@seams/wallet-server 0.5.0

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionStore.d.ts

@@ -0,0 +1,149 @@
+import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import type { LinkedDeviceApprovalV1, LinkedDeviceSessionClaimV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
+import { type LinkedDeviceSessionListCursorV1, type LinkedDeviceSessionListPageV1, type LinkedDeviceSessionMutationResultV1, type LinkedDeviceSessionRecordV1, type LinkedDeviceSessionStoreV1 } from '../../../../core/deviceLinking/linkedDeviceSession';
+import { type LinkDeviceSessionId } from '../../../../../../shared-ts/src/signing-lanes/ids';
+import type { DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
+import type { WalletAuthorityId, WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
+export type D1LinkedDeviceSessionScopeV1 = {
+    readonly namespace: string;
+    readonly orgId: string;
+    readonly projectId: string;
+    readonly envId: string;
+};
+export type D1LinkedDeviceSessionStoreOptionsV1 = {
+    readonly database: D1DatabaseLike;
+    readonly scope: D1LinkedDeviceSessionScopeV1;
+    readonly now?: () => number;
+};
+export declare class D1LinkedDeviceSessionStoreV1 implements LinkedDeviceSessionStoreV1 {
+    private readonly database;
+    private readonly scope;
+    private readonly now;
+    constructor(options: D1LinkedDeviceSessionStoreOptionsV1);
+    createUnclaimedSessionV1(record: LinkedDeviceSessionRecordV1): Promise<LinkedDeviceSessionMutationResultV1>;
+    getSessionV1(linkSessionId: LinkDeviceSessionId): Promise<LinkedDeviceSessionRecordV1 | null>;
+    private deleteRetiredShapeSessionRowV1;
+    listSessionsForWalletV1(input: {
+        readonly walletId: WalletId;
+        readonly limit: number;
+        readonly cursor: LinkedDeviceSessionListCursorV1 | null;
+    }): Promise<LinkedDeviceSessionListPageV1>;
+    claimSessionV1(input: {
+        readonly linkSessionId: LinkDeviceSessionId;
+        readonly expectedRevision: number;
+        readonly claim: LinkedDeviceSessionClaimV1;
+        readonly claimDigestB64u: DigestB64u;
+        readonly nextRecord: LinkedDeviceSessionRecordV1;
+        readonly nowMs: number;
+    }): Promise<LinkedDeviceSessionMutationResultV1>;
+    recordOwnerApprovalV1(input: {
+        readonly linkSessionId: LinkDeviceSessionId;
+        readonly expectedRevision: number;
+        readonly approval: LinkedDeviceApprovalV1;
+        readonly approvalDigestB64u: DigestB64u;
+        readonly nextRecord: LinkedDeviceSessionRecordV1;
+        readonly nowMs: number;
+    }): Promise<LinkedDeviceSessionMutationResultV1>;
+    recordTargetCredentialV1(input: {
+        readonly linkSessionId: LinkDeviceSessionId;
+        readonly expectedRevision: number;
+        readonly nextRecord: LinkedDeviceSessionRecordV1;
+        readonly nowMs: number;
+    }): Promise<LinkedDeviceSessionMutationResultV1>;
+    recordSourceContributionV1(input: {
+        readonly linkSessionId: LinkDeviceSessionId;
+        readonly expectedRevision: number;
+        readonly approval: LinkedDeviceApprovalV1;
+        readonly approvalDigestB64u: DigestB64u;
+        readonly nextRecord: LinkedDeviceSessionRecordV1;
+        readonly nowMs: number;
+    }): Promise<LinkedDeviceSessionMutationResultV1>;
+    recordEmailOtpChallengeStateV1(input: {
+        readonly linkSessionId: LinkDeviceSessionId;
+        readonly expectedRevision: number;
+        readonly nextRecord: LinkedDeviceSessionRecordV1;
+        readonly nowMs: number;
+    }): Promise<LinkedDeviceSessionMutationResultV1>;
+    buildTargetCredentialCasStatementsV1(input: {
+        readonly linkSessionId: LinkDeviceSessionId;
+        readonly expectedRevision: number;
+        readonly nextRecord: LinkedDeviceSessionRecordV1;
+        readonly nowMs: number;
+    }): readonly D1PreparedStatementLike[];
+    /**
+     * Builds the session half of the pending-authority transaction. The caller
+     * supplies the already validated next record; the CAS guard keeps the
+     * authority and session writes in one D1 batch.
+     */
+    buildAuthorityPendingLocalInstallCasStatementsV1(input: {
+        readonly linkSessionId: LinkDeviceSessionId;
+        readonly expectedRevision: number;
+        readonly nextRecord: LinkedDeviceSessionRecordV1;
+        readonly nowMs: number;
+    }): readonly D1PreparedStatementLike[];
+    /** Builds the session half of the pending-to-active authority transaction. */
+    buildAuthorityActivationCasStatementsV1(input: {
+        readonly linkSessionId: LinkDeviceSessionId;
+        readonly expectedRevision: number;
+        readonly nextRecord: LinkedDeviceSessionRecordV1;
+        readonly nowMs: number;
+    }): readonly D1PreparedStatementLike[];
+    markAuthorityPendingLocalInstallV1(input: {
+        readonly linkSessionId: LinkDeviceSessionId;
+        readonly expectedRevision: number;
+        readonly authorityId: WalletAuthorityId;
+        readonly packageSetDigestB64u: DigestB64u;
+        readonly nextRecord: LinkedDeviceSessionRecordV1;
+        readonly nowMs: number;
+    }): Promise<LinkedDeviceSessionMutationResultV1>;
+    activateSessionV1(input: {
+        readonly linkSessionId: LinkDeviceSessionId;
+        readonly expectedRevision: number;
+        readonly authorityId: WalletAuthorityId;
+        readonly packageSetDigestB64u: DigestB64u;
+        readonly activatedAtMs: number;
+        readonly nextRecord: LinkedDeviceSessionRecordV1;
+        readonly nowMs: number;
+    }): Promise<LinkedDeviceSessionMutationResultV1>;
+    failBeforeCommitV1(input: {
+        readonly linkSessionId: LinkDeviceSessionId;
+        readonly expectedRevision: number;
+        readonly nextRecord: LinkedDeviceSessionRecordV1;
+        readonly nowMs: number;
+    }): Promise<LinkedDeviceSessionMutationResultV1>;
+    cancelSessionV1(input: {
+        readonly linkSessionId: LinkDeviceSessionId;
+        readonly expectedRevision: number;
+        readonly nextRecord: LinkedDeviceSessionRecordV1;
+        readonly nowMs: number;
+    }): Promise<LinkedDeviceSessionMutationResultV1>;
+    expireSessionV1(input: {
+        readonly linkSessionId: LinkDeviceSessionId;
+        readonly expectedRevision: number;
+        readonly nextRecord: LinkedDeviceSessionRecordV1;
+        readonly nowMs: number;
+    }): Promise<LinkedDeviceSessionMutationResultV1>;
+    deleteActiveSessionV1(input: {
+        readonly linkSessionId: LinkDeviceSessionId;
+        readonly expectedRevision: number;
+        readonly authorityId: WalletAuthorityId;
+        readonly packageSetDigestB64u: DigestB64u;
+        readonly nowMs: number;
+    }): Promise<LinkedDeviceSessionMutationResultV1>;
+    deleteActiveSessionWithStatementsV1(input: {
+        readonly linkSessionId: LinkDeviceSessionId;
+        readonly expectedRevision: number;
+        readonly authorityId: WalletAuthorityId;
+        readonly packageSetDigestB64u: DigestB64u;
+        readonly nowMs: number;
+        readonly beforeDeleteStatements: readonly D1PreparedStatementLike[];
+        readonly afterDeleteStatements: readonly D1PreparedStatementLike[];
+    }): Promise<LinkedDeviceSessionMutationResultV1>;
+    private applyTranscriptCas;
+    private applyStateCas;
+    private applyTerminalStateCas;
+    private updateStatement;
+    private verifyImmutableTranscripts;
+    private verifyImmutableTranscriptsForRows;
+}
+//# sourceMappingURL=d1LinkedDeviceSessionStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSourceContributionPreparationPlanner.d.ts

@@ -0,0 +1,38 @@
+import type { LinkedDeviceApprovalV1, LinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1, LinkedDeviceTargetCredentialRegistrationV1, LinkedDeviceTargetPreparationV1, VerifiedTargetFactorV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
+import type { LinkedDeviceSessionRecordV1 } from '../../../../core/deviceLinking/linkedDeviceSession';
+import type { LinkedDeviceOwnerSourceChildResolverV1 } from './d1LinkedDeviceTargetPlanner';
+import type { LinkedDeviceSourceContributionPreparationPlannerV1, VerifiedLinkedDeviceTargetFactorEvidenceV1 } from './d1LinkedDeviceTargetCredentialProvider';
+import type { VerifiedLinkSourceReadV1 } from './d1LinkedDeviceVerifiedLinkBuilder';
+export type D1LinkedDeviceSourceContributionPreparationPlannerOptionsV1 = {
+    readonly resolveOwnerSourceChildV1: LinkedDeviceOwnerSourceChildResolverV1['resolveOwnerSourceChildV1'];
+    /** Deriver X25519 input recipients copied from the admitted Router keyset. */
+    readonly deriverAInputPublicKeyB64u: string;
+    readonly deriverBInputPublicKeyB64u: string;
+    /** The current SigningWorker X25519 recipient, encoded as canonical 32-byte base64url. */
+    readonly signingWorkerRecipientPublicKeyB64u: string;
+};
+/**
+ * Plans the exact public inputs consumed by Device 1 and the SigningWorker.
+ * Activation identities are fresh, while every other activation field is
+ * copied from the verified owner lane.
+ */
+export declare class D1LinkedDeviceSourceContributionPreparationPlannerV1 implements LinkedDeviceSourceContributionPreparationPlannerV1 {
+    private readonly resolveOwnerSourceChildV1;
+    private readonly deriverAInputPublicKeyB64u;
+    private readonly deriverBInputPublicKeyB64u;
+    private readonly signingWorkerRecipientPublicKeyB64u;
+    constructor(input: D1LinkedDeviceSourceContributionPreparationPlannerOptionsV1);
+    planSourceContributionPreparationV1(input: {
+        readonly session: LinkedDeviceSessionRecordV1;
+        readonly approval: LinkedDeviceApprovalV1;
+        readonly preparation: LinkedDeviceTargetPreparationV1;
+        readonly registration: LinkedDeviceTargetCredentialRegistrationV1;
+        readonly evidence: VerifiedLinkedDeviceTargetFactorEvidenceV1;
+        readonly targetFactor: VerifiedTargetFactorV1;
+        readonly source: VerifiedLinkSourceReadV1;
+        readonly requestedAtMs: number;
+    }): Promise<LinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1>;
+}
+export declare function createD1LinkedDeviceSourceContributionPreparationPlannerV1(input: D1LinkedDeviceSourceContributionPreparationPlannerOptionsV1): LinkedDeviceSourceContributionPreparationPlannerV1;
+export declare function linkedDeviceX25519RecipientPublicKeyB64uV1(value: string): string;
+//# sourceMappingURL=d1LinkedDeviceSourceContributionPreparationPlanner.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetAuthenticatorStore.d.ts

@@ -0,0 +1,19 @@
+import type { WebAuthnAuthenticatorRecord, WebAuthnAuthenticatorStore } from '../../../../core/WebAuthnAuthenticatorStore';
+import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
+import type { D1LinkedDeviceSessionScopeV1 } from './d1LinkedDeviceSessionStore';
+export declare class D1LinkedDeviceTargetAuthenticatorStoreV1 implements WebAuthnAuthenticatorStore {
+    private readonly database;
+    private readonly scope;
+    private readonly target;
+    constructor(input: {
+        readonly database: D1DatabaseLike;
+        readonly scope: D1LinkedDeviceSessionScopeV1;
+        readonly enrollmentId: string;
+        readonly deviceId: string;
+    });
+    get(userId: string, credentialIdB64u: string): Promise<WebAuthnAuthenticatorRecord | null>;
+    put(userId: string, record: WebAuthnAuthenticatorRecord): Promise<void>;
+    del(): Promise<void>;
+    private readRegisteredRow;
+}
+//# sourceMappingURL=d1LinkedDeviceTargetAuthenticatorStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetCredentialProvider.d.ts

@@ -0,0 +1,220 @@
+import type { LinkedDeviceApprovalV1, LinkedDevicePasskeyTargetConfigurationFieldsV1, LinkedDeviceTargetCredentialRegistrationV1, LinkedDeviceTargetCredentialRegistrationResultV1, LinkedDeviceTargetPreparationV1, LinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1, VerifiedTargetFactorV1, VerifiedLinkInputV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
+import { type DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
+import { type WalletAuthMethodId, type WebAuthnCredentialIdB64u } from '../../../../../../shared-ts/src/utils/domainIds';
+import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import type { LinkedDeviceSessionRecordV1 } from '../../../../core/deviceLinking/linkedDeviceSession';
+import type { DeviceLinkingTargetCredentialProviderV1, LinkedDeviceTargetPreparationResultV1 } from '../../../../router/transport/fetch/routes/deviceLinking';
+import type { D1LinkedDeviceSessionScopeV1 } from './d1LinkedDeviceSessionStore';
+import { type VerifiedLinkSourceReadV1, type VerifiedLinkSourceReaderV1 } from './d1LinkedDeviceVerifiedLinkBuilder';
+export type VerifiedLinkedDeviceWebAuthnCredentialV1 = {
+    readonly credentialIdB64u: string;
+    readonly credentialPublicKeyB64u: string;
+    readonly counter: number;
+};
+/** The consumed-grant projection an email OTP completion is committed under. */
+type VerifiedLinkedDeviceEmailOtpGrantBaseV1 = {
+    readonly grantId: string;
+    readonly targetEmail: import('../../../../../../shared-ts/src/utils/domainIds').VerifiedEmailAddress;
+    readonly enrollment: import('../../../../../../shared-ts/src/device-linking/contracts').LinkedDeviceEmailOtpEnrollmentSelectionV1;
+    readonly providerUserId: string;
+    readonly authorityDigestB64u: DigestB64u;
+    readonly descriptorCredentialIdB64u: WebAuthnCredentialIdB64u;
+};
+export type VerifiedLinkedDeviceEmailOtpGrantV1 = (VerifiedLinkedDeviceEmailOtpGrantBaseV1 & {
+    readonly enrollment: {
+        readonly kind: 'existing_enrollment';
+    };
+    readonly baseWalletAuthMethodId: WalletAuthMethodId;
+}) | (VerifiedLinkedDeviceEmailOtpGrantBaseV1 & {
+    readonly enrollment: {
+        readonly kind: 'new_enrollment';
+    };
+    readonly baseWalletAuthMethodId?: never;
+});
+/**
+ * The exact evidence a target registration was verified against, one branch
+ * per target factor. A Passkey commit cannot carry a grant and an Email OTP
+ * commit cannot carry WebAuthn material.
+ */
+export type VerifiedLinkedDeviceTargetFactorEvidenceV1 = {
+    readonly kind: 'passkey_prf';
+    readonly credential: VerifiedLinkedDeviceWebAuthnCredentialV1;
+    readonly grant?: never;
+} | {
+    readonly kind: 'email_otp';
+    readonly grant: VerifiedLinkedDeviceEmailOtpGrantV1;
+    readonly credential?: never;
+};
+/**
+ * The complete registered-target replay record. It is kept as one payload so
+ * a retry can finish the session CAS without rereading mutable source state.
+ */
+export type LinkedDeviceRegisteredTargetCredentialRecordV2 = {
+    readonly kind: 'linked_device_registered_target_credential_v2';
+    readonly registration: LinkedDeviceTargetCredentialRegistrationV1;
+    readonly verifiedTargetFactor: VerifiedTargetFactorV1;
+    readonly sourceContributionPreparation: LinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1;
+    readonly sourceContributionPreparationDigestB64u: DigestB64u;
+    readonly recipientRequestsDigestB64u: DigestB64u;
+};
+export type LinkedDeviceTargetCredentialVerificationPortV1 = {
+    verifyRegistrationV1(input: {
+        readonly preparation: LinkedDeviceTargetPreparationV1;
+        readonly registration: LinkedDeviceTargetCredentialRegistrationV1;
+        readonly expectedOrigin: string;
+    }): Promise<{
+        readonly kind: 'verified';
+        readonly credential: VerifiedLinkedDeviceWebAuthnCredentialV1;
+    } | {
+        readonly kind: 'rejected';
+        readonly message: string;
+    }>;
+};
+/** Verifies the browser-signed ceremony origin against the configured RP ID. */
+export declare class LinkedDeviceWebAuthnRegistrationVerifierV1 implements LinkedDeviceTargetCredentialVerificationPortV1 {
+    private readonly expectedRpId;
+    constructor(expectedRpId: LinkedDevicePasskeyTargetConfigurationFieldsV1['rpId']);
+    verifyRegistrationV1(input: {
+        readonly preparation: LinkedDeviceTargetPreparationV1;
+        readonly registration: LinkedDeviceTargetCredentialRegistrationV1;
+        readonly expectedOrigin: string;
+    }): Promise<{
+        readonly kind: 'verified';
+        readonly credential: VerifiedLinkedDeviceWebAuthnCredentialV1;
+    } | {
+        readonly kind: 'rejected';
+        readonly message: string;
+    }>;
+}
+/**
+ * Registration-time port for the Email OTP branch: validates the one-time
+ * verification grant a registration carries and, after the authority install
+ * commit, supplies the statements that consume the grant and persist the
+ * derived linked-owner binding atomically with the credential row.
+ */
+export type LinkedDeviceEmailOtpGrantRegistrationPortV1 = {
+    verifyRegistrationGrantV1(input: {
+        readonly preparation: LinkedDeviceTargetPreparationV1;
+        readonly registration: LinkedDeviceTargetCredentialRegistrationV1;
+        readonly requestedAtMs: number;
+    }): Promise<{
+        readonly kind: 'verified';
+        readonly grant: VerifiedLinkedDeviceEmailOtpGrantV1;
+    } | {
+        readonly kind: 'rejected';
+        readonly message: string;
+    }>;
+    buildCompletionStatementsV1(input: {
+        readonly grant: VerifiedLinkedDeviceEmailOtpGrantV1;
+        readonly registration: LinkedDeviceTargetCredentialRegistrationV1;
+        readonly keyManifestDigestB64u: DigestB64u;
+        readonly consumedAtMs: number;
+    }): Promise<readonly D1PreparedStatementLike[]>;
+};
+export type LinkedDeviceTargetPlannerV1 = {
+    createTargetPreparationV1(input: {
+        readonly session: LinkedDeviceSessionRecordV1;
+        readonly approval: LinkedDeviceApprovalV1;
+        readonly expectedOrigin: string;
+        readonly deliveryRecipientPublicKey65B64u: string;
+        readonly requestedAtMs: number;
+    }): Promise<LinkedDeviceTargetPreparationV1>;
+};
+/**
+ * Allocates the target-side material identities after the target factor has
+ * been verified. The returned tuple is the only source-preparation input that
+ * Device 1 and the authority installer may consume.
+ */
+export type LinkedDeviceSourceContributionPreparationPlannerV1 = {
+    planSourceContributionPreparationV1(input: {
+        readonly session: LinkedDeviceSessionRecordV1;
+        readonly approval: LinkedDeviceApprovalV1;
+        readonly preparation: LinkedDeviceTargetPreparationV1;
+        readonly registration: LinkedDeviceTargetCredentialRegistrationV1;
+        readonly evidence: VerifiedLinkedDeviceTargetFactorEvidenceV1;
+        readonly targetFactor: VerifiedTargetFactorV1;
+        readonly source: VerifiedLinkSourceReadV1;
+        readonly requestedAtMs: number;
+    }): Promise<LinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1>;
+};
+export type LinkedDeviceVerifiedLinkBuilderV1 = {
+    readonly source: VerifiedLinkSourceReaderV1;
+};
+type TargetCredentialRegistrationSuccessV1 = {
+    readonly outcome: 'applied' | 'replayed';
+    readonly keyManifestDigestB64u: DigestB64u;
+    readonly targetCredential: LinkedDeviceTargetCredentialRegistrationResultV1;
+};
+export declare class LinkedDeviceRetiredTargetRegistrationShapeErrorV1 extends Error {
+    readonly kind: "retired_target_registration_shape";
+    constructor();
+}
+export declare class D1LinkedDeviceTargetCredentialProviderV1 implements DeviceLinkingTargetCredentialProviderV1 {
+    private readonly database;
+    private readonly scope;
+    private readonly verifier;
+    private readonly emailOtpGrants;
+    private readonly planner;
+    private readonly sourceContributionPreparationPlanner;
+    private readonly verifiedLinkBuilder;
+    private readonly inFlightCommits;
+    constructor(input: {
+        readonly database: D1DatabaseLike;
+        readonly scope: D1LinkedDeviceSessionScopeV1;
+        readonly verifier: LinkedDeviceTargetCredentialVerificationPortV1;
+        readonly emailOtpGrants?: LinkedDeviceEmailOtpGrantRegistrationPortV1;
+        readonly planner: LinkedDeviceTargetPlannerV1;
+        readonly sourceContributionPreparationPlanner: LinkedDeviceSourceContributionPreparationPlannerV1;
+        readonly verifiedLinkBuilder: LinkedDeviceVerifiedLinkBuilderV1;
+    });
+    getTargetPreparationV1(input: {
+        readonly session: LinkedDeviceSessionRecordV1;
+        readonly approval: LinkedDeviceApprovalV1;
+        readonly requestedAtMs: number;
+    } & ({
+        readonly access: 'create_or_replay';
+        readonly expectedOrigin: string;
+        readonly deliveryRecipientPublicKey65B64u: string;
+    } | {
+        readonly access: 'replay_only';
+        readonly expectedOrigin?: never;
+        readonly deliveryRecipientPublicKey65B64u?: never;
+    })): Promise<LinkedDeviceTargetPreparationResultV1>;
+    registerTargetCredentialV1(input: {
+        readonly registration: LinkedDeviceTargetCredentialRegistrationV1;
+        readonly preparation: LinkedDeviceTargetPreparationV1;
+        readonly session: LinkedDeviceSessionRecordV1;
+        readonly approval: LinkedDeviceApprovalV1;
+        readonly expectedOrigin: string;
+        readonly requestedAtMs: number;
+    }): Promise<TargetCredentialRegistrationSuccessV1 | {
+        readonly outcome: 'invalid_input';
+        readonly message: string;
+    }>;
+    private commitReservedTargetV1;
+    /** Verifies the registration through its factor's own port — never the other's. */
+    private verifyTargetFactorEvidenceV1;
+    /**
+     * Flips the credential row to `registered`. The Email OTP branch commits the
+     * flip, the grant consumption, and the derived owner-binding insert in one
+     * batch — either all of them happened or none did.
+     */
+    private persistRegisteredTargetV1;
+    private planSourceContributionPreparationV1;
+    private buildTargetCredentialRegistrationReplayV1;
+    buildVerifiedLinkInputV1(input: {
+        readonly session: LinkedDeviceSessionRecordV1;
+        readonly approval: LinkedDeviceApprovalV1;
+        readonly requestedAtMs: number;
+    }): Promise<VerifiedLinkInputV1>;
+    private buildVerifiedLinkInputWithRegistrationV1;
+    private finalizeReservationIfPresentV1;
+    private reserveCommitV1;
+    private waitForCommitV1;
+    private readCommitReservationV1;
+    private commitReservationV1;
+    private releaseCommitReservationV1;
+    private readV1;
+}
+export {};
+//# sourceMappingURL=d1LinkedDeviceTargetCredentialProvider.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetPlanner.d.ts

@@ -0,0 +1,88 @@
+import type { LinkedDeviceApprovalV1, LinkedDeviceTargetPreparationV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
+import type { DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
+import type { WebAuthnRpId } from '../../../../../../shared-ts/src/utils/domainIds';
+import type { ActiveLaneProtocolSourceV1, EcdsaTargetCapabilityBindingV1, LaneTargetSigningWorkerV1 } from '../../../../../../shared-ts/src/signing-lanes/rotation';
+import type { LaneHolderParticipantId } from '../../../../../../shared-ts/src/signing-lanes/participants';
+import type { EvmFamilySigningKeySlotId } from '../../../../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId';
+import type { KeyCreationSignerSlot } from '../../../../../../shared-ts/src/passkey-custody/primitives';
+import type { Ed25519PublicKeyB64u } from '../../../../../../shared-ts/src/passkey-custody/primitives';
+import type { RouterAbEd25519YaoActivationBindingV1, RouterAbEd25519YaoApplicationBindingFactsV1 } from '../../../../../../shared-ts/src/utils/routerAbEd25519Yao';
+import type { NearEd25519SigningKeyId } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import type { WalletKeyId } from '../../../../../../shared-ts/src/signing-lanes/ids';
+import type { LinkedDeviceSessionRecordV1 } from '../../../../core/deviceLinking/linkedDeviceSession';
+import type { ExactAdministeredSignerV1 } from '../../../../../../shared-ts/src/device-linking/delegatedActivationPlan';
+import type { LinkedDeviceTargetPlannerV1 } from './d1LinkedDeviceTargetCredentialProvider';
+type LinkedDeviceOwnerSourceChildResolutionBaseV1 = {
+    readonly walletKeyId: WalletKeyId;
+    readonly source: ActiveLaneProtocolSourceV1;
+};
+/** Facts authenticated from Device 1's owner lane projection. Target
+ * participant and capability material is intentionally absent until Device 2
+ * returns its verified factor and public recipient requests. */
+type LinkedDeviceOwnerEd25519SourceChildResolutionV1 = LinkedDeviceOwnerSourceChildResolutionBaseV1 & {
+    readonly keyFamily: 'ed25519';
+    readonly applicationBindingDigestB64u: DigestB64u;
+    readonly registeredPublicKeyB64u: Ed25519PublicKeyB64u;
+    readonly nearEd25519SigningKeyId: NearEd25519SigningKeyId;
+    readonly keyCreationSignerSlot: KeyCreationSignerSlot;
+    readonly stableContextBindingB64u: string;
+    readonly sourceBinding: RouterAbEd25519YaoActivationBindingV1<'registration'>;
+    readonly applicationBinding: RouterAbEd25519YaoApplicationBindingFactsV1;
+};
+type LinkedDeviceOwnerEcdsaSourceChildResolutionV1 = LinkedDeviceOwnerSourceChildResolutionBaseV1 & {
+    readonly keyFamily: 'ecdsa_secp256k1';
+    readonly evmFamilySigningKeySlotId: EvmFamilySigningKeySlotId;
+    readonly thresholdPublicKey33B64u: string;
+    readonly evmAddress: string;
+    readonly sourceHolderVerifyingShare33B64u: string;
+    readonly sourceServerVerifyingShare33B64u: string;
+    readonly applicationBindingDigestB64u: DigestB64u;
+    readonly clientShareRetryCounter: number;
+};
+export type LinkedDeviceOwnerSourceChildResolutionV1 = LinkedDeviceOwnerEd25519SourceChildResolutionV1 | LinkedDeviceOwnerEcdsaSourceChildResolutionV1;
+export type LinkedDeviceTargetEnrichedChildResolutionV1 = (LinkedDeviceOwnerEd25519SourceChildResolutionV1 & {
+    readonly targetHolderParticipantId: LaneHolderParticipantId;
+    readonly targetSigningWorker: LaneTargetSigningWorkerV1;
+    readonly yaoSuiteId: import('../../../../../../shared-ts/src/signing-lanes/ids').Ed25519YaoSuiteId;
+    readonly circuitDigestB64u: string;
+}) | (LinkedDeviceOwnerEcdsaSourceChildResolutionV1 & {
+    readonly targetHolderParticipantId: LaneHolderParticipantId;
+    readonly targetSigningWorker: LaneTargetSigningWorkerV1;
+    readonly targetCapability: EcdsaTargetCapabilityBindingV1;
+    readonly reshareChannelBindingDigestB64u: string;
+});
+export type LinkedDeviceTargetPreparationResolutionV1 = LinkedDeviceOwnerSourceChildResolutionV1;
+export type LinkedDeviceOwnerSourceChildResolutionRequestV1 = {
+    readonly kind: 'preparation';
+    readonly session: LinkedDeviceSessionRecordV1;
+    readonly approval: LinkedDeviceApprovalV1;
+    readonly sourceSigner: ExactAdministeredSignerV1;
+    readonly childIndex: number;
+};
+export type LinkedDeviceOwnerSourceChildResolverV1 = {
+    resolveOwnerSourceChildV1(input: LinkedDeviceOwnerSourceChildResolutionRequestV1): Promise<LinkedDeviceTargetPreparationResolutionV1>;
+};
+export type D1LinkedDeviceTargetPlannerOptionsV1 = {
+    readonly resolveOwnerSourceChildV1: LinkedDeviceOwnerSourceChildResolverV1['resolveOwnerSourceChildV1'];
+    readonly targetPasskeyRpId: string;
+    readonly preparationTtlMs?: number;
+};
+/**
+ * Builds the one durable target preparation. Ordinary material activation and
+ * reservation identities are derived only after Device 2 verifies its factor.
+ */
+export declare class D1LinkedDeviceTargetPlannerV1 implements LinkedDeviceTargetPlannerV1 {
+    private readonly resolveOwnerSourceChildV1;
+    readonly targetPasskeyRpId: WebAuthnRpId;
+    private readonly preparationTtlMs;
+    constructor(input: D1LinkedDeviceTargetPlannerOptionsV1);
+    createTargetPreparationV1(input: {
+        readonly session: LinkedDeviceSessionRecordV1;
+        readonly approval: LinkedDeviceApprovalV1;
+        readonly expectedOrigin: string;
+        readonly deliveryRecipientPublicKey65B64u: string;
+        readonly requestedAtMs: number;
+    }): Promise<LinkedDeviceTargetPreparationV1>;
+}
+export {};
+//# sourceMappingURL=d1LinkedDeviceTargetPlanner.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceVerifiedLinkBuilder.d.ts

@@ -0,0 +1,54 @@
+import { type ExactAdministeredSignerManifestV1 } from '../../../../../../shared-ts/src/device-linking/delegatedActivationPlan';
+import type { LinkedDeviceApprovalV1, LinkedDeviceTargetCredentialRegistrationV1, LinkedDeviceTargetPreparationV1, VerifiedLinkInputV1, VerifiedTargetFactorV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
+import type { ActiveWalletAuthorityV1 } from '../../../../../../shared-ts/src/authorization/walletAuthority';
+import type { DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
+import type { WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import type { PrincipalId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
+import { type LinkedDeviceSessionRecordV1 } from '../../../../core/deviceLinking/linkedDeviceSession';
+import type { VerifiedLinkedDeviceTargetFactorEvidenceV1 } from './d1LinkedDeviceTargetCredentialProvider';
+export type VerifiedLinkSourceReadV1 = {
+    readonly authority: ActiveWalletAuthorityV1;
+    readonly authMethod: Extract<WalletAuthMethodRecordV2, {
+        readonly status: 'active';
+    }>;
+    readonly signerManifest: ExactAdministeredSignerManifestV1;
+    /** The custody manifest recorded on the requested source signer. */
+    readonly keyManifestDigestB64u: DigestB64u;
+    readonly principalId: PrincipalId;
+    readonly expiresAtMs: number;
+    readonly authorityDigestB64u: DigestB64u;
+    readonly verifiedRevocationEpoch: number;
+    readonly verifiedAtMs: number;
+};
+/**
+ * Narrow source-authority port. The implementation performs the Wallet
+ * Session V2 -> auth method -> authority read at its D1 boundary.
+ */
+export type VerifiedLinkSourceReaderV1 = {
+    readVerifiedSourceV1(input: {
+        readonly walletId: VerifiedLinkInputV1['walletId'];
+        readonly walletSessionId: string;
+        readonly authorizationId: string;
+        readonly keyFamily: ExactAdministeredSignerManifestV1['keyFamilies'][number];
+        readonly requestedAtMs: number;
+    }): Promise<VerifiedLinkSourceReadV1>;
+};
+export type BuildVerifiedLinkInputV1 = {
+    readonly session: LinkedDeviceSessionRecordV1;
+    readonly approval: LinkedDeviceApprovalV1;
+    readonly preparation: LinkedDeviceTargetPreparationV1;
+    readonly registration: LinkedDeviceTargetCredentialRegistrationV1;
+    readonly evidence: VerifiedLinkedDeviceTargetFactorEvidenceV1;
+    readonly source: VerifiedLinkSourceReaderV1;
+    readonly requestedAtMs: number;
+};
+export declare function buildVerifiedLinkInputV1(input: BuildVerifiedLinkInputV1): Promise<VerifiedLinkInputV1>;
+export declare function computeVerifiedTargetFactorVerificationDigestV1(input: {
+    readonly registration: LinkedDeviceTargetCredentialRegistrationV1;
+    readonly evidence: VerifiedLinkedDeviceTargetFactorEvidenceV1;
+    readonly verifiedAtMs: number;
+}): Promise<DigestB64u>;
+export type BuildVerifiedTargetFactorV1Input = Pick<BuildVerifiedLinkInputV1, 'preparation' | 'registration' | 'evidence' | 'requestedAtMs'>;
+export declare function buildVerifiedTargetFactorV1(input: BuildVerifiedTargetFactorV1Input): Promise<VerifiedTargetFactorV1>;
+export declare function linkedDeviceSignerManifestsEqualV1(left: ExactAdministeredSignerManifestV1, right: ExactAdministeredSignerManifestV1): boolean;
+//# sourceMappingURL=d1LinkedDeviceVerifiedLinkBuilder.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceVerifiedLinkSourceReader.d.ts

@@ -0,0 +1,23 @@
+import { type TenantId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
+import type { ExactAdministeredSignerV1 } from '../../../../../../shared-ts/src/device-linking/delegatedActivationPlan';
+import type { AuthorizationService } from '../../../../authorization/service';
+import type { D1WalletAuthMethodStore } from '../../../../core/d1WalletAuthMethodStore';
+import type { D1WalletStore } from '../../../../core/d1WalletStore';
+import type { D1WalletAuthorityStore } from '../wallet/d1WalletAuthorityStore';
+import type { VerifiedLinkSourceReaderV1 } from './d1LinkedDeviceVerifiedLinkBuilder';
+export declare function createD1LinkedDeviceVerifiedLinkSourceReaderV1(input: {
+    readonly authorizationService: Pick<AuthorizationService, 'readWalletSessionAuthorizationV2ByIdentity'>;
+    readonly authorityStore: Pick<D1WalletAuthorityStore, 'readById'>;
+    readonly authMethodStore: Pick<D1WalletAuthMethodStore, 'readByIdV2'>;
+    readonly walletStore: Pick<D1WalletStore, 'listEd25519SignersForWallet' | 'listEcdsaSignersForWallet'>;
+    readonly tenantId: TenantId;
+}): VerifiedLinkSourceReaderV1;
+/**
+ * The authority genuinely owns no signer of this family. Distinct from every
+ * infrastructure or identity failure so a caller probing families can fall
+ * back on this alone and let real errors surface.
+ */
+export declare class LinkedDeviceSourceFamilyUnavailableErrorV1 extends Error {
+    constructor(keyFamily: ExactAdministeredSignerV1['keyFamily']);
+}
+//# sourceMappingURL=d1LinkedDeviceVerifiedLinkSourceReader.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/index.d.ts

@@ -0,0 +1,15 @@
+export * from './d1LinkedDeviceSessionRecords';
+export * from './d1LinkedDeviceSessionStore';
+export * from './d1LinkedDeviceRequestProofNonceStore';
+export * from './d1LinkedDeviceRouteService';
+export * from './d1LinkedDeviceAuthorityInstallService';
+export * from './d1LinkedDeviceVerifiedLinkBuilder';
+export * from './d1LinkedDeviceVerifiedLinkSourceReader';
+export * from './d1LinkedDeviceSessionService';
+export * from './d1LinkedDeviceEd25519ExportRootStore';
+export * from './d1LinkedDeviceTargetCredentialProvider';
+export * from './d1LinkedDeviceTargetAuthenticatorStore';
+export * from './d1LinkedDeviceOwnerAuthorizationProvider';
+export * from './d1LinkedDeviceTargetPlanner';
+export * from './d1LinkedDeviceSourceContributionPreparationPlanner';
+//# sourceMappingURL=index.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoCapabilityPersistence.d.ts

@@ -0,0 +1,33 @@
+import type { WalletEd25519YaoActiveCapabilityRecord } from '../../../../core/WalletStore';
+import type { D1WalletStore, D1WalletStoreScope } from '../../../../core/d1WalletStore';
+import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
+import type { RouterAbEd25519YaoCapabilityReplacementOperationV1, RouterAbEd25519YaoCapabilityPersistenceResultV1, RouterAbEd25519YaoCapabilityPersistenceV1 } from '../../../domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery';
+export declare const ROUTER_AB_ED25519_YAO_CAPABILITY_REPLACEMENT_TABLE_V1 = "router_ab_yao_capability_replacements";
+export type CloudflareD1RouterAbEd25519YaoCapabilityPersistenceOptions = {
+    readonly database: D1DatabaseLike;
+    readonly scope: D1WalletStoreScope;
+    readonly walletStore: D1WalletStore;
+    readonly ensureSchema?: boolean;
+    readonly now?: () => number;
+};
+export declare class CloudflareD1RouterAbEd25519YaoCapabilityPersistence implements RouterAbEd25519YaoCapabilityPersistenceV1 {
+    private readonly database;
+    private readonly scope;
+    private readonly walletStore;
+    private readonly ensureSchemaOnUse;
+    private readonly now;
+    private schemaReady;
+    constructor(options: CloudflareD1RouterAbEd25519YaoCapabilityPersistenceOptions);
+    replaceActiveCapability(input: {
+        readonly operation: RouterAbEd25519YaoCapabilityReplacementOperationV1;
+        readonly previous: WalletEd25519YaoActiveCapabilityRecord;
+        readonly next: WalletEd25519YaoActiveCapabilityRecord;
+    }): Promise<RouterAbEd25519YaoCapabilityPersistenceResultV1>;
+    private ensureSchema;
+    private prepareActiveAuthorityReplacements;
+    private prepareAuthorityReplacementStatement;
+    private prepareSessionAuthorityProjectionReplacementStatement;
+    private readReceipt;
+    private reconcileAfterUncertainWrite;
+}
+//# sourceMappingURL=d1Ed25519YaoCapabilityPersistence.d.ts.map