@seams/wallet-server 0.8.0 → 0.9.1

package/dist/types/wallet-server/src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationIntentAuthorization.d.ts

@@ -1,7 +1,8 @@
 import { type RouterAbEd25519YaoRegistrationAdmissionRequestV1 } from '../../../../../../shared-ts/src/utils/routerAbEd25519Yao';
 import { type AddSignerIntentGrant, type AddSignerIntentV1, type RegistrationIntentGrant, type RegistrationIntentV1 } from '../../../../../../shared-ts/src/utils/registrationIntent';
-import type { RouterAbEd25519YaoRegistrationAuthorizationAdapter, RouterAbEd25519YaoRegistrationAuthorizationInput, RouterAbEd25519YaoRegistrationAuthorizationResult } from './routerAbEd25519YaoRegistration';
+import type { RouterAbEd25519YaoRegistrationAuthorizationAdapter, RouterAbEd25519YaoRegistrationAuthorizationInput, RouterAbEd25519YaoRegistrationAuthorizationFailure, RouterAbEd25519YaoRegistrationAuthorizationResult } from './routerAbEd25519YaoRegistration';
 type AvailableIntentAuthority = {
+    readonly ownershipGeneration: number;
     readonly kind: 'available';
     readonly purpose: RouterAbEd25519YaoActivationIntentPurposeV1;
     readonly credentialDigestSha256: Uint8Array;
@@ -10,6 +11,7 @@ type AvailableIntentAuthority = {
     readonly expiresAtMs: number;
 };
 type AdmittedIntentAuthority = {
+    readonly ownershipGeneration: number;
     readonly kind: 'admitted';
     readonly purpose: RouterAbEd25519YaoActivationIntentPurposeV1;
     readonly credentialDigestSha256: Uint8Array;
@@ -20,6 +22,7 @@ type AdmittedIntentAuthority = {
 type IntentAuthority = AvailableIntentAuthority | AdmittedIntentAuthority;
 type RouterAbEd25519YaoActivationIntentPurposeV1 = 'wallet_registration' | 'wallet_add_signer';
 export type RouterAbEd25519YaoVerifiedRegistrationIntentV1 = {
+    readonly ownershipGeneration: number;
     readonly kind: 'verified_registration_intent';
     readonly registrationIntentGrant: RegistrationIntentGrant;
     readonly intent: RegistrationIntentV1;
@@ -27,6 +30,7 @@ export type RouterAbEd25519YaoVerifiedRegistrationIntentV1 = {
     readonly expiresAtMs: number;
 };
 type RouterAbEd25519YaoVerifiedAddSignerIntentV1 = {
+    readonly ownershipGeneration: number;
     readonly kind: 'verified_add_signer_intent';
     readonly addSignerIntentGrant: AddSignerIntentGrant;
     readonly intent: AddSignerIntentV1 & {
@@ -72,6 +76,7 @@ export declare class InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAd
     constructor(state?: InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationStateV1);
     bindVerifiedIntent(verified: RouterAbEd25519YaoVerifiedActivationIntentV1): Promise<RouterAbEd25519YaoRegistrationIntentBindingResult>;
     bindVerifiedContinuation(verified: VerifiedNearRegistrationContinuationV1): Promise<RouterAbEd25519YaoRegistrationIntentBindingResult>;
+    bindAndAuthorizeAdmission(input: RouterAbEd25519YaoVerifiedActivationIntentV1): Promise<RouterAbEd25519YaoRegistrationIntentBindingResult | RouterAbEd25519YaoRegistrationAuthorizationFailure>;
     authorize(input: RouterAbEd25519YaoRegistrationAuthorizationInput): Promise<RouterAbEd25519YaoRegistrationAuthorizationResult>;
     private authorizeAdmission;
     private authorizeExecution;

package/dist/types/wallet-server/src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.d.ts

@@ -1,4 +1,5 @@
 import type { VersionedJsonRecordPutResult, VersionedJsonRecordReadResult } from '../../../framework/versionedJsonRecordStore';
+import type { RouterAbEd25519YaoPreparedWriteV1 } from '../capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore';
 export type RouterAbEd25519YaoRegistrationSideEffectOperationV1 = 'finalize' | 'registration_activate' | 'near_provisioning' | 'registration_start' | 'add_signer_start' | 'add_signer_finalize';
 type RouterAbEd25519YaoRetryableSideEffectFailureV1 = {
     readonly ok: false;
@@ -54,6 +55,8 @@ export type RouterAbEd25519YaoRegistrationSideEffectRecordV2<C, P> = RouterAbEd2
 export interface RouterAbEd25519YaoRegistrationSideEffectStoreV2<C, P> {
     read(key: string): Promise<VersionedJsonRecordReadResult<RouterAbEd25519YaoRegistrationSideEffectRecordV2<C, P>>>;
     put(key: string, value: RouterAbEd25519YaoRegistrationSideEffectRecordV2<C, P>, expectedVersion: string | null): Promise<VersionedJsonRecordPutResult>;
+    /** As `put`, with another store's write that commits in the same batch or not at all. */
+    putWithCompanion(key: string, value: RouterAbEd25519YaoRegistrationSideEffectRecordV2<C, P>, expectedVersion: string | null, companionWrite: RouterAbEd25519YaoPreparedWriteV1): Promise<VersionedJsonRecordPutResult>;
 }
 export declare function parseRouterAbEd25519YaoRegistrationSideEffectRecordV2<C, P>(raw: unknown, input: {
     readonly operation: RouterAbEd25519YaoRegistrationSideEffectOperationV1;
@@ -111,6 +114,8 @@ type RouterAbEd25519YaoRegistrationSideEffectRunInputV2<T, C, P> = {
     readonly kind: 'prepared_resumable';
     readonly operation: RouterAbEd25519YaoRegistrationSideEffectOperationV1;
     readonly key: string;
+    /** Read for this request. CAS reconciliation always reads the store again. */
+    readonly initialRecord: VersionedJsonRecordReadResult<RouterAbEd25519YaoRegistrationSideEffectRecordV2<C, P>>;
     readonly requestFingerprint: string;
     readonly resumeAfterMs: number;
     readonly nowMs: () => number;
@@ -118,6 +123,12 @@ type RouterAbEd25519YaoRegistrationSideEffectRunInputV2<T, C, P> = {
     readonly derivePreparedArtifactFingerprint: (prepared: P) => Promise<string>;
     readonly execute: (prepared: P, attempt: RouterAbEd25519YaoRegistrationSideEffectAttemptV1) => Promise<T>;
     readonly projectReceipt: (response: T) => Promise<C> | C;
+    /**
+     * Another store's write that the execution left for its completion, or
+     * none. It commits with the completion record: a completed operation
+     * implies that write, and a lost completion leaves it undone.
+     */
+    readonly completionWrite: (response: T) => RouterAbEd25519YaoPreparedWriteV1 | null;
     readonly replay: (receipt: C) => Promise<T>;
 };
 type RouterAbEd25519YaoRegistrationSideEffectRunResultV2<T, P> = RouterAbEd25519YaoRegistrationSideEffectRunResultV1<T, P>;

package/dist/types/wallet-server/src/router/domains/ed25519Yao/routerAbEd25519YaoGatewayEnvelope.d.ts

@@ -11,10 +11,19 @@ export type RouterAbEd25519YaoTenantRootWireV1 = {
 };
 export declare function parseRouterAbEd25519YaoTenantRootWireV1(input: unknown): RouterAbEd25519YaoTenantRootWireV1 | null;
 export declare function routerAbEd25519YaoTenantRootWireV1(root: RouterAbEd25519YaoResolvedTenantRootV1): Promise<RouterAbEd25519YaoTenantRootWireV1>;
-export type RouterAbEd25519YaoTenantRootResolutionInputV1 = {
+/**
+ * Identifies the signing root that a registration is created under. Its
+ * tenant root depends on these two values alone, so it can be read before the
+ * admission request exists.
+ */
+export type RouterAbEd25519YaoRegistrationSigningRootIdV1 = {
+    readonly signing_root_id: string;
+    readonly root_share_epoch: string;
+};
+export declare function routerAbEd25519YaoRegistrationSigningRootIdV1(admissionRequest: RouterAbEd25519YaoRegistrationAdmissionRequestV1): RouterAbEd25519YaoRegistrationSigningRootIdV1;
+export type RouterAbEd25519YaoTenantRootResolutionInputV1 = ({
     readonly operation: 'registration';
-    readonly admissionRequest: RouterAbEd25519YaoRegistrationAdmissionRequestV1;
-} | {
+} & RouterAbEd25519YaoRegistrationSigningRootIdV1) | {
     readonly operation: 'recovery';
     readonly admissionRequest: RouterAbEd25519YaoRecoveryAdmissionRequestV1;
 } | {

package/dist/types/wallet-server/src/router/domains/passkeyCustody/registrationCustodyOutcome.d.ts

@@ -5,12 +5,13 @@ import type { WalletCustodyCeremonyCommitPayload } from './walletCustodyRegistra
 import { type VerifiedEmailOtpEnrollmentFacts } from './verifiedCustodyFactor';
 import type { CloudflareD1WalletCustodyCommitStore } from '../../cloudflare/d1/passkeyCustody/d1WalletCustodyCommitStore';
 /**
- * The whole custody side-effect of one registration leg, in one call: resolve
- * the factor from the authority the leg verified, then admit the payload
- * against the wallet the leg registered.
+ * The whole custody side-effect of one registration leg, in two steps: resolve
+ * the factor from the authority the leg verified and admit the payload against
+ * the wallet the leg registers, which claims the recovery-code routes; then
+ * store the records once that wallet is committed.
  *
  * **Activation never fails because of custody.** The wallet's registration is
- * already committed by the time this runs, and the seed exists only in the
+ * already committed by the time the records are stored, and the seed exists only in the
  * client's worker — so the client is the one party that can retry, re-enter as
  * a join, or abandon the run. Failing activation here would leave the server
  * registered, the response an error, and the client with no instruction; the
@@ -25,7 +26,10 @@ import type { CloudflareD1WalletCustodyCommitStore } from '../../cloudflare/d1/p
  * payload it answers.
  */
 type RegistrationCustodyOutcome = WalletCustodyRegistrationOutcome;
-export declare function commitRegistrationCustody(input: {
+/** Stores the admitted custody records. It reports every failure and never throws. */
+export type RegistrationCustodyCommit = () => Promise<RegistrationCustodyOutcome>;
+/** Admits the custody payload and claims its routes. It never throws either. */
+export declare function reserveRegistrationCustody(input: {
     /** Absent when the client did not run a custody ceremony for this leg. */
     readonly payload?: WalletCustodyCeremonyCommitPayload;
     readonly verifiedWalletId: WalletId;
@@ -34,6 +38,6 @@ export declare function commitRegistrationCustody(input: {
     readonly verifiedEmailOtpEnrollment?: VerifiedEmailOtpEnrollmentFacts;
     readonly nowMs: number;
     readonly store: CloudflareD1WalletCustodyCommitStore;
-}): Promise<RegistrationCustodyOutcome>;
+}): Promise<RegistrationCustodyCommit>;
 export {};
 //# sourceMappingURL=registrationCustodyOutcome.d.ts.map

package/dist/types/wallet-server/src/router/domains/passkeyCustody/walletCustodyRegistrationAdmission.d.ts

@@ -1,6 +1,6 @@
 import type { WalletId } from '../../../../../shared-ts/src/utils/domainIds';
 import type { WalletCustodyEnvelopeFactor } from '../../../../../shared-ts/src/passkey-custody';
-import { type WalletCustodyCeremonyCommitPayload, type WalletCustodyRegistrationCommitOutcome } from './walletCustodyRegistrationCommit';
+import { type WalletCustodyCeremonyCommitPayload, type WalletCustodyRegistrationCommitOutcome, type WalletCustodyRegistrationReserved } from './walletCustodyRegistrationCommit';
 import type { CloudflareD1WalletCustodyCommitStore } from '../../cloudflare/d1/passkeyCustody/d1WalletCustodyCommitStore';
 /**
  * Admits one ceremony's custody commit against a registration this server has
@@ -12,7 +12,7 @@ import type { CloudflareD1WalletCustodyCommitStore } from '../../cloudflare/d1/p
  * leg's own auth proof. A separate endpoint would be a second, weaker way in.
  *
  * This module is where that decision is enforced, and it is deliberately the
- * only path to `commitWalletCustodyRegistration` from a route. Two checks, both
+ * only path to `reserveWalletCustodyRegistration` from a route. Two checks, both
  * cheap and both load-bearing:
  *
  * 1. **The payload names the wallet the registration named.** A ceremony
@@ -52,6 +52,13 @@ type WalletCustodyRegistrationAdmissionInput = {
     readonly nowMs: number;
     readonly store: CloudflareD1WalletCustodyCommitStore;
 };
-export declare function admitWalletCustodyRegistrationCommit(input: WalletCustodyRegistrationAdmissionInput): Promise<WalletCustodyRegistrationAdmissionOutcome>;
+/**
+ * An admitted commit with its recovery-code routes claimed, or the outcome
+ * that ends the admission with nothing claimed or written.
+ */
+export type WalletCustodyRegistrationAdmission = WalletCustodyRegistrationReserved | Extract<WalletCustodyRegistrationAdmissionOutcome, {
+    kind: 'rejected' | 'no_custody_records';
+}>;
+export declare function admitWalletCustodyRegistrationCommit(input: WalletCustodyRegistrationAdmissionInput): Promise<WalletCustodyRegistrationAdmission>;
 export {};
 //# sourceMappingURL=walletCustodyRegistrationAdmission.d.ts.map

package/dist/types/wallet-server/src/router/domains/passkeyCustody/walletCustodyRegistrationCommit.d.ts

@@ -19,18 +19,25 @@ export type WalletCustodyRegistrationCommitOutcome = ({
     readonly kind: 'rejected';
     readonly reason: string;
 };
+/** The write that a reservation left for after the registration's wallet commit. */
+export type WalletCustodyRegistrationReserved = {
+    readonly kind: 'reserved';
+    readonly commit: () => Promise<WalletCustodyRegistrationCommitOutcome>;
+};
 /**
- * Builds and commits in one call.
+ * Builds the records and claims their recovery-code routes.
  *
  * A payload this server cannot parse becomes `rejected` rather than an
  * exception, so a malformed ceremony result is a request outcome and not a
- * route crash. Nothing is written in that case: the records are built before
- * the store is touched.
+ * route crash. Nothing is claimed or written in that case: the records are
+ * built before the store is touched.
  */
-export declare function commitWalletCustodyRegistration(input: {
+export declare function reserveWalletCustodyRegistration(input: {
     readonly payload: WalletCustodyCeremonyCommitPayload;
     readonly factor: unknown;
     readonly nowMs: number;
     readonly store: CloudflareD1WalletCustodyCommitStore;
-}): Promise<WalletCustodyRegistrationCommitOutcome>;
+}): Promise<WalletCustodyRegistrationReserved | Extract<WalletCustodyRegistrationCommitOutcome, {
+    kind: 'rejected';
+}>>;
 //# sourceMappingURL=walletCustodyRegistrationCommit.d.ts.map

package/dist/types/wallet-server/src/router/domains/signingOperations/authorizedOperationWire.d.ts

@@ -0,0 +1,97 @@
+import type { Ed25519ReusableAuthorizedOperationReceipt } from './ed25519AuthorizedOperationReceipt';
+import type { AuthorizedOperation } from '../../../authorization/domain';
+export type AuthorizedOperationBindingWire = {
+    readonly kind: 'reusable_wallet_session';
+    readonly authorization_id: string;
+    readonly wallet_session_id: string;
+    readonly quota_id: string;
+} | {
+    readonly kind: 'gateway_owner_wallet_session';
+    readonly ownership_generation: number;
+    readonly subject_id: string;
+    readonly account_id: string;
+    readonly authorization_id: string;
+    readonly wallet_session_id: string;
+    readonly quota_id: string;
+    readonly threshold_session_id: string;
+    readonly org_id: string;
+    readonly project_id: string;
+    readonly environment: string;
+    readonly project_environment_id: string;
+    readonly signing_worker_id: string;
+    readonly expires_at_ms: number;
+} | {
+    readonly kind: 'operation_step_up';
+    readonly ownership_generation: number;
+    readonly authorization_session_id: string;
+    readonly org_id: string;
+    readonly project_id: string;
+    readonly environment: string;
+    readonly project_environment_id: string;
+    readonly subject_id: string;
+    readonly account_id: string;
+};
+export type AuthorizedOperationWireInput = {
+    readonly operation: AuthorizedOperation;
+    readonly binding: {
+        readonly kind: 'reusable_wallet_session';
+        readonly walletSessionId: string;
+        readonly quotaId: string;
+    };
+} | {
+    readonly operation: AuthorizedOperation;
+    readonly binding: {
+        readonly kind: 'gateway_owner_wallet_session';
+        readonly ownershipGeneration: number;
+        readonly subjectId: string;
+        readonly accountId: string;
+        readonly authorizationId: string;
+        readonly walletSessionId: string;
+        readonly quotaId: string;
+        readonly thresholdSessionId: string;
+        readonly orgId: string;
+        readonly projectId: string;
+        readonly environment: string;
+        readonly projectEnvironmentId: string;
+        readonly signingWorkerId: string;
+        readonly expiresAtMs: number;
+    };
+} | {
+    readonly operation: AuthorizedOperation;
+    readonly binding: OperationStepUpBinding;
+};
+export type OperationStepUpBinding = {
+    readonly kind: 'operation_step_up';
+    readonly ownershipGeneration: number;
+    readonly authorizationSessionId: string;
+    readonly orgId: string;
+    readonly projectId: string;
+    readonly environment: string;
+    readonly projectEnvironmentId: string;
+    readonly subjectId: string;
+    readonly accountId: string;
+};
+type AuthorizedOperationFields = {
+    readonly authorized_operation_id: string;
+    readonly operation_id: string;
+    readonly lane_digest_b64u: string;
+    readonly intent_digest_b64u: string;
+    readonly display_digest_b64u: string;
+    readonly operation_fingerprint_digest: string;
+} & ({
+    readonly capability_kind: 'evm_ecdsa_mpc_signing';
+    readonly operation_kind: 'evm.sign_transaction';
+} | Pick<Ed25519ReusableAuthorizedOperationReceipt, 'capability_kind' | 'operation_kind'>);
+type AuthorizedOperationWire<T extends AuthorizedOperationFields> = {
+    readonly binding: AuthorizedOperationBindingWire;
+    readonly authorized_operation: (T & {
+        readonly kind: 'reusable_wallet_session_authorized_operation_v1';
+    }) | (T & {
+        readonly kind: 'verified_step_up_authorized_operation_v1';
+        readonly authorization_session_id: string;
+        readonly evidence_set_digest: string;
+    });
+};
+export declare function buildAuthorizedOperationWire<T extends AuthorizedOperationFields>(input: AuthorizedOperationWireInput, commonAuthorizedOperation: T): AuthorizedOperationWire<T>;
+export {};
+//# sourceMappingURL=authorizedOperationWire.d.ts.map

package/dist/types/wallet-server/src/router/domains/signingOperations/ecdsaSigningResponse.d.ts

@@ -0,0 +1,13 @@
+import type { AuthorizedOperation } from '../../../authorization/domain';
+import type { RouterApiAuthorizedOperationService } from '../../framework/authServicePort';
+export declare function finishRouterAbEcdsaSigningResponse(input: {
+    readonly upstream: Response;
+    readonly operation: AuthorizedOperation;
+    readonly authorizedOperations: RouterApiAuthorizedOperationService;
+    readonly timing: {
+        proxy: number | null;
+        complete: number | null;
+    };
+    readonly proxyStartedAt: number;
+}): Promise<Response>;
+//# sourceMappingURL=ecdsaSigningResponse.d.ts.map

package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbNormalSigningAdmission.d.ts

@@ -1,4 +1,4 @@
-import type { D1EcdsaAdmissionPolicyRead } from '../../cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore';
+import type { D1EcdsaAdmissionPolicyRead, D1Ed25519AdmissionPolicyRead } from '../../cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore';
 import type { RouterAbNormalSigningAuthorizationIdentity } from '../../../core/routerAbSigning/RouterAbNormalSigningRuntime';
 import type { RouterAbNormalSigningRuntime } from '../../../core/routerAbSigning/RouterAbNormalSigningRuntime';
 import type { ThresholdEd25519AuthorityScope } from '../../../core/types';
@@ -8,205 +8,6 @@ import type { AuthorizationParseResult } from '../../../../../shared-ts/src/auth
 import type { AuthorizedOperation, AuthorizedOperationReplayResponse, OwnerOperationStepUpReason } from '../../../authorization/domain';
 import type { RouterAbMpcMaterialActivationRefWire } from '../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
 import { type MpcMaterialActivationId } from '../../../../../shared-ts/src/utils/domainIds';
-type RouterAbAcceptedAuthorizedOperationBindingV1 = {
-    readonly kind: 'reusable_wallet_session';
-    readonly walletSessionId: string;
-    readonly quotaId: string;
-} | {
-    readonly kind: 'gateway_owner_wallet_session';
-    readonly subjectId: string;
-    readonly accountId: string;
-    readonly authorizationId: string;
-    readonly walletSessionId: string;
-    readonly quotaId: string;
-    readonly thresholdSessionId: string;
-    readonly orgId: string;
-    readonly projectId: string;
-    readonly environment: string;
-    readonly signingWorkerId: string;
-    readonly expiresAtMs: number;
-} | {
-    readonly kind: 'operation_step_up';
-    readonly authorizationSessionId: string;
-    readonly orgId: string;
-    readonly projectId: string;
-    readonly environment: string;
-    readonly subjectId: string;
-};
-export declare function buildRouterAbEd25519AcceptedAuthorizedOperationV1(input: {
-    readonly operation: AuthorizedOperation;
-    readonly binding: RouterAbAcceptedAuthorizedOperationBindingV1;
-}): {
-    binding: {
-        kind: "reusable_wallet_session";
-        authorization_id: import("../../../../../shared-ts/src/authorization/capabilityKinds").WalletSessionAuthorizationId;
-        wallet_session_id: string;
-        quota_id: string;
-        subject_id?: undefined;
-        account_id?: undefined;
-        threshold_session_id?: undefined;
-        org_id?: undefined;
-        project_id?: undefined;
-        environment?: undefined;
-        signing_worker_id?: undefined;
-        expires_at_ms?: undefined;
-        authorization_session_id?: undefined;
-    };
-    authorized_operation: {
-        authorized_operation_id: import("../../../../../shared-ts/src/authorization/capabilityKinds").AuthorizedOperationId;
-        operation_id: import("../../../../../shared-ts/src/authorization/capabilityKinds").CapabilityOperationId;
-        capability_kind: "near_ed25519_mpc_signing" | "evm_ecdsa_mpc_signing";
-        operation_kind: "near.sign_transaction" | "near.sign_delegate_action" | "near.sign_nep413_message" | "evm.sign_transaction";
-        lane_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
-        intent_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
-        display_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
-        operation_fingerprint_digest: import("../../../../../shared-ts/src/authorization").CapabilityOperationFingerprintDigest;
-        kind: "reusable_wallet_session_authorized_operation_v1";
-    };
-} | {
-    binding: {
-        kind: "gateway_owner_wallet_session";
-        subject_id: string;
-        account_id: string;
-        authorization_id: string;
-        wallet_session_id: string;
-        quota_id: string;
-        threshold_session_id: string;
-        org_id: string;
-        project_id: string;
-        environment: string;
-        signing_worker_id: string;
-        expires_at_ms: number;
-        authorization_session_id?: undefined;
-    };
-    authorized_operation: {
-        authorized_operation_id: import("../../../../../shared-ts/src/authorization/capabilityKinds").AuthorizedOperationId;
-        operation_id: import("../../../../../shared-ts/src/authorization/capabilityKinds").CapabilityOperationId;
-        capability_kind: "near_ed25519_mpc_signing" | "evm_ecdsa_mpc_signing";
-        operation_kind: "near.sign_transaction" | "near.sign_delegate_action" | "near.sign_nep413_message" | "evm.sign_transaction";
-        lane_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
-        intent_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
-        display_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
-        operation_fingerprint_digest: import("../../../../../shared-ts/src/authorization").CapabilityOperationFingerprintDigest;
-        kind: "reusable_wallet_session_authorized_operation_v1";
-    };
-} | {
-    binding: {
-        kind: "operation_step_up";
-        authorization_session_id: string;
-        org_id: string;
-        project_id: string;
-        environment: string;
-        subject_id: string;
-        authorization_id?: undefined;
-        wallet_session_id?: undefined;
-        quota_id?: undefined;
-        account_id?: undefined;
-        threshold_session_id?: undefined;
-        signing_worker_id?: undefined;
-        expires_at_ms?: undefined;
-    };
-    authorized_operation: {
-        authorized_operation_id: import("../../../../../shared-ts/src/authorization/capabilityKinds").AuthorizedOperationId;
-        operation_id: import("../../../../../shared-ts/src/authorization/capabilityKinds").CapabilityOperationId;
-        capability_kind: "near_ed25519_mpc_signing" | "evm_ecdsa_mpc_signing";
-        operation_kind: "near.sign_transaction" | "near.sign_delegate_action" | "near.sign_nep413_message" | "evm.sign_transaction";
-        lane_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
-        intent_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
-        display_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
-        operation_fingerprint_digest: import("../../../../../shared-ts/src/authorization").CapabilityOperationFingerprintDigest;
-        kind: "verified_step_up_authorized_operation_v1";
-        authorization_session_id: string;
-        evidence_set_digest: import("../../../../../shared-ts/src/utils").DigestB64u;
-    };
-};
-export declare function buildRouterAbEcdsaAcceptedAuthorizedOperationV1(input: {
-    readonly operation: AuthorizedOperation;
-    readonly binding: RouterAbAcceptedAuthorizedOperationBindingV1;
-}): {
-    binding: {
-        kind: "reusable_wallet_session";
-        authorization_id: import("../../../../../shared-ts/src/authorization/capabilityKinds").WalletSessionAuthorizationId;
-        wallet_session_id: string;
-        quota_id: string;
-        subject_id?: undefined;
-        account_id?: undefined;
-        threshold_session_id?: undefined;
-        org_id?: undefined;
-        project_id?: undefined;
-        environment?: undefined;
-        signing_worker_id?: undefined;
-        expires_at_ms?: undefined;
-        authorization_session_id?: undefined;
-    };
-    authorized_operation: {
-        authorized_operation_id: import("../../../../../shared-ts/src/authorization/capabilityKinds").AuthorizedOperationId;
-        operation_id: import("../../../../../shared-ts/src/authorization/capabilityKinds").CapabilityOperationId;
-        capability_kind: "near_ed25519_mpc_signing" | "evm_ecdsa_mpc_signing";
-        operation_kind: "near.sign_transaction" | "near.sign_delegate_action" | "near.sign_nep413_message" | "evm.sign_transaction";
-        lane_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
-        intent_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
-        display_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
-        operation_fingerprint_digest: import("../../../../../shared-ts/src/authorization").CapabilityOperationFingerprintDigest;
-        kind: "reusable_wallet_session_authorized_operation_v1";
-    };
-} | {
-    binding: {
-        kind: "gateway_owner_wallet_session";
-        subject_id: string;
-        account_id: string;
-        authorization_id: string;
-        wallet_session_id: string;
-        quota_id: string;
-        threshold_session_id: string;
-        org_id: string;
-        project_id: string;
-        environment: string;
-        signing_worker_id: string;
-        expires_at_ms: number;
-        authorization_session_id?: undefined;
-    };
-    authorized_operation: {
-        authorized_operation_id: import("../../../../../shared-ts/src/authorization/capabilityKinds").AuthorizedOperationId;
-        operation_id: import("../../../../../shared-ts/src/authorization/capabilityKinds").CapabilityOperationId;
-        capability_kind: "near_ed25519_mpc_signing" | "evm_ecdsa_mpc_signing";
-        operation_kind: "near.sign_transaction" | "near.sign_delegate_action" | "near.sign_nep413_message" | "evm.sign_transaction";
-        lane_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
-        intent_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
-        display_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
-        operation_fingerprint_digest: import("../../../../../shared-ts/src/authorization").CapabilityOperationFingerprintDigest;
-        kind: "reusable_wallet_session_authorized_operation_v1";
-    };
-} | {
-    binding: {
-        kind: "operation_step_up";
-        authorization_session_id: string;
-        org_id: string;
-        project_id: string;
-        environment: string;
-        subject_id: string;
-        authorization_id?: undefined;
-        wallet_session_id?: undefined;
-        quota_id?: undefined;
-        account_id?: undefined;
-        threshold_session_id?: undefined;
-        signing_worker_id?: undefined;
-        expires_at_ms?: undefined;
-    };
-    authorized_operation: {
-        authorized_operation_id: import("../../../../../shared-ts/src/authorization/capabilityKinds").AuthorizedOperationId;
-        operation_id: import("../../../../../shared-ts/src/authorization/capabilityKinds").CapabilityOperationId;
-        capability_kind: "near_ed25519_mpc_signing" | "evm_ecdsa_mpc_signing";
-        operation_kind: "near.sign_transaction" | "near.sign_delegate_action" | "near.sign_nep413_message" | "evm.sign_transaction";
-        lane_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
-        intent_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
-        display_digest_b64u: import("../../../../../shared-ts/src/utils").DigestB64u;
-        operation_fingerprint_digest: import("../../../../../shared-ts/src/authorization").CapabilityOperationFingerprintDigest;
-        kind: "verified_step_up_authorized_operation_v1";
-        authorization_session_id: string;
-        evidence_set_digest: import("../../../../../shared-ts/src/utils").DigestB64u;
-    };
-};
 export type RouterAbSigningWorkerJsonResult = {
     ok: true;
     body: unknown;
@@ -278,16 +79,18 @@ export type RouterAbNormalSigningAdmissionFailure = {
 export type RouterAbNormalSigningAdmissionResult = {
     ok: true;
 } | RouterAbNormalSigningAdmissionFailure;
-type RouterAbNormalSigningPolicyReadSource = {
+/** Where a policy decision comes from: the store, or rows the credential read already holds. */
+type RouterAbNormalSigningPolicyReadSource<PolicyRead> = {
     readonly kind: 'database';
     readonly policyRead?: never;
 } | {
     readonly kind: 'credential_snapshot';
-    readonly policyRead: D1EcdsaAdmissionPolicyRead;
+    readonly policyRead: PolicyRead;
 };
+export type RouterAbEd25519PolicyReadSource = RouterAbNormalSigningPolicyReadSource<D1Ed25519AdmissionPolicyRead>;
 export type RouterAbNormalSigningAdmissionInput = {
     curve: 'ed25519';
-    readonly policyReadSource?: never;
+    readonly policyReadSource: RouterAbEd25519PolicyReadSource;
     authorityKind: 'wallet_authority_v1';
     authorityId: string;
     authorityScope?: never;
@@ -317,7 +120,7 @@ export type RouterAbNormalSigningAdmissionInput = {
     runtimePolicyScope: RuntimePolicyScope;
 } | {
     curve: 'ecdsa';
-    readonly policyReadSource: RouterAbNormalSigningPolicyReadSource;
+    readonly policyReadSource: RouterAbNormalSigningPolicyReadSource<D1EcdsaAdmissionPolicyRead>;
     phase: 'prepare' | 'finalize';
     walletId: string;
     materialActivationId: MpcMaterialActivationId;
@@ -334,7 +137,7 @@ export interface RouterAbNormalSigningAdmissionAdapter {
 export type RouterAbNormalSigningAdmissionEvaluationInput = {
     adapter: RouterAbNormalSigningAdmissionAdapter | null | undefined;
     curve: 'ed25519';
-    readonly policyReadSource?: never;
+    readonly policyReadSource: RouterAbEd25519PolicyReadSource;
     authorizationKind: 'wallet_session_operation_credential_v1';
     phase: 'prepare' | 'finalize';
     walletId: string;
@@ -349,7 +152,7 @@ export type RouterAbNormalSigningAdmissionEvaluationInput = {
 } | {
     adapter: RouterAbNormalSigningAdmissionAdapter | null | undefined;
     curve: 'ecdsa';
-    readonly policyReadSource: RouterAbNormalSigningPolicyReadSource;
+    readonly policyReadSource: RouterAbNormalSigningPolicyReadSource<D1EcdsaAdmissionPolicyRead>;
     authorizationKind: 'wallet_session_operation_credential_v1';
     phase: 'prepare' | 'finalize';
     walletId: string;

package/dist/types/wallet-server/src/router/domains/signingOperations/signingPrepareSession.d.ts

@@ -0,0 +1,23 @@
+import type { Variant } from '../../../../../shared-ts/src/utils/variant';
+import type { RouterAbEd25519NormalSigningAuthorizationResult } from './routerAbEd25519NormalSigningRoute';
+import type { RouterAbEcdsaNormalSigningAuthorizationResult } from './routerAbEcdsaDerivationNormalSigningRoute';
+/** The session snapshot validated for this admission, before its quota claim. */
+export declare function signingPrepareSessionResponse(signing: unknown, authorization: Variant<RouterAbEcdsaNormalSigningAuthorizationResult | RouterAbEd25519NormalSigningAuthorizationResult, 'ok', true>): {
+    kind: "operation_step_up";
+    signing: unknown;
+    session_status?: undefined;
+} | {
+    kind: "reusable_wallet_session";
+    signing: unknown;
+    session_status: {
+        ok: boolean;
+        status: string;
+        walletSessionId: import("../../../../../shared-ts/src/authorization").WalletSessionId;
+        quotaId: import("../../../../../shared-ts/src/authorization").MpcWalletSigningQuotaId;
+        remainingUses: number;
+        expiresAtMs: number;
+        quotaLifecycle: string;
+        authorization: import("../../../../../shared-ts/src/device-linking").ActiveWalletSessionV1;
+    };
+};
+//# sourceMappingURL=signingPrepareSession.d.ts.map

package/dist/types/wallet-server/src/router/domains/walletRegistration/registrationSessionSeal.d.ts

@@ -0,0 +1,36 @@
+import type { RegistrationEstablishedSessionProjectionV2 } from '../../../../../shared-ts/src/utils/registrationEstablishedSession';
+import type { SigningSessionSealServerSealRequest, SigningSessionSealService } from '../../../threshold/session/signingSessionSeal/signingSessionSeal.types';
+type SealSession = Pick<RegistrationEstablishedSessionProjectionV2, 'walletId' | 'walletSessionId' | 'expiresAtMs' | 'remainingUses' | 'tokens'>;
+type SealFailure = {
+    readonly ok: false;
+    readonly code: string;
+    readonly message: string;
+};
+type SealResult = {
+    readonly ok: true;
+    readonly value: {
+        readonly ciphertext: string;
+        readonly keyVersion: string;
+        readonly expiresAtMs: number;
+        readonly remainingUses: number;
+    };
+} | SealFailure;
+/** Holds one request's computation until registration can publish its response. */
+declare class RegistrationPreparedSessionSeal {
+    private readonly request;
+    private readonly service;
+    private prepared;
+    constructor(request: SigningSessionSealServerSealRequest, service: SigningSessionSealService | null);
+    prepare(session: RegistrationEstablishedSessionProjectionV2): Promise<void>;
+    finish(session: SealSession): Promise<SealResult>;
+}
+export declare function parseRegistrationPreparedSessionSeal(raw: unknown, service: SigningSessionSealService | null): {
+    readonly ok: true;
+    readonly value: RegistrationPreparedSessionSeal | null;
+} | {
+    readonly ok: false;
+    readonly code: 'invalid_body';
+    readonly message: string;
+};
+export {};
+//# sourceMappingURL=registrationSessionSeal.d.ts.map