@seams/wallet-server 0.6.2 → 0.7.3

package/dist/types/wallet-server/src/router/cloudflare/d1/passkeyCustody/d1PasskeyCustodyEnvelopeStore.d.ts

@@ -26,7 +26,7 @@ import { type CloudflareD1VersionedJsonRecordScopeV1 } from '../versionedJson/d1
  * `envelopeRevision`.
  */
 export declare const PASSKEY_ENVELOPE_KEY_PREFIX = "passkey-envelope";
-export type CloudflareD1PasskeyCustodyEnvelopeStoreOptions = {
+type CloudflareD1PasskeyCustodyEnvelopeStoreOptions = {
     readonly database: D1DatabaseLike;
     readonly scope: CloudflareD1VersionedJsonRecordScopeV1;
 };
@@ -58,7 +58,7 @@ export declare function envelopeFactorRef(envelope: PasskeyCustodyEnvelopeRecord
  * branch is an explicit failure the caller must handle: none of them may fall
  * back to deriving a fresh custody root.
  */
-export type PasskeyCustodyEnvelopeLookupResult = {
+type PasskeyCustodyEnvelopeLookupResult = {
     readonly kind: 'active';
     readonly envelope: PasskeyCustodyEnvelopeRecord;
     /** CAS token for a follow-up rewrap or lifecycle transition. */
@@ -86,7 +86,7 @@ export type PasskeyCustodyEnvelopeFactorLookupResult = PasskeyCustodyEnvelopeLoo
  * Whether a browser's cached ciphertext may still be used. A cache is usable
  * only at the exact server revision and digest; anything else must be refetched.
  */
-export type PasskeyCustodyEnvelopeCacheValidation = {
+type PasskeyCustodyEnvelopeCacheValidation = {
     readonly kind: 'cache_valid';
     readonly envelope: PasskeyCustodyEnvelopeRecord;
 } | {
@@ -97,7 +97,7 @@ export type PasskeyCustodyEnvelopeCacheValidation = {
     readonly kind: 'cache_unusable';
     readonly lookup: PasskeyCustodyEnvelopeLookupResult;
 };
-export type PasskeyCustodyEnvelopePutResult = {
+type PasskeyCustodyEnvelopePutResult = {
     readonly kind: 'stored';
     readonly storeVersion: string;
     readonly envelopeRevision: number;
@@ -113,25 +113,16 @@ export type PasskeyCustodyEnvelopePutResult = {
     readonly state: 'revoked';
 };
 /** What the caller believes it is replacing, checked before the ciphertext moves. */
-export type ExpectedCustodyEnvelopeState = {
+type ExpectedCustodyEnvelopeState = {
     readonly envelopeId: PasskeyEnvelopeId;
     readonly envelopeRevision: number;
     readonly ownership: WalletCustodyEnvelopeOwnership;
 };
-export type PasskeyCustodyEnvelopeRewrapResult = PasskeyCustodyEnvelopePutResult | {
+type PasskeyCustodyEnvelopeRewrapResult = PasskeyCustodyEnvelopePutResult | {
     readonly kind: 'ownership_conflict';
     readonly reason: string;
 };
-export type PasskeyCustodyEnvelopeRevocationResult = {
-    readonly kind: 'stored';
-    readonly revokedEnvelopeIds: readonly PasskeyEnvelopeId[];
-} | {
-    readonly kind: 'refused';
-    readonly reason: string;
-} | {
-    readonly kind: 'version_mismatch';
-};
-export type PasskeyCustodyEnvelopeLinkResult = {
+type PasskeyCustodyEnvelopeLinkResult = {
     readonly kind: 'stored';
     readonly storeVersion: string;
 } | {
@@ -139,7 +130,7 @@ export type PasskeyCustodyEnvelopeLinkResult = {
 } | {
     readonly kind: 'conflict';
 };
-export type PasskeyFactorWithoutCustodyLinkResult = {
+type PasskeyFactorWithoutCustodyLinkResult = {
     readonly kind: 'stored';
 } | {
     readonly kind: 'conflict';
@@ -148,7 +139,7 @@ export type WalletCredentialActivityProjection = {
     readonly index: PasskeyDeviceEnvelopeIndexRecord;
     readonly activity: WalletCredentialActivityRecordV1;
 };
-export type WalletCredentialActivityMutationResult = {
+type WalletCredentialActivityMutationResult = {
     readonly kind: 'updated';
     readonly projection: WalletCredentialActivityProjection;
 } | {
@@ -276,7 +267,7 @@ export declare class CloudflareD1PasskeyCustodyEnvelopeStore {
      * The envelope row is insert-only, so a repeated envelope identity or any
      * conflicting credential aborts the complete transaction.
      *
-     * The factor kind is the caller's to assert, not this store's. Refactor 109C
+     * The factor kind is the caller's to assert, not this store's. Method addition
      * enrols an Email OTP factor by exactly this route — a new envelope holding
      * the same seed, committed with the auth-method insert — and each branch has
      * already verified the factor it built the envelope for by the time it gets
@@ -332,4 +323,5 @@ export declare class CloudflareD1PasskeyCustodyEnvelopeStore {
      */
     private transitionLifecycle;
 }
+export {};
 //# sourceMappingURL=d1PasskeyCustodyEnvelopeStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/passkeyCustody/d1PasskeyCustodyRouteService.d.ts

@@ -5,9 +5,8 @@ import type { CloudflareD1WebAuthnStore } from '../webauthn/d1WebAuthnStore';
 import type { NormalizedLogger } from '../../../../core/logger';
 import type { CloudflareD1WalletCustodyCommitStore, WalletRecoveryCodeLocatorRecord } from './d1WalletCustodyCommitStore';
 import { type WalletRecoveryPreparationResult } from '../../../domains/passkeyCustody/walletRecoveryAttempt';
-import { type WalletAuthMethodId, type WalletAuthorityId, type WalletId, type WalletRecoveryOperationId, type WebAuthnRpId } from '../../../../../../shared-ts/src/utils/domainIds';
+import { type WalletAuthMethodId, type WalletAuthorityId, type WalletId, type WalletRecoveryOperationId } from '../../../../../../shared-ts/src/utils/domainIds';
 import { type DeviceId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
-import type { WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/registrationIntent';
 import { type WalletRecoveryFinalizationResult } from '../../../domains/passkeyCustody/walletRecoveryFinalization';
 import type { PasskeyCustodyEnvelopeRecord } from '../../../../../../shared-ts/src/passkey-custody';
 import type { CloudflareD1WalletRecoveryGoogleEmailOtpService, WalletRecoveryGoogleEmailOtpFinalizationResult } from './d1WalletRecoveryGoogleEmailOtpService';
@@ -18,7 +17,6 @@ import type { RecoveryCodeReservationId } from '../../../../../../shared-ts/src/
 import type { WalletRecoveryEcdsaPossessionProofV1 } from '../../../../../../shared-ts/src/wallet-recovery/walletRecoveryEcdsaPossession';
 import type { D1WalletStore } from '../../../../core/d1WalletStore';
 import type { D1WalletAuthorityStore } from '../wallet/d1WalletAuthorityStore';
-import { type ActiveWalletAuthorityV1 } from '../../../../../../shared-ts/src/authorization/walletAuthority';
 import type { WalletRecoveryTargetV1 } from '../../../../../../shared-ts/src/wallet-recovery/walletRecoveryTarget';
 import { type WalletRecoveryCommittedProjectionV1 } from '../../../../../../shared-ts/src/wallet-recovery/walletRecoveryCommittedProjection';
 import { type PreparedEd25519RecoveryAdmissionV1, type WalletUnlockKeyManifestV1, type WalletRecoveryPreparationKeyManifestV1 } from '../../../domains/passkeyCustody/walletRecoveryKeyManifest';
@@ -70,14 +68,14 @@ export type PasskeyCustodyEnvelopeRetrievalWireRequest = {
     readonly webauthnAuthentication: PasskeyCustodyEnvelopeRetrievalRequest['webauthnAuthentication'];
 };
 /**
- * Refactor 109C: what became of a pre-109C envelope's ownership upgrade.
+ * What became of an unbound envelope's ownership upgrade.
  *
  * `already_owned` is a success, not a near-miss. The upgrade runs on every
  * unlock until it lands, so the second unlock after a successful one finds the
  * work already done — reporting that as a conflict would turn the normal case
  * into an error the client has to special-case anyway.
  */
-export type WalletCustodyEnvelopeOwnershipUpgradeResult = {
+type WalletCustodyEnvelopeOwnershipUpgradeResult = {
     readonly kind: 'upgraded';
     readonly envelopeRevision: number;
 } | {
@@ -166,7 +164,7 @@ export interface RouterApiPasskeyCustodyService {
      */
     retrieveEnvelope(request: PasskeyCustodyEnvelopeRetrievalWireRequest): Promise<PasskeyCustodyEnvelopeRetrievalRouteResponse>;
     /**
-     * Binds a pre-109C custody envelope to the auth method that just opened it.
+     * Binds an unbound custody envelope to the auth method that just opened it.
      *
      * The ciphertext is the client's — the server never holds a factor secret and
      * cannot verify a reseal. What it can verify, and does, is that the submitted
@@ -310,34 +308,7 @@ export type WalletRecoveryGoogleEmailOtpRouteFinalizationRequest = {
     readonly reservationId: RecoveryCodeReservationId;
     readonly replacementEnvelope: PasskeyCustodyEnvelopeRecord;
 };
-type ActiveWalletAuthMethodRecordV2 = Extract<WalletAuthMethodRecordV2, {
-    readonly status: 'active';
-}>;
-export type WalletRecoveryContinuityAnchor = {
-    readonly kind: 'wallet_recovery_continuity_anchor_v1';
-    readonly authority: ActiveWalletAuthorityV1;
-    readonly method: ActiveWalletAuthMethodRecordV2;
-    readonly envelope: ActivePasskeyCustodyEnvelopeRecord;
-};
-type ActivePasskeyCustodyEnvelopeRecord = Omit<PasskeyCustodyEnvelopeRecord, 'lifecycle'> & {
-    readonly lifecycle: Extract<PasskeyCustodyEnvelopeRecord['lifecycle'], {
-        readonly state: 'active';
-    }>;
-};
-export type WalletRecoveryAuthoritySelection = ActiveWalletAuthorityV1;
-/**
- * Finds the one existing custody path that can authenticate a recovery code.
- * The target's RP is deliberately absent: it describes the new credential,
- * while continuity belongs to an already enrolled method and its envelope.
- */
-export declare function selectWalletRecoveryContinuityAnchor(input: {
-    readonly walletId: WalletId;
-    readonly targetFamily: WalletAuthMethodRecordV2['kind'];
-    readonly methods: readonly WalletAuthMethodRecordV2[];
-    readonly envelopes: readonly PasskeyCustodyEnvelopeRecord[];
-    readonly authorities: readonly WalletRecoveryAuthoritySelection[];
-}): WalletRecoveryContinuityAnchor | undefined;
-export type WalletRecoveryRoutePreparationResult = (Extract<WalletRecoveryPreparationResult, {
+type WalletRecoveryRoutePreparationResult = (Extract<WalletRecoveryPreparationResult, {
     readonly kind: 'prepared';
 }> & {
     readonly target: Extract<WalletRecoveryTargetV1, {
@@ -424,25 +395,5 @@ export declare function createD1PasskeyCustodyRouteService(assembly: {
     /** Injected so the reservation window is testable without waiting. */
     readonly nowMs?: () => number;
 }): RouterApiPasskeyCustodyService;
-export declare function createWalletRecoveryRegistrationOptions(input: {
-    readonly webAuthnStore: Pick<CloudflareD1WebAuthnStore, 'writeChallenge'>;
-    readonly walletId: WalletId;
-    readonly reservationId: RecoveryCodeReservationId;
-    readonly recoveryOperationId: WalletRecoveryOperationId;
-    readonly targetDeviceId: DeviceId;
-    readonly targetAuthorityId: WalletAuthorityId;
-    readonly targetWalletAuthMethodId: WalletAuthMethodId;
-    readonly origin: string;
-    readonly rpId: WebAuthnRpId;
-    readonly continuityAnchor: WalletRecoveryContinuityAnchor;
-    readonly expiresAtMs: number;
-    readonly nowMs: number;
-}): Promise<{
-    readonly kind: 'ready';
-    readonly options: WalletRecoveryRegistrationOptions;
-} | {
-    readonly kind: 'unavailable';
-    readonly reason: string;
-}>;
 export {};
 //# sourceMappingURL=d1PasskeyCustodyRouteService.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/passkeyCustody/d1WalletCustodyCommitStore.d.ts

@@ -11,25 +11,17 @@ import { type CloudflareD1VersionedJsonRecordScopeV1 } from '../versionedJson/d1
 import type { WebAuthnAuthenticatorRecord } from '../webauthn/d1WebAuthnRecords';
 import { type WebAuthnCredentialBindingRecord } from '../../../../core/WebAuthnCredentialBindingStore';
 import { D1WalletAuthMethodStore } from '../../../../core/d1WalletAuthMethodStore';
-import { type WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import { type ActiveEmailOtpWalletAuthMethodRecordV2, type ActivePasskeyWalletAuthMethodRecordV2, type PasskeyWalletAuthMethodRecordV2, type WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
 import { D1WalletAuthorityStore } from '../wallet/d1WalletAuthorityStore';
 import type { EmailOtpWalletEnrollmentRecord } from '../../../../core/EmailOtpStores';
 import { type WalletRecoveryGoogleEmailOtpFinalizationInput } from './d1WalletRecoveryGoogleEmailOtpRecords';
-type ActivePasskeyWalletAuthMethodRecordV2 = Extract<WalletAuthMethodRecordV2, {
-    readonly kind: 'passkey';
-    readonly status: 'active';
-}>;
-type ActiveEmailOtpWalletAuthMethodRecordV2 = Extract<WalletAuthMethodRecordV2, {
-    readonly kind: 'email_otp';
-    readonly status: 'active';
-}>;
-export type CloudflareD1WalletCustodyCommitStoreOptions = {
+type CloudflareD1WalletCustodyCommitStoreOptions = {
     readonly database: D1DatabaseLike;
     readonly scope: CloudflareD1VersionedJsonRecordScopeV1;
     readonly walletAuthMethodStore?: D1WalletAuthMethodStore;
     readonly walletAuthorityStore?: Pick<D1WalletAuthorityStore, 'readById'>;
 };
-export type WalletCustodyRegistrationCommit = {
+type WalletCustodyRegistrationCommit = {
     readonly envelope: PasskeyCustodyEnvelopeRecord;
     readonly recoverySet: WalletRecoveryEnvelopeSetRecord;
     readonly recoveryBackupAcknowledgement: WalletRecoveryBackupAcknowledgementV1;
@@ -74,7 +66,7 @@ export type WalletCustodyRegistrationCommitResult = {
     readonly kind: 'inconsistent';
     readonly reason: string;
 };
-export type WalletCustodyRecoveryAuthorityInstallCommitResult = {
+type WalletCustodyRecoveryAuthorityInstallCommitResult = {
     readonly kind: 'committed' | 'already_committed';
     readonly envelopeStoreVersion: string;
 } | {
@@ -92,7 +84,7 @@ export type WalletRecoveryEmailEnrollmentCommit = {
     readonly enrollment: EmailOtpWalletEnrollmentRecord;
     readonly statements: readonly D1PreparedStatementLike[];
 };
-export type WalletRecoveryGoogleEmailOtpAuthorityInstallCommit = {
+type WalletRecoveryGoogleEmailOtpAuthorityInstallCommit = {
     readonly recovery: WalletRecoveryGoogleEmailOtpFinalizationInput;
     readonly recoveryAttemptStoreVersion: string;
     readonly continuityAuthority: ActiveWalletAuthorityV1;
@@ -104,8 +96,6 @@ export type WalletRecoveryGoogleEmailOtpAuthorityInstallCommit = {
     readonly walletAuthMethod: ActiveEmailOtpWalletAuthMethodRecordV2;
     readonly enrollmentCommit: WalletRecoveryEmailEnrollmentCommit;
 };
-/** Recovery sets are wallet-scoped: one set covers the wallet, not one factor. */
-export declare function walletRecoveryBackupAcknowledgementRecordKey(walletId: WalletId): string;
 export type WalletRecoveryAuthenticatorCommit = {
     readonly userId: string;
     readonly authenticator: WebAuthnAuthenticatorRecord;
@@ -113,7 +103,6 @@ export type WalletRecoveryAuthenticatorCommit = {
     readonly walletAuthMethod: ActivePasskeyWalletAuthMethodRecordV2;
     readonly challengeDeleteStatement: D1PreparedStatementLike;
 };
-export declare function walletRecoveryEnvelopeSetRecordKey(walletId: WalletId): string;
 export declare class CloudflareD1WalletCustodyCommitStore {
     private readonly database;
     private readonly scope;
@@ -127,6 +116,7 @@ export declare class CloudflareD1WalletCustodyCommitStore {
         readonly walletId: WalletId;
         readonly recoveryKeyId: DerivedWalletRecoveryKeyId;
     }): Promise<WalletRecoveryCodeLocatorRecord | null>;
+    private tenantScope;
     private prepareRecoveryCodeLocatorInsertStatement;
     private prepareRecoveryCodeLocatorsDeleteForWalletStatement;
     private prepareRecoveryCodeLocatorCollisionGuardStatement;
@@ -161,9 +151,7 @@ export declare class CloudflareD1WalletCustodyCommitStore {
     readPasskeyWalletAuthMethod(input: {
         readonly rpId: string;
         readonly credentialIdB64u: string;
-    }): Promise<Extract<WalletAuthMethodRecordV2, {
-        readonly kind: 'passkey';
-    }> | null>;
+    }): Promise<PasskeyWalletAuthMethodRecordV2 | null>;
     /**
      * Reads the wallet's backup acknowledgement, if any.
      *

package/dist/types/wallet-server/src/router/cloudflare/d1/passkeyCustody/d1WalletRecoveryGoogleEmailOtpRecords.d.ts

@@ -3,7 +3,7 @@ import { type DeviceId } from '../../../../../../shared-ts/src/authorization/cap
 import { type WalletAuthMethodId, type WalletAuthorityBindingDigest, type WalletAuthorityId, type WalletId, type WalletRecoveryOperationId, type WebAuthnCredentialIdB64u, type WebAuthnRpId } from '../../../../../../shared-ts/src/utils/domainIds';
 import { type RecoveryCodeReservationId } from '../../../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation';
 import type { WebAuthnRecoveryContinuityAnchorRecord } from '../webauthn/d1WebAuthnRecords';
-export type WalletRecoveryGoogleEmailOtpTargetV1 = {
+type WalletRecoveryGoogleEmailOtpTargetV1 = {
     readonly kind: 'google_email_otp';
     readonly googleProvider: 'google';
 };
@@ -60,7 +60,7 @@ export type WalletRecoveryGoogleEmailOtpAttemptRecord = (WalletRecoveryGoogleEma
     readonly ownerProofBindingDigest: DigestB64u;
     readonly targetEnrollment: WalletRecoveryGoogleEmailOtpTargetEnrollmentV1;
 });
-export type PreparedWalletRecoveryGoogleEmailOtpAttempt = Extract<WalletRecoveryGoogleEmailOtpAttemptRecord, {
+type PreparedWalletRecoveryGoogleEmailOtpAttempt = Extract<WalletRecoveryGoogleEmailOtpAttemptRecord, {
     readonly state: 'prepared';
 }>;
 export type OtpIssuedWalletRecoveryGoogleEmailOtpAttempt = Extract<WalletRecoveryGoogleEmailOtpAttemptRecord, {
@@ -69,7 +69,7 @@ export type OtpIssuedWalletRecoveryGoogleEmailOtpAttempt = Extract<WalletRecover
 export type OtpVerifiedWalletRecoveryGoogleEmailOtpAttempt = Extract<WalletRecoveryGoogleEmailOtpAttemptRecord, {
     readonly state: 'otp_verified';
 }>;
-export type FinalizableWalletRecoveryGoogleEmailOtpAttempt = Extract<WalletRecoveryGoogleEmailOtpAttemptRecord, {
+type FinalizableWalletRecoveryGoogleEmailOtpAttempt = Extract<WalletRecoveryGoogleEmailOtpAttemptRecord, {
     readonly state: 'otp_verified' | 'finalized';
 }>;
 export type WalletRecoveryGoogleEmailOtpFinalizationInput = {
@@ -111,6 +111,7 @@ export declare function markWalletRecoveryGoogleEmailOtpAttemptIssued(input: {
 }): OtpIssuedWalletRecoveryGoogleEmailOtpAttempt;
 export declare function markWalletRecoveryGoogleEmailOtpAttemptVerified(attempt: OtpIssuedWalletRecoveryGoogleEmailOtpAttempt): OtpVerifiedWalletRecoveryGoogleEmailOtpAttempt;
 export declare function walletRecoveryGoogleEmailOtpFinalizationInput(attempt: FinalizableWalletRecoveryGoogleEmailOtpAttempt): WalletRecoveryGoogleEmailOtpFinalizationInput;
+export declare function sameWalletRecoveryGoogleEmailOtpFinalizationInputV1(left: WalletRecoveryGoogleEmailOtpFinalizationInput, right: WalletRecoveryGoogleEmailOtpFinalizationInput): boolean;
 export declare function parseWalletRecoveryGoogleEmailOtpAttemptRecord(raw: unknown): WalletRecoveryGoogleEmailOtpAttemptRecord | null;
 export type { WalletAuthMethodId, WalletAuthorityBindingDigest, WalletAuthorityId, WalletId, WebAuthnCredentialIdB64u, WebAuthnRpId, };
 //# sourceMappingURL=d1WalletRecoveryGoogleEmailOtpRecords.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/passkeyCustody/d1WalletRecoveryGoogleEmailOtpService.d.ts

@@ -1,5 +1,5 @@
-import { type ActiveWalletAuthorityV1 } from '../../../../../../shared-ts/src/authorization';
-import { type WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import type { ActiveWalletAuthorityV1 } from '../../../../../../shared-ts/src/authorization';
+import { type ActiveEmailOtpWalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
 import type { PasskeyCustodyEnvelopeRecord } from '../../../../../../shared-ts/src/passkey-custody';
 import type { EmailOtpWalletEnrollmentRecord } from '../../../../core/EmailOtpStores';
 import type { D1WalletStore } from '../../../../core/d1WalletStore';
@@ -23,11 +23,7 @@ type GoogleRecoveryFailure = {
     readonly code: string;
     readonly message: string;
 };
-type ActiveEmailOtpWalletAuthMethodRecordV2 = Extract<WalletAuthMethodRecordV2, {
-    readonly kind: 'email_otp';
-    readonly status: 'active';
-}>;
-export type WalletRecoveryGoogleEmailOtpFinalizationEnrollment = {
+type WalletRecoveryGoogleEmailOtpFinalizationEnrollment = {
     readonly kind: 'existing';
     readonly enrollmentId: string;
     readonly enrollmentSealKeyVersion: string;
@@ -38,7 +34,7 @@ export type WalletRecoveryGoogleEmailOtpFinalizationEnrollment = {
     readonly verifiedEmail: string;
     readonly material: EmailOtpEnrollmentMaterialBoundaryInput;
 };
-export type WalletRecoveryGoogleEmailOtpFinalizationDependencies = {
+type WalletRecoveryGoogleEmailOtpFinalizationDependencies = {
     readonly envelopeStore: CloudflareD1PasskeyCustodyEnvelopeStore;
     readonly walletCustodyCommits: CloudflareD1WalletCustodyCommitStore;
     readonly walletAuthorityStore: Pick<D1WalletAuthorityStore, 'readById'>;
@@ -64,7 +60,7 @@ export type WalletRecoveryGoogleEmailOtpFinalizationResult = {
     readonly kind: 'enrollment_rejected';
     readonly reason: string;
 };
-export type WalletRecoveryGoogleEmailOtpFinalizationRequest = {
+type WalletRecoveryGoogleEmailOtpFinalizationRequest = {
     readonly kind: 'finalize';
     readonly recovery: WalletRecoveryGoogleEmailOtpFinalizationInput;
     readonly replacementEnvelope: PasskeyCustodyEnvelopeRecord;
@@ -77,7 +73,7 @@ export type WalletRecoveryGoogleEmailOtpFinalizationRequest = {
     readonly replacementEnvelope: PasskeyCustodyEnvelopeRecord;
     readonly dependencies: WalletRecoveryGoogleEmailOtpFinalizationDependencies;
 };
-export type WalletRecoveryGoogleEmailOtpChallengeResult = {
+type WalletRecoveryGoogleEmailOtpChallengeResult = {
     readonly ok: true;
     readonly recoveryOperationId: string;
     readonly walletId: WalletId;
@@ -87,7 +83,7 @@ export type WalletRecoveryGoogleEmailOtpChallengeResult = {
     readonly delivery: EmailOtpChallengeDelivery;
     readonly expiresAtMs: number;
 } | GoogleRecoveryFailure;
-export type WalletRecoveryGoogleEmailOtpFactorReleaseResult = {
+type WalletRecoveryGoogleEmailOtpFactorReleaseResult = {
     readonly ok: true;
     readonly kind: 'email_otp_factor_release_v1';
     readonly recovery: WalletRecoveryGoogleEmailOtpFinalizationInput;
@@ -109,7 +105,7 @@ export type WalletRecoveryGoogleEmailOtpFactorReleaseResult = {
         readonly verifiedEmail: string;
     };
 } | GoogleRecoveryFailure;
-export type WalletRecoveryGoogleEmailOtpVerificationResult = {
+type WalletRecoveryGoogleEmailOtpVerificationResult = {
     readonly ok: true;
     readonly recovery: WalletRecoveryGoogleEmailOtpFinalizationInput;
     readonly attempt: OtpVerifiedWalletRecoveryGoogleEmailOtpAttempt;

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore.d.ts

@@ -1,34 +1,27 @@
 import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
-export type D1RegistrationCeremonyRecordScope = {
-    readonly namespace: string;
-    readonly orgId: string;
-    readonly projectId: string;
-    readonly envId: string;
-};
-export type D1RegistrationCeremonyRecordStoreOptions = {
+import type { D1TenantScope } from '../../../../core/d1TenantStore';
+export type D1RegistrationCeremonyRecordScope = D1TenantScope;
+type D1RegistrationCeremonyRecordStoreOptions = {
     readonly database: D1DatabaseLike;
     readonly scope: D1RegistrationCeremonyRecordScope;
     readonly keyPrefix: string;
 };
-export type D1RegistrationCeremonyStoredRecord = {
+type D1RegistrationCeremonyStoredRecord = {
     readonly value: Record<string, unknown>;
     readonly version: number;
     readonly expiresAtMs: number;
 };
-export type D1RegistrationCeremonyRecordMutation = {
+type D1RegistrationCeremonyRecordMutation = {
     readonly scope: string;
     readonly id: string;
     readonly value: Record<string, unknown>;
     readonly expiresAtMs: number;
 };
-export type D1RegistrationCeremonyAtomicBranchClaim = {
+type D1RegistrationCeremonyAtomicBranchClaim = {
     readonly value: Record<string, unknown>;
     readonly version: number;
     readonly expiresAtMs: number;
 };
-export declare class D1RegistrationCeremonyRecordConflictError extends Error {
-    constructor(message: string);
-}
 export declare class D1RegistrationCeremonyRecordStore {
     private readonly database;
     private readonly tenantScope;
@@ -36,7 +29,6 @@ export declare class D1RegistrationCeremonyRecordStore {
     constructor(options: D1RegistrationCeremonyRecordStoreOptions);
     get(scope: string, id: string): Promise<D1RegistrationCeremonyStoredRecord | null>;
     putExact(mutation: D1RegistrationCeremonyRecordMutation): Promise<void>;
-    reserveExclusive(mutation: D1RegistrationCeremonyRecordMutation): Promise<boolean>;
     updateExpected(input: {
         readonly scope: string;
         readonly id: string;
@@ -83,4 +75,5 @@ export declare class D1RegistrationCeremonyRecordStore {
     private bindKey;
     private normalizeKey;
 }
+export {};
 //# sourceMappingURL=d1RegistrationCeremonyRecordStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationCeremonyRecords.d.ts

@@ -1,19 +1,20 @@
+import type { WalletRegistrationFinalizeSuccess } from '../../../../core/registrationContracts';
 import { type EcdsaClientRootPublicKey33B64u } from '../../../../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap';
-import { type AddAuthMethodIntentCallerV1, type AddAuthMethodInput, type AddAuthMethodIntentV1, type AddSignerIntentV1, type AddSignerSelection, type ServerAllocatedWalletId, type RegistrationAuthority, type RegistrationAuthMethodInput, type RegistrationIntentV1, type RegistrationSignerSetSelection, type RuntimePolicyScopeLike, type WalletId } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import { type AddAuthMethodIntentCallerV1, type AddAuthMethodIntentV1, type AddSignerIntentV1, type RegistrationIntentV1, type RuntimePolicyScopeLike, type WalletId } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import { type ServerAllocatedWalletId } from '../../../../../../shared-ts/src/utils/registrationIds';
+import { type AddSignerSelection, type RegistrationSignerSetSelection } from '../../../../../../shared-ts/src/utils/registrationSignerPlan';
+import { type AddAuthMethodInput, type RegistrationAuthMethodInput } from '../../../../../../shared-ts/src/utils/registrationAuthMethodInput';
 import { type WalletAuthMethodId } from '../../../../../../shared-ts/src/utils/domainIds';
 import type { RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
 import { deriveEvmFamilySigningKeySlotId } from '../../../../../../shared-ts/src/signing-lanes';
 import { type RouterAbEcdsaDerivationPublicCapabilityV1, type RouterAbEcdsaRegistrationActivationReceiptV1 } from '../../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
-import type { EcdsaDerivationClientBootstrapRequest, EcdsaDerivationServerBootstrapResponse } from '../../../../core/types';
+import type { EcdsaDerivationServerBootstrapResponse } from '../../../../core/types';
 import type { WalletRegistrationCommittedInstallationProjectionV1 } from '../../../../core/threeRouteRegistrationContracts';
-import type { WalletRegistrationEcdsaClientBootstrap, WalletRegistrationEcdsaPrepareContext, WalletRegistrationEcdsaWalletKey, WalletRegistrationFinalizeResponse, WalletAddSignerFinalizeResponse } from '../../../../core/registrationContracts';
-import { type StoredWalletRegistrationNearEd25519YaoAuthorizedBranch, StoredAddAuthMethodIntent, StoredAddSignerIntent, StoredWalletAddAuthMethodCeremony, StoredWalletAddSignerCeremony, StoredWalletAddSignerFinalizeReplay, StoredWalletAddAuthMethodFinalizeReplay, StoredWalletAddSignerFinalizeRequest, StoredWalletRegistrationCeremony } from '../../../../core/RegistrationCeremonyStore';
+import type { WalletRegistrationEcdsaWalletKey, WalletAddSignerFinalizeResponse } from '../../../../core/registrationContracts';
+import { StoredAddAuthMethodIntent, StoredAddSignerIntent, StoredWalletAddAuthMethodCeremony, StoredWalletAddSignerCeremony, StoredWalletAddSignerFinalizeReplay, StoredWalletAddAuthMethodFinalizeReplay, StoredWalletRegistrationCeremony } from '../../../../core/RegistrationCeremonyStore';
 import { type ThresholdEcdsaChainTarget } from '../../../../core/thresholdEcdsaChainTarget';
 import { type WalletEcdsaSignerRecord, type WalletRecord } from '../../../../core/d1WalletStore';
-type D1WalletRegistrationFinalizeSuccess = Extract<WalletRegistrationFinalizeResponse, {
-    ok: true;
-}>;
-type D1WalletRegistrationFinalizeReplaySuccess = D1WalletRegistrationFinalizeSuccess;
+type D1WalletRegistrationFinalizeReplaySuccess = WalletRegistrationFinalizeSuccess;
 export declare function createD1ServerAllocatedWalletId(): ServerAllocatedWalletId;
 export declare function inferRuntimePolicyScopeFromSigningRoot(input: {
     readonly orgId: string;
@@ -47,32 +48,22 @@ export declare function buildAddAuthMethodIntent(input: {
     readonly caller: AddAuthMethodIntentCallerV1;
     readonly runtimePolicyScope?: RuntimePolicyScope;
 }): AddAuthMethodIntentV1;
-export declare function addAuthMethodInputMatches(left: AddAuthMethodInput, right: AddAuthMethodInput): boolean;
-export declare function addSignerSelectionMatches(left: AddSignerSelection, right: AddSignerSelection): boolean;
 export declare function parseWalletIdForIntent(raw: unknown): WalletId | null;
-export declare function parseD1RegistrationIntent(raw: unknown): RegistrationIntentV1 | null;
 export declare function parseD1StoredWalletRegistrationCeremony(raw: unknown): StoredWalletRegistrationCeremony | null;
 export declare function parseD1StoredWalletAddAuthMethodFinalizeReplay(raw: unknown): StoredWalletAddAuthMethodFinalizeReplay | null;
 export declare function parseD1StoredWalletAddSignerFinalizeReplay(raw: unknown): StoredWalletAddSignerFinalizeReplay | null;
 export declare function parseD1WalletAddSignerFinalizeTerminalResponse(raw: unknown): WalletAddSignerFinalizeResponse | null;
 export declare function parseD1WalletRegistrationFinalizeReplayResponse(raw: unknown): D1WalletRegistrationFinalizeReplaySuccess | null;
-export declare function parseD1StoredNearEd25519YaoAuthorizedBranch(record: Record<string, unknown>): StoredWalletRegistrationNearEd25519YaoAuthorizedBranch | null;
 export declare function parseD1WalletRegistrationCommittedInstallationProjection(raw: unknown): WalletRegistrationCommittedInstallationProjectionV1 | null;
 export declare function parseD1StoredAddSignerIntent(raw: unknown): StoredAddSignerIntent | null;
 export declare function parseD1AddSignerIntent(raw: unknown): AddSignerIntentV1 | null;
 export declare function parseD1StoredWalletAddSignerCeremony(raw: unknown): StoredWalletAddSignerCeremony | null;
 export declare function parseD1StoredAddSignerAuth(raw: unknown): StoredWalletAddSignerCeremony['auth'] | null;
-export declare function parseD1WalletAddSignerFinalizeRequest(raw: unknown): StoredWalletAddSignerFinalizeRequest | null;
 export declare function parseD1EcdsaDerivationServerBootstrapResponse(raw: unknown): EcdsaDerivationServerBootstrapResponse | null;
 export declare function runtimePolicyScopeMatches(left: RuntimePolicyScopeLike | undefined, right: RuntimePolicyScopeLike | undefined): boolean;
 export declare function positiveIntegerArraysEqual(left: readonly number[], right: readonly number[]): boolean;
 export declare function thresholdEcdsaChainTargetsEqual(left: readonly unknown[], right: readonly unknown[]): boolean;
-export declare function isMatchingD1EcdsaClientBootstrap(input: {
-    readonly expected: WalletRegistrationEcdsaPrepareContext;
-    readonly actual: WalletRegistrationEcdsaClientBootstrap;
-}): boolean;
-export declare function toD1EcdsaDerivationClientBootstrapRequest(clientBootstrap: WalletRegistrationEcdsaClientBootstrap): EcdsaDerivationClientBootstrapRequest;
-export type D1EcdsaWalletKeyBuildResult = {
+type D1EcdsaWalletKeyBuildResult = {
     readonly ok: true;
     readonly walletKeys: WalletRegistrationEcdsaWalletKey[];
 } | {
@@ -102,12 +93,9 @@ export declare function buildD1WalletEcdsaSignerRecords(input: {
     readonly now: number;
 }): WalletEcdsaSignerRecord[];
 export { deriveEvmFamilySigningKeySlotId };
-export declare function parseD1PositiveIntegerArray(raw: unknown): number[] | null;
 export declare function parseD1StoredAddAuthMethodIntent(raw: unknown): StoredAddAuthMethodIntent | null;
 export declare function parseD1StoredWalletAddAuthMethodCeremony(raw: unknown): StoredWalletAddAuthMethodCeremony | null;
-export declare function parseD1AddAuthMethodIntent(raw: unknown): AddAuthMethodIntentV1 | null;
 export declare function parseD1RuntimePolicyScope(raw: unknown): RuntimePolicyScope | undefined;
-export declare function parseD1RegistrationAuthority(raw: unknown): RegistrationAuthority | null;
 export declare function normalizeThresholdEcdsaChainTargets(input: readonly unknown[]): ThresholdEcdsaChainTarget[] | null;
 export declare function intentScopeMetadata(input: {
     readonly signingRootId?: string;

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationCeremonyStore.d.ts

@@ -3,13 +3,13 @@ import { StoredAddAuthMethodIntent, StoredAddSignerIntent, StoredWalletAddAuthMe
 import type { WalletId } from '../../../../core/registrationContracts';
 import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
 import { type D1RegistrationCeremonyRecordScope } from './d1RegistrationCeremonyRecordStore';
-export type RegistrationCeremonyIntentStoreConfig = {
+type RegistrationCeremonyIntentStoreConfig = {
     readonly kind: 'partitioned_d1';
     readonly database: D1DatabaseLike;
     readonly scope: D1RegistrationCeremonyRecordScope;
     readonly keyPrefix: string;
 };
-export type D1WalletRegistrationEcdsaCeremonyClaimV1 = {
+type D1WalletRegistrationEcdsaCeremonyClaimV1 = {
     readonly ceremony: StoredWalletRegistrationCeremony;
     readonly version: number;
 };
@@ -27,6 +27,9 @@ export declare class CloudflareD1RegistrationCeremonyIntentStore {
         readonly registrationCeremonyId: string;
         readonly strictRegistrationBindingJson: string;
         readonly registrationRequest: StoredWalletRegistrationEvmFamilyEcdsaResponseClaimedBranch['registrationRequest'];
+        readonly projectEnvironmentId: string;
+        readonly tenantRootIdentityDigestB64u: string;
+        readonly tenantRootCustodyLineageB64u: string;
     }): Promise<D1WalletRegistrationEcdsaCeremonyClaimV1 | null>;
     claimEcdsaActivation(input: {
         readonly registrationCeremonyId: string;
@@ -81,4 +84,5 @@ export declare class CloudflareD1RegistrationCeremonyIntentStore {
     private getDel;
     private del;
 }
+export {};
 //# sourceMappingURL=d1RegistrationCeremonyStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationCommitStore.d.ts

@@ -1,23 +1,27 @@
 import type { ActiveWalletAuthorityV1 } from '../../../../../../shared-ts/src/authorization/walletAuthority';
-import { type RegistrationAuthority, type WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import { type ActiveWalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
+import { type RegistrationAuthority } from '../../../../../../shared-ts/src/utils/registrationAuthMethodInput';
 import type { WalletRecord, WalletSignerRecord } from '../../../../core/WalletStore';
-import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
+import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
 import type { D1EmailOtpRegistrationCommitPlan } from '../emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer';
 type D1WalletRegistrationCommitBase = {
     readonly wallet: WalletRecord;
     readonly walletSigners: readonly WalletSignerRecord[];
     readonly now: number;
+    /**
+     * The Ed25519 Yao lifecycle decision this commit makes visible, when it
+     * finalizes one: it commits in this batch or nothing does.
+     */
+    readonly decisionStatements: readonly D1PreparedStatementLike[];
 };
 type D1WalletRegistrationFoundingFields = {
     readonly foundingAuthority?: never;
     readonly foundingAuthMethod?: never;
 } | {
     readonly foundingAuthority: ActiveWalletAuthorityV1;
-    readonly foundingAuthMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly status: 'active';
-    }>;
+    readonly foundingAuthMethod: ActiveWalletAuthMethodRecordV2;
 };
-export type D1WalletRegistrationCommitInput = (D1WalletRegistrationCommitBase & D1WalletRegistrationFoundingFields & {
+type D1WalletRegistrationCommitInput = (D1WalletRegistrationCommitBase & D1WalletRegistrationFoundingFields & {
     readonly kind: 'passkey_wallet_registration_commit_v1';
     readonly authority: Extract<RegistrationAuthority, {
         readonly kind: 'passkey';