@seams/wallet-server 0.8.0 → 0.9.1

package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationInputs.d.ts

@@ -1,5 +1,6 @@
 import type { CorrelationId } from '../../../../../shared-ts/src/utils/canonicalPrimitives';
 import type { RegistrationSignerSetSelection } from '../../../../../shared-ts/src/utils/registrationSignerPlan';
+import type { RegistrationEstablishedSessionProjectionV2 } from '../../../../../shared-ts/src/utils/registrationEstablishedSession';
 import type { RegisterWalletInput, RegistrationAuthMethodInput } from '../../../../../shared-ts/src/utils/registrationAuthMethodInput';
 import type { RouterAbEcdsaRegistrationRequestV1, RouterAbEcdsaVerifiedClientActivationFactsV1 } from '../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
 import type { WalletRegistrationAuthorityInput, WalletRegistrationFinalizeSignerWork } from '../../../core/registrationContracts';
@@ -55,9 +56,8 @@ export type WalletRegistrationActivateInput = {
      * request, so the client has nothing to cross-check against and asking it
      * to supply one would be theatre.
      */
-    readonly planKind: 'evm_family_ecdsa' | 'near_ed25519_and_evm_family_ecdsa' | 'near_ed25519';
-    /** Absent exactly when the plan is Ed25519-only. */
-    readonly ecdsa?: {
+    readonly planKind: 'evm_family_ecdsa' | 'near_ed25519_and_evm_family_ecdsa';
+    readonly ecdsa: {
         readonly activationCorrelationId: CorrelationId;
         readonly activationRequestDigestB64u: string;
         readonly clientActivation: RouterAbEcdsaVerifiedClientActivationFactsV1;
@@ -82,12 +82,12 @@ export type WalletRegistrationNearProvisioningInput = {
     }>['ed25519'];
     readonly emailOtpEnrollment?: unknown;
     /**
-     * The custody ceremony's sealed output. An Ed25519-only wallet establishes
-     * its custody *here* rather than at activate: activate returns
-     * `near_pending` with no Yao result yet, so this deferred leg is the first
-     * point at which that wallet has a key set to seal against.
+     * The custody ceremony's sealed output. NEAR-only registration commits its
+     * wallet and custody here after Yao and recovery backup complete.
      */
     readonly walletCustodyCommit?: unknown;
     readonly verifier: WalletRegistrationSetupVerifier;
+    /** Runs after session persistence, beside home publication. It exposes no response. */
+    readonly onSessionCommitted?: (session: RegistrationEstablishedSessionProjectionV2) => Promise<void>;
 };
 //# sourceMappingURL=walletRegistrationInputs.d.ts.map

package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationReservation.d.ts

@@ -1,3 +1,6 @@
+import type { WalletSessionLocatorPublication } from '../../../authorization/sessionRouting';
+import type { CommittedWalletRegistration } from '../../../authorization/domain';
+import type { D1PreparedStatementLike } from '../../../storage/tenantRoute';
 import { type DeviceId } from '../../../../../shared-ts/src/authorization/capabilityKinds';
 import { type WalletAuthorityId, type WalletAuthMethodId, type WalletId } from '../../../../../shared-ts/src/utils/domainIds';
 import type { WalletRegistrationSetupInput } from './walletRegistrationInputs';
@@ -13,6 +16,8 @@ export type WalletRegistrationSetupReservation = {
 export type WalletRegistrationSetupReservationResult = {
     readonly ok: true;
     readonly reservation: WalletRegistrationSetupReservation;
+    /** The ownership generation the reserved wallet's custody objects are named by. */
+    readonly ownershipGeneration: number;
     readonly lifecycle: 'reserved' | 'established';
     readonly code?: never;
     readonly message?: never;
@@ -21,8 +26,14 @@ export type WalletRegistrationSetupReservationResult = {
     readonly code: string;
     readonly message: string;
     readonly reservation?: never;
+    readonly ownershipGeneration?: never;
     readonly lifecycle?: never;
 };
+/** Persist custody addresses before setup completes, then start the reserved wallet objects. */
+export type RegistrationWalletStarter = (registration: {
+    readonly walletId: WalletId;
+    readonly ownershipGeneration: number;
+}) => Promise<void>;
 type ReservationOutcome = {
     readonly ok: true;
 } | {
@@ -30,22 +41,85 @@ type ReservationOutcome = {
     readonly code: string;
     readonly message: string;
 };
+type RegistrationHomeAdmission<Purpose extends 'registration' | 'ordinary' = 'registration' | 'ordinary'> = {
+    readonly ok: true;
+    readonly ownershipGeneration: number;
+    readonly purpose: Purpose;
+    readonly code?: never;
+    readonly message?: never;
+} | {
+    readonly ok: false;
+    readonly code: string;
+    readonly message: string;
+    readonly ownershipGeneration?: never;
+    readonly purpose?: never;
+};
+export interface WalletExecutionAuthority {
+    admitEstablishedHome(input: {
+        readonly walletId: WalletId;
+    }): Promise<RegistrationHomeAdmission<'ordinary'>>;
+}
 export interface WalletRegistrationReservationAuthority {
     reserve(input: WalletRegistrationSetupInput): Promise<WalletRegistrationSetupReservationResult>;
     admitHome(input: {
         readonly ceremonyId: string;
         readonly walletId: WalletId;
-    }): Promise<ReservationOutcome>;
+    }): Promise<RegistrationHomeAdmission>;
     complete(input: {
         readonly ceremonyId: string;
         readonly walletId: WalletId;
-        readonly outcome: 'established' | 'cancelled';
+    } & ({
+        readonly outcome: 'established';
+        readonly session: WalletSessionLocatorPublication & {
+            readonly kind: 'credential';
+        };
+    } | {
+        readonly outcome: 'cancelled';
+        readonly session?: never;
+    })): Promise<ReservationOutcome>;
+}
+/**
+ * The local write that makes an established registration active. It follows
+ * the acknowledged directory write. It commits in the batch of the record
+ * that completes the registration operation, or it does not commit.
+ */
+export type RegistrationActivationWrite = {
+    readonly statements: readonly D1PreparedStatementLike[];
+};
+export type RegistrationEstablishedPublication = {
+    readonly ok: true;
+    /** None when an earlier completion already activated the registration. */
+    readonly activation: RegistrationActivationWrite | null;
+    readonly code?: never;
+    readonly message?: never;
+} | {
+    readonly ok: false;
+    readonly code: string;
+    readonly message: string;
+    readonly activation?: never;
+};
+/** The registration authority at the wallet's home, which owns the local activation. */
+export interface WalletRegistrationHomeAuthority extends Pick<WalletRegistrationReservationAuthority, 'reserve' | 'admitHome'> {
+    /**
+     * Publishes the committed registration decision to its directory and prepares the
+     * activation. The caller commits the activation with its completion record.
+     */
+    publishEstablished(input: {
+        readonly registration: CommittedWalletRegistration;
+        readonly session: WalletSessionLocatorPublication & {
+            readonly kind: 'credential';
+        };
+    }): Promise<RegistrationEstablishedPublication>;
+    /** Fixes a definitive cancellation, publishes it, and retires the local home. */
+    cancel(input: {
+        readonly ceremonyId: string;
+        readonly walletId: WalletId;
     }): Promise<ReservationOutcome>;
 }
 export declare function parseWalletRegistrationSetupReservation(raw: unknown): WalletRegistrationSetupReservation;
-export declare function proposeWalletRegistrationSetup(input: WalletRegistrationSetupInput): WalletRegistrationSetupReservation;
-export declare function walletRegistrationSetupRequestDigest(namespace: string, input: WalletRegistrationSetupInput): Promise<string>;
-export declare function completeRegistrationReservation(authority: WalletRegistrationReservationAuthority | null, input: Parameters<WalletRegistrationReservationAuthority['complete']>[0]): Promise<ReservationOutcome>;
-export declare function admitRegistrationReservationHome(authority: WalletRegistrationReservationAuthority | null, input: Parameters<WalletRegistrationReservationAuthority['admitHome']>[0]): Promise<ReservationOutcome>;
+export declare function proposeWalletRegistrationSetup(input: Pick<WalletRegistrationSetupInput, 'request'>): WalletRegistrationSetupReservation;
+export declare function walletRegistrationSetupRequestDigest(namespace: string, input: Pick<WalletRegistrationSetupInput, 'request' | 'orgId' | 'expectedOrigin' | 'runtimePolicyScope'>): Promise<string>;
+export declare function cancelRegistrationHome(authority: Pick<WalletRegistrationHomeAuthority, 'cancel'> | null, input: Parameters<WalletRegistrationHomeAuthority['cancel']>[0]): Promise<ReservationOutcome>;
+export declare function admitRegistrationReservationHome(authority: Pick<WalletRegistrationReservationAuthority, 'admitHome'> | null, input: Parameters<WalletRegistrationReservationAuthority['admitHome']>[0]): Promise<RegistrationHomeAdmission>;
 export {};
 //# sourceMappingURL=walletRegistrationReservation.d.ts.map

package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationRoutes.d.ts

@@ -1,15 +1,17 @@
+import type { WalletRegistrationContextResolver } from '../../framework/apiCredentialPorts';
 import type { WalletRegistrationNearProvisioningResponseV2, WalletRegistrationNearAdmissionResponseV2, WalletRegistrationActivateRouteResponseV2, WalletRegistrationRespondResponseV2 } from '../../../core/threeRouteRegistrationContracts';
 import type { RouterApiPublishableKeyAuthAdapter } from '../../framework/routerApi';
 import type { RouterApiAuthorizationSessionService, RouterApiWalletRegistrationRouteService } from '../../framework/authServicePort';
 import type { FundImplicitNearAccountResult } from '../../../core/types';
 import type { CreateAddAuthMethodIntentResponse, CreateAddSignerIntentResponse, WalletAddSignerFinalizeResponse, WalletAddSignerEcdsaActivationResponse, WalletAddSignerEcdsaDerivationRespondResponse, WalletAddSignerStartResponse, WalletAddAuthMethodFinalizeResponse, WalletRevokeAuthMethodResponse, WalletAddAuthMethodStartResponse } from '../../../core/registrationContracts';
 import type { NormalizedRouterLogger } from '../../framework/logger';
-import type { RouterApiKeyAuthAdapter, RouterApiProjectEnvironmentResolver, SessionAdapter, RouterApiWalletProjectionAdapter } from '../../framework/routerApi';
+import type { RouterApiKeyAuthAdapter, RouterApiProjectEnvironmentResolver, SessionAdapter } from '../../framework/routerApi';
 import type { HeaderRecord, RouteResponse } from '../../framework/routeExecutionContext';
 import type { RouteDefinition } from '../../framework/routeDefinitions';
 import type { SigningSessionSealRoutesOptions } from '../../../threshold/session/signingSessionSeal/signingSessionSeal.types';
 import type { RouteErrorBody } from '../../framework/routeResponses';
 import type { RouterAbPublicKeysetV2 } from '../../../../../shared-ts/src/utils/routerAbPublicKeyset';
+import type { WalletRegistrationSetupRequest } from './walletRegistrationInputs';
 type RouterApiWalletRegistrationServices = {
     walletRegistration: RouterApiWalletRegistrationRouteService;
     authorizationSessions: RouterApiAuthorizationSessionService;
@@ -18,7 +20,7 @@ type RouterApiWalletRegistrationServices = {
     routerAbPublicKeyset?: RouterAbPublicKeysetV2 | null;
     session?: SessionAdapter | null;
     publishableKeyAuth?: RouterApiPublishableKeyAuthAdapter | null;
-    walletProjection?: RouterApiWalletProjectionAdapter | null;
+    registrationContext?: WalletRegistrationContextResolver | null;
 };
 type RouterApiWalletRegistrationInput = {
     body: unknown;
@@ -31,7 +33,17 @@ type RouterApiWalletRegistrationInput = {
     services: RouterApiWalletRegistrationServices;
     sourceIp?: string;
     signingSessionSeal?: SigningSessionSealRoutesOptions | null;
+    waitUntil?: (promise: Promise<unknown>) => void;
 };
+type ParseResult<T> = {
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    code: 'invalid_body';
+    message: string;
+};
+export declare function parseWalletRegistrationSetupRequest(body: Record<string, unknown>): ParseResult<WalletRegistrationSetupRequest>;
 export declare function handleRouterApiWalletAddSignerIntent(input: RouterApiWalletRegistrationInput): Promise<RouteResponse<CreateAddSignerIntentResponse | RouteErrorBody>>;
 export declare function handleRouterApiWalletRegistrationSetup(input: RouterApiWalletRegistrationInput): Promise<RouteResponse>;
 /**
@@ -49,9 +61,7 @@ export declare function handleRouterApiWalletRegistrationNearAdmission(input: Ro
  */
 export declare function handleRouterApiWalletRegistrationActivate(input: RouterApiWalletRegistrationInput): Promise<RouteResponse<WalletRegistrationActivateRouteResponseV2 | RouteErrorBody>>;
 /**
- * `POST /wallets/register/near-provisioning` — the non-blocking completion
- * the client calls after activate, once its already-running Yao computation
- * produces an activation.
+ * Commits a NEAR-only wallet or completes a mixed wallet's deferred signer.
  */
 export declare function handleRouterApiWalletRegistrationNearProvisioning(input: RouterApiWalletRegistrationInput): Promise<RouteResponse<WalletRegistrationNearProvisioningResponseV2 | RouteErrorBody>>;
 export declare function handleRouterApiWalletAddSignerStart(input: RouterApiWalletRegistrationInput): Promise<RouteResponse<WalletAddSignerStartResponse | RouteErrorBody>>;

package/dist/types/wallet-server/src/router/framework/apiCredentialPorts.d.ts

@@ -1,4 +1,6 @@
 import type { RouterApiKeyAuthFailureCode } from '../../../../shared-ts/src/utils/routerApiKeyAuth';
+import type { WalletRegistrationSetupRequest } from '../domains/walletRegistration/walletRegistrationInputs';
+import type { ReadonlyExclusiveUnion } from '../../../../shared-ts/src/utils/variant';
 export declare const ROUTER_API_CREDENTIAL_SCOPES: readonly ["accounts.create", "wallets.read", "wallets.auth_methods.create", "wallets.signers.create"];
 export type RouterApiCredentialScope = (typeof ROUTER_API_CREDENTIAL_SCOPES)[number];
 export type { RouterApiKeyAuthFailureCode };
@@ -47,6 +49,28 @@ export type RouterApiPublishableKeyAuthResult = {
 export interface RouterApiPublishableKeyAuthAdapter {
     authenticate(input: RouterApiPublishableKeyAuthRequest): Promise<RouterApiPublishableKeyAuthResult>;
 }
+export type WalletRegistrationContextResult = ReadonlyExclusiveUnion<{
+    ok: true;
+    principal: RouterApiKeyPrincipal;
+    environment: RouterApiProjectEnvironment & {
+        readonly status: 'ACTIVE';
+    };
+} | {
+    ok: false;
+    status: 401 | 403;
+    code: RouterApiPublishableKeyAuthFailureCode;
+    message: string;
+} | {
+    ok: false;
+    status: 500;
+    code: 'registration_environment_unavailable';
+    message: string;
+}>;
+export interface WalletRegistrationContextResolver {
+    resolve(input: RouterApiPublishableKeyAuthRequest & {
+        readonly registration: WalletRegistrationSetupRequest;
+    }): Promise<WalletRegistrationContextResult>;
+}
 export type RouterApiUsageMeterAction = 'wallet_created';
 export interface RouterApiUsageMeterEvent {
     orgId: string;

package/dist/types/wallet-server/src/router/framework/authServicePort.d.ts

@@ -1,6 +1,7 @@
 import type { RouteResponse } from './routeExecutionContext';
-import type { D1EcdsaAdmissionPolicyRead } from '../cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore';
+import type { D1EcdsaAdmissionPolicyRead, D1Ed25519AdmissionPolicyRead } from '../cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore';
 import type { EcdsaMaterialRead, EcdsaMaterialActivationReadInput } from '../../core/d1EcdsaSignerRead';
+import type { Ed25519SignerRead } from '../../core/d1Ed25519SignerRead';
 import type { EcdsaMaterialReadSnapshot } from '../../core/ecdsaMaterialReadSnapshot';
 import type { DigestB64u } from '../../../../shared-ts/src/utils/canonicalPrimitives';
 import type { TenantRootIdentityV1 } from '../../../../shared-ts/src/tenant-root/tenantRootIdentity';
@@ -112,6 +113,12 @@ export type RouterApiWalletSessionSigningCandidate = {
     readonly candidate: RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext;
     readonly context?: never;
 };
+/** An active session with the Ed25519 signer and policy rows its statement also read. */
+export type RouterApiEd25519WalletSessionSigningRead = {
+    readonly context: RouterApiWalletSessionAuthorizationV2AdmissionContext;
+    readonly signerRead: Ed25519SignerRead;
+    readonly policyRead: D1Ed25519AdmissionPolicyRead;
+};
 type RouterApiHostedWalletSessionAuthorizationV2AdmissionContext = RouterApiWalletSessionAuthorizationV2AdmissionContext & {
     readonly hostedCredentialId: HostedWalletSessionCredentialId;
     readonly appOrigin: SessionOrigin;
@@ -964,6 +971,8 @@ export interface RouterApiWalletRegistrationService {
     resolveEd25519MaterialActivation(input: {
         readonly walletId: string;
         readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
+        /** Signer rows the caller's session statement already read for this wallet and activation. */
+        readonly signerRead?: Ed25519SignerRead;
     }): Promise<{
         readonly ok: true;
         readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
@@ -1010,6 +1019,7 @@ export interface RouterApiWalletRegistrationService {
         readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
     }): Promise<{
         readonly ok: true;
+        readonly ownershipGeneration: number;
         readonly identityDigestB64u: string;
         readonly custodyLineageB64u: string;
         readonly projectEnvironmentId: string;
@@ -1024,7 +1034,7 @@ export interface RouterApiWalletRegistrationService {
     respondWalletRegistration(input: WalletRegistrationRespondInput, traceContext?: RouterAbTraceContextV1, serverTiming?: Array<readonly [string, number]>): Promise<WalletRegistrationRespondResponseV2>;
     authorizeWalletRegistrationNearAdmission(input: WalletRegistrationNearAdmissionInput): Promise<WalletRegistrationNearAdmissionResponseV2>;
     activateWalletRegistration(input: WalletRegistrationActivateInput, traceContext?: RouterAbTraceContextV1, serverTiming?: Array<readonly [string, number]>): Promise<WalletRegistrationActivateResponseV2>;
-    completeWalletRegistrationNearProvisioning(input: WalletRegistrationNearProvisioningInput, serverTiming?: Array<readonly [string, number]>): Promise<WalletRegistrationNearProvisioningResponseV2>;
+    completeWalletRegistrationNearProvisioning(input: WalletRegistrationNearProvisioningInput, serverTiming?: Array<readonly [string, number]>, waitUntil?: (promise: Promise<unknown>) => void): Promise<WalletRegistrationNearProvisioningResponseV2>;
     refreshEd25519YaoWalletSession(input: RouterAbEd25519YaoBudgetRefreshRequestV1): Promise<RouterAbEd25519YaoBudgetRefreshResponseV1>;
     provisionEd25519YaoWalletSession(input: RouterAbEd25519YaoVerifiedWalletUnlockRequestV1): Promise<RouterAbEd25519YaoVerifiedWalletUnlockResponseV1>;
     recordEcdsaPostRegistrationProof(input: {
@@ -1308,15 +1318,13 @@ export interface RouterApiServiceBag {
 export interface RouterApiAuthorizedOperationService {
     resolveEcdsaWalletSessionOperation(input: import('../../authorization/ecdsaWalletSessionAdmission').EcdsaWalletSessionAdmissionInput): Promise<import('../../authorization/ecdsaWalletSessionAdmission').EcdsaWalletSessionResolutionResult>;
     admitEcdsaWalletSessionOperation(input: import('../../authorization/ecdsaWalletSessionAdmission').EcdsaWalletSessionAdmissionInput): Promise<import('../../authorization/ecdsaWalletSessionAdmission').EcdsaWalletSessionAdmissionResult>;
+    admitEd25519WalletSessionOperation(input: import('../../authorization/ed25519WalletSessionAdmission').Ed25519WalletSessionAdmissionInput): Promise<import('../../authorization/ed25519WalletSessionAdmission').Ed25519WalletSessionAdmissionResult>;
+    resolveEd25519WalletSessionOperation(input: import('../../authorization/ed25519WalletSessionAdmission').Ed25519WalletSessionResolutionInput): Promise<import('../../authorization/ed25519WalletSessionAdmission').Ed25519WalletSessionResolutionResult>;
     readonly tenantId: TenantId;
     readPinnedOwnerWalletScope(input: {
         readonly operation: AuthorizedOperation;
         readonly walletId: WalletId;
-    }): Promise<{
-        readonly orgId: string;
-        readonly projectId: string;
-        readonly projectEnvironmentId: string;
-    }>;
+    }): Promise<import('../../authorization/ecdsaWalletSessionAdmission').PinnedOwnerWalletScope>;
     buildVerifiedOwnerProof(input: VerifiedOwnerProofInput): Promise<VerifiedOwnerProof>;
     recordVerifiedWalletOperationFactorEvidenceSet(input: VerifiedWalletOperationFactorEvidenceSetInput): Promise<VerifiedAuthorizationEvidenceSet>;
     readAuthorizedOperationById(input: {
@@ -1370,6 +1378,12 @@ export interface RouterApiAuthorizationSessionService {
         readonly nowMs: number;
         readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
     }) => Promise<RouterApiWalletSessionSigningCandidate | null>;
+    readonly readEd25519WalletSessionSigningReadByOperationCredential: (input: {
+        readonly tenantId: TenantId;
+        readonly token: string;
+        readonly nowMs: number;
+        readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
+    }) => Promise<RouterApiEd25519WalletSessionSigningRead | null>;
     readonly readWalletSessionExactOperationContextByCredential: (input: {
         readonly tenantId: TenantId;
         readonly token: string;

package/dist/types/wallet-server/src/router/framework/routerApi.d.ts

@@ -9,18 +9,9 @@ import type { RouterAbPublicKeysetV2 } from '../../../../shared-ts/src/utils/rou
 import type { RouterAbNormalSigningAdmissionAdapter } from '../domains/signingOperations/routerAbNormalSigningAdmission';
 import type { RouterAbEd25519YaoProductRegistrationRuntimeV1 } from '../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration';
 import type { RouterAbEcdsaStrictPostRegistrationPort } from '../domains/ecdsa/routerAbEcdsaStrictRegistration';
-import type { RouterApiKeyAuthAdapter, RouterApiProjectEnvironmentResolver, RouterApiPublishableKeyAuthAdapter, RouterApiUsageMeterAdapter } from './apiCredentialPorts';
+import type { RouterApiKeyAuthAdapter, RouterApiProjectEnvironmentResolver, RouterApiPublishableKeyAuthAdapter, RouterApiUsageMeterAdapter, WalletRegistrationContextResolver } from './apiCredentialPorts';
 import type { SessionParseResult } from '../../core/sessionValidation';
 export type { RouterApiCredentialScope, RouterApiKeyAuthAdapter, RouterApiKeyAuthFailureCode, RouterApiKeyAuthRequest, RouterApiKeyAuthResult, RouterApiKeyPrincipal, RouterApiProjectEnvironment, RouterApiProjectEnvironmentResolver, RouterApiPublishableKeyAuthAdapter, RouterApiPublishableKeyAuthFailureCode, RouterApiPublishableKeyAuthRequest, RouterApiPublishableKeyAuthResult, RouterApiUsageMeterAction, RouterApiUsageMeterAdapter, RouterApiUsageMeterEvent, } from './apiCredentialPorts';
-export interface RouterApiWalletProjectionEvent {
-    readonly orgId: string;
-    readonly runtimePolicyScope: RuntimePolicyScope;
-    readonly walletId: string;
-    readonly occurredAt: string;
-}
-export interface RouterApiWalletProjectionAdapter {
-    recordCreatedWallet(input: RouterApiWalletProjectionEvent): Promise<void>;
-}
 export type SessionClaims = Record<string, unknown>;
 export declare const DEFAULT_SESSION_COOKIE_NAME = "seams-jwt";
 /**
@@ -164,6 +155,8 @@ export interface RouterApiOptions {
      * API credential routes like signed delegate execution.
      */
     publishableKeyAuth?: RouterApiPublishableKeyAuthAdapter | null;
+    /** Fresh credential and active-environment resolution for registration setup. */
+    registrationContext?: WalletRegistrationContextResolver | null;
     /**
      * Optional Router API usage-meter adapter used to emit host runtime events.
      */
@@ -214,8 +207,6 @@ export interface RouterApiOptions {
      * Optional org/project/environment service used to resolve environment -> project scope.
      */
     orgProjectEnv?: RouterApiProjectEnvironmentResolver | null;
-    /** Projects successfully created wallets into the customer Console index. */
-    walletProjection?: RouterApiWalletProjectionAdapter | null;
     logger?: RouterLogger | null;
 }
 //# sourceMappingURL=routerApi.d.ts.map

package/dist/types/wallet-server/src/router/transport/fetch/routes/ed25519AuthorizedOperationRevalidation.d.ts

@@ -0,0 +1,37 @@
+import type { AuthorizedOperationId, TenantId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
+import type { CapabilityOperationFingerprintDigest } from '../../../../../../shared-ts/src/authorization/operationFingerprint';
+import type { WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
+import type { AuthorizedOperation } from '../../../../authorization/domain';
+import type { PinnedOwnerWalletScope } from '../../../../authorization/ecdsaWalletSessionAdmission';
+import type { FetchRouterApiContext } from '../createFetchRouter';
+type Revalidated<Result> = Result | {
+    readonly ok: false;
+    readonly response: Response;
+};
+export declare function revalidateEd25519StepUpOperation(input: {
+    readonly ctx: FetchRouterApiContext;
+    readonly operation: AuthorizedOperation;
+}): Promise<Revalidated<{
+    readonly ok: true;
+    readonly operation: AuthorizedOperation;
+}>>;
+/**
+ * Finds the operation a reusable Wallet Session prepared and checks that its
+ * grant is still active. A live operation returns the owner scope its
+ * admission row pinned. A completed operation returns none: it replays its
+ * stored response. The operation is read by its fingerprint, so a receipt
+ * that names another operation ID has no stored operation.
+ */
+export declare function resolveEd25519WalletSessionOperation(input: {
+    readonly ctx: FetchRouterApiContext;
+    readonly tenantId: TenantId;
+    readonly authorizedOperationId: AuthorizedOperationId;
+    readonly operationFingerprintDigest: CapabilityOperationFingerprintDigest;
+    readonly walletId: WalletId;
+}): Promise<Revalidated<{
+    readonly ok: true;
+    readonly operation: AuthorizedOperation;
+    readonly ownerScope: PinnedOwnerWalletScope | null;
+}>>;
+export {};
+//# sourceMappingURL=ed25519AuthorizedOperationRevalidation.d.ts.map

package/dist/types/wallet-server/src/router/transport/fetch/routes/thresholdEcdsa.d.ts

@@ -1,27 +1,11 @@
 import type { FetchRouterApiContext } from '../createFetchRouter';
 import { type RouterAbEcdsaPoolFillInitRouteRequest, type RouterAbEcdsaPoolFillStepRouteRequest } from '../../../domains/ecdsa/thresholdEcdsaRequestValidation';
 import type { RouterAbEcdsaDerivationPoolFillBinding } from '../../../../core/ThresholdService/routerAb/ecdsaDerivationPoolFillHandlers';
-import type { RouterApiAuthorizedOperationService } from '../../../framework/authServicePort';
 import type { WalletSessionOperationCredentialV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
-import { type AuthorizedOperation, type VerifiedOwnerProof } from '../../../../authorization/domain';
+import { type VerifiedOwnerProof } from '../../../../authorization/domain';
 type VerifiedOwnerWalletSessionProof = Extract<VerifiedOwnerProof, {
     readonly purpose: 'wallet_session';
 }>;
-type EcdsaSigningGatewayTiming = {
-    authorize: number | null;
-    admit: number | null;
-    proxy: number | null;
-    complete: number | null;
-    total: number | null;
-};
-export declare function finishRouterAbEcdsaSigningResponse(input: {
-    readonly phase: 'prepare' | 'finalize';
-    readonly upstream: Response;
-    readonly operation: AuthorizedOperation;
-    readonly authorizedOperations: RouterApiAuthorizedOperationService;
-    readonly timing: Pick<EcdsaSigningGatewayTiming, 'proxy' | 'complete'>;
-    readonly proxyStartedAt: number;
-}): Promise<Response>;
 type RouterAbEcdsaPoolFillAuthorizationResult = {
     readonly ok: true;
     readonly binding: RouterAbEcdsaDerivationPoolFillBinding;

package/dist/types/wallet-server/src/storage/tenantRoute.d.ts

@@ -2,7 +2,7 @@ import type { OrgId } from '../../../shared-ts/src/utils/domainIds';
 export type { OrgId } from '../../../shared-ts/src/utils/domainIds';
 export type TenantStorageBackendFamily = 'cloudflare_d1_do' | 'postgres';
 export type CloudflareTenantTopology = 'shared' | 'dedicated_tenant';
-export type TenantDataJurisdiction = 'automatic' | 'wnam' | 'enam' | 'weur' | 'eeur' | 'apac';
+export type TenantDataJurisdiction = 'automatic' | 'wnam' | 'enam' | 'weur' | 'eeur' | 'apac' | 'oc';
 export type PostgresMigrationReason = 'd1_size_limit' | 'd1_throughput_limit' | 'logical_database_required';
 export type NamespaceId = string;
 export type RouteVersion = number;

package/migrations/d1-signer/0049_wallet_relocation_challenges.sql

@@ -0,0 +1,16 @@
+CREATE TABLE wallet_relocation_challenges (
+  namespace TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  project_id TEXT NOT NULL,
+  env_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL,
+  move_id TEXT NOT NULL,
+  binding_json TEXT NOT NULL CHECK (json_valid(binding_json)),
+  challenge_b64u TEXT NOT NULL,
+  created_at_ms INTEGER NOT NULL CHECK (created_at_ms > 0),
+  expires_at_ms INTEGER NOT NULL,
+  consumed_at_ms INTEGER,
+  PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_id, move_id),
+  CHECK (expires_at_ms > created_at_ms AND expires_at_ms - created_at_ms <= 300000),
+  CHECK (consumed_at_ms IS NULL OR (consumed_at_ms >= created_at_ms AND consumed_at_ms < expires_at_ms))
+);

package/migrations/d1-signer/0050_wallet_relocation_approvals.sql

@@ -0,0 +1,14 @@
+CREATE TABLE wallet_relocation_approvals (
+  namespace TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  project_id TEXT NOT NULL,
+  env_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL,
+  move_id TEXT NOT NULL,
+  binding_json TEXT NOT NULL CHECK (json_valid(binding_json)),
+  authority_digest_b64u TEXT NOT NULL,
+  authority_revocation_epoch INTEGER NOT NULL CHECK (authority_revocation_epoch >= 0),
+  approved_at_ms INTEGER NOT NULL CHECK (approved_at_ms > 0),
+  expires_at_ms INTEGER NOT NULL CHECK (expires_at_ms > approved_at_ms),
+  PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_id, move_id)
+);

package/migrations/d1-signer/0051_wallet_relocation_email_otp.sql

@@ -0,0 +1,92 @@
+-- Add the relocation-bound Email OTP challenge purpose.
+
+PRAGMA defer_foreign_keys = ON;
+
+DROP INDEX email_otp_challenges_context_idx;
+DROP INDEX email_otp_challenges_expires_idx;
+
+ALTER TABLE email_otp_challenges RENAME TO email_otp_challenges_previous;
+
+CREATE TABLE email_otp_challenges (
+  namespace TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  project_id TEXT NOT NULL,
+  env_id TEXT NOT NULL,
+  challenge_id TEXT NOT NULL,
+  challenge_subject_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL,
+  record_org_id TEXT NOT NULL,
+  otp_channel TEXT NOT NULL,
+  owner_proof_binding_digest TEXT NOT NULL,
+  action TEXT NOT NULL,
+  operation TEXT NOT NULL,
+  otp_code TEXT NOT NULL,
+  record_json TEXT NOT NULL,
+  created_at_ms INTEGER NOT NULL,
+  expires_at_ms INTEGER NOT NULL,
+  PRIMARY KEY (namespace, org_id, project_id, env_id, challenge_id),
+  CHECK (length(namespace) > 0),
+  CHECK (length(org_id) > 0),
+  CHECK (length(project_id) > 0),
+  CHECK (length(env_id) > 0),
+  CHECK (length(challenge_id) > 0),
+  CHECK (length(challenge_subject_id) > 0),
+  CHECK (length(wallet_id) > 0),
+  CHECK (length(record_org_id) > 0),
+  CHECK (otp_channel = 'email_otp'),
+  CHECK (length(owner_proof_binding_digest) > 0),
+  CHECK (
+    action IN (
+      'wallet_email_otp_login',
+      'wallet_email_otp_registration',
+      'wallet_email_otp_device_recovery',
+      'wallet_email_otp_device_link',
+      'wallet_email_otp_recovery_bootstrap',
+      'wallet_email_otp_relocation'
+    )
+  ),
+  CHECK (operation IN ('wallet_unlock', 'transaction_sign', 'export_key', 'registration', 'device_link', 'wallet_relocation')),
+  CHECK ((action = 'wallet_email_otp_relocation') = (operation = 'wallet_relocation')),
+  CHECK (length(otp_code) > 0),
+  CHECK (json_valid(record_json)),
+  CHECK (created_at_ms > 0),
+  CHECK (expires_at_ms > created_at_ms),
+  CHECK (COALESCE(json_extract(record_json, '$.version') = 'email_otp_challenge_v1', 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.challengeId') = challenge_id, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.challengeSubjectId') = challenge_subject_id, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.walletId') = wallet_id, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.orgId') = record_org_id, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.otpChannel') = otp_channel, 0)),
+  CHECK (
+    COALESCE(json_extract(record_json, '$.ownerProofBindingDigest') = owner_proof_binding_digest, 0)
+  ),
+  CHECK (COALESCE(json_extract(record_json, '$.action') = action, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.operation') = operation, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.otpCode') = otp_code, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.createdAtMs') = created_at_ms, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.expiresAtMs') = expires_at_ms, 0))
+);
+
+INSERT INTO email_otp_challenges (
+  namespace, org_id, project_id, env_id, challenge_id, challenge_subject_id,
+  wallet_id, record_org_id, otp_channel, owner_proof_binding_digest, action,
+  operation, otp_code, record_json, created_at_ms, expires_at_ms
+)
+SELECT namespace, org_id, project_id, env_id, challenge_id, challenge_subject_id,
+       wallet_id, record_org_id, otp_channel, owner_proof_binding_digest, action,
+       operation, otp_code, record_json, created_at_ms, expires_at_ms
+  FROM email_otp_challenges_previous;
+
+DROP TABLE email_otp_challenges_previous;
+
+CREATE INDEX email_otp_challenges_context_idx
+  ON email_otp_challenges (
+    namespace, org_id, project_id, env_id, challenge_subject_id, wallet_id,
+    record_org_id, otp_channel, owner_proof_binding_digest, action, operation,
+    expires_at_ms, created_at_ms
+  );
+
+CREATE INDEX email_otp_challenges_expires_idx
+  ON email_otp_challenges (namespace, org_id, project_id, env_id, expires_at_ms);
+
+PRAGMA defer_foreign_keys = OFF;