@seams/wallet-server 0.6.2 → 0.7.1

package/dist/types/wallet-server/src/router/cloudflare/d1/authorization/d1AuthorizationStore.d.ts

@@ -1,8 +1,9 @@
+import type { EcdsaWalletSessionAdmissionInput, EcdsaWalletSessionAdmissionResult, PinnedOwnerWalletScope } from '../../../../authorization/ecdsaWalletSessionAdmission';
 import { type MpcMaterialActivationRef, type WalletAuthorityId, type WalletAuthMethodId, type WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
 import { type AuthorizedOperationId, type TenantId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
-import type { AuthorizedOperation, AuthorizedOperationInput, IssuedWalletSessionAuthorizationV2, LiveWalletSessionAuthorizationProjectionV2, WalletSessionAuthorizationV2, ActiveWalletSessionQuota, PersistedActiveWalletSessionAuthorizationV2, DirectV2CommitResult, WalletSessionAuthorizationV2MintLookup, WalletSessionAuthorizationV2MintRead, AuthorizedOperationReplayResponse, CompletedCapabilityOperationResult, IssuedHostedWalletSeamsSessionExchangeV2, RedeemHostedWalletSeamsSessionExchangeV2Input, PersistedHostedWalletSeamsSessionExchangeV2Result, ExactWalletSessionQuotaProjectionV1, ExactWalletSessionStatusV2, WalletSessionExactOperationContext, ResolvedHostedWalletSessionOperationCredentialV2, VerifiedAuthorizationEvidenceSet, VerifiedOwnerProof } from '../../../../authorization/domain';
+import type { AuthorizedOperation, AuthorizedOperationInput, IssuedWalletSessionAuthorizationV2, LiveWalletSessionAuthorizationProjectionV2, WalletSessionAuthorizationV2, ActiveWalletSessionQuota, PersistedActiveWalletSessionAuthorizationV2, DirectV2CommitResult, WalletSessionAuthorizationV2MintLookup, WalletSessionAuthorizationV2MintRead, AuthorizedOperationReplayResponse, CompletedCapabilityOperationResult, IssuedHostedWalletSeamsSessionExchangeV2, RedeemHostedWalletSeamsSessionExchangeV2Input, PersistedHostedWalletSeamsSessionExchangeV2Result, ExactWalletSessionQuotaProjectionV1, ExactWalletSessionStatusV2, ExactWalletSessionStatusSnapshotV2, WalletSessionAdmissionSnapshotV2, WalletSessionExactOperationContext, ResolvedHostedWalletSessionOperationCredentialV2, VerifiedAuthorizationEvidenceSet, VerifiedOwnerProof } from '../../../../authorization/domain';
 import { type CapabilityOperationFingerprintDigest } from '../../../../../../shared-ts/src/authorization/operationFingerprint';
-import type { AuthorizedOperationPort, AuthorizationEvidencePort, AuthorizationGrantPort, AuthorizationSessionPort, AuthorizedOperationMaterialScope } from '../../../../authorization/service';
+import type { AuthorizedOperationAdmissionRejection, AuthorizedOperationPort, AuthorizationEvidencePort, AuthorizationGrantPort, AuthorizationSessionPort, AuthorizedOperationMaterialScope, AuthorizedOperationAdmissionResult, PreparedAuthorizedOperationAdmission } from '../../../../authorization/service';
 import type { D1WalletStoreScope } from '../../../../core/d1WalletStore';
 import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
 /**
@@ -10,7 +11,7 @@ import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storag
  * rather than the wallet signer rows, so the exact-status material check needs
  * this reader to recognize a linked session's capability subjects.
  */
-export type D1AuthorizationLinkedAuthorityMaterialReader = {
+type D1AuthorizationLinkedAuthorityMaterialReader = {
     readInstalledEd25519AuthorityByMaterialActivationV1(input: {
         readonly walletId: WalletId;
         readonly materialActivation: MpcMaterialActivationRef;
@@ -20,7 +21,7 @@ export type D1AuthorizationLinkedAuthorityMaterialReader = {
         readonly materialActivation: MpcMaterialActivationRef;
     }): Promise<D1AuthorizationLinkedAuthorityMaterialProjection | null>;
 };
-export type D1AuthorizationLinkedAuthorityMaterialProjection = {
+type D1AuthorizationLinkedAuthorityMaterialProjection = {
     readonly walletId: string;
     readonly materialActivation: MpcMaterialActivationRef;
 };
@@ -34,7 +35,6 @@ export declare class CloudflareD1AuthorizationStore implements AuthorizationSess
     private readonly database;
     private readonly namespace;
     private readonly walletSignerScope;
-    private readonly walletAuthorityStore;
     private readonly walletStore;
     private readonly getLinkedDeviceAuthorityReader;
     constructor(options: D1AuthorizationStoreOptions);
@@ -96,7 +96,6 @@ export declare class CloudflareD1AuthorizationStore implements AuthorizationSess
         readonly session: WalletSessionAuthorizationV2;
         readonly promotionAtMs: number;
     }): readonly [D1PreparedStatementLike, D1PreparedStatementLike, D1PreparedStatementLike];
-    private existingWalletSessionAuthorizationV2QuotaMatches;
     readWalletSessionAuthorizationV2ByMint(input: WalletSessionAuthorizationV2MintLookup): Promise<WalletSessionAuthorizationV2MintRead | null>;
     readLiveWalletSessionAuthorizationProjectionV2(input: {
         readonly expected: WalletSessionAuthorizationV2;
@@ -125,6 +124,16 @@ export declare class CloudflareD1AuthorizationStore implements AuthorizationSess
         readonly tokenHash: import('../../../../../../shared-ts/src/utils/canonicalPrimitives').DigestB64u;
         readonly nowMs: number;
     }): Promise<IssuedWalletSessionAuthorizationV2 | null>;
+    /**
+     * The live session, its authority and its auth method from one joined read.
+     * A commit between separate reads could pair the session with an authority
+     * it was never bound to; one statement cannot.
+     */
+    readWalletSessionAdmissionSnapshotByOperationCredential(input: {
+        readonly tenantId: WalletSessionAuthorizationV2['tenantId'];
+        readonly tokenHash: import('../../../../../../shared-ts/src/utils/canonicalPrimitives').DigestB64u;
+        readonly nowMs: number;
+    }): Promise<WalletSessionAdmissionSnapshotV2 | null>;
     readWalletSessionExactOperationContextByCredential(input: {
         readonly tenantId: WalletSessionAuthorizationV2['tenantId'];
         readonly tokenHash: import('../../../../../../shared-ts/src/utils/canonicalPrimitives').DigestB64u;
@@ -142,7 +151,15 @@ export declare class CloudflareD1AuthorizationStore implements AuthorizationSess
         readonly tokenHash: import('../../../../../../shared-ts/src/utils/canonicalPrimitives').DigestB64u;
         readonly nowMs: number;
     }): Promise<ExactWalletSessionStatusV2>;
-    private readExactStatusAuthority;
+    /**
+     * The exact status with the authority and auth method it was judged
+     * against, all from the one joined read.
+     */
+    readExactWalletSessionStatusSnapshotByOperationCredential(input: {
+        readonly tenantId: WalletSessionAuthorizationV2['tenantId'];
+        readonly tokenHash: import('../../../../../../shared-ts/src/utils/canonicalPrimitives').DigestB64u;
+        readonly nowMs: number;
+    }): Promise<ExactWalletSessionStatusSnapshotV2>;
     private exactWalletSessionCapabilitySubjectsResolveMaterial;
     private exactWalletSessionMaterialResolves;
     private readLinkedAuthorityMaterial;
@@ -156,23 +173,29 @@ export declare class CloudflareD1AuthorizationStore implements AuthorizationSess
         readonly tenantId: TenantId;
         readonly authorizedOperationId: AuthorizedOperationId;
     }): Promise<AuthorizedOperation | null>;
-    private readAuthorizedOperationRecord;
+    readPinnedOwnerWalletScope(input: {
+        readonly operation: AuthorizedOperation;
+        readonly walletId: WalletId;
+    }): Promise<PinnedOwnerWalletScope>;
+    private pinnedWalletSessionOwnerScope;
+    private readAuthorizedOperationForAdmission;
+    /** How an operation already admitted for this fingerprint answers another admission. */
+    private answerExistingAuthorizedOperation;
+    /**
+     * The admission `admitAuthorizedOperation` would make, prepared for a batch
+     * another store owns, after the same reads. It admits no ECDSA material:
+     * that admission is conditional on the signer row, not a plain insert.
+     */
+    prepareAuthorizedOperationAdmission(input: {
+        readonly operation: AuthorizedOperationInput;
+    }): Promise<PreparedAuthorizedOperationAdmission>;
+    classifyAuthorizedOperationAdmissionFailure(error: unknown): AuthorizedOperationAdmissionRejection | null;
     admitAuthorizedOperation(input: {
         readonly operation: AuthorizedOperationInput;
         readonly material?: AuthorizedOperationMaterialScope;
-    }): Promise<{
-        readonly kind: 'claimed';
-        readonly operation: AuthorizedOperation;
-    } | {
-        readonly kind: 'replayed';
-        readonly operation: AuthorizedOperation;
-    } | {
-        readonly kind: 'operation_in_progress';
-        readonly operation: AuthorizedOperation;
-    } | {
-        readonly kind: 'authorization_grant_rejected' | 'verified_step_up_rejected' | 'wallet_session_quota_exhausted' | 'material_mismatch';
-    }>;
-    private isAuthorizedOperationSourceActive;
+    }): Promise<AuthorizedOperationAdmissionResult>;
+    admitEcdsaWalletSessionOperation(input: EcdsaWalletSessionAdmissionInput): Promise<EcdsaWalletSessionAdmissionResult>;
+    private admitAuthorizedOperationRecord;
     completeAuthorizedOperation(input: {
         readonly operation: AuthorizedOperation;
         readonly result: CompletedCapabilityOperationResult;
@@ -181,4 +204,5 @@ export declare class CloudflareD1AuthorizationStore implements AuthorizationSess
     }): Promise<AuthorizedOperation>;
     private readHostedWalletExchangeV2;
 }
+export {};
 //# sourceMappingURL=d1AuthorizationStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/authorization/persistedWalletSessionAuthorization.d.ts

@@ -0,0 +1,3 @@
+import { type WalletSessionAuthorizationV2 } from '../../../../authorization/domain';
+export declare function parsePersistedWalletSessionAuthorizationV2(value: unknown): WalletSessionAuthorizationV2;
+//# sourceMappingURL=persistedWalletSessionAuthorization.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/authorization/walletSessionAuthorityProjection.d.ts

@@ -3,7 +3,7 @@ import type { WalletAuthorityId, WalletId } from '../../../../../../shared-ts/sr
 import type { DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
 import type { D1WalletStoreScope } from '../../../../core/d1WalletStore';
 import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
-export type WalletSessionAuthorityProjectionInput = {
+type WalletSessionAuthorityProjectionInput = {
     readonly walletId: WalletId;
     readonly authorityId: WalletAuthorityId;
     readonly authorityDigestB64u: DigestB64u;
@@ -21,4 +21,5 @@ export declare function prepareD1WalletSessionAuthorityProjectionStatements(inpu
     readonly scope: D1WalletStoreScope;
     readonly projection: WalletSessionAuthorityProjectionInput;
 }): readonly [D1PreparedStatementLike, D1PreparedStatementLike, D1PreparedStatementLike];
+export {};
 //# sourceMappingURL=walletSessionAuthorityProjection.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService.d.ts

@@ -3,11 +3,11 @@ import { type LinkDeviceSessionId, type MpcMaterialActivationRef, type WalletAut
 import { type DeviceId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
 import { type PrincipalId, type TenantId, type WalletSessionAuthorizationId, type WalletSessionId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
 import { type CommittedAuthorityPackagesV1 } from '../../../../../../shared-ts/src/device-linking/committedSignerPackages';
-import { type LinkedDeviceSessionRecordV1 } from '../../../../core/deviceLinking/linkedDeviceSession';
+import { type LinkedDeviceSessionRecordV1 } from '../../../../core/deviceLinking/linkedDeviceSessionRecord';
 import type { LocalAuthorityActivationFinalAckV1, LocalAuthorityInstallationReceiptV1, OrdinarySignerMaterialReservationPreparationV1 as SharedOrdinarySignerMaterialReservationPreparationV1, VerifiedLinkInputV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
 import { type LinkedDeviceWalletSessionCredentialDeliveryBindingV1, type LinkedDeviceWalletSessionCredentialDeliveryV1, type LinkedDeviceActivationCleanupReceiptV1 } from '../../../../../../shared-ts/src/device-linking/walletSessionCredentialDelivery';
 import { type ExactAdministeredSignerV1 } from '../../../../../../shared-ts/src/device-linking/delegatedActivationPlan';
-import { type WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import { type ActiveWalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
 import { OrdinaryInactiveSignerMaterialReservationServiceV1, type OrdinaryEcdsaSignerMaterialReservationPreparationV1, type OrdinaryEd25519SignerMaterialReservationPreparationV1 } from '../../../../core/signingMaterial/ordinaryInactiveSignerMaterialReservation';
 import type { LinkedDeviceEcdsaSourcePreservingActivationReceiptV1 } from '../../../../../../shared-ts/src/device-linking/sourceContribution';
 import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
@@ -108,9 +108,7 @@ export type ActivateInstalledAuthorityResultV1 = {
     readonly kind: 'active';
     readonly outcome: 'activated' | 'replayed';
     readonly authority: ActiveWalletAuthorityV1;
-    readonly authMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly status: 'active';
-    }>;
+    readonly authMethod: ActiveWalletAuthMethodRecordV2;
     readonly session: LinkedDeviceSessionRecordV1;
     readonly walletSession: IssuedWalletSessionAuthorizationV2;
     readonly deliveryBinding: LinkedDeviceWalletSessionCredentialDeliveryBindingV1;
@@ -141,6 +139,26 @@ export type LocalAuthorityActivationAcknowledgementAuthenticationV1 = {
     readonly walletSessionId: WalletSessionId;
     readonly expiresAtMs: number;
 };
+export type StoredInstallationRow = {
+    readonly linkSessionId: LinkDeviceSessionId;
+    readonly authorityId: WalletAuthorityId;
+    readonly walletId: WalletId;
+    readonly authMethodId: WalletAuthMethodId;
+    readonly deviceId: DeviceId;
+    readonly packageSetDigestB64u: DigestB64u;
+    readonly targetFactorVerificationDigestB64u: DigestB64u;
+    readonly targetFactorVerifiedAtMs: number;
+    readonly sourceManifestDigestB64u: DigestB64u;
+    /** Null is accepted only for legacy rows created before migration 0033. */
+    readonly deliveryRecipientPublicKey65B64u: string | null;
+    readonly packages: CommittedAuthorityPackagesV1;
+    readonly serverReservationIds: Readonly<{
+        readonly ed25519?: ServerReservationRecordV1<'ed25519'>;
+        readonly ecdsa_secp256k1?: ServerReservationRecordV1<'ecdsa_secp256k1'>;
+    }>;
+    readonly installedRecordSetDigestB64u: DigestB64u | null;
+    readonly activatedAtMs: number | null;
+};
 export type InstalledLinkedDeviceEd25519AuthorityProjectionV1 = {
     readonly walletId: WalletId;
     readonly authorityId: WalletAuthorityId;
@@ -170,6 +188,12 @@ export type InstalledLinkedDeviceEcdsaAuthorityProjectionV1 = {
     readonly installedRecordSetDigestB64u: DigestB64u;
     readonly activatedAtMs: number;
 };
+type ServerReservationRecordV1<F extends 'ed25519' | 'ecdsa_secp256k1'> = {
+    readonly reservationId: string;
+    readonly preparation: Extract<WorkerOrdinarySignerMaterialReservationPreparationV1, {
+        readonly keyFamily: F;
+    }>['preparation'];
+};
 export declare class D1LinkedDeviceAuthorityInstallServiceV1 {
     private readonly options;
     private readonly nowV1;
@@ -202,6 +226,11 @@ export declare class D1LinkedDeviceAuthorityInstallServiceV1 {
         readonly walletId: WalletId;
         readonly materialActivation: MpcMaterialActivationRef;
     }): Promise<InstalledLinkedDeviceEcdsaAuthorityProjectionV1 | null>;
+    readInstalledEcdsaAuthorityChainByMaterialActivationV1(input: {
+        readonly walletId: WalletId;
+        readonly materialActivation: MpcMaterialActivationRef;
+    }): Promise<readonly InstalledLinkedDeviceEcdsaAuthorityProjectionV1[]>;
+    private readVerifiedEcdsaInstallations;
     readActivationCleanupReceiptV1(input: {
         readonly linkSessionId: LinkDeviceSessionId;
         readonly requestedAtMs: number;
@@ -228,7 +257,6 @@ export declare class D1LinkedDeviceAuthorityInstallServiceV1 {
     private readCredentialDelivery;
     private readCredentialDeliveryRow;
     private buildWalletSessionAuthorizationInput;
-    private markInstalled;
     private prepareAuthorityAllocation;
     private prepareEmailOtpEnrollmentStatements;
     private readAuthorityAllocation;
@@ -237,5 +265,28 @@ export declare class D1LinkedDeviceAuthorityInstallServiceV1 {
     private readInstallationByAuthority;
     private readInstallationsByWallet;
 }
+/**
+ * The installed Ed25519 authority of a linked device, read from Gateway SQL
+ * alone: a linked device approving another link names its own binding as the
+ * source. Null when a link did not install the authority. An installation
+ * that does not project refuses.
+ */
+export declare function readD1LinkedDeviceEd25519SourceV1(sql: Pick<D1LinkedDeviceAuthorityInstallServiceOptionsV1, 'database' | 'scope'>, input: {
+    readonly walletId: WalletId;
+    readonly authorityId: WalletAuthorityId;
+    readonly walletAuthMethodId: WalletAuthMethodId;
+}): Promise<InstalledLinkedDeviceEd25519AuthorityProjectionV1 | null>;
+/**
+ * The installed ECDSA authority of a linked device, read from Gateway SQL
+ * alone: a linked device approving another link contributes from it. Null
+ * when a link did not install the authority. An installation that does not
+ * project refuses, so a linked device never falls back to another device's
+ * material.
+ */
+export declare function readD1LinkedDeviceEcdsaSourceV1(sql: Pick<D1LinkedDeviceAuthorityInstallServiceOptionsV1, 'database' | 'scope'>, input: {
+    readonly walletId: WalletId;
+    readonly authorityId: WalletAuthorityId;
+    readonly walletAuthMethodId: WalletAuthMethodId;
+}): Promise<InstalledLinkedDeviceEcdsaAuthorityProjectionV1 | null>;
 export {};
 //# sourceMappingURL=d1LinkedDeviceAuthorityInstallService.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEmailOtpGrantStore.d.ts

@@ -1,6 +1,5 @@
 /**
- * Refactor 103 Phase 6 — D1 persistence for linked-device Email OTP
- * verification grants.
+ * D1 persistence for linked-device Email OTP verification grants.
  *
  * A grant is issued once, after the emailed code verifies against the exact
  * link-session binding, and consumed exactly once. The CAS guard makes a lost
@@ -9,7 +8,7 @@
  */
 import { type LinkedDeviceEmailOtpGrantRecordV1 } from '../../../../core/deviceLinking/linkedDeviceEmailOtpGrant';
 import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
-import type { D1LinkedDeviceSessionScopeV1 } from './d1LinkedDeviceSessionStore';
+import { type D1LinkedDeviceSessionScopeV1 } from './d1LinkedDeviceSessionStore';
 export declare class D1LinkedDeviceEmailOtpGrantStoreV1 {
     private readonly database;
     private readonly scope;

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEmailOtpTargetFactor.d.ts

@@ -1,20 +1,20 @@
 /**
- * Refactor 103 Phase 6.2 — the D1 composition behind the linked-device Email
- * OTP challenge routes and the approval-time base-factor provenance reader.
+ * The D1 composition behind the linked-device Email OTP challenge routes and
+ * the approval-time base-factor provenance reader.
  *
  * Everything identity-bearing is resolved server-side: the destination comes
  * from the wallet's active verified enrollment, the base factor from the
  * canonical wallet auth-method store, and the target authority identity
  * from the enrollment identity. Device 2 supplies only the code it received
- * and its worker's ephemeral recipient key. Challenges reuse the Refactor 100
+ * and its worker's ephemeral recipient key. Challenges reuse the Email OTP
  * issuer, verifier, rate limits, and lockouts under the dedicated
  * `wallet_email_otp_device_link` purpose, bound by a digest over the whole
  * device-link context.
  */
 import type { LinkedDeviceApprovalV1, LinkedDeviceEmailOtpFactorReleaseEnvelopeV1, LinkedDeviceEmailOtpBaseFactorRequestV1, LinkedDeviceEmailOtpBaseFactorResolutionV1, LinkedDeviceEmailOtpVerificationGrantV1, LinkedDeviceTargetPreparationV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
-import type { WalletId, VerifiedEmailAddress } from '../../../../../../shared-ts/src/utils/domainIds';
-import type { WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/registrationIntent';
-import type { LinkedDeviceSessionRecordV1 } from '../../../../core/deviceLinking/linkedDeviceSession';
+import type { WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
+import type { WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
+import type { LinkedDeviceSessionRecordV1 } from '../../../../core/deviceLinking/linkedDeviceSessionRecord';
 import type { D1WalletAuthorityStore } from '../wallet/d1WalletAuthorityStore';
 import type { DeviceLinkingEmailOtpTargetFactorProviderV1 } from '../../../transport/fetch/routes/deviceLinking';
 import type { LinkedDeviceEmailOtpGrantRegistrationPortV1, VerifiedLinkedDeviceEmailOtpGrantV1 } from './d1LinkedDeviceTargetCredentialProvider';
@@ -23,7 +23,7 @@ import type { CloudflareD1EmailOtpChallengeVerifier } from '../emailOtp/d1EmailO
 import type { CloudflareD1EmailOtpEnrollmentStore } from '../emailOtp/d1EmailOtpEnrollmentStore';
 import type { CloudflareD1EmailOtpServerSealRuntime } from '../emailOtp/d1EmailOtpServerSealRuntime';
 import { type D1LinkedDeviceEmailOtpGrantStoreV1 } from './d1LinkedDeviceEmailOtpGrantStore';
-export type D1LinkedDeviceEmailOtpTargetFactorOptionsV1 = {
+type D1LinkedDeviceEmailOtpTargetFactorOptionsV1 = {
     readonly issuer: Pick<CloudflareD1EmailOtpChallengeIssuer, 'create'>;
     readonly verifier: Pick<CloudflareD1EmailOtpChallengeVerifier, 'verifyExisting' | 'verifyRegistration'>;
     readonly enrollments: Pick<CloudflareD1EmailOtpEnrollmentStore, 'readEnrollment'>;
@@ -39,25 +39,11 @@ export type D1LinkedDeviceEmailOtpTargetFactorOptionsV1 = {
     readonly grantTtlMs?: number;
     readonly resendCooldownMs?: number;
 };
-export type LinkedDeviceEmailOtpTargetEnrollmentResolutionV1 = {
-    readonly kind: 'existing_enrollment';
-    readonly targetEmail: VerifiedEmailAddress;
-} | {
-    readonly kind: 'new_enrollment';
-    readonly targetEmail: VerifiedEmailAddress;
-} | {
-    readonly kind: 'conflict';
-    readonly message: string;
-};
 export declare class D1LinkedDeviceEmailOtpTargetFactorV1 implements DeviceLinkingEmailOtpTargetFactorProviderV1 {
     private readonly options;
     private readonly grantTtlMs;
     private readonly resendCooldownMs;
     constructor(options: D1LinkedDeviceEmailOtpTargetFactorOptionsV1);
-    resolveTargetEnrollmentV1(input: {
-        readonly walletId: WalletId;
-        readonly targetEmail: VerifiedEmailAddress;
-    }): Promise<LinkedDeviceEmailOtpTargetEnrollmentResolutionV1>;
     resolveBaseFactorSelectionV1(input: {
         readonly walletId: WalletId;
         readonly request: LinkedDeviceEmailOtpBaseFactorRequestV1;
@@ -115,4 +101,5 @@ export declare class D1LinkedDeviceEmailOtpTargetFactorV1 implements DeviceLinki
     private resolveBaseFactorV1;
 }
 export declare function linkedDeviceEmailOtpGrantRegistrationPortV1(provider: D1LinkedDeviceEmailOtpTargetFactorV1): LinkedDeviceEmailOtpGrantRegistrationPortV1;
+export {};
 //# sourceMappingURL=d1LinkedDeviceEmailOtpTargetFactor.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceOwnerAuthorizationProvider.d.ts

@@ -1,10 +1,13 @@
 import type { LinkedDeviceOwnerAuthorizationSourceV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
 import { type DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
 import type { WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
+import { type WalletAuthMethodId, type WalletAuthorityId } from '../../../../../../shared-ts/src/utils/domainIds';
+import type { InstalledLinkedDeviceEcdsaAuthorityProjectionV1, InstalledLinkedDeviceEd25519AuthorityProjectionV1 } from './d1LinkedDeviceAuthorityInstallService';
 import type { D1WalletStore } from '../../../../core/d1WalletStore';
 import type { D1WalletAuthMethodStore } from '../../../../core/d1WalletAuthMethodStore';
 import type { RouterApiWalletRegistrationService } from '../../../framework/authServicePort';
-import type { LinkedDeviceOwnerAuthorizationPortV1, LinkedDeviceSourceKeyManifestDigestsV1 } from '../../../../core/deviceLinking/linkedDeviceSession';
+import type { LinkedDeviceOwnerAuthorizationPortV1 } from '../../../../core/deviceLinking/linkedDeviceSession';
+import type { LinkedDeviceSourceKeyManifestDigestsV1 } from '../../../../core/deviceLinking/linkedDeviceSessionRecord';
 import type { DeviceLinkingOwnerAuthorizationRouteServiceV1, DeviceLinkingOwnerWalletSessionContextV1 } from '../../../../router/transport/fetch/routes/deviceLinkingOwnerAuthorization';
 import type { LinkedDeviceOwnerSourceChildResolutionRequestV1, LinkedDeviceOwnerSourceChildResolutionV1, LinkedDeviceOwnerSourceChildResolverV1, D1LinkedDeviceTargetPlannerOptionsV1, D1LinkedDeviceTargetPlannerV1 } from './d1LinkedDeviceTargetPlanner';
 import { type VerifiedLinkSourceReadV1 } from './d1LinkedDeviceVerifiedLinkBuilder';
@@ -47,6 +50,15 @@ export type D1LinkedDeviceOwnerSourceChildReaderV1 = Pick<D1LinkedDeviceOwnerAut
 export type D1LinkedDeviceOwnerSourceChildReaderOptionsV1 = {
     readonly walletAuthMethodStore: Pick<D1WalletAuthMethodStore, 'listForWalletV2'>;
     readonly walletStore: Pick<D1WalletStore, 'listEd25519SignersForWallet' | 'listEcdsaSignersForWallet'>;
+    /** A linked device's installed Ed25519 authority; null for one a link did not install. */
+    readonly readLinkedEd25519SourceV1: (input: LinkedDeviceSourceAuthorityIdentityV1) => Promise<InstalledLinkedDeviceEd25519AuthorityProjectionV1 | null>;
+    /** A linked device's installed ECDSA authority; null for one a link did not install. */
+    readonly readLinkedEcdsaSourceV1: (input: LinkedDeviceSourceAuthorityIdentityV1) => Promise<InstalledLinkedDeviceEcdsaAuthorityProjectionV1 | null>;
+};
+type LinkedDeviceSourceAuthorityIdentityV1 = {
+    readonly walletId: WalletId;
+    readonly authorityId: WalletAuthorityId;
+    readonly walletAuthMethodId: WalletAuthMethodId;
 };
 /** Builds authoritative source-child facts directly from the wallet stores. */
 export declare function createD1LinkedDeviceOwnerSourceChildReaderV1(options: D1LinkedDeviceOwnerSourceChildReaderOptionsV1): D1LinkedDeviceOwnerSourceChildReaderV1;
@@ -77,4 +89,5 @@ export type D1LinkedDeviceOwnerAuthorizationProviderV1 = {
     readonly targetPlanner: D1LinkedDeviceTargetPlannerV1;
 };
 export declare function createD1LinkedDeviceOwnerAuthorizationProviderV1(options: D1LinkedDeviceOwnerAuthorizationProviderOptionsV1): D1LinkedDeviceOwnerAuthorizationProviderV1;
+export {};
 //# sourceMappingURL=d1LinkedDeviceOwnerAuthorizationProvider.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRevocation.d.ts

@@ -0,0 +1,49 @@
+import type { LinkedDeviceRevokeRequestV1, LinkedDeviceRevokeResultV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
+import type { DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
+import type { WalletAuthMethodId, WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
+import type { LinkedDeviceManagementServiceV1, LinkedDeviceManagementSourceV1 } from '../../../../core/deviceLinking/linkedDeviceManagement';
+import type { D1WalletAuthMethodStore } from '../../../../core/d1WalletAuthMethodStore';
+import type { DeviceLinkingAuthDeniedV1 } from '../../../transport/fetch/routes/deviceLinking';
+import type { D1LinkedDeviceFreshRevokeProofV1, verifyD1LinkedDeviceFreshRevokeProofV1 } from '../wallet/d1WalletAuthMethodBoundary';
+import type { D1WalletAuthorityStore } from '../wallet/d1WalletAuthorityStore';
+import { type D1WalletAuthMethodRevocationReplayStoreV1 } from '../wallet/d1WalletAuthMethodRevocationReplayStore';
+/** Verifies a fresh proof without spending it; an Email OTP spend rides in the result. */
+type FreshRevokeProofVerifierV1 = (input: {
+    readonly walletId: WalletId;
+    readonly targetWalletAuthMethodId: WalletAuthMethodId;
+    readonly proof: D1LinkedDeviceFreshRevokeProofV1;
+    readonly expectedOrigin: string;
+    readonly verifiedAtMs: number;
+    readonly operationFingerprintDigest: DigestB64u;
+}) => ReturnType<typeof verifyD1LinkedDeviceFreshRevokeProofV1>;
+type D1LinkedDeviceRevocationOutcomeV1 = {
+    readonly kind: 'answered';
+    readonly result: LinkedDeviceRevokeResultV1;
+} | DeviceLinkingAuthDeniedV1;
+/**
+ * Revokes one linked device on a fresh proof from another active full-owner
+ * method, as an auth-method revocation does: the proof is spent, the method
+ * revoked and the answer recorded in one batch.
+ *
+ * The record binds the answer to the operation fingerprint and to a digest
+ * of the proof, never the proof or its code. An exact retry is answered from
+ * the record before its proof is examined again, so a request whose answer
+ * was lost receives what committed although its code is spent. An Email OTP
+ * code is verified without being spent, and spent only in that batch, so a
+ * batch that does not commit leaves it usable for the same request.
+ */
+export declare function createD1LinkedDeviceRevocationV1(deps: {
+    readonly management: Pick<LinkedDeviceManagementServiceV1, 'revokeLinkedDeviceV1' | 'finishLinkedDeviceRevocationV1'>;
+    readonly replays: D1WalletAuthMethodRevocationReplayStoreV1;
+    readonly verifyProofForBatch: FreshRevokeProofVerifierV1;
+    readonly authMethodStore: Pick<D1WalletAuthMethodStore, 'readByIdV2' | 'prepareActiveV2SourceGuardStatements'>;
+    readonly authorityStore: Pick<D1WalletAuthorityStore, 'readById'>;
+    readonly nowV1: () => number;
+}): (input: {
+    readonly request: LinkedDeviceRevokeRequestV1;
+    readonly owner: LinkedDeviceManagementSourceV1;
+    readonly proof: D1LinkedDeviceFreshRevokeProofV1;
+    readonly expectedOrigin: string;
+}) => Promise<D1LinkedDeviceRevocationOutcomeV1>;
+export {};
+//# sourceMappingURL=d1LinkedDeviceRevocation.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionRecords.d.ts

@@ -1,4 +1,4 @@
-import { type LinkedDeviceSessionRecordV1 } from '../../../../core/deviceLinking/linkedDeviceSession';
+import { type LinkedDeviceSessionRecordV1 } from '../../../../core/deviceLinking/linkedDeviceSessionRecord';
 import { type DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
 export type D1LinkedDeviceSessionRowV1 = {
     readonly link_session_id?: unknown;

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionStore.d.ts

@@ -1,6 +1,7 @@
 import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
 import type { LinkedDeviceApprovalV1, LinkedDeviceSessionClaimV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
-import { type LinkedDeviceSessionListCursorV1, type LinkedDeviceSessionListPageV1, type LinkedDeviceSessionMutationResultV1, type LinkedDeviceSessionRecordV1, type LinkedDeviceSessionStoreV1 } from '../../../../core/deviceLinking/linkedDeviceSession';
+import type { LinkedDeviceSessionListCursorV1, LinkedDeviceSessionListPageV1, LinkedDeviceSessionStoreV1 } from '../../../../core/deviceLinking/linkedDeviceSession';
+import { type LinkedDeviceSessionMutationResultV1, type LinkedDeviceSessionRecordV1 } from '../../../../core/deviceLinking/linkedDeviceSessionRecord';
 import { type LinkDeviceSessionId } from '../../../../../../shared-ts/src/signing-lanes/ids';
 import type { DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
 import type { WalletAuthorityId, WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
@@ -15,10 +16,11 @@ export type D1LinkedDeviceSessionStoreOptionsV1 = {
     readonly scope: D1LinkedDeviceSessionScopeV1;
     readonly now?: () => number;
 };
+/** Aborts the batch it is in when the statement just before it changed no row. */
+export declare const SESSION_CAS_GUARD_SQL = "INSERT INTO linked_device_session_cas_guard (guard_id)\nSELECT 1\n WHERE changes() = 0";
 export declare class D1LinkedDeviceSessionStoreV1 implements LinkedDeviceSessionStoreV1 {
     private readonly database;
     private readonly scope;
-    private readonly now;
     constructor(options: D1LinkedDeviceSessionStoreOptionsV1);
     createUnclaimedSessionV1(record: LinkedDeviceSessionRecordV1): Promise<LinkedDeviceSessionMutationResultV1>;
     getSessionV1(linkSessionId: LinkDeviceSessionId): Promise<LinkedDeviceSessionRecordV1 | null>;

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSourceContributionPreparationPlanner.d.ts

@@ -1,5 +1,5 @@
 import type { LinkedDeviceApprovalV1, LinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1, LinkedDeviceTargetCredentialRegistrationV1, LinkedDeviceTargetPreparationV1, VerifiedTargetFactorV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
-import type { LinkedDeviceSessionRecordV1 } from '../../../../core/deviceLinking/linkedDeviceSession';
+import type { LinkedDeviceSessionRecordV1 } from '../../../../core/deviceLinking/linkedDeviceSessionRecord';
 import type { LinkedDeviceOwnerSourceChildResolverV1 } from './d1LinkedDeviceTargetPlanner';
 import type { LinkedDeviceSourceContributionPreparationPlannerV1, VerifiedLinkedDeviceTargetFactorEvidenceV1 } from './d1LinkedDeviceTargetCredentialProvider';
 import type { VerifiedLinkSourceReadV1 } from './d1LinkedDeviceVerifiedLinkBuilder';

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetCredentialProvider.d.ts

@@ -2,9 +2,9 @@ import type { LinkedDeviceApprovalV1, LinkedDevicePasskeyTargetConfigurationFiel
 import { type DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
 import { type WalletAuthMethodId, type WebAuthnCredentialIdB64u } from '../../../../../../shared-ts/src/utils/domainIds';
 import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
-import type { LinkedDeviceSessionRecordV1 } from '../../../../core/deviceLinking/linkedDeviceSession';
+import type { LinkedDeviceSessionRecordV1 } from '../../../../core/deviceLinking/linkedDeviceSessionRecord';
 import type { DeviceLinkingTargetCredentialProviderV1, LinkedDeviceTargetPreparationResultV1 } from '../../../../router/transport/fetch/routes/deviceLinking';
-import type { D1LinkedDeviceSessionScopeV1 } from './d1LinkedDeviceSessionStore';
+import { type D1LinkedDeviceSessionScopeV1 } from './d1LinkedDeviceSessionStore';
 import { type VerifiedLinkSourceReadV1, type VerifiedLinkSourceReaderV1 } from './d1LinkedDeviceVerifiedLinkBuilder';
 export type VerifiedLinkedDeviceWebAuthnCredentialV1 = {
     readonly credentialIdB64u: string;

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetPlanner.d.ts

@@ -1,15 +1,15 @@
 import type { LinkedDeviceApprovalV1, LinkedDeviceTargetPreparationV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
 import type { DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
-import type { WebAuthnRpId } from '../../../../../../shared-ts/src/utils/domainIds';
+import type { MpcMaterialActivationRef, WebAuthnRpId } from '../../../../../../shared-ts/src/utils/domainIds';
 import type { ActiveLaneProtocolSourceV1, EcdsaTargetCapabilityBindingV1, LaneTargetSigningWorkerV1 } from '../../../../../../shared-ts/src/signing-lanes/rotation';
 import type { LaneHolderParticipantId } from '../../../../../../shared-ts/src/signing-lanes/participants';
 import type { EvmFamilySigningKeySlotId } from '../../../../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId';
 import type { KeyCreationSignerSlot } from '../../../../../../shared-ts/src/passkey-custody/primitives';
 import type { Ed25519PublicKeyB64u } from '../../../../../../shared-ts/src/passkey-custody/primitives';
-import type { RouterAbEd25519YaoActivationBindingV1, RouterAbEd25519YaoApplicationBindingFactsV1 } from '../../../../../../shared-ts/src/utils/routerAbEd25519Yao';
-import type { NearEd25519SigningKeyId } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import type { RouterAbEd25519YaoActivationBindingV1, RouterAbEd25519YaoApplicationBindingFactsV1, RouterAbEd25519YaoCeremonyBindingV1 } from '../../../../../../shared-ts/src/utils/routerAbEd25519Yao';
+import type { NearEd25519SigningKeyId } from '../../../../../../shared-ts/src/utils/registrationIds';
 import type { WalletKeyId } from '../../../../../../shared-ts/src/signing-lanes/ids';
-import type { LinkedDeviceSessionRecordV1 } from '../../../../core/deviceLinking/linkedDeviceSession';
+import type { LinkedDeviceSessionRecordV1 } from '../../../../core/deviceLinking/linkedDeviceSessionRecord';
 import type { ExactAdministeredSignerV1 } from '../../../../../../shared-ts/src/device-linking/delegatedActivationPlan';
 import type { LinkedDeviceTargetPlannerV1 } from './d1LinkedDeviceTargetCredentialProvider';
 type LinkedDeviceOwnerSourceChildResolutionBaseV1 = {
@@ -28,6 +28,8 @@ type LinkedDeviceOwnerEd25519SourceChildResolutionV1 = LinkedDeviceOwnerSourceCh
     readonly stableContextBindingB64u: string;
     readonly sourceBinding: RouterAbEd25519YaoActivationBindingV1<'registration'>;
     readonly applicationBinding: RouterAbEd25519YaoApplicationBindingFactsV1;
+    /** A linked device's own registration binding, when that device is the source. */
+    readonly linkedSourceBinding?: RouterAbEd25519YaoCeremonyBindingV1;
 };
 type LinkedDeviceOwnerEcdsaSourceChildResolutionV1 = LinkedDeviceOwnerSourceChildResolutionBaseV1 & {
     readonly keyFamily: 'ecdsa_secp256k1';
@@ -38,6 +40,8 @@ type LinkedDeviceOwnerEcdsaSourceChildResolutionV1 = LinkedDeviceOwnerSourceChil
     readonly sourceServerVerifyingShare33B64u: string;
     readonly applicationBindingDigestB64u: DigestB64u;
     readonly clientShareRetryCounter: number;
+    /** A linked device's own material, when that device is the source. */
+    readonly linkedSourceMaterialActivation?: MpcMaterialActivationRef;
 };
 export type LinkedDeviceOwnerSourceChildResolutionV1 = LinkedDeviceOwnerEd25519SourceChildResolutionV1 | LinkedDeviceOwnerEcdsaSourceChildResolutionV1;
 export type LinkedDeviceTargetEnrichedChildResolutionV1 = (LinkedDeviceOwnerEd25519SourceChildResolutionV1 & {

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceVerifiedLinkBuilder.d.ts

@@ -2,15 +2,13 @@ import { type ExactAdministeredSignerManifestV1 } from '../../../../../../shared
 import type { LinkedDeviceApprovalV1, LinkedDeviceTargetCredentialRegistrationV1, LinkedDeviceTargetPreparationV1, VerifiedLinkInputV1, VerifiedTargetFactorV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
 import type { ActiveWalletAuthorityV1 } from '../../../../../../shared-ts/src/authorization/walletAuthority';
 import type { DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
-import type { WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import type { ActiveWalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
 import type { PrincipalId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
-import { type LinkedDeviceSessionRecordV1 } from '../../../../core/deviceLinking/linkedDeviceSession';
+import { type LinkedDeviceSessionRecordV1 } from '../../../../core/deviceLinking/linkedDeviceSessionRecord';
 import type { VerifiedLinkedDeviceTargetFactorEvidenceV1 } from './d1LinkedDeviceTargetCredentialProvider';
 export type VerifiedLinkSourceReadV1 = {
     readonly authority: ActiveWalletAuthorityV1;
-    readonly authMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly status: 'active';
-    }>;
+    readonly authMethod: ActiveWalletAuthMethodRecordV2;
     readonly signerManifest: ExactAdministeredSignerManifestV1;
     /** The custody manifest recorded on the requested source signer. */
     readonly keyManifestDigestB64u: DigestB64u;

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/installedEcdsaAuthority.d.ts

@@ -0,0 +1,7 @@
+import { type MpcMaterialActivationRef } from '../../../../../../shared-ts/src/utils/domainIds';
+import type { InstalledLinkedDeviceEcdsaAuthorityProjectionV1, StoredInstallationRow } from './d1LinkedDeviceAuthorityInstallService';
+export declare function findInstalledEcdsaAuthority(rows: readonly StoredInstallationRow[], materialActivation: MpcMaterialActivationRef): InstalledLinkedDeviceEcdsaAuthorityProjectionV1 | null;
+/** Every hop observes the same verified installation set from one database read. */
+export declare function installedEcdsaAuthorityChain(rows: readonly StoredInstallationRow[], materialActivation: MpcMaterialActivationRef): readonly InstalledLinkedDeviceEcdsaAuthorityProjectionV1[];
+export declare function projectInstalledEcdsaAuthority(stored: StoredInstallationRow): InstalledLinkedDeviceEcdsaAuthorityProjectionV1 | null;
+//# sourceMappingURL=installedEcdsaAuthority.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoCapabilityPersistence.d.ts

@@ -18,7 +18,7 @@ export declare class CloudflareD1RouterAbEd25519YaoCapabilityPersistence impleme
     private readonly now;
     private schemaReady;
     constructor(options: CloudflareD1RouterAbEd25519YaoCapabilityPersistenceOptions);
-    replaceActiveCapability(input: {
+    prepareActiveCapabilityReplacement(input: {
         readonly operation: RouterAbEd25519YaoCapabilityReplacementOperationV1;
         readonly previous: WalletEd25519YaoActiveCapabilityRecord;
         readonly next: WalletEd25519YaoActiveCapabilityRecord;
@@ -28,6 +28,5 @@ export declare class CloudflareD1RouterAbEd25519YaoCapabilityPersistence impleme
     private prepareAuthorityReplacementStatement;
     private prepareSessionAuthorityProjectionReplacementStatement;
     private readReceipt;
-    private reconcileAfterUncertainWrite;
 }
 //# sourceMappingURL=d1Ed25519YaoCapabilityPersistence.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoLifecycleDecisionStore.d.ts

@@ -0,0 +1,33 @@
+import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import type { RouterAbEd25519YaoLifecycleDecisionV1 } from '../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoLifecycleDecision';
+/**
+ * The Gateway's Ed25519 Yao lifecycle decisions, in the signer database. A
+ * decision is inserted once, in the batch that makes its finalization
+ * visible, and never changes.
+ */
+export declare class CloudflareD1Ed25519YaoLifecycleDecisionStoreV1 {
+    private readonly database;
+    private readonly scope;
+    constructor(input: {
+        readonly database: D1DatabaseLike;
+        readonly namespace: string;
+        readonly orgId: string;
+        readonly projectId: string;
+        readonly envId: string;
+    });
+    read(lifecycleId: string): Promise<RouterAbEd25519YaoLifecycleDecisionV1 | null>;
+    /**
+     * The statements that record `decision`, for a batch whose other statements
+     * make its finalization visible. The batch aborts unless they insert the
+     * decision: a lifecycle already decided, even the same way, commits nothing
+     * more.
+     */
+    prepareDecideStatements(decision: RouterAbEd25519YaoLifecycleDecisionV1, decidedAtMs: number): readonly D1PreparedStatementLike[];
+    /**
+     * Commits `decision` and the statements that make its finalization visible
+     * in one batch. A guard among `visibility`, or a decision already recorded,
+     * aborts it and nothing commits: the caller reads what holds instead.
+     */
+    decide(decision: RouterAbEd25519YaoLifecycleDecisionV1, visibility: readonly D1PreparedStatementLike[], decidedAtMs: number): Promise<void>;
+}
+//# sourceMappingURL=d1Ed25519YaoLifecycleDecisionStore.d.ts.map