@seams/wallet-server 0.5.0

package/dist/types/wallet-server/src/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery.d.ts

@@ -0,0 +1,509 @@
+import { type RouterAbEd25519YaoActivationAdmissionReceiptV1, type RouterAbEd25519YaoActivationBindingV1, type RouterAbEd25519YaoActivationExecuteRequestV1, type RouterAbEd25519YaoActivationResultV1, type RouterAbEd25519YaoApplicationBindingFactsV1, type RouterAbEd25519YaoBytes32V1, type RouterAbEd25519YaoCeremonyBindingV1, type RouterAbEd25519YaoRecoveryActivationReceiptV1, type RouterAbEd25519YaoRecoveryActivationRequestV1, type RouterAbEd25519YaoRecoveryAdmissionRequestV1, type RouterAbEd25519YaoRegistrationAdmissionRequestV1, type RouterAbEd25519YaoWarmRecoveryBootstrapRequestV1 } from '../../../../../../shared-ts/src/utils/routerAbEd25519Yao';
+import { type RouterAbTraceContextV1 } from '../../../../../../shared-ts/src/utils/routerAbTraceContext';
+import { type RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
+import { type RouterAbEd25519NormalSigningState } from '../../../../../../shared-ts/src/utils/signingSessionSeal';
+import { type RouterApiModule } from '../../../framework/modules';
+import type { RouterApiWalletSessionAuthorizationV2AdmissionContext, RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext } from '../../../framework/authServicePort';
+import type { RouterAbEd25519YaoRecoveryExecuteAdmissionContextV1 } from '../routerAbEd25519YaoGatewayEnvelope';
+import type { WalletEd25519YaoActiveCapabilityRecord } from '../../../../core/WalletStore';
+import { type MpcMaterialActivationRef, type ThresholdEd25519SessionId } from '../../../../../../shared-ts/src/utils/domainIds';
+import { type RouterAbMpcMaterialActivationRefWire } from '../../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
+type RecoveryAdmissionReceipt = RouterAbEd25519YaoActivationAdmissionReceiptV1<'recovery'>;
+type RecoveryExecuteRequest = RouterAbEd25519YaoActivationExecuteRequestV1<'recovery'>;
+type RecoveryExecutionResult = RouterAbEd25519YaoActivationResultV1<'recovery'>;
+type RegistrationResult = RouterAbEd25519YaoActivationResultV1<'registration'>;
+export type RouterAbEd25519YaoRecoveryFailureCode = 'invalid_request' | 'invalid_backend_response' | 'admission_failed' | 'admission_in_progress' | 'unknown_recovery' | 'binding_mismatch' | 'execution_in_progress' | 'execution_failed' | 'ceremony_expired' | 'recovery_not_staged' | 'activation_in_progress' | 'activation_failed' | 'unknown_capability' | 'capability_suspended' | 'capability_retired' | 'capability_conflict' | 'continuity_mismatch' | 'stale_epoch';
+export type RouterAbEd25519YaoRecoveryFailure = {
+    readonly ok: false;
+    readonly status: 400 | 404 | 408 | 409 | 429 | 500 | 502 | 503;
+    readonly code: RouterAbEd25519YaoRecoveryFailureCode;
+    readonly message: string;
+};
+export type RouterAbEd25519YaoRecoveryServiceResult<T> = {
+    readonly ok: true;
+    readonly status: 200;
+    readonly value: T;
+} | RouterAbEd25519YaoRecoveryFailure;
+export type RouterAbEd25519YaoRecoveryBackendFailure = {
+    readonly ok: false;
+    readonly status: 400 | 408 | 409 | 429 | 500 | 502 | 503;
+    readonly code: string;
+    readonly message: string;
+};
+export type RouterAbEd25519YaoRecoveryBackendResult = {
+    readonly ok: true;
+    readonly body: unknown;
+} | RouterAbEd25519YaoRecoveryBackendFailure;
+export type RouterAbEd25519YaoRecoveryAuthorityProjectionV1 = {
+    readonly kind: 'replace_continuity_authority_projections';
+} | {
+    readonly kind: 'replace_active_authority_projection';
+};
+export type RouterAbEd25519YaoRecoveryAuthorizationBindingV1 = {
+    readonly kind: 'wallet_recovery';
+    readonly walletId: string;
+} | {
+    readonly kind: 'wallet_session_v2';
+    readonly tenantId: RouterApiWalletSessionAuthorizationV2AdmissionContext['authorization']['session']['tenantId'];
+    readonly principalId: RouterApiWalletSessionAuthorizationV2AdmissionContext['authorization']['session']['principalId'];
+    readonly walletId: RouterApiWalletSessionAuthorizationV2AdmissionContext['authorization']['session']['walletId'];
+    readonly authorityId: RouterApiWalletSessionAuthorizationV2AdmissionContext['authorization']['session']['authorityId'];
+    readonly walletAuthMethodId: RouterApiWalletSessionAuthorizationV2AdmissionContext['authorization']['session']['walletAuthMethodId'];
+    readonly mintId: RouterApiWalletSessionAuthorizationV2AdmissionContext['authorization']['session']['mintId'];
+    readonly authorizationId: RouterApiWalletSessionAuthorizationV2AdmissionContext['authorization']['session']['authorizationId'];
+    readonly walletSessionId: RouterApiWalletSessionAuthorizationV2AdmissionContext['authorization']['session']['walletSessionId'];
+    readonly quotaId: RouterApiWalletSessionAuthorizationV2AdmissionContext['authorization']['session']['quotaId'];
+};
+export interface RouterAbEd25519YaoRecoveryBackend {
+    admitRecovery(request: RouterAbEd25519YaoRecoveryAdmissionRequestV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRecoveryBackendResult> | RouterAbEd25519YaoRecoveryBackendResult;
+    executeRecovery(request: RecoveryExecuteRequest, admissionRequest: RouterAbEd25519YaoRecoveryExecuteAdmissionContextV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRecoveryBackendResult> | RouterAbEd25519YaoRecoveryBackendResult;
+    activateRecovery(request: RouterAbEd25519YaoRecoveryActivationRequestV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRecoveryBackendResult> | RouterAbEd25519YaoRecoveryBackendResult;
+}
+export interface RouterAbEd25519YaoRecoveryService {
+    admitRecovery(request: RouterAbEd25519YaoRecoveryAdmissionRequestV1, authorization: RouterAbEd25519YaoRecoveryAuthorizationBindingV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRecoveryServiceResult<RecoveryAdmissionReceipt>>;
+    executeRecovery(request: RecoveryExecuteRequest, authorization: RouterAbEd25519YaoRecoveryAuthorizationBindingV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRecoveryServiceResult<RecoveryExecutionResult>>;
+    activateRecovery(request: RouterAbEd25519YaoRecoveryActivationRequestV1, authorization: RouterAbEd25519YaoRecoveryAuthorizationBindingV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRecoveryServiceResult<RouterAbEd25519YaoRecoveryActivationReceiptV1>>;
+}
+export type RouterAbEd25519YaoRecoveryAdmissionClaimV1 = {
+    readonly kind: 'router_ab_ed25519_yao_recovery_admission_claim_v1';
+    readonly lifecycleId: string;
+    readonly recoveryKey: string;
+};
+export type RouterAbEd25519YaoRecoveryAdmissionPreparationV1 = {
+    readonly kind: 'claimed';
+    readonly claim: RouterAbEd25519YaoRecoveryAdmissionClaimV1;
+} | {
+    readonly kind: 'completed';
+    readonly value: RecoveryAdmissionReceipt;
+} | {
+    readonly kind: 'failed';
+    readonly failure: RouterAbEd25519YaoRecoveryFailure;
+};
+export type RouterAbEd25519YaoRecoveryAdmissionCommitInputV1 = {
+    readonly request: RouterAbEd25519YaoRecoveryAdmissionRequestV1;
+    readonly claim: RouterAbEd25519YaoRecoveryAdmissionClaimV1;
+    readonly outcome: {
+        readonly kind: 'backend_response';
+        readonly result: RouterAbEd25519YaoRecoveryBackendResult;
+    };
+};
+export interface RouterAbEd25519YaoRecoveryAdmissionBoundaryV1 {
+    prepareAdmitRecovery(request: RouterAbEd25519YaoRecoveryAdmissionRequestV1, authorization: RouterAbEd25519YaoRecoveryAuthorizationBindingV1): RouterAbEd25519YaoRecoveryAdmissionPreparationV1;
+    commitAdmitRecovery(input: RouterAbEd25519YaoRecoveryAdmissionCommitInputV1): RouterAbEd25519YaoRecoveryServiceResult<RecoveryAdmissionReceipt>;
+}
+export type RouterAbEd25519YaoRecoveryExecuteClaimV1 = {
+    readonly kind: 'router_ab_ed25519_yao_recovery_execute_claim_v1';
+    readonly lifecycleId: string;
+    readonly recoveryKey: string;
+    readonly sessionId: string;
+    readonly executeFingerprint: string;
+    readonly admissionRequest: RouterAbEd25519YaoRecoveryExecuteAdmissionContextV1;
+};
+export type RouterAbEd25519YaoRecoveryExecutePreparationV1 = {
+    readonly kind: 'claimed';
+    readonly claim: RouterAbEd25519YaoRecoveryExecuteClaimV1;
+} | {
+    readonly kind: 'completed';
+    readonly value: RecoveryExecutionResult;
+} | {
+    readonly kind: 'failed';
+    readonly failure: RouterAbEd25519YaoRecoveryFailure;
+};
+export type RouterAbEd25519YaoRecoveryExecuteCommitInputV1 = {
+    readonly request: RecoveryExecuteRequest;
+    readonly claim: RouterAbEd25519YaoRecoveryExecuteClaimV1;
+    readonly outcome: {
+        readonly kind: 'backend_response';
+        readonly result: RouterAbEd25519YaoRecoveryBackendResult;
+    };
+};
+export interface RouterAbEd25519YaoRecoveryExecuteBoundaryV1 {
+    prepareExecuteRecovery(request: RecoveryExecuteRequest, authorization: RouterAbEd25519YaoRecoveryAuthorizationBindingV1): RouterAbEd25519YaoRecoveryExecutePreparationV1;
+    commitExecuteRecovery(input: RouterAbEd25519YaoRecoveryExecuteCommitInputV1): RouterAbEd25519YaoRecoveryServiceResult<RecoveryExecutionResult>;
+}
+export type RouterAbEd25519YaoRecoveryActivationClaimV1 = {
+    readonly kind: 'router_ab_ed25519_yao_recovery_activation_claim_v1';
+    readonly lifecycleId: string;
+    readonly recoveryKey: string;
+    readonly sessionId: string;
+    readonly activationFingerprint: string;
+    readonly authorityProjection: RouterAbEd25519YaoRecoveryAuthorityProjectionV1;
+    readonly disposition: 'initial' | 'reconciliation';
+};
+export type RouterAbEd25519YaoRecoveryActivationPreparationV1 = {
+    readonly kind: 'claimed';
+    readonly claim: RouterAbEd25519YaoRecoveryActivationClaimV1;
+} | {
+    readonly kind: 'completed';
+    readonly value: RouterAbEd25519YaoRecoveryActivationReceiptV1;
+} | {
+    readonly kind: 'failed';
+    readonly failure: RouterAbEd25519YaoRecoveryFailure;
+};
+export type RouterAbEd25519YaoRecoveryActivationCommitInputV1 = {
+    readonly request: RouterAbEd25519YaoRecoveryActivationRequestV1;
+    readonly claim: RouterAbEd25519YaoRecoveryActivationClaimV1;
+    readonly outcome: {
+        readonly kind: 'backend_response';
+        readonly result: RouterAbEd25519YaoRecoveryBackendResult;
+    };
+};
+export type RouterAbEd25519YaoRecoveryActivationCommitResultV1 = {
+    readonly kind: 'completed';
+    readonly value: RouterAbEd25519YaoRecoveryServiceResult<RouterAbEd25519YaoRecoveryActivationReceiptV1>;
+} | {
+    readonly kind: 'uncertain';
+    readonly failure: RouterAbEd25519YaoRecoveryFailure;
+};
+export interface RouterAbEd25519YaoRecoveryActivationBoundaryV1 {
+    prepareActivateRecovery(request: RouterAbEd25519YaoRecoveryActivationRequestV1, authorization: RouterAbEd25519YaoRecoveryAuthorizationBindingV1): RouterAbEd25519YaoRecoveryActivationPreparationV1;
+    commitActivateRecovery(input: RouterAbEd25519YaoRecoveryActivationCommitInputV1): Promise<RouterAbEd25519YaoRecoveryActivationCommitResultV1>;
+}
+export type RouterAbEd25519YaoRecoveryAuthorizationInput = {
+    readonly kind: 'bootstrap';
+    readonly request: Request;
+    readonly body: RouterAbEd25519YaoWarmRecoveryBootstrapRequestV1;
+} | {
+    readonly kind: 'admit';
+    readonly request: Request;
+    readonly body: RouterAbEd25519YaoRecoveryAdmissionRequestV1;
+} | {
+    readonly kind: 'execute';
+    readonly request: Request;
+    readonly body: RecoveryExecuteRequest;
+} | {
+    readonly kind: 'activate';
+    readonly request: Request;
+    readonly body: RouterAbEd25519YaoRecoveryActivationRequestV1;
+};
+export type RouterAbEd25519YaoRecoveryAuthorizationResult = {
+    readonly ok: true;
+    readonly authorization: {
+        readonly kind: 'wallet_session_v2';
+        readonly context: RouterApiWalletSessionAuthorizationV2AdmissionContext;
+    } | {
+        readonly kind: 'wallet_session_v2_exhausted_candidate';
+        readonly context: RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext;
+    } | {
+        readonly kind: 'wallet_recovery';
+        readonly walletId: string;
+    };
+} | {
+    readonly ok: false;
+    readonly status: 401 | 403 | 409 | 429 | 503;
+    readonly code: string;
+    readonly message: string;
+};
+export declare function recoveryAuthorizationBinding(authorization: Extract<RouterAbEd25519YaoRecoveryAuthorizationResult, {
+    readonly ok: true;
+}>['authorization']): RouterAbEd25519YaoRecoveryAuthorizationBindingV1;
+type WarmBootstrapWalletSessionContext = {
+    readonly session: RouterApiWalletSessionAuthorizationV2AdmissionContext['authorization']['session'];
+    readonly quota: RouterApiWalletSessionAuthorizationV2AdmissionContext['authorization']['quota'] | RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext['status']['quota'];
+    readonly authority: RouterApiWalletSessionAuthorizationV2AdmissionContext['authority'];
+    readonly authMethod: RouterApiWalletSessionAuthorizationV2AdmissionContext['authMethod'];
+};
+export declare function recoveryAuthorityProjection(authorization: RouterAbEd25519YaoRecoveryAuthorizationBindingV1): RouterAbEd25519YaoRecoveryAuthorityProjectionV1;
+export interface RouterAbEd25519YaoRecoveryAuthorizationAdapter {
+    authorize(input: RouterAbEd25519YaoRecoveryAuthorizationInput): Promise<RouterAbEd25519YaoRecoveryAuthorizationResult> | RouterAbEd25519YaoRecoveryAuthorizationResult;
+}
+export type RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallationV1 = {
+    readonly kind: 'router_ab_ed25519_yao_registration_finalize_capability_v1';
+    readonly activeCapabilityBinding: RouterAbEd25519YaoBytes32V1;
+    readonly nearAccountId: string;
+    readonly registrationAdmissionRequest: RouterAbEd25519YaoRegistrationAdmissionRequestV1;
+    readonly registrationAdmissionReceipt: RouterAbEd25519YaoActivationAdmissionReceiptV1<'registration'>;
+    readonly registrationResult: RegistrationResult;
+    readonly runtimePolicyScope: RuntimePolicyScope;
+};
+export type RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallResultV1 = {
+    readonly ok: true;
+    readonly disposition: 'installed' | 'exact_retry';
+    readonly activeCapabilityBinding: RouterAbEd25519YaoBytes32V1;
+    readonly registeredPublicKey: RouterAbEd25519YaoBytes32V1;
+    readonly stateEpoch: number;
+} | {
+    readonly ok: false;
+    readonly code: 'invalid_installation' | 'capability_conflict' | 'capability_retired';
+    readonly message: string;
+};
+export interface RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallerV1 {
+    installRegistrationFinalizeCapability(input: RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallationV1): Promise<RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallResultV1> | RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallResultV1;
+}
+export interface RouterAbEd25519YaoPersistedActiveCapabilityInstallerV1 {
+    installPersistedActiveCapability(input: WalletEd25519YaoActiveCapabilityRecord): Promise<RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallResultV1> | RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallResultV1;
+}
+export type RouterAbEd25519YaoCapabilityReplacementOperationV1 = {
+    readonly kind: 'router_ab_ed25519_yao_capability_replacement_operation_v1';
+    readonly operationId: string;
+    readonly operationFingerprint: string;
+    readonly authorityProjection: RouterAbEd25519YaoRecoveryAuthorityProjectionV1;
+};
+export type RouterAbEd25519YaoCapabilityPersistenceResultV1 = {
+    readonly ok: true;
+    readonly disposition: 'applied' | 'exact_retry';
+} | {
+    readonly ok: false;
+    readonly disposition: 'rejected' | 'uncertain';
+    readonly code: string;
+    readonly message: string;
+};
+export interface RouterAbEd25519YaoCapabilityPersistenceV1 {
+    replaceActiveCapability(input: {
+        readonly operation: RouterAbEd25519YaoCapabilityReplacementOperationV1;
+        readonly previous: WalletEd25519YaoActiveCapabilityRecord;
+        readonly next: WalletEd25519YaoActiveCapabilityRecord;
+    }): Promise<RouterAbEd25519YaoCapabilityPersistenceResultV1> | RouterAbEd25519YaoCapabilityPersistenceResultV1;
+}
+export type RouterAbEd25519YaoActiveCapabilityLookupV1 = {
+    readonly kind: 'router_ab_ed25519_yao_active_capability_lookup_v1';
+    readonly walletId: string;
+    readonly nearEd25519SigningKeyId: string;
+    readonly signerSlot: number;
+    readonly signingWorkerId: string;
+    readonly participantIds: readonly [number, number];
+};
+export type RouterAbEd25519YaoActiveCapabilityDescriptorV1 = {
+    readonly kind: 'router_ab_ed25519_yao_active_capability_v1';
+    readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
+    readonly activeCapabilityBinding: RouterAbEd25519YaoBytes32V1;
+    readonly registeredPublicKey: RouterAbEd25519YaoBytes32V1;
+    readonly nearAccountId: string;
+    readonly applicationBinding: RouterAbEd25519YaoApplicationBindingFactsV1;
+    readonly runtimePolicyScope: RuntimePolicyScope;
+    readonly participantIds: readonly [number, number];
+    readonly lifecycle: {
+        readonly lifecycleId: string;
+        readonly rootShareEpoch: string;
+        readonly accountId: string;
+        readonly thresholdSessionId: ThresholdEd25519SessionId;
+        readonly signerSetId: string;
+        readonly signingWorkerId: string;
+    };
+    readonly stateEpoch: number;
+    readonly registrationContinuity: {
+        readonly kind: 'registration';
+        readonly admissionRequest: RouterAbEd25519YaoRegistrationAdmissionRequestV1;
+        readonly admissionReceipt: RouterAbEd25519YaoActivationAdmissionReceiptV1<'registration'>;
+        readonly activationTranscript: readonly number[];
+    } | {
+        readonly kind: 'recovery';
+        readonly activationTranscript: readonly number[];
+    };
+};
+export type RouterAbEd25519YaoActiveCapabilityLookupResultV1 = {
+    readonly ok: true;
+    readonly capability: RouterAbEd25519YaoActiveCapabilityDescriptorV1;
+} | {
+    readonly ok: false;
+    readonly code: 'invalid_lookup' | 'unknown_capability' | 'capability_conflict';
+    readonly message: string;
+};
+type RouterAbEd25519YaoExactRecoverySessionBinding = {
+    readonly walletId: string;
+    readonly nearAccountId: string;
+    readonly nearEd25519SigningKeyId: string;
+    readonly signerSlot: number;
+    readonly thresholdSessionId: ThresholdEd25519SessionId;
+    readonly walletSessionId: RouterApiWalletSessionAuthorizationV2AdmissionContext['authorization']['session']['walletSessionId'];
+    readonly quotaId: RouterApiWalletSessionAuthorizationV2AdmissionContext['authorization']['quota']['quotaId'];
+    readonly signingWorkerId: string;
+    readonly thresholdExpiresAtMs: number;
+    readonly participantIds: readonly [number, number];
+    readonly runtimePolicyScope: RuntimePolicyScope;
+    readonly routerAbNormalSigning: RouterAbEd25519NormalSigningState;
+    readonly capability: RouterAbEd25519YaoActiveCapabilityDescriptorV1;
+};
+export type RouterAbEd25519YaoWarmRecoveryBootstrapV1 = RouterAbEd25519YaoExactRecoverySessionBinding & {
+    readonly kind: 'router_ab_ed25519_yao_v2_session_bootstrap_v1';
+};
+export interface RouterAbEd25519YaoActiveCapabilityResolverV1 {
+    resolveActiveCapability(input: RouterAbEd25519YaoActiveCapabilityLookupV1): Promise<RouterAbEd25519YaoActiveCapabilityLookupResultV1> | RouterAbEd25519YaoActiveCapabilityLookupResultV1;
+}
+type CapabilityIdentity = {
+    readonly capabilityBinding: RouterAbEd25519YaoBytes32V1;
+    readonly nearAccountId: string;
+    readonly applicationBinding: RouterAbEd25519YaoApplicationBindingFactsV1;
+    readonly runtimePolicyScope: RuntimePolicyScope;
+    readonly participantIds: readonly [number, number];
+    readonly activationBinding: RouterAbEd25519YaoActivationBindingV1;
+    readonly registeredPublicKey: RouterAbEd25519YaoBytes32V1;
+    readonly stateEpoch: number;
+    readonly originFingerprint: string;
+    readonly persisted: WalletEd25519YaoActiveCapabilityRecord;
+};
+type ActiveCapabilityState = {
+    readonly kind: 'active';
+    readonly identity: CapabilityIdentity;
+};
+type SuspendedCapabilityState = {
+    readonly kind: 'suspended';
+    readonly identity: CapabilityIdentity;
+    readonly recoveryKey: string;
+};
+type RetiredCapabilityState = {
+    readonly kind: 'retired';
+    readonly identity: CapabilityIdentity;
+    readonly recoveryKey: string;
+    readonly replacementCapabilityBinding: RouterAbEd25519YaoBytes32V1;
+};
+type CapabilityState = ActiveCapabilityState | SuspendedCapabilityState | RetiredCapabilityState;
+type RecoveryContext = {
+    readonly recoveryKey: string;
+    readonly admissionRequest: RouterAbEd25519YaoRecoveryAdmissionRequestV1;
+    readonly activeCapability: CapabilityIdentity;
+    readonly authorization: RouterAbEd25519YaoRecoveryAuthorizationBindingV1;
+};
+type RecoveryAdmittingState = {
+    readonly kind: 'admitting';
+    readonly context: RecoveryContext;
+};
+type RecoveryAdmissionFailedState = {
+    readonly kind: 'admission_failed';
+    readonly context: RecoveryContext;
+    readonly failure: RouterAbEd25519YaoRecoveryFailure;
+};
+type RecoveryAdmittedState = {
+    readonly kind: 'admitted';
+    readonly context: RecoveryContext;
+    readonly admissionReceipt: RecoveryAdmissionReceipt;
+};
+type RecoveryExecutingState = {
+    readonly kind: 'executing';
+    readonly context: RecoveryContext;
+    readonly admissionReceipt: RecoveryAdmissionReceipt;
+    readonly executeFingerprint: string;
+};
+type RecoveryExecutionFailedState = {
+    readonly kind: 'execution_failed';
+    readonly context: RecoveryContext;
+    readonly admissionReceipt: RecoveryAdmissionReceipt;
+    readonly executeFingerprint: string;
+    readonly failure: RouterAbEd25519YaoRecoveryFailure;
+};
+type RecoveryStagedState = {
+    readonly kind: 'staged';
+    readonly context: RecoveryContext;
+    readonly admissionReceipt: RecoveryAdmissionReceipt;
+    readonly executeFingerprint: string;
+    readonly result: RecoveryExecutionResult;
+};
+type RecoveryActivatingState = {
+    readonly kind: 'activating';
+    readonly context: RecoveryContext;
+    readonly admissionReceipt: RecoveryAdmissionReceipt;
+    readonly executeFingerprint: string;
+    readonly result: RecoveryExecutionResult;
+    readonly activationFingerprint: string;
+};
+type RecoveryActivationFailedState = {
+    readonly kind: 'activation_failed';
+    readonly context: RecoveryContext;
+    readonly admissionReceipt: RecoveryAdmissionReceipt;
+    readonly executeFingerprint: string;
+    readonly result: RecoveryExecutionResult;
+    readonly activationFingerprint: string;
+    readonly failure: RouterAbEd25519YaoRecoveryFailure;
+};
+type RecoveryPromotedState = {
+    readonly kind: 'promoted';
+    readonly context: RecoveryContext;
+    readonly admissionReceipt: RecoveryAdmissionReceipt;
+    readonly executeFingerprint: string;
+    readonly result: RecoveryExecutionResult;
+    readonly activationFingerprint: string;
+    readonly activationReceipt: RouterAbEd25519YaoRecoveryActivationReceiptV1;
+};
+type RecoveryLifecycleState = RecoveryAdmittingState | RecoveryAdmissionFailedState | RecoveryAdmittedState | RecoveryExecutingState | RecoveryExecutionFailedState | RecoveryStagedState | RecoveryActivatingState | RecoveryActivationFailedState | RecoveryPromotedState;
+export declare class InMemoryRouterAbEd25519YaoRecoveryStateV1 {
+    readonly capabilities: Map<string, CapabilityState>;
+    readonly identityCapabilities: Map<string, string>;
+    readonly recoveries: Map<string, RecoveryLifecycleState>;
+    readonly recoverySessions: Map<string, string>;
+}
+/**
+ * The linked-authority projection fields the warm bootstrap needs. Structural
+ * on purpose: the concrete projection lives with the platform install service,
+ * and this domain only reads the identity, binding, and receipt facts.
+ */
+export type WarmBootstrapLinkedEd25519AuthorityProjectionV1 = {
+    readonly walletId: string;
+    readonly authorityId: string;
+    readonly walletAuthMethodId: string;
+    readonly linkSessionId: string;
+    readonly materialActivation: MpcMaterialActivationRef;
+    readonly targetBinding: RouterAbEd25519YaoCeremonyBindingV1;
+    readonly applicationBinding: RouterAbEd25519YaoApplicationBindingFactsV1;
+    readonly participantIds: readonly [number, number];
+    readonly activationReceipt: {
+        readonly registered_public_key: readonly number[];
+        readonly material_activation: RouterAbMpcMaterialActivationRefWire;
+    };
+};
+export type WarmBootstrapLinkedEd25519AuthorityReaderV1 = {
+    readInstalledEd25519AuthorityByMaterialActivationV1(input: {
+        readonly walletId: WarmBootstrapWalletSessionContext['authority']['walletId'];
+        readonly materialActivation: MpcMaterialActivationRef;
+    }): Promise<WarmBootstrapLinkedEd25519AuthorityProjectionV1 | null>;
+};
+export declare function warmBootstrapCapabilityMatchesStableIdentity(input: {
+    readonly request: RouterAbEd25519YaoWarmRecoveryBootstrapRequestV1;
+    readonly context: WarmBootstrapWalletSessionContext;
+    readonly capability: RouterAbEd25519YaoActiveCapabilityDescriptorV1;
+}): boolean;
+export declare function buildWarmRecoveryBootstrapResponse(input: {
+    readonly request: RouterAbEd25519YaoWarmRecoveryBootstrapRequestV1;
+    readonly authorization: Extract<RouterAbEd25519YaoRecoveryAuthorizationResult, {
+        readonly ok: true;
+    }>['authorization'];
+    readonly capability: RouterAbEd25519YaoActiveCapabilityDescriptorV1;
+    readonly linkedAuthorities?: WarmBootstrapLinkedEd25519AuthorityReaderV1 | null;
+}): Promise<RouterAbEd25519YaoWarmRecoveryBootstrapV1 | null>;
+export type RouterAbEd25519YaoActiveCapabilityRecordBuildResultV1 = {
+    readonly ok: true;
+    readonly record: WalletEd25519YaoActiveCapabilityRecord;
+} | Extract<RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallResultV1, {
+    readonly ok: false;
+}>;
+export declare function buildRouterAbEd25519YaoRegistrationCapabilityRecordV1(input: RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallationV1): RouterAbEd25519YaoActiveCapabilityRecordBuildResultV1;
+export declare class InMemoryRouterAbEd25519YaoRecoveryService implements RouterAbEd25519YaoRecoveryService, RouterAbEd25519YaoRecoveryAdmissionBoundaryV1, RouterAbEd25519YaoRecoveryExecuteBoundaryV1, RouterAbEd25519YaoRecoveryActivationBoundaryV1, RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallerV1, RouterAbEd25519YaoPersistedActiveCapabilityInstallerV1, RouterAbEd25519YaoActiveCapabilityResolverV1 {
+    private readonly backend;
+    private readonly capabilityPersistence;
+    private readonly capabilities;
+    private readonly identityCapabilities;
+    private readonly recoveries;
+    private readonly recoverySessions;
+    constructor(backend: RouterAbEd25519YaoRecoveryBackend, state?: InMemoryRouterAbEd25519YaoRecoveryStateV1, capabilityPersistence?: RouterAbEd25519YaoCapabilityPersistenceV1);
+    installRegistrationFinalizeCapability(input: RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallationV1): RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallResultV1;
+    installPersistedActiveCapability(input: WalletEd25519YaoActiveCapabilityRecord): RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallResultV1;
+    private installPersistedCapabilityIdentity;
+    private installCapabilityIdentity;
+    resolveActiveCapability(input: RouterAbEd25519YaoActiveCapabilityLookupV1): RouterAbEd25519YaoActiveCapabilityLookupResultV1;
+    admitRecovery(request: RouterAbEd25519YaoRecoveryAdmissionRequestV1, authorization: RouterAbEd25519YaoRecoveryAuthorizationBindingV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRecoveryServiceResult<RecoveryAdmissionReceipt>>;
+    prepareAdmitRecovery(request: RouterAbEd25519YaoRecoveryAdmissionRequestV1, authorization: RouterAbEd25519YaoRecoveryAuthorizationBindingV1): RouterAbEd25519YaoRecoveryAdmissionPreparationV1;
+    commitAdmitRecovery(input: RouterAbEd25519YaoRecoveryAdmissionCommitInputV1): RouterAbEd25519YaoRecoveryServiceResult<RecoveryAdmissionReceipt>;
+    executeRecovery(request: RecoveryExecuteRequest, authorization: RouterAbEd25519YaoRecoveryAuthorizationBindingV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRecoveryServiceResult<RecoveryExecutionResult>>;
+    prepareExecuteRecovery(request: RecoveryExecuteRequest, authorization: RouterAbEd25519YaoRecoveryAuthorizationBindingV1): RouterAbEd25519YaoRecoveryExecutePreparationV1;
+    commitExecuteRecovery(input: RouterAbEd25519YaoRecoveryExecuteCommitInputV1): RouterAbEd25519YaoRecoveryServiceResult<RecoveryExecutionResult>;
+    activateRecovery(request: RouterAbEd25519YaoRecoveryActivationRequestV1, authorization: RouterAbEd25519YaoRecoveryAuthorizationBindingV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRecoveryServiceResult<RouterAbEd25519YaoRecoveryActivationReceiptV1>>;
+    prepareActivateRecovery(request: RouterAbEd25519YaoRecoveryActivationRequestV1, authorization: RouterAbEd25519YaoRecoveryAuthorizationBindingV1): RouterAbEd25519YaoRecoveryActivationPreparationV1;
+    commitActivateRecovery(input: RouterAbEd25519YaoRecoveryActivationCommitInputV1): Promise<RouterAbEd25519YaoRecoveryActivationCommitResultV1>;
+    private activationClaim;
+    private activationUncertainFailure;
+    private promoteCapability;
+    private rollbackCapabilityPromotion;
+    private stateForSession;
+    private failUncertainAdmission;
+    private failUncertainExecution;
+    private storeAdmissionFailure;
+    private storeExecutionFailure;
+    private storeActivationFailure;
+}
+export declare function createRouterAbEd25519YaoRecoveryModule(input: {
+    readonly service: RouterAbEd25519YaoRecoveryService & RouterAbEd25519YaoActiveCapabilityResolverV1;
+    readonly capabilities?: RouterAbEd25519YaoActiveCapabilityResolverV1;
+    readonly authorization: RouterAbEd25519YaoRecoveryAuthorizationAdapter;
+    readonly linkedAuthorities?: (() => WarmBootstrapLinkedEd25519AuthorityReaderV1 | null) | null;
+}): RouterApiModule;
+export {};
+//# sourceMappingURL=routerAbEd25519YaoRecovery.d.ts.map

package/dist/types/wallet-server/src/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryActivation.typecheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=routerAbEd25519YaoRecoveryActivation.typecheck.d.ts.map

package/dist/types/wallet-server/src/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryRequestScopedCloudflare.d.ts

@@ -0,0 +1,14 @@
+import { type RouterAbEd25519YaoCapabilityPersistenceV1, type RouterAbEd25519YaoRecoveryAuthorizationAdapter, type RouterAbEd25519YaoRecoveryBackend, type RouterAbEd25519YaoActiveCapabilityResolverV1, type WarmBootstrapLinkedEd25519AuthorityReaderV1 } from './routerAbEd25519YaoRecovery';
+export type { WarmBootstrapLinkedEd25519AuthorityReaderV1 } from './routerAbEd25519YaoRecovery';
+import type { RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1 } from '../capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore';
+export type RouterAbEd25519YaoRecoveryRequestScopedCloudflareInputV1 = {
+    readonly request: Request;
+    readonly store: RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1;
+    readonly backend: RouterAbEd25519YaoRecoveryBackend;
+    readonly authorization: RouterAbEd25519YaoRecoveryAuthorizationAdapter;
+    readonly capabilityPersistence: RouterAbEd25519YaoCapabilityPersistenceV1;
+    readonly capabilities: RouterAbEd25519YaoActiveCapabilityResolverV1;
+    readonly linkedAuthorities?: WarmBootstrapLinkedEd25519AuthorityReaderV1 | null;
+};
+export declare function handleRouterAbEd25519YaoRecoveryRequestScopedCloudflareV1(input: RouterAbEd25519YaoRecoveryRequestScopedCloudflareInputV1): Promise<Response>;
+//# sourceMappingURL=routerAbEd25519YaoRecoveryRequestScopedCloudflare.d.ts.map

package/dist/types/wallet-server/src/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryWalletSessionAuthorization.d.ts

@@ -0,0 +1,20 @@
+import type { RouterApiAuthorizationSessionService, RouterApiWalletRegistrationService } from '../../../framework/authServicePort';
+import type { PreparedEd25519RecoveryAdmissionV1 } from '../../passkeyCustody/walletRecoveryKeyManifest';
+import type { RouterAbEd25519YaoRecoveryAuthorizationAdapter, RouterAbEd25519YaoRecoveryAuthorizationInput, RouterAbEd25519YaoRecoveryAuthorizationResult } from './routerAbEd25519YaoRecovery';
+export interface PreparedEd25519RecoveryAdmissionReaderV1 {
+    readPreparedEd25519RecoveryAdmission(input: {
+        readonly challengeId: string;
+        readonly nowMs: number;
+    }): Promise<PreparedEd25519RecoveryAdmissionV1 | null>;
+}
+export type RouterAbEd25519YaoRecoveryAuthorizationServicesV1 = {
+    readonly authorizationSessions: RouterApiAuthorizationSessionService;
+    readonly preparedRecoveryAdmission: PreparedEd25519RecoveryAdmissionReaderV1;
+    readonly resolveEd25519MaterialActivation: RouterApiWalletRegistrationService['resolveEd25519MaterialActivation'];
+};
+export declare class RouterAbEd25519YaoRecoveryWalletSessionAuthorizationAdapter implements RouterAbEd25519YaoRecoveryAuthorizationAdapter {
+    private readonly resolveServices;
+    constructor(resolveServices: () => Promise<RouterAbEd25519YaoRecoveryAuthorizationServicesV1>);
+    authorize(input: RouterAbEd25519YaoRecoveryAuthorizationInput): Promise<RouterAbEd25519YaoRecoveryAuthorizationResult>;
+}
+//# sourceMappingURL=routerAbEd25519YaoRecoveryWalletSessionAuthorization.d.ts.map

package/dist/types/wallet-server/src/router/domains/ed25519Yao/registration/routerAbEd25519YaoHttpRegistrationBackend.d.ts

@@ -0,0 +1,56 @@
+import { type RouterAbEd25519YaoActivationExecuteRequestV1, type RouterAbEd25519YaoActivationKeysetV1, type RouterAbEd25519YaoRecoveryActivationRequestV1, type RouterAbEd25519YaoRecoveryAdmissionRequestV1, type RouterAbEd25519YaoRegistrationAdmissionRequestV1, type RouterAbEd25519YaoExportAdmissionRequestV1, type RouterAbEd25519YaoExportExecuteRequestV1 } from '../../../../../../shared-ts/src/utils/routerAbEd25519Yao';
+import type { RouterAbEd25519YaoRegistrationBackend, RouterAbEd25519YaoRegistrationBackendResult } from './routerAbEd25519YaoRegistration';
+import type { RouterAbEd25519YaoExportBackend } from '../export/routerAbEd25519YaoExport';
+import type { RouterAbEd25519YaoRecoveryBackend } from '../recovery/routerAbEd25519YaoRecovery';
+import type { RouterAbEd25519YaoTenantRootResolverV1 } from '../routerAbEd25519YaoGatewayEnvelope';
+import { type RouterAbTraceContextV1 } from '../../../../../../shared-ts/src/utils/routerAbTraceContext';
+type RouterAbEd25519YaoRegistrationExecuteRequestV1 = RouterAbEd25519YaoActivationExecuteRequestV1<'registration'>;
+type RouterAbEd25519YaoRecoveryExecuteRequestV1 = RouterAbEd25519YaoActivationExecuteRequestV1<'recovery'>;
+export type RouterAbEd25519YaoHttpRegistrationBackendConfig = {
+    routerUrl: string;
+    signingWorkerId: string;
+    internalServiceAuth: string;
+    deriverAInputPublicKey: readonly number[];
+    deriverBInputPublicKey: readonly number[];
+    signingWorkerRecipientPublicKey: readonly number[];
+    resolveTenantRoot: RouterAbEd25519YaoTenantRootResolverV1;
+    fetch: typeof fetch;
+    onSpan?: (span: RouterAbEd25519YaoGatewaySpanV1) => void;
+};
+export type RouterAbEd25519YaoGatewaySpanV1 = {
+    readonly event: 'router_ab_yao_gateway_span_v1';
+    readonly span: 'gateway.pre_yao' | 'gateway.yao_execute' | 'gateway.d1_commit';
+    readonly operation: 'registration' | 'recovery' | 'export';
+    readonly outcome: 'success' | 'failure';
+    readonly duration_ms: number;
+    readonly trace_id: string;
+};
+export type RouterAbEd25519YaoHttpRegistrationBackendRawEnv = Readonly<Record<string, unknown>>;
+export declare function parseRouterAbEd25519YaoActivationKeysetFromEnvV1(env: RouterAbEd25519YaoHttpRegistrationBackendRawEnv): RouterAbEd25519YaoActivationKeysetV1;
+export declare class RouterAbEd25519YaoHttpRegistrationBackend implements RouterAbEd25519YaoRegistrationBackend, RouterAbEd25519YaoRecoveryBackend, RouterAbEd25519YaoExportBackend {
+    private readonly config;
+    private lastRouterServerTiming;
+    constructor(config: RouterAbEd25519YaoHttpRegistrationBackendConfig);
+    takeLastRouterServerTiming(): string | null;
+    admit(request: RouterAbEd25519YaoRegistrationAdmissionRequestV1, _traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationBackendResult>;
+    admitRecovery(request: RouterAbEd25519YaoRecoveryAdmissionRequestV1, _traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationBackendResult>;
+    admitExport(request: RouterAbEd25519YaoExportAdmissionRequestV1, _traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationBackendResult>;
+    executeExport(request: RouterAbEd25519YaoExportExecuteRequestV1, admissionRequest: RouterAbEd25519YaoExportAdmissionRequestV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationBackendResult>;
+    private keyset;
+    private admitActivation;
+    execute(request: RouterAbEd25519YaoRegistrationExecuteRequestV1, admissionRequest: RouterAbEd25519YaoRegistrationAdmissionRequestV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationBackendResult>;
+    executeRecovery(request: RouterAbEd25519YaoRecoveryExecuteRequestV1, admissionRequest: RouterAbEd25519YaoRecoveryAdmissionRequestV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationBackendResult>;
+    private executeRouterRequest;
+    activateRecovery(request: RouterAbEd25519YaoRecoveryActivationRequestV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationBackendResult>;
+    private post;
+    private headers;
+    private request;
+}
+export declare function createRouterAbEd25519YaoHttpRegistrationBackendFromEnv(input: {
+    env: RouterAbEd25519YaoHttpRegistrationBackendRawEnv;
+    resolveTenantRoot: RouterAbEd25519YaoTenantRootResolverV1;
+    onSpan?: (span: RouterAbEd25519YaoGatewaySpanV1) => void;
+    fetch: typeof fetch;
+}): RouterAbEd25519YaoRegistrationBackend & RouterAbEd25519YaoRecoveryBackend & RouterAbEd25519YaoExportBackend;
+export {};
+//# sourceMappingURL=routerAbEd25519YaoHttpRegistrationBackend.d.ts.map