@seams/wallet-server 0.5.0

package/dist/types/wallet-server/src/router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.d.ts

@@ -0,0 +1,26 @@
+import type { RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
+import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
+import type { RouterAbNormalSigningAdmissionInput } from '../../../domains/signingOperations/routerAbPrivateSigningWorker';
+import type { RouterAbNormalSigningAbuseDecision, RouterAbNormalSigningAdmissionStore, RouterAbNormalSigningProjectPolicyDecision } from '../../../domains/signingOperations/routerAbNormalSigningAdmissionCore';
+export type CloudflareD1RouterAbNormalSigningAdmissionStoreOptions = {
+    readonly database: D1DatabaseLike;
+    readonly storageNamespace: string;
+    readonly now?: () => number;
+};
+export declare class CloudflareD1RouterAbNormalSigningAdmissionStore implements RouterAbNormalSigningAdmissionStore {
+    private readonly database;
+    private readonly storageNamespace;
+    private readonly now;
+    constructor(options: CloudflareD1RouterAbNormalSigningAdmissionStoreOptions);
+    evaluateProjectPolicy(input: RouterAbNormalSigningAdmissionInput): Promise<RouterAbNormalSigningProjectPolicyDecision>;
+    evaluateAbuse(input: RouterAbNormalSigningAdmissionInput): Promise<RouterAbNormalSigningAbuseDecision>;
+    setProjectPolicy(scope: RuntimePolicyScope, decision: RouterAbNormalSigningProjectPolicyDecision): Promise<void>;
+    clearProjectPolicy(scope: RuntimePolicyScope): Promise<void>;
+    setAbuseDecision(input: RouterAbNormalSigningAdmissionInput, decision: RouterAbNormalSigningAbuseDecision): Promise<void>;
+    clearAbuseDecision(input: RouterAbNormalSigningAdmissionInput): Promise<void>;
+    private readDecision;
+    private putDecision;
+    private deleteRecord;
+}
+export declare function createCloudflareD1RouterAbNormalSigningAdmissionStore(options: CloudflareD1RouterAbNormalSigningAdmissionStoreOptions): CloudflareD1RouterAbNormalSigningAdmissionStore;
+//# sourceMappingURL=d1RouterAbNormalSigningAdmissionStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/signingLanes/d1EcdsaLanePrivateBindingResolver.d.ts

@@ -0,0 +1,4 @@
+import { type EcdsaOwnerSourceSignerContinuityPortV1, type EcdsaLanePrivateBindingResolverPortV1 } from '../../signingLanes/cloudflareLaneCurveExecution';
+import type { CloudflareD1LaneStoreOptions } from './d1LaneRecords';
+export declare function createCloudflareD1EcdsaLanePrivateBindingResolverV1(options: CloudflareD1LaneStoreOptions & EcdsaOwnerSourceSignerContinuityPortV1): EcdsaLanePrivateBindingResolverPortV1;
+//# sourceMappingURL=d1EcdsaLanePrivateBindingResolver.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/signingLanes/d1LaneAggregateRevocationApplicationService.d.ts

@@ -0,0 +1,4 @@
+import { LaneAggregateRevocationApplicationService } from '../../../../core/signingLanes/LaneAggregateRevocationApplicationService';
+import type { CloudflareD1LaneLifecycleApplicationServiceOptions } from './d1LaneLifecycleApplicationService';
+export declare function createCloudflareD1LaneAggregateRevocationApplicationService(options: CloudflareD1LaneLifecycleApplicationServiceOptions): LaneAggregateRevocationApplicationService;
+//# sourceMappingURL=d1LaneAggregateRevocationApplicationService.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/signingLanes/d1LaneEffectJournalStore.d.ts

@@ -0,0 +1,25 @@
+import type { LaneEffectJournalStore, LaneEffectMutation, LaneEffectMutationResult, LaneEffectRecordV1 } from '../../../../core/signingLanes/LaneEffectJournalStore';
+import { type CloudflareD1LaneStoreOptions } from './d1LaneRecords';
+export type CloudflareD1LaneEffectJournalStoreOptions = CloudflareD1LaneStoreOptions;
+export declare class CloudflareD1LaneEffectJournalStore implements LaneEffectJournalStore {
+    private readonly database;
+    private readonly scope;
+    private readonly now;
+    constructor(options: CloudflareD1LaneEffectJournalStoreOptions);
+    getEffect(input: {
+        readonly effectId: string;
+    }): Promise<{
+        readonly version: number;
+        readonly commandDigestB64u: string;
+        readonly record: LaneEffectRecordV1;
+    } | null>;
+    recordEffect(input: LaneEffectMutation): Promise<LaneEffectMutationResult>;
+    confirmEffect(input: {
+        readonly effectId: string;
+        readonly expectedVersion: number;
+        readonly commandDigestB64u: string;
+        readonly responseDigestB64u: string;
+        readonly confirmedAtMs: number;
+    }): Promise<LaneEffectMutationResult>;
+}
+//# sourceMappingURL=d1LaneEffectJournalStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/signingLanes/d1LaneEnrollmentGateway.d.ts

@@ -0,0 +1,20 @@
+import type { LaneEnrollmentGatewayV1 } from '../../../../../../shared-ts/src/signing-lanes';
+import type { LaneLifecycleStore } from '../../../../core/signingLanes/LaneLifecycleStore';
+export type CloudflareD1LaneEnrollmentGatewayOptions = {
+    readonly lifecycleStore: LaneLifecycleStore;
+};
+/** D1 gateway composition. Participant network calls are injected by callers. */
+export declare class CloudflareD1LaneEnrollmentGateway implements LaneEnrollmentGatewayV1 {
+    private readonly activation;
+    private readonly revocation;
+    constructor(options: CloudflareD1LaneEnrollmentGatewayOptions);
+    prepareLaneEnrollmentV1(...args: Parameters<LaneEnrollmentGatewayV1['prepareLaneEnrollmentV1']>): ReturnType<LaneEnrollmentGatewayV1['prepareLaneEnrollmentV1']>;
+    resumeLaneProtocolOperationV1(...args: Parameters<LaneEnrollmentGatewayV1['resumeLaneProtocolOperationV1']>): ReturnType<LaneEnrollmentGatewayV1['resumeLaneProtocolOperationV1']>;
+    recordLaneProtocolCommitV1(...args: Parameters<LaneEnrollmentGatewayV1['recordLaneProtocolCommitV1']>): ReturnType<LaneEnrollmentGatewayV1['recordLaneProtocolCommitV1']>;
+    recordLaneHolderDeliveryV1(...args: Parameters<LaneEnrollmentGatewayV1['recordLaneHolderDeliveryV1']>): ReturnType<LaneEnrollmentGatewayV1['recordLaneHolderDeliveryV1']>;
+    activateLaneServerMaterialV1(...args: Parameters<LaneEnrollmentGatewayV1['activateLaneServerMaterialV1']>): ReturnType<LaneEnrollmentGatewayV1['activateLaneServerMaterialV1']>;
+    commitLaneEnrollmentActivationV1(...args: Parameters<LaneEnrollmentGatewayV1['commitLaneEnrollmentActivationV1']>): ReturnType<LaneEnrollmentGatewayV1['commitLaneEnrollmentActivationV1']>;
+    fenceSigningLaneRevocationV1(...args: Parameters<LaneEnrollmentGatewayV1['fenceSigningLaneRevocationV1']>): ReturnType<LaneEnrollmentGatewayV1['fenceSigningLaneRevocationV1']>;
+    completeSigningLaneRevocationV1(...args: Parameters<LaneEnrollmentGatewayV1['completeSigningLaneRevocationV1']>): ReturnType<LaneEnrollmentGatewayV1['completeSigningLaneRevocationV1']>;
+}
+//# sourceMappingURL=d1LaneEnrollmentGateway.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/signingLanes/d1LaneLifecycleApplicationService.d.ts

@@ -0,0 +1,13 @@
+import { LaneLifecycleApplicationService, type LaneLifecycleAuthorizationPortV1, type LaneLifecycleCurveExecutionPortsV1 } from '../../../../core/signingLanes/LaneLifecycleApplicationService';
+import type { CloudflareD1LaneStoreOptions } from './d1LaneRecords';
+export type CloudflareD1LaneLifecycleApplicationServiceOptions = CloudflareD1LaneStoreOptions & {
+    readonly authorization: LaneLifecycleAuthorizationPortV1;
+    readonly execution: LaneLifecycleCurveExecutionPortsV1;
+};
+/**
+ * Builds the authenticated server-internal lane lifecycle boundary. Routes
+ * should receive this service from their private composition and never expose
+ * the receipt methods as a public raw-receipt endpoint.
+ */
+export declare function createCloudflareD1LaneLifecycleApplicationService(options: CloudflareD1LaneLifecycleApplicationServiceOptions): LaneLifecycleApplicationService;
+//# sourceMappingURL=d1LaneLifecycleApplicationService.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/signingLanes/d1LaneLifecycleStore.d.ts

@@ -0,0 +1,51 @@
+import type { CommitLaneEnrollmentActivationV1, LaneHolderDeliveryReceiptV1, LaneProductEpochRecordV1, LaneProtocolCommitReceiptV1, LaneProtocolRecordV1, LaneProtocolCasResultV1, LaneServerActivationReceiptV1, RevokeLaneEnrollmentV1, RevokeSigningLaneV1 } from '../../../../../../shared-ts/src/signing-lanes';
+import type { LaneEnrollmentId, LaneOperationId } from '../../../../../../shared-ts/src/signing-lanes';
+import type { LaneAdmissionMutationResult, LaneEnrollmentAdmissionInput, LaneEnrollmentAdmissionRecord, LaneEnrollmentLifecycleCasInput, LaneEnrollmentRevocationCommitInput, LaneEnrollmentRevocationCommitResult, LaneEnrollmentVisibilityCommitResult, LaneLifecycleStore, LaneProductEpochLookup, LaneActiveProductEpochLookup, LaneProtocolAdmissionInput, LaneProtocolAdmissionRecord, LaneProtocolLifecycleCasInput, LaneSigningLaneRevocationCommitInput, LaneSigningLaneRevocationFenceMutationResult, LaneSigningLaneRevocationMutationResult } from '../../../../core/signingLanes/LaneLifecycleStore';
+import { type CloudflareD1LaneStoreOptions } from './d1LaneRecords';
+export type CloudflareD1LaneLifecycleStoreOptions = CloudflareD1LaneStoreOptions;
+export declare class CloudflareD1LaneLifecycleStore implements LaneLifecycleStore {
+    private readonly database;
+    private readonly scope;
+    private readonly now;
+    constructor(options: CloudflareD1LaneLifecycleStoreOptions);
+    getEnrollment(enrollmentId: LaneEnrollmentId): Promise<LaneEnrollmentAdmissionRecord | null>;
+    getProtocol(operationId: LaneOperationId): Promise<LaneProtocolAdmissionRecord | null>;
+    /**
+     * Reads the committed protocol receipt only after verifying its persisted
+     * digest, receipt identity, and active protocol lifecycle binding.
+     */
+    getProtocolCommitReceipt(operationId: LaneOperationId): Promise<LaneProtocolCommitReceiptV1 | null>;
+    putEnrollmentAdmission(input: LaneEnrollmentAdmissionInput): Promise<LaneAdmissionMutationResult<LaneEnrollmentAdmissionRecord['value']>>;
+    putProtocolAdmission(input: LaneProtocolAdmissionInput): Promise<LaneAdmissionMutationResult<LaneProtocolRecordV1>>;
+    compareAndSetProtocolLifecycle(input: LaneProtocolLifecycleCasInput): Promise<LaneProtocolCasResultV1>;
+    compareAndSetEnrollmentLifecycle(input: LaneEnrollmentLifecycleCasInput): Promise<LaneAdmissionMutationResult<LaneEnrollmentAdmissionRecord['value']>>;
+    putProtocolCommitReceipt(receipt: LaneProtocolCommitReceiptV1, commandDigestB64u: string): Promise<LaneAdmissionMutationResult<LaneProtocolCommitReceiptV1>>;
+    putHolderDeliveryReceipt(receipt: LaneHolderDeliveryReceiptV1, commandDigestB64u: string): Promise<LaneAdmissionMutationResult<LaneHolderDeliveryReceiptV1>>;
+    putServerActivationReceipt(receipt: LaneServerActivationReceiptV1, commandDigestB64u: string): Promise<LaneAdmissionMutationResult<LaneServerActivationReceiptV1>>;
+    putProductEpochPending(productEpoch: Extract<LaneProductEpochRecordV1, {
+        state: 'pending_visibility';
+    }>, commandDigestB64u: string): Promise<LaneAdmissionMutationResult<LaneProductEpochRecordV1>>;
+    getProductEpoch(lookup: LaneProductEpochLookup): Promise<LaneProductEpochRecordV1 | null>;
+    private getProductEpochStored;
+    getActiveProductEpoch(lookup: LaneActiveProductEpochLookup): Promise<Extract<LaneProductEpochRecordV1, {
+        state: 'active';
+    }> | null>;
+    listEnrollmentProductEpochs(enrollmentId: LaneEnrollmentId): Promise<readonly LaneProductEpochRecordV1[]>;
+    commitEnrollmentVisibility(input: CommitLaneEnrollmentActivationV1): Promise<LaneEnrollmentVisibilityCommitResult>;
+    fenceLaneRevocation(input: RevokeSigningLaneV1): Promise<LaneSigningLaneRevocationFenceMutationResult>;
+    fenceEnrollmentRevocation(input: RevokeLaneEnrollmentV1): Promise<LaneAdmissionMutationResult<LaneEnrollmentAdmissionRecord['value']>>;
+    private commitLaneRevocationFence;
+    commitLaneRevocation(input: LaneSigningLaneRevocationCommitInput): Promise<LaneSigningLaneRevocationMutationResult>;
+    commitEnrollmentRevocation(input: LaneEnrollmentRevocationCommitInput): Promise<LaneEnrollmentRevocationCommitResult>;
+    private getFencedProductEpochByActivation;
+    private protocolInsertStatement;
+    private updateProtocolLifecycle;
+    private updateEnrollmentLifecycle;
+    private getEnrollmentRevocationFenceDigest;
+    private updateEnrollmentRevocationFence;
+    private putReceipt;
+    private readAndVerifyServerRetirementReceipt;
+    private verifyStoredRefreshPredecessorRetirements;
+    private readReceipt;
+}
+//# sourceMappingURL=d1LaneLifecycleStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/signingLanes/d1LaneLockStore.d.ts

@@ -0,0 +1,28 @@
+import type { LaneEnrollmentId, WalletKeyId } from '../../../../../../shared-ts/src/signing-lanes';
+import type { LaneLockResult, LaneLockStore } from '../../../../core/signingLanes/LaneLifecycleStore';
+import { type CloudflareD1LaneStoreOptions } from './d1LaneRecords';
+export type CloudflareD1LaneLockStoreOptions = CloudflareD1LaneStoreOptions;
+export declare class CloudflareD1LaneLockStore implements LaneLockStore {
+    private readonly database;
+    private readonly scope;
+    constructor(options: CloudflareD1LaneLockStoreOptions);
+    acquireWalletKeyLock(input: {
+        readonly walletKeyId: WalletKeyId;
+        readonly lockId: string;
+        readonly ttlMs: number;
+        readonly nowMs: number;
+    }): Promise<LaneLockResult>;
+    acquireEnrollmentLock(input: {
+        readonly enrollmentId: LaneEnrollmentId;
+        readonly lockId: string;
+        readonly ttlMs: number;
+        readonly nowMs: number;
+    }): Promise<LaneLockResult>;
+    releaseLock(input: {
+        readonly lockKey: string;
+        readonly lockId: string;
+    }): Promise<boolean>;
+    private acquire;
+    private read;
+}
+//# sourceMappingURL=d1LaneLockStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/signingLanes/d1LaneProtocolCommitter.d.ts

@@ -0,0 +1,5 @@
+import { CloudflareLaneProtocolCommitterV1, type CloudflareLaneProtocolCommitterOptionsV1 } from '../../signingLanes/cloudflareLaneProtocolCommitter';
+import type { CloudflareD1LaneStoreOptions } from './d1LaneRecords';
+export type CloudflareD1LaneProtocolCommitterOptionsV1 = CloudflareD1LaneStoreOptions & Omit<CloudflareLaneProtocolCommitterOptionsV1, 'gateway'>;
+export declare function createCloudflareD1LaneProtocolCommitterV1(options: CloudflareD1LaneProtocolCommitterOptionsV1): CloudflareLaneProtocolCommitterV1;
+//# sourceMappingURL=d1LaneProtocolCommitter.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/signingLanes/d1LaneRecords.d.ts

@@ -0,0 +1,107 @@
+import type { AggregateLaneActivationReceiptV1, AggregateLaneRevocationReceiptV1, LaneEnrollmentLifecycleV1, LaneEnrollmentManifestV1, LaneHolderDeliveryReceiptV1, LaneProductEpochRecordV1, LaneProtocolCommitReceiptV1, LaneProtocolRecordV1, LaneServerActivationReceiptV1, LaneServerRetirementReceiptV1, RevokeLaneEnrollmentV1 } from '../../../../../../shared-ts/src/signing-lanes';
+import type { D1DatabaseLike, D1ResultLike } from '../../../../storage/tenantRoute';
+export type CloudflareD1LaneScopeV1 = {
+    readonly namespace: string;
+    readonly orgId: string;
+    readonly projectId: string;
+    readonly envId: string;
+};
+export type CloudflareD1LaneStoreOptions = {
+    readonly database: D1DatabaseLike;
+    readonly scope: CloudflareD1LaneScopeV1;
+    readonly now?: () => number;
+};
+export type LaneEnrollmentRow = {
+    readonly enrollment_id?: unknown;
+    readonly wallet_id?: unknown;
+    readonly manifest_digest_b64u?: unknown;
+    readonly manifest_json?: unknown;
+    readonly lifecycle_json?: unknown;
+    readonly version?: unknown;
+    readonly command_digest_b64u?: unknown;
+    readonly created_at_ms?: unknown;
+    readonly updated_at_ms?: unknown;
+};
+export type LaneProtocolRow = {
+    readonly operation_id?: unknown;
+    readonly enrollment_id?: unknown;
+    readonly wallet_id?: unknown;
+    readonly wallet_key_id?: unknown;
+    readonly source_lane_id?: unknown;
+    readonly source_lane_share_epoch?: unknown;
+    readonly source_revocation_epoch?: unknown;
+    readonly target_lane_id?: unknown;
+    readonly target_lane_share_epoch?: unknown;
+    readonly target_material_activation_id?: unknown;
+    readonly job_json?: unknown;
+    readonly lifecycle_json?: unknown;
+    readonly version?: unknown;
+    readonly command_digest_b64u?: unknown;
+    readonly created_at_ms?: unknown;
+    readonly updated_at_ms?: unknown;
+};
+export type LaneProductEpochRow = {
+    readonly product_json?: unknown;
+    readonly version?: unknown;
+    readonly command_digest_b64u?: unknown;
+};
+export type LaneReceiptRow = {
+    readonly receipt_id?: unknown;
+    readonly receipt_kind?: unknown;
+    readonly receipt_digest_b64u?: unknown;
+    readonly receipt_json?: unknown;
+    readonly created_at_ms?: unknown;
+};
+export declare function requireD1LaneStoreOptions(input: CloudflareD1LaneStoreOptions): {
+    readonly database: D1DatabaseLike;
+    readonly scope: CloudflareD1LaneScopeV1;
+    readonly now: () => number;
+};
+export declare function normalizeScope(scope: CloudflareD1LaneScopeV1): CloudflareD1LaneScopeV1;
+export declare function parseVersion(value: unknown, label: string): number;
+export declare function parseTimestamp(value: unknown, label: string): number;
+export declare function parseRequiredString(value: unknown, label: string): string;
+export declare function parseJsonRecord(value: unknown, label: string): Record<string, unknown>;
+/** Compare parsed JSON records without relying on insertion order. */
+export declare function equalLaneRecords(left: unknown, right: unknown): boolean;
+export declare function parseEnrollmentRow(row: LaneEnrollmentRow): {
+    readonly enrollmentId: string;
+    readonly walletId: string;
+    readonly manifestDigestB64u: string;
+    readonly manifest: LaneEnrollmentManifestV1;
+    readonly lifecycle: LaneEnrollmentLifecycleV1;
+    readonly version: number;
+    readonly commandDigestB64u: string;
+    readonly createdAtMs: number;
+    readonly updatedAtMs: number;
+};
+export declare function parseProtocolRow(row: LaneProtocolRow): {
+    readonly operationId: string;
+    readonly enrollmentId: string;
+    readonly walletId: string;
+    readonly walletKeyId: string;
+    readonly sourceLaneId: string;
+    readonly sourceLaneShareEpoch: string;
+    readonly sourceRevocationEpoch: number;
+    readonly targetLaneId: string;
+    readonly targetLaneShareEpoch: string;
+    readonly targetMaterialActivationId: string;
+    readonly record: LaneProtocolRecordV1;
+    readonly version: number;
+    readonly commandDigestB64u: string;
+    readonly createdAtMs: number;
+    readonly updatedAtMs: number;
+};
+export declare function parseProductEpochRow(row: LaneProductEpochRow): LaneProductEpochRecordV1;
+export declare function parseReceiptRow(row: LaneReceiptRow): {
+    readonly receiptId: string;
+    readonly receiptKind: string;
+    readonly receiptDigestB64u: string;
+    readonly value: LaneProtocolCommitReceiptV1 | LaneHolderDeliveryReceiptV1 | LaneServerActivationReceiptV1 | LaneServerRetirementReceiptV1 | AggregateLaneActivationReceiptV1 | AggregateLaneRevocationReceiptV1;
+};
+export declare function digestLaneEnrollmentRevocationCommand(input: RevokeLaneEnrollmentV1): Promise<string>;
+export declare function scopeValues(scope: CloudflareD1LaneScopeV1): readonly string[];
+export declare function firstBatchResult(results: readonly unknown[], index: number): D1ResultLike;
+export declare const LANE_CAS_GUARD_SQL = "INSERT INTO lane_cas_guard (guard_id) SELECT 1 WHERE changes() = 0";
+export declare function assertD1Success(result: D1ResultLike, label: string): void;
+//# sourceMappingURL=d1LaneRecords.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/signingLanes/index.d.ts

@@ -0,0 +1,10 @@
+export * from './d1LaneRecords';
+export * from './d1LaneLifecycleStore';
+export * from './d1EcdsaLanePrivateBindingResolver';
+export * from './d1LaneEffectJournalStore';
+export * from './d1LaneLockStore';
+export * from './d1LaneEnrollmentGateway';
+export * from './d1LaneLifecycleApplicationService';
+export * from './d1LaneAggregateRevocationApplicationService';
+export * from './d1LaneProtocolCommitter';
+//# sourceMappingURL=index.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/versionedJson/d1VersionedJsonRecordStore.d.ts

@@ -0,0 +1,118 @@
+import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import type { VersionedJsonObject, VersionedJsonRecordPutResult, VersionedJsonRecordReadResult } from '../../../framework/versionedJsonRecordStore';
+export type CloudflareD1VersionedJsonRecordScopeV1 = {
+    readonly namespace: string;
+    readonly orgId: string;
+    readonly projectId: string;
+    readonly envId: string;
+};
+export type CloudflareD1VersionedJsonRecordStoreOptions<T> = {
+    readonly database: D1DatabaseLike;
+    readonly scope: CloudflareD1VersionedJsonRecordScopeV1;
+    readonly encode: (value: T) => VersionedJsonObject;
+    readonly parse: (raw: unknown) => T | null;
+    readonly keyPrefix?: string;
+};
+export type CloudflareD1VersionedJsonRecordMutationV1<T> = {
+    readonly key: string;
+    readonly value: T;
+    readonly expectedVersion: string | null;
+};
+export type CloudflareD1VersionedJsonRecordReadManyEntryV1<T> = {
+    readonly key: string;
+    readonly result: VersionedJsonRecordReadResult<T>;
+};
+export type CloudflareD1VersionedJsonRecordBatchPutResultV1 = {
+    readonly kind: 'stored';
+    readonly versions: readonly {
+        readonly key: string;
+        readonly version: string;
+    }[];
+} | {
+    readonly kind: 'version_mismatch';
+    readonly key: string;
+};
+export type CloudflareD1VersionedJsonRecordAtomicPatchV1 = {
+    readonly key: string;
+    readonly expectedVersion: string;
+    readonly exactStringPredicates: readonly {
+        readonly jsonPath: string;
+        readonly value: string;
+    }[];
+    readonly unexpired: {
+        readonly jsonPath: string;
+        readonly nowMs: number;
+    };
+    readonly patch: VersionedJsonObject;
+};
+export declare class CloudflareD1VersionedJsonRecordStoreError extends Error {
+    readonly code: 'invalid_record' | 'invalid_response' | 'request_failed';
+    constructor(code: 'invalid_record' | 'invalid_response' | 'request_failed', message: string);
+}
+export declare class CloudflareD1VersionedJsonRecordStore<T> {
+    private readonly database;
+    private readonly scope;
+    private readonly encode;
+    private readonly parse;
+    private readonly keyPrefix;
+    constructor(options: CloudflareD1VersionedJsonRecordStoreOptions<T>);
+    read(key: string): Promise<VersionedJsonRecordReadResult<T>>;
+    /**
+     * Reads a set of records from one D1 batch snapshot. Callers that compose
+     * shared and ceremony state must use this method so they never merge rows
+     * from different database versions.
+     */
+    /**
+     * Reads every record whose key starts with `keyStartsWith`, inside this
+     * scope.
+     *
+     * A prefix scan rather than a key batch because the caller does not know the
+     * keys: enumerating a wallet's envelopes means finding rows it has never
+     * seen. `substr` compares the prefix literally, so `%` and `_` never become
+     * pattern operators and D1 never compiles caller data as a LIKE pattern.
+     *
+     * Rows that fail to parse are skipped rather than failing the scan. A single
+     * unreadable row must not make a wallet's whole envelope set unlistable,
+     * which would turn one corrupt record into a wallet nobody can manage.
+     */
+    listByKeyPrefix(keyStartsWith: string, options?: {
+        readonly limit?: number;
+    }): Promise<readonly CloudflareD1VersionedJsonRecordReadManyEntryV1<T>[]>;
+    readMany(keys: readonly string[]): Promise<readonly CloudflareD1VersionedJsonRecordReadManyEntryV1<T>[]>;
+    private parseReadResult;
+    put(key: string, value: T, expectedVersion: string | null): Promise<VersionedJsonRecordPutResult>;
+    /**
+     * Applies multiple records in one D1 transaction. The guard statement turns
+     * every zero-row CAS into a constraint failure, which makes D1 roll back the
+     * whole batch instead of committing a partial update.
+     */
+    putMany(mutations: readonly CloudflareD1VersionedJsonRecordMutationV1<T>[]): Promise<CloudflareD1VersionedJsonRecordBatchPutResultV1>;
+    /**
+     * Applies versioned-record mutations and caller-owned D1 statements in the
+     * same transaction. The additional statements are used only where a domain
+     * commit spans this JSON store and a normalized table (for example, a
+     * recovery envelope plus its WebAuthn authenticator and binding).
+     */
+    putManyWithAdditionalStatements(mutations: readonly CloudflareD1VersionedJsonRecordMutationV1<T>[], additionalStatements: readonly D1PreparedStatementLike[]): Promise<CloudflareD1VersionedJsonRecordBatchPutResultV1>;
+    /**
+     * The same mutation + CAS-guard statements `putManyWithAdditionalStatements`
+     * would run, returned instead of executed, so a caller whose transaction is
+     * owned elsewhere can fold them into that batch.
+     *
+     * Auth-method revocation needs exactly this: the method, its sessions, and
+     * its sealed envelope have to commit together, and the authority store owns
+     * that batch.
+     */
+    prepareMutationStatements(mutations: readonly CloudflareD1VersionedJsonRecordMutationV1<T>[]): readonly D1PreparedStatementLike[];
+    patchAtomically(input: CloudflareD1VersionedJsonRecordAtomicPatchV1): Promise<VersionedJsonRecordPutResult & {
+        readonly value?: T;
+    }>;
+    private prepareBatchMutations;
+    private prepareMutationStatement;
+    private findBatchConflict;
+    private insert;
+    private update;
+    private storageKey;
+}
+export declare function createCloudflareD1VersionedJsonRecordStore<T>(options: CloudflareD1VersionedJsonRecordStoreOptions<T>): CloudflareD1VersionedJsonRecordStore<T>;
+//# sourceMappingURL=d1VersionedJsonRecordStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAddSignerService.d.ts

@@ -0,0 +1,114 @@
+import type { WalletAddSignerFinalizeRequest, WalletAddSignerFinalizeResponse, WalletAddSignerEcdsaActivationRequest, WalletAddSignerEcdsaActivationResponse, WalletAddSignerEcdsaDerivationRespondRequest, WalletAddSignerEcdsaDerivationRespondResponse, WalletAddSignerStartRequest, WalletAddSignerStartResponse } from '../../../../core/registrationContracts';
+import type { D1WalletStore } from '../../../../core/d1WalletStore';
+import type { StoredWalletAddSignerCeremony, StoredAddSignerIntent } from '../../../../core/RegistrationCeremonyStore';
+import { CloudflareD1RegistrationCeremonyIntentStore } from '../registration/d1RegistrationCeremonyStore';
+import { parseD1RuntimePolicyScope } from '../registration/d1RegistrationCeremonyRecords';
+import { CloudflareD1WalletAuthMethodService } from './d1WalletAuthMethodService';
+import { type RouterAbEd25519YaoProductRegistrationRuntimeV1 } from '../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration';
+import { type RouterAbEcdsaStrictRegistrationPort } from '../../../domains/ecdsa/routerAbEcdsaStrictRegistration';
+import type { TenantRootCustodyLineageResolverV1 } from '../../../domains/tenantRoot/tenantRootCustodyLineage';
+import { type RouterAbEd25519YaoRegistrationSideEffectRecordV1, type RouterAbEd25519YaoRegistrationSideEffectStoreV1 } from '../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary';
+import { CloudflareD1PasskeyCustodyEnvelopeStore } from '../passkeyCustody/d1PasskeyCustodyEnvelopeStore';
+type StartWalletAddSignerInput = WalletAddSignerStartRequest;
+type RespondWalletAddSignerDerivationInput = WalletAddSignerEcdsaDerivationRespondRequest;
+type ActivateWalletAddSignerEcdsaInput = WalletAddSignerEcdsaActivationRequest;
+type FinalizeWalletAddSignerInput = WalletAddSignerFinalizeRequest;
+type WalletAddSignerStartCoreResponse = (Omit<Extract<WalletAddSignerStartResponse, {
+    readonly ok: true;
+    readonly kind: 'near_ed25519';
+}>, 'ed25519'> & {
+    readonly ed25519: Omit<Extract<WalletAddSignerStartResponse, {
+        readonly ok: true;
+        readonly kind: 'near_ed25519';
+    }>['ed25519'], 'custodyEnvelope'>;
+}) | (Omit<Extract<WalletAddSignerStartResponse, {
+    readonly ok: true;
+    readonly kind: 'evm_family_ecdsa';
+}>, 'ecdsa'> & {
+    readonly ecdsa: Omit<Extract<WalletAddSignerStartResponse, {
+        readonly ok: true;
+        readonly kind: 'evm_family_ecdsa';
+    }>['ecdsa'], 'custodyEnvelope'>;
+}) | Extract<WalletAddSignerStartResponse, {
+    readonly ok: false;
+}>;
+type WalletAddSignerStartCoreSuccess = Extract<WalletAddSignerStartCoreResponse, {
+    readonly ok: true;
+}>;
+type RegistrationCeremonyStoreProvider = () => CloudflareD1RegistrationCeremonyIntentStore;
+type WalletStoreProvider = () => D1WalletStore;
+type Ed25519YaoProductRegistrationProvider = () => RouterAbEd25519YaoProductRegistrationRuntimeV1 | null;
+export type D1WalletAddSignerStartPreparedV1 = {
+    readonly kind: 'd1_wallet_add_signer_start_prepared_v1';
+    readonly addSignerCeremonyId: string;
+    readonly registrationPreparationId: string;
+    readonly expiresAtMs: number;
+    readonly storedIntent: StoredAddSignerIntent;
+    readonly auth: StoredWalletAddSignerCeremony['auth'];
+};
+export type D1WalletAddSignerStartTerminalV1 = {
+    readonly kind: 'd1_wallet_add_signer_start_succeeded_v1';
+    readonly ceremony: StoredWalletAddSignerCeremony;
+    readonly response: WalletAddSignerStartCoreSuccess;
+} | {
+    readonly kind: 'd1_wallet_add_signer_start_rejected_v1';
+    readonly response: Extract<WalletAddSignerStartResponse, {
+        readonly ok: false;
+    }>;
+};
+export type D1WalletAddSignerStartSideEffectStore = RouterAbEd25519YaoRegistrationSideEffectStoreV1<D1WalletAddSignerStartTerminalV1, D1WalletAddSignerStartPreparedV1>;
+export type D1WalletAddSignerStartSideEffectRecord = RouterAbEd25519YaoRegistrationSideEffectRecordV1<D1WalletAddSignerStartTerminalV1, D1WalletAddSignerStartPreparedV1>;
+export type D1WalletAddSignerFinalizePreparedV1 = {
+    readonly kind: 'd1_wallet_add_signer_finalize_ed25519_prepared_v1';
+    readonly finalizingAtMs: number;
+} | {
+    readonly kind: 'd1_wallet_add_signer_finalize_ecdsa_prepared_v1';
+    readonly signerWriteAtMs: number;
+};
+export type D1WalletAddSignerFinalizeSideEffectStore = RouterAbEd25519YaoRegistrationSideEffectStoreV1<WalletAddSignerFinalizeResponse, D1WalletAddSignerFinalizePreparedV1>;
+export type D1WalletAddSignerFinalizeSideEffectRecord = RouterAbEd25519YaoRegistrationSideEffectRecordV1<WalletAddSignerFinalizeResponse, D1WalletAddSignerFinalizePreparedV1>;
+export declare function parseD1WalletAddSignerStartSideEffectRecord(raw: unknown): D1WalletAddSignerStartSideEffectRecord | null;
+export declare function parseD1WalletAddSignerFinalizeSideEffectRecord(raw: unknown): D1WalletAddSignerFinalizeSideEffectRecord | null;
+export declare class CloudflareD1WalletAddSignerService {
+    private readonly getRegistrationCeremonyIntentStore;
+    private readonly getEd25519YaoProductRegistration;
+    private readonly ecdsaStrictRegistration;
+    private readonly tenantRootCustodyLineage;
+    private readonly getWalletStore;
+    private readonly walletAuthMethods;
+    private readonly passkeyCustodyEnvelopes;
+    private readonly startSideEffects;
+    private readonly finalizeSideEffects;
+    constructor(input: {
+        readonly getRegistrationCeremonyIntentStore: RegistrationCeremonyStoreProvider;
+        readonly getEd25519YaoProductRegistration: Ed25519YaoProductRegistrationProvider;
+        readonly ecdsaStrictRegistration: RouterAbEcdsaStrictRegistrationPort;
+        readonly tenantRootCustodyLineage: TenantRootCustodyLineageResolverV1;
+        readonly getWalletStore: WalletStoreProvider;
+        readonly walletAuthMethods: CloudflareD1WalletAuthMethodService;
+        readonly passkeyCustodyEnvelopes: CloudflareD1PasskeyCustodyEnvelopeStore;
+        readonly startSideEffects: D1WalletAddSignerStartSideEffectStore;
+        readonly finalizeSideEffects: D1WalletAddSignerFinalizeSideEffectStore;
+    });
+    getWalletAddSignerRuntimePolicyScope(addSignerCeremonyId: string): Promise<NonNullable<ReturnType<typeof parseD1RuntimePolicyScope>> | null>;
+    startWalletAddSigner(request: StartWalletAddSignerInput): Promise<WalletAddSignerStartResponse>;
+    private attachWalletAddSignerCustodyEnvelope;
+    private executeWalletAddSignerStartSideEffect;
+    private executeWalletAddSignerStart;
+    respondWalletAddSignerEcdsaDerivation(request: RespondWalletAddSignerDerivationInput): Promise<WalletAddSignerEcdsaDerivationRespondResponse>;
+    /**
+     * Idempotent under the canonical activation coordinates. The client computes
+     * the activation request digest from the canonical add-signer command
+     * (`wallet_add_signer_activate_v2`); this method recomputes it, records the
+     * coordinates as a claim before any Router custody work, and replays the
+     * committed receipt to any later activate with the same coordinates — the
+     * replay is also how completion is queried since the standalone
+     * prepare/query routes were removed.
+     */
+    activateWalletAddSignerEcdsa(request: ActivateWalletAddSignerEcdsaInput): Promise<WalletAddSignerEcdsaActivationResponse>;
+    finalizeWalletAddSigner(request: FinalizeWalletAddSignerInput): Promise<WalletAddSignerFinalizeResponse>;
+    private executeWalletAddSignerFinalizeSideEffect;
+    private executeWalletAddSignerFinalize;
+}
+export {};
+//# sourceMappingURL=d1WalletAddSignerService.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAddSignerService.typecheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=d1WalletAddSignerService.typecheck.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthMethodBoundary.d.ts

@@ -0,0 +1,90 @@
+import { type WalletAuthMethodId, type WalletAuthorityId } from '../../../../../../shared-ts/src/utils/domainIds';
+import { type AddAuthMethodIntentV1, type AddSignerIntentV1, type RegistrationAuthority, type WebAuthnRpId, type WalletId, type WalletAuthMethodRevocationProof, type WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import { type WalletAuthAuthority } from '../../../../../../shared-ts/src/utils/walletAuthAuthority';
+import type { StoredWalletAddAuthMethodCeremony, StoredWalletAddSignerCeremony } from '../../../../core/RegistrationCeremonyStore';
+import type { WalletAddAuthMethodStartRequest, WalletAddSignerStartRequest, WalletRegistrationFinalizeAuthMethod } from '../../../../core/registrationContracts';
+import type { WalletAuthMethodV2Store } from '../../../../core/d1WalletAuthMethodStore';
+import type { DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
+import type { EmailOtpWalletEnrollmentRecord } from '../../../../core/EmailOtpStores';
+import type { EmailOtpExistingChallengeVerifyInput, EmailOtpExistingChallengeVerifyResult } from '../emailOtp/d1EmailOtpChallengeVerifier';
+type StartWalletAddSignerInput = WalletAddSignerStartRequest;
+type StartWalletAddAuthMethodInput = WalletAddAuthMethodStartRequest;
+export type D1AddSignerExistingAuthResolution = {
+    readonly ok: true;
+    readonly auth: StoredWalletAddSignerCeremony['auth'];
+} | {
+    readonly ok: false;
+    readonly code: string;
+    readonly message: string;
+};
+export type D1AddAuthMethodExistingAuthResolution = {
+    readonly ok: true;
+    readonly auth: StoredWalletAddAuthMethodCeremony['auth'];
+} | {
+    readonly ok: false;
+    readonly code: string;
+    readonly message: string;
+};
+export declare function walletRegistrationFinalizeAuthMethodFromAuthority(authority: RegistrationAuthority): WalletRegistrationFinalizeAuthMethod;
+export declare function walletAuthAuthorityFromRegistrationAuthority(input: {
+    readonly authority: RegistrationAuthority;
+    readonly walletAuthMethodId: WalletAuthMethodId;
+}): WalletAuthAuthority;
+export declare function walletAuthMethodRecordFromRegistrationAuthority(input: {
+    readonly authority: RegistrationAuthority;
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly walletAuthorityId: WalletAuthorityId;
+    readonly now: number;
+}): Extract<WalletAuthMethodRecordV2, {
+    readonly status: 'active';
+}>;
+export type D1LinkedDeviceFreshRevokeProofV1 = WalletAuthMethodRevocationProof;
+export type D1FreshRevokeWebAuthnVerifierV1 = (input: {
+    readonly userId: string;
+    readonly rpId: WebAuthnRpId;
+    readonly expectedChallenge: string;
+    readonly webauthn_authentication: unknown;
+    readonly expected_origin: string;
+}) => Promise<{
+    readonly success: boolean;
+    readonly verified: boolean;
+    readonly message?: string;
+}>;
+export declare function verifyD1LinkedDeviceFreshRevokeProofV1(input: {
+    readonly walletId: WalletId;
+    readonly orgId: string;
+    readonly targetWalletAuthMethodId: WalletAuthMethodId;
+    readonly proof: D1LinkedDeviceFreshRevokeProofV1;
+    readonly expectedOrigin: string;
+    readonly verifiedAtMs: number;
+    readonly operationFingerprintDigest: DigestB64u;
+    readonly walletAuthMethodStore: Pick<WalletAuthMethodV2Store, 'getPasskeyV2' | 'listForWalletV2'>;
+    readonly verifyWebAuthnAuthenticationLite: D1FreshRevokeWebAuthnVerifierV1;
+    readonly verifyEmailOtpExisting?: (input: EmailOtpExistingChallengeVerifyInput) => Promise<EmailOtpExistingChallengeVerifyResult>;
+    readonly readEmailOtpEnrollment?: (walletId: string) => Promise<EmailOtpWalletEnrollmentRecord | null>;
+}): Promise<{
+    readonly kind: 'authorized';
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly verifiedAtMs: number;
+} | {
+    readonly kind: 'denied';
+    readonly code: 'unauthorized' | 'invalid';
+    readonly message: string;
+}>;
+export declare function resolveD1AddSignerExistingAuth(input: {
+    readonly auth: StartWalletAddSignerInput['auth'];
+    readonly walletId: WalletId;
+    readonly intent: AddSignerIntentV1;
+    readonly walletAuthMethodStore: Pick<WalletAuthMethodV2Store, 'getPasskeyV2'>;
+    readonly nowMs: number;
+}): Promise<D1AddSignerExistingAuthResolution>;
+export declare function resolveD1AddAuthMethodExistingAuth(input: {
+    readonly auth: StartWalletAddAuthMethodInput['auth'];
+    readonly walletId: WalletId;
+    readonly intent: AddAuthMethodIntentV1;
+    readonly walletAuthMethodStore: Pick<WalletAuthMethodV2Store, 'getPasskeyV2'>;
+    readonly nowMs: number;
+}): Promise<D1AddAuthMethodExistingAuthResolution>;
+export declare function d1HostIsWithinWebAuthnRpId(host: string, rpId: string): boolean;
+export {};
+//# sourceMappingURL=d1WalletAuthMethodBoundary.d.ts.map