@seams/wallet-server 0.6.2 → 0.7.1

package/dist/types/wallet-server/src/router/cloudflare/runtime/walletGateway.d.ts

@@ -23,6 +23,7 @@ export interface CloudflareWalletGatewayRouterOptionsV1 {
     readonly walletConsole: WalletConsoleServiceBinding;
     readonly signerDatabase: CloudflareD1RouterAbNormalSigningAdmissionStoreOptions['database'];
     readonly signerStorageNamespace: string;
+    readonly routeExtensions?: readonly RouterApiRouteExtension[];
     readonly router: Omit<RouterApiOptions, WalletGatewayManagedRouterOption>;
 }
 export declare function createCloudflareWalletGatewayRouterV1(input: CloudflareWalletGatewayRouterOptionsV1): FetchHandler;

package/dist/types/wallet-server/src/router/cloudflare/signingLanes/cloudflareOrdinaryInactiveSignerMaterialReservation.d.ts

@@ -2,7 +2,7 @@ import { type OrdinaryEcdsaSignerMaterialReservationRequestV1, type OrdinaryEcds
 import { type LinkedDeviceEd25519SourceContributionPreparationV1 } from '../../../../../shared-ts/src/device-linking/sourceContribution';
 import type { DeviceLinkingEd25519SourcePreservingRouterPortV1 } from '../../transport/fetch/routes/deviceLinking';
 import type { OrdinaryInactiveSignerMaterialActivationPortV1 } from '../d1/deviceLinking/d1LinkedDeviceAuthorityInstallService';
-import type { TenantRootActiveLineageV1 } from '../../domains/tenantRoot/tenantRootCustodyLineage';
+import { type RouterAbEd25519YaoResolvedTenantRootV1 } from '../../domains/ed25519Yao/routerAbEd25519YaoGatewayEnvelope';
 import type { OrdinaryEcdsaSignerMaterialReservationPreparationV1, OrdinaryEd25519SignerMaterialReservationPreparationV1 } from '../../../core/signingMaterial/ordinaryInactiveSignerMaterialReservation';
 /** Source-preserving ordinary material paths implemented by the Cloudflare workers. */
 export declare const CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1: "/router-ab/router/ed25519-yao/execute-source-preserving";
@@ -11,6 +11,16 @@ export declare const CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_
 export declare const CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1: "/router-ab/signing-worker/ecdsa-derivation/activate-reservation";
 export declare const CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1: "/router-ab/signing-worker/ed25519-yao/deactivate-reservation";
 export declare const CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1: "/router-ab/signing-worker/ecdsa-derivation/deactivate-reservation";
+/**
+ * The tenant this Gateway serves. With one of its wallets it names the
+ * SigningWorker wallet object that holds that wallet's material, and the
+ * SigningWorker checks the wallet against the source activation it holds.
+ */
+export type CloudflareSigningWorkerTenantV1 = {
+    readonly orgId: string;
+    readonly projectId: string;
+    readonly envId: string;
+};
 /**
  * Boundary for the dedicated ordinary reservation operation. Its response is
  * deliberately unknown until the core reservation parser has checked the
@@ -26,7 +36,7 @@ export type CloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1 = Devi
 export declare function createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1(input: {
     readonly fetch: typeof fetch;
     readonly internalServiceAuthSecret: string;
-    readonly resolveTenantRoot: (context: Pick<LinkedDeviceEd25519SourceContributionPreparationV1, 'applicationBinding' | 'targetAdmission' | 'participantIds'>) => Promise<TenantRootActiveLineageV1>;
+    readonly resolveTenantRoot: (context: Pick<LinkedDeviceEd25519SourceContributionPreparationV1, 'applicationBinding' | 'targetAdmission' | 'participantIds'>) => Promise<RouterAbEd25519YaoResolvedTenantRootV1>;
 }): CloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1;
 export type CloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1 = {
     activateInactiveEd25519SignerMaterialV1(input: {
@@ -49,14 +59,17 @@ export type CloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1 = {
 export declare function createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1(input: {
     readonly fetch: typeof fetch;
     readonly internalServiceAuthSecret: string;
+    readonly tenant: CloudflareSigningWorkerTenantV1;
 }): CloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1;
 export declare function createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1(input: {
     readonly fetch: typeof fetch;
     readonly internalServiceAuthSecret: string;
+    readonly tenant: CloudflareSigningWorkerTenantV1;
 }): CloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1;
 export declare function createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1(input: {
     readonly fetch: typeof fetch;
     readonly internalServiceAuthSecret: string;
+    readonly tenant: CloudflareSigningWorkerTenantV1;
 }): CloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1;
 /**
  * Adapter for the ordinary inactive reservation endpoint. The endpoint owns

package/dist/types/wallet-server/src/router/cloudflare-adaptor.d.ts

@@ -1,9 +1,9 @@
 export type { RouterApiKeyAuthAdapter, RouterApiKeyAuthFailureCode, RouterApiKeyAuthRequest, RouterApiKeyAuthResult, RouterApiKeyPrincipal, RouterApiOptions, RouterApiPublishableKeyAuthAdapter, RouterApiPublishableKeyAuthFailureCode, RouterApiPublishableKeyAuthRequest, RouterApiPublishableKeyAuthResult, RouterApiRuntimePolicyScope, RouterApiRuntimeSnapshotConsumer, RouterApiRuntimeSnapshotEnvelope, RouterApiUsageMeterAction, RouterApiUsageMeterAdapter, RouterApiUsageMeterEvent, } from './framework/routerApi';
 export { ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, parseRouterAbPublicKeysetV2, } from '../../../shared-ts/src/utils/routerAbPublicKeyset';
 export type { RouterAbPublicKeysetV2 } from '../../../shared-ts/src/utils/routerAbPublicKeyset';
-export type { RouterAbNormalSigningAdmissionAdapter, RouterAbNormalSigningAdmissionFailure, RouterAbNormalSigningAdmissionFailureCode, RouterAbNormalSigningAdmissionInput, RouterAbNormalSigningAdmissionResult, } from './domains/signingOperations/routerAbPrivateSigningWorker';
+export type { RouterAbNormalSigningAdmissionAdapter, RouterAbNormalSigningAdmissionFailure, RouterAbNormalSigningAdmissionFailureCode, RouterAbNormalSigningAdmissionInput, RouterAbNormalSigningAdmissionResult, } from './domains/signingOperations/routerAbNormalSigningAdmission';
 export { InMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createRouterAbNormalSigningAdmissionAdapter, } from './domains/signingOperations/routerAbNormalSigningAdmissionCore';
-export type { RouterAbNormalSigningAbuseDecision, RouterAbNormalSigningAbuseProvider, RouterAbNormalSigningAdmissionStore, RouterAbNormalSigningProjectPolicyDecision, RouterAbNormalSigningProjectPolicyProvider, } from './domains/signingOperations/routerAbNormalSigningAdmissionCore';
+export type { RouterAbNormalSigningAbuseDecision, RouterAbNormalSigningPolicyDecision, RouterAbNormalSigningAdmissionStore, RouterAbNormalSigningProjectPolicyDecision, } from './domains/signingOperations/routerAbNormalSigningAdmissionCore';
 export { CloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1RouterAbNormalSigningAdmissionStore, } from './cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore';
 export type { CloudflareD1RouterAbNormalSigningAdmissionStoreOptions } from './cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore';
 export type { RouterApiFetchRouteExtension, RouterApiFetchRouteExtensionInput, RouterApiRouteExtension, RouterApiRouteExtensionTransport, } from './framework/routeExtensions';

package/dist/types/wallet-server/src/router/domains/ecdsa/routerAbEcdsaStrictRegistration.d.ts

@@ -66,6 +66,7 @@ export type RouterAbEcdsaRegistrationRequestPolicyV1 = {
 export type RouterAbEcdsaRegistrationTenantRootV1 = {
     readonly identityDigestB64u: string;
     readonly custodyLineageB64u: string;
+    readonly projectEnvironmentId: string;
 };
 type RouterAbRequestPolicyClaimsInputV1 = {
     readonly policyVersion: string;
@@ -75,16 +76,16 @@ type RouterAbRequestPolicyClaimsInputV1 = {
     };
 };
 /**
- * Receives the Router's raw `Server-Timing` header, when it sent one
- * (Refactor 94B Phase 0). Diagnostics only: the Router's spans never reach the
- * response body, and a caller that omits this sink changes nothing about the
- * ceremony. Called at most once per forwarded request, before the result is
- * parsed, so a failing leg still reports where its time went.
+ * Receives the Router's raw `Server-Timing` header, when it sent one.
+ * Diagnostics only: the Router's spans never reach the response body, and a
+ * caller that omits this sink changes nothing about the ceremony. Called at
+ * most once per forwarded request, before the result is parsed, so a failing
+ * leg still reports where its time went.
  */
 export type RouterAbEcdsaStrictServerTimingSink = (header: string) => void;
 /**
- * Refactor 94B Phase 0. Reports whether a role leg returned the diagnostics
- * header we expect, and nothing about what it contained.
+ * Reports whether a role leg returned the diagnostics header we expect, and
+ * nothing about what it contained.
  *
  * `Server-Timing` carries role and span names from inside the MPC topology.
  * A missing header and an empty one are different failures — the first means
@@ -149,6 +150,7 @@ export type RouterAbEcdsaCeremonyTokenClaims = {
     readonly orgId: string;
     readonly projectId: string;
     readonly environment: string;
+    readonly projectEnvironmentId: string;
     readonly accountId: string;
     readonly expiresAtMs: number;
 };

package/dist/types/wallet-server/src/router/domains/ecdsa/thresholdEcdsaRequestValidation.d.ts

@@ -1,19 +1,19 @@
 import { type RouterAbEcdsaOperationStepUpPreparationV1Wire } from '../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
 import { type RouterAbNormalSigningAuthorizationWire } from '../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
 import type { RouterAbEcdsaDerivationPoolFillInitRequest, RouterAbEcdsaDerivationPoolFillStepRequest } from '../../../core/types';
-export type ThresholdEcdsaRouteErrorBody = {
+type ThresholdEcdsaRouteErrorBody = {
     ok: false;
     code: 'invalid_body';
     message: string;
 };
-export type ThresholdEcdsaRouteParseResult<T> = {
+type ThresholdEcdsaRouteParseResult<T> = {
     ok: true;
     request: T;
 } | {
     ok: false;
     body: ThresholdEcdsaRouteErrorBody;
 };
-export type RouterAbEcdsaPoolFillAuthorization = {
+type RouterAbEcdsaPoolFillAuthorization = {
     readonly authorization: Extract<RouterAbNormalSigningAuthorizationWire, {
         readonly kind: 'reusable_wallet_session';
     }>;
@@ -28,5 +28,5 @@ export type RouterAbEcdsaPoolFillInitRouteRequest = RouterAbEcdsaDerivationPoolF
 export type RouterAbEcdsaPoolFillStepRouteRequest = RouterAbEcdsaDerivationPoolFillStepRequest & RouterAbEcdsaPoolFillAuthorization;
 export declare function parseRouterAbEcdsaDerivationPoolFillInitRouteRequest(raw: unknown): ThresholdEcdsaRouteParseResult<RouterAbEcdsaPoolFillInitRouteRequest>;
 export declare function parseRouterAbEcdsaDerivationPoolFillStepRouteRequest(raw: unknown): ThresholdEcdsaRouteParseResult<RouterAbEcdsaPoolFillStepRouteRequest>;
-export declare function thresholdEcdsaRouteDiagnosticMetadata(raw: unknown, fields: readonly string[]): Record<string, string | undefined>;
+export {};
 //# sourceMappingURL=thresholdEcdsaRequestValidation.d.ts.map

package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoLifecycleDecision.d.ts

@@ -0,0 +1,46 @@
+import type { WalletEd25519YaoActiveCapabilityRecord } from '../../../../core/WalletStore';
+/**
+ * How an Ed25519 Yao lifecycle was finalized. A lifecycle has at most one
+ * decision, and the decision is the linearization point of its finalization:
+ * it commits in the same batch as the writes that make the finalization
+ * visible, so the result is visible if and only if the decision exists.
+ *
+ * The Router's wallet object binds the first finalization that consumes a
+ * registration's execution. The decision records which one became visible,
+ * and nothing else records it.
+ */
+export type RouterAbEd25519YaoLifecycleDecisionKindV1 = 'registration_finalized' | 'add_signer_finalized';
+export type RouterAbEd25519YaoLifecycleDecisionV1 = {
+    readonly lifecycleId: string;
+    readonly kind: RouterAbEd25519YaoLifecycleDecisionKindV1;
+    /** Names the finalization: its consumer binding and the capability it installs. */
+    readonly decisionId: string;
+    readonly walletId: string;
+};
+/** The decision one finalization would record. */
+export declare function routerAbEd25519YaoLifecycleDecisionV1(input: {
+    readonly kind: RouterAbEd25519YaoLifecycleDecisionKindV1;
+    readonly lifecycleId: string;
+    readonly walletId: string;
+    /** The binding the Router's wallet object consumed the execution for. */
+    readonly consumerBinding: string;
+    readonly capability: WalletEd25519YaoActiveCapabilityRecord;
+}): Promise<RouterAbEd25519YaoLifecycleDecisionV1>;
+/** What a finalization finds when it looks up its lifecycle's decision. */
+type RouterAbEd25519YaoLifecycleDecisionLookupV1 = 
+/** No finalization has become visible: this one may decide. */
+{
+    readonly kind: 'undecided';
+}
+/** This finalization already became visible: its visibility writes are done. */
+ | {
+    readonly kind: 'decided';
+}
+/** Another finalization became visible for this lifecycle. */
+ | {
+    readonly kind: 'decided_otherwise';
+    readonly decision: RouterAbEd25519YaoLifecycleDecisionV1;
+};
+export declare function routerAbEd25519YaoLifecycleDecisionLookupV1(wanted: RouterAbEd25519YaoLifecycleDecisionV1, stored: RouterAbEd25519YaoLifecycleDecisionV1 | null): RouterAbEd25519YaoLifecycleDecisionLookupV1;
+export {};
+//# sourceMappingURL=routerAbEd25519YaoLifecycleDecision.d.ts.map

package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.d.ts

@@ -1,4 +1,6 @@
-import { type AddSignerIntentV1, type RegistrationNearEd25519SignerPlan, type WalletId, type RegistrationEd25519AuthorityScope } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import { type AddSignerIntentV1, type WalletId } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import { type RegistrationEd25519AuthorityScope } from '../../../../../../shared-ts/src/utils/registrationIds';
+import { type RegistrationNearEd25519SignerPlan } from '../../../../../../shared-ts/src/utils/registrationSignerPlan';
 import { type RouterAbEd25519YaoActivationAdmissionReceiptV1, type RouterAbEd25519YaoRegistrationAdmissionRequestV1 } from '../../../../../../shared-ts/src/utils/routerAbEd25519Yao';
 import { type RouterAbMpcMaterialActivationRefWire } from '../../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
 import type { RouterAbEd25519YaoActivationConsumerV1, RouterAbEd25519YaoActivationConsumptionRequestV1, RouterAbEd25519YaoActivationConsumptionResultV1, RouterAbEd25519YaoRegistrationServiceResult } from '../registration/routerAbEd25519YaoRegistration';
@@ -10,7 +12,7 @@ import type { ThresholdEd25519SessionId } from '../../../../../../shared-ts/src/
 import { type RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
 import type { WalletAuthAuthority } from '../../../../../../shared-ts/src/utils/walletAuthAuthority';
 import type { WalletSessionOperationCredentialV1 } from '../../../../../../shared-ts/src/device-linking';
-import type { WalletRegistrationEd25519YaoBootstrapSession } from '../../../../core/registrationContracts';
+import type { WalletRegistrationEd25519YaoBootstrapSession } from '../../../../../../shared-ts/src/utils/registrationContracts';
 import { InMemoryRouterAbEd25519YaoRecoveryStateV1, type RouterAbEd25519YaoActiveCapabilityLookupV1, type RouterAbEd25519YaoActiveCapabilityResolverV1, type RouterAbEd25519YaoPersistedActiveCapabilityInstallerV1, type RouterAbEd25519YaoRecoveryAuthorizationAdapter, type RouterAbEd25519YaoRecoveryService, type RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallerV1, type WarmBootstrapLinkedEd25519AuthorityReaderV1 } from '../recovery/routerAbEd25519YaoRecovery';
 import type { WalletEd25519YaoActiveCapabilityRecord } from '../../../../core/WalletStore';
 import { InMemoryRouterAbEd25519YaoExportStateV1, type RouterAbEd25519YaoExportAuthorizationAdapter, type RouterAbEd25519YaoExportService } from '../export/routerAbEd25519YaoExport';
@@ -142,7 +144,7 @@ export declare function createRouterAbEd25519YaoMaterialActivationRefV1(input: {
 }): RouterAbMpcMaterialActivationRefWire;
 /**
  * Takes the authority *scope* rather than the authority because setup admits
- * before the proof exists (Refactor 94C). Callers holding a verified authority
+ * before the proof exists. Callers holding a verified authority
  * pass `registrationEd25519AuthorityScopeFromAuthority(authority)`; setup
  * passes the scope derived from the requested auth method, and only when that
  * derivation is complete without a proof.

package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore.d.ts

@@ -1,12 +1,11 @@
-import type { VersionedJsonObject, VersionedJsonRecordPutResult, VersionedJsonRecordReadResult } from '../../../framework/versionedJsonRecordStore';
-import type { RouterAbEd25519YaoActivationConsumptionRequestV1, RouterAbEd25519YaoActivationConsumptionResultV1, RouterAbEd25519YaoRegistrationFailure } from '../registration/routerAbEd25519YaoRegistration';
-import { type RouterAbEd25519YaoRegistrationExecutionRecordV1 } from '../registration/routerAbEd25519YaoRegistrationExecutionRecord';
+import type { VersionedJsonObject, VersionedJsonRecordReadResult } from '../../../framework/versionedJsonRecordStore';
+import type { D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import { type RouterAbEd25519YaoRegistrationExecutionAuthorityV1 } from '../registration/routerAbEd25519YaoRegistrationExecutionRecord';
 import type { RouterAbEd25519YaoProductRegistrationStateV1 } from './routerAbEd25519YaoProductRegistration';
 import { type RouterAbEd25519YaoProductRegistrationCeremonyStateV1, type RouterAbEd25519YaoProductRegistrationSharedStateV1 } from './routerAbEd25519YaoProductRegistrationPartitioning';
 export declare const ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1 = "router-ab-ed25519-yao:shared";
 declare const SHARED_RECORD_KIND = "router_ab_ed25519_yao_product_registration_shared_record_v1";
 declare const CEREMONY_RECORD_KIND = "router_ab_ed25519_yao_product_registration_ceremony_record_v1";
-declare const EXECUTION_RECORD_KIND = "router_ab_ed25519_yao_registration_execution_record_v1";
 export type RouterAbEd25519YaoProductRegistrationPartitionRecordV1 = {
     readonly kind: typeof SHARED_RECORD_KIND;
     readonly value: RouterAbEd25519YaoProductRegistrationSharedStateV1;
@@ -14,10 +13,6 @@ export type RouterAbEd25519YaoProductRegistrationPartitionRecordV1 = {
     readonly kind: typeof CEREMONY_RECORD_KIND;
     readonly lifecycleId: string;
     readonly value: RouterAbEd25519YaoProductRegistrationCeremonyStateV1;
-} | {
-    readonly kind: typeof EXECUTION_RECORD_KIND;
-    readonly lifecycleId: string;
-    readonly value: RouterAbEd25519YaoRegistrationExecutionRecordV1;
 };
 export type RouterAbEd25519YaoProductRegistrationPartitionMutationV1 = {
     readonly key: string;
@@ -34,12 +29,19 @@ export type RouterAbEd25519YaoProductRegistrationPartitionBatchResultV1 = {
     readonly kind: 'version_mismatch';
     readonly key: string;
 };
+/**
+ * Writes another store prepared on the same signer database, which commit in
+ * the batch of a state commit or not at all.
+ */
+export type RouterAbEd25519YaoPreparedWriteV1 = {
+    readonly statements: readonly D1PreparedStatementLike[];
+};
 export type RouterAbEd25519YaoProductRegistrationPartitionRecordStoreV1 = {
     readonly readMany: (keys: readonly string[]) => Promise<readonly {
         readonly key: string;
         readonly result: VersionedJsonRecordReadResult<VersionedJsonObject>;
     }[]>;
-    readonly putMany: (mutations: readonly RouterAbEd25519YaoProductRegistrationPartitionMutationV1[]) => Promise<RouterAbEd25519YaoProductRegistrationPartitionBatchResultV1>;
+    readonly putMany: (mutations: readonly RouterAbEd25519YaoProductRegistrationPartitionMutationV1[], companion: RouterAbEd25519YaoPreparedWriteV1 | null) => Promise<RouterAbEd25519YaoProductRegistrationPartitionBatchResultV1>;
 };
 export type RouterAbEd25519YaoProductRegistrationPartitionedStateV1 = {
     readonly state: RouterAbEd25519YaoProductRegistrationStateV1;
@@ -47,82 +49,31 @@ export type RouterAbEd25519YaoProductRegistrationPartitionedStateV1 = {
         readonly sharedEncoding: RouterAbEd25519YaoSharedStateCanonicalEncodingV1;
         readonly sharedVersion: string | null;
         readonly ceremonyVersion: string | null;
-        readonly executionVersion: string | null;
     };
 };
 export type RouterAbEd25519YaoSharedStateCanonicalEncodingV1 = VersionedJsonObject;
 export type RouterAbEd25519YaoProductRegistrationPartitionedStateCommitInputV1 = {
     readonly lifecycleId: string;
     readonly state: RouterAbEd25519YaoProductRegistrationStateV1;
+    /** Another store's writes that commit with this state or not at all, or none. */
+    readonly companionWrite: RouterAbEd25519YaoPreparedWriteV1 | null;
     readonly baseline: {
         readonly sharedEncoding: RouterAbEd25519YaoSharedStateCanonicalEncodingV1;
         readonly sharedVersion: string | null;
         readonly ceremonyVersion: string | null;
-        readonly executionVersion: string | null;
     };
 };
 export type RouterAbEd25519YaoProductRegistrationPartitionedStateCommitResultV1 = {
     readonly kind: 'stored';
     readonly sharedVersion: string | null;
     readonly ceremonyVersion: string;
-    readonly executionVersion: string | null;
 } | {
     readonly kind: 'version_mismatch';
-    readonly key: 'shared' | 'ceremony' | 'execution';
-};
-type ExecuteRequest = Extract<RouterAbEd25519YaoRegistrationExecutionRecordV1, {
-    readonly kind: 'claimed';
-}>['request'];
-type ActivationResult = Extract<RouterAbEd25519YaoRegistrationExecutionRecordV1, {
-    readonly kind: 'completed';
-}>['result'];
-export type RouterAbEd25519YaoRegistrationExecutionClaimResultV1 = {
-    readonly kind: 'claimed';
-    readonly value: Extract<RouterAbEd25519YaoRegistrationExecutionRecordV1, {
-        readonly kind: 'claimed';
-    }>;
-    readonly version: string;
-} | {
-    readonly kind: 'completed';
-    readonly value: ActivationResult;
-} | {
-    readonly kind: 'failed';
-    readonly value: RouterAbEd25519YaoRegistrationFailure;
-} | {
-    readonly kind: 'rejected';
-    readonly code: 'unknown_registration' | 'binding_mismatch' | 'credential_rejected' | 'credential_expired' | 'execution_in_progress';
-    readonly message: string;
-};
-export type RouterAbEd25519YaoRegistrationExecutionCommitResultV1 = {
-    readonly kind: 'stored';
-    readonly value: ActivationResult | RouterAbEd25519YaoRegistrationFailure;
-} | {
-    readonly kind: 'uncertain';
+    readonly key: 'shared' | 'ceremony';
 };
 export interface RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1 {
     load(lifecycleId: string): Promise<RouterAbEd25519YaoProductRegistrationPartitionedStateV1>;
     commit(input: RouterAbEd25519YaoProductRegistrationPartitionedStateCommitInputV1): Promise<RouterAbEd25519YaoProductRegistrationPartitionedStateCommitResultV1>;
-    claimRegistrationExecution(input: {
-        readonly lifecycleId: string;
-        readonly request: ExecuteRequest;
-        readonly requestDigestSha256Hex: string;
-        readonly credentialDigestSha256Hex: string;
-        readonly nowMs: number;
-    }): Promise<RouterAbEd25519YaoRegistrationExecutionClaimResultV1>;
-    commitRegistrationExecution(input: {
-        readonly claimed: Extract<RouterAbEd25519YaoRegistrationExecutionRecordV1, {
-            readonly kind: 'claimed';
-        }>;
-        readonly claimedVersion: string;
-        readonly outcome: {
-            readonly kind: 'completed';
-            readonly result: ActivationResult;
-        } | {
-            readonly kind: 'failed';
-            readonly failure: RouterAbEd25519YaoRegistrationFailure;
-        };
-    }): Promise<RouterAbEd25519YaoRegistrationExecutionCommitResultV1>;
-    consumeRegistrationExecution(input: RouterAbEd25519YaoActivationConsumptionRequestV1): Promise<RouterAbEd25519YaoActivationConsumptionResultV1>;
 }
 export declare function routerAbEd25519YaoPartitionedStateAfterStoredCommitV1(input: {
     readonly lifecycleId: string;
@@ -131,26 +82,16 @@ export declare function routerAbEd25519YaoPartitionedStateAfterStoredCommitV1(in
         readonly kind: 'stored';
     }>;
 }): RouterAbEd25519YaoProductRegistrationPartitionedStateV1;
-export declare function createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1(store: RouterAbEd25519YaoProductRegistrationPartitionRecordStoreV1, atomicPatch?: AtomicPatch): RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1;
+export declare function createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1(store: RouterAbEd25519YaoProductRegistrationPartitionRecordStoreV1): RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1;
+/**
+ * The admitted authority a registration execute is checked against, from a
+ * loaded ceremony state, or `null` when the lifecycle is not admitted.
+ */
+export declare function routerAbEd25519YaoAdmittedRegistrationAuthorityV1(state: RouterAbEd25519YaoProductRegistrationStateV1, lifecycleId: string): RouterAbEd25519YaoRegistrationExecutionAuthorityV1 | null;
 export declare function encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1(record: RouterAbEd25519YaoProductRegistrationPartitionRecordV1): VersionedJsonObject;
 export declare function sameRouterAbEd25519YaoSharedStateCanonicalEncodingV1(left: RouterAbEd25519YaoSharedStateCanonicalEncodingV1, right: RouterAbEd25519YaoSharedStateCanonicalEncodingV1): boolean;
 export declare function parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1(input: unknown): RouterAbEd25519YaoProductRegistrationPartitionRecordV1 | null;
 /** The host-neutral adapter carries only validated encoded JSON objects. */
 export declare function parseRouterAbEd25519YaoProductRegistrationPartitionRecordJsonV1(input: unknown): VersionedJsonObject | null;
-type AtomicPatch = (input: {
-    readonly key: string;
-    readonly expectedVersion: string;
-    readonly exactStringPredicates: readonly {
-        readonly jsonPath: string;
-        readonly value: string;
-    }[];
-    readonly unexpired: {
-        readonly jsonPath: string;
-        readonly nowMs: number;
-    };
-    readonly patch: VersionedJsonObject;
-}) => Promise<VersionedJsonRecordPutResult & {
-    readonly value?: VersionedJsonObject;
-}>;
 export {};
 //# sourceMappingURL=routerAbEd25519YaoProductRegistrationPartitionedStateStore.d.ts.map

package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitioning.d.ts

@@ -6,6 +6,7 @@ import { type RouterAbEd25519YaoProductRegistrationStateV1 } from './routerAbEd2
 type MapValue<T> = T extends Map<string, infer Value> ? Value : never;
 type RegistrationLifecycleState = MapValue<InMemoryRouterAbEd25519YaoRegistrationStateV1['states']>;
 type RegistrationAdmissionClaim = RouterAbEd25519YaoRegistrationAdmissionClaimV1;
+type RegistrationDispatchRoot = MapValue<InMemoryRouterAbEd25519YaoRegistrationStateV1['dispatchRoots']>;
 type RegistrationIntentAuthority = InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationStateV1['authorities'][number];
 type RecoveryCapabilityState = MapValue<InMemoryRouterAbEd25519YaoRecoveryStateV1['capabilities']>;
 type RecoveryLifecycleState = MapValue<InMemoryRouterAbEd25519YaoRecoveryStateV1['recoveries']>;
@@ -25,6 +26,7 @@ export type RouterAbEd25519YaoProductRegistrationCeremonyStateV1 = {
         readonly states: ReadonlyMap<string, RegistrationLifecycleState>;
         readonly lifecycleSessions: ReadonlyMap<string, string>;
         readonly admissionClaims: ReadonlyMap<string, RegistrationAdmissionClaim>;
+        readonly dispatchRoots: ReadonlyMap<string, RegistrationDispatchRoot>;
     };
     readonly authorization: {
         readonly authorities: readonly RegistrationIntentAuthority[];

package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationRequestScopedRunner.d.ts

@@ -16,7 +16,7 @@ export type RouterAbEd25519YaoProductRegistrationRequestScopedRunResultV1<T> = {
     readonly ceremonyVersion: string;
 } | {
     readonly kind: 'version_mismatch';
-    readonly key: 'shared' | 'ceremony' | 'execution';
+    readonly key: 'shared' | 'ceremony';
 };
 /**
  * Runs one request against a request-local product-state snapshot.

package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationRequestScopedRuntime.d.ts

@@ -1,12 +1,13 @@
 import type { WalletEd25519YaoActiveCapabilityRecord } from '../../../../core/WalletStore';
-import { type RouterAbEd25519YaoRegistrationBackend } from '../registration/routerAbEd25519YaoRegistration';
 import { type RouterAbEd25519YaoActiveCapabilityLookupV1 } from '../recovery/routerAbEd25519YaoRecovery';
 import { type RouterAbEd25519YaoProductRegistrationRuntimeV1 } from './routerAbEd25519YaoProductRegistration';
-import type { RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1 } from './routerAbEd25519YaoProductRegistrationPartitionedStateStore';
+import { type RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1 } from './routerAbEd25519YaoProductRegistrationPartitionedStateStore';
+import { type RouterAbEd25519YaoPinnedRegistrationBackend } from '../registration/routerAbEd25519YaoHttpRegistrationBackend';
 export type RouterAbEd25519YaoProductRegistrationRequestScopedRuntimeInputV1 = {
     readonly signingWorkerId: string;
     readonly store: RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1;
-    readonly registrationBackend: RouterAbEd25519YaoRegistrationBackend;
+    /** The Router, which owns each registration's execution and its consumption. */
+    readonly registrationBackend: RouterAbEd25519YaoPinnedRegistrationBackend;
     /** Loads one canonical signer record for an existing-wallet capability miss. */
     readonly loadPersistedActiveCapability?: (input: RouterAbEd25519YaoActiveCapabilityLookupV1) => Promise<WalletEd25519YaoActiveCapabilityRecord | null>;
 };

package/dist/types/wallet-server/src/router/domains/ed25519Yao/export/routerAbEd25519YaoExport.d.ts

@@ -6,6 +6,7 @@ import type { RouterApiAuthorizedOperationService, RouterApiEmailOtpRouteService
 import { type RouterApiModule } from '../../../framework/modules';
 import type { RouterAbEd25519YaoActiveCapabilityResolverV1 } from '../recovery/routerAbEd25519YaoRecovery';
 import type { RouterAbEd25519YaoExportExecuteAdmissionContextV1 } from '../routerAbEd25519YaoGatewayEnvelope';
+import type { RouterAbEd25519YaoPreparedWriteV1 } from '../capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore';
 export type RouterAbEd25519YaoExportFailure = {
     readonly ok: false;
     readonly status: 400 | 404 | 408 | 409 | 429 | 500 | 502 | 503;
@@ -31,27 +32,20 @@ export interface RouterAbEd25519YaoExportBackend {
     executeExport(request: RouterAbEd25519YaoExportExecuteRequestV1, admissionRequest: RouterAbEd25519YaoExportExecuteAdmissionContextV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoExportBackendResult> | RouterAbEd25519YaoExportBackendResult;
 }
 export interface RouterAbEd25519YaoExportService {
-    admitExport(request: RouterAbEd25519YaoExportAdmissionRequestV1, authorizationIdentity: RouterAbEd25519YaoExportServerAuthorizationIdentityV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoExportServiceResult<RouterAbEd25519YaoExportAdmissionReceiptV1>>;
+    admitExport(request: RouterAbEd25519YaoExportAdmissionRequestV1, authorizationIdentity: RouterAbEd25519YaoExportServerAuthorizationIdentityV1, admission: RouterAbEd25519YaoExportOperationAdmissionV1, factorRelease: RouterAbEd25519YaoExportEmailOtpFactorReleaseV1 | null, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoExportServiceResult<RouterAbEd25519YaoExportAdmissionReceiptV1>>;
     executeExport(request: RouterAbEd25519YaoExportExecuteRequestV1, authorizationIdentity: RouterAbEd25519YaoExportServerAuthorizationIdentityV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoExportServiceResult<RouterAbEd25519YaoExportResultV1>>;
 }
-export type RouterAbEd25519YaoExportAuthorizationClaimV1 = {
-    readonly kind: 'router_ab_ed25519_yao_export_authorization_claim_v1';
-    readonly lifecycleId: string;
-    readonly exportKey: string;
-    readonly authorizationFingerprint: string;
-};
-export type RouterAbEd25519YaoExportAuthorizationPreparationV1 = {
-    readonly kind: 'claimed';
-    readonly claim: RouterAbEd25519YaoExportAuthorizationClaimV1;
+/**
+ * What authorizing one export did to the state: authorized it, a change the
+ * caller commits with the export's operation admission, or answered it from
+ * an authorization already there.
+ */
+export type RouterAbEd25519YaoExportAuthorizationDecisionV1 = {
+    readonly kind: 'authorized';
 } | {
     readonly kind: 'completed';
     readonly value: RouterAbEd25519YaoExportAuthorizationResult;
 };
-export type RouterAbEd25519YaoExportAuthorizationCommitInputV1 = {
-    readonly request: RouterAbEd25519YaoExportAdmissionRequestV1;
-    readonly claim: RouterAbEd25519YaoExportAuthorizationClaimV1;
-    readonly outcome: RouterAbEd25519YaoExportAuthorizationResult;
-};
 export type RouterAbEd25519YaoExportAdmissionClaimV1 = {
     readonly kind: 'router_ab_ed25519_yao_export_admission_claim_v1';
     readonly lifecycleId: string;
@@ -116,14 +110,13 @@ export type RouterAbEd25519YaoExportAdmissionAuthorization = {
     readonly otpCode: string;
     readonly webauthnAuthentication?: never;
 };
-export type RouterAbEd25519YaoExportAuthorizationInput = {
-    readonly kind: 'admit';
+export type RouterAbEd25519YaoExportAdmissionAuthorizationInputV1 = {
     readonly request: Request;
     readonly body: RouterAbEd25519YaoExportAdmissionRequestV1;
     readonly authorization: RouterAbEd25519YaoExportAdmissionAuthorization;
     readonly expectedOrigin: string;
-} | {
-    readonly kind: 'execute';
+};
+export type RouterAbEd25519YaoExportExecutionAuthorizationInputV1 = {
     readonly request: Request;
     readonly body: RouterAbEd25519YaoExportExecuteRequestV1;
 };
@@ -142,16 +135,40 @@ export type RouterAbEd25519YaoExportAuthorizationResult = {
     readonly code: string;
     readonly message: string;
 };
+export type RouterAbEd25519YaoExportAuthorizationFailure = Extract<RouterAbEd25519YaoExportAuthorizationResult, {
+    readonly ok: false;
+}>;
 export type RouterAbEd25519YaoExportServerAuthorizationIdentityV1 = {
     readonly thresholdSessionId: ThresholdEd25519SessionId;
 };
-type RouterAbEd25519YaoExportAuthorizationAdapterResult = {
+/**
+ * The authorized operation a verified export proof admits, not yet admitted.
+ * It commits in the batch that authorizes the export, so the operation, the
+ * nonce claim and the export's `authorized` state are durable together.
+ */
+export interface RouterAbEd25519YaoExportOperationAdmissionV1 {
+    /** The admission's writes for that batch, or why it needs none. */
+    prepare(): Promise<RouterAbEd25519YaoExportPreparedOperationAdmissionV1>;
+    /** The rejection a failed batch stands for, when the admission refused it. */
+    classifyFailure(error: unknown): RouterAbEd25519YaoExportAuthorizationFailure | null;
+    /** The admission applied alone, for export state no batch can include. */
+    admit(): Promise<RouterAbEd25519YaoExportAuthorizationResult>;
+}
+export type RouterAbEd25519YaoExportPreparedOperationAdmissionV1 = {
+    readonly kind: 'prepared';
+    readonly write: RouterAbEd25519YaoPreparedWriteV1;
+} | {
+    readonly kind: 'already_admitted';
+} | {
+    readonly kind: 'rejected';
+    readonly failure: RouterAbEd25519YaoExportAuthorizationFailure;
+};
+export type RouterAbEd25519YaoExportAdmissionAuthorizationResultV1 = {
     readonly ok: true;
     readonly authorizationIdentity: RouterAbEd25519YaoExportServerAuthorizationIdentityV1;
+    readonly admission: RouterAbEd25519YaoExportOperationAdmissionV1;
     readonly factorRelease?: RouterAbEd25519YaoExportEmailOtpFactorReleaseV1;
-} | Extract<RouterAbEd25519YaoExportAuthorizationResult, {
-    readonly ok: false;
-}>;
+} | RouterAbEd25519YaoExportAuthorizationFailure;
 export type RouterAbEd25519YaoExportAuthorizationIdentityResolutionResult = {
     readonly ok: true;
     readonly authorizationIdentity: RouterAbEd25519YaoExportServerAuthorizationIdentityV1;
@@ -159,22 +176,20 @@ export type RouterAbEd25519YaoExportAuthorizationIdentityResolutionResult = {
     readonly ok: false;
 }>;
 export interface RouterAbEd25519YaoExportAuthorizationAdapter {
-    authorize(input: RouterAbEd25519YaoExportAuthorizationInput): Promise<RouterAbEd25519YaoExportAuthorizationAdapterResult> | RouterAbEd25519YaoExportAuthorizationAdapterResult;
-    resolveAuthorizationIdentity(request: Request): Promise<RouterAbEd25519YaoExportAuthorizationIdentityResolutionResult> | RouterAbEd25519YaoExportAuthorizationIdentityResolutionResult;
+    authorizeAdmission(input: RouterAbEd25519YaoExportAdmissionAuthorizationInputV1): Promise<RouterAbEd25519YaoExportAdmissionAuthorizationResultV1> | RouterAbEd25519YaoExportAdmissionAuthorizationResultV1;
+    authorizeExecution(input: RouterAbEd25519YaoExportExecutionAuthorizationInputV1): Promise<RouterAbEd25519YaoExportAuthorizationIdentityResolutionResult> | RouterAbEd25519YaoExportAuthorizationIdentityResolutionResult;
+    /** The identity an already-authorized export's admission resolves to now. */
+    resolveAuthorizationIdentity(body: RouterAbEd25519YaoExportAdmissionRequestV1): Promise<RouterAbEd25519YaoExportAuthorizationIdentityResolutionResult> | RouterAbEd25519YaoExportAuthorizationIdentityResolutionResult;
 }
 type ExportAuthorizationContext = {
     readonly request: RouterAbEd25519YaoExportAdmissionRequestV1;
     readonly authorizationFingerprint: string;
     readonly authorizationIdentity: RouterAbEd25519YaoExportServerAuthorizationIdentityV1;
-};
-type ExportAuthorizingState = ExportAuthorizationContext & {
-    readonly kind: 'authorizing';
-};
-type ExportAuthorizationFailedState = ExportAuthorizationContext & {
-    readonly kind: 'authorization_failed';
-    readonly failure: Extract<RouterAbEd25519YaoExportAuthorizationResult, {
-        readonly ok: false;
-    }>;
+    /**
+     * The Email OTP factor release the authorization answered with, if any. Its
+     * proof is spent once verified, so an exact replay answers with this.
+     */
+    readonly factorRelease: RouterAbEd25519YaoExportEmailOtpFactorReleaseV1 | null;
 };
 type ExportAuthorizedState = ExportAuthorizationContext & {
     readonly kind: 'authorized';
@@ -207,7 +222,7 @@ type ExportCompletedState = ExportAuthorizationContext & {
     readonly executeFingerprint: string;
     readonly result: RouterAbEd25519YaoExportResultV1;
 };
-type ExportLifecycleState = ExportAuthorizingState | ExportAuthorizationFailedState | ExportAuthorizedState | ExportAdmittingState | ExportAdmissionFailedState | ExportAdmittedState | ExportExecutingState | ExportExecutionFailedState | ExportCompletedState;
+type ExportLifecycleState = ExportAuthorizedState | ExportAdmittingState | ExportAdmissionFailedState | ExportAdmittedState | ExportExecutingState | ExportExecutionFailedState | ExportCompletedState;
 export declare class InMemoryRouterAbEd25519YaoExportStateV1 {
     readonly exports: Map<string, ExportLifecycleState>;
     readonly authorizationNonces: Set<string>;
@@ -220,12 +235,16 @@ export declare class InMemoryRouterAbEd25519YaoExportService implements RouterAb
     constructor(backend: RouterAbEd25519YaoExportBackend, capabilities: RouterAbEd25519YaoActiveCapabilityResolverV1, state?: InMemoryRouterAbEd25519YaoExportStateV1);
     authorizationIsUncertain(request: RouterAbEd25519YaoExportAdmissionRequestV1): boolean;
     recordAuthorizationUncertain(request: RouterAbEd25519YaoExportAdmissionRequestV1): void;
-    admitExport(request: RouterAbEd25519YaoExportAdmissionRequestV1, authorizationIdentity: RouterAbEd25519YaoExportServerAuthorizationIdentityV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoExportServiceResult<RouterAbEd25519YaoExportAdmissionReceiptV1>>;
-    prepareAuthorizeExport(request: RouterAbEd25519YaoExportAdmissionRequestV1, authorizationFingerprint: string, authorizationIdentity: RouterAbEd25519YaoExportServerAuthorizationIdentityV1): RouterAbEd25519YaoExportAuthorizationPreparationV1;
+    admitExport(request: RouterAbEd25519YaoExportAdmissionRequestV1, authorizationIdentity: RouterAbEd25519YaoExportServerAuthorizationIdentityV1, admission: RouterAbEd25519YaoExportOperationAdmissionV1, factorRelease: RouterAbEd25519YaoExportEmailOtpFactorReleaseV1 | null, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoExportServiceResult<RouterAbEd25519YaoExportAdmissionReceiptV1>>;
+    /**
+     * Authorizes one export: its nonce claimed and its state `authorized`, in
+     * this state for the caller to commit with the export's operation
+     * admission. An export already here answers from its state instead, with
+     * the factor release it recorded.
+     */
+    authorizeExport(request: RouterAbEd25519YaoExportAdmissionRequestV1, authorizationFingerprint: string, authorizationIdentity: RouterAbEd25519YaoExportServerAuthorizationIdentityV1, factorRelease: RouterAbEd25519YaoExportEmailOtpFactorReleaseV1 | null): RouterAbEd25519YaoExportAuthorizationDecisionV1;
     readAuthorizationIdentity(request: RouterAbEd25519YaoExportAdmissionRequestV1): RouterAbEd25519YaoExportServerAuthorizationIdentityV1 | null;
-    authorizationRequiresActiveIdentity(request: RouterAbEd25519YaoExportAdmissionRequestV1): boolean;
-    commitAuthorizeExport(input: RouterAbEd25519YaoExportAuthorizationCommitInputV1): RouterAbEd25519YaoExportAuthorizationResult;
-    prepareAdmitExport(request: RouterAbEd25519YaoExportAdmissionRequestV1, authorizationIdentity: RouterAbEd25519YaoExportServerAuthorizationIdentityV1): Promise<RouterAbEd25519YaoExportAdmissionPreparationV1>;
+    prepareAdmitExport(request: RouterAbEd25519YaoExportAdmissionRequestV1, _authorizationIdentity: RouterAbEd25519YaoExportServerAuthorizationIdentityV1): Promise<RouterAbEd25519YaoExportAdmissionPreparationV1>;
     commitAdmitExport(input: RouterAbEd25519YaoExportAdmissionCommitInputV1): RouterAbEd25519YaoExportServiceResult<RouterAbEd25519YaoExportAdmissionReceiptV1>;
     executeExport(request: RouterAbEd25519YaoExportExecuteRequestV1, authorizationIdentity: RouterAbEd25519YaoExportServerAuthorizationIdentityV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoExportServiceResult<RouterAbEd25519YaoExportResultV1>>;
     prepareExecuteExport(request: RouterAbEd25519YaoExportExecuteRequestV1, authorizationIdentity: RouterAbEd25519YaoExportServerAuthorizationIdentityV1): RouterAbEd25519YaoExportExecutePreparationV1;
@@ -243,8 +262,9 @@ export declare class RouterAbEd25519YaoExportOwnerProofAuthorizationAdapter impl
     private readonly authorizedOperations;
     private readonly resolveEd25519MaterialActivation;
     constructor(webAuthn: Pick<RouterApiWebAuthnService, 'verifyWebAuthnAuthenticationLite'>, emailOtp: Pick<RouterApiEmailOtpRouteService, 'verifyEmailOtpChallenge'>, walletAuthMethods: Pick<RouterApiWalletAuthMethodService, 'resolveActivePasskeyAuthorityForVerifiedCredential' | 'resolveActiveEmailOtpAuthorityForVerifiedMethod'>, authorizedOperations: RouterApiAuthorizedOperationService, resolveEd25519MaterialActivation: RouterApiWalletRegistrationService['resolveEd25519MaterialActivation']);
-    authorize(input: RouterAbEd25519YaoExportAuthorizationInput): Promise<RouterAbEd25519YaoExportAuthorizationAdapterResult>;
-    resolveAuthorizationIdentity(request: Request): Promise<RouterAbEd25519YaoExportAuthorizationIdentityResolutionResult>;
+    authorizeAdmission(input: RouterAbEd25519YaoExportAdmissionAuthorizationInputV1): Promise<RouterAbEd25519YaoExportAdmissionAuthorizationResultV1>;
+    authorizeExecution(input: RouterAbEd25519YaoExportExecutionAuthorizationInputV1): RouterAbEd25519YaoExportAuthorizationIdentityResolutionResult;
+    resolveAuthorizationIdentity(body: RouterAbEd25519YaoExportAdmissionRequestV1): Promise<RouterAbEd25519YaoExportAuthorizationIdentityResolutionResult>;
 }
 export type RouterAbEd25519YaoExportAdmissionEnvelopeParseResultV1 = {
     readonly ok: true;