@seams/wallet-server 0.6.1 → 0.7.1

package/dist/types/wallet-server/src/router/cloudflare/d1/passkeyCustody/d1WalletCustodyCommitStore.d.ts

@@ -11,25 +11,17 @@ import { type CloudflareD1VersionedJsonRecordScopeV1 } from '../versionedJson/d1
 import type { WebAuthnAuthenticatorRecord } from '../webauthn/d1WebAuthnRecords';
 import { type WebAuthnCredentialBindingRecord } from '../../../../core/WebAuthnCredentialBindingStore';
 import { D1WalletAuthMethodStore } from '../../../../core/d1WalletAuthMethodStore';
-import { type WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import { type ActiveEmailOtpWalletAuthMethodRecordV2, type ActivePasskeyWalletAuthMethodRecordV2, type PasskeyWalletAuthMethodRecordV2, type WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
 import { D1WalletAuthorityStore } from '../wallet/d1WalletAuthorityStore';
 import type { EmailOtpWalletEnrollmentRecord } from '../../../../core/EmailOtpStores';
 import { type WalletRecoveryGoogleEmailOtpFinalizationInput } from './d1WalletRecoveryGoogleEmailOtpRecords';
-type ActivePasskeyWalletAuthMethodRecordV2 = Extract<WalletAuthMethodRecordV2, {
-    readonly kind: 'passkey';
-    readonly status: 'active';
-}>;
-type ActiveEmailOtpWalletAuthMethodRecordV2 = Extract<WalletAuthMethodRecordV2, {
-    readonly kind: 'email_otp';
-    readonly status: 'active';
-}>;
-export type CloudflareD1WalletCustodyCommitStoreOptions = {
+type CloudflareD1WalletCustodyCommitStoreOptions = {
     readonly database: D1DatabaseLike;
     readonly scope: CloudflareD1VersionedJsonRecordScopeV1;
     readonly walletAuthMethodStore?: D1WalletAuthMethodStore;
     readonly walletAuthorityStore?: Pick<D1WalletAuthorityStore, 'readById'>;
 };
-export type WalletCustodyRegistrationCommit = {
+type WalletCustodyRegistrationCommit = {
     readonly envelope: PasskeyCustodyEnvelopeRecord;
     readonly recoverySet: WalletRecoveryEnvelopeSetRecord;
     readonly recoveryBackupAcknowledgement: WalletRecoveryBackupAcknowledgementV1;
@@ -74,7 +66,7 @@ export type WalletCustodyRegistrationCommitResult = {
     readonly kind: 'inconsistent';
     readonly reason: string;
 };
-export type WalletCustodyRecoveryAuthorityInstallCommitResult = {
+type WalletCustodyRecoveryAuthorityInstallCommitResult = {
     readonly kind: 'committed' | 'already_committed';
     readonly envelopeStoreVersion: string;
 } | {
@@ -92,7 +84,7 @@ export type WalletRecoveryEmailEnrollmentCommit = {
     readonly enrollment: EmailOtpWalletEnrollmentRecord;
     readonly statements: readonly D1PreparedStatementLike[];
 };
-export type WalletRecoveryGoogleEmailOtpAuthorityInstallCommit = {
+type WalletRecoveryGoogleEmailOtpAuthorityInstallCommit = {
     readonly recovery: WalletRecoveryGoogleEmailOtpFinalizationInput;
     readonly recoveryAttemptStoreVersion: string;
     readonly continuityAuthority: ActiveWalletAuthorityV1;
@@ -104,8 +96,6 @@ export type WalletRecoveryGoogleEmailOtpAuthorityInstallCommit = {
     readonly walletAuthMethod: ActiveEmailOtpWalletAuthMethodRecordV2;
     readonly enrollmentCommit: WalletRecoveryEmailEnrollmentCommit;
 };
-/** Recovery sets are wallet-scoped: one set covers the wallet, not one factor. */
-export declare function walletRecoveryBackupAcknowledgementRecordKey(walletId: WalletId): string;
 export type WalletRecoveryAuthenticatorCommit = {
     readonly userId: string;
     readonly authenticator: WebAuthnAuthenticatorRecord;
@@ -113,7 +103,6 @@ export type WalletRecoveryAuthenticatorCommit = {
     readonly walletAuthMethod: ActivePasskeyWalletAuthMethodRecordV2;
     readonly challengeDeleteStatement: D1PreparedStatementLike;
 };
-export declare function walletRecoveryEnvelopeSetRecordKey(walletId: WalletId): string;
 export declare class CloudflareD1WalletCustodyCommitStore {
     private readonly database;
     private readonly scope;
@@ -127,6 +116,7 @@ export declare class CloudflareD1WalletCustodyCommitStore {
         readonly walletId: WalletId;
         readonly recoveryKeyId: DerivedWalletRecoveryKeyId;
     }): Promise<WalletRecoveryCodeLocatorRecord | null>;
+    private tenantScope;
     private prepareRecoveryCodeLocatorInsertStatement;
     private prepareRecoveryCodeLocatorsDeleteForWalletStatement;
     private prepareRecoveryCodeLocatorCollisionGuardStatement;
@@ -161,9 +151,7 @@ export declare class CloudflareD1WalletCustodyCommitStore {
     readPasskeyWalletAuthMethod(input: {
         readonly rpId: string;
         readonly credentialIdB64u: string;
-    }): Promise<Extract<WalletAuthMethodRecordV2, {
-        readonly kind: 'passkey';
-    }> | null>;
+    }): Promise<PasskeyWalletAuthMethodRecordV2 | null>;
     /**
      * Reads the wallet's backup acknowledgement, if any.
      *

package/dist/types/wallet-server/src/router/cloudflare/d1/passkeyCustody/d1WalletRecoveryGoogleEmailOtpRecords.d.ts

@@ -3,7 +3,7 @@ import { type DeviceId } from '../../../../../../shared-ts/src/authorization/cap
 import { type WalletAuthMethodId, type WalletAuthorityBindingDigest, type WalletAuthorityId, type WalletId, type WalletRecoveryOperationId, type WebAuthnCredentialIdB64u, type WebAuthnRpId } from '../../../../../../shared-ts/src/utils/domainIds';
 import { type RecoveryCodeReservationId } from '../../../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation';
 import type { WebAuthnRecoveryContinuityAnchorRecord } from '../webauthn/d1WebAuthnRecords';
-export type WalletRecoveryGoogleEmailOtpTargetV1 = {
+type WalletRecoveryGoogleEmailOtpTargetV1 = {
     readonly kind: 'google_email_otp';
     readonly googleProvider: 'google';
 };
@@ -60,7 +60,7 @@ export type WalletRecoveryGoogleEmailOtpAttemptRecord = (WalletRecoveryGoogleEma
     readonly ownerProofBindingDigest: DigestB64u;
     readonly targetEnrollment: WalletRecoveryGoogleEmailOtpTargetEnrollmentV1;
 });
-export type PreparedWalletRecoveryGoogleEmailOtpAttempt = Extract<WalletRecoveryGoogleEmailOtpAttemptRecord, {
+type PreparedWalletRecoveryGoogleEmailOtpAttempt = Extract<WalletRecoveryGoogleEmailOtpAttemptRecord, {
     readonly state: 'prepared';
 }>;
 export type OtpIssuedWalletRecoveryGoogleEmailOtpAttempt = Extract<WalletRecoveryGoogleEmailOtpAttemptRecord, {
@@ -69,7 +69,7 @@ export type OtpIssuedWalletRecoveryGoogleEmailOtpAttempt = Extract<WalletRecover
 export type OtpVerifiedWalletRecoveryGoogleEmailOtpAttempt = Extract<WalletRecoveryGoogleEmailOtpAttemptRecord, {
     readonly state: 'otp_verified';
 }>;
-export type FinalizableWalletRecoveryGoogleEmailOtpAttempt = Extract<WalletRecoveryGoogleEmailOtpAttemptRecord, {
+type FinalizableWalletRecoveryGoogleEmailOtpAttempt = Extract<WalletRecoveryGoogleEmailOtpAttemptRecord, {
     readonly state: 'otp_verified' | 'finalized';
 }>;
 export type WalletRecoveryGoogleEmailOtpFinalizationInput = {
@@ -111,6 +111,7 @@ export declare function markWalletRecoveryGoogleEmailOtpAttemptIssued(input: {
 }): OtpIssuedWalletRecoveryGoogleEmailOtpAttempt;
 export declare function markWalletRecoveryGoogleEmailOtpAttemptVerified(attempt: OtpIssuedWalletRecoveryGoogleEmailOtpAttempt): OtpVerifiedWalletRecoveryGoogleEmailOtpAttempt;
 export declare function walletRecoveryGoogleEmailOtpFinalizationInput(attempt: FinalizableWalletRecoveryGoogleEmailOtpAttempt): WalletRecoveryGoogleEmailOtpFinalizationInput;
+export declare function sameWalletRecoveryGoogleEmailOtpFinalizationInputV1(left: WalletRecoveryGoogleEmailOtpFinalizationInput, right: WalletRecoveryGoogleEmailOtpFinalizationInput): boolean;
 export declare function parseWalletRecoveryGoogleEmailOtpAttemptRecord(raw: unknown): WalletRecoveryGoogleEmailOtpAttemptRecord | null;
 export type { WalletAuthMethodId, WalletAuthorityBindingDigest, WalletAuthorityId, WalletId, WebAuthnCredentialIdB64u, WebAuthnRpId, };
 //# sourceMappingURL=d1WalletRecoveryGoogleEmailOtpRecords.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/passkeyCustody/d1WalletRecoveryGoogleEmailOtpService.d.ts

@@ -1,5 +1,5 @@
-import { type ActiveWalletAuthorityV1 } from '../../../../../../shared-ts/src/authorization';
-import { type WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import type { ActiveWalletAuthorityV1 } from '../../../../../../shared-ts/src/authorization';
+import { type ActiveEmailOtpWalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
 import type { PasskeyCustodyEnvelopeRecord } from '../../../../../../shared-ts/src/passkey-custody';
 import type { EmailOtpWalletEnrollmentRecord } from '../../../../core/EmailOtpStores';
 import type { D1WalletStore } from '../../../../core/d1WalletStore';
@@ -23,11 +23,7 @@ type GoogleRecoveryFailure = {
     readonly code: string;
     readonly message: string;
 };
-type ActiveEmailOtpWalletAuthMethodRecordV2 = Extract<WalletAuthMethodRecordV2, {
-    readonly kind: 'email_otp';
-    readonly status: 'active';
-}>;
-export type WalletRecoveryGoogleEmailOtpFinalizationEnrollment = {
+type WalletRecoveryGoogleEmailOtpFinalizationEnrollment = {
     readonly kind: 'existing';
     readonly enrollmentId: string;
     readonly enrollmentSealKeyVersion: string;
@@ -38,7 +34,7 @@ export type WalletRecoveryGoogleEmailOtpFinalizationEnrollment = {
     readonly verifiedEmail: string;
     readonly material: EmailOtpEnrollmentMaterialBoundaryInput;
 };
-export type WalletRecoveryGoogleEmailOtpFinalizationDependencies = {
+type WalletRecoveryGoogleEmailOtpFinalizationDependencies = {
     readonly envelopeStore: CloudflareD1PasskeyCustodyEnvelopeStore;
     readonly walletCustodyCommits: CloudflareD1WalletCustodyCommitStore;
     readonly walletAuthorityStore: Pick<D1WalletAuthorityStore, 'readById'>;
@@ -64,7 +60,7 @@ export type WalletRecoveryGoogleEmailOtpFinalizationResult = {
     readonly kind: 'enrollment_rejected';
     readonly reason: string;
 };
-export type WalletRecoveryGoogleEmailOtpFinalizationRequest = {
+type WalletRecoveryGoogleEmailOtpFinalizationRequest = {
     readonly kind: 'finalize';
     readonly recovery: WalletRecoveryGoogleEmailOtpFinalizationInput;
     readonly replacementEnvelope: PasskeyCustodyEnvelopeRecord;
@@ -77,7 +73,7 @@ export type WalletRecoveryGoogleEmailOtpFinalizationRequest = {
     readonly replacementEnvelope: PasskeyCustodyEnvelopeRecord;
     readonly dependencies: WalletRecoveryGoogleEmailOtpFinalizationDependencies;
 };
-export type WalletRecoveryGoogleEmailOtpChallengeResult = {
+type WalletRecoveryGoogleEmailOtpChallengeResult = {
     readonly ok: true;
     readonly recoveryOperationId: string;
     readonly walletId: WalletId;
@@ -87,7 +83,7 @@ export type WalletRecoveryGoogleEmailOtpChallengeResult = {
     readonly delivery: EmailOtpChallengeDelivery;
     readonly expiresAtMs: number;
 } | GoogleRecoveryFailure;
-export type WalletRecoveryGoogleEmailOtpFactorReleaseResult = {
+type WalletRecoveryGoogleEmailOtpFactorReleaseResult = {
     readonly ok: true;
     readonly kind: 'email_otp_factor_release_v1';
     readonly recovery: WalletRecoveryGoogleEmailOtpFinalizationInput;
@@ -109,7 +105,7 @@ export type WalletRecoveryGoogleEmailOtpFactorReleaseResult = {
         readonly verifiedEmail: string;
     };
 } | GoogleRecoveryFailure;
-export type WalletRecoveryGoogleEmailOtpVerificationResult = {
+type WalletRecoveryGoogleEmailOtpVerificationResult = {
     readonly ok: true;
     readonly recovery: WalletRecoveryGoogleEmailOtpFinalizationInput;
     readonly attempt: OtpVerifiedWalletRecoveryGoogleEmailOtpAttempt;

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore.d.ts

@@ -5,30 +5,27 @@ export type D1RegistrationCeremonyRecordScope = {
     readonly projectId: string;
     readonly envId: string;
 };
-export type D1RegistrationCeremonyRecordStoreOptions = {
+type D1RegistrationCeremonyRecordStoreOptions = {
     readonly database: D1DatabaseLike;
     readonly scope: D1RegistrationCeremonyRecordScope;
     readonly keyPrefix: string;
 };
-export type D1RegistrationCeremonyStoredRecord = {
+type D1RegistrationCeremonyStoredRecord = {
     readonly value: Record<string, unknown>;
     readonly version: number;
     readonly expiresAtMs: number;
 };
-export type D1RegistrationCeremonyRecordMutation = {
+type D1RegistrationCeremonyRecordMutation = {
     readonly scope: string;
     readonly id: string;
     readonly value: Record<string, unknown>;
     readonly expiresAtMs: number;
 };
-export type D1RegistrationCeremonyAtomicBranchClaim = {
+type D1RegistrationCeremonyAtomicBranchClaim = {
     readonly value: Record<string, unknown>;
     readonly version: number;
     readonly expiresAtMs: number;
 };
-export declare class D1RegistrationCeremonyRecordConflictError extends Error {
-    constructor(message: string);
-}
 export declare class D1RegistrationCeremonyRecordStore {
     private readonly database;
     private readonly tenantScope;
@@ -36,7 +33,6 @@ export declare class D1RegistrationCeremonyRecordStore {
     constructor(options: D1RegistrationCeremonyRecordStoreOptions);
     get(scope: string, id: string): Promise<D1RegistrationCeremonyStoredRecord | null>;
     putExact(mutation: D1RegistrationCeremonyRecordMutation): Promise<void>;
-    reserveExclusive(mutation: D1RegistrationCeremonyRecordMutation): Promise<boolean>;
     updateExpected(input: {
         readonly scope: string;
         readonly id: string;
@@ -83,4 +79,5 @@ export declare class D1RegistrationCeremonyRecordStore {
     private bindKey;
     private normalizeKey;
 }
+export {};
 //# sourceMappingURL=d1RegistrationCeremonyRecordStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationCeremonyRecords.d.ts

@@ -1,19 +1,20 @@
+import type { WalletRegistrationFinalizeSuccess } from '../../../../core/registrationContracts';
 import { type EcdsaClientRootPublicKey33B64u } from '../../../../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap';
-import { type AddAuthMethodIntentCallerV1, type AddAuthMethodInput, type AddAuthMethodIntentV1, type AddSignerIntentV1, type AddSignerSelection, type ServerAllocatedWalletId, type RegistrationAuthority, type RegistrationAuthMethodInput, type RegistrationIntentV1, type RegistrationSignerSetSelection, type RuntimePolicyScopeLike, type WalletId } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import { type AddAuthMethodIntentCallerV1, type AddAuthMethodIntentV1, type AddSignerIntentV1, type RegistrationIntentV1, type RuntimePolicyScopeLike, type WalletId } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import { type ServerAllocatedWalletId } from '../../../../../../shared-ts/src/utils/registrationIds';
+import { type AddSignerSelection, type RegistrationSignerSetSelection } from '../../../../../../shared-ts/src/utils/registrationSignerPlan';
+import { type AddAuthMethodInput, type RegistrationAuthMethodInput } from '../../../../../../shared-ts/src/utils/registrationAuthMethodInput';
 import { type WalletAuthMethodId } from '../../../../../../shared-ts/src/utils/domainIds';
 import type { RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
 import { deriveEvmFamilySigningKeySlotId } from '../../../../../../shared-ts/src/signing-lanes';
 import { type RouterAbEcdsaDerivationPublicCapabilityV1, type RouterAbEcdsaRegistrationActivationReceiptV1 } from '../../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
-import type { EcdsaDerivationClientBootstrapRequest, EcdsaDerivationServerBootstrapResponse } from '../../../../core/types';
+import type { EcdsaDerivationServerBootstrapResponse } from '../../../../core/types';
 import type { WalletRegistrationCommittedInstallationProjectionV1 } from '../../../../core/threeRouteRegistrationContracts';
-import type { WalletRegistrationEcdsaClientBootstrap, WalletRegistrationEcdsaPrepareContext, WalletRegistrationEcdsaWalletKey, WalletRegistrationFinalizeResponse, WalletAddSignerFinalizeResponse } from '../../../../core/registrationContracts';
-import { type StoredWalletRegistrationNearEd25519YaoAuthorizedBranch, StoredAddAuthMethodIntent, StoredAddSignerIntent, StoredWalletAddAuthMethodCeremony, StoredWalletAddSignerCeremony, StoredWalletAddSignerFinalizeReplay, StoredWalletAddAuthMethodFinalizeReplay, StoredWalletAddSignerFinalizeRequest, StoredWalletRegistrationCeremony } from '../../../../core/RegistrationCeremonyStore';
+import type { WalletRegistrationEcdsaWalletKey, WalletAddSignerFinalizeResponse } from '../../../../core/registrationContracts';
+import { StoredAddAuthMethodIntent, StoredAddSignerIntent, StoredWalletAddAuthMethodCeremony, StoredWalletAddSignerCeremony, StoredWalletAddSignerFinalizeReplay, StoredWalletAddAuthMethodFinalizeReplay, StoredWalletRegistrationCeremony } from '../../../../core/RegistrationCeremonyStore';
 import { type ThresholdEcdsaChainTarget } from '../../../../core/thresholdEcdsaChainTarget';
 import { type WalletEcdsaSignerRecord, type WalletRecord } from '../../../../core/d1WalletStore';
-type D1WalletRegistrationFinalizeSuccess = Extract<WalletRegistrationFinalizeResponse, {
-    ok: true;
-}>;
-type D1WalletRegistrationFinalizeReplaySuccess = D1WalletRegistrationFinalizeSuccess;
+type D1WalletRegistrationFinalizeReplaySuccess = WalletRegistrationFinalizeSuccess;
 export declare function createD1ServerAllocatedWalletId(): ServerAllocatedWalletId;
 export declare function inferRuntimePolicyScopeFromSigningRoot(input: {
     readonly orgId: string;
@@ -47,32 +48,22 @@ export declare function buildAddAuthMethodIntent(input: {
     readonly caller: AddAuthMethodIntentCallerV1;
     readonly runtimePolicyScope?: RuntimePolicyScope;
 }): AddAuthMethodIntentV1;
-export declare function addAuthMethodInputMatches(left: AddAuthMethodInput, right: AddAuthMethodInput): boolean;
-export declare function addSignerSelectionMatches(left: AddSignerSelection, right: AddSignerSelection): boolean;
 export declare function parseWalletIdForIntent(raw: unknown): WalletId | null;
-export declare function parseD1RegistrationIntent(raw: unknown): RegistrationIntentV1 | null;
 export declare function parseD1StoredWalletRegistrationCeremony(raw: unknown): StoredWalletRegistrationCeremony | null;
 export declare function parseD1StoredWalletAddAuthMethodFinalizeReplay(raw: unknown): StoredWalletAddAuthMethodFinalizeReplay | null;
 export declare function parseD1StoredWalletAddSignerFinalizeReplay(raw: unknown): StoredWalletAddSignerFinalizeReplay | null;
 export declare function parseD1WalletAddSignerFinalizeTerminalResponse(raw: unknown): WalletAddSignerFinalizeResponse | null;
 export declare function parseD1WalletRegistrationFinalizeReplayResponse(raw: unknown): D1WalletRegistrationFinalizeReplaySuccess | null;
-export declare function parseD1StoredNearEd25519YaoAuthorizedBranch(record: Record<string, unknown>): StoredWalletRegistrationNearEd25519YaoAuthorizedBranch | null;
 export declare function parseD1WalletRegistrationCommittedInstallationProjection(raw: unknown): WalletRegistrationCommittedInstallationProjectionV1 | null;
 export declare function parseD1StoredAddSignerIntent(raw: unknown): StoredAddSignerIntent | null;
 export declare function parseD1AddSignerIntent(raw: unknown): AddSignerIntentV1 | null;
 export declare function parseD1StoredWalletAddSignerCeremony(raw: unknown): StoredWalletAddSignerCeremony | null;
 export declare function parseD1StoredAddSignerAuth(raw: unknown): StoredWalletAddSignerCeremony['auth'] | null;
-export declare function parseD1WalletAddSignerFinalizeRequest(raw: unknown): StoredWalletAddSignerFinalizeRequest | null;
 export declare function parseD1EcdsaDerivationServerBootstrapResponse(raw: unknown): EcdsaDerivationServerBootstrapResponse | null;
 export declare function runtimePolicyScopeMatches(left: RuntimePolicyScopeLike | undefined, right: RuntimePolicyScopeLike | undefined): boolean;
 export declare function positiveIntegerArraysEqual(left: readonly number[], right: readonly number[]): boolean;
 export declare function thresholdEcdsaChainTargetsEqual(left: readonly unknown[], right: readonly unknown[]): boolean;
-export declare function isMatchingD1EcdsaClientBootstrap(input: {
-    readonly expected: WalletRegistrationEcdsaPrepareContext;
-    readonly actual: WalletRegistrationEcdsaClientBootstrap;
-}): boolean;
-export declare function toD1EcdsaDerivationClientBootstrapRequest(clientBootstrap: WalletRegistrationEcdsaClientBootstrap): EcdsaDerivationClientBootstrapRequest;
-export type D1EcdsaWalletKeyBuildResult = {
+type D1EcdsaWalletKeyBuildResult = {
     readonly ok: true;
     readonly walletKeys: WalletRegistrationEcdsaWalletKey[];
 } | {
@@ -102,12 +93,9 @@ export declare function buildD1WalletEcdsaSignerRecords(input: {
     readonly now: number;
 }): WalletEcdsaSignerRecord[];
 export { deriveEvmFamilySigningKeySlotId };
-export declare function parseD1PositiveIntegerArray(raw: unknown): number[] | null;
 export declare function parseD1StoredAddAuthMethodIntent(raw: unknown): StoredAddAuthMethodIntent | null;
 export declare function parseD1StoredWalletAddAuthMethodCeremony(raw: unknown): StoredWalletAddAuthMethodCeremony | null;
-export declare function parseD1AddAuthMethodIntent(raw: unknown): AddAuthMethodIntentV1 | null;
 export declare function parseD1RuntimePolicyScope(raw: unknown): RuntimePolicyScope | undefined;
-export declare function parseD1RegistrationAuthority(raw: unknown): RegistrationAuthority | null;
 export declare function normalizeThresholdEcdsaChainTargets(input: readonly unknown[]): ThresholdEcdsaChainTarget[] | null;
 export declare function intentScopeMetadata(input: {
     readonly signingRootId?: string;

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationCeremonyStore.d.ts

@@ -3,13 +3,13 @@ import { StoredAddAuthMethodIntent, StoredAddSignerIntent, StoredWalletAddAuthMe
 import type { WalletId } from '../../../../core/registrationContracts';
 import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
 import { type D1RegistrationCeremonyRecordScope } from './d1RegistrationCeremonyRecordStore';
-export type RegistrationCeremonyIntentStoreConfig = {
+type RegistrationCeremonyIntentStoreConfig = {
     readonly kind: 'partitioned_d1';
     readonly database: D1DatabaseLike;
     readonly scope: D1RegistrationCeremonyRecordScope;
     readonly keyPrefix: string;
 };
-export type D1WalletRegistrationEcdsaCeremonyClaimV1 = {
+type D1WalletRegistrationEcdsaCeremonyClaimV1 = {
     readonly ceremony: StoredWalletRegistrationCeremony;
     readonly version: number;
 };
@@ -27,6 +27,9 @@ export declare class CloudflareD1RegistrationCeremonyIntentStore {
         readonly registrationCeremonyId: string;
         readonly strictRegistrationBindingJson: string;
         readonly registrationRequest: StoredWalletRegistrationEvmFamilyEcdsaResponseClaimedBranch['registrationRequest'];
+        readonly projectEnvironmentId: string;
+        readonly tenantRootIdentityDigestB64u: string;
+        readonly tenantRootCustodyLineageB64u: string;
     }): Promise<D1WalletRegistrationEcdsaCeremonyClaimV1 | null>;
     claimEcdsaActivation(input: {
         readonly registrationCeremonyId: string;
@@ -81,4 +84,5 @@ export declare class CloudflareD1RegistrationCeremonyIntentStore {
     private getDel;
     private del;
 }
+export {};
 //# sourceMappingURL=d1RegistrationCeremonyStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationCommitStore.d.ts

@@ -1,23 +1,27 @@
 import type { ActiveWalletAuthorityV1 } from '../../../../../../shared-ts/src/authorization/walletAuthority';
-import { type RegistrationAuthority, type WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import { type ActiveWalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
+import { type RegistrationAuthority } from '../../../../../../shared-ts/src/utils/registrationAuthMethodInput';
 import type { WalletRecord, WalletSignerRecord } from '../../../../core/WalletStore';
-import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
+import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
 import type { D1EmailOtpRegistrationCommitPlan } from '../emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer';
 type D1WalletRegistrationCommitBase = {
     readonly wallet: WalletRecord;
     readonly walletSigners: readonly WalletSignerRecord[];
     readonly now: number;
+    /**
+     * The Ed25519 Yao lifecycle decision this commit makes visible, when it
+     * finalizes one: it commits in this batch or nothing does.
+     */
+    readonly decisionStatements: readonly D1PreparedStatementLike[];
 };
 type D1WalletRegistrationFoundingFields = {
     readonly foundingAuthority?: never;
     readonly foundingAuthMethod?: never;
 } | {
     readonly foundingAuthority: ActiveWalletAuthorityV1;
-    readonly foundingAuthMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly status: 'active';
-    }>;
+    readonly foundingAuthMethod: ActiveWalletAuthMethodRecordV2;
 };
-export type D1WalletRegistrationCommitInput = (D1WalletRegistrationCommitBase & D1WalletRegistrationFoundingFields & {
+type D1WalletRegistrationCommitInput = (D1WalletRegistrationCommitBase & D1WalletRegistrationFoundingFields & {
     readonly kind: 'passkey_wallet_registration_commit_v1';
     readonly authority: Extract<RegistrationAuthority, {
         readonly kind: 'passkey';

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationService.d.ts

@@ -13,6 +13,7 @@ import { type RouterAbEcdsaDerivationNormalSigningStateV1, type RouterAbEcdsaDer
 import { WalletRegistrationEcdsaActivationResponse } from '../../../../core/registrationContracts';
 import { type RouterAbEcdsaStrictRegistrationPort } from '../../../domains/ecdsa/routerAbEcdsaStrictRegistration';
 import type { TenantRootCustodyLineageResolverV1 } from '../../../domains/tenantRoot/tenantRootCustodyLineage';
+import { type TenantRootIdentityV1 } from '../../../domains/tenantRoot/tenantRootIdentityResolution';
 import { CloudflareD1RegistrationCeremonyIntentStore } from './d1RegistrationCeremonyStore';
 import type { InstalledLinkedDeviceEcdsaAuthorityProjectionV1, InstalledLinkedDeviceEd25519AuthorityProjectionV1 } from '../deviceLinking/d1LinkedDeviceAuthorityInstallService';
 import { type ThresholdEcdsaKeyInventoryDiagnostics, type ThresholdEcdsaKeyInventoryRecord } from '../../../../core/authService/thresholdEcdsaKeyInventory';
@@ -23,6 +24,7 @@ import type { CloudflareD1WalletCustodyCommitStore } from '../passkeyCustody/d1W
 import { CloudflareD1EmailOtpRegistrationEnrollmentFinalizer } from '../emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer';
 import { CloudflareD1WalletAuthMethodService } from '../wallet/d1WalletAuthMethodService';
 import type { D1WalletRegistrationCommitStore } from './d1WalletRegistrationCommitStore';
+import type { CloudflareD1Ed25519YaoLifecycleDecisionStoreV1 } from '../ed25519Yao/d1Ed25519YaoLifecycleDecisionStore';
 import { type WalletEcdsaSignerKey, type WalletEcdsaSignerRecord } from '../../../../core/WalletStore';
 import type { D1WalletStore } from '../../../../core/d1WalletStore';
 import { type RouterAbEd25519YaoProductRegistrationRuntimeV1 } from '../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration';
@@ -38,7 +40,7 @@ type ActivateWalletRegistrationEcdsaInput = {
         readonly publicFacts: NonNullable<WalletRegistrationActivateInput['ecdsa']>['clientActivation'];
     };
 };
-export type D1LinkedDeviceEd25519AuthorityReaderV1 = {
+type D1LinkedDeviceEd25519AuthorityReaderV1 = {
     readInstalledEd25519AuthorityByIdentityV1(input: {
         readonly walletId: WalletId;
         readonly authorityId: WalletAuthorityId;
@@ -53,10 +55,10 @@ export type D1LinkedDeviceEd25519AuthorityReaderV1 = {
         readonly authorityId: WalletAuthorityId;
         readonly walletAuthMethodId: WalletAuthMethodId;
     }) => Promise<InstalledLinkedDeviceEcdsaAuthorityProjectionV1 | null>;
-    readonly readInstalledEcdsaAuthorityByMaterialActivationV1?: (input: {
+    readInstalledEcdsaAuthorityChainByMaterialActivationV1(input: {
         readonly walletId: WalletId;
         readonly materialActivation: MpcMaterialActivationRef;
-    }) => Promise<InstalledLinkedDeviceEcdsaAuthorityProjectionV1 | null>;
+    }): Promise<readonly InstalledLinkedDeviceEcdsaAuthorityProjectionV1[]>;
 };
 export type D1WalletRegistrationOperationPreparedV1 = {
     readonly kind: 'd1_wallet_registration_operation_prepared_v1';
@@ -98,7 +100,6 @@ type SponsoredNamedNearAccountCreator = (input: {
      */
     readonly idempotencyKey: string;
 }) => Promise<SponsoredNamedNearAccountCreationResult>;
-export declare function hasEcdsaKeyHandleSetMismatch(expectedKeyHandles: readonly string[], actualKeyHandles: readonly string[]): boolean;
 export declare function ecdsaStrictRegistrationAuthority(facts: RouterAbEcdsaRegistrationRequestFactsV1): {
     readonly subjectId: string;
     readonly sessionId: string;
@@ -120,16 +121,6 @@ type EcdsaPostRegistrationProofInput = {
     readonly request: RouterAbEcdsaDerivationActivationRefreshRequestV1;
     readonly response: RouterAbEcdsaDerivationActivationRefreshForwardedResponseV1;
 };
-/**
- * Folds the Router's own `Server-Timing` header into the Gateway's span list
- * (Refactor 94B Phase 0), so the Router and role-worker breakdown reaches the
- * browser on the same header as the Gateway's own boundaries.
- *
- * Entries without a finite non-negative `dur` are dropped, which also discards
- * Cloudflare's descriptive metrics, and names are restricted to a token
- * charset so a metric name can never forge extra entries downstream.
- */
-export declare function mergeRouterServerTiming(target: Array<readonly [string, number]>, header: string): void;
 export declare class CloudflareD1WalletRegistrationService {
     private readonly authorizationService;
     private readonly authorizationTenantId;
@@ -140,15 +131,16 @@ export declare class CloudflareD1WalletRegistrationService {
     private readonly ecdsaStrictRegistration;
     private readonly tenantRootCustodyLineage;
     private readonly getWalletStore;
-    /** The single Gateway operation row for activate-with-finalize (94C). */
+    /** The single Gateway operation row for activate-with-finalize. */
     private readonly activateSideEffects;
-    /** Deferred NEAR provisioning's own operation row (94C). */
+    /** Deferred NEAR provisioning's own operation row. */
     private readonly nearProvisioningSideEffects;
     private readonly walletRegistrationCommitStore;
     /** Where a ceremony's sealed custody seed and its recovery set land. */
     private readonly walletCustodyCommitStore;
     private readonly walletAuthMethods;
     private readonly getLinkedDeviceEd25519AuthorityReader;
+    private readonly yaoLifecycleDecisions;
     constructor(input: {
         readonly authorizationService: AuthorizationService;
         readonly authorizationTenantId: TenantId;
@@ -165,8 +157,8 @@ export declare class CloudflareD1WalletRegistrationService {
         readonly walletCustodyCommitStore: CloudflareD1WalletCustodyCommitStore;
         readonly walletAuthMethods: CloudflareD1WalletAuthMethodService;
         readonly getLinkedDeviceEd25519AuthorityReader: () => D1LinkedDeviceEd25519AuthorityReaderV1 | null;
+        readonly yaoLifecycleDecisions: CloudflareD1Ed25519YaoLifecycleDecisionStoreV1;
     });
-    getWalletRegistrationRuntimePolicyScope(registrationCeremonyId: string): Promise<RuntimePolicyScope | undefined>;
     resolveEd25519MaterialActivation(input: {
         readonly walletId: string;
         readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
@@ -205,6 +197,7 @@ export declare class CloudflareD1WalletRegistrationService {
         readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
     }): Promise<{
         readonly ok: true;
+        readonly identity: TenantRootIdentityV1;
         readonly identityDigestB64u: string;
         readonly custodyLineageB64u: string;
     } | {
@@ -219,6 +212,7 @@ export declare class CloudflareD1WalletRegistrationService {
         readonly ok: true;
         readonly identityDigestB64u: string;
         readonly custodyLineageB64u: string;
+        readonly projectEnvironmentId: string;
     } | {
         readonly ok: false;
         readonly code: 'not_found' | 'invalid_state' | 'internal';
@@ -261,8 +255,8 @@ export declare class CloudflareD1WalletRegistrationService {
     refreshEd25519YaoWalletSession(request: RouterAbEd25519YaoBudgetRefreshRequestV1): Promise<RouterAbEd25519YaoBudgetRefreshResponseV1>;
     provisionEd25519YaoWalletSession(request: RouterAbEd25519YaoVerifiedWalletUnlockRequestV1): Promise<RouterAbEd25519YaoVerifiedWalletUnlockResponseV1>;
     /**
-     * Refactor 94C. `/wallets/register/setup` — grant, intent, and start in one
-     * request, with one D1 write.
+     * `/wallets/register/setup` — grant, intent, and start in one request, with
+     * one D1 write.
      *
      * Setup runs before the client's WebAuthn create, because it issues the
      * challenge that create signs. So the ECDSA prepare and the Ed25519
@@ -280,7 +274,6 @@ export declare class CloudflareD1WalletRegistrationService {
      * owns idempotency here, so the commit keeps no replay cache of its own.
      */
     private readRegistrationOwnerProofContext;
-    private registrationOwnerProof;
     /** For callers that must read the context before finalize tombstones it. */
     private registrationOwnerProofWithContext;
     authorizeNearRegistrationContinuation(input: {
@@ -339,8 +332,8 @@ export declare class CloudflareD1WalletRegistrationService {
      */
     private authorizeRespondEd25519Branch;
     /**
-     * Refactor 94C. `/wallets/register/activate` — activation and finalization
-     * as one irreversible step behind one Gateway operation row.
+     * `/wallets/register/activate` — activation and finalization as one
+     * irreversible step behind one Gateway operation row.
      *
      * Previously activation and finalization were separate requests with
      * separate idempotency: activation claimed and CAS'd the ceremony branch,

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationSetup.d.ts

@@ -1,6 +1,6 @@
 /**
- * Refactor 94C. `/wallets/register/setup` — one request replacing the bootstrap
- * grant, the registration intent, and registration start.
+ * `/wallets/register/setup` — one request replacing the bootstrap grant, the
+ * registration intent, and registration start.
  *
  * The three legs it replaces made six-plus serialized storage round trips
  * between them, most of it bookkeeping written on every request and read on
@@ -31,7 +31,9 @@
  * allocation and insertion are the same request. Genuine uniqueness is still
  * arbitrated where it always was, by the wallet table at commit.
  */
-import { type RegisterWalletInput, type RegistrationAuthMethodInput, type RegistrationSignerSetSelection, type WalletId } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import { type WalletId } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import { type RegistrationSignerSetSelection } from '../../../../../../shared-ts/src/utils/registrationSignerPlan';
+import { type RegisterWalletInput, type RegistrationAuthMethodInput } from '../../../../../../shared-ts/src/utils/registrationAuthMethodInput';
 import type { RespondEd25519DeferredWorkV2, WalletRegistrationRespondResponseV2, WalletRegistrationSetupResponseV2 } from '../../../../core/threeRouteRegistrationContracts';
 import type { StoredWalletRegistrationCeremony } from '../../../../core/RegistrationCeremonyStore';
 import { mintSignedWalletRegistrationSetup, type WalletRegistrationSetupMinter } from '../../../domains/walletRegistration/walletRegistrationSetupPayload';

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/walletRegistrationEstablishedSessionIssuer.d.ts

@@ -1,4 +1,5 @@
-import type { WalletRegistrationEd25519YaoPublicResult, WalletRegistrationFinalizeAuthMethod } from '../../../../core/registrationContracts';
+import type { WalletRegistrationEd25519YaoPublicResult } from '../../../../core/registrationContracts';
+import type { WalletRegistrationFinalizeAuthMethod } from '../../../../../../shared-ts/src/utils/registrationContracts';
 import { type VerifiedOwnerProof } from '../../../../authorization/factorEvidence';
 import type { AuthorizationService } from '../../../../authorization/service';
 import type { LiveWalletSessionAuthorizationProjectionV2 } from '../../../../authorization/domain';
@@ -12,8 +13,8 @@ import { type WalletAuthAuthority } from '../../../../../../shared-ts/src/utils/
 import { type DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
 import type { RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
 import type { RegistrationEstablishedSessionProjectionTokensV2, RegistrationEstablishedSessionProjectionV2, RegistrationEstablishedSessionResultV2, RegistrationEstablishedSessionV2 } from '../../../../../../shared-ts/src/utils/registrationEstablishedSession';
-export type RegistrationEstablishedSessionIssuerAuthorizationService = Pick<AuthorizationService, 'issueDirectWalletSessionAuthorizationV2' | 'issueDirectRegistrationPromotedWalletSessionAuthorizationV2' | 'readWalletSessionAuthorizationV2ByMint' | 'readWalletSessionAuthorizationV2ByAuthorizationId' | 'refreshWalletSessionAuthorizationV2AuthorityProjection'>;
-export type RegistrationEstablishedSessionIssuerWalletAuthMethodReader = {
+type RegistrationEstablishedSessionIssuerAuthorizationService = Pick<AuthorizationService, 'issueDirectWalletSessionAuthorizationV2' | 'issueDirectRegistrationPromotedWalletSessionAuthorizationV2' | 'readWalletSessionAuthorizationV2ByMint' | 'readWalletSessionAuthorizationV2ByAuthorizationId' | 'refreshWalletSessionAuthorizationV2AuthorityProjection'>;
+type RegistrationEstablishedSessionIssuerWalletAuthMethodReader = {
     readonly readActiveRegistrationAuthority: (authority: StoredRegistrationAuthority) => Promise<{
         readonly authority: ActiveWalletAuthorityV1;
         readonly walletAuthMethodId: WalletAuthMethodId;

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/walletRegistrationSessionCommitReceipt.d.ts

@@ -1,6 +1,7 @@
-import type { WalletRegistrationFinalizeResponse, WalletRegistrationFinalizeSuccess, WalletRegistrationFinalizeAuthMethod } from '../../../../core/registrationContracts';
+import type { WalletRegistrationFinalizeResponse, WalletRegistrationFinalizeSuccess } from '../../../../core/registrationContracts';
+import type { WalletRegistrationFinalizeAuthMethod } from '../../../../../../shared-ts/src/utils/registrationContracts';
 import type { WalletRegistrationActivateResponseV2, WalletRegistrationCommittedInstallationProjectionV1, WalletRegistrationSessionCommitReceiptV2 } from '../../../../core/threeRouteRegistrationContracts';
-import type { RegistrationEstablishedSessionV2, RegistrationEstablishedSessionResultV2, RegistrationEstablishedSessionProjectionV2 } from '../../../../../../shared-ts/src/utils/registrationEstablishedSession';
+import type { RegistrationEstablishedSessionResultV2 } from '../../../../../../shared-ts/src/utils/registrationEstablishedSession';
 import { type WalletSessionMintId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
 export type WalletRegistrationNearProvisioningFinalizeResponse = WalletRegistrationFinalizeResponse | (Extract<WalletRegistrationFinalizeSuccess, {
     readonly kind: 'near_ed25519';
@@ -32,7 +33,6 @@ export type RegistrationCommitExecution<T> = {
 };
 export declare function unissuedRegistrationCommit<T>(response: T): RegistrationCommitExecution<T>;
 export declare function replayedRegistrationCommit<T>(response: T): RegistrationCommitExecution<T>;
-export declare function projectRegistrationEstablishedSessionV2(session: RegistrationEstablishedSessionV2): RegistrationEstablishedSessionProjectionV2;
 export declare function projectWalletRegistrationSessionCommitReceiptV2(input: {
     readonly operation: 'registration_activate' | 'near_provisioning';
     readonly operationFingerprint: string;
@@ -44,7 +44,7 @@ type WalletRegistrationIdentityCommitReceiptV2 = Exclude<WalletRegistrationSessi
         readonly kind: 'error';
     };
 }>;
-export type RegistrationReplayAuthMethodFields = {
+type RegistrationReplayAuthMethodFields = {
     readonly kind: 'passkey';
     readonly authMethod: Extract<WalletRegistrationFinalizeAuthMethod, {
         readonly kind: 'passkey';
@@ -59,7 +59,7 @@ export type RegistrationReplayAuthMethodFields = {
 };
 export declare function registrationReplayAuthMethodFields(receipt: WalletRegistrationIdentityCommitReceiptV2): RegistrationReplayAuthMethodFields;
 export declare function registrationEstablishedMintId(registrationCeremonyId: string): WalletSessionMintId;
-export type RegistrationCommitReceiptCommittedParser = (raw: unknown) => WalletRegistrationSessionCommitReceiptV2['committed'] | null;
+type RegistrationCommitReceiptCommittedParser = (raw: unknown) => WalletRegistrationSessionCommitReceiptV2['committed'] | null;
 /**
  * Parses the one durable registration receipt shape. Nested signer payloads
  * are parsed by the caller's branch parser; this boundary owns the envelope,

package/dist/types/wallet-server/src/router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.d.ts

@@ -1,7 +1,7 @@
 import type { RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
 import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
-import type { RouterAbNormalSigningAdmissionInput } from '../../../domains/signingOperations/routerAbPrivateSigningWorker';
-import type { RouterAbNormalSigningAbuseDecision, RouterAbNormalSigningAdmissionStore, RouterAbNormalSigningProjectPolicyDecision } from '../../../domains/signingOperations/routerAbNormalSigningAdmissionCore';
+import type { RouterAbNormalSigningAdmissionInput } from '../../../domains/signingOperations/routerAbNormalSigningAdmission';
+import type { RouterAbNormalSigningAbuseDecision, RouterAbNormalSigningAdmissionStore, RouterAbNormalSigningProjectPolicyDecision, RouterAbNormalSigningPolicyDecision } from '../../../domains/signingOperations/routerAbNormalSigningAdmissionCore';
 export type CloudflareD1RouterAbNormalSigningAdmissionStoreOptions = {
     readonly database: D1DatabaseLike;
     readonly storageNamespace: string;
@@ -12,13 +12,11 @@ export declare class CloudflareD1RouterAbNormalSigningAdmissionStore implements
     private readonly storageNamespace;
     private readonly now;
     constructor(options: CloudflareD1RouterAbNormalSigningAdmissionStoreOptions);
-    evaluateProjectPolicy(input: RouterAbNormalSigningAdmissionInput): Promise<RouterAbNormalSigningProjectPolicyDecision>;
-    evaluateAbuse(input: RouterAbNormalSigningAdmissionInput): Promise<RouterAbNormalSigningAbuseDecision>;
+    evaluatePolicy(input: RouterAbNormalSigningAdmissionInput): Promise<RouterAbNormalSigningPolicyDecision>;
     setProjectPolicy(scope: RuntimePolicyScope, decision: RouterAbNormalSigningProjectPolicyDecision): Promise<void>;
     clearProjectPolicy(scope: RuntimePolicyScope): Promise<void>;
     setAbuseDecision(input: RouterAbNormalSigningAdmissionInput, decision: RouterAbNormalSigningAbuseDecision): Promise<void>;
     clearAbuseDecision(input: RouterAbNormalSigningAdmissionInput): Promise<void>;
-    private readDecision;
     private putDecision;
     private deleteRecord;
 }

package/dist/types/wallet-server/src/router/cloudflare/d1/signingLanes/d1LaneEffectJournalStore.d.ts

@@ -4,7 +4,6 @@ export type CloudflareD1LaneEffectJournalStoreOptions = CloudflareD1LaneStoreOpt
 export declare class CloudflareD1LaneEffectJournalStore implements LaneEffectJournalStore {
     private readonly database;
     private readonly scope;
-    private readonly now;
     constructor(options: CloudflareD1LaneEffectJournalStoreOptions);
     getEffect(input: {
         readonly effectId: string;