@seams/wallet-server 0.5.0

package/dist/types/wallet-server/src/router/domains/ecdsa/routerAbEcdsaStrictRegistration.d.ts

@@ -0,0 +1,199 @@
+import { type RouterAbEcdsaDerivationActivationCommitQueryResultV1, type RouterAbEcdsaDerivationActivationPrepareResultV1, type RouterAbEcdsaDerivationActivationRefreshCommitRequestV1, type RouterAbEcdsaDerivationActivationRefreshResponseV1, type RouterAbEcdsaDerivationExplicitExportRequestV1, type RouterAbEcdsaDerivationNormalSigningScopeV1, type RouterAbEcdsaExplicitExportForwardedResponseV1, type RouterAbEcdsaDerivationSignerSetV1, type RouterAbEcdsaRegistrationActivationReceiptV1, type RouterAbEcdsaRegistrationRecipientKeysV1, type RouterAbEcdsaRegistrationRequestFactsV1, type RouterAbEcdsaRegistrationRequestV1, type RouterAbEcdsaStrictForwardedRegistrationResponseV1, type RouterAbEcdsaVerifiedClientActivationFactsV1 } from '../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
+import type { RouterAbNormalSigningAuthorizationWire } from '../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
+import type { CorrelationId } from '../../../../../shared-ts/src/utils/canonicalPrimitives';
+import { type RouterAbTraceContextV1 } from '../../../../../shared-ts/src/utils/routerAbTraceContext';
+declare const routerAbEcdsaPendingActivationJsonBrand: unique symbol;
+type RouterAbEcdsaPendingActivationJsonV1 = string & {
+    readonly [routerAbEcdsaPendingActivationJsonBrand]: true;
+};
+type RouterAbEcdsaStrictFailure = {
+    readonly ok: false;
+    readonly code: string;
+    readonly message: string;
+    readonly retryable: boolean;
+};
+export type RouterAbEcdsaPendingActivationV1 = {
+    readonly kind: 'router_ab_ecdsa_pending_activation_v1';
+    readonly canonicalPayloadJson: RouterAbEcdsaPendingActivationJsonV1;
+};
+export type RouterAbEcdsaStrictRegistrationResult = {
+    readonly ok: true;
+    readonly value: {
+        readonly publicResponse: RouterAbEcdsaStrictForwardedRegistrationResponseV1;
+        readonly pendingActivation: RouterAbEcdsaPendingActivationV1;
+    };
+} | RouterAbEcdsaStrictFailure;
+export type RouterAbEcdsaStrictActivationResult = {
+    readonly ok: true;
+    readonly value: RouterAbEcdsaRegistrationActivationReceiptV1;
+} | RouterAbEcdsaStrictFailure;
+export type RouterAbEcdsaStrictActivationPrepareResult = {
+    readonly ok: true;
+    readonly value: RouterAbEcdsaDerivationActivationPrepareResultV1;
+} | RouterAbEcdsaStrictFailure;
+export type RouterAbEcdsaStrictActivationQueryResult = {
+    readonly ok: true;
+    readonly value: RouterAbEcdsaDerivationActivationCommitQueryResultV1;
+} | RouterAbEcdsaStrictFailure;
+export type RouterAbEcdsaStrictRegistrationAuthority = {
+    readonly subjectId: string;
+    readonly sessionId: string;
+    readonly accountId: string;
+    readonly expiresAtMs: number;
+};
+export type RouterAbEcdsaStrictExportAuthority = RouterAbEcdsaStrictRegistrationAuthority & {
+    readonly keyHandle: string;
+    readonly authorization: RouterAbNormalSigningAuthorizationWire;
+    readonly privateAuthorization: RouterAbEcdsaStrictExportPrivateAuthorization;
+    readonly normalSigningScope: RouterAbEcdsaDerivationNormalSigningScopeV1;
+};
+export type RouterAbEcdsaStrictExportPrivateAuthorization = {
+    readonly kind: 'reusable_wallet_session';
+    readonly walletSessionId: string;
+} | {
+    readonly kind: 'operation_step_up';
+    readonly evidenceSetDigest: string;
+};
+export type RouterAbEcdsaStrictRegistrationTopology = {
+    readonly routerId: string;
+    readonly signerSet: RouterAbEcdsaDerivationSignerSetV1;
+    readonly deriverRecipientKeys: RouterAbEcdsaRegistrationRecipientKeysV1;
+};
+export type RouterAbEcdsaRegistrationRequestPolicyV1 = {
+    readonly policyVersion: string;
+    readonly requestDigestB64u: string;
+};
+export type RouterAbEcdsaRegistrationTenantRootV1 = {
+    readonly identityDigestB64u: string;
+    readonly custodyLineageB64u: string;
+};
+type RouterAbRequestPolicyClaimsInputV1 = {
+    readonly policyVersion: string;
+    readonly workKind: 'registration_prepare' | 'key_export' | 'server_share_refresh';
+    readonly requestDigest: {
+        readonly bytes: readonly number[];
+    };
+};
+/**
+ * Receives the Router's raw `Server-Timing` header, when it sent one
+ * (Refactor 94B Phase 0). Diagnostics only: the Router's spans never reach the
+ * response body, and a caller that omits this sink changes nothing about the
+ * ceremony. Called at most once per forwarded request, before the result is
+ * parsed, so a failing leg still reports where its time went.
+ */
+export type RouterAbEcdsaStrictServerTimingSink = (header: string) => void;
+/**
+ * Refactor 94B Phase 0. Reports whether a role leg returned the diagnostics
+ * header we expect, and nothing about what it contained.
+ *
+ * `Server-Timing` carries role and span names from inside the MPC topology.
+ * A missing header and an empty one are different failures — the first means
+ * the leg never emitted diagnostics, the second that it emitted nothing
+ * measurable — so presence is worth recording. The value is not: it is
+ * attacker-influencable in principle and identifying in practice, so it is
+ * never passed here.
+ */
+export type RouterAbEcdsaStrictHeaderPresenceSink = (presence: {
+    readonly leg: string;
+    readonly serverTiming: 'present' | 'absent';
+}) => void;
+export interface RouterAbEcdsaStrictRegistrationPort {
+    topology(): RouterAbEcdsaStrictRegistrationTopology;
+    registerWithTenantRoot(input: {
+        readonly request: RouterAbEcdsaRegistrationRequestV1;
+        readonly tenantRoot: RouterAbEcdsaRegistrationTenantRootV1;
+        readonly requestPolicy: RouterAbEcdsaRegistrationRequestPolicyV1;
+        readonly authority: RouterAbEcdsaStrictRegistrationAuthority;
+        readonly traceContext?: RouterAbTraceContextV1;
+        readonly onServerTiming?: RouterAbEcdsaStrictServerTimingSink;
+        readonly onHeaderPresence?: RouterAbEcdsaStrictHeaderPresenceSink;
+    }): Promise<RouterAbEcdsaStrictRegistrationResult>;
+    activate(input: {
+        readonly activationCorrelationId: CorrelationId;
+        readonly activationRequestDigestB64u: string;
+        readonly pendingActivation: RouterAbEcdsaPendingActivationV1;
+        readonly clientActivation: RouterAbEcdsaVerifiedClientActivationFactsV1;
+        readonly requestPolicy: RouterAbEcdsaRegistrationRequestPolicyV1;
+        readonly authority: RouterAbEcdsaStrictRegistrationAuthority;
+        readonly traceContext?: RouterAbTraceContextV1;
+        readonly onServerTiming?: RouterAbEcdsaStrictServerTimingSink;
+        readonly onHeaderPresence?: RouterAbEcdsaStrictHeaderPresenceSink;
+    }): Promise<RouterAbEcdsaStrictActivationResult>;
+}
+export type RouterAbEcdsaStrictExportResult = {
+    readonly ok: true;
+    readonly value: RouterAbEcdsaExplicitExportForwardedResponseV1;
+} | RouterAbEcdsaStrictFailure;
+export type RouterAbEcdsaStrictRefreshResult = {
+    readonly ok: true;
+    readonly value: RouterAbEcdsaDerivationActivationRefreshResponseV1;
+} | RouterAbEcdsaStrictFailure;
+export interface RouterAbEcdsaStrictPostRegistrationPort {
+    topology(): RouterAbEcdsaStrictRegistrationTopology;
+    explicitExport(input: {
+        readonly request: RouterAbEcdsaDerivationExplicitExportRequestV1;
+        readonly requestDigestB64u: string;
+        readonly authority: RouterAbEcdsaStrictExportAuthority;
+        readonly tenantRoot: RouterAbEcdsaRegistrationTenantRootV1;
+    }): Promise<RouterAbEcdsaStrictExportResult>;
+    refresh(input: {
+        readonly request: RouterAbEcdsaDerivationActivationRefreshCommitRequestV1;
+        readonly requestDigestB64u: string;
+        readonly authority: RouterAbEcdsaStrictRegistrationAuthority;
+        readonly tenantRoot: RouterAbEcdsaRegistrationTenantRootV1;
+    }): Promise<RouterAbEcdsaStrictRefreshResult>;
+}
+export type RouterAbEcdsaCeremonyTokenClaims = {
+    readonly subjectId: string;
+    readonly sessionId: string;
+    readonly orgId: string;
+    readonly projectId: string;
+    readonly environment: string;
+    readonly accountId: string;
+    readonly expiresAtMs: number;
+};
+export type RouterAbEcdsaEd25519CeremonyTokenIssuerConfig = {
+    readonly issuer: string;
+    readonly audience: string;
+    readonly keyId: string;
+    readonly privateJwk: RouterAbEcdsaEd25519PrivateJwk;
+};
+export type RouterAbEcdsaEd25519PrivateJwk = JsonWebKey & {
+    readonly kty: 'OKP';
+    readonly crv: 'Ed25519';
+    readonly x: string;
+    readonly d: string;
+};
+export interface RouterAbEcdsaCeremonyTokenIssuer {
+    issue(claims: RouterAbEcdsaCeremonyTokenClaims): Promise<string>;
+    issueRequest(claims: RouterAbEcdsaCeremonyTokenClaims, requestPolicy: RouterAbRequestPolicyClaimsInputV1): Promise<string>;
+    publicJwks(): {
+        readonly keys: readonly JsonWebKey[];
+    };
+}
+type StrictRegistrationForwarderConfig = {
+    readonly router: {
+        fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
+    };
+    readonly tokenIssuer: RouterAbEcdsaCeremonyTokenIssuer;
+    readonly tokenScope: {
+        readonly orgId: string;
+        readonly projectId: string;
+        readonly environment: string;
+    };
+    readonly topology: RouterAbEcdsaStrictRegistrationTopology;
+};
+export declare function parseStoredRouterAbEcdsaPendingActivationV1(value: unknown): RouterAbEcdsaPendingActivationV1;
+export declare function routerAbEcdsaStrictRegistrationRequestMatchesFacts(input: {
+    readonly request: RouterAbEcdsaRegistrationRequestV1;
+    readonly facts: RouterAbEcdsaRegistrationRequestFactsV1;
+}): boolean;
+export declare function routerAbEcdsaStrictRegistrationFactsBindingJson(facts: RouterAbEcdsaRegistrationRequestFactsV1): string;
+export declare function routerAbEcdsaStrictRegistrationRequestBindingJson(request: RouterAbEcdsaRegistrationRequestV1): string;
+export declare function createRouterAbEcdsaStrictRegistrationPort(config: StrictRegistrationForwarderConfig): RouterAbEcdsaStrictRegistrationPort;
+export declare function createRouterAbEcdsaStrictPostRegistrationPort(config: StrictRegistrationForwarderConfig): RouterAbEcdsaStrictPostRegistrationPort;
+export declare function createRouterAbEcdsaEd25519CeremonyTokenIssuer(config: RouterAbEcdsaEd25519CeremonyTokenIssuerConfig): RouterAbEcdsaCeremonyTokenIssuer;
+export declare function parseRouterAbEcdsaEd25519PrivateJwk(raw: unknown): RouterAbEcdsaEd25519PrivateJwk | null;
+export declare function parseRouterAbEcdsaStrictRegistrationTopology(raw: unknown): RouterAbEcdsaStrictRegistrationTopology | null;
+export {};
+//# sourceMappingURL=routerAbEcdsaStrictRegistration.d.ts.map

package/dist/types/wallet-server/src/router/domains/ecdsa/thresholdEcdsaRequestValidation.d.ts

@@ -0,0 +1,32 @@
+import { type RouterAbEcdsaOperationStepUpPreparationV1Wire } from '../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
+import { type RouterAbNormalSigningAuthorizationWire } from '../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
+import type { RouterAbEcdsaDerivationPoolFillInitRequest, RouterAbEcdsaDerivationPoolFillStepRequest } from '../../../core/types';
+export type ThresholdEcdsaRouteErrorBody = {
+    ok: false;
+    code: 'invalid_body';
+    message: string;
+};
+export type ThresholdEcdsaRouteParseResult<T> = {
+    ok: true;
+    request: T;
+} | {
+    ok: false;
+    body: ThresholdEcdsaRouteErrorBody;
+};
+export type RouterAbEcdsaPoolFillAuthorization = {
+    readonly authorization: Extract<RouterAbNormalSigningAuthorizationWire, {
+        readonly kind: 'reusable_wallet_session';
+    }>;
+    readonly operation?: never;
+} | {
+    readonly authorization: Extract<RouterAbNormalSigningAuthorizationWire, {
+        readonly kind: 'operation_step_up';
+    }>;
+    readonly operation: RouterAbEcdsaOperationStepUpPreparationV1Wire;
+};
+export type RouterAbEcdsaPoolFillInitRouteRequest = RouterAbEcdsaDerivationPoolFillInitRequest & RouterAbEcdsaPoolFillAuthorization;
+export type RouterAbEcdsaPoolFillStepRouteRequest = RouterAbEcdsaDerivationPoolFillStepRequest & RouterAbEcdsaPoolFillAuthorization;
+export declare function parseRouterAbEcdsaDerivationPoolFillInitRouteRequest(raw: unknown): ThresholdEcdsaRouteParseResult<RouterAbEcdsaPoolFillInitRouteRequest>;
+export declare function parseRouterAbEcdsaDerivationPoolFillStepRouteRequest(raw: unknown): ThresholdEcdsaRouteParseResult<RouterAbEcdsaPoolFillStepRouteRequest>;
+export declare function thresholdEcdsaRouteDiagnosticMetadata(raw: unknown, fields: readonly string[]): Record<string, string | undefined>;
+//# sourceMappingURL=thresholdEcdsaRequestValidation.d.ts.map

package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.d.ts

@@ -0,0 +1,172 @@
+import { type AddSignerIntentV1, type RegistrationNearEd25519SignerPlan, type WalletId, type RegistrationEd25519AuthorityScope } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import { type RouterAbEd25519YaoActivationAdmissionReceiptV1, type RouterAbEd25519YaoRegistrationAdmissionRequestV1 } from '../../../../../../shared-ts/src/utils/routerAbEd25519Yao';
+import { type RouterAbMpcMaterialActivationRefWire } from '../../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
+import type { RouterAbEd25519YaoActivationConsumerV1, RouterAbEd25519YaoActivationConsumptionRequestV1, RouterAbEd25519YaoActivationConsumptionResultV1, RouterAbEd25519YaoRegistrationServiceResult } from '../registration/routerAbEd25519YaoRegistration';
+import { InMemoryRouterAbEd25519YaoRegistrationStateV1, type RouterAbEd25519YaoRegistrationAuthorizationAdapter, type RouterAbEd25519YaoRegistrationService } from '../registration/routerAbEd25519YaoRegistration';
+import { InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationStateV1, type RouterAbEd25519YaoVerifiedActivationIntentV1, type RouterAbEd25519YaoRegistrationIntentBindingResult } from '../registration/routerAbEd25519YaoRegistrationIntentAuthorization';
+import { type RouterApiModule } from '../../../framework/modules';
+import type { MpcWalletSigningQuotaId, WalletSessionAuthorizationId, WalletSessionId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
+import type { ThresholdEd25519SessionId } from '../../../../../../shared-ts/src/utils/domainIds';
+import { type RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
+import type { WalletAuthAuthority } from '../../../../../../shared-ts/src/utils/walletAuthAuthority';
+import type { WalletSessionOperationCredentialV1 } from '../../../../../../shared-ts/src/device-linking';
+import type { WalletRegistrationEd25519YaoBootstrapSession } from '../../../../core/registrationContracts';
+import { InMemoryRouterAbEd25519YaoRecoveryStateV1, type RouterAbEd25519YaoActiveCapabilityLookupV1, type RouterAbEd25519YaoActiveCapabilityResolverV1, type RouterAbEd25519YaoPersistedActiveCapabilityInstallerV1, type RouterAbEd25519YaoRecoveryAuthorizationAdapter, type RouterAbEd25519YaoRecoveryService, type RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallerV1, type WarmBootstrapLinkedEd25519AuthorityReaderV1 } from '../recovery/routerAbEd25519YaoRecovery';
+import type { WalletEd25519YaoActiveCapabilityRecord } from '../../../../core/WalletStore';
+import { InMemoryRouterAbEd25519YaoExportStateV1, type RouterAbEd25519YaoExportAuthorizationAdapter, type RouterAbEd25519YaoExportService } from '../export/routerAbEd25519YaoExport';
+import type { DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
+/**
+ * How the Ed25519 Yao session response reaches its primary credential. A
+ * freshly issued exact session hands its plaintext credential over exactly
+ * once; a reused session has none to hand over.
+ */
+export type RouterAbEd25519YaoWalletSessionCredentialV1 = {
+    readonly kind: 'issued_exact_wallet_session';
+    readonly operationCredential: WalletSessionOperationCredentialV1;
+} | {
+    readonly kind: 'already_committed_exact_wallet_session';
+    readonly operationCredential?: never;
+};
+type RouterAbEd25519YaoWalletSessionMintIdentityV1 = {
+    readonly walletSessionCredential: RouterAbEd25519YaoWalletSessionCredentialV1;
+    readonly walletId: WalletId;
+    readonly nearAccountId: string;
+    readonly nearEd25519SigningKeyId: string;
+    readonly authority: WalletAuthAuthority;
+    readonly thresholdSessionId: ThresholdEd25519SessionId;
+    readonly authorizationId: WalletSessionAuthorizationId;
+    readonly walletSessionId: WalletSessionId;
+    readonly quotaId: MpcWalletSigningQuotaId;
+    readonly participantIds: readonly [number, number];
+    readonly runtimePolicyScope: RuntimePolicyScope;
+    /** Recorded on the signer record when registration verified this key set. */
+    readonly keyManifestDigestB64u: DigestB64u;
+};
+export type RouterAbEd25519YaoWalletSessionMintInputV1 = (RouterAbEd25519YaoWalletSessionMintIdentityV1 & {
+    readonly kind: 'verified_wallet_unlock_v1';
+    readonly ttlMs?: never;
+    readonly expiresAtMs: number;
+    readonly remainingUses: number;
+}) | (RouterAbEd25519YaoWalletSessionMintIdentityV1 & {
+    readonly kind: 'same_identity_budget_refresh_v1';
+    readonly expiresAtMs: number;
+    readonly remainingUses: number;
+});
+export type RouterAbEd25519YaoProductRegistrationRuntimeV1 = RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallerV1 & RouterAbEd25519YaoPersistedActiveCapabilityInstallerV1 & RouterAbEd25519YaoActiveCapabilityResolverV1 & {
+    readonly kind: 'router_ab_ed25519_yao_product_registration_runtime_v1';
+    readonly signingWorkerId: string;
+    bindAndAdmitVerifiedRegistration(input: RouterAbEd25519YaoVerifiedActivationIntentV1): Promise<RouterAbEd25519YaoVerifiedRegistrationAdmissionResultV1>;
+    bindVerifiedIntent(input: RouterAbEd25519YaoVerifiedActivationIntentV1): Promise<RouterAbEd25519YaoRegistrationIntentBindingResult>;
+    consumeActivated(request: RouterAbEd25519YaoActivationConsumptionRequestV1): Promise<RouterAbEd25519YaoActivationConsumptionResultV1>;
+};
+export type RouterAbEd25519YaoVerifiedRegistrationAdmissionResultV1 = Extract<RouterAbEd25519YaoRegistrationIntentBindingResult, {
+    readonly ok: false;
+}> | RouterAbEd25519YaoRegistrationServiceResult<RouterAbEd25519YaoActivationAdmissionReceiptV1<'registration'>>;
+export type RouterAbEd25519YaoProductRegistrationCompositionV1 = {
+    readonly kind: 'router_ab_ed25519_yao_product_registration_composition_v1';
+    readonly registrationService: RouterAbEd25519YaoProductRegistrationServicePortV1;
+    readonly authorization: RouterAbEd25519YaoProductRegistrationAuthorizationPortV1;
+    readonly recoveryService: RouterAbEd25519YaoProductRecoveryServicePortV1;
+    readonly recoveryAuthorization: RouterAbEd25519YaoRecoveryAuthorizationAdapter;
+    readonly exportService: RouterAbEd25519YaoExportService;
+    readonly exportAuthorization: RouterAbEd25519YaoExportAuthorizationAdapter;
+    readonly runtime: RouterAbEd25519YaoProductRegistrationRuntimeV1;
+    readonly module: RouterApiModule;
+};
+export interface RouterAbEd25519YaoProductRegistrationServicePortV1 extends RouterAbEd25519YaoRegistrationService, RouterAbEd25519YaoActivationConsumerV1 {
+}
+export interface RouterAbEd25519YaoProductRegistrationAuthorizationPortV1 extends RouterAbEd25519YaoRegistrationAuthorizationAdapter {
+    bindVerifiedIntent(input: RouterAbEd25519YaoVerifiedActivationIntentV1): Promise<RouterAbEd25519YaoRegistrationIntentBindingResult>;
+}
+export interface RouterAbEd25519YaoProductRecoveryServicePortV1 extends RouterAbEd25519YaoRecoveryService, RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallerV1, RouterAbEd25519YaoPersistedActiveCapabilityInstallerV1, RouterAbEd25519YaoActiveCapabilityResolverV1 {
+}
+export type RouterAbEd25519YaoProductRegistrationPortsV1 = {
+    readonly signingWorkerId: string;
+    readonly registrationService: RouterAbEd25519YaoProductRegistrationServicePortV1;
+    readonly authorization: RouterAbEd25519YaoProductRegistrationAuthorizationPortV1;
+    readonly recoveryService: RouterAbEd25519YaoProductRecoveryServicePortV1;
+    readonly capabilities: RouterAbEd25519YaoActiveCapabilityResolverV1;
+    readonly recoveryAuthorization: RouterAbEd25519YaoRecoveryAuthorizationAdapter;
+    readonly exportService: RouterAbEd25519YaoExportService;
+    readonly exportAuthorization: RouterAbEd25519YaoExportAuthorizationAdapter;
+    readonly linkedAuthorities?: (() => WarmBootstrapLinkedEd25519AuthorityReaderV1 | null) | null;
+};
+export type RouterAbEd25519YaoProductRegistrationStateV1 = {
+    readonly kind: 'router_ab_ed25519_yao_product_registration_state_v1';
+    readonly registration: InMemoryRouterAbEd25519YaoRegistrationStateV1;
+    readonly authorization: InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationStateV1;
+    readonly recovery: InMemoryRouterAbEd25519YaoRecoveryStateV1;
+    readonly export: InMemoryRouterAbEd25519YaoExportStateV1;
+};
+export declare function createRouterAbEd25519YaoProductRegistrationStateV1(): RouterAbEd25519YaoProductRegistrationStateV1;
+export declare function createRouterAbEd25519YaoProductRegistrationStateFromPartsV1(input: {
+    readonly registration: InMemoryRouterAbEd25519YaoRegistrationStateV1;
+    readonly authorization: InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationStateV1;
+    readonly recovery: InMemoryRouterAbEd25519YaoRecoveryStateV1;
+    readonly export: InMemoryRouterAbEd25519YaoExportStateV1;
+}): RouterAbEd25519YaoProductRegistrationStateV1;
+export type RouterAbEd25519YaoProductRegistrationStateParseResultV1 = {
+    readonly ok: true;
+    readonly value: RouterAbEd25519YaoProductRegistrationStateV1;
+} | {
+    readonly ok: false;
+    readonly message: string;
+};
+export declare function parseRouterAbEd25519YaoProductRegistrationStateV1(input: unknown): RouterAbEd25519YaoProductRegistrationStateParseResultV1;
+export declare function createRouterAbEd25519YaoProductRegistrationCompositionFromPortsV1(input: RouterAbEd25519YaoProductRegistrationPortsV1): RouterAbEd25519YaoProductRegistrationCompositionV1;
+/**
+ * Projects the Ed25519 Yao view of one exact Wallet Session. Issuance itself
+ * belongs to the direct V2 issuer, which commits the authorization, quota, and
+ * primary credential digest together; this only carries the credential that
+ * issuer already returned, so a replay reaches this code with none to carry.
+ */
+export declare function projectRouterAbEd25519YaoExactWalletSession(input: {
+    readonly signingWorkerId: string;
+    readonly sessionInput: RouterAbEd25519YaoWalletSessionMintInputV1;
+}): Promise<WalletRegistrationEd25519YaoBootstrapSession>;
+export declare function createRouterAbEd25519YaoProductRegistrationRuntimeV1(input: {
+    readonly signingWorkerId: string;
+    readonly registrationService: RouterAbEd25519YaoProductRegistrationServicePortV1;
+    readonly authorization: RouterAbEd25519YaoProductRegistrationAuthorizationPortV1;
+    readonly capabilityInstaller: RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallerV1 & RouterAbEd25519YaoPersistedActiveCapabilityInstallerV1;
+    readonly capabilityResolver: RouterAbEd25519YaoActiveCapabilityResolverV1;
+}): RouterAbEd25519YaoProductRegistrationRuntimeV1;
+export declare function routerAbEd25519YaoPersistedCapabilityMatchesLookupV1(capability: WalletEd25519YaoActiveCapabilityRecord, lookup: RouterAbEd25519YaoActiveCapabilityLookupV1): boolean;
+/**
+ * Mints the explicit material identity at the registration boundary. None of
+ * its fields are derived from a wallet-session or ceremony identifier.
+ */
+export declare function createRouterAbEd25519YaoMaterialActivationRefV1(input: {
+    readonly walletId: WalletId;
+    readonly signingWorkerId: string;
+}): RouterAbMpcMaterialActivationRefWire;
+/**
+ * Takes the authority *scope* rather than the authority because setup admits
+ * before the proof exists (Refactor 94C). Callers holding a verified authority
+ * pass `registrationEd25519AuthorityScopeFromAuthority(authority)`; setup
+ * passes the scope derived from the requested auth method, and only when that
+ * derivation is complete without a proof.
+ */
+export declare function buildRouterAbEd25519YaoProductAdmissionRequestV1(input: {
+    readonly registrationCeremonyId: string;
+    readonly walletId: WalletId;
+    readonly signingRootId: string;
+    readonly signingRootVersion: string;
+    readonly authorityScope: RegistrationEd25519AuthorityScope;
+    readonly branch: RegistrationNearEd25519SignerPlan;
+    readonly signingWorkerId: string;
+    readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
+}): Promise<RouterAbEd25519YaoRegistrationAdmissionRequestV1>;
+export declare function buildRouterAbEd25519YaoAddSignerAdmissionRequestV1(input: {
+    readonly addSignerCeremonyId: string;
+    readonly walletId: WalletId;
+    readonly signingRootId: string;
+    readonly signingRootVersion: string;
+    readonly selection: Extract<AddSignerIntentV1['signerSelection'], {
+        mode: 'ed25519';
+    }>;
+    readonly signingWorkerId: string;
+    readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
+}): Promise<RouterAbEd25519YaoRegistrationAdmissionRequestV1>;
+export {};
+//# sourceMappingURL=routerAbEd25519YaoProductRegistration.d.ts.map

package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.typecheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=routerAbEd25519YaoProductRegistration.typecheck.d.ts.map

package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore.d.ts

@@ -0,0 +1,156 @@
+import type { VersionedJsonObject, VersionedJsonRecordPutResult, VersionedJsonRecordReadResult } from '../../../framework/versionedJsonRecordStore';
+import type { RouterAbEd25519YaoActivationConsumptionRequestV1, RouterAbEd25519YaoActivationConsumptionResultV1, RouterAbEd25519YaoRegistrationFailure } from '../registration/routerAbEd25519YaoRegistration';
+import { type RouterAbEd25519YaoRegistrationExecutionRecordV1 } from '../registration/routerAbEd25519YaoRegistrationExecutionRecord';
+import type { RouterAbEd25519YaoProductRegistrationStateV1 } from './routerAbEd25519YaoProductRegistration';
+import { type RouterAbEd25519YaoProductRegistrationCeremonyStateV1, type RouterAbEd25519YaoProductRegistrationSharedStateV1 } from './routerAbEd25519YaoProductRegistrationPartitioning';
+export declare const ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1 = "router-ab-ed25519-yao:shared";
+declare const SHARED_RECORD_KIND = "router_ab_ed25519_yao_product_registration_shared_record_v1";
+declare const CEREMONY_RECORD_KIND = "router_ab_ed25519_yao_product_registration_ceremony_record_v1";
+declare const EXECUTION_RECORD_KIND = "router_ab_ed25519_yao_registration_execution_record_v1";
+export type RouterAbEd25519YaoProductRegistrationPartitionRecordV1 = {
+    readonly kind: typeof SHARED_RECORD_KIND;
+    readonly value: RouterAbEd25519YaoProductRegistrationSharedStateV1;
+} | {
+    readonly kind: typeof CEREMONY_RECORD_KIND;
+    readonly lifecycleId: string;
+    readonly value: RouterAbEd25519YaoProductRegistrationCeremonyStateV1;
+} | {
+    readonly kind: typeof EXECUTION_RECORD_KIND;
+    readonly lifecycleId: string;
+    readonly value: RouterAbEd25519YaoRegistrationExecutionRecordV1;
+};
+export type RouterAbEd25519YaoProductRegistrationPartitionMutationV1 = {
+    readonly key: string;
+    readonly value: VersionedJsonObject;
+    readonly expectedVersion: string | null;
+};
+export type RouterAbEd25519YaoProductRegistrationPartitionBatchResultV1 = {
+    readonly kind: 'stored';
+    readonly versions: readonly {
+        readonly key: string;
+        readonly version: string;
+    }[];
+} | {
+    readonly kind: 'version_mismatch';
+    readonly key: string;
+};
+export type RouterAbEd25519YaoProductRegistrationPartitionRecordStoreV1 = {
+    readonly readMany: (keys: readonly string[]) => Promise<readonly {
+        readonly key: string;
+        readonly result: VersionedJsonRecordReadResult<VersionedJsonObject>;
+    }[]>;
+    readonly putMany: (mutations: readonly RouterAbEd25519YaoProductRegistrationPartitionMutationV1[]) => Promise<RouterAbEd25519YaoProductRegistrationPartitionBatchResultV1>;
+};
+export type RouterAbEd25519YaoProductRegistrationPartitionedStateV1 = {
+    readonly state: RouterAbEd25519YaoProductRegistrationStateV1;
+    readonly baseline: {
+        readonly sharedEncoding: RouterAbEd25519YaoSharedStateCanonicalEncodingV1;
+        readonly sharedVersion: string | null;
+        readonly ceremonyVersion: string | null;
+        readonly executionVersion: string | null;
+    };
+};
+export type RouterAbEd25519YaoSharedStateCanonicalEncodingV1 = VersionedJsonObject;
+export type RouterAbEd25519YaoProductRegistrationPartitionedStateCommitInputV1 = {
+    readonly lifecycleId: string;
+    readonly state: RouterAbEd25519YaoProductRegistrationStateV1;
+    readonly baseline: {
+        readonly sharedEncoding: RouterAbEd25519YaoSharedStateCanonicalEncodingV1;
+        readonly sharedVersion: string | null;
+        readonly ceremonyVersion: string | null;
+        readonly executionVersion: string | null;
+    };
+};
+export type RouterAbEd25519YaoProductRegistrationPartitionedStateCommitResultV1 = {
+    readonly kind: 'stored';
+    readonly sharedVersion: string | null;
+    readonly ceremonyVersion: string;
+    readonly executionVersion: string | null;
+} | {
+    readonly kind: 'version_mismatch';
+    readonly key: 'shared' | 'ceremony' | 'execution';
+};
+type ExecuteRequest = Extract<RouterAbEd25519YaoRegistrationExecutionRecordV1, {
+    readonly kind: 'claimed';
+}>['request'];
+type ActivationResult = Extract<RouterAbEd25519YaoRegistrationExecutionRecordV1, {
+    readonly kind: 'completed';
+}>['result'];
+export type RouterAbEd25519YaoRegistrationExecutionClaimResultV1 = {
+    readonly kind: 'claimed';
+    readonly value: Extract<RouterAbEd25519YaoRegistrationExecutionRecordV1, {
+        readonly kind: 'claimed';
+    }>;
+    readonly version: string;
+} | {
+    readonly kind: 'completed';
+    readonly value: ActivationResult;
+} | {
+    readonly kind: 'failed';
+    readonly value: RouterAbEd25519YaoRegistrationFailure;
+} | {
+    readonly kind: 'rejected';
+    readonly code: 'unknown_registration' | 'binding_mismatch' | 'credential_rejected' | 'credential_expired' | 'execution_in_progress';
+    readonly message: string;
+};
+export type RouterAbEd25519YaoRegistrationExecutionCommitResultV1 = {
+    readonly kind: 'stored';
+    readonly value: ActivationResult | RouterAbEd25519YaoRegistrationFailure;
+} | {
+    readonly kind: 'uncertain';
+};
+export interface RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1 {
+    load(lifecycleId: string): Promise<RouterAbEd25519YaoProductRegistrationPartitionedStateV1>;
+    commit(input: RouterAbEd25519YaoProductRegistrationPartitionedStateCommitInputV1): Promise<RouterAbEd25519YaoProductRegistrationPartitionedStateCommitResultV1>;
+    claimRegistrationExecution(input: {
+        readonly lifecycleId: string;
+        readonly request: ExecuteRequest;
+        readonly requestDigestSha256Hex: string;
+        readonly credentialDigestSha256Hex: string;
+        readonly nowMs: number;
+    }): Promise<RouterAbEd25519YaoRegistrationExecutionClaimResultV1>;
+    commitRegistrationExecution(input: {
+        readonly claimed: Extract<RouterAbEd25519YaoRegistrationExecutionRecordV1, {
+            readonly kind: 'claimed';
+        }>;
+        readonly claimedVersion: string;
+        readonly outcome: {
+            readonly kind: 'completed';
+            readonly result: ActivationResult;
+        } | {
+            readonly kind: 'failed';
+            readonly failure: RouterAbEd25519YaoRegistrationFailure;
+        };
+    }): Promise<RouterAbEd25519YaoRegistrationExecutionCommitResultV1>;
+    consumeRegistrationExecution(input: RouterAbEd25519YaoActivationConsumptionRequestV1): Promise<RouterAbEd25519YaoActivationConsumptionResultV1>;
+}
+export declare function routerAbEd25519YaoPartitionedStateAfterStoredCommitV1(input: {
+    readonly lifecycleId: string;
+    readonly state: RouterAbEd25519YaoProductRegistrationStateV1;
+    readonly commit: Extract<RouterAbEd25519YaoProductRegistrationPartitionedStateCommitResultV1, {
+        readonly kind: 'stored';
+    }>;
+}): RouterAbEd25519YaoProductRegistrationPartitionedStateV1;
+export declare function createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1(store: RouterAbEd25519YaoProductRegistrationPartitionRecordStoreV1, atomicPatch?: AtomicPatch): RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1;
+export declare function encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1(record: RouterAbEd25519YaoProductRegistrationPartitionRecordV1): VersionedJsonObject;
+export declare function sameRouterAbEd25519YaoSharedStateCanonicalEncodingV1(left: RouterAbEd25519YaoSharedStateCanonicalEncodingV1, right: RouterAbEd25519YaoSharedStateCanonicalEncodingV1): boolean;
+export declare function parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1(input: unknown): RouterAbEd25519YaoProductRegistrationPartitionRecordV1 | null;
+/** The host-neutral adapter carries only validated encoded JSON objects. */
+export declare function parseRouterAbEd25519YaoProductRegistrationPartitionRecordJsonV1(input: unknown): VersionedJsonObject | null;
+type AtomicPatch = (input: {
+    readonly key: string;
+    readonly expectedVersion: string;
+    readonly exactStringPredicates: readonly {
+        readonly jsonPath: string;
+        readonly value: string;
+    }[];
+    readonly unexpired: {
+        readonly jsonPath: string;
+        readonly nowMs: number;
+    };
+    readonly patch: VersionedJsonObject;
+}) => Promise<VersionedJsonRecordPutResult & {
+    readonly value?: VersionedJsonObject;
+}>;
+export {};
+//# sourceMappingURL=routerAbEd25519YaoProductRegistrationPartitionedStateStore.d.ts.map

package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitioning.d.ts

@@ -0,0 +1,59 @@
+import type { InMemoryRouterAbEd25519YaoRegistrationStateV1, RouterAbEd25519YaoRegistrationAdmissionClaimV1 } from '../registration/routerAbEd25519YaoRegistration';
+import type { InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationStateV1 } from '../registration/routerAbEd25519YaoRegistrationIntentAuthorization';
+import type { InMemoryRouterAbEd25519YaoRecoveryStateV1 } from '../recovery/routerAbEd25519YaoRecovery';
+import type { InMemoryRouterAbEd25519YaoExportStateV1 } from '../export/routerAbEd25519YaoExport';
+import { type RouterAbEd25519YaoProductRegistrationStateV1 } from './routerAbEd25519YaoProductRegistration';
+type MapValue<T> = T extends Map<string, infer Value> ? Value : never;
+type RegistrationLifecycleState = MapValue<InMemoryRouterAbEd25519YaoRegistrationStateV1['states']>;
+type RegistrationAdmissionClaim = RouterAbEd25519YaoRegistrationAdmissionClaimV1;
+type RegistrationIntentAuthority = InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationStateV1['authorities'][number];
+type RecoveryCapabilityState = MapValue<InMemoryRouterAbEd25519YaoRecoveryStateV1['capabilities']>;
+type RecoveryLifecycleState = MapValue<InMemoryRouterAbEd25519YaoRecoveryStateV1['recoveries']>;
+type ExportLifecycleState = MapValue<InMemoryRouterAbEd25519YaoExportStateV1['exports']>;
+export type RouterAbEd25519YaoProductRegistrationSharedStateV1 = {
+    readonly kind: 'router_ab_ed25519_yao_product_registration_shared_state_v1';
+    readonly recoveryCapabilities: ReadonlyMap<string, RecoveryCapabilityState>;
+    readonly recoveryIdentityCapabilities: ReadonlyMap<string, string>;
+    readonly recoverySessions: ReadonlyMap<string, string>;
+    readonly exportAuthorizationNonces: ReadonlySet<string>;
+    readonly exportAuthorizationUncertain: ReadonlySet<string>;
+};
+export type RouterAbEd25519YaoProductRegistrationCeremonyStateV1 = {
+    readonly kind: 'router_ab_ed25519_yao_product_registration_ceremony_state_v1';
+    readonly lifecycleId: string;
+    readonly registration: {
+        readonly states: ReadonlyMap<string, RegistrationLifecycleState>;
+        readonly lifecycleSessions: ReadonlyMap<string, string>;
+        readonly admissionClaims: ReadonlyMap<string, RegistrationAdmissionClaim>;
+    };
+    readonly authorization: {
+        readonly authorities: readonly RegistrationIntentAuthority[];
+    };
+    readonly recovery: {
+        readonly recoveries: ReadonlyMap<string, RecoveryLifecycleState>;
+    };
+    readonly export: {
+        readonly exports: ReadonlyMap<string, ExportLifecycleState>;
+    };
+};
+export type RouterAbEd25519YaoProductRegistrationStatePartitionV1 = {
+    readonly kind: 'router_ab_ed25519_yao_product_registration_state_partition_v1';
+    readonly lifecycleId: string;
+    readonly shared: RouterAbEd25519YaoProductRegistrationSharedStateV1;
+    readonly ceremony: RouterAbEd25519YaoProductRegistrationCeremonyStateV1;
+};
+/**
+ * Projects the tenant-wide state into shared and lifecycle-owned records.
+ * Capability ownership and export nonce replay state deliberately stay in the
+ * shared record; only lifecycle-indexed entries enter the ceremony record.
+ */
+export declare function partitionRouterAbEd25519YaoProductRegistrationStateV1(state: RouterAbEd25519YaoProductRegistrationStateV1, lifecycleId: string): RouterAbEd25519YaoProductRegistrationStatePartitionV1;
+/**
+ * Applies one request's partition back onto a complete snapshot. Existing
+ * lifecycle entries are replaced while unrelated ceremonies and all shared
+ * records remain intact.
+ */
+export declare function mergeRouterAbEd25519YaoProductRegistrationStatePartitionV1(base: RouterAbEd25519YaoProductRegistrationStateV1, partition: RouterAbEd25519YaoProductRegistrationStatePartitionV1): RouterAbEd25519YaoProductRegistrationStateV1;
+export declare function boundedRouterAbEd25519YaoProductRegistrationSharedStateV1(source: RouterAbEd25519YaoProductRegistrationSharedStateV1): RouterAbEd25519YaoProductRegistrationSharedStateV1;
+export {};
+//# sourceMappingURL=routerAbEd25519YaoProductRegistrationPartitioning.d.ts.map