@seams/wallet-server 0.6.2 → 0.7.1

package/dist/types/wallet-server/src/router/cloudflare/d1/versionedJson/d1VersionedJsonRecordStore.d.ts

@@ -32,19 +32,6 @@ export type CloudflareD1VersionedJsonRecordBatchPutResultV1 = {
     readonly kind: 'version_mismatch';
     readonly key: string;
 };
-export type CloudflareD1VersionedJsonRecordAtomicPatchV1 = {
-    readonly key: string;
-    readonly expectedVersion: string;
-    readonly exactStringPredicates: readonly {
-        readonly jsonPath: string;
-        readonly value: string;
-    }[];
-    readonly unexpired: {
-        readonly jsonPath: string;
-        readonly nowMs: number;
-    };
-    readonly patch: VersionedJsonObject;
-};
 export declare class CloudflareD1VersionedJsonRecordStoreError extends Error {
     readonly code: 'invalid_record' | 'invalid_response' | 'request_failed';
     constructor(code: 'invalid_record' | 'invalid_response' | 'request_failed', message: string);
@@ -104,9 +91,6 @@ export declare class CloudflareD1VersionedJsonRecordStore<T> {
      * that batch.
      */
     prepareMutationStatements(mutations: readonly CloudflareD1VersionedJsonRecordMutationV1<T>[]): readonly D1PreparedStatementLike[];
-    patchAtomically(input: CloudflareD1VersionedJsonRecordAtomicPatchV1): Promise<VersionedJsonRecordPutResult & {
-        readonly value?: T;
-    }>;
     private prepareBatchMutations;
     private prepareMutationStatement;
     private findBatchConflict;

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAddSignerService.d.ts

@@ -1,3 +1,5 @@
+import type { WalletAddSignerStartSuccess } from '../../../../core/registrationContracts';
+import type { CloudflareD1Ed25519YaoLifecycleDecisionStoreV1 } from '../ed25519Yao/d1Ed25519YaoLifecycleDecisionStore';
 import type { WalletAddSignerFinalizeRequest, WalletAddSignerFinalizeResponse, WalletAddSignerEcdsaActivationRequest, WalletAddSignerEcdsaActivationResponse, WalletAddSignerEcdsaDerivationRespondRequest, WalletAddSignerEcdsaDerivationRespondResponse, WalletAddSignerStartRequest, WalletAddSignerStartResponse } from '../../../../core/registrationContracts';
 import type { D1WalletStore } from '../../../../core/d1WalletStore';
 import type { StoredWalletAddSignerCeremony, StoredAddSignerIntent } from '../../../../core/RegistrationCeremonyStore';
@@ -13,21 +15,17 @@ type StartWalletAddSignerInput = WalletAddSignerStartRequest;
 type RespondWalletAddSignerDerivationInput = WalletAddSignerEcdsaDerivationRespondRequest;
 type ActivateWalletAddSignerEcdsaInput = WalletAddSignerEcdsaActivationRequest;
 type FinalizeWalletAddSignerInput = WalletAddSignerFinalizeRequest;
-type WalletAddSignerStartCoreResponse = (Omit<Extract<WalletAddSignerStartResponse, {
-    readonly ok: true;
-    readonly kind: 'near_ed25519';
+type WalletAddSignerStartCoreResponse = (Omit<Extract<WalletAddSignerStartSuccess, {
+    kind: 'near_ed25519';
 }>, 'ed25519'> & {
-    readonly ed25519: Omit<Extract<WalletAddSignerStartResponse, {
-        readonly ok: true;
-        readonly kind: 'near_ed25519';
+    readonly ed25519: Omit<Extract<WalletAddSignerStartSuccess, {
+        kind: 'near_ed25519';
     }>['ed25519'], 'custodyEnvelope'>;
-}) | (Omit<Extract<WalletAddSignerStartResponse, {
-    readonly ok: true;
-    readonly kind: 'evm_family_ecdsa';
+}) | (Omit<Extract<WalletAddSignerStartSuccess, {
+    kind: 'evm_family_ecdsa';
 }>, 'ecdsa'> & {
-    readonly ecdsa: Omit<Extract<WalletAddSignerStartResponse, {
-        readonly ok: true;
-        readonly kind: 'evm_family_ecdsa';
+    readonly ecdsa: Omit<Extract<WalletAddSignerStartSuccess, {
+        kind: 'evm_family_ecdsa';
     }>['ecdsa'], 'custodyEnvelope'>;
 }) | Extract<WalletAddSignerStartResponse, {
     readonly ok: false;
@@ -38,7 +36,7 @@ type WalletAddSignerStartCoreSuccess = Extract<WalletAddSignerStartCoreResponse,
 type RegistrationCeremonyStoreProvider = () => CloudflareD1RegistrationCeremonyIntentStore;
 type WalletStoreProvider = () => D1WalletStore;
 type Ed25519YaoProductRegistrationProvider = () => RouterAbEd25519YaoProductRegistrationRuntimeV1 | null;
-export type D1WalletAddSignerStartPreparedV1 = {
+type D1WalletAddSignerStartPreparedV1 = {
     readonly kind: 'd1_wallet_add_signer_start_prepared_v1';
     readonly addSignerCeremonyId: string;
     readonly registrationPreparationId: string;
@@ -46,7 +44,7 @@ export type D1WalletAddSignerStartPreparedV1 = {
     readonly storedIntent: StoredAddSignerIntent;
     readonly auth: StoredWalletAddSignerCeremony['auth'];
 };
-export type D1WalletAddSignerStartTerminalV1 = {
+type D1WalletAddSignerStartTerminalV1 = {
     readonly kind: 'd1_wallet_add_signer_start_succeeded_v1';
     readonly ceremony: StoredWalletAddSignerCeremony;
     readonly response: WalletAddSignerStartCoreSuccess;
@@ -79,6 +77,7 @@ export declare class CloudflareD1WalletAddSignerService {
     private readonly passkeyCustodyEnvelopes;
     private readonly startSideEffects;
     private readonly finalizeSideEffects;
+    private readonly yaoLifecycleDecisions;
     constructor(input: {
         readonly getRegistrationCeremonyIntentStore: RegistrationCeremonyStoreProvider;
         readonly getEd25519YaoProductRegistration: Ed25519YaoProductRegistrationProvider;
@@ -89,7 +88,16 @@ export declare class CloudflareD1WalletAddSignerService {
         readonly passkeyCustodyEnvelopes: CloudflareD1PasskeyCustodyEnvelopeStore;
         readonly startSideEffects: D1WalletAddSignerStartSideEffectStore;
         readonly finalizeSideEffects: D1WalletAddSignerFinalizeSideEffectStore;
+        readonly yaoLifecycleDecisions: CloudflareD1Ed25519YaoLifecycleDecisionStoreV1;
     });
+    /**
+     * Commits an added ECDSA signer onto the authority whose passkey authorized
+     * the ceremony: its signer records, the authority extended with the new
+     * activation, and that authority's live Wallet Sessions promoted to it, so the
+     * wallet signs with the new key at once. A retry after the commit finds the
+     * authority already carrying this activation and commits nothing.
+     */
+    private extendOwnerAuthorityWithAddedEcdsaSigner;
     getWalletAddSignerRuntimePolicyScope(addSignerCeremonyId: string): Promise<NonNullable<ReturnType<typeof parseD1RuntimePolicyScope>> | null>;
     startWalletAddSigner(request: StartWalletAddSignerInput): Promise<WalletAddSignerStartResponse>;
     private attachWalletAddSignerCustodyEnvelope;
@@ -108,6 +116,13 @@ export declare class CloudflareD1WalletAddSignerService {
     activateWalletAddSignerEcdsa(request: ActivateWalletAddSignerEcdsaInput): Promise<WalletAddSignerEcdsaActivationResponse>;
     finalizeWalletAddSigner(request: FinalizeWalletAddSignerInput): Promise<WalletAddSignerFinalizeResponse>;
     private executeWalletAddSignerFinalizeSideEffect;
+    /**
+     * Makes an added Ed25519 signer visible with its lifecycle's decision, in
+     * one batch. A finalize that finds its own decision has nothing left to
+     * write. Another decision for the lifecycle, or another signer in the slot,
+     * refuses it.
+     */
+    private decideEd25519YaoSignerVisibility;
     private executeWalletAddSignerFinalize;
 }
 export {};

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthMethodBoundary.d.ts

@@ -1,12 +1,16 @@
-import { type WalletAuthMethodId, type WalletAuthorityId } from '../../../../../../shared-ts/src/utils/domainIds';
-import { type AddAuthMethodIntentV1, type AddSignerIntentV1, type RegistrationAuthority, type WebAuthnRpId, type WalletId, type WalletAuthMethodRevocationProof, type WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import { type WalletAuthMethodId } from '../../../../../../shared-ts/src/utils/domainIds';
+import { type AddAuthMethodIntentV1, type AddSignerIntentV1, type WebAuthnRpId, type WalletId } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import { type WalletAuthMethodRevocationProof } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
+import { type RegistrationAuthority } from '../../../../../../shared-ts/src/utils/registrationAuthMethodInput';
 import { type WalletAuthAuthority } from '../../../../../../shared-ts/src/utils/walletAuthAuthority';
 import type { StoredWalletAddAuthMethodCeremony, StoredWalletAddSignerCeremony } from '../../../../core/RegistrationCeremonyStore';
-import type { WalletAddAuthMethodStartRequest, WalletAddSignerStartRequest, WalletRegistrationFinalizeAuthMethod } from '../../../../core/registrationContracts';
+import type { WalletAddAuthMethodStartRequest, WalletAddSignerStartRequest } from '../../../../core/registrationContracts';
+import type { WalletRegistrationFinalizeAuthMethod } from '../../../../../../shared-ts/src/utils/registrationContracts';
 import type { WalletAuthMethodV2Store } from '../../../../core/d1WalletAuthMethodStore';
 import type { DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
 import type { EmailOtpWalletEnrollmentRecord } from '../../../../core/EmailOtpStores';
-import type { EmailOtpExistingChallengeVerifyInput, EmailOtpExistingChallengeVerifyResult } from '../emailOtp/d1EmailOtpChallengeVerifier';
+import type { EmailOtpExistingChallengeVerifyInput, EmailOtpExistingChallengeBatchVerifyResult, EmailOtpExistingChallengeVerifyResult } from '../emailOtp/d1EmailOtpChallengeVerifier';
+import type { D1PreparedStatementLike } from '../../../../storage/tenantRoute';
 type StartWalletAddSignerInput = WalletAddSignerStartRequest;
 type StartWalletAddAuthMethodInput = WalletAddAuthMethodStartRequest;
 export type D1AddSignerExistingAuthResolution = {
@@ -30,14 +34,6 @@ export declare function walletAuthAuthorityFromRegistrationAuthority(input: {
     readonly authority: RegistrationAuthority;
     readonly walletAuthMethodId: WalletAuthMethodId;
 }): WalletAuthAuthority;
-export declare function walletAuthMethodRecordFromRegistrationAuthority(input: {
-    readonly authority: RegistrationAuthority;
-    readonly walletAuthMethodId: WalletAuthMethodId;
-    readonly walletAuthorityId: WalletAuthorityId;
-    readonly now: number;
-}): Extract<WalletAuthMethodRecordV2, {
-    readonly status: 'active';
-}>;
 export type D1LinkedDeviceFreshRevokeProofV1 = WalletAuthMethodRevocationProof;
 export type D1FreshRevokeWebAuthnVerifierV1 = (input: {
     readonly userId: string;
@@ -61,11 +57,18 @@ export declare function verifyD1LinkedDeviceFreshRevokeProofV1(input: {
     readonly walletAuthMethodStore: Pick<WalletAuthMethodV2Store, 'getPasskeyV2' | 'listForWalletV2'>;
     readonly verifyWebAuthnAuthenticationLite: D1FreshRevokeWebAuthnVerifierV1;
     readonly verifyEmailOtpExisting?: (input: EmailOtpExistingChallengeVerifyInput) => Promise<EmailOtpExistingChallengeVerifyResult>;
+    /**
+     * Given, an Email OTP proof is verified without consuming its challenge,
+     * and the authorization carries the statements that consume it inside the
+     * caller's batch.
+     */
+    readonly verifyEmailOtpExistingForBatch?: (input: EmailOtpExistingChallengeVerifyInput) => Promise<EmailOtpExistingChallengeBatchVerifyResult>;
     readonly readEmailOtpEnrollment?: (walletId: string) => Promise<EmailOtpWalletEnrollmentRecord | null>;
 }): Promise<{
     readonly kind: 'authorized';
     readonly walletAuthMethodId: WalletAuthMethodId;
     readonly verifiedAtMs: number;
+    readonly emailOtpConsumeInBatch?: readonly D1PreparedStatementLike[];
 } | {
     readonly kind: 'denied';
     readonly code: 'unauthorized' | 'invalid';

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthMethodRevocationReplayStore.d.ts

@@ -0,0 +1,71 @@
+import type { WalletAuthMethodRevocationProof } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
+import type { LinkedDeviceRevokeResultV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
+import type { WalletRevokeAuthMethodResponse } from '../../../../core/registrationContracts';
+import type { WalletAuthMethodId, WalletAuthorityId, WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
+import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+type ReplayScope = {
+    readonly namespace: string;
+    readonly orgId: string;
+    readonly projectId: string;
+    readonly envId: string;
+};
+/** The operation and the proof one revocation request presents. */
+export type WalletAuthMethodRevocationReplayIdentityV1 = {
+    readonly walletId: WalletId;
+    readonly targetWalletAuthMethodId: WalletAuthMethodId;
+    readonly operationFingerprintDigestB64u: string;
+    readonly sourceProofDigestB64u: string;
+};
+/**
+ * A digest of the proof a revocation request presents. The recorded answer
+ * is bound to it, so no proof, and no one-time code, is kept.
+ */
+export declare function computeWalletAuthMethodRevocationProofDigestV1(proof: WalletAuthMethodRevocationProof): Promise<string>;
+/**
+ * Each auth-method revocation's committed answer, in the signer database. The
+ * row is inserted in the batch that revokes the method, and never changes.
+ */
+export declare class D1WalletAuthMethodRevocationReplayStoreV1 {
+    private readonly database;
+    private readonly scope;
+    constructor(input: {
+        readonly database: D1DatabaseLike;
+        readonly scope: ReplayScope;
+    });
+    /**
+     * The committed answer to exactly this request: the same operation, proven
+     * by the same proof. Null for a method no revocation committed, or one a
+     * different request revoked.
+     */
+    readExactAnswerV1(identity: WalletAuthMethodRevocationReplayIdentityV1): Promise<WalletRevokeAuthMethodResponse | null>;
+    /** The committed answer to exactly this linked-device revocation request. */
+    readExactLinkedDeviceAnswerV1(identity: WalletAuthMethodRevocationReplayIdentityV1): Promise<LinkedDeviceRevokeResultV1 | null>;
+    private readExactAnswerJson;
+    /**
+     * The statements that record `response` as the answer to this request, for
+     * the batch that revokes the method. They abort the batch unless they
+     * insert it: a method whose revocation already committed commits nothing
+     * more.
+     */
+    prepareRecordAnswerStatements(input: {
+        readonly identity: WalletAuthMethodRevocationReplayIdentityV1;
+        readonly sourceWalletAuthMethodId: WalletAuthMethodId;
+        readonly response: WalletRevokeAuthMethodResponse;
+        readonly committedAtMs: number;
+    }): readonly D1PreparedStatementLike[];
+    /**
+     * The statements that record a linked-device revocation's answer, for the
+     * end of the batch that revokes the device's method. The answer names the
+     * device's authority and its revocation epoch, which the batch itself sets,
+     * so the statement reads them from the row the batch wrote: the record is
+     * the answer that committed. They abort the batch unless they insert it.
+     */
+    prepareRecordLinkedDeviceAnswerStatements(input: {
+        readonly identity: WalletAuthMethodRevocationReplayIdentityV1;
+        readonly sourceWalletAuthMethodId: WalletAuthMethodId;
+        readonly authorityId: WalletAuthorityId;
+        readonly committedAtMs: number;
+    }): readonly D1PreparedStatementLike[];
+}
+export {};
+//# sourceMappingURL=d1WalletAuthMethodRevocationReplayStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthMethodService.d.ts

@@ -1,10 +1,12 @@
 import { type WebAuthnCredentialIdB64u, type WebAuthnRpId, type WalletAuthMethodId, type WalletAuthorityId } from '../../../../../../shared-ts/src/utils/domainIds';
-import { type AddAuthMethodIntentGrant, type AddAuthMethodIntentV1, type AddSignerIntentV1, type RegistrationAuthority, type RegistrationIntentV1, type WalletId, type WalletAuthMethodRevocationProof, type WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import { type AddAuthMethodIntentGrant, type AddAuthMethodIntentV1, type AddSignerIntentV1, type RegistrationIntentV1, type WalletId } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import { type ActivePasskeyWalletAuthMethodRecordV2, type ActiveWalletAuthMethodRecordV2, type WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
+import { type RegistrationAuthority } from '../../../../../../shared-ts/src/utils/registrationAuthMethodInput';
 import { type EmailOtpWalletAuthAuthority, type PasskeyWalletAuthAuthority, type WalletAuthAuthorityRef } from '../../../../../../shared-ts/src/utils/walletAuthAuthority';
 import type { D1PreparedStatementLike } from '../../../../storage/tenantRoute';
 import type { D1WalletAuthMethodStore } from '../../../../core/d1WalletAuthMethodStore';
 import type { StoredWalletAddAuthMethodCeremony } from '../../../../core/RegistrationCeremonyStore';
-import type { WalletAddAuthMethodFinalizeResponse, WalletAddAuthMethodStartRequest, WalletAddAuthMethodStartResponse, WalletAddSignerStartRequest, WalletRegistrationAuthorityInput, WalletRevokeAuthMethodResponse } from '../../../../core/registrationContracts';
+import type { WalletAddAuthMethodFinalizeResponse, WalletAddAuthMethodStartRequest, WalletAddAuthMethodStartResponse, WalletAddSignerStartRequest, WalletRegistrationAuthorityInput } from '../../../../core/registrationContracts';
 import { EMAIL_OTP_CHANNEL } from '../../../../../../shared-ts/src/utils/emailOtpDomain';
 import { CloudflareD1EmailOtpChallengeVerifier } from '../emailOtp/d1EmailOtpChallengeVerifier';
 import type { CloudflareD1EmailOtpRegistrationEnrollmentFinalizer } from '../emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer';
@@ -20,13 +22,12 @@ import type { CloudflareD1PasskeyCustodyEnvelopeStore } from '../passkeyCustody/
 import type { D1WalletAuthorityStore } from './d1WalletAuthorityStore';
 import type { ActiveWalletAuthorityV1 } from '../../../../../../shared-ts/src/authorization/walletAuthority';
 import { type WalletExecutionLaneAuthSource } from '../../../../core/signingLanes/WalletExecutionLaneProjection';
-import type { ActiveWalletSessionAuthorityResolution, FinalizeWalletAddAuthMethodCommand, RevokeWalletAuthMethodCommand, StartWalletAddAuthMethodCommand, WalletAuthMethodRevokeProofVerificationResult, WalletUnlockEmailOtpAuthorityResolution, WalletUnlockPasskeyAuthorityResolution } from '../../../framework/authServicePort';
+import type { ActiveWalletSessionAuthorityResolution, FinalizeWalletAddAuthMethodCommand, RevokeWalletAuthMethodWithFreshProofCommand, RevokeWalletAuthMethodWithFreshProofResult, StartWalletAddAuthMethodCommand, WalletUnlockEmailOtpAuthorityResolution, WalletUnlockPasskeyAuthorityResolution } from '../../../framework/authServicePort';
+import { type D1WalletAuthMethodRevocationReplayStoreV1 } from './d1WalletAuthMethodRevocationReplayStore';
 type StartWalletAddAuthMethodInput = StartWalletAddAuthMethodCommand;
 type StartWalletAddAuthMethodResult = WalletAddAuthMethodStartResponse;
 type FinalizeWalletAddAuthMethodInput = FinalizeWalletAddAuthMethodCommand;
 type FinalizeWalletAddAuthMethodResult = WalletAddAuthMethodFinalizeResponse;
-type RevokeWalletAuthMethodInput = RevokeWalletAuthMethodCommand;
-type RevokeWalletAuthMethodResult = WalletRevokeAuthMethodResponse;
 type OwnerWalletSessionRevocationStatementsV1 = (input: {
     readonly walletId: WalletId;
     readonly walletAuthMethodId: WalletAuthMethodId;
@@ -107,6 +108,7 @@ export declare class CloudflareD1WalletAuthMethodService {
     private readonly orgId;
     private readonly verifyWebAuthnAuthenticationLite;
     private readonly prepareOwnerWalletSessionRevocation;
+    private readonly revocationReplays;
     constructor(input: {
         readonly emailOtpChallengeVerifier: CloudflareD1EmailOtpChallengeVerifier;
         readonly emailOtpEnrollmentChallengeIssuer: EmailOtpEnrollmentChallengeIssuerV1;
@@ -123,6 +125,7 @@ export declare class CloudflareD1WalletAuthMethodService {
         readonly orgId: string;
         readonly verifyWebAuthnAuthenticationLite: D1FreshRevokeWebAuthnVerifierV1;
         readonly prepareOwnerWalletSessionRevocation: OwnerWalletSessionRevocationStatementsV1;
+        readonly revocationReplays: D1WalletAuthMethodRevocationReplayStoreV1;
     });
     /**
      * Sends the enrollment code for an Email OTP addition.
@@ -266,16 +269,15 @@ export declare class CloudflareD1WalletAuthMethodService {
     verifyActivePasskeyAuthority(authority: PasskeyWalletAuthAuthority): Promise<{
         readonly ok: true;
         readonly authority: ActiveWalletAuthorityV1;
-        readonly authMethod: Extract<WalletAuthMethodRecordV2, {
-            readonly kind: 'passkey';
-            readonly status: 'active';
-        }>;
+        readonly authMethod: ActivePasskeyWalletAuthMethodRecordV2;
     } | WalletAuthMethodError>;
     resolveActiveWalletSessionAuthority(input: {
         readonly walletId: WalletId;
         readonly authorityRef: WalletAuthAuthorityRef;
         readonly authSource: WalletExecutionLaneAuthSource;
     }): Promise<ActiveWalletSessionAuthorityResolution>;
+    /** Commits an added signer onto its owner's authority. */
+    extendActiveWalletAuthority(input: Parameters<D1WalletAuthorityStore['extendActiveAuthority']>[0]): Promise<void>;
     resolveActivePasskeyAuthorityForVerifiedCredential(input: {
         readonly walletId: WalletId;
         readonly rpId: WebAuthnRpId;
@@ -284,10 +286,7 @@ export declare class CloudflareD1WalletAuthMethodService {
         readonly ok: true;
         readonly authority: PasskeyWalletAuthAuthority;
         readonly walletAuthority: ActiveWalletAuthorityV1;
-        readonly authMethod: Extract<WalletAuthMethodRecordV2, {
-            readonly kind: 'passkey';
-            readonly status: 'active';
-        }>;
+        readonly authMethod: ActivePasskeyWalletAuthMethodRecordV2;
     } | WalletAuthMethodError>;
     resolveActivePasskeyAuthorityForUnlock(input: {
         readonly walletId: WalletId;
@@ -336,23 +335,34 @@ export declare class CloudflareD1WalletAuthMethodService {
         readonly walletAuthorityId: WalletAuthMethodRecordV2['walletAuthorityId'];
         readonly walletAuthMethodId: WalletAuthMethodRecordV2['walletAuthMethodId'];
         readonly authority: ActiveWalletAuthorityV1;
-        readonly authMethod: Extract<WalletAuthMethodRecordV2, {
-            readonly status: 'active';
-        }>;
+        readonly authMethod: ActiveWalletAuthMethodRecordV2;
     } | null>;
     readActiveRegistrationAuthority(authority: RegistrationAuthority): Promise<{
         readonly authority: ActiveWalletAuthorityV1;
         readonly walletAuthMethodId: WalletAuthMethodId;
     } | null>;
-    verifyWalletAuthMethodRevokeProof(input: {
-        readonly walletId: WalletId;
-        readonly targetWalletAuthMethodId: WalletAuthMethodId;
-        readonly requestedAtMs: number;
-        readonly sourceProof: WalletAuthMethodRevocationProof;
-        readonly expectedOrigin: string;
-    }): Promise<WalletAuthMethodRevokeProofVerificationResult>;
+    /**
+     * Verifies a revocation's source proof: bound to this operation, and from a
+     * different active method on an active full-owner authority. An Email OTP
+     * proof's challenge is left unspent here. The result carries the statements
+     * that spend it, which commit only with the revocation.
+     */
+    private verifyFreshRevokeProof;
     private createPasskeyRegistrationOptions;
-    revokeWalletAuthMethod(input: RevokeWalletAuthMethodInput): Promise<RevokeWalletAuthMethodResult>;
+    /**
+     * Revokes one wallet auth method on a fresh proof from a different active
+     * full-owner method.
+     *
+     * The proof is spent, the method revoked and the answer recorded in one
+     * batch. The record binds the answer to the operation fingerprint and to a
+     * digest of the proof, never the proof or its code. An exact retry is
+     * answered from the record before its proof is examined again, so a request
+     * whose answer was lost receives what committed although its code is spent.
+     * A batch that does not commit spends nothing, so the same request can run
+     * again.
+     */
+    revokeWalletAuthMethodWithFreshProof(input: RevokeWalletAuthMethodWithFreshProofCommand): Promise<RevokeWalletAuthMethodWithFreshProofResult>;
+    private revokeWithVerifiedProof;
     private verifyRegistrationCredentialForIntent;
     private verifyRegistrationPasskeyAuthority;
     private verifyRegistrationEmailOtpAuthority;

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthorityStore.d.ts

@@ -1,28 +1,29 @@
 import { type ActiveWalletAuthorityV1, type PendingWalletAuthorityV1, type WalletAuthorityV1 } from '../../../../../../shared-ts/src/authorization/walletAuthority';
 import { type DeviceId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
 import { type WalletAuthorityId, type WalletAuthMethodId, type WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
-import { type WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import { type ActiveWalletAuthMethodRecordV2, type RevokedWalletAuthMethodRecordV2, type WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
 import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import { type WalletSignerRecord } from '../../../../core/d1WalletStore';
 export type D1WalletAuthorityStoreScope = {
     readonly namespace: string;
     readonly orgId: string;
     readonly projectId: string;
     readonly envId: string;
 };
-export type WalletAuthorityPageCursorV1 = {
+type WalletAuthorityPageCursorV1 = {
     readonly updatedAtMs: number;
     readonly authorityId: WalletAuthorityId;
 };
-export type WalletAuthorityPageV1 = {
+type WalletAuthorityPageV1 = {
     readonly records: readonly WalletAuthorityV1[];
     readonly nextCursor: WalletAuthorityPageCursorV1 | null;
 };
-export type CommittedWalletAuthorityV1 = {
+type CommittedWalletAuthorityV1 = {
     readonly kind: 'committed_wallet_authority_v1';
     readonly authority: PendingWalletAuthorityV1;
     readonly authMethod: WalletAuthMethodRecordV2;
 };
-export type WalletAuthorityCommitResultV1 = CommittedWalletAuthorityV1 | {
+type WalletAuthorityCommitResultV1 = CommittedWalletAuthorityV1 | {
     readonly kind: 'replayed';
     readonly authority: PendingWalletAuthorityV1;
     readonly authMethod: WalletAuthMethodRecordV2;
@@ -30,34 +31,27 @@ export type WalletAuthorityCommitResultV1 = CommittedWalletAuthorityV1 | {
     readonly kind: 'conflict';
     readonly authorityId: WalletAuthorityId;
 };
-export type WalletAuthorityActivationResultV1 = {
+type WalletAuthorityActivationResultV1 = {
     readonly kind: 'activated';
     readonly authority: ActiveWalletAuthorityV1;
-    readonly authMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly status: 'active';
-    }>;
+    readonly authMethod: ActiveWalletAuthMethodRecordV2;
 } | {
     readonly kind: 'replayed';
     readonly authority: ActiveWalletAuthorityV1;
-    readonly authMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly status: 'active';
-    }>;
+    readonly authMethod: ActiveWalletAuthMethodRecordV2;
 } | {
     readonly kind: 'conflict';
     readonly authorityId: WalletAuthorityId;
 };
-export type WalletAuthorityRevocationResultV1 = {
+type WalletAuthorityRevocationResultV1 = {
     readonly kind: 'revoked_method';
-    readonly authMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly status: 'revoked';
-    }>;
+    readonly authMethod: RevokedWalletAuthMethodRecordV2;
     readonly authority: WalletAuthorityV1;
 } | {
     readonly kind: 'would_remove_last_wallet_auth_method';
 } | {
     readonly kind: 'conflict';
 };
-export declare const WALLET_AUTHORITY_STORE_D1_SCHEMA_SQL: readonly ["\n    CREATE TABLE IF NOT EXISTS wallet_authorities (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      authority_id TEXT NOT NULL,\n      wallet_id TEXT NOT NULL,\n      device_id TEXT NOT NULL,\n      provenance_kind TEXT NOT NULL,\n      enrollment_id TEXT,\n      source_authority_id TEXT,\n      link_session_id TEXT,\n      recovery_operation_id TEXT,\n      continuity_authority_id TEXT,\n      lifecycle_state TEXT NOT NULL,\n      permissions_json TEXT NOT NULL,\n      signer_activations_json TEXT NOT NULL,\n      local_install_package_set_digest_b64u TEXT,\n      signer_activation_set_digest_b64u TEXT NOT NULL,\n      authority_digest_b64u TEXT NOT NULL,\n      revocation_epoch INTEGER NOT NULL,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      updated_at_ms INTEGER NOT NULL,\n      activated_at_ms INTEGER,\n      revoked_at_ms INTEGER,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, authority_id),\n      CHECK (length(authority_id) > 0),\n      CHECK (length(wallet_id) > 0),\n      CHECK (length(device_id) > 0),\n      CHECK (provenance_kind IN ('wallet_registration', 'device_link', 'wallet_recovery')),\n      CHECK (lifecycle_state IN ('pending_local_install', 'active', 'revoked')),\n      CHECK (length(permissions_json) > 0 AND json_valid(permissions_json)),\n      CHECK (length(signer_activations_json) > 0 AND json_valid(signer_activations_json)),\n      CHECK (length(record_json) > 0 AND json_valid(record_json)),\n      CHECK (length(signer_activation_set_digest_b64u) > 0),\n      CHECK (length(authority_digest_b64u) > 0),\n      CHECK (revocation_epoch >= 0),\n      CHECK (created_at_ms >= 0),\n      CHECK (updated_at_ms >= created_at_ms),\n      CHECK (\n        (provenance_kind = 'wallet_registration'\n          AND enrollment_id IS NULL\n          AND source_authority_id IS NULL\n          AND link_session_id IS NULL\n          AND recovery_operation_id IS NULL\n          AND continuity_authority_id IS NULL)\n        OR\n        (provenance_kind = 'device_link'\n          AND enrollment_id IS NOT NULL AND length(enrollment_id) > 0\n          AND source_authority_id IS NOT NULL AND length(source_authority_id) > 0\n          AND link_session_id IS NOT NULL AND length(link_session_id) > 0\n          AND recovery_operation_id IS NULL\n          AND continuity_authority_id IS NULL)\n        OR\n        (provenance_kind = 'wallet_recovery'\n          AND enrollment_id IS NULL\n          AND source_authority_id IS NULL\n          AND link_session_id IS NULL\n          AND recovery_operation_id IS NOT NULL\n          AND length(recovery_operation_id) > 0\n          AND continuity_authority_id IS NOT NULL\n          AND length(continuity_authority_id) > 0)\n      ),\n      CHECK (\n        (lifecycle_state = 'pending_local_install'\n          AND local_install_package_set_digest_b64u IS NOT NULL\n          AND length(local_install_package_set_digest_b64u) > 0\n          AND activated_at_ms IS NULL\n          AND revoked_at_ms IS NULL\n          AND revocation_epoch = 0)\n        OR\n        (lifecycle_state = 'active'\n          AND local_install_package_set_digest_b64u IS NULL\n          AND activated_at_ms IS NOT NULL\n          AND revoked_at_ms IS NULL)\n        OR\n        (lifecycle_state = 'revoked'\n          AND local_install_package_set_digest_b64u IS NULL\n          AND activated_at_ms IS NOT NULL\n          AND revoked_at_ms IS NOT NULL)\n      ),\n      CHECK (json_extract(record_json, '$.authorityId') = authority_id),\n      CHECK (json_extract(record_json, '$.walletId') = wallet_id),\n      CHECK (json_extract(record_json, '$.state') = lifecycle_state),\n      CHECK (json_extract(record_json, '$.revocationEpoch') = revocation_epoch),\n      CHECK (json_extract(record_json, '$.authorityDigestB64u') = authority_digest_b64u),\n      CHECK (\n        json_extract(record_json, '$.signerActivationSetDigestB64u')\n          = signer_activation_set_digest_b64u\n      )\n    )\n  ", "\n    CREATE UNIQUE INDEX IF NOT EXISTS wallet_authorities_active_device_uidx\n      ON wallet_authorities (\n        namespace, org_id, project_id, env_id, wallet_id, device_id\n      )\n      WHERE lifecycle_state <> 'revoked'\n  ", "\n    CREATE UNIQUE INDEX IF NOT EXISTS wallet_authorities_enrollment_uidx\n      ON wallet_authorities (\n        namespace, org_id, project_id, env_id, wallet_id, enrollment_id\n      )\n      WHERE enrollment_id IS NOT NULL\n  ", "\n    CREATE INDEX IF NOT EXISTS wallet_authorities_inventory_idx\n      ON wallet_authorities (\n        namespace, org_id, project_id, env_id, wallet_id, lifecycle_state,\n        updated_at_ms, authority_id\n      )\n  ", "\n    CREATE TABLE IF NOT EXISTS wallet_authority_cas_guard (\n      guard_id INTEGER PRIMARY KEY CHECK (guard_id = 1)\n    )\n  ", "\n    INSERT OR IGNORE INTO wallet_authority_cas_guard (guard_id) VALUES (1)\n  "];
 type AuthorityRow = {
     readonly authority_id?: unknown;
     readonly wallet_id?: unknown;
@@ -87,6 +81,19 @@ export declare function prepareD1WalletAuthorityPutStatement(input: {
     readonly scope: D1WalletAuthorityStoreScope;
     readonly authority: WalletAuthorityV1;
 }): D1PreparedStatementLike;
+/**
+ * Replaces one active authority with its extension, only if the stored row is
+ * still exactly `expected`. Pair it with the CAS guard so a lost race aborts
+ * the whole batch.
+ */
+export declare function prepareD1WalletAuthorityExtensionStatement(input: {
+    readonly database: D1DatabaseLike;
+    readonly scope: D1WalletAuthorityStoreScope;
+    readonly expected: ActiveWalletAuthorityV1;
+    readonly next: ActiveWalletAuthorityV1;
+}): D1PreparedStatementLike;
+/** Aborts the batch when the preceding authority extension changed no row. */
+export declare function prepareD1WalletAuthorityExtensionCasGuard(database: D1DatabaseLike): D1PreparedStatementLike;
 export declare class WalletAuthorityCommitConflictError extends Error {
     readonly kind = "wallet_authority_commit_conflict";
     constructor(authorityId: WalletAuthorityId);
@@ -106,6 +113,19 @@ export declare class D1WalletAuthorityStore {
         readonly ensureSchema?: boolean;
     });
     private ensureSchema;
+    /**
+     * Commits an added signer: its signer records, the authority extended with
+     * its activation, and every live Wallet Session of that authority promoted to
+     * the extended authority, all at once. Each session keeps its identity,
+     * quota and operation-credential hash; promotion retires its hosted
+     * credentials and deletes its unredeemed hosted exchange codes.
+     */
+    extendActiveAuthority(input: {
+        readonly expected: ActiveWalletAuthorityV1;
+        readonly next: ActiveWalletAuthorityV1;
+        readonly walletSigners: readonly WalletSignerRecord[];
+        readonly promotionAtMs: number;
+    }): Promise<void>;
     readById(authorityId: WalletAuthorityId): Promise<WalletAuthorityV1 | null>;
     readByWalletAndDevice(input: {
         readonly walletId: WalletId;
@@ -128,9 +148,7 @@ export declare class D1WalletAuthorityStore {
         readonly pendingAuthority: PendingWalletAuthorityV1;
         readonly activeAuthority: ActiveWalletAuthorityV1;
         readonly pendingAuthMethod: WalletAuthMethodRecordV2;
-        readonly activeAuthMethod: Extract<WalletAuthMethodRecordV2, {
-            readonly status: 'active';
-        }>;
+        readonly activeAuthMethod: ActiveWalletAuthMethodRecordV2;
     }): Promise<WalletAuthorityActivationResultV1>;
     /**
      * Activates authority records together with caller-owned D1 statements.
@@ -141,9 +159,7 @@ export declare class D1WalletAuthorityStore {
         readonly pendingAuthority: PendingWalletAuthorityV1;
         readonly activeAuthority: ActiveWalletAuthorityV1;
         readonly pendingAuthMethod: WalletAuthMethodRecordV2;
-        readonly activeAuthMethod: Extract<WalletAuthMethodRecordV2, {
-            readonly status: 'active';
-        }>;
+        readonly activeAuthMethod: ActiveWalletAuthMethodRecordV2;
     }, additionalStatements: readonly D1PreparedStatementLike[]): Promise<WalletAuthorityActivationResultV1>;
     listForWallet(input: {
         readonly walletId: WalletId;
@@ -158,11 +174,13 @@ export declare class D1WalletAuthorityStore {
         readonly expectedAuthorityRevocationEpoch: number;
         readonly requestedAtMs: number;
         readonly sessionRevocationStatements?: readonly D1PreparedStatementLike[];
+        /**
+         * Run last, after the method and its authority are written, so they can
+         * read what the revocation wrote. They commit with it or not at all.
+         */
+        readonly trailingStatements?: readonly D1PreparedStatementLike[];
     }): Promise<WalletAuthorityRevocationResultV1>;
     private readAuthMethodById;
 }
-export declare class D1WalletAuthorityStoreV1 extends D1WalletAuthorityStore {
-}
-export type CloudflareD1WalletAuthorityStore = D1WalletAuthorityStore;
 export {};
 //# sourceMappingURL=d1WalletAuthorityStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/webauthn/d1WebAuthnRecords.d.ts

@@ -2,7 +2,7 @@ import { type PasskeyEnvelopeId, type WalletAuthorityId, type WalletAuthMethodId
 import { type DeviceId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
 import { type ActiveWalletAuthorityV1 } from '../../../../../../shared-ts/src/authorization/walletAuthority';
 import { type EnvelopeRevision, type PasskeyCustodyEnvelopeRecord } from '../../../../../../shared-ts/src/passkey-custody';
-import { type WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import { type ActiveWalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
 import { type RecoveryCodeReservationId } from '../../../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation';
 import { type WebAuthnAuthenticatorDeviceInfo } from '../../../../../../shared-ts/src/utils/webauthnDeviceInfo';
 import type { WebAuthnCredentialBindingRecord as CoreWebAuthnCredentialBindingRecord } from '../../../../core/WebAuthnCredentialBindingStore';
@@ -76,9 +76,7 @@ export type WebAuthnSyncChallengeRecord = {
 export type WebAuthnRecoveryContinuityAnchorRecord = {
     readonly kind: 'wallet_recovery_continuity_anchor_v1';
     readonly authority: ActiveWalletAuthorityV1;
-    readonly method: Extract<WalletAuthMethodRecordV2, {
-        readonly status: 'active';
-    }>;
+    readonly method: ActiveWalletAuthMethodRecordV2;
     readonly envelope: WebAuthnRecoveryContinuityEnvelopeAnchorRecord;
 };
 export type WebAuthnRecoveryContinuityEnvelopeAnchorRecord = {
@@ -123,9 +121,7 @@ export declare function parseWebAuthnSyncChallengeRecord(input: unknown): WebAut
 export declare function parseWebAuthnRecoveryRegistrationChallengeRecord(input: unknown): WebAuthnRecoveryRegistrationChallengeRecord | null;
 export declare function buildWebAuthnRecoveryContinuityAnchorRecord(input: {
     readonly authority: ActiveWalletAuthorityV1;
-    readonly method: Extract<WalletAuthMethodRecordV2, {
-        readonly status: 'active';
-    }>;
+    readonly method: ActiveWalletAuthMethodRecordV2;
     readonly envelope: PasskeyCustodyEnvelopeRecord;
 }): WebAuthnRecoveryContinuityAnchorRecord;
 export declare function parseWebAuthnAuthenticator(row: D1AuthenticatorRow | null): WebAuthnAuthenticatorRecord | null;

package/dist/types/wallet-server/src/router/cloudflare/d1/webauthn/d1WebAuthnStore.d.ts

@@ -1,34 +1,23 @@
 import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import { type D1TenantScope } from '../../../../core/d1TenantStore';
 import { type WebAuthnCredentialBindingRecord } from '../../../../core/WebAuthnCredentialBindingStore';
 import { type D1AuthenticatorRow, type WebAuthnAuthenticatorRecord, type WebAuthnRecoveryRegistrationChallengeRecord, type WebAuthnLoginChallengeRecord, type WebAuthnSyncChallengeRecord } from './d1WebAuthnRecords';
 type WebAuthnChallengeKind = 'login' | 'sync' | 'recovery_registration';
-export type D1WebAuthnStoreScope = {
-    readonly namespace: string;
-    readonly orgId: string;
-    readonly projectId: string;
-    readonly envId: string;
-};
-export declare function prepareD1WebAuthnAuthenticatorPutStatement(input: {
+export type D1WebAuthnStoreScope = D1TenantScope;
+type AuthenticatorStatementInput = {
     readonly database: D1DatabaseLike;
     readonly scope: D1WebAuthnStoreScope;
     readonly userId: string;
     readonly record: WebAuthnAuthenticatorRecord;
-}): D1PreparedStatementLike;
+};
+export declare function prepareD1WebAuthnAuthenticatorPutStatement(input: AuthenticatorStatementInput): D1PreparedStatementLike;
 /** Insert-only variant used by recovery promotion. A credential collision must
  * abort the surrounding envelope/code transaction instead of reassigning an
  * existing authenticator's public key. */
-export declare function prepareD1WebAuthnAuthenticatorInsertStatement(input: {
-    readonly database: D1DatabaseLike;
-    readonly scope: D1WebAuthnStoreScope;
-    readonly userId: string;
-    readonly record: WebAuthnAuthenticatorRecord;
-}): D1PreparedStatementLike;
+export declare function prepareD1WebAuthnAuthenticatorInsertStatement(input: AuthenticatorStatementInput): D1PreparedStatementLike;
 export declare class CloudflareD1WebAuthnStore {
     private readonly database;
-    private readonly namespace;
-    private readonly orgId;
-    private readonly projectId;
-    private readonly envId;
+    private readonly scope;
     constructor(input: {
         readonly database: D1DatabaseLike;
         readonly namespace: string;
@@ -83,7 +72,7 @@ export declare class CloudflareD1WebAuthnStore {
         readonly rpId?: string;
     }): Promise<WebAuthnCredentialBindingRecord[]>;
     private consumeChallenge;
-    private prepare;
+    private readonly prepare;
 }
 export {};
 //# sourceMappingURL=d1WebAuthnStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/runtime/walletConsoleTenantRootLineage.d.ts

@@ -1,7 +1,8 @@
 import type { RouterApiProjectEnvironmentResolver } from '../../framework/apiCredentialPorts';
 import { type RuntimePolicyScope } from '../../../../../shared-ts/src/threshold/signingRootScope';
+import type { TenantRootRuntimeActiveLineageV1 } from '../../domains/tenantRoot/tenantRootCustodyLineage';
 import type { WalletConsoleTenantRootActiveLineageResolverV1 } from './walletConsoleOps';
 export declare function resolveRuntimeTenantRootLineage(environments: RouterApiProjectEnvironmentResolver, roots: WalletConsoleTenantRootActiveLineageResolverV1, scope: RuntimePolicyScope & {
     readonly signingRootId: string;
-}): Promise<import("./walletConsoleOps").WalletConsoleTenantRootActiveLineageV1 | null>;
+}): Promise<TenantRootRuntimeActiveLineageV1 | null>;
 //# sourceMappingURL=walletConsoleTenantRootLineage.d.ts.map