@seams/wallet-server 0.6.2 → 0.7.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (705) hide show
  1. package/artifact-manifest.json +147 -32
  2. package/cloudflare-router-ab/build/deriver-a/build-stamp.json +1 -0
  3. package/cloudflare-router-ab/build/deriver-a/index.js +2 -2
  4. package/cloudflare-router-ab/build/deriver-a/index_bg.wasm +0 -0
  5. package/cloudflare-router-ab/build/deriver-b/build-stamp.json +1 -0
  6. package/cloudflare-router-ab/build/deriver-b/index.js +2 -2
  7. package/cloudflare-router-ab/build/deriver-b/index_bg.wasm +0 -0
  8. package/cloudflare-router-ab/build/local-tools/darwin-arm64/router_ab_local_init +0 -0
  9. package/cloudflare-router-ab/build/local-tools/darwin-x64/router_ab_local_init +0 -0
  10. package/cloudflare-router-ab/build/local-tools/linux-x64/router_ab_local_init +0 -0
  11. package/cloudflare-router-ab/build/router/build-stamp.json +1 -0
  12. package/cloudflare-router-ab/build/router/index.js +2 -2
  13. package/cloudflare-router-ab/build/router/index_bg.wasm +0 -0
  14. package/cloudflare-router-ab/build/signing-worker/build-stamp.json +1 -0
  15. package/cloudflare-router-ab/build/signing-worker/index.js +2 -2
  16. package/cloudflare-router-ab/build/signing-worker/index_bg.wasm +0 -0
  17. package/cloudflare-router-ab/build/tenant-root-control-plane/build-stamp.json +1 -0
  18. package/cloudflare-router-ab/build/tenant-root-control-plane/index.js +2 -2
  19. package/cloudflare-router-ab/build/tenant-root-control-plane/index_bg.wasm +0 -0
  20. package/cloudflare-router-ab/migrations/deriver-a/0012_tenant_root_creation_tombstones.sql +20 -0
  21. package/cloudflare-router-ab/migrations/deriver-a/0013_tenant_root_root_use_admissions.sql +32 -0
  22. package/cloudflare-router-ab/migrations/deriver-a/0014_tenant_root_refresh_supersessions.sql +24 -0
  23. package/cloudflare-router-ab/migrations/deriver-a/0015_tenant_root_root_use_attempts.sql +56 -0
  24. package/cloudflare-router-ab/migrations/deriver-a/0016_tenant_root_root_use_admission_settlement.sql +5 -0
  25. package/cloudflare-router-ab/migrations/deriver-a/0017_tenant_root_root_use_admission_claims.sql +64 -0
  26. package/cloudflare-router-ab/migrations/deriver-a/0018_tenant_root_recovery_retention_keys.sql +12 -0
  27. package/cloudflare-router-ab/migrations/deriver-b/0012_tenant_root_creation_tombstones.sql +20 -0
  28. package/cloudflare-router-ab/migrations/deriver-b/0013_tenant_root_root_use_admissions.sql +32 -0
  29. package/cloudflare-router-ab/migrations/deriver-b/0014_tenant_root_refresh_supersessions.sql +24 -0
  30. package/cloudflare-router-ab/migrations/deriver-b/0015_tenant_root_root_use_attempts.sql +56 -0
  31. package/cloudflare-router-ab/migrations/deriver-b/0016_tenant_root_root_use_admission_settlement.sql +5 -0
  32. package/cloudflare-router-ab/migrations/deriver-b/0017_tenant_root_root_use_admission_claims.sql +64 -0
  33. package/cloudflare-router-ab/migrations/deriver-b/0018_tenant_root_recovery_retention_keys.sql +12 -0
  34. package/cloudflare-router-ab/scripts/bootstrap-local-tenant-root.mjs +81 -16
  35. package/cloudflare-router-ab/scripts/prepare-local-runtime-config.mjs +102 -9
  36. package/cloudflare-router-ab/scripts/start-local-role-workers.mjs +4 -1
  37. package/cloudflare-router-ab/wrangler.deriver-a.toml +24 -0
  38. package/cloudflare-router-ab/wrangler.router.toml +13 -0
  39. package/dist/esm/authorization/capabilityPolicy.js +1 -1
  40. package/dist/esm/authorization/domain.js +2 -2
  41. package/dist/esm/authorization/factorEvidence.js +6 -100
  42. package/dist/esm/authorization/service.js +34 -2
  43. package/dist/esm/authorization/vaultProxyUse.js +3 -4
  44. package/dist/esm/cloud-host.js +16 -11
  45. package/dist/esm/core/EmailOtpRecords.js +19 -1
  46. package/dist/esm/core/EmailOtpStores.js +323 -924
  47. package/dist/esm/core/IdentityStore.js +44 -235
  48. package/dist/esm/core/NearPublicKeyStore.js +21 -63
  49. package/dist/esm/core/RegistrationCeremonyStore.js +3 -1793
  50. package/dist/esm/core/ThresholdService/config.js +1 -82
  51. package/dist/esm/core/ThresholdService/kv.js +3 -3
  52. package/dist/esm/core/ThresholdService/routerAb/ecdsaDerivationPoolFillHandlers.js +37 -5
  53. package/dist/esm/core/ThresholdService/routerAb/ecdsaDerivationPresignBridge.js +4 -74
  54. package/dist/esm/core/ThresholdService/stores/CloudflareDurableObjectStore.js +15 -51
  55. package/dist/esm/core/ThresholdService/stores/KeyStore.js +3 -3
  56. package/dist/esm/core/ThresholdService/stores/SessionStore.js +5 -81
  57. package/dist/esm/core/ThresholdService/stores/WalletSessionStore.js +185 -290
  58. package/dist/esm/core/ThresholdService/validation.js +18 -230
  59. package/dist/esm/core/WalletAuthMethodStore.js +22 -79
  60. package/dist/esm/core/WalletStore.js +58 -185
  61. package/dist/esm/core/WebAuthnAuthenticatorStore.js +57 -340
  62. package/dist/esm/core/WebAuthnCredentialBindingStore.js +90 -369
  63. package/dist/esm/core/WebAuthnLoginChallengeStore.js +17 -397
  64. package/dist/esm/core/WebAuthnSyncChallengeStore.js +17 -397
  65. package/dist/esm/core/authService/AuthService.js +2 -19
  66. package/dist/esm/core/authService/emailOtpChallengeProof.js +1 -1
  67. package/dist/esm/core/authService/emailOtpChallenges.js +1 -1
  68. package/dist/esm/core/authService/emailOtpConfig.js +1 -32
  69. package/dist/esm/core/authService/emailOtpRegistrationEnrollment.js +6 -153
  70. package/dist/esm/core/authService/googleEmailOtpRegistration.js +1 -1
  71. package/dist/esm/core/authService/nearPrivateKeySigning.js +7 -15
  72. package/dist/esm/core/authService/nearTransactions.js +2 -1
  73. package/dist/esm/core/authService/oidcVerification.js +3 -4
  74. package/dist/esm/core/authService/rateLimits.js +1 -31
  75. package/dist/esm/core/authService/registrationThresholdHelpers.js +2 -103
  76. package/dist/esm/core/authService/storeRegistry.js +2 -13
  77. package/dist/esm/core/authService/thresholdEcdsaKeyInventory.js +4 -5
  78. package/dist/esm/core/authService/webauthn.js +15 -50
  79. package/dist/esm/core/authService/webauthnOidcHelpers.js +1 -6
  80. package/dist/esm/core/authService/webauthnVerificationOutcomes.js +60 -0
  81. package/dist/esm/core/authService/webauthnWalletBinding.js +2 -122
  82. package/dist/esm/core/d1IdentityStore.js +32 -66
  83. package/dist/esm/core/d1TenantStore.js +82 -0
  84. package/dist/esm/core/d1WalletAuthMethodStore.js +92 -143
  85. package/dist/esm/core/d1WalletStore.js +14 -12
  86. package/dist/esm/core/deviceLinking/linkedDeviceEmailOtpGrant.js +10 -8
  87. package/dist/esm/core/deviceLinking/linkedDeviceManagement.js +25 -3
  88. package/dist/esm/core/deviceLinking/linkedDeviceSession.js +6 -895
  89. package/dist/esm/core/deviceLinking/linkedDeviceSessionApproval.js +102 -0
  90. package/dist/esm/core/deviceLinking/linkedDeviceSessionRecord.js +668 -0
  91. package/dist/esm/core/emailOtpD1Statements.js +383 -0
  92. package/dist/esm/core/hostedAccountIds.js +2 -2
  93. package/dist/esm/core/keyMaterialBrands.js +2 -48
  94. package/dist/esm/core/nearRelayerAccountProvisioning.js +25 -150
  95. package/dist/esm/core/nearSignerWasmRuntime.js +1 -4
  96. package/dist/esm/core/rpcClients/near/NearClient.js +15 -218
  97. package/dist/esm/core/signingLanes/LaneEnrollmentActivation.js +1 -1
  98. package/dist/esm/core/signingLanes/LaneLifecycleApplicationService.js +2 -4
  99. package/dist/esm/core/signingLanes/LaneLifecycleStore.js +0 -24
  100. package/dist/esm/core/signingLanes/WalletExecutionLaneProjection.js +5 -5
  101. package/dist/esm/core/signingLanes/ecdsaServerRetirement.js +3 -8
  102. package/dist/esm/core/signingLanes/ed25519ServerRetirement.js +1 -4
  103. package/dist/esm/core/storeBackends.js +208 -0
  104. package/dist/esm/core/thresholdEcdsaChainTarget.js +1 -7
  105. package/dist/esm/core/webAuthnD1Statements.js +92 -0
  106. package/dist/esm/core/webAuthnStoreBackends.js +198 -0
  107. package/dist/esm/hosted-wallet-gateway.js +33 -16
  108. package/dist/esm/index.js +2 -2
  109. package/dist/esm/local-hosted-wallet-gateway-worker.js +2 -23
  110. package/dist/esm/localHostedWalletGatewayHandler.js +299 -0
  111. package/dist/esm/localIntendedEcdsaFinalizeFault.js +85 -0
  112. package/dist/esm/localIntendedLinkExecuteFault.js +140 -0
  113. package/dist/esm/localIntendedRevokeFault.js +106 -0
  114. package/dist/esm/localIntendedSessionAdmissionFault.js +139 -0
  115. package/dist/esm/localIntendedYaoExportFault.js +117 -0
  116. package/dist/esm/localIntendedYaoFault.js +13 -16
  117. package/dist/esm/localIntendedYaoFinalizeFault.js +99 -0
  118. package/dist/esm/localIntendedYaoRecoveryFault.js +102 -0
  119. package/dist/esm/localIntendedYaoSigningFault.js +127 -0
  120. package/dist/esm/router/auth/authRequestValidation.js +1 -1
  121. package/dist/esm/router/auth/commonRouterUtils.js +10 -2
  122. package/dist/esm/router/auth/walletSessionFailure.js +1 -14
  123. package/dist/esm/router/cloudflare/d1/auth/d1AuthorizedOperationRouteService.js +23 -0
  124. package/dist/esm/router/cloudflare/d1/auth/d1RouterApiAuthService.js +86 -66
  125. package/dist/esm/router/cloudflare/d1/authorization/authorizedOperationStatements.js +208 -0
  126. package/dist/esm/router/cloudflare/d1/authorization/d1AuthorizationStore.js +246 -296
  127. package/dist/esm/router/cloudflare/d1/authorization/persistedWalletSessionAuthorization.js +14 -0
  128. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService.js +62 -63
  129. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEmailOtpGrantStore.js +3 -6
  130. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEmailOtpTargetFactor.js +1 -19
  131. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceManagementService.js +4 -3
  132. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceOwnerAuthorizationProvider.js +52 -9
  133. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRequestProofNonceStore.js +3 -6
  134. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRevocation.js +100 -0
  135. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionRecords.js +7 -10
  136. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionStore.js +33 -124
  137. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSourceContributionPreparationPlanner.js +2 -2
  138. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetCredentialProvider.js +9 -17
  139. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceVerifiedLinkBuilder.js +6 -6
  140. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceVerifiedLinkSourceReader.js +3 -1
  141. package/dist/esm/router/cloudflare/d1/deviceLinking/index.js +3 -3
  142. package/dist/esm/router/cloudflare/d1/deviceLinking/installedEcdsaAuthority.js +69 -0
  143. package/dist/esm/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoCapabilityPersistence.js +39 -68
  144. package/dist/esm/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoLifecycleDecisionStore.js +69 -0
  145. package/dist/esm/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoProductRegistrationPartitionedStateStore.js +2 -2
  146. package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeStore.js +26 -71
  147. package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeVerifier.js +20 -3
  148. package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpEnrollmentStore.js +7 -94
  149. package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpGrantStore.js +5 -47
  150. package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRecords.js +26 -123
  151. package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRecoveryService.js +0 -2
  152. package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer.js +2 -2
  153. package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationAttemptStore.js +15 -134
  154. package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationRecords.js +54 -260
  155. package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpSessionResolver.js +1 -1
  156. package/dist/esm/router/cloudflare/d1/identity/d1IdentityRecords.js +1 -28
  157. package/dist/esm/router/cloudflare/d1/near/d1NearPublicKeyStore.js +2 -8
  158. package/dist/esm/router/cloudflare/d1/passkeyCustody/d1PasskeyCustodyEnvelopeStore.js +1 -1
  159. package/dist/esm/router/cloudflare/d1/passkeyCustody/d1PasskeyCustodyRouteService.js +3 -3
  160. package/dist/esm/router/cloudflare/d1/passkeyCustody/d1WalletCustodyCommitStore.js +23 -73
  161. package/dist/esm/router/cloudflare/d1/passkeyCustody/d1WalletRecoveryGoogleEmailOtpRecords.js +15 -2
  162. package/dist/esm/router/cloudflare/d1/passkeyCustody/d1WalletRecoveryGoogleEmailOtpService.js +12 -203
  163. package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore.js +16 -32
  164. package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyRecords.js +29 -72
  165. package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyStore.js +4 -1
  166. package/dist/esm/router/cloudflare/d1/registration/d1RegistrationIntentService.js +3 -1
  167. package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationCommitStore.js +6 -30
  168. package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationService.js +261 -205
  169. package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationSetup.js +5 -3
  170. package/dist/esm/router/cloudflare/d1/registration/walletRegistrationEstablishedSessionIssuer.js +2 -2
  171. package/dist/esm/router/cloudflare/d1/registration/walletRegistrationSessionCommitReceipt.js +3 -3
  172. package/dist/esm/router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.js +43 -25
  173. package/dist/esm/router/cloudflare/d1/signingLanes/d1LaneEffectJournalStore.js +0 -1
  174. package/dist/esm/router/cloudflare/d1/signingLanes/d1LaneLifecycleStore.js +1 -1
  175. package/dist/esm/router/cloudflare/d1/signingLanes/d1LaneRecords.js +2 -1
  176. package/dist/esm/router/cloudflare/d1/versionedJson/d1VersionedJsonRecordStore.js +2 -60
  177. package/dist/esm/router/cloudflare/d1/wallet/d1WalletAddSignerService.js +158 -19
  178. package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthMethodBoundary.js +19 -49
  179. package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthMethodRevocationReplayStore.js +100 -0
  180. package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthMethodService.js +132 -33
  181. package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthorityStore.js +83 -4
  182. package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnAuthService.js +14 -49
  183. package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnRecords.js +4 -4
  184. package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnStore.js +22 -116
  185. package/dist/esm/router/cloudflare/runtime/createSelfHostedCloudflareSigningWorker.js +1 -2
  186. package/dist/esm/router/cloudflare/runtime/walletConsoleTenantRootLineage.js +11 -2
  187. package/dist/esm/router/cloudflare/runtime/walletGateway.js +1 -1
  188. package/dist/esm/router/cloudflare/signingLanes/cloudflareLaneCurveExecution.js +5 -6
  189. package/dist/esm/router/cloudflare/signingLanes/cloudflareLaneProtocolCommitter.js +2 -1
  190. package/dist/esm/router/cloudflare/signingLanes/cloudflareOrdinaryInactiveSignerMaterialReservation.js +48 -21
  191. package/dist/esm/router/cloudflare.js +11480 -12853
  192. package/dist/esm/router/domains/ecdsa/routerAbEcdsaStrictRegistration.js +16 -5
  193. package/dist/esm/router/domains/ecdsa/thresholdEcdsaRequestValidation.js +2 -8
  194. package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoLifecycleDecision.js +33 -0
  195. package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js +17 -9
  196. package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore.js +29 -431
  197. package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitioning.js +7 -2
  198. package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationRequestScopedRunner.js +2 -1
  199. package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationRequestScopedRuntime.js +70 -2
  200. package/dist/esm/router/domains/ed25519Yao/export/routerAbEd25519YaoExport.js +134 -169
  201. package/dist/esm/router/domains/ed25519Yao/export/routerAbEd25519YaoExportRequestScopedCloudflare.js +77 -162
  202. package/dist/esm/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery.js +205 -51
  203. package/dist/esm/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryRequestScopedCloudflare.js +29 -11
  204. package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoHttpRegistrationBackend.js +182 -55
  205. package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistration.js +2 -1
  206. package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationExecutionRecord.js +63 -247
  207. package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationIntentAuthorization.js +3 -2
  208. package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationRequestScopedCloudflare.js +87 -132
  209. package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationTwoPhaseRunner.js +5 -4
  210. package/dist/esm/router/domains/ed25519Yao/routerAbEd25519YaoGatewayEnvelope.js +45 -0
  211. package/dist/esm/router/domains/ed25519Yao/session/thresholdEd25519RequestValidation.js +1 -1
  212. package/dist/esm/router/domains/emailOtp/emailOtpExportPolicy.js +1 -42
  213. package/dist/esm/router/domains/emailOtp/emailOtpRequestValidation.js +1 -6
  214. package/dist/esm/router/domains/emailOtp/emailOtpSessionRouteHelpers.js +1 -142
  215. package/dist/esm/router/domains/passkeyCustody/passkeyCustodyEnvelopeRetrievalRoute.js +1 -1
  216. package/dist/esm/router/domains/passkeyCustody/walletCustodyRegistrationCommit.js +2 -2
  217. package/dist/esm/router/domains/passkeyCustody/walletRecoveryFinalization.js +23 -45
  218. package/dist/esm/router/domains/passkeyCustody/walletRecoveryKeyManifest.js +5 -5
  219. package/dist/esm/router/domains/signingOperations/ed25519AuthorizedOperationReceipt.js +1 -1
  220. package/dist/esm/router/domains/signingOperations/routerAbEcdsaDerivationNormalSigningRoute.js +827 -0
  221. package/dist/esm/router/domains/signingOperations/routerAbEd25519NormalSigningRoute.js +698 -0
  222. package/dist/esm/router/domains/signingOperations/routerAbNormalSigningAdmission.js +209 -0
  223. package/dist/esm/router/domains/signingOperations/routerAbNormalSigningAdmissionCore.js +16 -15
  224. package/dist/esm/router/domains/signingOperations/routerAbOperationStepUp.js +313 -0
  225. package/dist/esm/router/domains/signingOperations/routerAbPrivateSigningWorker.js +62 -2159
  226. package/dist/esm/router/domains/tenantRoot/tenantRootIdentityResolution.js +1 -1
  227. package/dist/esm/router/domains/walletRegistration/walletRegistrationRoutes.js +18 -22
  228. package/dist/esm/router/domains/walletRegistration/walletRegistrationSetupPayload.js +3 -4
  229. package/dist/esm/router/domains/walletUnlock/walletUnlockRequestedCapabilitiesValidation.js +2 -2
  230. package/dist/esm/router/domains/walletUnlock/walletUnlockRouteHandlers.js +97 -150
  231. package/dist/esm/router/express.js +5967 -6410
  232. package/dist/esm/router/framework/http.js +1 -4
  233. package/dist/esm/router/framework/ror/normalize.js +1 -1
  234. package/dist/esm/router/framework/routerApiRouteSurface.js +1 -1
  235. package/dist/esm/router/node/nodeHostedWalletGateway.js +64 -0
  236. package/dist/esm/router/node/nodeHostedWalletGatewayCheck.js +163 -0
  237. package/dist/esm/router/node/nodeHostedWalletGatewayMain.js +120 -0
  238. package/dist/esm/router/node/nodeHttp.js +79 -0
  239. package/dist/esm/router/node/nodeSqlite.js +43 -0
  240. package/dist/esm/router/node/signerSqlMigrations.js +48 -0
  241. package/dist/esm/router/transport/fetch/createFetchRouter.js +1 -1
  242. package/dist/esm/router/transport/fetch/routes/deviceLinking.js +16 -18
  243. package/dist/esm/router/transport/fetch/routes/deviceLinkingOwnerAuthorization.js +3 -5
  244. package/dist/esm/router/transport/fetch/routes/deviceManagement.js +15 -24
  245. package/dist/esm/router/transport/fetch/routes/normalSigningRouterProxy.js +3 -16
  246. package/dist/esm/router/transport/fetch/routes/passkeyCustody.js +144 -461
  247. package/dist/esm/router/transport/fetch/routes/sessions.js +4 -4
  248. package/dist/esm/router/transport/fetch/routes/syncAccount.js +4 -6
  249. package/dist/esm/router/transport/fetch/routes/syncAccountBootstrap.js +2 -2
  250. package/dist/esm/router/transport/fetch/routes/thresholdEcdsa.js +69 -23
  251. package/dist/esm/router/transport/fetch/routes/thresholdEd25519.js +52 -27
  252. package/dist/esm/shared-ts/src/authorization/capabilityKinds.js +1 -1
  253. package/dist/esm/shared-ts/src/authorization/delegatedAuthority.js +1 -1
  254. package/dist/esm/shared-ts/src/authorization/operationFingerprint.js +1 -2
  255. package/dist/esm/shared-ts/src/authorization/walletAuthority.js +99 -227
  256. package/dist/esm/shared-ts/src/authorization/walletCustodyOperation.js +4 -6
  257. package/dist/esm/shared-ts/src/device-linking/activeWalletSession.js +74 -0
  258. package/dist/esm/shared-ts/src/device-linking/authorityActivation.js +50 -0
  259. package/dist/esm/shared-ts/src/device-linking/committedSignerPackages.js +8 -9
  260. package/dist/esm/shared-ts/src/device-linking/delegatedActivationPlan.js +3 -1
  261. package/dist/esm/shared-ts/src/device-linking/deviceManagement.js +55 -0
  262. package/dist/esm/shared-ts/src/device-linking/digests.js +10 -65
  263. package/dist/esm/shared-ts/src/device-linking/ed25519ExportRoot.js +3 -1
  264. package/dist/esm/shared-ts/src/device-linking/index.js +4 -1
  265. package/dist/esm/shared-ts/src/device-linking/parsers.js +510 -1063
  266. package/dist/esm/shared-ts/src/device-linking/requestProof.js +5 -14
  267. package/dist/esm/shared-ts/src/device-linking/sourceContribution.js +6 -9
  268. package/dist/esm/shared-ts/src/device-linking/walletSessionCredentialDelivery.js +9 -9
  269. package/dist/esm/shared-ts/src/device-linking/wireFields.js +59 -0
  270. package/dist/esm/shared-ts/src/near/nearClient.js +252 -0
  271. package/dist/esm/shared-ts/src/passkey-custody/credentialActivity.js +3 -1
  272. package/dist/esm/shared-ts/src/passkey-custody/custodyEnvelope.js +7 -5
  273. package/dist/esm/shared-ts/src/passkey-custody/custodySecretBinding.js +6 -4
  274. package/dist/esm/shared-ts/src/passkey-custody/primitives.js +5 -39
  275. package/dist/esm/shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js +1 -5
  276. package/dist/esm/shared-ts/src/signing-lanes/index.js +3 -3
  277. package/dist/esm/shared-ts/src/signing-lanes/ownerContinuity.js +5 -12
  278. package/dist/esm/shared-ts/src/signing-lanes/participantDigest.js +5 -14
  279. package/dist/esm/shared-ts/src/signing-lanes/participants.js +2 -5
  280. package/dist/esm/shared-ts/src/signing-lanes/recordParsers.js +7 -5
  281. package/dist/esm/shared-ts/src/signing-lanes/rotationDigests.js +6 -45
  282. package/dist/esm/shared-ts/src/signing-lanes/rotationParsers.js +423 -1511
  283. package/dist/esm/shared-ts/src/signing-lanes/rotationProtocolParsers.js +323 -0
  284. package/dist/esm/shared-ts/src/signing-lanes/rotationWireFields.js +59 -0
  285. package/dist/esm/shared-ts/src/tenant-root/tenantRootOperationRecord.js +1 -1
  286. package/dist/esm/shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js +1 -2
  287. package/dist/esm/shared-ts/src/threshold/keyMaterialBrands.js +49 -0
  288. package/dist/esm/shared-ts/src/utils/addAuthMethodRegistration.js +3 -4
  289. package/dist/esm/shared-ts/src/utils/canonicalPrimitives.js +8 -1
  290. package/dist/esm/shared-ts/src/utils/digestEncoding.js +63 -0
  291. package/dist/esm/shared-ts/src/utils/emailOtpDomain.js +2 -2
  292. package/dist/esm/shared-ts/src/utils/exactRecord.js +44 -0
  293. package/dist/esm/shared-ts/src/utils/registrationAuthMethodInput.js +127 -0
  294. package/dist/esm/shared-ts/src/utils/registrationEstablishedSession.js +2 -2
  295. package/dist/esm/shared-ts/src/utils/registrationIds.js +280 -0
  296. package/dist/esm/shared-ts/src/utils/registrationIntent.js +4 -1170
  297. package/dist/esm/shared-ts/src/utils/registrationSignerPlan.js +429 -0
  298. package/dist/esm/shared-ts/src/utils/routerAbEcdsaDerivation.js +11 -136
  299. package/dist/esm/shared-ts/src/utils/routerAbEd25519Yao.js +3 -163
  300. package/dist/esm/shared-ts/src/utils/routerAbEd25519YaoDigests.js +160 -0
  301. package/dist/esm/shared-ts/src/utils/routerAbNormalSigningIdentity.js +1 -4
  302. package/dist/esm/shared-ts/src/utils/routerAbPublicKeyset.js +7 -15
  303. package/dist/esm/shared-ts/src/utils/validation.js +37 -6
  304. package/dist/esm/shared-ts/src/utils/walletAuthMethodRecord.js +362 -0
  305. package/dist/esm/shared-ts/src/utils/wireSchema.js +77 -0
  306. package/dist/esm/shared-ts/src/wallet-recovery/recoveryCodeLocator.js +1 -1
  307. package/dist/esm/shared-ts/src/wallet-recovery/recoveryCodeReservation.js +1 -1
  308. package/dist/esm/shared-ts/src/wallet-recovery/walletRecoveryCommittedProjection.js +7 -11
  309. package/dist/esm/shared-ts/src/wallet-recovery/walletRecoveryEcdsaPossession.js +4 -8
  310. package/dist/esm/shared-ts/src/wallet-recovery/walletRecoveryEnvelopeSet.js +3 -1
  311. package/dist/esm/storage/d1Sql.js +10 -1
  312. package/dist/esm/storage/syncSqlite.js +79 -0
  313. package/dist/esm/threshold/session/signingSessionSeal/crypto/cipher.js +1 -1
  314. package/dist/esm/threshold/session/signingSessionSeal/crypto/shamir3PassWasm.js +1 -1
  315. package/dist/esm/threshold/session/signingSessionSeal/idempotencyRecords.js +1 -2
  316. package/dist/esm/threshold/session/signingSessionSeal/options.js +1 -1
  317. package/dist/esm/threshold/session/signingSessionSeal/transport/shared.js +18 -55
  318. package/dist/esm/threshold/statusCodes.js +1 -1
  319. package/dist/esm/wasm/near_signer/pkg/wasm_signer_worker.js +3 -3
  320. package/dist/esm/wasm/near_signer/pkg/wasm_signer_worker_bg.wasm +0 -0
  321. package/dist/esm/wasm/router_ab_ecdsa_signing_worker/pkg/router_ab_ecdsa_signing_worker_bg.wasm +0 -0
  322. package/dist/types/shared-ts/src/authorization/capabilityKinds.d.ts +8 -26
  323. package/dist/types/shared-ts/src/authorization/delegatedAuthority.d.ts +0 -8
  324. package/dist/types/shared-ts/src/authorization/operationFingerprint.d.ts +1 -3
  325. package/dist/types/shared-ts/src/authorization/walletAuthority.d.ts +25 -12
  326. package/dist/types/shared-ts/src/authorization/walletSessionIssuance.d.ts +2 -1
  327. package/dist/types/shared-ts/src/device-linking/activeWalletSession.d.ts +3 -2
  328. package/dist/types/shared-ts/src/device-linking/authorityActivation.d.ts +5 -0
  329. package/dist/types/shared-ts/src/device-linking/committedSignerPackages.d.ts +2 -5
  330. package/dist/types/shared-ts/src/device-linking/contracts.d.ts +8 -11
  331. package/dist/types/shared-ts/src/device-linking/contracts.typecheck.d.ts +2 -1
  332. package/dist/types/shared-ts/src/device-linking/deviceManagement.d.ts +7 -0
  333. package/dist/types/shared-ts/src/device-linking/digests.d.ts +0 -5
  334. package/dist/types/shared-ts/src/device-linking/ed25519ExportRoot.d.ts +3 -2
  335. package/dist/types/shared-ts/src/device-linking/index.d.ts +2 -0
  336. package/dist/types/shared-ts/src/device-linking/parsers.d.ts +4 -41
  337. package/dist/types/shared-ts/src/device-linking/requestProof.d.ts +0 -1
  338. package/dist/types/shared-ts/src/device-linking/sourceContribution.d.ts +3 -2
  339. package/dist/types/shared-ts/src/device-linking/walletSessionCredentialDelivery.d.ts +2 -1
  340. package/dist/types/shared-ts/src/device-linking/wireFields.d.ts +26 -0
  341. package/dist/types/shared-ts/src/near/actions.d.ts +4 -4
  342. package/dist/types/shared-ts/src/near/delegate.d.ts +3 -2
  343. package/dist/types/shared-ts/src/near/nearClient.d.ts +145 -0
  344. package/dist/types/shared-ts/src/passkey-custody/ceremonyCommitPayload.d.ts +0 -22
  345. package/dist/types/shared-ts/src/passkey-custody/credentialActivity.d.ts +2 -4
  346. package/dist/types/shared-ts/src/passkey-custody/custodyEnvelope.d.ts +9 -18
  347. package/dist/types/shared-ts/src/passkey-custody/custodySecretBinding.d.ts +8 -24
  348. package/dist/types/shared-ts/src/passkey-custody/index.d.ts +0 -2
  349. package/dist/types/shared-ts/src/passkey-custody/primitives.d.ts +0 -14
  350. package/dist/types/shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.d.ts +0 -15
  351. package/dist/types/shared-ts/src/signing-lanes/execution.d.ts +2 -51
  352. package/dist/types/shared-ts/src/signing-lanes/index.d.ts +1 -2
  353. package/dist/types/shared-ts/src/signing-lanes/ownerContinuity.d.ts +1 -2
  354. package/dist/types/shared-ts/src/signing-lanes/participantDigest.d.ts +5 -27
  355. package/dist/types/shared-ts/src/signing-lanes/participants.d.ts +0 -11
  356. package/dist/types/shared-ts/src/signing-lanes/recordParsers.d.ts +6 -53
  357. package/dist/types/shared-ts/src/signing-lanes/records.d.ts +1 -2
  358. package/dist/types/shared-ts/src/signing-lanes/rotation.d.ts +15 -37
  359. package/dist/types/shared-ts/src/signing-lanes/rotationDigests.d.ts +1 -20
  360. package/dist/types/shared-ts/src/signing-lanes/rotationLifecycle.d.ts +4 -25
  361. package/dist/types/shared-ts/src/signing-lanes/rotationParsers.d.ts +1 -41
  362. package/dist/types/shared-ts/src/signing-lanes/rotationProtocolParsers.d.ts +6 -0
  363. package/dist/types/shared-ts/src/signing-lanes/rotationWireFields.d.ts +20 -0
  364. package/dist/types/shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.d.ts +2 -35
  365. package/dist/types/shared-ts/src/threshold/ed25519OperationFingerprint.d.ts +8 -35
  366. package/dist/types/shared-ts/src/threshold/keyMaterialBrands.d.ts +25 -0
  367. package/dist/types/shared-ts/src/threshold/participants.d.ts +3 -9
  368. package/dist/types/shared-ts/src/threshold/secp256k1.d.ts +0 -37
  369. package/dist/types/shared-ts/src/threshold/sessionPolicy.d.ts +24 -0
  370. package/dist/types/shared-ts/src/threshold/signingRootScope.d.ts +2 -5
  371. package/dist/types/shared-ts/src/utils/addAuthMethodRegistration.d.ts +3 -4
  372. package/dist/types/shared-ts/src/utils/addWalletAuthMethod.d.ts +7 -108
  373. package/dist/types/shared-ts/src/utils/addWalletAuthMethod.typecheck.d.ts +16 -3
  374. package/dist/types/shared-ts/src/utils/canonicalPrimitives.d.ts +2 -0
  375. package/dist/types/shared-ts/src/utils/digestEncoding.d.ts +9 -0
  376. package/dist/types/shared-ts/src/utils/domainIds.d.ts +1 -2
  377. package/dist/types/shared-ts/src/utils/ecdsaKeyFactsInventory.d.ts +1 -2
  378. package/dist/types/shared-ts/src/utils/emailOtpDomain.d.ts +5 -5
  379. package/dist/types/shared-ts/src/utils/emailOtpRecoveryKey.d.ts +0 -2
  380. package/dist/types/shared-ts/src/utils/errors.d.ts +0 -7
  381. package/dist/types/shared-ts/src/utils/exactRecord.d.ts +12 -0
  382. package/dist/types/shared-ts/src/utils/index.d.ts +5 -2
  383. package/dist/types/shared-ts/src/utils/jsonRpc.d.ts +3 -2
  384. package/dist/types/shared-ts/src/utils/near.d.ts +2 -1
  385. package/dist/types/shared-ts/src/utils/nearRpcResults.d.ts +7 -7
  386. package/dist/types/shared-ts/src/utils/normalize.d.ts +0 -4
  387. package/dist/types/shared-ts/src/utils/registrationAuthMethodInput.d.ts +184 -0
  388. package/dist/types/shared-ts/src/utils/registrationContracts.d.ts +76 -0
  389. package/dist/types/shared-ts/src/utils/registrationEstablishedSession.d.ts +1 -2
  390. package/dist/types/shared-ts/src/utils/registrationIds.d.ts +56 -0
  391. package/dist/types/shared-ts/src/utils/registrationIntent.d.ts +9 -514
  392. package/dist/types/shared-ts/src/utils/registrationSignerPlan.d.ts +142 -0
  393. package/dist/types/shared-ts/src/utils/routerAbEcdsaDerivation.d.ts +21 -92
  394. package/dist/types/shared-ts/src/utils/routerAbEd25519Yao.d.ts +14 -99
  395. package/dist/types/shared-ts/src/utils/routerAbEd25519YaoDigests.d.ts +39 -0
  396. package/dist/types/shared-ts/src/utils/routerAbPublicKeyset.d.ts +10 -15
  397. package/dist/types/shared-ts/src/utils/routerAbTraceContext.d.ts +2 -1
  398. package/dist/types/shared-ts/src/utils/secureRandomId.d.ts +0 -2
  399. package/dist/types/shared-ts/src/utils/signerDomain.d.ts +3 -35
  400. package/dist/types/shared-ts/src/utils/signerSlot.d.ts +0 -4
  401. package/dist/types/shared-ts/src/utils/signingSessionSeal.d.ts +1 -7
  402. package/dist/types/shared-ts/src/utils/validation.d.ts +10 -10
  403. package/dist/types/shared-ts/src/utils/variant.d.ts +11 -0
  404. package/dist/types/shared-ts/src/utils/variant.typecheck.d.ts +22 -0
  405. package/dist/types/shared-ts/src/utils/walletAddSignerActivation.d.ts +2 -2
  406. package/dist/types/shared-ts/src/utils/walletAuthAuthority.d.ts +1 -58
  407. package/dist/types/shared-ts/src/utils/walletAuthMethodRecord.d.ts +104 -0
  408. package/dist/types/shared-ts/src/utils/walletCapabilityBindings.d.ts +3 -7
  409. package/dist/types/shared-ts/src/utils/webauthnDeviceInfo.d.ts +3 -4
  410. package/dist/types/shared-ts/src/utils/wireSchema.d.ts +60 -0
  411. package/dist/types/shared-ts/src/wallet-recovery/backupAcknowledgement.d.ts +2 -1
  412. package/dist/types/shared-ts/src/wallet-recovery/index.d.ts +0 -1
  413. package/dist/types/shared-ts/src/wallet-recovery/recoveryCodeLocator.d.ts +0 -16
  414. package/dist/types/shared-ts/src/wallet-recovery/recoveryCodeReservation.d.ts +2 -11
  415. package/dist/types/shared-ts/src/wallet-recovery/walletRecoveryCommittedProjection.d.ts +6 -18
  416. package/dist/types/shared-ts/src/wallet-recovery/walletRecoveryEcdsaPossession.d.ts +0 -2
  417. package/dist/types/shared-ts/src/wallet-recovery/walletRecoveryEnvelopeSet.d.ts +1 -3
  418. package/dist/types/wallet-server/src/authorization/capabilityPolicy.d.ts +0 -1
  419. package/dist/types/wallet-server/src/authorization/domain.d.ts +25 -5
  420. package/dist/types/wallet-server/src/authorization/ecdsaWalletSessionAdmission.d.ts +37 -0
  421. package/dist/types/wallet-server/src/authorization/ecdsaWalletSessionAdmission.typecheck.d.ts +2 -0
  422. package/dist/types/wallet-server/src/authorization/factorEvidence.d.ts +6 -7
  423. package/dist/types/wallet-server/src/authorization/service.d.ts +52 -3
  424. package/dist/types/wallet-server/src/cloud-host.d.ts +6 -2
  425. package/dist/types/wallet-server/src/core/EmailOtpRecords.d.ts +10 -1
  426. package/dist/types/wallet-server/src/core/EmailOtpStores.d.ts +16 -116
  427. package/dist/types/wallet-server/src/core/IdentityStore.d.ts +2 -7
  428. package/dist/types/wallet-server/src/core/NearPublicKeyStore.d.ts +6 -16
  429. package/dist/types/wallet-server/src/core/RegistrationCeremonyStore.d.ts +29 -90
  430. package/dist/types/wallet-server/src/core/ThresholdService/config.d.ts +0 -12
  431. package/dist/types/wallet-server/src/core/ThresholdService/routerAb/ecdsaDerivationPoolFillHandlers.d.ts +10 -3
  432. package/dist/types/wallet-server/src/core/ThresholdService/routerAb/ecdsaDerivationPresignBridge.d.ts +17 -48
  433. package/dist/types/wallet-server/src/core/ThresholdService/routerAb/internalServiceHttp.d.ts +2 -1
  434. package/dist/types/wallet-server/src/core/ThresholdService/stores/CloudflareDurableObjectStore.d.ts +4 -71
  435. package/dist/types/wallet-server/src/core/ThresholdService/stores/KeyStore.d.ts +2 -1
  436. package/dist/types/wallet-server/src/core/ThresholdService/stores/SessionStore.d.ts +4 -8
  437. package/dist/types/wallet-server/src/core/ThresholdService/stores/StoreConfig.d.ts +2 -1
  438. package/dist/types/wallet-server/src/core/ThresholdService/stores/WalletSessionStore.d.ts +1 -3
  439. package/dist/types/wallet-server/src/core/ThresholdService/validation.d.ts +14 -47
  440. package/dist/types/wallet-server/src/core/WalletAuthMethodStore.d.ts +2 -7
  441. package/dist/types/wallet-server/src/core/WalletStore.d.ts +3 -8
  442. package/dist/types/wallet-server/src/core/WebAuthnAuthenticatorStore.d.ts +7 -22
  443. package/dist/types/wallet-server/src/core/WebAuthnCredentialBindingStore.d.ts +14 -36
  444. package/dist/types/wallet-server/src/core/WebAuthnLoginChallengeStore.d.ts +9 -34
  445. package/dist/types/wallet-server/src/core/WebAuthnSyncChallengeStore.d.ts +9 -34
  446. package/dist/types/wallet-server/src/core/authService/AuthService.d.ts +0 -3
  447. package/dist/types/wallet-server/src/core/authService/emailOtpChallengeOperations.d.ts +6 -5
  448. package/dist/types/wallet-server/src/core/authService/emailOtpChallengeProof.d.ts +9 -17
  449. package/dist/types/wallet-server/src/core/authService/emailOtpChallengeVerification.d.ts +3 -2
  450. package/dist/types/wallet-server/src/core/authService/emailOtpChallenges.d.ts +7 -23
  451. package/dist/types/wallet-server/src/core/authService/emailOtpConfig.d.ts +3 -10
  452. package/dist/types/wallet-server/src/core/authService/emailOtpDelivery.d.ts +4 -3
  453. package/dist/types/wallet-server/src/core/authService/emailOtpGrant.d.ts +4 -3
  454. package/dist/types/wallet-server/src/core/authService/emailOtpRegistrationEnrollment.d.ts +3 -70
  455. package/dist/types/wallet-server/src/core/authService/emailOtpSeal.d.ts +3 -2
  456. package/dist/types/wallet-server/src/core/authService/emailOtpUnlock.d.ts +4 -3
  457. package/dist/types/wallet-server/src/core/authService/googleEmailOtpRegistration.d.ts +5 -8
  458. package/dist/types/wallet-server/src/core/authService/nearPrivateKeySigning.d.ts +3 -2
  459. package/dist/types/wallet-server/src/core/authService/nearPublicKeyMetadata.d.ts +2 -1
  460. package/dist/types/wallet-server/src/core/authService/nearTransactions.d.ts +2 -1
  461. package/dist/types/wallet-server/src/core/authService/oidcVerification.d.ts +4 -3
  462. package/dist/types/wallet-server/src/core/authService/rateLimits.d.ts +0 -3
  463. package/dist/types/wallet-server/src/core/authService/registrationThresholdHelpers.d.ts +0 -26
  464. package/dist/types/wallet-server/src/core/authService/storeRegistry.d.ts +0 -5
  465. package/dist/types/wallet-server/src/core/authService/thresholdEcdsaKeyInventory.d.ts +0 -23
  466. package/dist/types/wallet-server/src/core/authService/webauthn.d.ts +8 -16
  467. package/dist/types/wallet-server/src/core/authService/webauthnOidcHelpers.d.ts +7 -7
  468. package/dist/types/wallet-server/src/core/authService/webauthnVerificationOutcomes.d.ts +43 -0
  469. package/dist/types/wallet-server/src/core/authService/webauthnWalletBinding.d.ts +1 -28
  470. package/dist/types/wallet-server/src/core/d1IdentityStore.d.ts +6 -16
  471. package/dist/types/wallet-server/src/core/d1TenantStore.d.ts +51 -0
  472. package/dist/types/wallet-server/src/core/d1WalletAuthMethodStore.d.ts +11 -29
  473. package/dist/types/wallet-server/src/core/d1WalletStore.d.ts +6 -1
  474. package/dist/types/wallet-server/src/core/deviceLinking/linkedDeviceEd25519ExportRoot.d.ts +2 -1
  475. package/dist/types/wallet-server/src/core/deviceLinking/linkedDeviceEmailOtpGrant.d.ts +2 -1
  476. package/dist/types/wallet-server/src/core/deviceLinking/linkedDeviceManagement.d.ts +44 -26
  477. package/dist/types/wallet-server/src/core/deviceLinking/linkedDeviceSession.d.ts +19 -217
  478. package/dist/types/wallet-server/src/core/deviceLinking/linkedDeviceSessionApproval.d.ts +8 -0
  479. package/dist/types/wallet-server/src/core/deviceLinking/linkedDeviceSessionRecord.d.ts +259 -0
  480. package/dist/types/wallet-server/src/core/deviceLinking/requestProof.d.ts +2 -2
  481. package/dist/types/wallet-server/src/core/emailOtpD1Statements.d.ts +54 -0
  482. package/dist/types/wallet-server/src/core/hostedAccountIds.d.ts +0 -15
  483. package/dist/types/wallet-server/src/core/keyMaterialBrands.d.ts +4 -24
  484. package/dist/types/wallet-server/src/core/nearRelayerAccountProvisioning.d.ts +2 -3
  485. package/dist/types/wallet-server/src/core/nearSignerWasmRuntime.d.ts +0 -1
  486. package/dist/types/wallet-server/src/core/registrationContracts.d.ts +37 -108
  487. package/dist/types/wallet-server/src/core/routerAbSigning/RouterAbNormalSigningRuntime.d.ts +5 -4
  488. package/dist/types/wallet-server/src/core/rpcClients/near/NearClient.d.ts +10 -106
  489. package/dist/types/wallet-server/src/core/signingLanes/LaneAggregateRevocationApplicationService.d.ts +4 -3
  490. package/dist/types/wallet-server/src/core/signingLanes/LaneEffectJournalStore.d.ts +2 -3
  491. package/dist/types/wallet-server/src/core/signingLanes/LaneLifecycleStore.d.ts +2 -3
  492. package/dist/types/wallet-server/src/core/signingLanes/WalletExecutionLaneProjection.d.ts +3 -9
  493. package/dist/types/wallet-server/src/core/signingLanes/ecdsaServerRetirement.d.ts +4 -4
  494. package/dist/types/wallet-server/src/core/signingLanes/ed25519ServerRetirement.d.ts +3 -3
  495. package/dist/types/wallet-server/src/core/storeBackends.d.ts +83 -0
  496. package/dist/types/wallet-server/src/core/threeRouteRegistrationContracts.d.ts +13 -59
  497. package/dist/types/wallet-server/src/core/threeRouteRegistrationContracts.typecheck.d.ts +51 -3
  498. package/dist/types/wallet-server/src/core/thresholdEcdsaChainTarget.d.ts +0 -1
  499. package/dist/types/wallet-server/src/core/types.d.ts +3 -24
  500. package/dist/types/wallet-server/src/core/webAuthnD1Statements.d.ts +29 -0
  501. package/dist/types/wallet-server/src/core/webAuthnStoreBackends.d.ts +96 -0
  502. package/dist/types/wallet-server/src/hosted-wallet-gateway.d.ts +11 -7
  503. package/dist/types/wallet-server/src/index.d.ts +1 -1
  504. package/dist/types/wallet-server/src/local-hosted-wallet-gateway-worker.d.ts +1 -4
  505. package/dist/types/wallet-server/src/localHostedWalletGatewayHandler.d.ts +12 -0
  506. package/dist/types/wallet-server/src/localIntendedEcdsaFinalizeFault.d.ts +33 -0
  507. package/dist/types/wallet-server/src/localIntendedLinkExecuteFault.d.ts +47 -0
  508. package/dist/types/wallet-server/src/localIntendedRevokeFault.d.ts +40 -0
  509. package/dist/types/wallet-server/src/localIntendedSessionAdmissionFault.d.ts +41 -0
  510. package/dist/types/wallet-server/src/localIntendedYaoExportFault.d.ts +41 -0
  511. package/dist/types/wallet-server/src/localIntendedYaoFault.d.ts +7 -1
  512. package/dist/types/wallet-server/src/localIntendedYaoFinalizeFault.d.ts +37 -0
  513. package/dist/types/wallet-server/src/localIntendedYaoRecoveryFault.d.ts +45 -0
  514. package/dist/types/wallet-server/src/localIntendedYaoSigningFault.d.ts +51 -0
  515. package/dist/types/wallet-server/src/router/auth/authRequestValidation.d.ts +10 -21
  516. package/dist/types/wallet-server/src/router/auth/commonRouterUtils.d.ts +5 -10
  517. package/dist/types/wallet-server/src/router/auth/walletSessionFailure.d.ts +1 -4
  518. package/dist/types/wallet-server/src/router/auth/webAuthnCredentialCodecs.d.ts +3 -2
  519. package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1AuthorizedOperationRouteService.d.ts +12 -0
  520. package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1RouterApiAuthBoundary.d.ts +3 -2
  521. package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1RouterApiAuthConfig.d.ts +2 -2
  522. package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1RouterApiAuthService.d.ts +1 -1
  523. package/dist/types/wallet-server/src/router/cloudflare/d1/authorization/authorizedOperationStatements.d.ts +30 -0
  524. package/dist/types/wallet-server/src/router/cloudflare/d1/authorization/d1AuthorizationStore.d.ts +45 -21
  525. package/dist/types/wallet-server/src/router/cloudflare/d1/authorization/persistedWalletSessionAuthorization.d.ts +3 -0
  526. package/dist/types/wallet-server/src/router/cloudflare/d1/authorization/walletSessionAuthorityProjection.d.ts +2 -1
  527. package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService.d.ts +57 -6
  528. package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEmailOtpGrantStore.d.ts +2 -3
  529. package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEmailOtpTargetFactor.d.ts +8 -21
  530. package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceOwnerAuthorizationProvider.d.ts +14 -1
  531. package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRevocation.d.ts +49 -0
  532. package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionRecords.d.ts +1 -1
  533. package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionStore.d.ts +4 -2
  534. package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSourceContributionPreparationPlanner.d.ts +1 -1
  535. package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetCredentialProvider.d.ts +2 -2
  536. package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetPlanner.d.ts +8 -4
  537. package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceVerifiedLinkBuilder.d.ts +3 -5
  538. package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/installedEcdsaAuthority.d.ts +7 -0
  539. package/dist/types/wallet-server/src/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoCapabilityPersistence.d.ts +1 -2
  540. package/dist/types/wallet-server/src/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoLifecycleDecisionStore.d.ts +33 -0
  541. package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeIssuer.d.ts +1 -1
  542. package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeStore.d.ts +13 -3
  543. package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeVerifier.d.ts +24 -5
  544. package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpEnrollmentStore.d.ts +2 -3
  545. package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpGrantStore.d.ts +1 -3
  546. package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpRateLimitStore.d.ts +3 -4
  547. package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpRecords.d.ts +9 -8
  548. package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpRecoveryService.d.ts +0 -2
  549. package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer.d.ts +5 -4
  550. package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationAttemptStore.d.ts +1 -3
  551. package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationRecords.d.ts +3 -21
  552. package/dist/types/wallet-server/src/router/cloudflare/d1/identity/d1IdentityRecords.d.ts +0 -23
  553. package/dist/types/wallet-server/src/router/cloudflare/d1/near/d1NearPublicKeyStore.d.ts +1 -2
  554. package/dist/types/wallet-server/src/router/cloudflare/d1/passkeyCustody/d1PasskeyCustodyEnvelopeStore.d.ts +11 -19
  555. package/dist/types/wallet-server/src/router/cloudflare/d1/passkeyCustody/d1PasskeyCustodyRouteService.d.ts +5 -54
  556. package/dist/types/wallet-server/src/router/cloudflare/d1/passkeyCustody/d1WalletCustodyCommitStore.d.ts +7 -19
  557. package/dist/types/wallet-server/src/router/cloudflare/d1/passkeyCustody/d1WalletRecoveryGoogleEmailOtpRecords.d.ts +4 -3
  558. package/dist/types/wallet-server/src/router/cloudflare/d1/passkeyCustody/d1WalletRecoveryGoogleEmailOtpService.d.ts +8 -12
  559. package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore.d.ts +5 -8
  560. package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationCeremonyRecords.d.ts +10 -22
  561. package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationCeremonyStore.d.ts +6 -2
  562. package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationCommitStore.d.ts +10 -6
  563. package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationService.d.ts +15 -22
  564. package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationSetup.d.ts +5 -3
  565. package/dist/types/wallet-server/src/router/cloudflare/d1/registration/walletRegistrationEstablishedSessionIssuer.d.ts +4 -3
  566. package/dist/types/wallet-server/src/router/cloudflare/d1/registration/walletRegistrationSessionCommitReceipt.d.ts +5 -5
  567. package/dist/types/wallet-server/src/router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.d.ts +3 -5
  568. package/dist/types/wallet-server/src/router/cloudflare/d1/signingLanes/d1LaneEffectJournalStore.d.ts +0 -1
  569. package/dist/types/wallet-server/src/router/cloudflare/d1/versionedJson/d1VersionedJsonRecordStore.d.ts +0 -16
  570. package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAddSignerService.d.ts +29 -14
  571. package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthMethodBoundary.d.ts +15 -12
  572. package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthMethodRevocationReplayStore.d.ts +71 -0
  573. package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthMethodService.d.ts +34 -24
  574. package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthorityStore.d.ts +44 -26
  575. package/dist/types/wallet-server/src/router/cloudflare/d1/webauthn/d1WebAuthnRecords.d.ts +3 -7
  576. package/dist/types/wallet-server/src/router/cloudflare/d1/webauthn/d1WebAuthnStore.d.ts +8 -19
  577. package/dist/types/wallet-server/src/router/cloudflare/runtime/walletConsoleTenantRootLineage.d.ts +2 -1
  578. package/dist/types/wallet-server/src/router/cloudflare/runtime/walletGateway.d.ts +1 -0
  579. package/dist/types/wallet-server/src/router/cloudflare/signingLanes/cloudflareOrdinaryInactiveSignerMaterialReservation.d.ts +15 -2
  580. package/dist/types/wallet-server/src/router/cloudflare-adaptor.d.ts +2 -2
  581. package/dist/types/wallet-server/src/router/domains/ecdsa/routerAbEcdsaStrictRegistration.d.ts +9 -7
  582. package/dist/types/wallet-server/src/router/domains/ecdsa/thresholdEcdsaRequestValidation.d.ts +4 -4
  583. package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoLifecycleDecision.d.ts +46 -0
  584. package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.d.ts +5 -3
  585. package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore.d.ts +20 -79
  586. package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitioning.d.ts +2 -0
  587. package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationRequestScopedRunner.d.ts +1 -1
  588. package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationRequestScopedRuntime.d.ts +4 -3
  589. package/dist/types/wallet-server/src/router/domains/ed25519Yao/export/routerAbEd25519YaoExport.d.ts +62 -42
  590. package/dist/types/wallet-server/src/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery.d.ts +108 -32
  591. package/dist/types/wallet-server/src/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryActivation.typecheck.d.ts +5 -0
  592. package/dist/types/wallet-server/src/router/domains/ed25519Yao/registration/routerAbEd25519YaoHttpRegistrationBackend.d.ts +36 -5
  593. package/dist/types/wallet-server/src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistration.d.ts +5 -4
  594. package/dist/types/wallet-server/src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationExecutionRecord.d.ts +41 -50
  595. package/dist/types/wallet-server/src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationIntentAuthorization.d.ts +2 -2
  596. package/dist/types/wallet-server/src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationRequestScopedCloudflare.d.ts +3 -3
  597. package/dist/types/wallet-server/src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.d.ts +6 -5
  598. package/dist/types/wallet-server/src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationTwoPhaseRunner.d.ts +14 -4
  599. package/dist/types/wallet-server/src/router/domains/ed25519Yao/routerAbEd25519YaoGatewayEnvelope.d.ts +12 -1
  600. package/dist/types/wallet-server/src/router/domains/ed25519Yao/session/routerAbEd25519YaoWalletSession.d.ts +5 -5
  601. package/dist/types/wallet-server/src/router/domains/ed25519Yao/session/thresholdEd25519RequestValidation.d.ts +3 -4
  602. package/dist/types/wallet-server/src/router/domains/emailOtp/emailOtpExportPolicy.d.ts +2 -27
  603. package/dist/types/wallet-server/src/router/domains/emailOtp/emailOtpRequestValidation.d.ts +1 -2
  604. package/dist/types/wallet-server/src/router/domains/emailOtp/emailOtpRouteHandlers.d.ts +2 -1
  605. package/dist/types/wallet-server/src/router/domains/emailOtp/emailOtpSessionRouteHelpers.d.ts +2 -102
  606. package/dist/types/wallet-server/src/router/domains/passkeyCustody/envelopeRevocationAdmission.d.ts +2 -1
  607. package/dist/types/wallet-server/src/router/domains/passkeyCustody/passkeyCustodyEnvelopeRetrieval.d.ts +3 -2
  608. package/dist/types/wallet-server/src/router/domains/passkeyCustody/passkeyCustodyEnvelopeRetrievalRoute.d.ts +1 -9
  609. package/dist/types/wallet-server/src/router/domains/passkeyCustody/registrationCustodyOutcome.d.ts +2 -1
  610. package/dist/types/wallet-server/src/router/domains/passkeyCustody/verifiedCustodyFactor.d.ts +2 -1
  611. package/dist/types/wallet-server/src/router/domains/passkeyCustody/walletCustodyRegistrationAdmission.d.ts +2 -1
  612. package/dist/types/wallet-server/src/router/domains/passkeyCustody/walletCustodyRegistrationCommit.d.ts +2 -28
  613. package/dist/types/wallet-server/src/router/domains/passkeyCustody/walletRecoveryFinalization.d.ts +43 -1
  614. package/dist/types/wallet-server/src/router/domains/passkeyCustody/walletRecoveryKeyManifest.d.ts +7 -7
  615. package/dist/types/wallet-server/src/router/domains/signingOperations/ed25519AuthorizedOperationReceipt.d.ts +0 -3
  616. package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbEcdsaDerivationNormalSigningRoute.d.ts +165 -0
  617. package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbEd25519NormalSigningRoute.d.ts +110 -0
  618. package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbNormalSigningAdmission.d.ts +360 -0
  619. package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbNormalSigningAdmissionCore.d.ts +11 -10
  620. package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbNormalSigningAdmissionCore.typecheck.d.ts +2 -0
  621. package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbOperationStepUp.d.ts +165 -0
  622. package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbPrivateSigningWorker.d.ts +16 -702
  623. package/dist/types/wallet-server/src/router/domains/signingOperations/walletExecutionAdmission.d.ts +5 -12
  624. package/dist/types/wallet-server/src/router/domains/syncAccount/syncAccountRequestValidation.d.ts +5 -4
  625. package/dist/types/wallet-server/src/router/domains/tenantRoot/tenantRootCustodyLineage.d.ts +6 -1
  626. package/dist/types/wallet-server/src/router/domains/tenantRoot/tenantRootIdentityResolution.d.ts +4 -7
  627. package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationInputs.d.ts +2 -1
  628. package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationRoutes.d.ts +8 -8
  629. package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationSetupPayload.d.ts +4 -4
  630. package/dist/types/wallet-server/src/router/domains/walletUnlock/walletUnlockRequestedCapabilitiesValidation.d.ts +4 -4
  631. package/dist/types/wallet-server/src/router/domains/walletUnlock/walletUnlockRouteHandlers.d.ts +4 -62
  632. package/dist/types/wallet-server/src/router/express-adaptor.d.ts +2 -2
  633. package/dist/types/wallet-server/src/router/framework/authServicePort.d.ts +64 -61
  634. package/dist/types/wallet-server/src/router/framework/http.d.ts +0 -1
  635. package/dist/types/wallet-server/src/router/framework/ror/normalize.d.ts +2 -2
  636. package/dist/types/wallet-server/src/router/framework/routeMeteringPolicy.d.ts +3 -2
  637. package/dist/types/wallet-server/src/router/framework/routerApi.d.ts +1 -1
  638. package/dist/types/wallet-server/src/router/framework/routerApiRouteSurface.d.ts +3 -3
  639. package/dist/types/wallet-server/src/router/node/nodeHostedWalletGateway.d.ts +34 -0
  640. package/dist/types/wallet-server/src/router/node/nodeHostedWalletGatewayCheck.d.ts +21 -0
  641. package/dist/types/wallet-server/src/router/node/nodeHostedWalletGatewayMain.d.ts +2 -0
  642. package/dist/types/wallet-server/src/router/node/nodeHttp.d.ts +13 -0
  643. package/dist/types/wallet-server/src/router/node/nodeSqlite.d.ts +22 -0
  644. package/dist/types/wallet-server/src/router/node/signerSqlMigrations.d.ts +20 -0
  645. package/dist/types/wallet-server/src/router/transport/fetch/createFetchRouter.d.ts +1 -3
  646. package/dist/types/wallet-server/src/router/transport/fetch/routes/deviceLinking.d.ts +5 -6
  647. package/dist/types/wallet-server/src/router/transport/fetch/routes/deviceLinkingOwnerAuthorization.d.ts +2 -2
  648. package/dist/types/wallet-server/src/router/transport/fetch/routes/deviceManagement.d.ts +14 -16
  649. package/dist/types/wallet-server/src/router/transport/fetch/routes/normalSigningRouterProxy.d.ts +0 -12
  650. package/dist/types/wallet-server/src/router/transport/fetch/routes/passkeyCustody.d.ts +1 -1
  651. package/dist/types/wallet-server/src/router/transport/fetch/routes/sessions.d.ts +2 -1
  652. package/dist/types/wallet-server/src/router/transport/fetch/routes/syncAccountBootstrap.d.ts +7 -13
  653. package/dist/types/wallet-server/src/router/transport/fetch/routes/thresholdEcdsa.d.ts +3 -57
  654. package/dist/types/wallet-server/src/router/transport/fetch/routes/thresholdEd25519.d.ts +0 -44
  655. package/dist/types/wallet-server/src/storage/d1Sql.d.ts +7 -0
  656. package/dist/types/wallet-server/src/storage/syncSqlite.d.ts +28 -0
  657. package/dist/types/wallet-server/src/threshold/session/signingSessionSeal/crypto/shamir3PassWasm.d.ts +0 -1
  658. package/dist/types/wallet-server/src/threshold/session/signingSessionSeal/idempotencyRecords.d.ts +5 -6
  659. package/dist/types/wallet-server/src/threshold/session/signingSessionSeal/transport/shared.d.ts +1 -0
  660. package/dist/types/wallet-server/src/threshold/statusCodes.d.ts +4 -4
  661. package/migrations/d1-signer/0036_r150_yao_lifecycle_decisions.sql +22 -0
  662. package/migrations/d1-signer/0037_r150_wallet_auth_method_revocation_replays.sql +26 -0
  663. package/migrations/d1-signer/0038_r150_registration_ceremony_cas_guard_seed.sql +8 -0
  664. package/migrations/d1-signer/0039_r150_revocation_replay_answer_kind.sql +9 -0
  665. package/package.json +1 -1
  666. package/dist/esm/core/ThresholdService/ecdsaClientRootProof.js +0 -27
  667. package/dist/esm/core/ThresholdService/routerAbEcdsaSigningWorkerWasm.js +0 -115
  668. package/dist/esm/core/ThresholdService/secureRandomId.js +0 -9
  669. package/dist/esm/core/authService/record.js +0 -8
  670. package/dist/esm/core/authService/thresholdRuntimePolicy.js +0 -19
  671. package/dist/esm/core/authService/walletRegistrationPlanning.js +0 -49
  672. package/dist/esm/core/deviceLinking/index.js +0 -5
  673. package/dist/esm/core/errors.js +0 -54
  674. package/dist/esm/core/routerAbSigning/createCloudflareDurableObjectRouterAbSigningRuntimes.js +0 -39
  675. package/dist/esm/core/signingLanes/WalletKeyStore.js +0 -0
  676. package/dist/esm/core/signingLanes/index.js +0 -8
  677. package/dist/esm/router/domains/tenantRoot/tenantRootEcdsaWalletSessionComposition.js +0 -55
  678. package/dist/esm/router/domains/tenantRoot/tenantRootEd25519WalletSessionComposition.js +0 -56
  679. package/dist/esm/shared-ts/src/signing-lanes/linkedEcdsaScope.js +0 -1
  680. package/dist/esm/wasm/router_ab_ecdsa_signing_worker/pkg/router_ab_ecdsa_signing_worker.js +0 -414
  681. package/dist/types/shared-ts/src/passkey-custody/credentialObservations.d.ts +0 -74
  682. package/dist/types/shared-ts/src/passkey-custody/kekContext.d.ts +0 -34
  683. package/dist/types/shared-ts/src/signing-lanes/linkedEcdsaScope.d.ts +0 -62
  684. package/dist/types/shared-ts/src/signing-lanes/linkedEcdsaScope.typecheck.d.ts +0 -2
  685. package/dist/types/shared-ts/src/signing-lanes/validation.d.ts +0 -11
  686. package/dist/types/shared-ts/src/utils/bigint.d.ts +0 -3
  687. package/dist/types/shared-ts/src/utils/paillier.d.ts +0 -37
  688. package/dist/types/shared-ts/src/utils/recoveryDomain.d.ts +0 -12
  689. package/dist/types/shared-ts/src/utils/signerDomain.typecheck.d.ts +0 -2
  690. package/dist/types/shared-ts/src/wallet-recovery/recoveryKekContext.d.ts +0 -37
  691. package/dist/types/wallet-server/src/core/ThresholdService/ecdsaClientRootProof.d.ts +0 -12
  692. package/dist/types/wallet-server/src/core/ThresholdService/routerAbEcdsaSigningWorkerWasm.d.ts +0 -17
  693. package/dist/types/wallet-server/src/core/ThresholdService/secureRandomId.d.ts +0 -2
  694. package/dist/types/wallet-server/src/core/authService/record.d.ts +0 -2
  695. package/dist/types/wallet-server/src/core/authService/thresholdRuntimePolicy.d.ts +0 -4
  696. package/dist/types/wallet-server/src/core/authService/walletRegistrationPlanning.d.ts +0 -19
  697. package/dist/types/wallet-server/src/core/deviceLinking/index.d.ts +0 -5
  698. package/dist/types/wallet-server/src/core/errors.d.ts +0 -10
  699. package/dist/types/wallet-server/src/core/routerAbSigning/createCloudflareDurableObjectRouterAbSigningRuntimes.d.ts +0 -28
  700. package/dist/types/wallet-server/src/core/signingLanes/SigningLaneStore.d.ts +0 -15
  701. package/dist/types/wallet-server/src/core/signingLanes/WalletKeyStore.d.ts +0 -13
  702. package/dist/types/wallet-server/src/core/signingLanes/index.d.ts +0 -11
  703. package/dist/types/wallet-server/src/router/domains/tenantRoot/tenantRootEcdsaWalletSessionComposition.d.ts +0 -35
  704. package/dist/types/wallet-server/src/router/domains/tenantRoot/tenantRootEd25519WalletSessionComposition.d.ts +0 -35
  705. /package/dist/esm/{core/signingLanes/SigningLaneStore.js → authorization/ecdsaWalletSessionAdmission.js} +0 -0
@@ -1,17 +1,12 @@
1
- import { sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
2
- import { sameRouterAbEd25519YaoActivationBindingV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
3
- import { routerAbEd25519YaoExecutionMatchesAdmissionV1 } from "../registration/routerAbEd25519YaoRegistration.js";
4
1
  import { createRouterAbEd25519YaoProductRegistrationStateV1 } from "./routerAbEd25519YaoProductRegistration.js";
5
2
  import { encodeRouterAbEd25519YaoProductRegistrationStateV1, parseRouterAbEd25519YaoProductRegistrationStateJsonV1 } from "./routerAbEd25519YaoProductRegistrationPersistence.js";
6
3
  import { boundedRouterAbEd25519YaoProductRegistrationSharedStateV1, mergeRouterAbEd25519YaoProductRegistrationStatePartitionV1, partitionRouterAbEd25519YaoProductRegistrationStateV1 } from "./routerAbEd25519YaoProductRegistrationPartitioning.js";
7
- import { ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTION_RECORD_KIND_V1, buildRouterAbEd25519YaoRegistrationExecutionReadyRecordV1, encodeRouterAbEd25519YaoRegistrationExecutionRecordV1, parseRouterAbEd25519YaoRegistrationExecutionRecordV1, routerAbEd25519YaoRegistrationExecutionRecordKeyV1 } from "../registration/routerAbEd25519YaoRegistrationExecutionRecord.js";
4
+ import { buildRouterAbEd25519YaoRegistrationExecutionAuthorityV1 } from "../registration/routerAbEd25519YaoRegistrationExecutionRecord.js";
8
5
  //#region src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore.ts
9
6
  const ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1 = "router-ab-ed25519-yao:shared";
10
7
  const PARTITION_RECORD_CODEC_KIND = "router_ab_ed25519_yao_product_registration_partition_record_json_v1";
11
8
  const SHARED_RECORD_KIND = "router_ab_ed25519_yao_product_registration_shared_record_v1";
12
9
  const CEREMONY_RECORD_KIND = "router_ab_ed25519_yao_product_registration_ceremony_record_v1";
13
- const EXECUTION_RECORD_KIND = ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTION_RECORD_KIND_V1;
14
- const EXECUTION_RECONCILIATION_LEASE_MS = 1e4;
15
10
  function routerAbEd25519YaoPartitionedStateAfterStoredCommitV1(input) {
16
11
  const lifecycleId = requireLifecycleId(input.lifecycleId);
17
12
  const shared = boundedRouterAbEd25519YaoProductRegistrationSharedStateV1(partitionRouterAbEd25519YaoProductRegistrationStateV1(input.state, lifecycleId).shared);
@@ -20,21 +15,30 @@ function routerAbEd25519YaoPartitionedStateAfterStoredCommitV1(input) {
20
15
  baseline: {
21
16
  sharedEncoding: encodeSharedStateCanonicalEncoding(shared),
22
17
  sharedVersion: input.commit.sharedVersion,
23
- ceremonyVersion: input.commit.ceremonyVersion,
24
- executionVersion: input.commit.executionVersion
18
+ ceremonyVersion: input.commit.ceremonyVersion
25
19
  }
26
20
  };
27
21
  }
28
- function createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1(store, atomicPatch) {
29
- return new RouterAbEd25519YaoProductRegistrationPartitionedStateStore(store, atomicPatch);
22
+ function createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1(store) {
23
+ return new RouterAbEd25519YaoProductRegistrationPartitionedStateStore(store);
24
+ }
25
+ /**
26
+ * The admitted authority a registration execute is checked against, from a
27
+ * loaded ceremony state, or `null` when the lifecycle is not admitted.
28
+ */
29
+ function routerAbEd25519YaoAdmittedRegistrationAuthorityV1(state, lifecycleId) {
30
+ const sessionKey = state.registration.lifecycleSessions.get(lifecycleId);
31
+ const registration = sessionKey === void 0 ? void 0 : state.registration.states.get(sessionKey);
32
+ const authority = state.authorization.authorities.find((candidate) => candidate.admissionRequest.scope.lifecycle_id === lifecycleId);
33
+ if (!registration || registration.kind !== "admitted" || !authority) return null;
34
+ return buildRouterAbEd25519YaoRegistrationExecutionAuthorityV1({
35
+ lifecycleId,
36
+ registration,
37
+ authority,
38
+ dispatchRoot: state.registration.dispatchRoots.get(lifecycleId)
39
+ });
30
40
  }
31
41
  function encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1(record) {
32
- if (record.kind === EXECUTION_RECORD_KIND) return {
33
- kind: PARTITION_RECORD_CODEC_KIND,
34
- recordKind: EXECUTION_RECORD_KIND,
35
- lifecycleId: record.lifecycleId,
36
- execution: encodeRouterAbEd25519YaoRegistrationExecutionRecordV1(record.value)
37
- };
38
42
  const lifecycleId = record.kind === SHARED_RECORD_KIND ? "shared" : record.lifecycleId;
39
43
  const state = createRouterAbEd25519YaoProductRegistrationStateV1();
40
44
  const empty = partitionRouterAbEd25519YaoProductRegistrationStateV1(state, lifecycleId);
@@ -86,21 +90,6 @@ function sameVersionedJsonValue(left, right) {
86
90
  }
87
91
  function parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1(input) {
88
92
  if (!isVersionedJsonObject(input) || input.kind !== PARTITION_RECORD_CODEC_KIND) return null;
89
- if (input.recordKind === EXECUTION_RECORD_KIND) {
90
- if (!hasExactObjectKeys(input, [
91
- "kind",
92
- "recordKind",
93
- "lifecycleId",
94
- "execution"
95
- ])) return null;
96
- const lifecycleId = readLifecycleId(input.lifecycleId);
97
- const execution = parseRouterAbEd25519YaoRegistrationExecutionRecordV1(input.execution);
98
- return lifecycleId !== null && execution?.lifecycleId === lifecycleId ? {
99
- kind: EXECUTION_RECORD_KIND,
100
- lifecycleId,
101
- value: execution
102
- } : null;
103
- }
104
93
  if (input.recordKind !== SHARED_RECORD_KIND && input.recordKind !== CEREMONY_RECORD_KIND) return null;
105
94
  if (!hasExactObjectKeys(input, [
106
95
  "kind",
@@ -148,9 +137,8 @@ function isCeremonyStateOwnedByLifecycle(state, lifecycleId) {
148
137
  return true;
149
138
  }
150
139
  var RouterAbEd25519YaoProductRegistrationPartitionedStateStore = class {
151
- constructor(store, atomicPatch) {
140
+ constructor(store) {
152
141
  this.store = store;
153
- this.atomicPatch = atomicPatch;
154
142
  }
155
143
  async readMany(keys) {
156
144
  const encodedEntries = await this.store.readMany(keys);
@@ -161,34 +149,28 @@ var RouterAbEd25519YaoProductRegistrationPartitionedStateStore = class {
161
149
  });
162
150
  return entries;
163
151
  }
164
- async putMany(mutations) {
152
+ async putMany(mutations, companion) {
165
153
  const encodedMutations = [];
166
154
  for (const mutation of mutations) encodedMutations.push({
167
155
  key: mutation.key,
168
156
  value: encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1(mutation.value),
169
157
  expectedVersion: mutation.expectedVersion
170
158
  });
171
- return await this.store.putMany(encodedMutations);
159
+ return await this.store.putMany(encodedMutations, companion);
172
160
  }
173
161
  async load(lifecycleId) {
174
162
  const normalizedLifecycleId = requireLifecycleId(lifecycleId);
175
- const entries = await this.readMany([
176
- ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1,
177
- normalizedLifecycleId,
178
- routerAbEd25519YaoRegistrationExecutionRecordKeyV1(normalizedLifecycleId)
179
- ]);
163
+ const entries = await this.readMany([ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1, normalizedLifecycleId]);
180
164
  const sharedResult = readManyEntry(entries, ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1);
181
165
  const ceremonyResult = readManyEntry(entries, normalizedLifecycleId);
182
166
  const shared = readSharedRecord(sharedResult);
183
167
  const ceremony = readCeremonyRecord(ceremonyResult, normalizedLifecycleId);
184
- const executionVersion = readExecutionVersion(readManyEntry(entries, routerAbEd25519YaoRegistrationExecutionRecordKeyV1(normalizedLifecycleId)), normalizedLifecycleId);
185
168
  return {
186
169
  state: materializeState(shared.value, ceremony.value),
187
170
  baseline: {
188
171
  sharedEncoding: encodeSharedStateCanonicalEncoding(shared.value),
189
172
  sharedVersion: shared.version,
190
- ceremonyVersion: ceremony.version,
191
- executionVersion
173
+ ceremonyVersion: ceremony.version
192
174
  }
193
175
  };
194
176
  }
@@ -214,375 +196,18 @@ var RouterAbEd25519YaoProductRegistrationPartitionedStateStore = class {
214
196
  },
215
197
  expectedVersion: input.baseline.ceremonyVersion
216
198
  });
217
- const execution = registrationExecutionRecordFromState(input.state, lifecycleId);
218
- if (input.baseline.executionVersion === null && execution !== null) mutations.push({
219
- key: routerAbEd25519YaoRegistrationExecutionRecordKeyV1(lifecycleId),
220
- value: {
221
- kind: EXECUTION_RECORD_KIND,
222
- lifecycleId,
223
- value: execution
224
- },
225
- expectedVersion: input.baseline.executionVersion
226
- });
227
- else if (execution !== null) {
228
- const key = routerAbEd25519YaoRegistrationExecutionRecordKeyV1(lifecycleId);
229
- const current = readManyEntry(await this.readMany([key]), key);
230
- if (current.kind === "missing" || current.version !== input.baseline.executionVersion) return {
231
- kind: "version_mismatch",
232
- key: "execution"
233
- };
234
- if (current.value.kind !== EXECUTION_RECORD_KIND) throw new Error("Yao registration execution record has an invalid kind");
235
- const retained = current.value.value;
236
- if (retained.credentialDigestSha256Hex !== execution.credentialDigestSha256Hex || retained.expiresAtMs !== execution.expiresAtMs) mutations.push({
237
- key,
238
- value: {
239
- kind: EXECUTION_RECORD_KIND,
240
- lifecycleId,
241
- value: executionWithCurrentAuthority(retained, execution)
242
- },
243
- expectedVersion: current.version
244
- });
245
- }
246
- const result = await this.putMany(mutations);
199
+ const result = await this.putMany(mutations, input.companionWrite);
247
200
  if (result.kind === "version_mismatch") return {
248
201
  kind: "version_mismatch",
249
- key: result.key === "router-ab-ed25519-yao:shared" ? "shared" : result.key === routerAbEd25519YaoRegistrationExecutionRecordKeyV1(lifecycleId) ? "execution" : "ceremony"
202
+ key: result.key === "router-ab-ed25519-yao:shared" ? "shared" : "ceremony"
250
203
  };
251
204
  return {
252
205
  kind: "stored",
253
206
  sharedVersion: mutations[0]?.key === "router-ab-ed25519-yao:shared" ? findStoredVersion(result.versions, ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1) : input.baseline.sharedVersion,
254
- ceremonyVersion: findStoredVersion(result.versions, lifecycleId),
255
- executionVersion: mutations.some(isRegistrationExecutionMutation) ? findStoredVersion(result.versions, routerAbEd25519YaoRegistrationExecutionRecordKeyV1(lifecycleId)) : input.baseline.executionVersion
207
+ ceremonyVersion: findStoredVersion(result.versions, lifecycleId)
256
208
  };
257
209
  }
258
- async claimRegistrationExecution(input) {
259
- const lifecycleId = requireLifecycleId(input.lifecycleId);
260
- const key = routerAbEd25519YaoRegistrationExecutionRecordKeyV1(lifecycleId);
261
- const admissionBindingJson = JSON.stringify(input.request.binding);
262
- if (this.atomicPatch) {
263
- const patch = await this.atomicPatch({
264
- key,
265
- expectedVersion: "1",
266
- exactStringPredicates: [
267
- {
268
- jsonPath: "$.recordKind",
269
- value: EXECUTION_RECORD_KIND
270
- },
271
- {
272
- jsonPath: "$.lifecycleId",
273
- value: lifecycleId
274
- },
275
- {
276
- jsonPath: "$.execution.kind",
277
- value: "ready"
278
- },
279
- {
280
- jsonPath: "$.execution.admissionBindingJson",
281
- value: admissionBindingJson
282
- },
283
- {
284
- jsonPath: "$.execution.credentialDigestSha256Hex",
285
- value: input.credentialDigestSha256Hex
286
- }
287
- ],
288
- unexpired: {
289
- jsonPath: "$.execution.expiresAtMs",
290
- nowMs: input.nowMs
291
- },
292
- patch: { execution: {
293
- kind: "claimed",
294
- requestDigestSha256Hex: input.requestDigestSha256Hex,
295
- request: versionedJsonObject(input.request),
296
- claimedAtMs: input.nowMs,
297
- reconcileAfterMs: input.nowMs + EXECUTION_RECONCILIATION_LEASE_MS
298
- } }
299
- });
300
- if (patch.kind === "stored") {
301
- const stored = decodeAtomicPatchValue(patch.value);
302
- if (stored?.kind !== EXECUTION_RECORD_KIND || stored.value.kind !== "claimed") throw new Error("Yao registration atomic claim returned an invalid execution record");
303
- return {
304
- kind: "claimed",
305
- value: stored.value,
306
- version: patch.version
307
- };
308
- }
309
- }
310
- return await this.reconcileRegistrationExecutionClaim(input);
311
- }
312
- async commitRegistrationExecution(input) {
313
- const terminal = input.outcome.kind === "completed" ? {
314
- ...input.claimed,
315
- kind: "completed",
316
- result: input.outcome.result,
317
- consumerBinding: null
318
- } : {
319
- ...input.claimed,
320
- kind: "failed",
321
- failure: input.outcome.failure
322
- };
323
- const key = routerAbEd25519YaoRegistrationExecutionRecordKeyV1(input.claimed.lifecycleId);
324
- if ((await this.putMany([{
325
- key,
326
- value: {
327
- kind: EXECUTION_RECORD_KIND,
328
- lifecycleId: input.claimed.lifecycleId,
329
- value: terminal
330
- },
331
- expectedVersion: input.claimedVersion
332
- }])).kind === "stored") return {
333
- kind: "stored",
334
- value: terminal.kind === "completed" ? terminal.result : terminal.failure
335
- };
336
- const current = await this.readRegistrationExecution(input.claimed.lifecycleId);
337
- if (current?.kind === terminal.kind && current.requestDigestSha256Hex === input.claimed.requestDigestSha256Hex) {
338
- if (terminal.kind === "completed" && current.kind === "completed" && sameActivationResult(current.result, terminal.result)) return {
339
- kind: "stored",
340
- value: current.result
341
- };
342
- if (terminal.kind === "failed" && current.kind === "failed" && sameRegistrationFailure(current.failure, terminal.failure)) return {
343
- kind: "stored",
344
- value: current.failure
345
- };
346
- }
347
- return { kind: "uncertain" };
348
- }
349
- async consumeRegistrationExecution(input) {
350
- const lifecycleId = requireLifecycleId(input.reference.lifecycleId);
351
- const key = routerAbEd25519YaoRegistrationExecutionRecordKeyV1(lifecycleId);
352
- for (let attempt = 0; attempt < 2; attempt += 1) {
353
- const entry = readManyEntry(await this.readMany([key]), key);
354
- if (entry.kind === "missing") return {
355
- ok: false,
356
- code: "unknown_registration",
357
- message: "registration lifecycle was not found"
358
- };
359
- if (entry.value.kind !== EXECUTION_RECORD_KIND || entry.value.lifecycleId !== lifecycleId) throw new Error("Yao registration execution record does not match its lifecycle");
360
- const execution = entry.value.value;
361
- if (execution.kind !== "completed") return {
362
- ok: false,
363
- code: "registration_not_activated",
364
- message: "registration lifecycle has no verified Yao activation"
365
- };
366
- if (!sameByteSequence(execution.result.binding.session_id, input.reference.sessionId)) return {
367
- ok: false,
368
- code: "activation_reference_mismatch",
369
- message: "Yao activation reference does not match the admitted registration"
370
- };
371
- if (execution.consumerBinding !== null && execution.consumerBinding !== input.consumerBinding) return {
372
- ok: false,
373
- code: "activation_consumed",
374
- message: "Yao activation was already consumed by wallet finalization"
375
- };
376
- if (execution.consumerBinding !== null) return {
377
- ok: true,
378
- activation: {
379
- admissionRequest: execution.admissionRequest,
380
- admissionReceipt: execution.admissionReceipt,
381
- result: execution.result
382
- }
383
- };
384
- const consumed = {
385
- ...execution,
386
- consumerBinding: input.consumerBinding
387
- };
388
- if ((await this.putMany([{
389
- key,
390
- value: {
391
- kind: EXECUTION_RECORD_KIND,
392
- lifecycleId,
393
- value: consumed
394
- },
395
- expectedVersion: entry.version
396
- }])).kind === "stored") return {
397
- ok: true,
398
- activation: {
399
- admissionRequest: execution.admissionRequest,
400
- admissionReceipt: execution.admissionReceipt,
401
- result: execution.result
402
- }
403
- };
404
- }
405
- throw new Error("Yao registration execution consumer claim did not converge");
406
- }
407
- async reconcileRegistrationExecutionClaim(input) {
408
- const lifecycleId = requireLifecycleId(input.lifecycleId);
409
- const key = routerAbEd25519YaoRegistrationExecutionRecordKeyV1(lifecycleId);
410
- const entry = readManyEntry(await this.readMany([key]), key);
411
- if (entry.kind === "missing") return {
412
- kind: "rejected",
413
- code: "unknown_registration",
414
- message: "registration admission was not found"
415
- };
416
- if (entry.value.kind !== EXECUTION_RECORD_KIND || entry.value.lifecycleId !== lifecycleId) throw new Error("Yao registration execution record does not match its lifecycle");
417
- const execution = entry.value.value;
418
- if (!routerAbEd25519YaoExecutionMatchesAdmissionV1(input.request, execution.admissionReceipt)) return {
419
- kind: "rejected",
420
- code: "binding_mismatch",
421
- message: "registration execution does not match the admitted binding"
422
- };
423
- if (execution.credentialDigestSha256Hex !== input.credentialDigestSha256Hex) return {
424
- kind: "rejected",
425
- code: "credential_rejected",
426
- message: "registration execution credential does not match its admission subject"
427
- };
428
- if (execution.expiresAtMs <= input.nowMs) return {
429
- kind: "rejected",
430
- code: "credential_expired",
431
- message: "registration intent credential is expired"
432
- };
433
- switch (execution.kind) {
434
- case "completed": return execution.requestDigestSha256Hex === input.requestDigestSha256Hex ? {
435
- kind: "completed",
436
- value: execution.result
437
- } : {
438
- kind: "rejected",
439
- code: "binding_mismatch",
440
- message: "completed registration rejects a different execution payload"
441
- };
442
- case "failed": return execution.requestDigestSha256Hex === input.requestDigestSha256Hex ? {
443
- kind: "failed",
444
- value: execution.failure
445
- } : {
446
- kind: "rejected",
447
- code: "binding_mismatch",
448
- message: "failed registration rejects a different execution payload"
449
- };
450
- case "claimed":
451
- if (execution.requestDigestSha256Hex !== input.requestDigestSha256Hex) return {
452
- kind: "rejected",
453
- code: "execution_in_progress",
454
- message: "registration execution is already in progress"
455
- };
456
- if (execution.reconcileAfterMs > input.nowMs) return {
457
- kind: "rejected",
458
- code: "execution_in_progress",
459
- message: "registration execution is already in progress"
460
- };
461
- return await this.renewRegistrationExecutionClaim(execution, entry.version, input.nowMs);
462
- case "ready": {
463
- const claimed = {
464
- ...execution,
465
- kind: "claimed",
466
- requestDigestSha256Hex: input.requestDigestSha256Hex,
467
- request: input.request,
468
- claimedAtMs: input.nowMs,
469
- reconcileAfterMs: input.nowMs + EXECUTION_RECONCILIATION_LEASE_MS
470
- };
471
- const result = await this.putMany([{
472
- key,
473
- value: {
474
- kind: EXECUTION_RECORD_KIND,
475
- lifecycleId,
476
- value: claimed
477
- },
478
- expectedVersion: entry.version
479
- }]);
480
- return result.kind === "stored" ? {
481
- kind: "claimed",
482
- value: claimed,
483
- version: findStoredVersion(result.versions, key)
484
- } : await this.reconcileRegistrationExecutionClaim(input);
485
- }
486
- }
487
- }
488
- async renewRegistrationExecutionClaim(execution, expectedVersion, nowMs) {
489
- const renewed = {
490
- ...execution,
491
- claimedAtMs: nowMs,
492
- reconcileAfterMs: nowMs + EXECUTION_RECONCILIATION_LEASE_MS
493
- };
494
- const key = routerAbEd25519YaoRegistrationExecutionRecordKeyV1(execution.lifecycleId);
495
- const result = await this.putMany([{
496
- key,
497
- value: {
498
- kind: EXECUTION_RECORD_KIND,
499
- lifecycleId: execution.lifecycleId,
500
- value: renewed
501
- },
502
- expectedVersion
503
- }]);
504
- return result.kind === "stored" ? {
505
- kind: "claimed",
506
- value: renewed,
507
- version: findStoredVersion(result.versions, key)
508
- } : {
509
- kind: "rejected",
510
- code: "execution_in_progress",
511
- message: "registration execution reconciliation was claimed concurrently"
512
- };
513
- }
514
- async readRegistrationExecution(lifecycleId) {
515
- const key = routerAbEd25519YaoRegistrationExecutionRecordKeyV1(lifecycleId);
516
- const entry = readManyEntry(await this.readMany([key]), key);
517
- if (entry.kind === "missing") return null;
518
- if (entry.value.kind !== EXECUTION_RECORD_KIND || entry.value.lifecycleId !== lifecycleId) throw new Error("Yao registration execution record does not match its lifecycle");
519
- return entry.value.value;
520
- }
521
210
  };
522
- function isRegistrationExecutionMutation(mutation) {
523
- return mutation.value.kind === EXECUTION_RECORD_KIND;
524
- }
525
- function executionWithCurrentAuthority(retained, authority) {
526
- if (retained.lifecycleId !== authority.lifecycleId || retained.admissionBindingJson !== authority.admissionBindingJson) throw new Error("NEAR continuation changed its execution identity");
527
- const common = {
528
- lifecycleId: retained.lifecycleId,
529
- admissionRequest: retained.admissionRequest,
530
- admissionReceipt: retained.admissionReceipt,
531
- admissionBindingJson: retained.admissionBindingJson,
532
- credentialDigestSha256Hex: authority.credentialDigestSha256Hex,
533
- expiresAtMs: authority.expiresAtMs
534
- };
535
- switch (retained.kind) {
536
- case "ready": return {
537
- kind: "ready",
538
- ...common
539
- };
540
- case "claimed": return {
541
- kind: "claimed",
542
- ...common,
543
- requestDigestSha256Hex: retained.requestDigestSha256Hex,
544
- request: retained.request,
545
- claimedAtMs: retained.claimedAtMs,
546
- reconcileAfterMs: retained.reconcileAfterMs
547
- };
548
- case "completed": return {
549
- kind: "completed",
550
- ...common,
551
- requestDigestSha256Hex: retained.requestDigestSha256Hex,
552
- request: retained.request,
553
- claimedAtMs: retained.claimedAtMs,
554
- reconcileAfterMs: retained.reconcileAfterMs,
555
- result: retained.result,
556
- consumerBinding: retained.consumerBinding
557
- };
558
- case "failed": return {
559
- kind: "failed",
560
- ...common,
561
- requestDigestSha256Hex: retained.requestDigestSha256Hex,
562
- request: retained.request,
563
- claimedAtMs: retained.claimedAtMs,
564
- reconcileAfterMs: retained.reconcileAfterMs,
565
- failure: retained.failure
566
- };
567
- }
568
- }
569
- function sameActivationResult(left, right) {
570
- return sameRouterAbEd25519YaoActivationBindingV1(left.binding, right.binding) && sameActivationClientPackage(left.deriver_a_client_package, right.deriver_a_client_package) && sameActivationClientPackage(left.deriver_b_client_package, right.deriver_b_client_package) && sameActivationPublicReceipt(left.public_receipt, right.public_receipt);
571
- }
572
- function sameActivationClientPackage(left, right) {
573
- return left.kind === right.kind && left.deriver === right.deriver && sameByteSequence(left.session, right.session) && sameByteSequence(left.transcript, right.transcript) && sameByteSequence(left.encapsulated_key, right.encapsulated_key) && sameByteSequence(left.ciphertext, right.ciphertext);
574
- }
575
- function sameActivationPublicReceipt(left, right) {
576
- return sameByteSequence(left.transcript, right.transcript) && sameByteSequence(left.registered_public_key, right.registered_public_key) && sameByteSequence(left.joined_client_commitment, right.joined_client_commitment) && sameByteSequence(left.joined_signing_worker_commitment, right.joined_signing_worker_commitment) && sameByteSequence(left.signing_worker_verifying_share, right.signing_worker_verifying_share) && left.state_epoch === right.state_epoch && sameRouterAbMpcMaterialActivationRef(left.material_activation, right.material_activation);
577
- }
578
- function sameRegistrationFailure(left, right) {
579
- return left.status === right.status && left.code === right.code && left.message === right.message;
580
- }
581
- function sameByteSequence(left, right) {
582
- if (left.length !== right.length) return false;
583
- for (let index = 0; index < left.length; index += 1) if (left[index] !== right[index]) return false;
584
- return true;
585
- }
586
211
  function decodePartitionReadResult(result) {
587
212
  if (result.kind === "missing") return result;
588
213
  const parsed = parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1(result.value);
@@ -593,12 +218,6 @@ function decodePartitionReadResult(result) {
593
218
  version: result.version
594
219
  };
595
220
  }
596
- function decodeAtomicPatchValue(value) {
597
- if (value === void 0) return void 0;
598
- const parsed = parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1(value);
599
- if (parsed === null) throw new Error("Router A/B atomic patch returned an invalid record");
600
- return parsed;
601
- }
602
221
  function readManyEntry(entries, key) {
603
222
  const entry = entries.find((candidate) => candidate.key === key);
604
223
  if (!entry) throw new Error(`Router A/B batch read omitted ${key}`);
@@ -626,22 +245,6 @@ function readCeremonyRecord(result, lifecycleId) {
626
245
  version: result.version
627
246
  };
628
247
  }
629
- function readExecutionVersion(result, lifecycleId) {
630
- if (result.kind === "missing") return null;
631
- if (result.value.kind !== EXECUTION_RECORD_KIND || result.value.lifecycleId !== lifecycleId || result.value.value.lifecycleId !== lifecycleId) throw new Error("Router A/B execution record does not match its lifecycle key");
632
- return result.version;
633
- }
634
- function registrationExecutionRecordFromState(state, lifecycleId) {
635
- const sessionKey = state.registration.lifecycleSessions.get(lifecycleId);
636
- const registration = sessionKey === void 0 ? void 0 : state.registration.states.get(sessionKey);
637
- const authority = state.authorization.authorities.find((candidate) => candidate.admissionRequest.scope.lifecycle_id === lifecycleId);
638
- if (!registration || registration.kind !== "admitted" || !authority) return null;
639
- return buildRouterAbEd25519YaoRegistrationExecutionReadyRecordV1({
640
- lifecycleId,
641
- registration,
642
- authority
643
- });
644
- }
645
248
  function materializeState(shared, ceremony) {
646
249
  return mergeRouterAbEd25519YaoProductRegistrationStatePartitionV1(createRouterAbEd25519YaoProductRegistrationStateV1(), {
647
250
  kind: "router_ab_ed25519_yao_product_registration_state_partition_v1",
@@ -671,11 +274,6 @@ function hasExactObjectKeys(input, expectedFields) {
671
274
  const expected = new Set(expectedFields);
672
275
  return actualFields.every((field) => expected.has(field));
673
276
  }
674
- function versionedJsonObject(input) {
675
- const value = JSON.parse(JSON.stringify(input));
676
- if (!isVersionedJsonObject(value)) throw new Error("Router A/B execution request is not canonical JSON");
677
- return value;
678
- }
679
277
  function isVersionedJsonObject(input) {
680
278
  return typeof input === "object" && input !== null && !Array.isArray(input) && Object.values(input).every(isVersionedJsonValue);
681
279
  }
@@ -685,6 +283,6 @@ function isVersionedJsonValue(input) {
685
283
  return isVersionedJsonObject(input);
686
284
  }
687
285
  //#endregion
688
- export { ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordJsonV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1, routerAbEd25519YaoPartitionedStateAfterStoredCommitV1, sameRouterAbEd25519YaoSharedStateCanonicalEncodingV1 };
286
+ export { ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordJsonV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1, routerAbEd25519YaoAdmittedRegistrationAuthorityV1, routerAbEd25519YaoPartitionedStateAfterStoredCommitV1, sameRouterAbEd25519YaoSharedStateCanonicalEncodingV1 };
689
287
 
690
288
  //# sourceMappingURL=routerAbEd25519YaoProductRegistrationPartitionedStateStore.js.map
@@ -28,7 +28,8 @@ function partitionRouterAbEd25519YaoProductRegistrationStateV1(state, lifecycleI
28
28
  registration: {
29
29
  states: registrationStates,
30
30
  lifecycleSessions: selectMapLifecycleEntry(state.registration.lifecycleSessions, normalizedLifecycleId),
31
- admissionClaims: selectMapLifecycleEntry(state.registration.admissionClaims, normalizedLifecycleId)
31
+ admissionClaims: selectMapLifecycleEntry(state.registration.admissionClaims, normalizedLifecycleId),
32
+ dispatchRoots: selectMapLifecycleEntry(state.registration.dispatchRoots, normalizedLifecycleId)
32
33
  },
33
34
  authorization: { authorities: state.authorization.authorities.filter((authority) => authorityLifecycleId(authority) === normalizedLifecycleId) },
34
35
  recovery: { recoveries: recoveryStates },
@@ -51,6 +52,9 @@ function mergeRouterAbEd25519YaoProductRegistrationStatePartitionV1(base, partit
51
52
  const admissionClaims = new Map(base.registration.admissionClaims);
52
53
  admissionClaims.delete(lifecycleId);
53
54
  for (const [key, value] of partition.ceremony.registration.admissionClaims) admissionClaims.set(key, value);
55
+ const dispatchRoots = new Map(base.registration.dispatchRoots);
56
+ dispatchRoots.delete(lifecycleId);
57
+ for (const [key, value] of partition.ceremony.registration.dispatchRoots) dispatchRoots.set(key, value);
54
58
  const authorities = base.authorization.authorities.filter((authority) => authorityLifecycleId(authority) !== lifecycleId);
55
59
  authorities.push(...partition.ceremony.authorization.authorities);
56
60
  const recoveries = replaceLifecycleEntries(base.recovery.recoveries, partition.ceremony.recovery.recoveries, recoveryStateLifecycleId, lifecycleId);
@@ -59,7 +63,8 @@ function mergeRouterAbEd25519YaoProductRegistrationStatePartitionV1(base, partit
59
63
  registration: {
60
64
  states: registrationStates,
61
65
  lifecycleSessions,
62
- admissionClaims: new Map(admissionClaims)
66
+ admissionClaims: new Map(admissionClaims),
67
+ dispatchRoots
63
68
  },
64
69
  authorization: { authorities },
65
70
  recovery: {
@@ -22,7 +22,8 @@ function buildCommitInput(lifecycleId, loaded, state) {
22
22
  return {
23
23
  lifecycleId,
24
24
  state,
25
- baseline: loaded.baseline
25
+ baseline: loaded.baseline,
26
+ companionWrite: null
26
27
  };
27
28
  }
28
29
  //#endregion