@seams/wallet-server 0.6.2 → 0.7.3

package/dist/types/wallet-server/src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.d.ts

@@ -1,6 +1,6 @@
 import type { VersionedJsonRecordPutResult, VersionedJsonRecordReadResult } from '../../../framework/versionedJsonRecordStore';
 export type RouterAbEd25519YaoRegistrationSideEffectOperationV1 = 'finalize' | 'registration_activate' | 'near_provisioning' | 'registration_start' | 'add_signer_start' | 'add_signer_finalize';
-export type RouterAbEd25519YaoRetryableSideEffectFailureV1 = {
+type RouterAbEd25519YaoRetryableSideEffectFailureV1 = {
     readonly ok: false;
     readonly code: string;
     readonly message: string;
@@ -40,7 +40,7 @@ export interface RouterAbEd25519YaoRegistrationSideEffectStoreV1<T, P> {
  * claim remains shared with the older journal shape because it contains no
  * response or bearer material.
  */
-export type RouterAbEd25519YaoRegistrationSideEffectCompletionV2<C, P> = {
+type RouterAbEd25519YaoRegistrationSideEffectCompletionV2<C, P> = {
     readonly kind: 'router_ab_ed25519_yao_registration_side_effect_completion_v2';
     readonly operation: RouterAbEd25519YaoRegistrationSideEffectOperationV1;
     readonly requestFingerprint: string;
@@ -70,7 +70,7 @@ export declare function parseRouterAbEd25519YaoRegistrationSideEffectRecordV1<T,
  * broadcast it without observing the outcome. Execution must reconcile before
  * it repeats any network effect.
  */
-export type RouterAbEd25519YaoRegistrationSideEffectAttemptV1 = 'fresh' | 'resumed';
+type RouterAbEd25519YaoRegistrationSideEffectAttemptV1 = 'fresh' | 'resumed';
 export type RouterAbEd25519YaoRegistrationSideEffectRunInputV1<T, P> = {
     readonly kind: 'prepared_resumable';
     readonly operation: RouterAbEd25519YaoRegistrationSideEffectOperationV1;
@@ -107,7 +107,7 @@ export type RouterAbEd25519YaoRegistrationSideEffectRunResultV1<T, P> = {
  * or allowing a network effect.
  */
 export declare function runRouterAbEd25519YaoRegistrationSideEffectV1<T, P>(store: RouterAbEd25519YaoRegistrationSideEffectStoreV1<T, P>, input: RouterAbEd25519YaoRegistrationSideEffectRunInputV1<T, P>): Promise<RouterAbEd25519YaoRegistrationSideEffectRunResultV1<T, P>>;
-export type RouterAbEd25519YaoRegistrationSideEffectRunInputV2<T, C, P> = {
+type RouterAbEd25519YaoRegistrationSideEffectRunInputV2<T, C, P> = {
     readonly kind: 'prepared_resumable';
     readonly operation: RouterAbEd25519YaoRegistrationSideEffectOperationV1;
     readonly key: string;
@@ -120,7 +120,7 @@ export type RouterAbEd25519YaoRegistrationSideEffectRunInputV2<T, C, P> = {
     readonly projectReceipt: (response: T) => Promise<C> | C;
     readonly replay: (receipt: C) => Promise<T>;
 };
-export type RouterAbEd25519YaoRegistrationSideEffectRunResultV2<T, P> = RouterAbEd25519YaoRegistrationSideEffectRunResultV1<T, P>;
+type RouterAbEd25519YaoRegistrationSideEffectRunResultV2<T, P> = RouterAbEd25519YaoRegistrationSideEffectRunResultV1<T, P>;
 /**
  * Registration-only journal runner. Completion CAS stores a credential-free
  * receipt instead of the public response, and replay rebuilds the committed
@@ -128,4 +128,5 @@ export type RouterAbEd25519YaoRegistrationSideEffectRunResultV2<T, P> = RouterAb
  * from its digest, so replay never reconstructs one.
  */
 export declare function runRouterAbEd25519YaoRegistrationSideEffectV2<T, C, P>(store: RouterAbEd25519YaoRegistrationSideEffectStoreV2<C, P>, input: RouterAbEd25519YaoRegistrationSideEffectRunInputV2<T, C, P>): Promise<RouterAbEd25519YaoRegistrationSideEffectRunResultV2<T, P>>;
+export {};
 //# sourceMappingURL=routerAbEd25519YaoRegistrationSideEffectBoundary.d.ts.map

package/dist/types/wallet-server/src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationTwoPhaseRunner.d.ts

@@ -1,5 +1,5 @@
 import type { RouterAbEd25519YaoProductRegistrationStateV1 } from '../capabilityLifecycle/routerAbEd25519YaoProductRegistration';
-import type { RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1 } from '../capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore';
+import type { RouterAbEd25519YaoPreparedWriteV1, RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1 } from '../capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore';
 export type RouterAbEd25519YaoRegistrationTwoPhaseBackendResultV1<T> = {
     readonly kind: 'response';
     readonly value: T;
@@ -18,9 +18,19 @@ export type RouterAbEd25519YaoRegistrationTwoPhasePrepareResultV1<TClaim, TRespo
     readonly kind: 'rejected';
     readonly value: TRejection;
 };
-export type RouterAbEd25519YaoRegistrationTwoPhaseCompletionV1<TResponse> = {
+export type RouterAbEd25519YaoRegistrationTwoPhaseCompletionV1<TResponse> = 
+/** The terminal state commits alone. */
+{
+    readonly kind: 'state';
     readonly state: RouterAbEd25519YaoProductRegistrationStateV1;
     readonly value: TResponse;
+}
+/** The terminal state commits with another store's prepared writes, or neither does. */
+ | {
+    readonly kind: 'state_with_write';
+    readonly state: RouterAbEd25519YaoProductRegistrationStateV1;
+    readonly value: TResponse;
+    readonly write: RouterAbEd25519YaoPreparedWriteV1;
 };
 export type RouterAbEd25519YaoRegistrationTwoPhaseRunResultV1<TClaim, TResponse, TRejection> = {
     readonly kind: 'committed';
@@ -35,7 +45,7 @@ export type RouterAbEd25519YaoRegistrationTwoPhaseRunResultV1<TClaim, TResponse,
     readonly value: TRejection;
 } | {
     readonly kind: 'preclaim_version_mismatch';
-    readonly key: 'shared' | 'ceremony' | 'execution';
+    readonly key: 'shared' | 'ceremony';
 } | {
     readonly kind: 'backend_uncertain';
     readonly claim: TClaim;
@@ -43,7 +53,7 @@ export type RouterAbEd25519YaoRegistrationTwoPhaseRunResultV1<TClaim, TResponse,
 } | {
     readonly kind: 'terminal_version_mismatch';
     readonly claim: TClaim;
-    readonly key: 'shared' | 'ceremony' | 'execution';
+    readonly key: 'shared' | 'ceremony';
 };
 export type RouterAbEd25519YaoRegistrationTwoPhaseRunInputV1<TClaim, TBackend, TResponse, TRejection> = {
     readonly lifecycleId: string;

package/dist/types/wallet-server/src/router/domains/ed25519Yao/routerAbEd25519YaoGatewayEnvelope.d.ts

@@ -1,5 +1,16 @@
 import type { RouterAbEd25519YaoExportAdmissionRequestV1, RouterAbEd25519YaoRecoveryAdmissionRequestV1, RouterAbEd25519YaoRegistrationAdmissionRequestV1 } from '../../../../../shared-ts/src/utils/routerAbEd25519Yao';
 import type { TenantRootActiveLineageV1 } from '../tenantRoot/tenantRootCustodyLineage';
+import type { TenantRootIdentityV1 } from '../tenantRoot/tenantRootIdentityResolution';
+import type { TenantRootIdentityWireV1 } from '../../../../../shared-ts/src/tenant-root/tenantRootIdentity';
+export type RouterAbEd25519YaoResolvedTenantRootV1 = TenantRootActiveLineageV1 & {
+    readonly identity: TenantRootIdentityV1;
+};
+export type RouterAbEd25519YaoTenantRootWireV1 = {
+    readonly identity: TenantRootIdentityWireV1;
+    readonly custody_lineage_b64u: string;
+};
+export declare function parseRouterAbEd25519YaoTenantRootWireV1(input: unknown): RouterAbEd25519YaoTenantRootWireV1 | null;
+export declare function routerAbEd25519YaoTenantRootWireV1(root: RouterAbEd25519YaoResolvedTenantRootV1): Promise<RouterAbEd25519YaoTenantRootWireV1>;
 export type RouterAbEd25519YaoTenantRootResolutionInputV1 = {
     readonly operation: 'registration';
     readonly admissionRequest: RouterAbEd25519YaoRegistrationAdmissionRequestV1;
@@ -10,7 +21,7 @@ export type RouterAbEd25519YaoTenantRootResolutionInputV1 = {
     readonly operation: 'export';
     readonly admissionRequest: RouterAbEd25519YaoExportAdmissionRequestV1;
 };
-export type RouterAbEd25519YaoTenantRootResolverV1 = (input: RouterAbEd25519YaoTenantRootResolutionInputV1) => Promise<TenantRootActiveLineageV1>;
+export type RouterAbEd25519YaoTenantRootResolverV1 = (input: RouterAbEd25519YaoTenantRootResolutionInputV1) => Promise<RouterAbEd25519YaoResolvedTenantRootV1>;
 export type RouterAbEd25519YaoRegistrationExecuteAdmissionContextV1 = RouterAbEd25519YaoRegistrationAdmissionRequestV1;
 export type RouterAbEd25519YaoRecoveryExecuteAdmissionContextV1 = RouterAbEd25519YaoRecoveryAdmissionRequestV1;
 export type RouterAbEd25519YaoExportExecuteAdmissionContextV1 = RouterAbEd25519YaoExportAdmissionRequestV1;

package/dist/types/wallet-server/src/router/domains/ed25519Yao/session/routerAbEd25519YaoWalletSession.d.ts

@@ -3,11 +3,13 @@ import type { RouterAbEd25519NormalSigningState } from '../../../../../../shared
 import type { PasskeyWalletAuthAuthority, WalletAuthAuthority, WalletAuthAuthorityRef } from '../../../../../../shared-ts/src/utils/walletAuthAuthority';
 import type { WebAuthnAuthenticationCredential } from '../../../../core/types';
 import { thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from '../../../../core/ThresholdService/validation';
-import type { WalletRegistrationEd25519YaoBootstrapSession } from '../../../../core/registrationContracts';
+import type { WalletRegistrationEd25519YaoBootstrapSession } from '../../../../../../shared-ts/src/utils/registrationContracts';
 import type { RouterAbEd25519YaoActiveCapabilityDescriptorV1 } from '../recovery/routerAbEd25519YaoRecovery';
-import type { MpcWalletSigningQuotaId, WalletSessionMintId, WalletSessionAuthorizationId, WalletSessionId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
+import type { MpcWalletSigningQuotaId, WalletSessionAuthorizationId, WalletSessionId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
+import type { WalletSessionAlreadyCommittedResponseV1, WalletSessionRejectionV1 } from '../../../../../../shared-ts/src/authorization/walletSessionIssuance';
 import type { WalletSessionOperationCredentialV1 } from '../../../../../../shared-ts/src/device-linking';
-import type { ThresholdEd25519SessionId, WalletAuthMethodId, WalletAuthorityId, WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
+import type { ThresholdEd25519SessionId } from '../../../../../../shared-ts/src/utils/domainIds';
+import type { RouterAbEd25519OperationStepUpMaterialRecoveryRequest, RouterAbEd25519OperationStepUpMaterialRecoveryResponse } from '../../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
 import type { VerifiedOwnerProof } from '../../../../authorization/factorEvidence';
 export type RouterAbEd25519YaoSessionPolicyV1 = {
     readonly version: 'threshold_session_v1';
@@ -35,23 +37,8 @@ export type RouterAbEd25519YaoSessionRouteCommandV1 = {
     };
     readonly sessionKind: 'opaque';
 };
-export type RouterAbEd25519YaoOperationStepUpMaterialRecoveryRequest = {
-    readonly kind: 'not_requested';
-} | {
-    readonly kind: 'email_otp_factor_release_v1';
-    readonly workerEphemeralPublicKey65B64u: string;
-};
-export type RouterAbEd25519YaoOperationStepUpMaterialRecoveryResponse = {
-    readonly kind: 'not_requested';
-} | {
-    readonly kind: 'email_otp_factor_release_v1';
-    readonly challengeId: string;
-    readonly enrollmentId: string;
-    readonly enrollmentSealKeyVersion: string;
-    readonly serverEphemeralPublicKey65B64u: string;
-    readonly nonce12B64u: string;
-    readonly ciphertextB64u: string;
-};
+type RouterAbEd25519YaoOperationStepUpMaterialRecoveryRequest = Readonly<RouterAbEd25519OperationStepUpMaterialRecoveryRequest>;
+export type RouterAbEd25519YaoOperationStepUpMaterialRecoveryResponse = Readonly<RouterAbEd25519OperationStepUpMaterialRecoveryResponse>;
 type RouterAbEd25519YaoOperationStepUpGrantCommandBase = {
     readonly kind: 'router_ab_ed25519_yao_operation_step_up_grant_v1';
     readonly normalSigningRequest: Record<string, unknown>;
@@ -93,35 +80,7 @@ export type RouterAbEd25519YaoBudgetRefreshRequestV1 = {
     readonly sessionPolicy: RouterAbEd25519YaoSessionPolicyV1;
     readonly authorization: RouterAbEd25519YaoBudgetRefreshAuthorizationV1;
 };
-/**
- * The committed identity of one Wallet Session issuance attempt whose
- * credential is unreachable. It is credential-free by construction: a replay
- * reads a committed digest, and no digest reproduces plaintext.
- */
-export type RouterAbEd25519YaoCommittedWalletSessionV1 = {
-    readonly kind: 'already_committed_wallet_session_v1';
-    readonly walletId: WalletId;
-    readonly authorityId: WalletAuthorityId;
-    readonly walletAuthMethodId: WalletAuthMethodId;
-    readonly mintId: WalletSessionMintId;
-    readonly authorizationId: WalletSessionAuthorizationId;
-    readonly walletSessionId: WalletSessionId;
-    readonly quotaId: MpcWalletSigningQuotaId;
-};
-export type RouterAbEd25519YaoAlreadyCommittedResponseV1 = {
-    readonly ok: false;
-    readonly code: 'already_committed';
-    readonly message: string;
-    readonly next: 'unlock_exact_method';
-    readonly committed: RouterAbEd25519YaoCommittedWalletSessionV1;
-};
-export type RouterAbEd25519YaoWalletSessionRejectionV1 = {
-    readonly ok: false;
-    readonly code: string;
-    readonly message: string;
-    readonly next?: never;
-    readonly committed?: never;
-};
+export type RouterAbEd25519YaoAlreadyCommittedResponseV1 = WalletSessionAlreadyCommittedResponseV1;
 type RouterAbEd25519YaoBudgetRefreshSessionV1 = {
     readonly ok: true;
     readonly walletId: string;
@@ -145,7 +104,7 @@ export type RouterAbEd25519YaoBudgetRefreshResponseV1 = (RouterAbEd25519YaoBudge
 }) | (RouterAbEd25519YaoBudgetRefreshSessionV1 & {
     readonly sessionKind: 'already_committed_exact_wallet_session';
     readonly operationCredential?: never;
-}) | RouterAbEd25519YaoAlreadyCommittedResponseV1 | RouterAbEd25519YaoWalletSessionRejectionV1;
+}) | RouterAbEd25519YaoAlreadyCommittedResponseV1 | WalletSessionRejectionV1;
 type RouterAbEd25519YaoVerifiedWalletUnlockRequestBaseV1 = {
     readonly walletId: string;
     readonly signerSlot: number;
@@ -156,7 +115,7 @@ type RouterAbEd25519YaoVerifiedWalletUnlockRequestBaseV1 = {
         readonly purpose: 'wallet_session';
     }>;
 };
-export type RouterAbEd25519YaoWalletSessionIdentityV1 = {
+type RouterAbEd25519YaoWalletSessionIdentityV1 = {
     readonly kind: 'new_wallet_session';
 } | {
     readonly kind: 'reuse_wallet_session_v2';
@@ -173,6 +132,6 @@ export type RouterAbEd25519YaoVerifiedWalletUnlockResponseV1 = {
     readonly ok: true;
     readonly session: WalletRegistrationEd25519YaoBootstrapSession;
     readonly capability: RouterAbEd25519YaoActiveCapabilityDescriptorV1;
-} | RouterAbEd25519YaoAlreadyCommittedResponseV1 | RouterAbEd25519YaoWalletSessionRejectionV1;
+} | RouterAbEd25519YaoAlreadyCommittedResponseV1 | WalletSessionRejectionV1;
 export {};
 //# sourceMappingURL=routerAbEd25519YaoWalletSession.d.ts.map

package/dist/types/wallet-server/src/router/domains/ed25519Yao/session/thresholdEd25519RequestValidation.d.ts

@@ -1,5 +1,5 @@
-import type { RouterAbEd25519YaoOperationStepUpGrantCommandV1, RouterAbEd25519YaoSessionPolicyV1, RouterAbEd25519YaoSessionRouteCommandV1 } from './routerAbEd25519YaoWalletSession';
-export type ThresholdEd25519RouteErrorBody = {
+import type { RouterAbEd25519YaoOperationStepUpGrantCommandV1, RouterAbEd25519YaoSessionRouteCommandV1 } from './routerAbEd25519YaoWalletSession';
+type ThresholdEd25519RouteErrorBody = {
     ok: false;
     code: 'invalid_body';
     message: string;
@@ -8,11 +8,10 @@ type ThresholdEd25519RouteParseError = {
     ok: false;
     body: ThresholdEd25519RouteErrorBody;
 };
-export type ThresholdEd25519RouteParseResult<T> = {
+type ThresholdEd25519RouteParseResult<T> = {
     ok: true;
     request: T;
 } | ThresholdEd25519RouteParseError;
-export declare function parseRouterAbEd25519YaoSessionPolicyV1(raw: unknown): ThresholdEd25519RouteParseResult<RouterAbEd25519YaoSessionPolicyV1>;
 export declare function parseThresholdEd25519SessionRouteRequest(raw: unknown): ThresholdEd25519RouteParseResult<RouterAbEd25519YaoSessionRouteCommandV1>;
 export declare function parseThresholdEd25519OperationStepUpGrantRequest(raw: unknown): ThresholdEd25519RouteParseResult<RouterAbEd25519YaoOperationStepUpGrantCommandV1>;
 export {};

package/dist/types/wallet-server/src/router/domains/emailOtp/emailOtpExportPolicy.d.ts

@@ -1,32 +1,7 @@
 import type { RouterApiEmailOtpExportPolicyDecision, RouterApiEmailOtpExportPolicyInput, RouterApiOptions } from '../../framework/routerApi';
-export type ResolvedEmailOtpExportPolicyDecision = RouterApiEmailOtpExportPolicyDecision & {
+type ResolvedEmailOtpExportPolicyDecision = RouterApiEmailOtpExportPolicyDecision & {
     policySource: 'adapter' | 'default_allow';
 };
 export declare function authorizeEmailOtpExportPolicy(opts: RouterApiOptions, input: RouterApiEmailOtpExportPolicyInput): Promise<ResolvedEmailOtpExportPolicyDecision>;
-export declare function emailOtpExportPolicyAuditPayload(input: {
-    source: 'login_challenge' | 'login_verify' | 'signing_session_challenge' | 'signing_session_verify';
-    decision: ResolvedEmailOtpExportPolicyDecision;
-    challengeId?: string;
-    otpChannel?: string;
-}): Record<string, unknown>;
-export declare function emailOtpExportPolicyWebhookEventDescriptor(input: {
-    eventType: 'wallet.email_otp.export_denied' | 'wallet.email_otp.export_challenge_issued' | 'wallet.email_otp.export_approved';
-    source: 'login_challenge' | 'login_verify' | 'signing_session_challenge' | 'signing_session_verify';
-    decision: ResolvedEmailOtpExportPolicyDecision;
-    challengeId?: string;
-    otpChannel?: string;
-    code?: string;
-    message?: string;
-}): {
-    eventType: string;
-    eventId?: string;
-    payload: Record<string, unknown>;
-};
-export declare function emailOtpExportDeniedDecisionFromResult(input: {
-    code: string;
-    message: string;
-    policySource: ResolvedEmailOtpExportPolicyDecision['policySource'];
-    policyId?: string;
-    approvalId?: string;
-}): ResolvedEmailOtpExportPolicyDecision;
+export {};
 //# sourceMappingURL=emailOtpExportPolicy.d.ts.map

package/dist/types/wallet-server/src/router/domains/emailOtp/emailOtpRequestValidation.d.ts

@@ -1,7 +1,6 @@
-import { type WalletEmailOtpChannel, type WalletEmailOtpLoginOperation, type WalletUnlockBackend } from '../../../../../shared-ts/src/utils/emailOtpDomain';
+import { type WalletEmailOtpLoginOperation, type WalletUnlockBackend } from '../../../../../shared-ts/src/utils/emailOtpDomain';
 export type { WalletEmailOtpChannel } from '../../../../../shared-ts/src/utils/emailOtpDomain';
 export declare function parseWalletUnlockBackend(raw: unknown): WalletUnlockBackend | null;
-export declare function parseWalletEmailOtpChannel(raw: unknown): WalletEmailOtpChannel | null;
 export declare function parseWalletEmailOtpLoginOperation(raw: unknown): {
     ok: true;
     operation: WalletEmailOtpLoginOperation;

package/dist/types/wallet-server/src/router/domains/emailOtp/emailOtpRouteHandlers.d.ts

@@ -1,5 +1,5 @@
 import type { RouterApiEmailOtpRouteService } from '../../framework/authServicePort';
-export type EmailOtpRouteResponse = {
+type EmailOtpRouteResponse = {
     status: number;
     body: Record<string, unknown>;
 };
@@ -32,4 +32,5 @@ export declare function handleEmailOtpDevOutboxRoute(input: {
     body: unknown;
     service: RouterApiEmailOtpRouteService;
 }): Promise<EmailOtpRouteResponse>;
+export {};
 //# sourceMappingURL=emailOtpRouteHandlers.d.ts.map

package/dist/types/wallet-server/src/router/domains/emailOtp/emailOtpSessionRouteHelpers.d.ts

@@ -1,7 +1,5 @@
 import { type WalletEmailOtpChannel } from '../../../../../shared-ts/src/utils/emailOtpDomain';
-import type { EmailOtpChallengeDelivery } from '../../framework/authServicePort';
-export type OidcAccountMode = 'register' | 'login';
-export type EmailOtpFailureAuditInput = {
+type EmailOtpFailureAuditInput = {
     source: 'registration_finalize' | 'login_challenge' | 'login_verify' | 'unlock_verify' | 'signing_session_challenge' | 'signing_session_verify';
     code: string;
     message: string;
@@ -15,57 +13,13 @@ export type EmailOtpWebhookEventDescriptor = {
     eventId?: string;
     payload: Record<string, unknown>;
 };
-export type EmailOtpRouteValidationError = {
-    ok: false;
-    status: number;
-    body: Record<string, unknown>;
-};
-export type EmailOtpRouteValidationResult<T> = ({
-    ok: true;
-} & T) | EmailOtpRouteValidationError;
 export declare function emailOtpStatusCode(code: string | undefined): number;
-export declare function emailOtpResultStatus(result: {
-    ok: boolean;
-    code?: string;
-}): number;
-export declare function emailOtpInternalErrorBody(error: unknown): {
-    ok: false;
-    code: 'internal';
-    message: string;
-};
-export declare function emailOtpFailureAuditPayload(input: EmailOtpFailureAuditInput): Record<string, unknown>;
-export declare function shouldEmitEmailOtpLockedWebhook(code: string): boolean;
 export declare function emailOtpFailureWebhookEventDescriptors(input: EmailOtpFailureAuditInput): EmailOtpWebhookEventDescriptor[];
 export declare function emailOtpLoggedInWebhookEventDescriptor(input: {
     challengeId: string;
     otpChannel: WalletEmailOtpChannel;
     unlockBackend: string;
 }): EmailOtpWebhookEventDescriptor;
-export declare function emailOtpEnrolledWebhookEventDescriptor(input: {
-    challengeId: string;
-    otpChannel: WalletEmailOtpChannel;
-    enrollmentSealKeyVersion: string;
-    unlockKeyVersion?: string;
-}): EmailOtpWebhookEventDescriptor;
-export declare function validateEmailOtpJsonObjectBody(body: unknown): EmailOtpRouteValidationResult<{
-    body: Record<string, unknown>;
-}>;
-export declare function validateEmailOtpWalletId(input: {
-    body: Record<string, unknown>;
-    claims: unknown;
-    userId: string;
-}): EmailOtpRouteValidationResult<{
-    walletId: string;
-}>;
-export declare function validateEmailOtpChannel(body: Record<string, unknown>): EmailOtpRouteValidationResult<{
-    otpChannel: WalletEmailOtpChannel;
-}>;
-export declare function validateEmailOtpRequiredString(body: Record<string, unknown>, field: string): EmailOtpRouteValidationResult<{
-    value: string;
-}>;
-export declare function getAuthenticatedWalletId(claims: unknown, userId: string): string;
-export declare function isGoogleOidcEmailOtpSession(claims: unknown): boolean;
-export declare function parseOidcAccountMode(raw: unknown): OidcAccountMode | undefined;
 export declare function hashEmailOtpOperationBinding(input: {
     walletId: string;
     providerUserId: string;
@@ -76,59 +30,5 @@ export declare function hashEmailOtpOperationBinding(input: {
     authorityRef?: unknown;
     operationFingerprintDigest?: string;
 }): Promise<string>;
-export declare function emailOtpChallengeResponseBody(result: {
-    ok: boolean;
-    challenge?: {
-        challengeId: string;
-        issuedAtMs: number;
-        expiresAtMs: number;
-        userId: string;
-        walletId: string;
-        orgId?: string;
-        ownerProofBindingDigest: string;
-        otpChannel: string;
-        action: string;
-        operation: string;
-    };
-    delivery?: EmailOtpChallengeDelivery;
-    retryAfterMs?: number;
-}): Record<string, unknown>;
-export declare function emailOtpServerSealResponseBody(result: {
-    ok: true;
-    ciphertext: string;
-    enrollmentSealKeyVersion: string;
-} | ({
-    ok: false;
-    code: string;
-    message: string;
-} & Record<string, unknown>), walletId: string): Record<string, unknown>;
-export declare function emailOtpEnrollmentFinalizeResponseBody(result: {
-    ok: true;
-    walletId: string;
-    otpChannel: string;
-    enrollment: {
-        createdAtMs: number;
-        updatedAtMs: number;
-        enrollmentSealKeyVersion: string;
-        unlockKeyVersion?: string;
-    };
-} | ({
-    ok: false;
-    code: string;
-    message: string;
-} & Record<string, unknown>)): Record<string, unknown>;
-export declare function emailOtpLoginVerifyResponseBody(args: {
-    result: {
-        ok: true;
-        challengeId: string;
-        loginGrant: string;
-        grantExpiresAtMs: number;
-        otpChannel: string;
-    };
-    enrollment: {
-        enrollment: {
-            enrollmentSealKeyVersion?: unknown;
-        };
-    };
-}): Record<string, unknown>;
+export {};
 //# sourceMappingURL=emailOtpSessionRouteHelpers.d.ts.map

package/dist/types/wallet-server/src/router/domains/passkeyCustody/envelopeRevocationAdmission.d.ts

@@ -16,7 +16,7 @@ import type { PasskeyCustodyEnvelopeRecord } from '../../../../../shared-ts/src/
  * secret is protected by another active envelope, so the lane stays open and
  * the removal is safe.
  */
-export type EnvelopeRevocationAdmission = {
+type EnvelopeRevocationAdmission = {
     readonly kind: 'admitted';
 } | {
     readonly kind: 'refused';
@@ -28,4 +28,5 @@ export declare function admitEnvelopeRevocation(input: {
     /** The envelope the caller wants revoked. */
     readonly envelopeId: string;
 }): EnvelopeRevocationAdmission;
+export {};
 //# sourceMappingURL=envelopeRevocationAdmission.d.ts.map

package/dist/types/wallet-server/src/router/domains/passkeyCustody/passkeyCustodyEnvelopeRetrieval.d.ts

@@ -10,7 +10,7 @@ import type { CloudflareD1PasskeyCustodyEnvelopeStore, PasskeyCustodyEnvelopeLoc
  * unrepresentable in this request type: their factor secret is not a
  * credential, so a WebAuthn assertion is never evidence for them.
  */
-export type PasskeyEnvelopeRetrievalLocator = Omit<PasskeyCustodyEnvelopeLocator, 'factor'> & {
+type PasskeyEnvelopeRetrievalLocator = Omit<PasskeyCustodyEnvelopeLocator, 'factor'> & {
     readonly factor: Extract<WalletCustodyFactorRef, {
         kind: 'passkey';
     }>;
@@ -74,7 +74,7 @@ export type PasskeyCustodyEnvelopeRetrievalResult = {
  * lifecycle mapping below can be tested against a verified assertion without
  * forging authenticator signatures; production callers take the default.
  */
-export type PasskeyCustodyAssertionVerifier = typeof verifyWebAuthnAuthenticationLiteWithStore;
+type PasskeyCustodyAssertionVerifier = typeof verifyWebAuthnAuthenticationLiteWithStore;
 export declare function retrievePasskeyCustodyEnvelope(input: {
     readonly request: PasskeyCustodyEnvelopeRetrievalRequest;
     readonly envelopeStore: CloudflareD1PasskeyCustodyEnvelopeStore;
@@ -82,4 +82,5 @@ export declare function retrievePasskeyCustodyEnvelope(input: {
     readonly logger: NormalizedLogger;
     readonly verifyAssertion?: PasskeyCustodyAssertionVerifier;
 }): Promise<PasskeyCustodyEnvelopeRetrievalResult>;
+export {};
 //# sourceMappingURL=passkeyCustodyEnvelopeRetrieval.d.ts.map

package/dist/types/wallet-server/src/router/domains/passkeyCustody/passkeyCustodyEnvelopeRetrievalRoute.d.ts

@@ -1,4 +1,4 @@
-import { type PasskeyCustodyEnvelopeRetrievalRequest, type PasskeyCustodyEnvelopeRetrievalResult } from './passkeyCustodyEnvelopeRetrieval';
+import { type PasskeyCustodyEnvelopeRetrievalRequest } from './passkeyCustodyEnvelopeRetrieval';
 import type { CloudflareD1PasskeyCustodyEnvelopeStore } from '../../cloudflare/d1/passkeyCustody/d1PasskeyCustodyEnvelopeStore';
 import type { WebAuthnAuthenticatorStore } from '../../../core/WebAuthnAuthenticatorStore';
 import type { NormalizedLogger } from '../../../core/logger';
@@ -31,12 +31,4 @@ export declare function handlePasskeyCustodyEnvelopeRetrieval(input: {
     readonly authenticatorStore: WebAuthnAuthenticatorStore;
     readonly logger: NormalizedLogger;
 }): Promise<PasskeyCustodyEnvelopeRetrievalRouteResponse>;
-/**
- * The wire mapping, exported because it is the part with the decisions.
- *
- * The retrieval it wraps is tested on its own; what belongs here is which
- * status each outcome earns, and that is worth reading and testing without a
- * store, an authenticator, or an assertion.
- */
-export declare function passkeyCustodyEnvelopeRetrievalRouteResponse(result: PasskeyCustodyEnvelopeRetrievalResult): PasskeyCustodyEnvelopeRetrievalRouteResponse;
 //# sourceMappingURL=passkeyCustodyEnvelopeRetrievalRoute.d.ts.map

package/dist/types/wallet-server/src/router/domains/passkeyCustody/registrationCustodyOutcome.d.ts

@@ -24,7 +24,7 @@ import type { CloudflareD1WalletCustodyCommitStore } from '../../cloudflare/d1/p
  * The outcome shape itself is the wire contract, and lives in shared beside the
  * payload it answers.
  */
-export type RegistrationCustodyOutcome = WalletCustodyRegistrationOutcome;
+type RegistrationCustodyOutcome = WalletCustodyRegistrationOutcome;
 export declare function commitRegistrationCustody(input: {
     /** Absent when the client did not run a custody ceremony for this leg. */
     readonly payload?: WalletCustodyCeremonyCommitPayload;
@@ -35,4 +35,5 @@ export declare function commitRegistrationCustody(input: {
     readonly nowMs: number;
     readonly store: CloudflareD1WalletCustodyCommitStore;
 }): Promise<RegistrationCustodyOutcome>;
+export {};
 //# sourceMappingURL=registrationCustodyOutcome.d.ts.map

package/dist/types/wallet-server/src/router/domains/passkeyCustody/verifiedCustodyFactor.d.ts

@@ -16,7 +16,7 @@ import { type WalletAuthAuthority } from '../../../../../shared-ts/src/utils/wal
  * finalizes, not on the authority. So the OTP arm takes them explicitly, and
  * the caller must pass the enrollment it verified rather than one it looked up.
  */
-export type VerifiedCustodyFactorResult = {
+type VerifiedCustodyFactorResult = {
     readonly ok: true;
     readonly factor: WalletCustodyEnvelopeFactor;
 } | {
@@ -32,4 +32,5 @@ export declare function verifiedCustodyFactorFromAuthority(input: {
     /** Required exactly when the authority is Email OTP. */
     readonly emailOtpEnrollment?: VerifiedEmailOtpEnrollmentFacts;
 }): VerifiedCustodyFactorResult;
+export {};
 //# sourceMappingURL=verifiedCustodyFactor.d.ts.map

package/dist/types/wallet-server/src/router/domains/passkeyCustody/walletCustodyRegistrationAdmission.d.ts

@@ -38,7 +38,7 @@ export type WalletCustodyRegistrationAdmissionOutcome = WalletCustodyRegistratio
     readonly kind: 'no_custody_records';
     readonly keyManifestDigestB64u: string;
 };
-export type WalletCustodyRegistrationAdmissionInput = {
+type WalletCustodyRegistrationAdmissionInput = {
     /** What the ceremony produced. Client-supplied, therefore untrusted. */
     readonly payload: WalletCustodyCeremonyCommitPayload;
     /** The wallet this server verified the registration for. */
@@ -53,4 +53,5 @@ export type WalletCustodyRegistrationAdmissionInput = {
     readonly store: CloudflareD1WalletCustodyCommitStore;
 };
 export declare function admitWalletCustodyRegistrationCommit(input: WalletCustodyRegistrationAdmissionInput): Promise<WalletCustodyRegistrationAdmissionOutcome>;
+export {};
 //# sourceMappingURL=walletCustodyRegistrationAdmission.d.ts.map

package/dist/types/wallet-server/src/router/domains/passkeyCustody/walletCustodyRegistrationCommit.d.ts

@@ -1,28 +1,7 @@
-import { type PasskeyCustodyEnvelopeRecord, type WalletCustodyCeremonyCommitPayload } from '../../../../../shared-ts/src/passkey-custody';
-import { type WalletRecoveryEnvelopeSetRecord } from '../../../../../shared-ts/src/wallet-recovery';
-import { buildWalletRecoveryBackupAcknowledgementV1 } from '../../../../../shared-ts/src/wallet-recovery/recoveryCodes';
+import { type WalletCustodyCeremonyCommitPayload } from '../../../../../shared-ts/src/passkey-custody';
 import { type WalletId } from '../../../../../shared-ts/src/utils/domainIds';
 export type { WalletCustodyCeremonyCommitPayload };
-import type { CloudflareD1WalletCustodyCommitStore, WalletRecoveryCodeLocatorRecord, WalletCustodyRegistrationCommitResult } from '../../cloudflare/d1/passkeyCustody/d1WalletCustodyCommitStore';
-/**
- * Turns a ceremony's commit payload into the two records the store writes.
- *
- * The payload is what `wallet_custody_ceremony`'s `seal` returned: ciphertext
- * and public facts only. This module adds nothing cryptographic — it parses the
- * payload through the same boundary parsers every other reader uses, and
- * assembles records. Anything it cannot parse is rejected here rather than
- * stored for a later reader to choke on.
- *
- * The ten recovery-code wraps and the single seed entry arrive together because
- * the ceremony produced them under one manifest KEK. Splitting that across two
- * requests would let a wallet exist with a partial code set.
- */
-export type WalletCustodyRegistrationRecords = {
-    readonly envelope: PasskeyCustodyEnvelopeRecord;
-    readonly recoverySet: WalletRecoveryEnvelopeSetRecord;
-    readonly recoveryCodeLocators: readonly WalletRecoveryCodeLocatorRecord[];
-    readonly recoveryBackupAcknowledgement: ReturnType<typeof buildWalletRecoveryBackupAcknowledgementV1>;
-};
+import type { CloudflareD1WalletCustodyCommitStore, WalletCustodyRegistrationCommitResult } from '../../cloudflare/d1/passkeyCustody/d1WalletCustodyCommitStore';
 export type WalletCustodyRegistrationCommitOutcome = ({
     readonly kind: 'committed';
 } & Omit<Extract<WalletCustodyRegistrationCommitResult, {
@@ -43,11 +22,6 @@ export type WalletCustodyRegistrationCommitOutcome = ({
     readonly kind: 'rejected';
     readonly reason: string;
 };
-export declare function buildWalletCustodyRegistrationRecords(args: {
-    readonly payload: WalletCustodyCeremonyCommitPayload;
-    readonly factor: unknown;
-    readonly nowMs: number;
-}): WalletCustodyRegistrationRecords;
 /**
  * Builds and commits in one call.
  *