@seams/wallet-server 0.8.0 → 0.9.1

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthorizationSnapshot.d.ts

@@ -0,0 +1,31 @@
+import { type D1TenantScope } from '../../../../core/d1TenantStore';
+import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
+import { WalletRelocationSessionSource } from './d1WalletRelocationSessions';
+export declare const AUTHORIZATION_SNAPSHOT_MAX_BYTES = 524288;
+export declare const AUTHORIZATION_SNAPSHOT_MAX_CHUNKS = 80;
+type Manifest = {
+    readonly schemaJson: string;
+    readonly chunkCount: number;
+    readonly recordCount: number;
+    readonly digestHex: string;
+};
+export declare class D1WalletAuthorizationSnapshot {
+    private readonly database;
+    private readonly scope;
+    constructor(database: D1DatabaseLike, scope: D1TenantScope);
+    seal(source: WalletRelocationSessionSource): Promise<Manifest>;
+    exportSnapshot(source: WalletRelocationSessionSource): Promise<readonly {
+        readonly index: number;
+        readonly chunkJson: string;
+        readonly digestHex: string;
+    }[]>;
+    assertCapacity(walletId: string): Promise<void>;
+    private prepare;
+    private read;
+    private readProgress;
+    private nextRecord;
+    private readSegment;
+    private storeChunk;
+}
+export {};
+//# sourceMappingURL=d1WalletAuthorizationSnapshot.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletRelocationApprovals.d.ts

@@ -0,0 +1,49 @@
+import type { WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
+import { type DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
+import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
+import type { D1TenantScope } from '../../../../core/d1TenantStore';
+import { WalletRelocationChallengeBinding } from './d1WalletRelocationChallenges';
+import type { CloudflareD1EmailOtpChallengeVerifier } from '../emailOtp/d1EmailOtpChallengeVerifier';
+import type { CloudflareD1EmailOtpChallengeStore } from '../emailOtp/d1EmailOtpChallengeStore';
+import type { WalletRelocationOwnerRequest } from './d1WalletRelocationOwnerRequest';
+type StoredApproval = {
+    readonly binding: WalletRelocationChallengeBinding;
+    readonly authorityDigestB64u: DigestB64u;
+    readonly authorityRevocationEpoch: number;
+    readonly approvedAtMs: number;
+    readonly expiresAtMs: number;
+};
+type ApprovalResult = {
+    readonly kind: 'approved';
+    readonly approval: StoredApproval;
+} | {
+    readonly kind: 'denied';
+    readonly approval?: never;
+};
+export declare class D1WalletRelocationApprovals {
+    private readonly database;
+    private readonly scope;
+    constructor(database: D1DatabaseLike, scope: D1TenantScope);
+    approvePasskey(input: {
+        readonly owner: WalletRelocationOwnerRequest;
+        readonly binding: WalletRelocationChallengeBinding;
+        readonly credential: unknown;
+        readonly nowMs: number;
+    }): Promise<ApprovalResult>;
+    approveEmailOtp(input: {
+        readonly owner: WalletRelocationOwnerRequest;
+        readonly binding: WalletRelocationChallengeBinding;
+        readonly challengeId: string;
+        readonly otpCode: string;
+        readonly nowMs: number;
+        readonly verifier: CloudflareD1EmailOtpChallengeVerifier;
+        readonly emailOtpChallenges: CloudflareD1EmailOtpChallengeStore;
+    }): Promise<ApprovalResult>;
+    private commit;
+    find(walletId: WalletId, moveId: string): Promise<StoredApproval | null>;
+    readForAdmission(binding: WalletRelocationChallengeBinding, nowMs: number): Promise<StoredApproval | null>;
+    read(binding: WalletRelocationChallengeBinding): Promise<StoredApproval | null>;
+    private key;
+}
+export {};
+//# sourceMappingURL=d1WalletRelocationApprovals.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletRelocationChallenges.d.ts

@@ -0,0 +1,47 @@
+import { type WalletId, type WalletAuthorityId, type WalletAuthMethodId } from '../../../../../../shared-ts/src/utils/domainIds';
+import { type SessionOrigin } from '../../../../authorization/domain';
+import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import type { D1TenantScope } from '../../../../core/d1TenantStore';
+export declare class WalletRelocationChallengeBinding {
+    #private;
+    readonly walletId: WalletId;
+    readonly moveId: string;
+    readonly requestDigestHex: string;
+    readonly sourceGeneration: number;
+    readonly destinationRegion: 'US' | 'WEUR' | 'APAC' | 'OC';
+    readonly authorityId: WalletAuthorityId;
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly credentialDigestHex: string;
+    readonly credentialExpiresAtMs: number;
+    readonly origin: SessionOrigin;
+    private constructor();
+    static parse(raw: unknown): WalletRelocationChallengeBinding;
+    static decode(encoded: string): WalletRelocationChallengeBinding;
+    encoded(): string;
+}
+type ChallengeFields = {
+    readonly binding: WalletRelocationChallengeBinding;
+    readonly challengeB64u: string;
+    readonly createdAtMs: number;
+    readonly expiresAtMs: number;
+};
+type IssuedChallenge = ChallengeFields & {
+    readonly state: 'issued';
+    readonly consumedAtMs?: never;
+};
+type StoredChallenge = IssuedChallenge | (ChallengeFields & {
+    readonly state: 'consumed';
+    readonly consumedAtMs: number;
+});
+export declare class D1WalletRelocationChallenges {
+    private readonly database;
+    private readonly scope;
+    constructor(database: D1DatabaseLike, scope: D1TenantScope);
+    issue(binding: WalletRelocationChallengeBinding, nowMs: number, factorExpiresAtMs: number): Promise<StoredChallenge>;
+    find(walletId: WalletId, moveId: string): Promise<StoredChallenge | null>;
+    read(binding: WalletRelocationChallengeBinding): Promise<StoredChallenge | null>;
+    prepareConsume(challenge: IssuedChallenge, nowMs: number): readonly D1PreparedStatementLike[];
+    private key;
+}
+export {};
+//# sourceMappingURL=d1WalletRelocationChallenges.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletRelocationEmailOtp.d.ts

@@ -0,0 +1,25 @@
+import type { CloudflareD1EmailOtpChallengeIssuer } from '../emailOtp/d1EmailOtpChallengeIssuer';
+import { type DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
+import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
+import type { D1TenantScope } from '../../../../core/d1TenantStore';
+import type { CloudflareD1EmailOtpChallengeVerifier } from '../emailOtp/d1EmailOtpChallengeVerifier';
+import type { CloudflareD1EmailOtpChallengeStore } from '../emailOtp/d1EmailOtpChallengeStore';
+import { type WalletRelocationChallengeBinding } from './d1WalletRelocationChallenges';
+import { type WalletRelocationFactorVerification } from './d1WalletRelocationOwner';
+export type WalletRelocationEmailOtpServices = {
+    readonly issuer: CloudflareD1EmailOtpChallengeIssuer;
+    readonly verifier: CloudflareD1EmailOtpChallengeVerifier;
+    readonly emailOtpChallenges: CloudflareD1EmailOtpChallengeStore;
+};
+export declare function walletRelocationEmailOtpBinding(scope: D1TenantScope, binding: WalletRelocationChallengeBinding, challengeB64u: string): Promise<DigestB64u>;
+export declare function verifyWalletRelocationEmailOtp(input: {
+    readonly database: D1DatabaseLike;
+    readonly scope: D1TenantScope;
+    readonly binding: WalletRelocationChallengeBinding;
+    readonly challengeId: string;
+    readonly otpCode: string;
+    readonly nowMs: number;
+    readonly verifier: CloudflareD1EmailOtpChallengeVerifier;
+    readonly emailOtpChallenges: CloudflareD1EmailOtpChallengeStore;
+}): Promise<WalletRelocationFactorVerification>;
+//# sourceMappingURL=d1WalletRelocationEmailOtp.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletRelocationOwner.d.ts

@@ -0,0 +1,88 @@
+import type { DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
+import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import type { D1TenantScope } from '../../../../core/d1TenantStore';
+import type { WalletRelocationChallengeBinding } from './d1WalletRelocationChallenges';
+export type WalletRelocationFactorVerification = {
+    readonly kind: 'verified';
+    readonly authorityDigestB64u: DigestB64u;
+    readonly authorityRevocationEpoch: number;
+    readonly commitPrerequisites: readonly D1PreparedStatementLike[];
+} | {
+    readonly kind: 'denied';
+    readonly authorityDigestB64u?: never;
+    readonly authorityRevocationEpoch?: never;
+    readonly commitPrerequisites?: never;
+};
+export declare function readWalletRelocationOwner(database: D1DatabaseLike, scope: D1TenantScope, binding: WalletRelocationChallengeBinding): Promise<{
+    method: ({
+        readonly version: "wallet_auth_method_v2";
+        readonly walletAuthMethodId: import("../../../../../../shared-ts/src/utils").WalletAuthMethodId;
+        readonly walletId: import("../../../../../../shared-ts/src/utils").WalletId;
+        readonly walletAuthorityId: import("../../../../../../shared-ts/src/utils").WalletAuthorityId;
+        readonly createdAtMs: number;
+        readonly updatedAtMs: number;
+    } & {
+        readonly walletAuthMethodId: import("../../../../../../shared-ts/src/utils").WalletAuthMethodId;
+        readonly walletId: import("../../../../../../shared-ts/src/utils").WalletId;
+        readonly createdAtMs: number;
+    } & {
+        readonly kind: "passkey";
+        readonly rpId: import("../../../../../../shared-ts/src/utils").WebAuthnRpId;
+        readonly credentialIdB64u: import("../../../../../../shared-ts/src/utils").WebAuthnCredentialIdB64u;
+        readonly credentialPublicKeyB64u: string;
+        readonly counter: number;
+        readonly emailHashHex?: never;
+        readonly registrationAuthorityId?: never;
+    } & {
+        readonly status: "active";
+        readonly activatedAtMs: number;
+        readonly revokedAtMs?: undefined;
+    }) | ({
+        readonly version: "wallet_auth_method_v2";
+        readonly walletAuthMethodId: import("../../../../../../shared-ts/src/utils").WalletAuthMethodId;
+        readonly walletId: import("../../../../../../shared-ts/src/utils").WalletId;
+        readonly walletAuthorityId: import("../../../../../../shared-ts/src/utils").WalletAuthorityId;
+        readonly createdAtMs: number;
+        readonly updatedAtMs: number;
+    } & {
+        readonly walletAuthMethodId: import("../../../../../../shared-ts/src/utils").WalletAuthMethodId;
+        readonly walletId: import("../../../../../../shared-ts/src/utils").WalletId;
+        readonly createdAtMs: number;
+    } & {
+        readonly kind: "email_otp";
+        readonly emailHashHex: string;
+        readonly registrationAuthorityId: string;
+        readonly rpId?: never;
+        readonly credentialIdB64u?: never;
+        readonly credentialPublicKeyB64u?: never;
+        readonly counter?: never;
+    } & {
+        readonly status: "active";
+        readonly activatedAtMs: number;
+        readonly revokedAtMs?: undefined;
+    });
+    authority: {
+        readonly kind: "wallet_authority_v1";
+        readonly authorityId: import("../../../../../../shared-ts/src/utils").WalletAuthorityId;
+        readonly walletId: import("../../../../../../shared-ts/src/utils").WalletId;
+        readonly principal: {
+            readonly kind: "owner_device";
+            readonly deviceId: import("../../../../../../shared-ts/src/authorization").DeviceId;
+        };
+        readonly provenance: import("../../../../../../shared-ts/src/authorization").WalletAuthorityProvenanceV1;
+        readonly permissions: import("../../../../../../shared-ts/src/authorization/delegatedAuthority").CanonicalDelegatedWalletPermissionSetV1;
+        readonly signerActivations: import("../../../../../../shared-ts/src/authorization").WalletSignerActivationSetV1;
+        readonly signerActivationSetDigestB64u: DigestB64u;
+        readonly authorityDigestB64u: DigestB64u;
+        readonly revocationEpoch: number;
+        readonly createdAtMs: number;
+        readonly updatedAtMs: number;
+    } & {
+        readonly state: "active";
+        readonly localInstallPackageSetDigestB64u?: never;
+        readonly activatedAtMs: number;
+        readonly revokedAtMs?: never;
+    };
+    commitPrerequisites: readonly D1PreparedStatementLike[];
+} | null>;
+//# sourceMappingURL=d1WalletRelocationOwner.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletRelocationOwnerRequest.d.ts

@@ -0,0 +1,37 @@
+import type { TenantId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
+import type { WalletId, WalletAuthorityId, WalletAuthMethodId } from '../../../../../../shared-ts/src/utils/domainIds';
+import { type SessionOrigin } from '../../../../authorization/domain';
+import type { D1TenantScope } from '../../../../core/d1TenantStore';
+import { type AuthorizationService } from '../../../../authorization/service';
+import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import { WalletRelocationChallengeBinding } from './d1WalletRelocationChallenges';
+export declare class WalletRelocationOwnerRequest {
+    #private;
+    readonly walletId: WalletId;
+    readonly authorityId: WalletAuthorityId;
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly credentialExpiresAtMs: number;
+    readonly origin: SessionOrigin;
+    private readonly scope;
+    private readonly tenantId;
+    private readonly authorizationId;
+    private readonly credentialHash;
+    private constructor();
+    static authenticate(input: {
+        readonly request: Request;
+        readonly walletId: WalletId;
+        readonly tenantId: TenantId;
+        readonly scope: D1TenantScope;
+        readonly allowedOrigins: readonly SessionOrigin[];
+        readonly authorizationSessions: Pick<AuthorizationService, 'readWalletSessionExactOperationContextByCredential'>;
+        readonly nowMs: number;
+    }): Promise<WalletRelocationOwnerRequest | null>;
+    prepareApprovalGuard(database: D1DatabaseLike, scope: D1TenantScope, binding: WalletRelocationChallengeBinding, nowMs: number): readonly D1PreparedStatementLike[];
+    bindMove(input: {
+        readonly moveId: string;
+        readonly requestDigestHex: string;
+        readonly sourceGeneration: number;
+        readonly destinationRegion: WalletRelocationChallengeBinding['destinationRegion'];
+    }): WalletRelocationChallengeBinding;
+}
+//# sourceMappingURL=d1WalletRelocationOwnerRequest.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletRelocationPasskey.d.ts

@@ -0,0 +1,12 @@
+import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
+import type { D1TenantScope } from '../../../../core/d1TenantStore';
+import { type WalletRelocationFactorVerification } from './d1WalletRelocationOwner';
+import { type WalletRelocationChallengeBinding } from './d1WalletRelocationChallenges';
+export declare function verifyWalletRelocationPasskey(input: {
+    readonly database: D1DatabaseLike;
+    readonly scope: D1TenantScope;
+    readonly binding: WalletRelocationChallengeBinding;
+    readonly credential: unknown;
+    readonly nowMs: number;
+}): Promise<WalletRelocationFactorVerification>;
+//# sourceMappingURL=d1WalletRelocationPasskey.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletRelocationReadAccess.d.ts

@@ -0,0 +1,18 @@
+import { type SessionOrigin } from '../../../../authorization/domain';
+import type { D1TenantScope } from '../../../../core/d1TenantStore';
+import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
+import type { WalletRelocationChallengeBinding } from './d1WalletRelocationChallenges';
+export declare class WalletRelocationReadAccess {
+    #private;
+    private constructor();
+    static authenticate(input: {
+        readonly database: D1DatabaseLike;
+        readonly scope: D1TenantScope;
+        readonly binding: WalletRelocationChallengeBinding;
+        readonly request: Request;
+        readonly allowedOrigins: readonly SessionOrigin[];
+        readonly nowMs: number;
+    }): Promise<WalletRelocationReadAccess | null>;
+    get binding(): WalletRelocationChallengeBinding;
+}
+//# sourceMappingURL=d1WalletRelocationReadAccess.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletRelocationSessions.d.ts

@@ -0,0 +1,23 @@
+import { type WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
+import { type D1TenantScope } from '../../../../core/d1TenantStore';
+import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+export declare class WalletRelocationSessionSource {
+    #private;
+    readonly walletId: WalletId;
+    readonly moveId: string;
+    readonly requestDigestHex: string;
+    readonly sourceGeneration: number;
+    private constructor();
+    static parse(raw: unknown): WalletRelocationSessionSource;
+    matches(row: Record<string, unknown>): boolean;
+}
+export declare class D1WalletRelocationSessions {
+    private readonly database;
+    private readonly scope;
+    constructor(database: D1DatabaseLike, scope: D1TenantScope);
+    hasPendingOperations(walletId: WalletId): Promise<boolean>;
+    retire(source: WalletRelocationSessionSource, nowMs: number): Promise<number>;
+    retirementStatements(source: WalletRelocationSessionSource, nowMs: number): readonly D1PreparedStatementLike[];
+    private read;
+}
+//# sourceMappingURL=d1WalletRelocationSessions.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletRelocationWriteBlock.d.ts

@@ -0,0 +1,16 @@
+import { type D1TenantScope } from '../../../../core/d1TenantStore';
+import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
+import { WalletRelocationSessionSource } from './d1WalletRelocationSessions';
+export declare class D1WalletRelocationWriteBlock {
+    private readonly database;
+    private readonly scope;
+    constructor(database: D1DatabaseLike, scope: D1TenantScope);
+    check(source: WalletRelocationSessionSource, nowMs: number): Promise<'ready' | 'draining'>;
+    release(source: WalletRelocationSessionSource, nowMs: number): Promise<void>;
+    freeze(source: WalletRelocationSessionSource, nowMs: number): Promise<{
+        readonly retiredAtMs: number;
+        readonly frozenAtMs: number;
+    }>;
+    private read;
+}
+//# sourceMappingURL=d1WalletRelocationWriteBlock.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/walletObjectAddresses.d.ts

@@ -0,0 +1,14 @@
+import type { CloudflareServiceBindingFetcher } from '../runtime/routerAbServiceBindings';
+import { type D1TenantScope } from '../../../core/d1TenantStore';
+import type { D1DatabaseLike } from '../../../storage/tenantRoute';
+import { WalletObjectAddresses, type WalletObjectIdentity } from '../runtime/walletObjectAddresses';
+export declare class D1WalletObjectAddresses {
+    private readonly database;
+    private readonly scope;
+    constructor(database: D1DatabaseLike, scope: D1TenantScope);
+    initialize(identity: WalletObjectIdentity, router: CloudflareServiceBindingFetcher, credential: string): Promise<WalletObjectAddresses>;
+    read(identity: WalletObjectIdentity): Promise<WalletObjectAddresses | null>;
+    /** Competing allocations return the same persisted winner before either starts work. */
+    insert(identity: WalletObjectIdentity, addresses: WalletObjectAddresses): Promise<WalletObjectAddresses>;
+}
+//# sourceMappingURL=walletObjectAddresses.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/runtime/routerAbServiceBindings.d.ts

@@ -1,3 +1,5 @@
+import type { D1DatabaseLike } from '../../../storage/tenantRoute';
+import { type WalletObjectAddressSnapshot } from './walletObjectAddresses';
 export interface CloudflareServiceBindingFetcher {
     fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
 }
@@ -5,6 +7,17 @@ export interface RouterAbServiceBindingEnv {
     readonly MPC_ROUTER: CloudflareServiceBindingFetcher;
     readonly SIGNING_WORKER: CloudflareServiceBindingFetcher;
 }
+export type WalletHomeRegion = 'US' | 'WEUR' | 'APAC' | 'OC';
+/** Apply only after the host admits this request to the wallet's fixed home. */
+export declare class WalletHomeCustodyBinding implements CloudflareServiceBindingFetcher {
+    private readonly binding;
+    private readonly home;
+    private readonly database;
+    private readonly namespace;
+    private readonly initialAddresses;
+    constructor(binding: CloudflareServiceBindingFetcher, home: WalletHomeRegion, database: D1DatabaseLike, namespace: string, initialAddresses: WalletObjectAddressSnapshot | null);
+    fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
+}
 export declare const ROUTER_AB_MPC_ROUTER_ORIGIN = "https://mpc-router.router-ab.internal";
 export declare const ROUTER_AB_SIGNING_WORKER_ORIGIN = "https://signing-worker.router-ab.internal";
 export declare function createRouterAbServiceBindingFetch(env: RouterAbServiceBindingEnv): typeof globalThis.fetch;

package/dist/types/wallet-server/src/router/cloudflare/runtime/walletAuthorizationRelocationRoutes.d.ts

@@ -0,0 +1,21 @@
+import type { D1TenantScope } from '../../../core/d1TenantStore';
+import type { D1DatabaseLike } from '../../../storage/tenantRoute';
+import type { RouterApiRouteExtension, RouterApiFetchRouteExtensionInput } from '../../framework/routeExtensions';
+import type { WalletConsoleServiceBinding } from './walletConsoleOpsClient';
+export declare class WalletAuthorizationRelocationRoutes implements RouterApiRouteExtension {
+    private readonly options;
+    readonly kind = "fetch_route_extension";
+    readonly id = "wallet_authorization_relocation";
+    readonly routes: RouterApiRouteExtension['routes'];
+    constructor(options: {
+        readonly database: D1DatabaseLike;
+        readonly scope: D1TenantScope;
+        readonly directory: WalletConsoleServiceBinding;
+    });
+    private ownerApproval;
+    private prepareDestination;
+    handleFetchRoute(input: RouterApiFetchRouteExtensionInput): Promise<Response>;
+    private capacityBlock;
+    handle(request: Request): Promise<Response>;
+}
+//# sourceMappingURL=walletAuthorizationRelocationRoutes.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/runtime/walletConsoleOps.d.ts

@@ -6,8 +6,8 @@ export declare const WALLET_CONSOLE_SERVICE_ORIGIN_V1 = "https://wallet-console.
 export declare const WALLET_CONSOLE_OP_PATHS_V1: {
     readonly secretKeyAuth: "/internal/wallet-console/v1/secret-key-auth";
     readonly publishableKeyAuth: "/internal/wallet-console/v1/publishable-key-auth";
+    readonly registrationContext: "/internal/wallet-console/v1/registration-context";
     readonly usageEvents: "/internal/wallet-console/v1/usage-events";
-    readonly walletProjection: "/internal/wallet-console/v1/wallet-projections";
     readonly projectEnvironments: "/internal/wallet-console/v1/project-environments";
     readonly tenantRootActiveLineage: "/internal/wallet-console/v1/tenant-root/active-lineage";
 };

package/dist/types/wallet-server/src/router/cloudflare/runtime/walletConsoleOpsClient.d.ts

@@ -1,5 +1,4 @@
-import type { RouterApiWalletProjectionAdapter } from '../../framework/routerApi';
-import type { RouterApiKeyAuthAdapter, RouterApiPublishableKeyAuthAdapter, RouterApiProjectEnvironmentResolver, RouterApiUsageMeterAdapter } from '../../framework/apiCredentialPorts';
+import type { RouterApiKeyAuthAdapter, RouterApiPublishableKeyAuthAdapter, RouterApiProjectEnvironmentResolver, RouterApiUsageMeterAdapter, RouterApiPublishableKeyAuthRequest, WalletRegistrationContextResolver, WalletRegistrationContextResult } from '../../framework/apiCredentialPorts';
 import { type WalletConsoleTenantRootActiveLineageResolverV1 } from './walletConsoleOps';
 /** The shape of a Cloudflare service binding (`Fetcher`). */
 export interface WalletConsoleServiceBinding {
@@ -8,11 +7,12 @@ export interface WalletConsoleServiceBinding {
 export interface WalletConsoleOpsClient {
     readonly apiKeyAuth: RouterApiKeyAuthAdapter;
     readonly publishableKeyAuth: RouterApiPublishableKeyAuthAdapter;
+    readonly registrationContext: WalletRegistrationContextResolver;
     readonly usageMeter: RouterApiUsageMeterAdapter;
-    readonly walletProjection: RouterApiWalletProjectionAdapter;
     readonly projectEnvironments: RouterApiProjectEnvironmentResolver;
     readonly tenantRootActiveLineage: WalletConsoleTenantRootActiveLineageResolverV1;
 }
+export declare function parseWalletRegistrationContextResponse(input: RouterApiPublishableKeyAuthRequest, status: number, body: unknown): WalletRegistrationContextResult;
 /**
  * Gateway-side client for the private Wallet Console service binding. The
  * Wallet Gateway composes its Router API key auth and usage metering through

package/dist/types/wallet-server/src/router/cloudflare/runtime/walletControlOps.d.ts

@@ -1,9 +1,10 @@
+import { type WalletRelocationRuntimeBindings } from './walletRelocationOps';
 import type { CloudflareServiceBindingFetcher } from './routerAbServiceBindings';
 import type { WalletRuntimeServiceBinding } from './walletRuntimeOps';
 export declare const WALLET_CONTROL_SERVICE_ORIGIN_V1 = "https://wallet-runtime.internal";
 export declare const WALLET_CONTROL_BASE_PATH_V1 = "/internal/wallet-runtime/v1/tenant-root-control";
 export declare const WALLET_CONTROL_AUTH_MARKER_V1 = "wallet-control-private-binding-v1";
-export interface WalletControlRuntimeBindings {
+export interface WalletControlRuntimeBindings extends WalletRelocationRuntimeBindings {
     readonly MPC_ROUTER: CloudflareServiceBindingFetcher;
     readonly TENANT_ROOT_CONTROL_PLANE: CloudflareServiceBindingFetcher;
     readonly DERIVER_A: CloudflareServiceBindingFetcher;

package/dist/types/wallet-server/src/router/cloudflare/runtime/walletGateway.d.ts

@@ -1,3 +1,4 @@
+import type { WalletRegistrationContextResolver } from '../../framework/apiCredentialPorts';
 import { type CloudflareD1RouterAbNormalSigningAdmissionStoreOptions } from '../d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore';
 import type { RouterApiOptions } from '../../framework/routerApi';
 import type { RouteDefinition } from '../../framework/routeDefinitions';
@@ -17,10 +18,11 @@ export declare function walletConsoleSignedDelegateRouteDefinitionV1(routePath:
 export declare function walletConsoleSponsoredEvmCallRouteDefinitionV1(routePath?: string): RouteDefinition;
 export declare function walletConsoleRelayRouteDefinitionsV1(): readonly RouteDefinition[];
 export declare function createWalletConsoleRelayProxyExtensionV1(binding: WalletConsoleServiceBinding): RouterApiRouteExtension;
-type WalletGatewayManagedRouterOption = 'apiKeyAuth' | 'publishableKeyAuth' | 'apiKeyUsageMeter' | 'walletProjection' | 'orgProjectEnv' | 'routerAbNormalSigningAdmission' | 'routeExtensions';
+type WalletGatewayManagedRouterOption = 'apiKeyAuth' | 'publishableKeyAuth' | 'registrationContext' | 'apiKeyUsageMeter' | 'orgProjectEnv' | 'routerAbNormalSigningAdmission' | 'routeExtensions';
 export interface CloudflareWalletGatewayRouterOptionsV1 {
     readonly service: Parameters<typeof createCloudflareRouter>[0];
     readonly walletConsole: WalletConsoleServiceBinding;
+    readonly registrationContext?: WalletRegistrationContextResolver;
     readonly signerDatabase: CloudflareD1RouterAbNormalSigningAdmissionStoreOptions['database'];
     readonly signerStorageNamespace: string;
     readonly routeExtensions?: readonly RouterApiRouteExtension[];

package/dist/types/wallet-server/src/router/cloudflare/runtime/walletObjectAddresses.d.ts

@@ -0,0 +1,45 @@
+import type { WalletId } from '../../../../../shared-ts/src/utils/domainIds';
+export declare const WALLET_OBJECT_IDENTITY_HEADER = "x-seams-wallet-object-identity";
+export declare const WALLET_OBJECT_ADDRESSES_HEADER = "x-seams-wallet-object-addresses";
+/** Opaque addresses select custody objects. They confer no execution authority. */
+export declare class WalletObjectAddresses {
+    private readonly values;
+    private constructor();
+    get router(): string;
+    get deriver_a(): string;
+    get deriver_b(): string;
+    get signing_worker(): string;
+    toJSON(): {
+        readonly router: string;
+        readonly deriver_a: string;
+        readonly deriver_b: string;
+        readonly signing_worker: string;
+    };
+    static parse(raw: unknown): WalletObjectAddresses;
+}
+export type WalletObjectTenant = {
+    readonly orgId: string;
+    readonly projectId: string;
+    readonly envId: string;
+};
+export type WalletObjectIdentity = WalletObjectTenant & {
+    readonly walletId: WalletId;
+    readonly ownershipGeneration: number;
+};
+/** A request-local read of immutable addresses for one wallet generation. */
+export declare class WalletObjectAddressSnapshot {
+    private readonly namespace;
+    private readonly identity;
+    private readonly addresses;
+    private constructor();
+    static parse(raw: unknown, namespace: string, tenant: WalletObjectTenant): WalletObjectAddressSnapshot;
+    resolve(namespace: string, identity: WalletObjectIdentity): WalletObjectAddresses | null;
+}
+export declare function walletObjectIdentity(wallet: unknown, generation: unknown, tenant: {
+    readonly [Key in keyof WalletObjectTenant]: unknown;
+}): WalletObjectIdentity;
+export declare function walletObjectIdentityHeaders(identity: WalletObjectIdentity): Record<string, string>;
+export declare function readWalletObjectIdentityHeader(headers: Headers): WalletObjectIdentity | null;
+export declare function walletObjectIdentityFromWireScope(scope: unknown, generation: unknown): WalletObjectIdentity;
+export declare function walletRelocationObjectIdentity(wallet: Record<string, unknown>, generation: unknown): WalletObjectIdentity;
+//# sourceMappingURL=walletObjectAddresses.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/runtime/walletPlacementRoutes.d.ts

@@ -0,0 +1,30 @@
+import type { WalletRelocationEmailOtpServices } from '../d1/wallet/d1WalletRelocationEmailOtp';
+import type { TenantId } from '../../../../../shared-ts/src/authorization/capabilityKinds';
+import type { SessionOrigin } from '../../../authorization/domain';
+import type { AuthorizationService } from '../../../authorization/service';
+import type { D1TenantScope } from '../../../core/d1TenantStore';
+import type { D1DatabaseLike } from '../../../storage/tenantRoute';
+import type { RouterApiRouteExtension, RouterApiFetchRouteExtensionInput } from '../../framework/routeExtensions';
+import type { WalletConsoleServiceBinding } from './walletConsoleOpsClient';
+export declare class WalletPlacementRoutes implements RouterApiRouteExtension {
+    private readonly options;
+    readonly kind = "fetch_route_extension";
+    readonly id = "wallet_placement";
+    readonly routes: RouterApiRouteExtension['routes'];
+    constructor(options: {
+        readonly emailOtp: WalletRelocationEmailOtpServices;
+        readonly database: D1DatabaseLike;
+        readonly scope: D1TenantScope;
+        readonly tenantId: TenantId;
+        readonly allowedOrigins: readonly SessionOrigin[];
+        readonly authorizationSessions: Pick<AuthorizationService, 'readWalletSessionExactOperationContextByCredential'>;
+        readonly directory: WalletConsoleServiceBinding;
+    });
+    handleFetchRoute(input: RouterApiFetchRouteExtensionInput): Promise<Response>;
+    handle(request: Request): Promise<Response>;
+    private challenge;
+    private relocate;
+    private walletKey;
+    private dispatch;
+}
+//# sourceMappingURL=walletPlacementRoutes.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/runtime/walletRelocationDeriver.d.ts

@@ -0,0 +1,11 @@
+import type { CloudflareServiceBindingFetcher } from './routerAbServiceBindings';
+import type { RuntimeSourceDirectory } from './walletRelocationSource';
+type Role = 'deriver-a' | 'deriver-b';
+type Operation = 'fence' | 'capture' | 'export' | 'import' | 'status' | 'verify' | 'activate' | 'cleanup';
+export declare function deriverRuntimeOperation(value: string): {
+    role: Role;
+    operation: Operation;
+} | null;
+export declare function forwardDeriverRelocation(input: unknown, role: Role, operation: Operation, binding: CloudflareServiceBindingFetcher, credential: string, directory: RuntimeSourceDirectory): Promise<Response>;
+export {};
+//# sourceMappingURL=walletRelocationDeriver.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/runtime/walletRelocationEcdsa.d.ts

@@ -0,0 +1,7 @@
+import type { CloudflareServiceBindingFetcher } from './routerAbServiceBindings';
+import { type RuntimeSourceDirectory } from './walletRelocationSource';
+type Operation = 'freeze' | 'export' | 'import' | 'status' | 'verify' | 'activate' | 'cleanup';
+export declare function ecdsaRuntimeOperation(operation: string): Operation | null;
+export declare function forwardEcdsaRelocation(input: unknown, operation: Operation, router: CloudflareServiceBindingFetcher, credential: string, directory: RuntimeSourceDirectory): Promise<Response>;
+export {};
+//# sourceMappingURL=walletRelocationEcdsa.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/runtime/walletRelocationEd25519.d.ts

@@ -0,0 +1,7 @@
+import type { CloudflareServiceBindingFetcher } from './routerAbServiceBindings';
+import { type RuntimeSourceDirectory } from './walletRelocationSource';
+type Operation = 'capture' | 'export' | 'import' | 'status' | 'verify' | 'activate' | 'cleanup';
+export declare function ed25519RuntimeOperation(operation: string): Operation | null;
+export declare function forwardEd25519Snapshot(input: unknown, operation: Operation, router: CloudflareServiceBindingFetcher, credential: string, directory: RuntimeSourceDirectory): Promise<Response>;
+export {};
+//# sourceMappingURL=walletRelocationEd25519.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/runtime/walletRelocationOps.d.ts

@@ -0,0 +1,11 @@
+import { type RuntimeSourceDirectory } from './walletRelocationSource';
+import type { CloudflareServiceBindingFetcher } from './routerAbServiceBindings';
+export type WalletRelocationRuntimeBindings = RuntimeSourceDirectory & {
+    readonly MPC_ROUTER: CloudflareServiceBindingFetcher;
+    readonly DERIVER_A: CloudflareServiceBindingFetcher;
+    readonly DERIVER_B: CloudflareServiceBindingFetcher;
+    readonly ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET?: string;
+    readonly ROUTER_AB_GATEWAY_TO_ROUTER_AUTH_SECRET?: string;
+};
+export declare function handleWalletRelocationRequest(request: Request, env: WalletRelocationRuntimeBindings): Promise<Response | null>;
+//# sourceMappingURL=walletRelocationOps.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/runtime/walletRelocationPresign.d.ts

@@ -0,0 +1,7 @@
+import type { CloudflareServiceBindingFetcher } from './routerAbServiceBindings';
+import type { RuntimeSourceDirectory } from './walletRelocationSource';
+type Operation = 'inventory' | 'fence' | 'freeze' | 'export' | 'import' | 'verify' | 'status' | 'cleanup';
+export declare function presignSourceOperation(operation: string): Operation | null;
+export declare function forwardPresignSource(input: unknown, operation: Operation, router: CloudflareServiceBindingFetcher, credential: string, directory: RuntimeSourceDirectory): Promise<Response>;
+export {};
+//# sourceMappingURL=walletRelocationPresign.d.ts.map