@seams/wallet-server 0.6.2 → 0.7.1

package/dist/types/wallet-server/src/core/storeBackends.d.ts

@@ -0,0 +1,83 @@
+import type { NormalizedLogger } from './logger';
+import type { CloudflareDurableObjectNamespaceLike, CloudflareDurableObjectStubLike, ThresholdStoreConfigInput } from './types';
+import { type D1TenantStoreOptions } from './d1TenantStore';
+export type StoreFactoryInput = {
+    config?: ThresholdStoreConfigInput | null;
+    logger: NormalizedLogger;
+    isNode: boolean;
+};
+/** The first of `namespace`, `durableObjectNamespace` and `THRESHOLD_DO_NAMESPACE` that is one. */
+export declare function resolveDurableObjectNamespace(config: Record<string, unknown>): CloudflareDurableObjectNamespaceLike | null;
+/** The object a store config names: `objectName`, else `name`, else the default. */
+export declare function durableObjectName(config: Record<string, unknown>): string;
+export declare function durableObjectStub(namespace: CloudflareDurableObjectNamespaceLike, objectName: string): CloudflareDurableObjectStubLike;
+/** Posts one JSON request to a store's Durable Object. */
+export declare function postDurableObjectRequest(stub: CloudflareDurableObjectStubLike, body: unknown): Promise<Response>;
+/**
+ * Posts a request and parses the object's JSON reply; an empty reply reads as null. An HTTP error
+ * or a reply that is not JSON throws, naming the store: `<storeName> DO store …`.
+ */
+export declare function requestDurableObjectJson(stub: CloudflareDurableObjectStubLike, body: unknown, storeName: string): Promise<unknown>;
+/** A store's records in a key-value backend, under keys the store builds. */
+export interface KeyValueRecords<R> {
+    get(key: string): Promise<R | null>;
+    /** Reads and deletes, so a one-time record is used at most once. */
+    take(key: string): Promise<R | null>;
+    set(key: string, record: R, ttlMs?: number): Promise<void>;
+    del(key: string): Promise<void>;
+}
+/** How a key-value store names itself in the log lines and errors of its backend selection. */
+export type KeyValueStoreSpec<R> = {
+    /** Tags log lines, `[<tag>] …`, and names the store in Durable Object namespace errors. */
+    readonly tag: string;
+    /** Names the store in log lines and in D1, Upstash and Redis errors, e.g. `login challenge`. */
+    readonly label: string;
+    /** Names the store in missing-connection errors, e.g. `webauthn store`. */
+    readonly connectionErrorSubject: string;
+    /** Ends the Durable Object log line, after `Using Cloudflare Durable Object `. */
+    readonly durableObjectLog: string;
+    /** Leads Durable Object request errors, as in `<name> DO store HTTP 500`. */
+    readonly durableObjectErrorName: string;
+    /** Qualifies the in-memory fallback's log line when nothing is configured. */
+    readonly unconfiguredNote: string;
+    /** Names the store in D1 scope errors. */
+    readonly d1StoreName: string;
+    /** The store's key prefix, which is also its D1 namespace. */
+    readonly resolvePrefix: (config: Record<string, unknown>) => string;
+    /** Validates a record read back from a remote backend; null when it is invalid. */
+    readonly parse: (raw: unknown) => R | null;
+};
+/** Builds the store for the backend the config selects. */
+type KeyValueStoreBuilders<R, S> = {
+    readonly d1: (options: D1TenantStoreOptions) => S;
+    /** Upstash REST, Redis TCP and Durable Object backends. */
+    readonly keyValue: (records: KeyValueRecords<R>, prefix: string) => S;
+    readonly inMemory: (prefix: string) => S;
+};
+/**
+ * Selects a key-value store's backend: the config's explicit `kind`, else Upstash or Redis from
+ * env-shaped config, else in memory. The store type `S` comes from the caller's return type.
+ */
+export declare function createKeyValueStore<R, S>(input: StoreFactoryInput, spec: KeyValueStoreSpec<R>, build: KeyValueStoreBuilders<R, NoInfer<S>>): S;
+/** How a store on D1, a Durable Object or memory names itself in its selection's logs and errors. */
+export type DurableObjectStoreSpec = {
+    /** Tags log lines and D1 errors, `[<tag>] …`. */
+    readonly tag: string;
+    /** Names the store in kind errors, e.g. `wallet` in `Unknown wallet store kind`. */
+    readonly name: string;
+    /** The in-memory fallback's log line, after the tag. */
+    readonly inMemoryLog: string;
+    /** Names the store in D1 scope errors. */
+    readonly d1StoreName: string;
+    /** The store's key prefix, which is also its D1 namespace. */
+    readonly resolvePrefix: (config: Record<string, unknown>) => string;
+};
+type DurableObjectStoreBuilders<S> = {
+    readonly d1: (options: D1TenantStoreOptions) => S;
+    readonly durableObject: (stub: CloudflareDurableObjectStubLike, prefix: string) => S;
+    readonly inMemory: (prefix: string) => S;
+};
+/** Selects the backend the config's `kind` names: D1, a Durable Object, or else memory. */
+export declare function createDurableObjectStore<S>(input: StoreFactoryInput, spec: DurableObjectStoreSpec, build: DurableObjectStoreBuilders<NoInfer<S>>): S;
+export {};
+//# sourceMappingURL=storeBackends.d.ts.map

package/dist/types/wallet-server/src/core/threeRouteRegistrationContracts.d.ts

@@ -1,20 +1,21 @@
-import type { RegisterWalletInput, RegistrationAuthMethodInput, RegistrationSignerSetSelection } from '../../../shared-ts/src/utils/registrationIntent';
+import type { ActiveWalletAuthMethodRecordV2 } from '../../../shared-ts/src/utils/walletAuthMethodRecord';
 import type { CorrelationId } from '../../../shared-ts/src/utils/canonicalPrimitives';
 import type { RouterAbEcdsaVerifiedClientActivationFactsV1 } from '../../../shared-ts/src/utils/routerAbEcdsaDerivation';
-import type { WalletRegistrationEcdsaPreparePayload, WalletRegistrationStartRequest, WalletRegistrationAuthorityInput, WalletRegistrationStartResponse, WalletRegistrationFinalizeRequest, WalletRegistrationFinalizeResponse, WalletRegistrationEcdsaActivationResponse, WalletRegistrationEcdsaWalletKey, WalletRegistrationEd25519YaoPublicResult, WalletRegistrationFinalizeAuthMethod, WalletRegistrationRouteDiagnostics } from './registrationContracts';
+import type { WalletRegistrationEcdsaPreparePayload, WalletRegistrationFinalizeSuccess, WalletRegistrationStartRequest, WalletRegistrationAuthorityInput, WalletRegistrationStartResponse, WalletRegistrationFinalizeRequest, WalletRegistrationEcdsaActivationResponse, WalletRegistrationEcdsaWalletKey, WalletRegistrationEd25519YaoPublicResult, WalletRegistrationRouteDiagnostics } from './registrationContracts';
+import type { WalletRegistrationFinalizeAuthMethod } from '../../../shared-ts/src/utils/registrationContracts';
 import type { RegistrationEstablishedSessionProjectionV2, RegistrationEstablishedSessionResultV2 } from '../../../shared-ts/src/utils/registrationEstablishedSession';
 import type { WalletAuthMethodId, WalletId } from '../../../shared-ts/src/utils/domainIds';
 import type { WalletSessionMintId } from '../../../shared-ts/src/authorization/capabilityKinds';
 import type { ActiveWalletAuthorityV1 } from '../../../shared-ts/src/authorization/walletAuthority';
-import type { RegistrationNearAccountProvisioning, ResolvedRegistrationNearAccount, RegistrationAuthority, RegistrationSignerPlan, WalletAuthMethodRecordV2 } from '../../../shared-ts/src/utils/registrationIntent';
+import type { RegistrationNearAccountProvisioning, ResolvedRegistrationNearAccount, RegistrationSignerPlan } from '../../../shared-ts/src/utils/registrationSignerPlan';
+import type { RegistrationAuthority } from '../../../shared-ts/src/utils/registrationAuthMethodInput';
 import type { WalletAuthAuthority } from '../../../shared-ts/src/utils/walletAuthAuthority';
 import type { WalletCustodyRegistrationOutcome } from '../../../shared-ts/src/passkey-custody';
 import type { DigestB64u } from '../../../shared-ts/src/utils/canonicalPrimitives';
 import type { ThresholdEd25519AuthorityScope, EcdsaDerivationServerBootstrapResponse } from './types';
 import type { StoredWalletRegistrationNearEd25519YaoAuthorizedBranch, StoredWalletRegistrationPreparedContext } from './RegistrationCeremonyStore';
 /**
- * Refactor 94C: the three-route registration wire contract, frozen at the
- * 2026-07-28 checkpoint (docs/refactor-94C-product-contract.md §2).
+ * The three-route registration wire contract.
  *
  * Everything here derives from the existing contracts by indexed access, so a
  * change to an underlying payload surfaces as a compile error in this file
@@ -51,8 +52,7 @@ type SetupEd25519Work = Extract<WalletRegistrationStartResponse, {
 } ? T : never;
 type ActivateIdempotencyKey = WalletRegistrationFinalizeRequest['idempotencyKey'];
 type FinalizeRequestBase = WalletRegistrationFinalizeRequest;
-type EcdsaFinalizeSuccess = Extract<WalletRegistrationFinalizeResponse, {
-    ok: true;
+type EcdsaFinalizeSuccess = Extract<WalletRegistrationFinalizeSuccess, {
     kind: 'evm_family_ecdsa';
 }>;
 type EcdsaActivationSuccess = Extract<WalletRegistrationEcdsaActivationResponse, {
@@ -88,9 +88,7 @@ type WalletRegistrationSessionCommitReceiptMetadataV2 = {
 };
 type WalletRegistrationSessionCommitReadyBaseV2 = WalletRegistrationSessionCommitReceiptMetadataV2 & {
     readonly foundingAuthority: ActiveWalletAuthorityV1;
-    readonly foundingAuthMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly status: 'active';
-    }>;
+    readonly foundingAuthMethod: ActiveWalletAuthMethodRecordV2;
     readonly mintId: WalletSessionMintId;
     readonly issuedAtMs: number;
     readonly expiresAtMs: number;
@@ -137,7 +135,7 @@ type WalletRegistrationEcdsaReadyCommitBaseV2 = {
     };
     readonly session: RegistrationEstablishedSessionProjectionV2;
 };
-export type WalletRegistrationEcdsaReadyCommitV2 = (WalletRegistrationEcdsaReadyCommitBaseV2 & {
+type WalletRegistrationEcdsaReadyCommitV2 = (WalletRegistrationEcdsaReadyCommitBaseV2 & {
     readonly nearProvisioning?: never;
     readonly installation?: never;
 }) | (WalletRegistrationEcdsaReadyCommitBaseV2 & {
@@ -152,18 +150,6 @@ export type WalletRegistrationRouteErrorV2 = {
     message: string;
     retryAfterMs?: number;
 };
-/** Route 1 — one Gateway request replacing grant, intent, and start. */
-export type WalletRegistrationSetupRequestV2 = {
-    /** Omitted means server-allocated, matching the intent route it replaces. */
-    wallet?: RegisterWalletInput;
-    signerSelection: RegistrationSignerSetSelection;
-    /**
-     * The requested method, not a proof. Setup issues the challenge that the
-     * client's WebAuthn create must sign, so no proof can exist yet; it arrives
-     * on respond.
-     */
-    authMethod: RegistrationAuthMethodInput;
-};
 /**
  * Setup is ECDSA-only, uniformly, for both authentication methods.
  *
@@ -255,7 +241,7 @@ export type WalletRegistrationRespondRequestV2 = WalletRegistrationRespondAuthor
  * asynchronously and must not await it: the wallet is usable on ECDSA alone,
  * and blocking registration on Yao is the coupling this refactor removes.
  */
-export type WalletRegistrationRespondSignerPlanV2 = {
+type WalletRegistrationRespondSignerPlanV2 = {
     kind: 'evm_family_ecdsa';
     ecdsa: RespondEcdsaProofBundles;
     ed25519?: never;
@@ -280,7 +266,7 @@ export type WalletRegistrationRespondSignerPlanV2 = {
     ed25519: RespondEd25519DeferredWorkV2;
 };
 /** Exact A/B role bundles, unchanged from the derivation respond leg. */
-export type RespondEcdsaProofBundles = {
+type RespondEcdsaProofBundles = {
     kind: 'router_ab_ecdsa_registration_forwarded_v1';
     strictResult: unknown;
 };
@@ -358,8 +344,7 @@ type ActivateEcdsaTerminalPayload = EcdsaFinalizeSuccess['ecdsa'] & {
     activation: EcdsaActivationSuccess['ecdsa']['activation'];
     bootstrap: EcdsaActivationSuccess['ecdsa']['bootstrap'];
 };
-type Ed25519FinalizeSuccess = Extract<WalletRegistrationFinalizeResponse, {
-    ok: true;
+type Ed25519FinalizeSuccess = Extract<WalletRegistrationFinalizeSuccess, {
     kind: 'near_ed25519';
 }>;
 type DistributiveOmit<T, K extends keyof any> = T extends unknown ? Omit<T, K> : never;
@@ -395,38 +380,7 @@ export type WalletRegistrationActivateResponseV2 = (DistributiveOmit<EcdsaFinali
 }) | WalletRegistrationActivateEd25519PendingV2 | WalletRegistrationRouteErrorV2;
 type ActivateSuccessV2 = Exclude<WalletRegistrationActivateResponseV2, WalletRegistrationRouteErrorV2>;
 export type WalletRegistrationActivateRouteResponseV2 = ActivateSuccessV2 | WalletRegistrationRouteErrorV2;
-/**
- * Deferred NEAR provisioning — `POST /wallets/register/near-provisioning`.
- *
- * Not one of the three routes: it is the non-blocking completion the client
- * calls *after* activate has returned, with the Yao activation the already
- * running computation produced. It installs the wallet's Ed25519 signer,
- * derives the implicit-account projection, and moves provisioning to ready.
- *
- * Implicit-account registration is keypair derivation only — no NEAR RPC and
- * no on-chain transaction, so nothing here spends gas or creates irreversible
- * chain state.
- *
- * Both plans use it. On a mixed plan the wallet was already signable on ECDSA;
- * on an Ed25519-only plan this call is what makes the wallet signable at all.
- */
-export type WalletRegistrationNearProvisioningRequestV2 = {
-    registrationCeremonyId: string;
-    signedSetup: SignedSetupPayloadB64u;
-    /** Its own key: this commit is a separate effect from activate's. */
-    idempotencyKey: ActivateIdempotencyKey;
-    ed25519: Extract<WalletRegistrationFinalizeRequest, {
-        kind: 'near_ed25519';
-    }>['ed25519'];
-    emailOtpEnrollment?: NonNullable<WalletRegistrationFinalizeRequest['emailOtpEnrollment']>;
-    sessionSeal?: {
-        readonly thresholdSessionId: string;
-        readonly ciphertext: string;
-        readonly keyVersion?: string;
-    };
-};
-type WalletRegistrationNearProvisioningFinalizeSuccessV2 = Extract<WalletRegistrationFinalizeResponse, {
-    ok: true;
+type WalletRegistrationNearProvisioningFinalizeSuccessV2 = Extract<WalletRegistrationFinalizeSuccess, {
     kind: 'near_ed25519';
 }>;
 type WalletRegistrationNearProvisioningSuccessBaseV2 = {

package/dist/types/wallet-server/src/core/threeRouteRegistrationContracts.typecheck.d.ts

@@ -1,6 +1,6 @@
 /**
- * Refactor 94C. Compile-time proof that the three-route request unions make
- * invalid registrations unrepresentable.
+ * Compile-time proof that the three-route request unions make invalid
+ * registrations unrepresentable.
  *
  * These are the states a single object type with required `ecdsa` allowed and
  * shouldn't have: an Ed25519-only request carrying ECDSA work it has none of,
@@ -54,5 +54,53 @@ export declare const _threeRouteRequestFixtures: readonly [{
 } & {
     kind: "near_ed25519";
     ecdsa?: never;
-}, WalletRegistrationRespondRequestV2, WalletRegistrationActivateRequestV2, WalletRegistrationRespondRequestV2, WalletRegistrationActivateRequestV2, WalletRegistrationActivateRequestV2, WalletRegistrationActivateRequestV2, WalletRegistrationCommittedInstallationProjectionV1, import("./threeRouteRegistrationContracts").WalletRegistrationEcdsaReadyCommitV2, import("./threeRouteRegistrationContracts").WalletRegistrationEcdsaReadyCommitV2];
+}, WalletRegistrationRespondRequestV2, WalletRegistrationActivateRequestV2, WalletRegistrationRespondRequestV2, WalletRegistrationActivateRequestV2, WalletRegistrationActivateRequestV2, WalletRegistrationActivateRequestV2, WalletRegistrationCommittedInstallationProjectionV1, ({
+    readonly kind: "ecdsa_ready";
+    readonly ecdsa: {
+        readonly walletKeys: readonly import("./registrationContracts").WalletRegistrationEcdsaWalletKey[];
+        readonly activation: import("../../../shared-ts/src/utils").RouterAbEcdsaRegistrationActivationReceiptV1;
+        readonly bootstrap: import("./types").EcdsaDerivationServerBootstrapResponse;
+    };
+    readonly session: import("../../../shared-ts/src/utils/registrationEstablishedSession").RegistrationEstablishedSessionProjectionV2;
+} & {
+    readonly nearProvisioning?: never;
+    readonly installation?: never;
+}) | ({
+    readonly kind: "ecdsa_ready";
+    readonly ecdsa: {
+        readonly walletKeys: readonly import("./registrationContracts").WalletRegistrationEcdsaWalletKey[];
+        readonly activation: import("../../../shared-ts/src/utils").RouterAbEcdsaRegistrationActivationReceiptV1;
+        readonly bootstrap: import("./types").EcdsaDerivationServerBootstrapResponse;
+    };
+    readonly session: import("../../../shared-ts/src/utils/registrationEstablishedSession").RegistrationEstablishedSessionProjectionV2;
+} & {
+    readonly nearProvisioning: {
+        readonly status: "near_pending";
+    };
+    readonly installation: WalletRegistrationCommittedInstallationProjectionV1;
+}), ({
+    readonly kind: "ecdsa_ready";
+    readonly ecdsa: {
+        readonly walletKeys: readonly import("./registrationContracts").WalletRegistrationEcdsaWalletKey[];
+        readonly activation: import("../../../shared-ts/src/utils").RouterAbEcdsaRegistrationActivationReceiptV1;
+        readonly bootstrap: import("./types").EcdsaDerivationServerBootstrapResponse;
+    };
+    readonly session: import("../../../shared-ts/src/utils/registrationEstablishedSession").RegistrationEstablishedSessionProjectionV2;
+} & {
+    readonly nearProvisioning?: never;
+    readonly installation?: never;
+}) | ({
+    readonly kind: "ecdsa_ready";
+    readonly ecdsa: {
+        readonly walletKeys: readonly import("./registrationContracts").WalletRegistrationEcdsaWalletKey[];
+        readonly activation: import("../../../shared-ts/src/utils").RouterAbEcdsaRegistrationActivationReceiptV1;
+        readonly bootstrap: import("./types").EcdsaDerivationServerBootstrapResponse;
+    };
+    readonly session: import("../../../shared-ts/src/utils/registrationEstablishedSession").RegistrationEstablishedSessionProjectionV2;
+} & {
+    readonly nearProvisioning: {
+        readonly status: "near_pending";
+    };
+    readonly installation: WalletRegistrationCommittedInstallationProjectionV1;
+})];
 //# sourceMappingURL=threeRouteRegistrationContracts.typecheck.d.ts.map

package/dist/types/wallet-server/src/core/thresholdEcdsaChainTarget.d.ts

@@ -11,5 +11,4 @@ export type ThresholdEcdsaChainTarget = {
 export declare function thresholdEcdsaChainTargetFromValue(value: unknown): ThresholdEcdsaChainTarget | null;
 export declare function thresholdEcdsaChainTargetKey(target: ThresholdEcdsaChainTarget): string;
 export declare function thresholdEcdsaChainTargetsEqual(left: ThresholdEcdsaChainTarget, right: ThresholdEcdsaChainTarget): boolean;
-export declare function thresholdEcdsaChainTargetsShareEvmFamilyAddress(left: ThresholdEcdsaChainTarget, right: ThresholdEcdsaChainTarget): boolean;
 //# sourceMappingURL=thresholdEcdsaChainTarget.d.ts.map

package/dist/types/wallet-server/src/core/types.d.ts

@@ -1,12 +1,13 @@
 import { AuthenticatorOptions, UserVerificationPolicy, OriginPolicyInput } from '../../../shared-ts/src/utils/authenticatorOptions';
 import type { InitInput } from '../../../../wasm/near_signer/pkg/wasm_signer_worker.js';
 import type { Logger } from './logger';
+import type { Ed25519AuthorityScope } from '../../../shared-ts/src/threshold/sessionPolicy';
 import type { RuntimePolicyScope } from '../../../shared-ts/src/threshold/signingRootScope';
 import type { EcdsaClientRootPublicKey33B64u, DerivationClientSharePublicKey33B64u, EcdsaDerivationRelayerPublicKey33B64u } from '../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap';
 import type { RouterAbEd25519NormalSigningState } from '../../../shared-ts/src/utils/signingSessionSeal';
 import type { RouterAbEcdsaDerivationNormalSigningScopeV1, RouterAbEcdsaDerivationNormalSigningStateV1 } from '../../../shared-ts/src/utils/routerAbEcdsaDerivation';
 import type { WalletAuthAuthority } from '../../../shared-ts/src/utils/walletAuthAuthority';
-import type { RootShareEpoch, WebAuthnRpId } from '../../../shared-ts/src/utils/domainIds';
+import type { RootShareEpoch } from '../../../shared-ts/src/utils/domainIds';
 import type { EvmFamilySigningKeySlotId } from '../../../shared-ts/src/signing-lanes';
 import type { WalletSessionOperationCredentialV1 } from '../../../shared-ts/src/device-linking';
 import type { MpcWalletSigningQuotaId, WalletSessionId } from '../../../shared-ts/src/authorization/capabilityKinds';
@@ -370,29 +371,7 @@ export type ThresholdRuntimeSnapshotExpectation = {
     checksum?: string;
 };
 export type ThresholdEd25519Purpose = 'near_tx' | 'nep461_delegate' | 'nep413' | string;
-export type ThresholdEd25519AuthorityScope = {
-    kind: 'passkey_rp';
-    rpId: WebAuthnRpId;
-    proofKind?: never;
-    email?: never;
-    provider?: never;
-    providerUserId?: never;
-    challengeId?: never;
-    googleEmailOtpRegistrationAttemptId?: never;
-    googleEmailOtpRegistrationOfferId?: never;
-    googleEmailOtpRegistrationCandidateId?: never;
-} | {
-    kind: 'email_otp';
-    provider: 'google' | 'email';
-    providerUserId: string;
-    proofKind?: never;
-    rpId?: never;
-    email?: never;
-    challengeId?: never;
-    googleEmailOtpRegistrationAttemptId?: never;
-    googleEmailOtpRegistrationOfferId?: never;
-    googleEmailOtpRegistrationCandidateId?: never;
-};
+export type ThresholdEd25519AuthorityScope = Ed25519AuthorityScope;
 export type Ed25519SessionPolicy = {
     version: 'threshold_session_v1';
     nearAccountId: string;

package/dist/types/wallet-server/src/core/webAuthnD1Statements.d.ts

@@ -0,0 +1,29 @@
+import type { ScopedD1Prepare } from './emailOtpD1Statements';
+/** Binds the scope, then the user and the record's seven columns. */
+export declare const INSERT_WEBAUTHN_AUTHENTICATOR_SQL = "INSERT INTO webauthn_authenticators (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        user_id,\n        credential_id_b64u,\n        credential_public_key_b64u,\n        counter,\n        created_at_ms,\n        updated_at_ms,\n        device_info_json\n      )\n      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)";
+/**
+ * The insert, which on a credential collision keeps the lowest creation time and the highest
+ * counter and update time. Binds as the insert does.
+ */
+export declare const UPSERT_WEBAUTHN_AUTHENTICATOR_SQL = "INSERT INTO webauthn_authenticators (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        user_id,\n        credential_id_b64u,\n        credential_public_key_b64u,\n        counter,\n        created_at_ms,\n        updated_at_ms,\n        device_info_json\n      )\n      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)\n      ON CONFLICT (namespace, org_id, project_id, env_id, user_id, credential_id_b64u)\n      DO UPDATE SET\n        credential_public_key_b64u = EXCLUDED.credential_public_key_b64u,\n        counter = MAX(webauthn_authenticators.counter, EXCLUDED.counter),\n        created_at_ms = MIN(webauthn_authenticators.created_at_ms, EXCLUDED.created_at_ms),\n        updated_at_ms = MAX(webauthn_authenticators.updated_at_ms, EXCLUDED.updated_at_ms),\n        device_info_json = EXCLUDED.device_info_json";
+/** Statements on `webauthn_authenticators`. */
+export declare const webAuthnAuthenticatorRows: {
+    select: (prepare: ScopedD1Prepare, userId: string, credentialIdB64u: string) => import("..").D1PreparedStatementLike;
+};
+/** Statements on `webauthn_credential_bindings`. */
+export declare const webAuthnCredentialBindingRows: {
+    select: (prepare: ScopedD1Prepare, rpId: string, credentialIdB64u: string) => import("..").D1PreparedStatementLike;
+};
+/** Statements on `webauthn_challenges`. */
+export declare const webAuthnChallengeRows: {
+    upsert: (prepare: ScopedD1Prepare, input: {
+        readonly challengeId: string;
+        readonly challengeKind: string;
+        readonly record: unknown;
+        readonly createdAtMs: number;
+        readonly expiresAtMs: number;
+    }) => import("..").D1PreparedStatementLike;
+    /** Deletes the live challenge of the kind and returns its record, so it is used at most once. */
+    consume: (prepare: ScopedD1Prepare, challengeId: string, challengeKind: string, nowMs: number) => import("..").D1PreparedStatementLike;
+};
+//# sourceMappingURL=webAuthnD1Statements.d.ts.map

package/dist/types/wallet-server/src/core/webAuthnStoreBackends.d.ts

@@ -0,0 +1,96 @@
+import { type KeyValueRecords, type StoreFactoryInput } from './storeBackends';
+import { type D1SchemaOptions, type D1TenantStoreOptions } from './d1TenantStore';
+/** What sets one WebAuthn store apart from the others. */
+export type WebAuthnStoreSpec<R> = {
+    /** Names the store in log lines and errors, e.g. `login challenge`. */
+    readonly label: string;
+    /** Config key that replaces the whole key prefix, e.g. `WEBAUTHN_LOGIN_CHALLENGE_PREFIX`. */
+    readonly prefixConfigKey: string;
+    /** The default prefix's last segment: `<THRESHOLD_PREFIX>:webauthn:<prefixName>:`. */
+    readonly prefixName: string;
+    /** Validates a record being written or read back; null when it is invalid. */
+    readonly parse: (raw: unknown) => R | null;
+    /** Ends the Durable Object log line, e.g. `login challenge persistence`. */
+    readonly durableObjectLogSubject: string;
+    /** Names the store in missing-connection errors, e.g. `webauthn store`. */
+    readonly connectionErrorSubject: string;
+    /** Qualifies the in-memory fallback's log line, e.g. `non-persistent`. */
+    readonly unconfiguredNote: string;
+    /** Names the store in D1 scope errors, e.g. `credential`. */
+    readonly d1ScopeLabel: string;
+};
+/** Builds the store for the backend the config selects. */
+type WebAuthnStoreBuilders<R, S> = {
+    readonly d1: (options: D1TenantStoreOptions) => S;
+    /** Upstash REST, Redis TCP and Durable Object backends. */
+    readonly keyValue: (records: KeyValueRecords<R>, prefix: string) => S;
+    readonly inMemory: (records: InMemoryWebAuthnRecords<R>, prefix: string) => S;
+};
+/**
+ * A store's key prefix, which is also its D1 namespace: `config[spec.prefixConfigKey]` when set,
+ * else `<THRESHOLD_PREFIX>:webauthn:<spec.prefixName>:`. It always ends with a colon.
+ */
+export declare function resolveWebAuthnStorePrefix(config: Record<string, unknown>, spec: Pick<WebAuthnStoreSpec<unknown>, 'prefixConfigKey' | 'prefixName'>): string;
+/**
+ * Selects a WebAuthn store's backend: the config's explicit `kind`, else Upstash or Redis from
+ * env-shaped config, else in memory. The store type `S` comes from the caller's return type.
+ */
+export declare function createWebAuthnStore<R, S>(input: StoreFactoryInput, spec: WebAuthnStoreSpec<R>, build: WebAuthnStoreBuilders<R, NoInfer<S>>): S;
+/** Keeps each record as it was put, without expiry; reads return the stored object. */
+export declare class InMemoryWebAuthnRecords<R> implements KeyValueRecords<R> {
+    readonly map: Map<string, R>;
+    get(key: string): Promise<R | null>;
+    take(key: string): Promise<R | null>;
+    set(key: string, record: R): Promise<void>;
+    del(key: string): Promise<void>;
+}
+/**
+ * Per-credential records under `${prefix}${ownerId}:${credentialIdB64u}`, where the owner is the
+ * user for authenticators and the RP ID for credential bindings. A blank id reads as missing.
+ */
+export declare class WebAuthnCredentialRecords<R> {
+    private readonly records;
+    private readonly prefix;
+    constructor(records: KeyValueRecords<R>, prefix: string);
+    get(ownerId: string, credentialIdB64u: string): Promise<R | null>;
+    set(ownerId: string, credentialIdB64u: string, record: R): Promise<void>;
+    del(ownerId: string, credentialIdB64u: string): Promise<void>;
+    private key;
+    private trimmedKey;
+}
+/** Names a WebAuthn store in D1 scope errors, e.g. `WebAuthn credential store`. */
+export declare function webAuthnD1Store(d1ScopeLabel: string): string;
+type WebAuthnChallengeRecord = {
+    readonly challengeId: string;
+    readonly createdAtMs: number;
+    readonly expiresAtMs: number;
+};
+/** Holds each challenge until it is consumed once or expires. */
+export interface WebAuthnChallengeStore<R> {
+    put(record: R): Promise<void>;
+    consume(challengeId: string): Promise<R | null>;
+    del(challengeId: string): Promise<void>;
+}
+export type WebAuthnChallengeStoreSpec<R> = WebAuthnStoreSpec<R> & {
+    /** The `challenge_kind` that tells this store's rows apart in the shared D1 table. */
+    readonly challengeKind: 'login' | 'sync';
+};
+export interface D1WebAuthnChallengeStoreOptions extends D1TenantStoreOptions {
+    readonly now?: () => Date;
+}
+export declare const WEBAUTHN_CHALLENGE_STORE_D1_SCHEMA_SQL: readonly ["\n    CREATE TABLE IF NOT EXISTS webauthn_challenges (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      challenge_id TEXT NOT NULL,\n      challenge_kind TEXT NOT NULL,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      expires_at_ms INTEGER NOT NULL,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, challenge_id),\n      CHECK (length(challenge_id) > 0),\n      CHECK (challenge_kind IN ('login', 'sync', 'recovery_registration')),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms > 0),\n      CHECK (expires_at_ms > created_at_ms)\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS webauthn_challenges_expiry_idx\n      ON webauthn_challenges (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        challenge_kind,\n        expires_at_ms\n      )\n  "];
+export declare function ensureWebAuthnChallengeStoreD1Schema(options: D1SchemaOptions): Promise<void>;
+export declare function createWebAuthnChallengeStore<R extends WebAuthnChallengeRecord>(input: StoreFactoryInput, spec: WebAuthnChallengeStoreSpec<R>, d1: (options: D1TenantStoreOptions) => WebAuthnChallengeStore<R>): WebAuthnChallengeStore<R>;
+export declare class D1WebAuthnChallengeStore<R extends WebAuthnChallengeRecord> implements WebAuthnChallengeStore<R> {
+    private readonly spec;
+    readonly adapterKind = "d1";
+    private readonly table;
+    private readonly now;
+    private readonly prepare;
+    constructor(input: D1WebAuthnChallengeStoreOptions, spec: WebAuthnChallengeStoreSpec<R>);
+    put(record: R): Promise<void>;
+    consume(challengeId: string): Promise<R | null>;
+    del(challengeId: string): Promise<void>;
+}
+export {};
+//# sourceMappingURL=webAuthnStoreBackends.d.ts.map

package/dist/types/wallet-server/src/hosted-wallet-gateway.d.ts

@@ -39,6 +39,8 @@ export interface CloudflareD1GatewayBaseEnv extends Readonly<Record<string, unkn
     readonly ROUTER_AB_NORMAL_SIGNING_WORKER_ID?: string;
     readonly SIGNING_WORKER_ID?: string;
     readonly ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET?: string;
+    readonly ROUTER_AB_GATEWAY_TO_ROUTER_AUTH_SECRET?: string;
+    readonly ROUTER_AB_GATEWAY_TO_SIGNING_WORKER_PRESIGN_AUTH_SECRET?: string;
     readonly ROUTER_AB_PREWARM_ENABLED: string;
     readonly ROUTER_AB_CEREMONY_JWT_PRIVATE_JWK?: string;
     readonly ROUTER_AB_CEREMONY_JWT_ISSUER?: string;
@@ -78,14 +80,16 @@ export interface CloudflareD1GatewayEnv extends CloudflareD1GatewayBaseEnv {
 }
 export interface HostedWalletGatewayDependenciesV1 {
     readonly emailOtpDeliveryProvider?: CloudflareD1RouterApiAuthServiceOptions['emailOtpDeliveryProvider'];
+    /** Host loader for the signer WASM; defaults to the Workers module import. */
+    readonly signerWasm?: CloudflareD1RouterApiAuthServiceOptions['signerWasmModuleOrPath'];
 }
-export declare function createStagingEd25519YaoBackend(env: CloudflareD1GatewayBaseEnv, resolveTenantRoot: RouterAbEd25519YaoTenantRootResolverV1): import("./cloud-host").RouterAbEd25519YaoRegistrationBackend & import("./router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery").RouterAbEd25519YaoRecoveryBackend & import("./cloud-host").RouterAbEd25519YaoExportBackend;
+export declare function createStagingEd25519YaoBackend(env: CloudflareD1GatewayBaseEnv, resolveTenantRoot: RouterAbEd25519YaoTenantRootResolverV1): import("./cloud-host").RouterAbEd25519YaoPinnedRegistrationBackend & import("./router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery").RouterAbEd25519YaoRecoveryBackend & import("./cloud-host").RouterAbEd25519YaoExportBackend;
 /**
- * The split Wallet Gateway (R105 Phase 4 cutover target): serves the Wallet
- * runtime only, holds no Console database binding, and reaches the Wallet
- * Console deployment exclusively through the exact service-binding ops.
- * The sponsored-relay route extensions stay on the Wallet Console deployment
- * until policy/sponsorship resolution operations join the binding.
+ * The split Wallet Gateway: serves the Wallet runtime only, holds no Console
+ * database binding, and reaches the Wallet Console deployment exclusively
+ * through the exact service-binding ops. The sponsored-relay route extensions
+ * stay on the Wallet Console deployment until policy/sponsorship resolution
+ * operations join the binding.
  */
 export declare function createHostedWalletGatewayCompositionV1(env: CloudflareD1GatewayEnv, dependencies?: HostedWalletGatewayDependenciesV1): Promise<{
     handler: FetchHandler;
@@ -102,7 +106,7 @@ declare function createStagingYaoPartitionedStateStore(env: CloudflareD1GatewayB
  * This is new composition wiring over the existing authorization classes, not a
  * second authorization implementation: the same adapter the tenant runtime uses
  * is constructed here against request-scoped state instead of runtime-held
- * state, which is the dependency Refactor 93 exists to remove.
+ * state, which is the dependency this wiring exists to remove.
  */
 export declare function createStagingRecoveryRequestScopedDependencies(env: CloudflareD1GatewayBaseEnv, tenantRootCustodyLineage: CloudflareD1RouterApiAuthServiceOptions['tenantRootCustodyLineage'], dependencies?: HostedWalletGatewayDependenciesV1): {
     readonly store: ReturnType<typeof createStagingYaoPartitionedStateStore>;

package/dist/types/wallet-server/src/index.d.ts

@@ -23,7 +23,7 @@ export { D1WebAuthnLoginChallengeStore, WEBAUTHN_LOGIN_CHALLENGE_STORE_D1_SCHEMA
 export { D1WebAuthnSyncChallengeStore, WEBAUTHN_SYNC_CHALLENGE_STORE_D1_SCHEMA_SQL, createWebAuthnSyncChallengeStore, ensureWebAuthnSyncChallengeStoreD1Schema, type D1WebAuthnSyncChallengeStoreOptions, type D1WebAuthnSyncChallengeStoreSchemaOptions, type WebAuthnSyncChallengeRecord, type WebAuthnSyncChallengeStore, } from './core/WebAuthnSyncChallengeStore';
 export { D1IdentityStore, IDENTITY_STORE_D1_SCHEMA_SQL, createIdentityStore, ensureIdentityStoreD1Schema, resolveIdentityStoreNamespace, type D1IdentityStoreOptions, type D1IdentityStoreSchemaOptions, type IdentityStore, type IdentitySubjectRecord, type IdentityUserRecord, type LinkIdentityResult, type UnlinkIdentityResult, } from './core/IdentityStore';
 export { D1NearPublicKeyStore, NEAR_PUBLIC_KEY_STORE_D1_SCHEMA_SQL, createNearPublicKeyStore, ensureNearPublicKeyStoreD1Schema, type D1NearPublicKeyStoreOptions, type D1NearPublicKeyStoreSchemaOptions, type NearPublicKeyKind, type NearPublicKeyRecord, type NearPublicKeyStore, } from './core/NearPublicKeyStore';
-export { InMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createRouterAbNormalSigningAdmissionAdapter, type RouterAbNormalSigningAbuseDecision, type RouterAbNormalSigningAbuseProvider, type RouterAbNormalSigningAdmissionStore, type RouterAbNormalSigningProjectPolicyDecision, type RouterAbNormalSigningProjectPolicyProvider, } from './router/domains/signingOperations/routerAbNormalSigningAdmissionCore';
+export { InMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createRouterAbNormalSigningAdmissionAdapter, type RouterAbNormalSigningAbuseDecision, type RouterAbNormalSigningPolicyDecision, type RouterAbNormalSigningAdmissionStore, type RouterAbNormalSigningProjectPolicyDecision, } from './router/domains/signingOperations/routerAbNormalSigningAdmissionCore';
 export { CloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1RouterAbNormalSigningAdmissionStore, type CloudflareD1RouterAbNormalSigningAdmissionStoreOptions, } from './router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore';
 export * from './threshold/session/signingSessionSeal';
 export type { RouterApiModule, RouterApiModuleKind, RouterApiModuleOptions, } from './router/framework/modules';

package/dist/types/wallet-server/src/local-hosted-wallet-gateway-worker.d.ts

@@ -1,8 +1,5 @@
-import { type CloudflareD1GatewayBaseEnv } from './hosted-wallet-gateway';
+import { type LocalHostedWalletGatewayEnv } from './localHostedWalletGatewayHandler';
 import type { CfExecutionContext, CfScheduledEvent } from './router/cloudflare/runtime/cloudflare.types';
-type LocalHostedWalletGatewayEnv = CloudflareD1GatewayBaseEnv & {
-    readonly WALLET_LOCAL_DEPLOYMENT_JSON: string;
-};
 declare function fetch(request: Request, env: LocalHostedWalletGatewayEnv, ctx: CfExecutionContext): Promise<Response>;
 declare function scheduled(event: CfScheduledEvent, env: LocalHostedWalletGatewayEnv, _ctx: CfExecutionContext): Promise<void>;
 declare const _default: {

package/dist/types/wallet-server/src/localHostedWalletGatewayHandler.d.ts

@@ -0,0 +1,12 @@
+import { type CloudflareD1GatewayBaseEnv, type HostedWalletGatewayDependenciesV1 } from './hosted-wallet-gateway';
+import type { CfExecutionContext } from './router/cloudflare/runtime/cloudflare.types';
+export type LocalHostedWalletGatewayEnv = CloudflareD1GatewayBaseEnv & {
+    readonly WALLET_LOCAL_DEPLOYMENT_JSON: string;
+};
+/**
+ * The local Gateway: the hosted Gateway handler plus the intended-suite
+ * transport faults, which a request arms with local-only headers. The local
+ * Worker and the local Node host both serve through this.
+ */
+export declare function handleLocalHostedWalletGatewayRequestV1(request: Request, env: LocalHostedWalletGatewayEnv, ctx: CfExecutionContext, dependencies?: HostedWalletGatewayDependenciesV1): Promise<Response>;
+//# sourceMappingURL=localHostedWalletGatewayHandler.d.ts.map

package/dist/types/wallet-server/src/localIntendedEcdsaFinalizeFault.d.ts

@@ -0,0 +1,33 @@
+export declare const LOCAL_INTENDED_ECDSA_FINALIZE_FAULT_HEADER_V1 = "x-seams-intended-ecdsa-finalize-fault-v1";
+export declare const LOCAL_INTENDED_ECDSA_FINALIZE_FAULT_TOKEN_HEADER_V1 = "x-seams-intended-ecdsa-finalize-fault-token-v1";
+export declare const ROUTER_AB_ECDSA_FINALIZE_PATH_V1 = "/router-ab/ecdsa-derivation/sign";
+/**
+ * The Router's response to an admitted ECDSA finalize is lost after the
+ * SigningWorker has signed, and the identical request is sent again before the
+ * Gateway records any outcome. The retry reaches the SigningWorker, which must
+ * answer from the signing effect it already claimed: the same signature, with
+ * no second presignature consumed.
+ */
+type LocalIntendedEcdsaFinalizeFaultModeV1 = 'drop_router_response_once';
+type LocalIntendedEcdsaFinalizeFaultProofV1 = 'stored_signature_replayed';
+type LocalIntendedEcdsaFinalizeFaultViolationV1 = 'router_finalize_not_observed' | 'router_first_response_failed' | 'router_retry_response_failed' | 'router_retry_changed_response' | 'unexpected_additional_finalize';
+type LocalIntendedEcdsaFinalizeFaultOutcomeV1 = {
+    readonly kind: 'proved';
+    readonly proof: LocalIntendedEcdsaFinalizeFaultProofV1;
+} | {
+    readonly kind: 'violated';
+    readonly violation: LocalIntendedEcdsaFinalizeFaultViolationV1;
+};
+export declare function parseLocalIntendedEcdsaFinalizeFaultModeV1(value: string | null): LocalIntendedEcdsaFinalizeFaultModeV1 | null;
+export declare function parseLocalIntendedEcdsaFinalizeFaultTokenV1(value: string | null): string | null;
+export declare class LocalIntendedEcdsaFinalizeFaultControllerV1 {
+    private readonly baseFetch;
+    private state;
+    constructor(baseFetch: typeof globalThis.fetch);
+    fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
+    consumeOutcome(): LocalIntendedEcdsaFinalizeFaultOutcomeV1;
+}
+export declare function requestWithoutLocalIntendedEcdsaFinalizeFaultHeadersV1(request: Request): Request;
+export declare function responseWithLocalIntendedEcdsaFinalizeFaultOutcomeV1(response: Response, outcome: LocalIntendedEcdsaFinalizeFaultOutcomeV1, token: string): Response;
+export {};
+//# sourceMappingURL=localIntendedEcdsaFinalizeFault.d.ts.map