@seams/wallet-server 0.6.2 → 0.7.3

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthMethodService.d.ts

@@ -1,10 +1,12 @@
 import { type WebAuthnCredentialIdB64u, type WebAuthnRpId, type WalletAuthMethodId, type WalletAuthorityId } from '../../../../../../shared-ts/src/utils/domainIds';
-import { type AddAuthMethodIntentGrant, type AddAuthMethodIntentV1, type AddSignerIntentV1, type RegistrationAuthority, type RegistrationIntentV1, type WalletId, type WalletAuthMethodRevocationProof, type WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import { type AddAuthMethodIntentGrant, type AddAuthMethodIntentV1, type AddSignerIntentV1, type RegistrationIntentV1, type WalletId } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import { type ActivePasskeyWalletAuthMethodRecordV2, type ActiveWalletAuthMethodRecordV2, type WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
+import { type RegistrationAuthority } from '../../../../../../shared-ts/src/utils/registrationAuthMethodInput';
 import { type EmailOtpWalletAuthAuthority, type PasskeyWalletAuthAuthority, type WalletAuthAuthorityRef } from '../../../../../../shared-ts/src/utils/walletAuthAuthority';
 import type { D1PreparedStatementLike } from '../../../../storage/tenantRoute';
 import type { D1WalletAuthMethodStore } from '../../../../core/d1WalletAuthMethodStore';
 import type { StoredWalletAddAuthMethodCeremony } from '../../../../core/RegistrationCeremonyStore';
-import type { WalletAddAuthMethodFinalizeResponse, WalletAddAuthMethodStartRequest, WalletAddAuthMethodStartResponse, WalletAddSignerStartRequest, WalletRegistrationAuthorityInput, WalletRevokeAuthMethodResponse } from '../../../../core/registrationContracts';
+import type { WalletAddAuthMethodFinalizeResponse, WalletAddAuthMethodStartRequest, WalletAddAuthMethodStartResponse, WalletAddSignerStartRequest, WalletRegistrationAuthorityInput } from '../../../../core/registrationContracts';
 import { EMAIL_OTP_CHANNEL } from '../../../../../../shared-ts/src/utils/emailOtpDomain';
 import { CloudflareD1EmailOtpChallengeVerifier } from '../emailOtp/d1EmailOtpChallengeVerifier';
 import type { CloudflareD1EmailOtpRegistrationEnrollmentFinalizer } from '../emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer';
@@ -20,13 +22,12 @@ import type { CloudflareD1PasskeyCustodyEnvelopeStore } from '../passkeyCustody/
 import type { D1WalletAuthorityStore } from './d1WalletAuthorityStore';
 import type { ActiveWalletAuthorityV1 } from '../../../../../../shared-ts/src/authorization/walletAuthority';
 import { type WalletExecutionLaneAuthSource } from '../../../../core/signingLanes/WalletExecutionLaneProjection';
-import type { ActiveWalletSessionAuthorityResolution, FinalizeWalletAddAuthMethodCommand, RevokeWalletAuthMethodCommand, StartWalletAddAuthMethodCommand, WalletAuthMethodRevokeProofVerificationResult, WalletUnlockEmailOtpAuthorityResolution, WalletUnlockPasskeyAuthorityResolution } from '../../../framework/authServicePort';
+import type { ActiveWalletSessionAuthorityResolution, FinalizeWalletAddAuthMethodCommand, RevokeWalletAuthMethodWithFreshProofCommand, RevokeWalletAuthMethodWithFreshProofResult, StartWalletAddAuthMethodCommand, WalletUnlockEmailOtpAuthorityResolution, WalletUnlockPasskeyAuthorityResolution } from '../../../framework/authServicePort';
+import { type D1WalletAuthMethodRevocationReplayStoreV1 } from './d1WalletAuthMethodRevocationReplayStore';
 type StartWalletAddAuthMethodInput = StartWalletAddAuthMethodCommand;
 type StartWalletAddAuthMethodResult = WalletAddAuthMethodStartResponse;
 type FinalizeWalletAddAuthMethodInput = FinalizeWalletAddAuthMethodCommand;
 type FinalizeWalletAddAuthMethodResult = WalletAddAuthMethodFinalizeResponse;
-type RevokeWalletAuthMethodInput = RevokeWalletAuthMethodCommand;
-type RevokeWalletAuthMethodResult = WalletRevokeAuthMethodResponse;
 type OwnerWalletSessionRevocationStatementsV1 = (input: {
     readonly walletId: WalletId;
     readonly walletAuthMethodId: WalletAuthMethodId;
@@ -107,6 +108,7 @@ export declare class CloudflareD1WalletAuthMethodService {
     private readonly orgId;
     private readonly verifyWebAuthnAuthenticationLite;
     private readonly prepareOwnerWalletSessionRevocation;
+    private readonly revocationReplays;
     constructor(input: {
         readonly emailOtpChallengeVerifier: CloudflareD1EmailOtpChallengeVerifier;
         readonly emailOtpEnrollmentChallengeIssuer: EmailOtpEnrollmentChallengeIssuerV1;
@@ -123,6 +125,7 @@ export declare class CloudflareD1WalletAuthMethodService {
         readonly orgId: string;
         readonly verifyWebAuthnAuthenticationLite: D1FreshRevokeWebAuthnVerifierV1;
         readonly prepareOwnerWalletSessionRevocation: OwnerWalletSessionRevocationStatementsV1;
+        readonly revocationReplays: D1WalletAuthMethodRevocationReplayStoreV1;
     });
     /**
      * Sends the enrollment code for an Email OTP addition.
@@ -266,16 +269,15 @@ export declare class CloudflareD1WalletAuthMethodService {
     verifyActivePasskeyAuthority(authority: PasskeyWalletAuthAuthority): Promise<{
         readonly ok: true;
         readonly authority: ActiveWalletAuthorityV1;
-        readonly authMethod: Extract<WalletAuthMethodRecordV2, {
-            readonly kind: 'passkey';
-            readonly status: 'active';
-        }>;
+        readonly authMethod: ActivePasskeyWalletAuthMethodRecordV2;
     } | WalletAuthMethodError>;
     resolveActiveWalletSessionAuthority(input: {
         readonly walletId: WalletId;
         readonly authorityRef: WalletAuthAuthorityRef;
         readonly authSource: WalletExecutionLaneAuthSource;
     }): Promise<ActiveWalletSessionAuthorityResolution>;
+    /** Commits an added signer onto its owner's authority. */
+    extendActiveWalletAuthority(input: Parameters<D1WalletAuthorityStore['extendActiveAuthority']>[0]): Promise<void>;
     resolveActivePasskeyAuthorityForVerifiedCredential(input: {
         readonly walletId: WalletId;
         readonly rpId: WebAuthnRpId;
@@ -284,10 +286,7 @@ export declare class CloudflareD1WalletAuthMethodService {
         readonly ok: true;
         readonly authority: PasskeyWalletAuthAuthority;
         readonly walletAuthority: ActiveWalletAuthorityV1;
-        readonly authMethod: Extract<WalletAuthMethodRecordV2, {
-            readonly kind: 'passkey';
-            readonly status: 'active';
-        }>;
+        readonly authMethod: ActivePasskeyWalletAuthMethodRecordV2;
     } | WalletAuthMethodError>;
     resolveActivePasskeyAuthorityForUnlock(input: {
         readonly walletId: WalletId;
@@ -336,23 +335,34 @@ export declare class CloudflareD1WalletAuthMethodService {
         readonly walletAuthorityId: WalletAuthMethodRecordV2['walletAuthorityId'];
         readonly walletAuthMethodId: WalletAuthMethodRecordV2['walletAuthMethodId'];
         readonly authority: ActiveWalletAuthorityV1;
-        readonly authMethod: Extract<WalletAuthMethodRecordV2, {
-            readonly status: 'active';
-        }>;
+        readonly authMethod: ActiveWalletAuthMethodRecordV2;
     } | null>;
     readActiveRegistrationAuthority(authority: RegistrationAuthority): Promise<{
         readonly authority: ActiveWalletAuthorityV1;
         readonly walletAuthMethodId: WalletAuthMethodId;
     } | null>;
-    verifyWalletAuthMethodRevokeProof(input: {
-        readonly walletId: WalletId;
-        readonly targetWalletAuthMethodId: WalletAuthMethodId;
-        readonly requestedAtMs: number;
-        readonly sourceProof: WalletAuthMethodRevocationProof;
-        readonly expectedOrigin: string;
-    }): Promise<WalletAuthMethodRevokeProofVerificationResult>;
+    /**
+     * Verifies a revocation's source proof: bound to this operation, and from a
+     * different active method on an active full-owner authority. An Email OTP
+     * proof's challenge is left unspent here. The result carries the statements
+     * that spend it, which commit only with the revocation.
+     */
+    private verifyFreshRevokeProof;
     private createPasskeyRegistrationOptions;
-    revokeWalletAuthMethod(input: RevokeWalletAuthMethodInput): Promise<RevokeWalletAuthMethodResult>;
+    /**
+     * Revokes one wallet auth method on a fresh proof from a different active
+     * full-owner method.
+     *
+     * The proof is spent, the method revoked and the answer recorded in one
+     * batch. The record binds the answer to the operation fingerprint and to a
+     * digest of the proof, never the proof or its code. An exact retry is
+     * answered from the record before its proof is examined again, so a request
+     * whose answer was lost receives what committed although its code is spent.
+     * A batch that does not commit spends nothing, so the same request can run
+     * again.
+     */
+    revokeWalletAuthMethodWithFreshProof(input: RevokeWalletAuthMethodWithFreshProofCommand): Promise<RevokeWalletAuthMethodWithFreshProofResult>;
+    private revokeWithVerifiedProof;
     private verifyRegistrationCredentialForIntent;
     private verifyRegistrationPasskeyAuthority;
     private verifyRegistrationEmailOtpAuthority;

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthorityStore.d.ts

@@ -1,28 +1,29 @@
 import { type ActiveWalletAuthorityV1, type PendingWalletAuthorityV1, type WalletAuthorityV1 } from '../../../../../../shared-ts/src/authorization/walletAuthority';
 import { type DeviceId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
 import { type WalletAuthorityId, type WalletAuthMethodId, type WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
-import { type WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import { type ActiveWalletAuthMethodRecordV2, type RevokedWalletAuthMethodRecordV2, type WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
 import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import { type WalletSignerRecord } from '../../../../core/d1WalletStore';
 export type D1WalletAuthorityStoreScope = {
     readonly namespace: string;
     readonly orgId: string;
     readonly projectId: string;
     readonly envId: string;
 };
-export type WalletAuthorityPageCursorV1 = {
+type WalletAuthorityPageCursorV1 = {
     readonly updatedAtMs: number;
     readonly authorityId: WalletAuthorityId;
 };
-export type WalletAuthorityPageV1 = {
+type WalletAuthorityPageV1 = {
     readonly records: readonly WalletAuthorityV1[];
     readonly nextCursor: WalletAuthorityPageCursorV1 | null;
 };
-export type CommittedWalletAuthorityV1 = {
+type CommittedWalletAuthorityV1 = {
     readonly kind: 'committed_wallet_authority_v1';
     readonly authority: PendingWalletAuthorityV1;
     readonly authMethod: WalletAuthMethodRecordV2;
 };
-export type WalletAuthorityCommitResultV1 = CommittedWalletAuthorityV1 | {
+type WalletAuthorityCommitResultV1 = CommittedWalletAuthorityV1 | {
     readonly kind: 'replayed';
     readonly authority: PendingWalletAuthorityV1;
     readonly authMethod: WalletAuthMethodRecordV2;
@@ -30,34 +31,27 @@ export type WalletAuthorityCommitResultV1 = CommittedWalletAuthorityV1 | {
     readonly kind: 'conflict';
     readonly authorityId: WalletAuthorityId;
 };
-export type WalletAuthorityActivationResultV1 = {
+type WalletAuthorityActivationResultV1 = {
     readonly kind: 'activated';
     readonly authority: ActiveWalletAuthorityV1;
-    readonly authMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly status: 'active';
-    }>;
+    readonly authMethod: ActiveWalletAuthMethodRecordV2;
 } | {
     readonly kind: 'replayed';
     readonly authority: ActiveWalletAuthorityV1;
-    readonly authMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly status: 'active';
-    }>;
+    readonly authMethod: ActiveWalletAuthMethodRecordV2;
 } | {
     readonly kind: 'conflict';
     readonly authorityId: WalletAuthorityId;
 };
-export type WalletAuthorityRevocationResultV1 = {
+type WalletAuthorityRevocationResultV1 = {
     readonly kind: 'revoked_method';
-    readonly authMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly status: 'revoked';
-    }>;
+    readonly authMethod: RevokedWalletAuthMethodRecordV2;
     readonly authority: WalletAuthorityV1;
 } | {
     readonly kind: 'would_remove_last_wallet_auth_method';
 } | {
     readonly kind: 'conflict';
 };
-export declare const WALLET_AUTHORITY_STORE_D1_SCHEMA_SQL: readonly ["\n    CREATE TABLE IF NOT EXISTS wallet_authorities (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      authority_id TEXT NOT NULL,\n      wallet_id TEXT NOT NULL,\n      device_id TEXT NOT NULL,\n      provenance_kind TEXT NOT NULL,\n      enrollment_id TEXT,\n      source_authority_id TEXT,\n      link_session_id TEXT,\n      recovery_operation_id TEXT,\n      continuity_authority_id TEXT,\n      lifecycle_state TEXT NOT NULL,\n      permissions_json TEXT NOT NULL,\n      signer_activations_json TEXT NOT NULL,\n      local_install_package_set_digest_b64u TEXT,\n      signer_activation_set_digest_b64u TEXT NOT NULL,\n      authority_digest_b64u TEXT NOT NULL,\n      revocation_epoch INTEGER NOT NULL,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      updated_at_ms INTEGER NOT NULL,\n      activated_at_ms INTEGER,\n      revoked_at_ms INTEGER,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, authority_id),\n      CHECK (length(authority_id) > 0),\n      CHECK (length(wallet_id) > 0),\n      CHECK (length(device_id) > 0),\n      CHECK (provenance_kind IN ('wallet_registration', 'device_link', 'wallet_recovery')),\n      CHECK (lifecycle_state IN ('pending_local_install', 'active', 'revoked')),\n      CHECK (length(permissions_json) > 0 AND json_valid(permissions_json)),\n      CHECK (length(signer_activations_json) > 0 AND json_valid(signer_activations_json)),\n      CHECK (length(record_json) > 0 AND json_valid(record_json)),\n      CHECK (length(signer_activation_set_digest_b64u) > 0),\n      CHECK (length(authority_digest_b64u) > 0),\n      CHECK (revocation_epoch >= 0),\n      CHECK (created_at_ms >= 0),\n      CHECK (updated_at_ms >= created_at_ms),\n      CHECK (\n        (provenance_kind = 'wallet_registration'\n          AND enrollment_id IS NULL\n          AND source_authority_id IS NULL\n          AND link_session_id IS NULL\n          AND recovery_operation_id IS NULL\n          AND continuity_authority_id IS NULL)\n        OR\n        (provenance_kind = 'device_link'\n          AND enrollment_id IS NOT NULL AND length(enrollment_id) > 0\n          AND source_authority_id IS NOT NULL AND length(source_authority_id) > 0\n          AND link_session_id IS NOT NULL AND length(link_session_id) > 0\n          AND recovery_operation_id IS NULL\n          AND continuity_authority_id IS NULL)\n        OR\n        (provenance_kind = 'wallet_recovery'\n          AND enrollment_id IS NULL\n          AND source_authority_id IS NULL\n          AND link_session_id IS NULL\n          AND recovery_operation_id IS NOT NULL\n          AND length(recovery_operation_id) > 0\n          AND continuity_authority_id IS NOT NULL\n          AND length(continuity_authority_id) > 0)\n      ),\n      CHECK (\n        (lifecycle_state = 'pending_local_install'\n          AND local_install_package_set_digest_b64u IS NOT NULL\n          AND length(local_install_package_set_digest_b64u) > 0\n          AND activated_at_ms IS NULL\n          AND revoked_at_ms IS NULL\n          AND revocation_epoch = 0)\n        OR\n        (lifecycle_state = 'active'\n          AND local_install_package_set_digest_b64u IS NULL\n          AND activated_at_ms IS NOT NULL\n          AND revoked_at_ms IS NULL)\n        OR\n        (lifecycle_state = 'revoked'\n          AND local_install_package_set_digest_b64u IS NULL\n          AND activated_at_ms IS NOT NULL\n          AND revoked_at_ms IS NOT NULL)\n      ),\n      CHECK (json_extract(record_json, '$.authorityId') = authority_id),\n      CHECK (json_extract(record_json, '$.walletId') = wallet_id),\n      CHECK (json_extract(record_json, '$.state') = lifecycle_state),\n      CHECK (json_extract(record_json, '$.revocationEpoch') = revocation_epoch),\n      CHECK (json_extract(record_json, '$.authorityDigestB64u') = authority_digest_b64u),\n      CHECK (\n        json_extract(record_json, '$.signerActivationSetDigestB64u')\n          = signer_activation_set_digest_b64u\n      )\n    )\n  ", "\n    CREATE UNIQUE INDEX IF NOT EXISTS wallet_authorities_active_device_uidx\n      ON wallet_authorities (\n        namespace, org_id, project_id, env_id, wallet_id, device_id\n      )\n      WHERE lifecycle_state <> 'revoked'\n  ", "\n    CREATE UNIQUE INDEX IF NOT EXISTS wallet_authorities_enrollment_uidx\n      ON wallet_authorities (\n        namespace, org_id, project_id, env_id, wallet_id, enrollment_id\n      )\n      WHERE enrollment_id IS NOT NULL\n  ", "\n    CREATE INDEX IF NOT EXISTS wallet_authorities_inventory_idx\n      ON wallet_authorities (\n        namespace, org_id, project_id, env_id, wallet_id, lifecycle_state,\n        updated_at_ms, authority_id\n      )\n  ", "\n    CREATE TABLE IF NOT EXISTS wallet_authority_cas_guard (\n      guard_id INTEGER PRIMARY KEY CHECK (guard_id = 1)\n    )\n  ", "\n    INSERT OR IGNORE INTO wallet_authority_cas_guard (guard_id) VALUES (1)\n  "];
 type AuthorityRow = {
     readonly authority_id?: unknown;
     readonly wallet_id?: unknown;
@@ -87,6 +81,19 @@ export declare function prepareD1WalletAuthorityPutStatement(input: {
     readonly scope: D1WalletAuthorityStoreScope;
     readonly authority: WalletAuthorityV1;
 }): D1PreparedStatementLike;
+/**
+ * Replaces one active authority with its extension, only if the stored row is
+ * still exactly `expected`. Pair it with the CAS guard so a lost race aborts
+ * the whole batch.
+ */
+export declare function prepareD1WalletAuthorityExtensionStatement(input: {
+    readonly database: D1DatabaseLike;
+    readonly scope: D1WalletAuthorityStoreScope;
+    readonly expected: ActiveWalletAuthorityV1;
+    readonly next: ActiveWalletAuthorityV1;
+}): D1PreparedStatementLike;
+/** Aborts the batch when the preceding authority extension changed no row. */
+export declare function prepareD1WalletAuthorityExtensionCasGuard(database: D1DatabaseLike): D1PreparedStatementLike;
 export declare class WalletAuthorityCommitConflictError extends Error {
     readonly kind = "wallet_authority_commit_conflict";
     constructor(authorityId: WalletAuthorityId);
@@ -106,6 +113,19 @@ export declare class D1WalletAuthorityStore {
         readonly ensureSchema?: boolean;
     });
     private ensureSchema;
+    /**
+     * Commits an added signer: its signer records, the authority extended with
+     * its activation, and every live Wallet Session of that authority promoted to
+     * the extended authority, all at once. Each session keeps its identity,
+     * quota and operation-credential hash; promotion retires its hosted
+     * credentials and deletes its unredeemed hosted exchange codes.
+     */
+    extendActiveAuthority(input: {
+        readonly expected: ActiveWalletAuthorityV1;
+        readonly next: ActiveWalletAuthorityV1;
+        readonly walletSigners: readonly WalletSignerRecord[];
+        readonly promotionAtMs: number;
+    }): Promise<void>;
     readById(authorityId: WalletAuthorityId): Promise<WalletAuthorityV1 | null>;
     readByWalletAndDevice(input: {
         readonly walletId: WalletId;
@@ -128,9 +148,7 @@ export declare class D1WalletAuthorityStore {
         readonly pendingAuthority: PendingWalletAuthorityV1;
         readonly activeAuthority: ActiveWalletAuthorityV1;
         readonly pendingAuthMethod: WalletAuthMethodRecordV2;
-        readonly activeAuthMethod: Extract<WalletAuthMethodRecordV2, {
-            readonly status: 'active';
-        }>;
+        readonly activeAuthMethod: ActiveWalletAuthMethodRecordV2;
     }): Promise<WalletAuthorityActivationResultV1>;
     /**
      * Activates authority records together with caller-owned D1 statements.
@@ -141,9 +159,7 @@ export declare class D1WalletAuthorityStore {
         readonly pendingAuthority: PendingWalletAuthorityV1;
         readonly activeAuthority: ActiveWalletAuthorityV1;
         readonly pendingAuthMethod: WalletAuthMethodRecordV2;
-        readonly activeAuthMethod: Extract<WalletAuthMethodRecordV2, {
-            readonly status: 'active';
-        }>;
+        readonly activeAuthMethod: ActiveWalletAuthMethodRecordV2;
     }, additionalStatements: readonly D1PreparedStatementLike[]): Promise<WalletAuthorityActivationResultV1>;
     listForWallet(input: {
         readonly walletId: WalletId;
@@ -158,11 +174,13 @@ export declare class D1WalletAuthorityStore {
         readonly expectedAuthorityRevocationEpoch: number;
         readonly requestedAtMs: number;
         readonly sessionRevocationStatements?: readonly D1PreparedStatementLike[];
+        /**
+         * Run last, after the method and its authority are written, so they can
+         * read what the revocation wrote. They commit with it or not at all.
+         */
+        readonly trailingStatements?: readonly D1PreparedStatementLike[];
     }): Promise<WalletAuthorityRevocationResultV1>;
     private readAuthMethodById;
 }
-export declare class D1WalletAuthorityStoreV1 extends D1WalletAuthorityStore {
-}
-export type CloudflareD1WalletAuthorityStore = D1WalletAuthorityStore;
 export {};
 //# sourceMappingURL=d1WalletAuthorityStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/webauthn/d1WebAuthnRecords.d.ts

@@ -2,35 +2,22 @@ import { type PasskeyEnvelopeId, type WalletAuthorityId, type WalletAuthMethodId
 import { type DeviceId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
 import { type ActiveWalletAuthorityV1 } from '../../../../../../shared-ts/src/authorization/walletAuthority';
 import { type EnvelopeRevision, type PasskeyCustodyEnvelopeRecord } from '../../../../../../shared-ts/src/passkey-custody';
-import { type WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import { type ActiveWalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
 import { type RecoveryCodeReservationId } from '../../../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation';
 import { type WebAuthnAuthenticatorDeviceInfo } from '../../../../../../shared-ts/src/utils/webauthnDeviceInfo';
 import type { WebAuthnCredentialBindingRecord as CoreWebAuthnCredentialBindingRecord } from '../../../../core/WebAuthnCredentialBindingStore';
-export type D1AuthenticatorRow = {
-    readonly credential_id_b64u?: unknown;
-    readonly credential_public_key_b64u?: unknown;
-    readonly counter?: unknown;
-    readonly created_at_ms?: unknown;
-    readonly updated_at_ms?: unknown;
-    readonly device_info_json?: unknown;
-};
+import type { D1WebAuthnAuthenticatorRow } from '../../../../core/WebAuthnAuthenticatorStore';
+import type { WebAuthnLoginChallengeRecord as CoreWebAuthnLoginChallengeRecord } from '../../../../core/WebAuthnLoginChallengeStore';
+import type { WebAuthnSyncChallengeRecord as CoreWebAuthnSyncChallengeRecord } from '../../../../core/WebAuthnSyncChallengeStore';
+import type { NearPublicKeyAuthBinding } from '../../../../core/NearPublicKeyStore';
+import type { ResolvedEd25519WalletBinding } from '../../../../core/authService/webauthnWalletBinding';
+export type D1AuthenticatorRow = D1WebAuthnAuthenticatorRow;
 export type D1RecordJsonRow = {
     readonly record_json?: unknown;
 };
 export type WebAuthnCredentialBindingRecord = CoreWebAuthnCredentialBindingRecord;
-export type WebAuthnSyncWalletBinding = {
-    readonly walletId: string;
-    readonly nearAccountId: string;
-    readonly nearEd25519SigningKeyId: string;
-    readonly rpId: string;
-    readonly credentialIdB64u: string;
-    readonly signerSlot: number;
-};
-export type NearPublicKeyAuthBinding = {
-    readonly kind: 'passkey';
-    readonly rpId: WebAuthnRpId;
-    readonly credentialIdB64u: string;
-};
+export type WebAuthnSyncWalletBinding = Readonly<ResolvedEd25519WalletBinding>;
+export type { NearPublicKeyAuthBinding };
 export type NearPublicKeyRecord = {
     readonly publicKey: string;
     readonly kind: 'threshold' | 'local' | 'backup' | 'ephemeral';
@@ -50,24 +37,8 @@ export type WebAuthnAuthenticatorRecord = {
     readonly deviceInfo: WebAuthnAuthenticatorDeviceInfo;
 };
 export declare function parseWebAuthnAuthenticatorRowDeviceInfo(raw: unknown): WebAuthnAuthenticatorDeviceInfo;
-export type WebAuthnLoginChallengeRecord = {
-    readonly version: 'webauthn_login_challenge_v1';
-    readonly challengeId: string;
-    readonly userId: string;
-    readonly rpId: string;
-    readonly challengeB64u: string;
-    readonly createdAtMs: number;
-    readonly expiresAtMs: number;
-};
-export type WebAuthnSyncChallengeRecord = {
-    readonly version: 'webauthn_sync_challenge_v1';
-    readonly challengeId: string;
-    readonly rpId: string;
-    readonly expectedUserId?: string;
-    readonly challengeB64u: string;
-    readonly createdAtMs: number;
-    readonly expiresAtMs: number;
-};
+export type WebAuthnLoginChallengeRecord = Readonly<CoreWebAuthnLoginChallengeRecord>;
+export type WebAuthnSyncChallengeRecord = Readonly<CoreWebAuthnSyncChallengeRecord>;
 /**
  * The exact continuity snapshot selected by prepare. The snapshot is stored
  * inside the one-shot challenge so finalization cannot silently switch to a
@@ -76,9 +47,7 @@ export type WebAuthnSyncChallengeRecord = {
 export type WebAuthnRecoveryContinuityAnchorRecord = {
     readonly kind: 'wallet_recovery_continuity_anchor_v1';
     readonly authority: ActiveWalletAuthorityV1;
-    readonly method: Extract<WalletAuthMethodRecordV2, {
-        readonly status: 'active';
-    }>;
+    readonly method: ActiveWalletAuthMethodRecordV2;
     readonly envelope: WebAuthnRecoveryContinuityEnvelopeAnchorRecord;
 };
 export type WebAuthnRecoveryContinuityEnvelopeAnchorRecord = {
@@ -123,9 +92,7 @@ export declare function parseWebAuthnSyncChallengeRecord(input: unknown): WebAut
 export declare function parseWebAuthnRecoveryRegistrationChallengeRecord(input: unknown): WebAuthnRecoveryRegistrationChallengeRecord | null;
 export declare function buildWebAuthnRecoveryContinuityAnchorRecord(input: {
     readonly authority: ActiveWalletAuthorityV1;
-    readonly method: Extract<WalletAuthMethodRecordV2, {
-        readonly status: 'active';
-    }>;
+    readonly method: ActiveWalletAuthMethodRecordV2;
     readonly envelope: PasskeyCustodyEnvelopeRecord;
 }): WebAuthnRecoveryContinuityAnchorRecord;
 export declare function parseWebAuthnAuthenticator(row: D1AuthenticatorRow | null): WebAuthnAuthenticatorRecord | null;

package/dist/types/wallet-server/src/router/cloudflare/d1/webauthn/d1WebAuthnStore.d.ts

@@ -1,34 +1,23 @@
 import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import { type D1TenantScope } from '../../../../core/d1TenantStore';
 import { type WebAuthnCredentialBindingRecord } from '../../../../core/WebAuthnCredentialBindingStore';
 import { type D1AuthenticatorRow, type WebAuthnAuthenticatorRecord, type WebAuthnRecoveryRegistrationChallengeRecord, type WebAuthnLoginChallengeRecord, type WebAuthnSyncChallengeRecord } from './d1WebAuthnRecords';
 type WebAuthnChallengeKind = 'login' | 'sync' | 'recovery_registration';
-export type D1WebAuthnStoreScope = {
-    readonly namespace: string;
-    readonly orgId: string;
-    readonly projectId: string;
-    readonly envId: string;
-};
-export declare function prepareD1WebAuthnAuthenticatorPutStatement(input: {
+export type D1WebAuthnStoreScope = D1TenantScope;
+type AuthenticatorStatementInput = {
     readonly database: D1DatabaseLike;
     readonly scope: D1WebAuthnStoreScope;
     readonly userId: string;
     readonly record: WebAuthnAuthenticatorRecord;
-}): D1PreparedStatementLike;
+};
+export declare function prepareD1WebAuthnAuthenticatorPutStatement(input: AuthenticatorStatementInput): D1PreparedStatementLike;
 /** Insert-only variant used by recovery promotion. A credential collision must
  * abort the surrounding envelope/code transaction instead of reassigning an
  * existing authenticator's public key. */
-export declare function prepareD1WebAuthnAuthenticatorInsertStatement(input: {
-    readonly database: D1DatabaseLike;
-    readonly scope: D1WebAuthnStoreScope;
-    readonly userId: string;
-    readonly record: WebAuthnAuthenticatorRecord;
-}): D1PreparedStatementLike;
+export declare function prepareD1WebAuthnAuthenticatorInsertStatement(input: AuthenticatorStatementInput): D1PreparedStatementLike;
 export declare class CloudflareD1WebAuthnStore {
     private readonly database;
-    private readonly namespace;
-    private readonly orgId;
-    private readonly projectId;
-    private readonly envId;
+    private readonly scope;
     constructor(input: {
         readonly database: D1DatabaseLike;
         readonly namespace: string;
@@ -83,7 +72,7 @@ export declare class CloudflareD1WebAuthnStore {
         readonly rpId?: string;
     }): Promise<WebAuthnCredentialBindingRecord[]>;
     private consumeChallenge;
-    private prepare;
+    private readonly prepare;
 }
 export {};
 //# sourceMappingURL=d1WebAuthnStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/runtime/walletConsoleOps.d.ts

@@ -1,5 +1,6 @@
 import type { TenantRootIdentityFieldV1, TenantRootIdentityWireV1 } from '../../../../../shared-ts/src/tenant-root';
-import type { RouterApiCredentialScope } from '../../framework/apiCredentialPorts';
+import type { RouterApiCredentialScope, RouterApiKeyAuthRequest, RouterApiProjectEnvironment, RouterApiPublishableKeyAuthRequest, RouterApiUsageMeterEvent } from '../../framework/apiCredentialPorts';
+import type { ReadonlyExclusiveUnion } from '../../../../../shared-ts/src/utils/variant';
 export declare const WALLET_CONSOLE_OPS_BASE_PATH_V1 = "/internal/wallet-console/v1";
 export declare const WALLET_CONSOLE_SERVICE_ORIGIN_V1 = "https://wallet-console.internal";
 export declare const WALLET_CONSOLE_OP_PATHS_V1: {
@@ -9,12 +10,7 @@ export declare const WALLET_CONSOLE_OP_PATHS_V1: {
     readonly projectEnvironments: "/internal/wallet-console/v1/project-environments";
     readonly tenantRootActiveLineage: "/internal/wallet-console/v1/tenant-root/active-lineage";
 };
-export interface WalletConsoleSecretKeyAuthRequestV1 {
-    readonly secret: string;
-    readonly endpoint: string;
-    readonly requiredScopes: RouterApiCredentialScope[];
-    readonly sourceIp?: string;
-    readonly environmentId?: string;
+export interface WalletConsoleSecretKeyAuthRequestV1 extends Readonly<RouterApiKeyAuthRequest> {
 }
 export interface WalletConsolePrincipalV1 {
     readonly apiKeyId: string;
@@ -33,23 +29,10 @@ export type WalletConsoleSecretKeyAuthResponseV1 = {
     readonly code: string;
     readonly message: string;
 };
-export interface WalletConsolePublishableKeyAuthRequestV1 {
-    readonly secret: string;
-    readonly origin: string;
-    readonly environmentId: string;
+export interface WalletConsolePublishableKeyAuthRequestV1 extends Readonly<RouterApiPublishableKeyAuthRequest> {
 }
 export type WalletConsolePublishableKeyAuthResponseV1 = WalletConsoleSecretKeyAuthResponseV1;
-export interface WalletConsoleUsageEventV1 {
-    readonly orgId: string;
-    readonly environmentId: string;
-    readonly apiKeyId: string;
-    readonly endpoint: string;
-    readonly walletId: string;
-    readonly action: 'wallet_created';
-    readonly succeeded: boolean;
-    readonly occurredAt?: string;
-    /** Producer-owned idempotency key; replays with the same id must not double-count. */
-    readonly sourceEventId?: string;
+export interface WalletConsoleUsageEventV1 extends Readonly<RouterApiUsageMeterEvent> {
 }
 export interface WalletConsoleUsageEventsResponseV1 {
     readonly ok: boolean;
@@ -68,12 +51,7 @@ export interface WalletConsoleProjectEnvironmentsRequestV1 {
         readonly status?: string;
     };
 }
-export interface WalletConsoleProjectEnvironmentV1 {
-    readonly id: string;
-    readonly projectId: string;
-    readonly key: string;
-    readonly signingRootVersion: string;
-    readonly status?: string;
+export interface WalletConsoleProjectEnvironmentV1 extends Readonly<RouterApiProjectEnvironment> {
 }
 export interface WalletConsoleProjectEnvironmentsResponseV1 {
     readonly ok: boolean;
@@ -87,19 +65,15 @@ export interface WalletConsoleTenantRootActiveLineageV1 {
     readonly identityDigestB64u: string;
     readonly custodyLineageB64u: string;
 }
-export type WalletConsoleTenantRootActiveLineageResponseV1 = {
+export type WalletConsoleTenantRootActiveLineageResponseV1 = ReadonlyExclusiveUnion<{
     readonly ok: true;
     readonly identityDigestB64u: string;
     readonly custodyLineageB64u: string;
-    readonly code?: never;
-    readonly message?: never;
 } | {
     readonly ok: false;
     readonly code: 'invalid_body' | 'tenant_root_active_lineage_not_found';
     readonly message: string;
-    readonly identityDigestB64u?: never;
-    readonly custodyLineageB64u?: never;
-};
+}>;
 export type WalletConsoleDecodeResult<T, E> = {
     readonly ok: true;
     readonly value: T;

package/dist/types/wallet-server/src/router/cloudflare/runtime/walletConsoleTenantRootLineage.d.ts

@@ -1,7 +1,8 @@
 import type { RouterApiProjectEnvironmentResolver } from '../../framework/apiCredentialPorts';
 import { type RuntimePolicyScope } from '../../../../../shared-ts/src/threshold/signingRootScope';
+import type { TenantRootRuntimeActiveLineageV1 } from '../../domains/tenantRoot/tenantRootCustodyLineage';
 import type { WalletConsoleTenantRootActiveLineageResolverV1 } from './walletConsoleOps';
 export declare function resolveRuntimeTenantRootLineage(environments: RouterApiProjectEnvironmentResolver, roots: WalletConsoleTenantRootActiveLineageResolverV1, scope: RuntimePolicyScope & {
     readonly signingRootId: string;
-}): Promise<import("./walletConsoleOps").WalletConsoleTenantRootActiveLineageV1 | null>;
+}): Promise<TenantRootRuntimeActiveLineageV1 | null>;
 //# sourceMappingURL=walletConsoleTenantRootLineage.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/runtime/walletGateway.d.ts

@@ -23,6 +23,7 @@ export interface CloudflareWalletGatewayRouterOptionsV1 {
     readonly walletConsole: WalletConsoleServiceBinding;
     readonly signerDatabase: CloudflareD1RouterAbNormalSigningAdmissionStoreOptions['database'];
     readonly signerStorageNamespace: string;
+    readonly routeExtensions?: readonly RouterApiRouteExtension[];
     readonly router: Omit<RouterApiOptions, WalletGatewayManagedRouterOption>;
 }
 export declare function createCloudflareWalletGatewayRouterV1(input: CloudflareWalletGatewayRouterOptionsV1): FetchHandler;

package/dist/types/wallet-server/src/router/cloudflare/signingLanes/cloudflareOrdinaryInactiveSignerMaterialReservation.d.ts

@@ -2,7 +2,7 @@ import { type OrdinaryEcdsaSignerMaterialReservationRequestV1, type OrdinaryEcds
 import { type LinkedDeviceEd25519SourceContributionPreparationV1 } from '../../../../../shared-ts/src/device-linking/sourceContribution';
 import type { DeviceLinkingEd25519SourcePreservingRouterPortV1 } from '../../transport/fetch/routes/deviceLinking';
 import type { OrdinaryInactiveSignerMaterialActivationPortV1 } from '../d1/deviceLinking/d1LinkedDeviceAuthorityInstallService';
-import type { TenantRootActiveLineageV1 } from '../../domains/tenantRoot/tenantRootCustodyLineage';
+import { type RouterAbEd25519YaoResolvedTenantRootV1 } from '../../domains/ed25519Yao/routerAbEd25519YaoGatewayEnvelope';
 import type { OrdinaryEcdsaSignerMaterialReservationPreparationV1, OrdinaryEd25519SignerMaterialReservationPreparationV1 } from '../../../core/signingMaterial/ordinaryInactiveSignerMaterialReservation';
 /** Source-preserving ordinary material paths implemented by the Cloudflare workers. */
 export declare const CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1: "/router-ab/router/ed25519-yao/execute-source-preserving";
@@ -11,6 +11,16 @@ export declare const CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_
 export declare const CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1: "/router-ab/signing-worker/ecdsa-derivation/activate-reservation";
 export declare const CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1: "/router-ab/signing-worker/ed25519-yao/deactivate-reservation";
 export declare const CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1: "/router-ab/signing-worker/ecdsa-derivation/deactivate-reservation";
+/**
+ * The tenant this Gateway serves. With one of its wallets it names the
+ * SigningWorker wallet object that holds that wallet's material, and the
+ * SigningWorker checks the wallet against the source activation it holds.
+ */
+export type CloudflareSigningWorkerTenantV1 = {
+    readonly orgId: string;
+    readonly projectId: string;
+    readonly envId: string;
+};
 /**
  * Boundary for the dedicated ordinary reservation operation. Its response is
  * deliberately unknown until the core reservation parser has checked the
@@ -26,7 +36,7 @@ export type CloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1 = Devi
 export declare function createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1(input: {
     readonly fetch: typeof fetch;
     readonly internalServiceAuthSecret: string;
-    readonly resolveTenantRoot: (context: Pick<LinkedDeviceEd25519SourceContributionPreparationV1, 'applicationBinding' | 'targetAdmission' | 'participantIds'>) => Promise<TenantRootActiveLineageV1>;
+    readonly resolveTenantRoot: (context: Pick<LinkedDeviceEd25519SourceContributionPreparationV1, 'applicationBinding' | 'targetAdmission' | 'participantIds'>) => Promise<RouterAbEd25519YaoResolvedTenantRootV1>;
 }): CloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1;
 export type CloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1 = {
     activateInactiveEd25519SignerMaterialV1(input: {
@@ -49,14 +59,17 @@ export type CloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1 = {
 export declare function createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1(input: {
     readonly fetch: typeof fetch;
     readonly internalServiceAuthSecret: string;
+    readonly tenant: CloudflareSigningWorkerTenantV1;
 }): CloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1;
 export declare function createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1(input: {
     readonly fetch: typeof fetch;
     readonly internalServiceAuthSecret: string;
+    readonly tenant: CloudflareSigningWorkerTenantV1;
 }): CloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1;
 export declare function createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1(input: {
     readonly fetch: typeof fetch;
     readonly internalServiceAuthSecret: string;
+    readonly tenant: CloudflareSigningWorkerTenantV1;
 }): CloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1;
 /**
  * Adapter for the ordinary inactive reservation endpoint. The endpoint owns

package/dist/types/wallet-server/src/router/cloudflare-adaptor.d.ts

@@ -1,9 +1,9 @@
 export type { RouterApiKeyAuthAdapter, RouterApiKeyAuthFailureCode, RouterApiKeyAuthRequest, RouterApiKeyAuthResult, RouterApiKeyPrincipal, RouterApiOptions, RouterApiPublishableKeyAuthAdapter, RouterApiPublishableKeyAuthFailureCode, RouterApiPublishableKeyAuthRequest, RouterApiPublishableKeyAuthResult, RouterApiRuntimePolicyScope, RouterApiRuntimeSnapshotConsumer, RouterApiRuntimeSnapshotEnvelope, RouterApiUsageMeterAction, RouterApiUsageMeterAdapter, RouterApiUsageMeterEvent, } from './framework/routerApi';
 export { ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, parseRouterAbPublicKeysetV2, } from '../../../shared-ts/src/utils/routerAbPublicKeyset';
 export type { RouterAbPublicKeysetV2 } from '../../../shared-ts/src/utils/routerAbPublicKeyset';
-export type { RouterAbNormalSigningAdmissionAdapter, RouterAbNormalSigningAdmissionFailure, RouterAbNormalSigningAdmissionFailureCode, RouterAbNormalSigningAdmissionInput, RouterAbNormalSigningAdmissionResult, } from './domains/signingOperations/routerAbPrivateSigningWorker';
+export type { RouterAbNormalSigningAdmissionAdapter, RouterAbNormalSigningAdmissionFailure, RouterAbNormalSigningAdmissionFailureCode, RouterAbNormalSigningAdmissionInput, RouterAbNormalSigningAdmissionResult, } from './domains/signingOperations/routerAbNormalSigningAdmission';
 export { InMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createRouterAbNormalSigningAdmissionAdapter, } from './domains/signingOperations/routerAbNormalSigningAdmissionCore';
-export type { RouterAbNormalSigningAbuseDecision, RouterAbNormalSigningAbuseProvider, RouterAbNormalSigningAdmissionStore, RouterAbNormalSigningProjectPolicyDecision, RouterAbNormalSigningProjectPolicyProvider, } from './domains/signingOperations/routerAbNormalSigningAdmissionCore';
+export type { RouterAbNormalSigningAbuseDecision, RouterAbNormalSigningPolicyDecision, RouterAbNormalSigningAdmissionStore, RouterAbNormalSigningProjectPolicyDecision, } from './domains/signingOperations/routerAbNormalSigningAdmissionCore';
 export { CloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1RouterAbNormalSigningAdmissionStore, } from './cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore';
 export type { CloudflareD1RouterAbNormalSigningAdmissionStoreOptions } from './cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore';
 export type { RouterApiFetchRouteExtension, RouterApiFetchRouteExtensionInput, RouterApiRouteExtension, RouterApiRouteExtensionTransport, } from './framework/routeExtensions';