GoogleEmailOtpRegistrationAttemptScopeInput, PendingGoogleEmailOtpRegistrationAttemptRecord } from './EmailOtpStores';
+export declare function parseEmailOtpChallengePurpose(action: unknown, operation: unknown): EmailOtpChallengePurpose | null;
 export declare function parseCurrentEmailOtpChallengeRow(input: {
     recordJson: unknown;
     expiresAtMs: unknown;

package/dist/types/wallet-server/src/core/EmailOtpStores.d.ts

@@ -1,11 +1,27 @@
 import type { ThresholdRuntimePolicyScope } from './types';
 import type { WalletEmailOtpChannel, WalletEmailOtpLoginOperation, WalletEmailOtpOperation } from '../../../shared-ts/src/utils/emailOtpDomain';
-import { WALLET_EMAIL_OTP_ACTIONS } from '../../../shared-ts/src/utils/emailOtpDomain';
+import { WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION, WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION, WALLET_EMAIL_OTP_RELOCATION_OPERATION } from '../../../shared-ts/src/utils/emailOtpDomain';
 export type EmailOtpChannel = WalletEmailOtpChannel;
 export type EmailOtpGrantAction = typeof WALLET_EMAIL_OTP_ACTIONS.unseal | typeof WALLET_EMAIL_OTP_ACTIONS.recoveryBootstrap;
-export type EmailOtpChallengeAction = typeof WALLET_EMAIL_OTP_ACTIONS.login | typeof WALLET_EMAIL_OTP_ACTIONS.registration | typeof WALLET_EMAIL_OTP_ACTIONS.recoveryBootstrap | typeof WALLET_EMAIL_OTP_ACTIONS.deviceLink;
+export type EmailOtpChallengeAction = typeof WALLET_EMAIL_OTP_ACTIONS.login | typeof WALLET_EMAIL_OTP_ACTIONS.registration | typeof WALLET_EMAIL_OTP_ACTIONS.recoveryBootstrap | typeof WALLET_EMAIL_OTP_ACTIONS.deviceLink | typeof WALLET_EMAIL_OTP_ACTIONS.relocation;
 export type EmailOtpChallengeOperation = WalletEmailOtpOperation;
 export type EmailOtpLoginChallengeOperation = WalletEmailOtpLoginOperation;
+export type EmailOtpChallengePurpose = {
+    readonly action: typeof WALLET_EMAIL_OTP_ACTIONS.login;
+    readonly operation: WalletEmailOtpLoginOperation;
+} | {
+    readonly action: typeof WALLET_EMAIL_OTP_ACTIONS.registration;
+    readonly operation: typeof WALLET_EMAIL_OTP_REGISTRATION_OPERATION;
+} | {
+    readonly action: typeof WALLET_EMAIL_OTP_ACTIONS.recoveryBootstrap;
+    readonly operation: typeof WALLET_EMAIL_OTP_UNLOCK_OPERATION;
+} | {
+    readonly action: typeof WALLET_EMAIL_OTP_ACTIONS.deviceLink;
+    readonly operation: typeof WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION;
+} | {
+    readonly action: typeof WALLET_EMAIL_OTP_ACTIONS.relocation;
+    readonly operation: typeof WALLET_EMAIL_OTP_RELOCATION_OPERATION;
+};
 export type EmailOtpChallengeRecord = {
     version: 'email_otp_challenge_v1';
     challengeId: string;
@@ -25,13 +41,11 @@ export type EmailOtpChallengeRecord = {
     otpCode: string;
     /** Exact wallet, owner, operation, origin, and audience binding digest. */
     ownerProofBindingDigest: string;
-    action: EmailOtpChallengeAction;
-    operation: EmailOtpChallengeOperation;
     createdAtMs: number;
     expiresAtMs: number;
     attemptCount: number;
     maxAttempts: number;
-};
+} & EmailOtpChallengePurpose;
 export type EmailOtpGrantRecord = {
     version: 'email_otp_grant_v1';
     grantToken: string;