@seams/wallet-server 0.6.2 → 0.7.3

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationService.d.ts

@@ -1,3 +1,6 @@
+import type { EcdsaMaterialActivationReadInput } from '../../../../core/d1EcdsaSignerRead';
+import type { EcdsaMaterialReadSnapshot } from '../../../../core/ecdsaMaterialReadSnapshot';
+import type { InstalledEcdsaCustodySnapshotV1 } from '../deviceLinking/d1LinkedDeviceAuthorityInstallService';
 import type { VerifiedNearRegistrationContinuationV1 } from '../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationIntentAuthorization';
 import { type DeviceId, type TenantId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
 import type { AuthorizationService } from '../../../../authorization/service';
@@ -13,6 +16,7 @@ import { type RouterAbEcdsaDerivationNormalSigningStateV1, type RouterAbEcdsaDer
 import { WalletRegistrationEcdsaActivationResponse } from '../../../../core/registrationContracts';
 import { type RouterAbEcdsaStrictRegistrationPort } from '../../../domains/ecdsa/routerAbEcdsaStrictRegistration';
 import type { TenantRootCustodyLineageResolverV1 } from '../../../domains/tenantRoot/tenantRootCustodyLineage';
+import { type TenantRootIdentityV1 } from '../../../domains/tenantRoot/tenantRootIdentityResolution';
 import { CloudflareD1RegistrationCeremonyIntentStore } from './d1RegistrationCeremonyStore';
 import type { InstalledLinkedDeviceEcdsaAuthorityProjectionV1, InstalledLinkedDeviceEd25519AuthorityProjectionV1 } from '../deviceLinking/d1LinkedDeviceAuthorityInstallService';
 import { type ThresholdEcdsaKeyInventoryDiagnostics, type ThresholdEcdsaKeyInventoryRecord } from '../../../../core/authService/thresholdEcdsaKeyInventory';
@@ -23,6 +27,7 @@ import type { CloudflareD1WalletCustodyCommitStore } from '../passkeyCustody/d1W
 import { CloudflareD1EmailOtpRegistrationEnrollmentFinalizer } from '../emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer';
 import { CloudflareD1WalletAuthMethodService } from '../wallet/d1WalletAuthMethodService';
 import type { D1WalletRegistrationCommitStore } from './d1WalletRegistrationCommitStore';
+import type { CloudflareD1Ed25519YaoLifecycleDecisionStoreV1 } from '../ed25519Yao/d1Ed25519YaoLifecycleDecisionStore';
 import { type WalletEcdsaSignerKey, type WalletEcdsaSignerRecord } from '../../../../core/WalletStore';
 import type { D1WalletStore } from '../../../../core/d1WalletStore';
 import { type RouterAbEd25519YaoProductRegistrationRuntimeV1 } from '../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration';
@@ -38,7 +43,7 @@ type ActivateWalletRegistrationEcdsaInput = {
         readonly publicFacts: NonNullable<WalletRegistrationActivateInput['ecdsa']>['clientActivation'];
     };
 };
-export type D1LinkedDeviceEd25519AuthorityReaderV1 = {
+type D1LinkedDeviceEd25519AuthorityReaderV1 = {
     readInstalledEd25519AuthorityByIdentityV1(input: {
         readonly walletId: WalletId;
         readonly authorityId: WalletAuthorityId;
@@ -53,10 +58,11 @@ export type D1LinkedDeviceEd25519AuthorityReaderV1 = {
         readonly authorityId: WalletAuthorityId;
         readonly walletAuthMethodId: WalletAuthMethodId;
     }) => Promise<InstalledLinkedDeviceEcdsaAuthorityProjectionV1 | null>;
-    readonly readInstalledEcdsaAuthorityByMaterialActivationV1?: (input: {
+    readInstalledEcdsaCustodySnapshotV1(input: {
+        readonly source: EcdsaMaterialActivationReadInput['source'];
         readonly walletId: WalletId;
         readonly materialActivation: MpcMaterialActivationRef;
-    }) => Promise<InstalledLinkedDeviceEcdsaAuthorityProjectionV1 | null>;
+    }): Promise<InstalledEcdsaCustodySnapshotV1 | null>;
 };
 export type D1WalletRegistrationOperationPreparedV1 = {
     readonly kind: 'd1_wallet_registration_operation_prepared_v1';
@@ -98,7 +104,6 @@ type SponsoredNamedNearAccountCreator = (input: {
      */
     readonly idempotencyKey: string;
 }) => Promise<SponsoredNamedNearAccountCreationResult>;
-export declare function hasEcdsaKeyHandleSetMismatch(expectedKeyHandles: readonly string[], actualKeyHandles: readonly string[]): boolean;
 export declare function ecdsaStrictRegistrationAuthority(facts: RouterAbEcdsaRegistrationRequestFactsV1): {
     readonly subjectId: string;
     readonly sessionId: string;
@@ -120,16 +125,6 @@ type EcdsaPostRegistrationProofInput = {
     readonly request: RouterAbEcdsaDerivationActivationRefreshRequestV1;
     readonly response: RouterAbEcdsaDerivationActivationRefreshForwardedResponseV1;
 };
-/**
- * Folds the Router's own `Server-Timing` header into the Gateway's span list
- * (Refactor 94B Phase 0), so the Router and role-worker breakdown reaches the
- * browser on the same header as the Gateway's own boundaries.
- *
- * Entries without a finite non-negative `dur` are dropped, which also discards
- * Cloudflare's descriptive metrics, and names are restricted to a token
- * charset so a metric name can never forge extra entries downstream.
- */
-export declare function mergeRouterServerTiming(target: Array<readonly [string, number]>, header: string): void;
 export declare class CloudflareD1WalletRegistrationService {
     private readonly authorizationService;
     private readonly authorizationTenantId;
@@ -140,15 +135,16 @@ export declare class CloudflareD1WalletRegistrationService {
     private readonly ecdsaStrictRegistration;
     private readonly tenantRootCustodyLineage;
     private readonly getWalletStore;
-    /** The single Gateway operation row for activate-with-finalize (94C). */
+    /** The single Gateway operation row for activate-with-finalize. */
     private readonly activateSideEffects;
-    /** Deferred NEAR provisioning's own operation row (94C). */
+    /** Deferred NEAR provisioning's own operation row. */
     private readonly nearProvisioningSideEffects;
     private readonly walletRegistrationCommitStore;
     /** Where a ceremony's sealed custody seed and its recovery set land. */
     private readonly walletCustodyCommitStore;
     private readonly walletAuthMethods;
     private readonly getLinkedDeviceEd25519AuthorityReader;
+    private readonly yaoLifecycleDecisions;
     constructor(input: {
         readonly authorizationService: AuthorizationService;
         readonly authorizationTenantId: TenantId;
@@ -165,8 +161,8 @@ export declare class CloudflareD1WalletRegistrationService {
         readonly walletCustodyCommitStore: CloudflareD1WalletCustodyCommitStore;
         readonly walletAuthMethods: CloudflareD1WalletAuthMethodService;
         readonly getLinkedDeviceEd25519AuthorityReader: () => D1LinkedDeviceEd25519AuthorityReaderV1 | null;
+        readonly yaoLifecycleDecisions: CloudflareD1Ed25519YaoLifecycleDecisionStoreV1;
     });
-    getWalletRegistrationRuntimePolicyScope(registrationCeremonyId: string): Promise<RuntimePolicyScope | undefined>;
     resolveEd25519MaterialActivation(input: {
         readonly walletId: string;
         readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
@@ -184,11 +180,9 @@ export declare class CloudflareD1WalletRegistrationService {
         readonly code: 'not_found' | 'internal';
         readonly message: string;
     }>;
-    resolveEcdsaMaterialActivation(input: {
-        readonly walletId: string;
-        readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
-    }): Promise<{
+    resolveEcdsaMaterialActivation(input: EcdsaMaterialActivationReadInput): Promise<{
         readonly ok: true;
+        readonly readSnapshot: EcdsaMaterialReadSnapshot;
         readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
         readonly keyHandle: string;
         readonly relayerKeyId: string;
@@ -205,6 +199,7 @@ export declare class CloudflareD1WalletRegistrationService {
         readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
     }): Promise<{
         readonly ok: true;
+        readonly identity: TenantRootIdentityV1;
         readonly identityDigestB64u: string;
         readonly custodyLineageB64u: string;
     } | {
@@ -219,6 +214,7 @@ export declare class CloudflareD1WalletRegistrationService {
         readonly ok: true;
         readonly identityDigestB64u: string;
         readonly custodyLineageB64u: string;
+        readonly projectEnvironmentId: string;
     } | {
         readonly ok: false;
         readonly code: 'not_found' | 'invalid_state' | 'internal';
@@ -261,8 +257,8 @@ export declare class CloudflareD1WalletRegistrationService {
     refreshEd25519YaoWalletSession(request: RouterAbEd25519YaoBudgetRefreshRequestV1): Promise<RouterAbEd25519YaoBudgetRefreshResponseV1>;
     provisionEd25519YaoWalletSession(request: RouterAbEd25519YaoVerifiedWalletUnlockRequestV1): Promise<RouterAbEd25519YaoVerifiedWalletUnlockResponseV1>;
     /**
-     * Refactor 94C. `/wallets/register/setup` — grant, intent, and start in one
-     * request, with one D1 write.
+     * `/wallets/register/setup` — grant, intent, and start in one request, with
+     * one D1 write.
      *
      * Setup runs before the client's WebAuthn create, because it issues the
      * challenge that create signs. So the ECDSA prepare and the Ed25519
@@ -280,7 +276,6 @@ export declare class CloudflareD1WalletRegistrationService {
      * owns idempotency here, so the commit keeps no replay cache of its own.
      */
     private readRegistrationOwnerProofContext;
-    private registrationOwnerProof;
     /** For callers that must read the context before finalize tombstones it. */
     private registrationOwnerProofWithContext;
     authorizeNearRegistrationContinuation(input: {
@@ -339,8 +334,8 @@ export declare class CloudflareD1WalletRegistrationService {
      */
     private authorizeRespondEd25519Branch;
     /**
-     * Refactor 94C. `/wallets/register/activate` — activation and finalization
-     * as one irreversible step behind one Gateway operation row.
+     * `/wallets/register/activate` — activation and finalization as one
+     * irreversible step behind one Gateway operation row.
      *
      * Previously activation and finalization were separate requests with
      * separate idempotency: activation claimed and CAS'd the ceremony branch,

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationSetup.d.ts

@@ -1,6 +1,6 @@
 /**
- * Refactor 94C. `/wallets/register/setup` — one request replacing the bootstrap
- * grant, the registration intent, and registration start.
+ * `/wallets/register/setup` — one request replacing the bootstrap grant, the
+ * registration intent, and registration start.
  *
  * The three legs it replaces made six-plus serialized storage round trips
  * between them, most of it bookkeeping written on every request and read on
@@ -31,7 +31,9 @@
  * allocation and insertion are the same request. Genuine uniqueness is still
  * arbitrated where it always was, by the wallet table at commit.
  */
-import { type RegisterWalletInput, type RegistrationAuthMethodInput, type RegistrationSignerSetSelection, type WalletId } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import { type WalletId } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import { type RegistrationSignerSetSelection } from '../../../../../../shared-ts/src/utils/registrationSignerPlan';
+import { type RegisterWalletInput, type RegistrationAuthMethodInput } from '../../../../../../shared-ts/src/utils/registrationAuthMethodInput';
 import type { RespondEd25519DeferredWorkV2, WalletRegistrationRespondResponseV2, WalletRegistrationSetupResponseV2 } from '../../../../core/threeRouteRegistrationContracts';
 import type { StoredWalletRegistrationCeremony } from '../../../../core/RegistrationCeremonyStore';
 import { mintSignedWalletRegistrationSetup, type WalletRegistrationSetupMinter } from '../../../domains/walletRegistration/walletRegistrationSetupPayload';

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/walletRegistrationEstablishedSessionIssuer.d.ts

@@ -1,4 +1,5 @@
-import type { WalletRegistrationEd25519YaoPublicResult, WalletRegistrationFinalizeAuthMethod } from '../../../../core/registrationContracts';
+import type { WalletRegistrationEd25519YaoPublicResult } from '../../../../core/registrationContracts';
+import type { WalletRegistrationFinalizeAuthMethod } from '../../../../../../shared-ts/src/utils/registrationContracts';
 import { type VerifiedOwnerProof } from '../../../../authorization/factorEvidence';
 import type { AuthorizationService } from '../../../../authorization/service';
 import type { LiveWalletSessionAuthorizationProjectionV2 } from '../../../../authorization/domain';
@@ -12,8 +13,8 @@ import { type WalletAuthAuthority } from '../../../../../../shared-ts/src/utils/
 import { type DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
 import type { RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
 import type { RegistrationEstablishedSessionProjectionTokensV2, RegistrationEstablishedSessionProjectionV2, RegistrationEstablishedSessionResultV2, RegistrationEstablishedSessionV2 } from '../../../../../../shared-ts/src/utils/registrationEstablishedSession';
-export type RegistrationEstablishedSessionIssuerAuthorizationService = Pick<AuthorizationService, 'issueDirectWalletSessionAuthorizationV2' | 'issueDirectRegistrationPromotedWalletSessionAuthorizationV2' | 'readWalletSessionAuthorizationV2ByMint' | 'readWalletSessionAuthorizationV2ByAuthorizationId' | 'refreshWalletSessionAuthorizationV2AuthorityProjection'>;
-export type RegistrationEstablishedSessionIssuerWalletAuthMethodReader = {
+type RegistrationEstablishedSessionIssuerAuthorizationService = Pick<AuthorizationService, 'issueDirectWalletSessionAuthorizationV2' | 'issueDirectRegistrationPromotedWalletSessionAuthorizationV2' | 'readWalletSessionAuthorizationV2ByMint' | 'readWalletSessionAuthorizationV2ByAuthorizationId' | 'refreshWalletSessionAuthorizationV2AuthorityProjection'>;
+type RegistrationEstablishedSessionIssuerWalletAuthMethodReader = {
     readonly readActiveRegistrationAuthority: (authority: StoredRegistrationAuthority) => Promise<{
         readonly authority: ActiveWalletAuthorityV1;
         readonly walletAuthMethodId: WalletAuthMethodId;

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/walletRegistrationSessionCommitReceipt.d.ts

@@ -1,6 +1,7 @@
-import type { WalletRegistrationFinalizeResponse, WalletRegistrationFinalizeSuccess, WalletRegistrationFinalizeAuthMethod } from '../../../../core/registrationContracts';
+import type { WalletRegistrationFinalizeResponse, WalletRegistrationFinalizeSuccess } from '../../../../core/registrationContracts';
+import type { WalletRegistrationFinalizeAuthMethod } from '../../../../../../shared-ts/src/utils/registrationContracts';
 import type { WalletRegistrationActivateResponseV2, WalletRegistrationCommittedInstallationProjectionV1, WalletRegistrationSessionCommitReceiptV2 } from '../../../../core/threeRouteRegistrationContracts';
-import type { RegistrationEstablishedSessionV2, RegistrationEstablishedSessionResultV2, RegistrationEstablishedSessionProjectionV2 } from '../../../../../../shared-ts/src/utils/registrationEstablishedSession';
+import type { RegistrationEstablishedSessionResultV2 } from '../../../../../../shared-ts/src/utils/registrationEstablishedSession';
 import { type WalletSessionMintId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
 export type WalletRegistrationNearProvisioningFinalizeResponse = WalletRegistrationFinalizeResponse | (Extract<WalletRegistrationFinalizeSuccess, {
     readonly kind: 'near_ed25519';
@@ -32,7 +33,6 @@ export type RegistrationCommitExecution<T> = {
 };
 export declare function unissuedRegistrationCommit<T>(response: T): RegistrationCommitExecution<T>;
 export declare function replayedRegistrationCommit<T>(response: T): RegistrationCommitExecution<T>;
-export declare function projectRegistrationEstablishedSessionV2(session: RegistrationEstablishedSessionV2): RegistrationEstablishedSessionProjectionV2;
 export declare function projectWalletRegistrationSessionCommitReceiptV2(input: {
     readonly operation: 'registration_activate' | 'near_provisioning';
     readonly operationFingerprint: string;
@@ -44,7 +44,7 @@ type WalletRegistrationIdentityCommitReceiptV2 = Exclude<WalletRegistrationSessi
         readonly kind: 'error';
     };
 }>;
-export type RegistrationReplayAuthMethodFields = {
+type RegistrationReplayAuthMethodFields = {
     readonly kind: 'passkey';
     readonly authMethod: Extract<WalletRegistrationFinalizeAuthMethod, {
         readonly kind: 'passkey';
@@ -59,7 +59,7 @@ export type RegistrationReplayAuthMethodFields = {
 };
 export declare function registrationReplayAuthMethodFields(receipt: WalletRegistrationIdentityCommitReceiptV2): RegistrationReplayAuthMethodFields;
 export declare function registrationEstablishedMintId(registrationCeremonyId: string): WalletSessionMintId;
-export type RegistrationCommitReceiptCommittedParser = (raw: unknown) => WalletRegistrationSessionCommitReceiptV2['committed'] | null;
+type RegistrationCommitReceiptCommittedParser = (raw: unknown) => WalletRegistrationSessionCommitReceiptV2['committed'] | null;
 /**
  * Parses the one durable registration receipt shape. Nested signer payloads
  * are parsed by the caller's branch parser; this boundary owns the envelope,

package/dist/types/wallet-server/src/router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.d.ts

@@ -1,7 +1,7 @@
-import type { RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
+import { type RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
 import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
-import type { RouterAbNormalSigningAdmissionInput } from '../../../domains/signingOperations/routerAbPrivateSigningWorker';
-import type { RouterAbNormalSigningAbuseDecision, RouterAbNormalSigningAdmissionStore, RouterAbNormalSigningProjectPolicyDecision } from '../../../domains/signingOperations/routerAbNormalSigningAdmissionCore';
+import type { RouterAbNormalSigningAdmissionInput } from '../../../domains/signingOperations/routerAbNormalSigningAdmission';
+import type { RouterAbNormalSigningAbuseDecision, RouterAbNormalSigningAdmissionStore, RouterAbNormalSigningProjectPolicyDecision, RouterAbNormalSigningPolicyDecision } from '../../../domains/signingOperations/routerAbNormalSigningAdmissionCore';
 export type CloudflareD1RouterAbNormalSigningAdmissionStoreOptions = {
     readonly database: D1DatabaseLike;
     readonly storageNamespace: string;
@@ -12,15 +12,26 @@ export declare class CloudflareD1RouterAbNormalSigningAdmissionStore implements
     private readonly storageNamespace;
     private readonly now;
     constructor(options: CloudflareD1RouterAbNormalSigningAdmissionStoreOptions);
-    evaluateProjectPolicy(input: RouterAbNormalSigningAdmissionInput): Promise<RouterAbNormalSigningProjectPolicyDecision>;
-    evaluateAbuse(input: RouterAbNormalSigningAdmissionInput): Promise<RouterAbNormalSigningAbuseDecision>;
+    evaluatePolicy(input: RouterAbNormalSigningAdmissionInput): Promise<RouterAbNormalSigningPolicyDecision>;
     setProjectPolicy(scope: RuntimePolicyScope, decision: RouterAbNormalSigningProjectPolicyDecision): Promise<void>;
     clearProjectPolicy(scope: RuntimePolicyScope): Promise<void>;
     setAbuseDecision(input: RouterAbNormalSigningAdmissionInput, decision: RouterAbNormalSigningAbuseDecision): Promise<void>;
     clearAbuseDecision(input: RouterAbNormalSigningAdmissionInput): Promise<void>;
-    private readDecision;
     private putDecision;
     private deleteRecord;
 }
 export declare function createCloudflareD1RouterAbNormalSigningAdmissionStore(options: CloudflareD1RouterAbNormalSigningAdmissionStoreOptions): CloudflareD1RouterAbNormalSigningAdmissionStore;
+export declare class D1EcdsaAdmissionPolicyRead {
+    #private;
+    private readonly database;
+    private readonly namespace;
+    private readonly walletId;
+    private readonly activationId;
+    private constructor();
+    static fromRows(database: D1DatabaseLike, namespace: string, walletId: string, activationId: string, rows: unknown): D1EcdsaAdmissionPolicyRead;
+    resolve(database: D1DatabaseLike, namespace: string, input: RouterAbNormalSigningAdmissionInput & {
+        readonly curve: 'ecdsa';
+    }): RouterAbNormalSigningPolicyDecision | null;
+}
+export declare const ECDSA_CREDENTIAL_POLICY_PROJECTION = "\n  (WITH candidates AS (\n     SELECT DISTINCT json_extract(signer.record_json, '$.runtimePolicyScope') AS scope_json\n       FROM wallet_signers AS signer\n      WHERE signer.namespace = session.namespace AND signer.org_id = session.org_id\n        AND signer.project_id = session.project_id AND signer.env_id = session.env_id\n        AND signer.wallet_id = session.wallet_id AND signer.signer_family = 'ecdsa'\n        AND json_valid(signer.record_json)\n   ), scopes AS (\n     SELECT scope_json,\n            json_extract(scope_json, '$.orgId') AS org_id,\n            json_extract(scope_json, '$.projectId') AS project_id,\n            json_extract(scope_json, '$.envId') AS env_id,\n            json_extract(scope_json, '$.signingRootVersion') AS signing_root_version,\n            json_extract(scope_json, '$.orgId') || char(31) ||\n            json_extract(scope_json, '$.projectId') || char(31) ||\n            json_extract(scope_json, '$.envId') || char(31) ||\n            json_extract(scope_json, '$.signingRootVersion') AS project_key\n       FROM candidates\n   )\n   SELECT json_group_array(json_object(\n     'scope_json', scopes.scope_json,\n     'project_key', project.record_key, 'project_decision', project.decision,\n     'project_retry_after_ms', project.retry_after_ms,\n     'abuse_key', abuse.record_key, 'abuse_decision', abuse.decision,\n     'abuse_retry_after_ms', abuse.retry_after_ms))\n     FROM scopes\n     LEFT JOIN router_ab_normal_signing_admission_records AS project\n       ON project.namespace = session.namespace AND project.org_id = scopes.org_id\n      AND project.project_id = scopes.project_id AND project.env_id = scopes.env_id\n      AND project.signing_root_version = scopes.signing_root_version\n      AND project.record_kind = 'project_policy' AND project.record_key = scopes.project_key\n     LEFT JOIN router_ab_normal_signing_admission_records AS abuse\n       ON abuse.namespace = session.namespace AND abuse.org_id = scopes.org_id\n      AND abuse.project_id = scopes.project_id AND abuse.env_id = scopes.env_id\n      AND abuse.signing_root_version = scopes.signing_root_version\n      AND abuse.record_kind = 'abuse'\n      AND abuse.record_key = scopes.project_key || char(31) || session.wallet_id || char(31) ||\n          'material_activation:' || ? || char(31) || 'ecdsa'\n  ) AS ecdsa_policy_records_json,";
 //# sourceMappingURL=d1RouterAbNormalSigningAdmissionStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/signingLanes/d1LaneEffectJournalStore.d.ts

@@ -4,7 +4,6 @@ export type CloudflareD1LaneEffectJournalStoreOptions = CloudflareD1LaneStoreOpt
 export declare class CloudflareD1LaneEffectJournalStore implements LaneEffectJournalStore {
     private readonly database;
     private readonly scope;
-    private readonly now;
     constructor(options: CloudflareD1LaneEffectJournalStoreOptions);
     getEffect(input: {
         readonly effectId: string;

package/dist/types/wallet-server/src/router/cloudflare/d1/versionedJson/d1VersionedJsonRecordStore.d.ts

@@ -32,19 +32,6 @@ export type CloudflareD1VersionedJsonRecordBatchPutResultV1 = {
     readonly kind: 'version_mismatch';
     readonly key: string;
 };
-export type CloudflareD1VersionedJsonRecordAtomicPatchV1 = {
-    readonly key: string;
-    readonly expectedVersion: string;
-    readonly exactStringPredicates: readonly {
-        readonly jsonPath: string;
-        readonly value: string;
-    }[];
-    readonly unexpired: {
-        readonly jsonPath: string;
-        readonly nowMs: number;
-    };
-    readonly patch: VersionedJsonObject;
-};
 export declare class CloudflareD1VersionedJsonRecordStoreError extends Error {
     readonly code: 'invalid_record' | 'invalid_response' | 'request_failed';
     constructor(code: 'invalid_record' | 'invalid_response' | 'request_failed', message: string);
@@ -104,9 +91,6 @@ export declare class CloudflareD1VersionedJsonRecordStore<T> {
      * that batch.
      */
     prepareMutationStatements(mutations: readonly CloudflareD1VersionedJsonRecordMutationV1<T>[]): readonly D1PreparedStatementLike[];
-    patchAtomically(input: CloudflareD1VersionedJsonRecordAtomicPatchV1): Promise<VersionedJsonRecordPutResult & {
-        readonly value?: T;
-    }>;
     private prepareBatchMutations;
     private prepareMutationStatement;
     private findBatchConflict;

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAddSignerService.d.ts

@@ -1,3 +1,5 @@
+import type { WalletAddSignerStartSuccess } from '../../../../core/registrationContracts';
+import type { CloudflareD1Ed25519YaoLifecycleDecisionStoreV1 } from '../ed25519Yao/d1Ed25519YaoLifecycleDecisionStore';
 import type { WalletAddSignerFinalizeRequest, WalletAddSignerFinalizeResponse, WalletAddSignerEcdsaActivationRequest, WalletAddSignerEcdsaActivationResponse, WalletAddSignerEcdsaDerivationRespondRequest, WalletAddSignerEcdsaDerivationRespondResponse, WalletAddSignerStartRequest, WalletAddSignerStartResponse } from '../../../../core/registrationContracts';
 import type { D1WalletStore } from '../../../../core/d1WalletStore';
 import type { StoredWalletAddSignerCeremony, StoredAddSignerIntent } from '../../../../core/RegistrationCeremonyStore';
@@ -13,21 +15,17 @@ type StartWalletAddSignerInput = WalletAddSignerStartRequest;
 type RespondWalletAddSignerDerivationInput = WalletAddSignerEcdsaDerivationRespondRequest;
 type ActivateWalletAddSignerEcdsaInput = WalletAddSignerEcdsaActivationRequest;
 type FinalizeWalletAddSignerInput = WalletAddSignerFinalizeRequest;
-type WalletAddSignerStartCoreResponse = (Omit<Extract<WalletAddSignerStartResponse, {
-    readonly ok: true;
-    readonly kind: 'near_ed25519';
+type WalletAddSignerStartCoreResponse = (Omit<Extract<WalletAddSignerStartSuccess, {
+    kind: 'near_ed25519';
 }>, 'ed25519'> & {
-    readonly ed25519: Omit<Extract<WalletAddSignerStartResponse, {
-        readonly ok: true;
-        readonly kind: 'near_ed25519';
+    readonly ed25519: Omit<Extract<WalletAddSignerStartSuccess, {
+        kind: 'near_ed25519';
     }>['ed25519'], 'custodyEnvelope'>;
-}) | (Omit<Extract<WalletAddSignerStartResponse, {
-    readonly ok: true;
-    readonly kind: 'evm_family_ecdsa';
+}) | (Omit<Extract<WalletAddSignerStartSuccess, {
+    kind: 'evm_family_ecdsa';
 }>, 'ecdsa'> & {
-    readonly ecdsa: Omit<Extract<WalletAddSignerStartResponse, {
-        readonly ok: true;
-        readonly kind: 'evm_family_ecdsa';
+    readonly ecdsa: Omit<Extract<WalletAddSignerStartSuccess, {
+        kind: 'evm_family_ecdsa';
     }>['ecdsa'], 'custodyEnvelope'>;
 }) | Extract<WalletAddSignerStartResponse, {
     readonly ok: false;
@@ -38,7 +36,7 @@ type WalletAddSignerStartCoreSuccess = Extract<WalletAddSignerStartCoreResponse,
 type RegistrationCeremonyStoreProvider = () => CloudflareD1RegistrationCeremonyIntentStore;
 type WalletStoreProvider = () => D1WalletStore;
 type Ed25519YaoProductRegistrationProvider = () => RouterAbEd25519YaoProductRegistrationRuntimeV1 | null;
-export type D1WalletAddSignerStartPreparedV1 = {
+type D1WalletAddSignerStartPreparedV1 = {
     readonly kind: 'd1_wallet_add_signer_start_prepared_v1';
     readonly addSignerCeremonyId: string;
     readonly registrationPreparationId: string;
@@ -46,7 +44,7 @@ export type D1WalletAddSignerStartPreparedV1 = {
     readonly storedIntent: StoredAddSignerIntent;
     readonly auth: StoredWalletAddSignerCeremony['auth'];
 };
-export type D1WalletAddSignerStartTerminalV1 = {
+type D1WalletAddSignerStartTerminalV1 = {
     readonly kind: 'd1_wallet_add_signer_start_succeeded_v1';
     readonly ceremony: StoredWalletAddSignerCeremony;
     readonly response: WalletAddSignerStartCoreSuccess;
@@ -79,6 +77,7 @@ export declare class CloudflareD1WalletAddSignerService {
     private readonly passkeyCustodyEnvelopes;
     private readonly startSideEffects;
     private readonly finalizeSideEffects;
+    private readonly yaoLifecycleDecisions;
     constructor(input: {
         readonly getRegistrationCeremonyIntentStore: RegistrationCeremonyStoreProvider;
         readonly getEd25519YaoProductRegistration: Ed25519YaoProductRegistrationProvider;
@@ -89,7 +88,16 @@ export declare class CloudflareD1WalletAddSignerService {
         readonly passkeyCustodyEnvelopes: CloudflareD1PasskeyCustodyEnvelopeStore;
         readonly startSideEffects: D1WalletAddSignerStartSideEffectStore;
         readonly finalizeSideEffects: D1WalletAddSignerFinalizeSideEffectStore;
+        readonly yaoLifecycleDecisions: CloudflareD1Ed25519YaoLifecycleDecisionStoreV1;
     });
+    /**
+     * Commits an added ECDSA signer onto the authority whose passkey authorized
+     * the ceremony: its signer records, the authority extended with the new
+     * activation, and that authority's live Wallet Sessions promoted to it, so the
+     * wallet signs with the new key at once. A retry after the commit finds the
+     * authority already carrying this activation and commits nothing.
+     */
+    private extendOwnerAuthorityWithAddedEcdsaSigner;
     getWalletAddSignerRuntimePolicyScope(addSignerCeremonyId: string): Promise<NonNullable<ReturnType<typeof parseD1RuntimePolicyScope>> | null>;
     startWalletAddSigner(request: StartWalletAddSignerInput): Promise<WalletAddSignerStartResponse>;
     private attachWalletAddSignerCustodyEnvelope;
@@ -108,6 +116,13 @@ export declare class CloudflareD1WalletAddSignerService {
     activateWalletAddSignerEcdsa(request: ActivateWalletAddSignerEcdsaInput): Promise<WalletAddSignerEcdsaActivationResponse>;
     finalizeWalletAddSigner(request: FinalizeWalletAddSignerInput): Promise<WalletAddSignerFinalizeResponse>;
     private executeWalletAddSignerFinalizeSideEffect;
+    /**
+     * Makes an added Ed25519 signer visible with its lifecycle's decision, in
+     * one batch. A finalize that finds its own decision has nothing left to
+     * write. Another decision for the lifecycle, or another signer in the slot,
+     * refuses it.
+     */
+    private decideEd25519YaoSignerVisibility;
     private executeWalletAddSignerFinalize;
 }
 export {};

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthMethodBoundary.d.ts

@@ -1,12 +1,16 @@
-import { type WalletAuthMethodId, type WalletAuthorityId } from '../../../../../../shared-ts/src/utils/domainIds';
-import { type AddAuthMethodIntentV1, type AddSignerIntentV1, type RegistrationAuthority, type WebAuthnRpId, type WalletId, type WalletAuthMethodRevocationProof, type WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import { type WalletAuthMethodId } from '../../../../../../shared-ts/src/utils/domainIds';
+import { type AddAuthMethodIntentV1, type AddSignerIntentV1, type WebAuthnRpId, type WalletId } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import { type WalletAuthMethodRevocationProof } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
+import { type RegistrationAuthority } from '../../../../../../shared-ts/src/utils/registrationAuthMethodInput';
 import { type WalletAuthAuthority } from '../../../../../../shared-ts/src/utils/walletAuthAuthority';
 import type { StoredWalletAddAuthMethodCeremony, StoredWalletAddSignerCeremony } from '../../../../core/RegistrationCeremonyStore';
-import type { WalletAddAuthMethodStartRequest, WalletAddSignerStartRequest, WalletRegistrationFinalizeAuthMethod } from '../../../../core/registrationContracts';
+import type { WalletAddAuthMethodStartRequest, WalletAddSignerStartRequest } from '../../../../core/registrationContracts';
+import type { WalletRegistrationFinalizeAuthMethod } from '../../../../../../shared-ts/src/utils/registrationContracts';
 import type { WalletAuthMethodV2Store } from '../../../../core/d1WalletAuthMethodStore';
 import type { DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
 import type { EmailOtpWalletEnrollmentRecord } from '../../../../core/EmailOtpStores';
-import type { EmailOtpExistingChallengeVerifyInput, EmailOtpExistingChallengeVerifyResult } from '../emailOtp/d1EmailOtpChallengeVerifier';
+import type { EmailOtpExistingChallengeVerifyInput, EmailOtpExistingChallengeBatchVerifyResult, EmailOtpExistingChallengeVerifyResult } from '../emailOtp/d1EmailOtpChallengeVerifier';
+import type { D1PreparedStatementLike } from '../../../../storage/tenantRoute';
 type StartWalletAddSignerInput = WalletAddSignerStartRequest;
 type StartWalletAddAuthMethodInput = WalletAddAuthMethodStartRequest;
 export type D1AddSignerExistingAuthResolution = {
@@ -30,14 +34,6 @@ export declare function walletAuthAuthorityFromRegistrationAuthority(input: {
     readonly authority: RegistrationAuthority;
     readonly walletAuthMethodId: WalletAuthMethodId;
 }): WalletAuthAuthority;
-export declare function walletAuthMethodRecordFromRegistrationAuthority(input: {
-    readonly authority: RegistrationAuthority;
-    readonly walletAuthMethodId: WalletAuthMethodId;
-    readonly walletAuthorityId: WalletAuthorityId;
-    readonly now: number;
-}): Extract<WalletAuthMethodRecordV2, {
-    readonly status: 'active';
-}>;
 export type D1LinkedDeviceFreshRevokeProofV1 = WalletAuthMethodRevocationProof;
 export type D1FreshRevokeWebAuthnVerifierV1 = (input: {
     readonly userId: string;
@@ -61,11 +57,18 @@ export declare function verifyD1LinkedDeviceFreshRevokeProofV1(input: {
     readonly walletAuthMethodStore: Pick<WalletAuthMethodV2Store, 'getPasskeyV2' | 'listForWalletV2'>;
     readonly verifyWebAuthnAuthenticationLite: D1FreshRevokeWebAuthnVerifierV1;
     readonly verifyEmailOtpExisting?: (input: EmailOtpExistingChallengeVerifyInput) => Promise<EmailOtpExistingChallengeVerifyResult>;
+    /**
+     * Given, an Email OTP proof is verified without consuming its challenge,
+     * and the authorization carries the statements that consume it inside the
+     * caller's batch.
+     */
+    readonly verifyEmailOtpExistingForBatch?: (input: EmailOtpExistingChallengeVerifyInput) => Promise<EmailOtpExistingChallengeBatchVerifyResult>;
     readonly readEmailOtpEnrollment?: (walletId: string) => Promise<EmailOtpWalletEnrollmentRecord | null>;
 }): Promise<{
     readonly kind: 'authorized';
     readonly walletAuthMethodId: WalletAuthMethodId;
     readonly verifiedAtMs: number;
+    readonly emailOtpConsumeInBatch?: readonly D1PreparedStatementLike[];
 } | {
     readonly kind: 'denied';
     readonly code: 'unauthorized' | 'invalid';

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthMethodRevocationReplayStore.d.ts

@@ -0,0 +1,71 @@
+import type { WalletAuthMethodRevocationProof } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
+import type { LinkedDeviceRevokeResultV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
+import type { WalletRevokeAuthMethodResponse } from '../../../../core/registrationContracts';
+import type { WalletAuthMethodId, WalletAuthorityId, WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
+import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+type ReplayScope = {
+    readonly namespace: string;
+    readonly orgId: string;
+    readonly projectId: string;
+    readonly envId: string;
+};
+/** The operation and the proof one revocation request presents. */
+export type WalletAuthMethodRevocationReplayIdentityV1 = {
+    readonly walletId: WalletId;
+    readonly targetWalletAuthMethodId: WalletAuthMethodId;
+    readonly operationFingerprintDigestB64u: string;
+    readonly sourceProofDigestB64u: string;
+};
+/**
+ * A digest of the proof a revocation request presents. The recorded answer
+ * is bound to it, so no proof, and no one-time code, is kept.
+ */
+export declare function computeWalletAuthMethodRevocationProofDigestV1(proof: WalletAuthMethodRevocationProof): Promise<string>;
+/**
+ * Each auth-method revocation's committed answer, in the signer database. The
+ * row is inserted in the batch that revokes the method, and never changes.
+ */
+export declare class D1WalletAuthMethodRevocationReplayStoreV1 {
+    private readonly database;
+    private readonly scope;
+    constructor(input: {
+        readonly database: D1DatabaseLike;
+        readonly scope: ReplayScope;
+    });
+    /**
+     * The committed answer to exactly this request: the same operation, proven
+     * by the same proof. Null for a method no revocation committed, or one a
+     * different request revoked.
+     */
+    readExactAnswerV1(identity: WalletAuthMethodRevocationReplayIdentityV1): Promise<WalletRevokeAuthMethodResponse | null>;
+    /** The committed answer to exactly this linked-device revocation request. */
+    readExactLinkedDeviceAnswerV1(identity: WalletAuthMethodRevocationReplayIdentityV1): Promise<LinkedDeviceRevokeResultV1 | null>;
+    private readExactAnswerJson;
+    /**
+     * The statements that record `response` as the answer to this request, for
+     * the batch that revokes the method. They abort the batch unless they
+     * insert it: a method whose revocation already committed commits nothing
+     * more.
+     */
+    prepareRecordAnswerStatements(input: {
+        readonly identity: WalletAuthMethodRevocationReplayIdentityV1;
+        readonly sourceWalletAuthMethodId: WalletAuthMethodId;
+        readonly response: WalletRevokeAuthMethodResponse;
+        readonly committedAtMs: number;
+    }): readonly D1PreparedStatementLike[];
+    /**
+     * The statements that record a linked-device revocation's answer, for the
+     * end of the batch that revokes the device's method. The answer names the
+     * device's authority and its revocation epoch, which the batch itself sets,
+     * so the statement reads them from the row the batch wrote: the record is
+     * the answer that committed. They abort the batch unless they insert it.
+     */
+    prepareRecordLinkedDeviceAnswerStatements(input: {
+        readonly identity: WalletAuthMethodRevocationReplayIdentityV1;
+        readonly sourceWalletAuthMethodId: WalletAuthMethodId;
+        readonly authorityId: WalletAuthorityId;
+        readonly committedAtMs: number;
+    }): readonly D1PreparedStatementLike[];
+}
+export {};
+//# sourceMappingURL=d1WalletAuthMethodRevocationReplayStore.d.ts.map