@seams/wallet-server 0.7.3 → 0.8.0

package/dist/types/wallet-server/src/index.d.ts

@@ -1,28 +1,23 @@
 export * from './core/types';
 export * from './core/config';
-export * from './core/defaultConfigsServer';
 export { formatSigningSessionSealKeyVersionForWire, parseSigningSessionSealKeyVersion, type SigningSessionSealKeyVersion, } from './core/keyMaterialBrands';
-export { AuthService } from './core/AuthService';
 export * from './authorization/domain';
 export * from './authorization/service';
 export * from './authorization/vaultProxyUse';
 export { SessionService, parseCsvList, buildCorsOrigins } from './core/SessionService';
 export type { SessionConfig } from './core/SessionService';
-export { createThresholdEd25519KeyStore, createThresholdEd25519SessionStore, createEd25519WalletSessionStore, createEcdsaWalletSessionStore, } from './core/ThresholdService';
-export { createRouterAbSigningRuntimes, type RouterAbSigningRuntimeBundle, } from './core/routerAbSigning/createRouterAbSigningRuntimes';
 export { RouterAbEcdsaPresignRuntime } from './core/routerAbSigning/RouterAbEcdsaPresignRuntime';
 export { ensureEvmCryptoWasm, computeEip1559TxHash, signSecp256k1Recoverable, encodeEip1559SignedTxFromSignature65, secp256k1PrivateKey32ToPublicKey33, secp256k1PublicKey33ToEthereumAddress, } from './core/ThresholdService/evmCryptoWasm';
 export type { ServerEip1559UnsignedTx } from './core/ThresholdService/evmCryptoWasm';
-export type { ThresholdEd25519KeyStore, ThresholdEd25519KeyRecord, ThresholdEd25519SessionStore, ThresholdEd25519MpcSessionRecord, ThresholdEd25519SigningSessionRecord, ThresholdEd25519Commitments, Ed25519WalletSessionStore, Ed25519WalletSessionRecord, } from './core/ThresholdService';
+export type { Ed25519WalletSessionStore, Ed25519WalletSessionRecord, } from './core/ThresholdService';
 export * from './core/signingMaterial/ordinaryInactiveSignerMaterialReservation';
-export { D1WalletAuthMethodStore, createWalletAuthMethodStore, ensureWalletAuthMethodStoreD1Schema, normalizeWalletAuthMethod, resolveWalletAuthMethodStoreNamespace, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, type D1WalletAuthMethodStoreOptions, type D1WalletAuthMethodStoreSchemaOptions, type WalletAuthMethodRecord, type WalletAuthMethodStore, } from './core/WalletAuthMethodStore';
-export { D1WalletStore, WALLET_STORE_D1_SCHEMA_SQL, buildWalletEcdsaSignerRecord, buildWalletEd25519SignerId, createWalletStore, ensureWalletStoreD1Schema, resolveWalletStoreNamespace, type D1WalletStoreOptions, type D1WalletStoreSchemaOptions, type WalletEcdsaSignerRecord, type WalletEd25519SignerRecord, type WalletRecord, type WalletSignerRecord, type WalletStore, } from './core/WalletStore';
-export { D1WebAuthnAuthenticatorStore, WEBAUTHN_AUTHENTICATOR_STORE_D1_SCHEMA_SQL, createWebAuthnAuthenticatorStore, ensureWebAuthnAuthenticatorStoreD1Schema, resolveWebAuthnAuthenticatorStoreNamespace, type D1WebAuthnAuthenticatorStoreOptions, type D1WebAuthnAuthenticatorStoreSchemaOptions, type WebAuthnAuthenticatorRecord, type WebAuthnAuthenticatorStore, } from './core/WebAuthnAuthenticatorStore';
-export { D1WebAuthnCredentialBindingStore, WEBAUTHN_CREDENTIAL_BINDING_STORE_D1_SCHEMA_SQL, createWebAuthnCredentialBindingStore, ensureWebAuthnCredentialBindingStoreD1Schema, resolveWebAuthnCredentialBindingStoreNamespace, type D1WebAuthnCredentialBindingStoreOptions, type D1WebAuthnCredentialBindingStoreSchemaOptions, type WebAuthnCredentialBindingRecord, type WebAuthnCredentialBindingStore, } from './core/WebAuthnCredentialBindingStore';
-export { D1WebAuthnLoginChallengeStore, WEBAUTHN_LOGIN_CHALLENGE_STORE_D1_SCHEMA_SQL, createWebAuthnLoginChallengeStore, ensureWebAuthnLoginChallengeStoreD1Schema, type D1WebAuthnLoginChallengeStoreOptions, type D1WebAuthnLoginChallengeStoreSchemaOptions, type WebAuthnLoginChallengeRecord, type WebAuthnLoginChallengeStore, } from './core/WebAuthnLoginChallengeStore';
-export { D1WebAuthnSyncChallengeStore, WEBAUTHN_SYNC_CHALLENGE_STORE_D1_SCHEMA_SQL, createWebAuthnSyncChallengeStore, ensureWebAuthnSyncChallengeStoreD1Schema, type D1WebAuthnSyncChallengeStoreOptions, type D1WebAuthnSyncChallengeStoreSchemaOptions, type WebAuthnSyncChallengeRecord, type WebAuthnSyncChallengeStore, } from './core/WebAuthnSyncChallengeStore';
-export { D1IdentityStore, IDENTITY_STORE_D1_SCHEMA_SQL, createIdentityStore, ensureIdentityStoreD1Schema, resolveIdentityStoreNamespace, type D1IdentityStoreOptions, type D1IdentityStoreSchemaOptions, type IdentityStore, type IdentitySubjectRecord, type IdentityUserRecord, type LinkIdentityResult, type UnlinkIdentityResult, } from './core/IdentityStore';
-export { D1NearPublicKeyStore, NEAR_PUBLIC_KEY_STORE_D1_SCHEMA_SQL, createNearPublicKeyStore, ensureNearPublicKeyStoreD1Schema, type D1NearPublicKeyStoreOptions, type D1NearPublicKeyStoreSchemaOptions, type NearPublicKeyKind, type NearPublicKeyRecord, type NearPublicKeyStore, } from './core/NearPublicKeyStore';
+export { D1WalletAuthMethodStore, ensureWalletAuthMethodStoreD1Schema, normalizeWalletAuthMethod, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, type D1WalletAuthMethodStoreOptions, type D1WalletAuthMethodStoreSchemaOptions, type WalletAuthMethodRecord, type WalletAuthMethodStore, } from './core/WalletAuthMethodStore';
+export { D1WalletStore, WALLET_STORE_D1_SCHEMA_SQL, buildWalletEcdsaSignerRecord, buildWalletEd25519SignerId, ensureWalletStoreD1Schema, type D1WalletStoreOptions, type D1WalletStoreSchemaOptions, type WalletEcdsaSignerRecord, type WalletEd25519SignerRecord, type WalletRecord, type WalletSignerRecord, type WalletStore, } from './core/WalletStore';
+export { type WebAuthnAuthenticatorRecord, type WebAuthnAuthenticatorStore, } from './core/WebAuthnAuthenticatorStore';
+export { type WebAuthnCredentialBindingRecord, type WebAuthnCredentialBindingStore, } from './core/WebAuthnCredentialBindingStore';
+export { type WebAuthnLoginChallengeRecord } from './core/WebAuthnLoginChallengeStore';
+export { type WebAuthnSyncChallengeRecord } from './core/WebAuthnSyncChallengeStore';
+export { D1IdentityStore, IDENTITY_STORE_D1_SCHEMA_SQL, ensureIdentityStoreD1Schema, type D1IdentityStoreOptions, type D1IdentityStoreSchemaOptions, type IdentityStore, type IdentitySubjectRecord, type LinkIdentityResult, type UnlinkIdentityResult, } from './core/IdentityStore';
 export { InMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createRouterAbNormalSigningAdmissionAdapter, type RouterAbNormalSigningAbuseDecision, type RouterAbNormalSigningPolicyDecision, type RouterAbNormalSigningAdmissionStore, type RouterAbNormalSigningProjectPolicyDecision, } from './router/domains/signingOperations/routerAbNormalSigningAdmissionCore';
 export { CloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1RouterAbNormalSigningAdmissionStore, type CloudflareD1RouterAbNormalSigningAdmissionStoreOptions, } from './router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore';
 export * from './threshold/session/signingSessionSeal';

package/dist/types/wallet-server/src/localRegistrationSetupAuthority.d.ts

@@ -0,0 +1,13 @@
+import type { D1DatabaseLike } from './storage/tenantRoute';
+import type { D1TenantScope } from './core/d1TenantStore';
+import { type WalletRegistrationReservationAuthority, type WalletRegistrationSetupReservationResult } from './router/domains/walletRegistration/walletRegistrationReservation';
+import type { WalletRegistrationSetupInput } from './router/domains/walletRegistration/walletRegistrationInputs';
+export declare class LocalRegistrationSetupAuthority implements WalletRegistrationReservationAuthority {
+    private readonly scope;
+    private readonly storage;
+    constructor(database: D1DatabaseLike, scope: D1TenantScope);
+    reserve(input: WalletRegistrationSetupInput): Promise<WalletRegistrationSetupReservationResult>;
+    admitHome(input: Parameters<WalletRegistrationReservationAuthority['admitHome']>[0]): Promise<Awaited<ReturnType<WalletRegistrationReservationAuthority['admitHome']>>>;
+    complete(input: Parameters<WalletRegistrationReservationAuthority['complete']>[0]): Promise<Awaited<ReturnType<WalletRegistrationReservationAuthority['admitHome']>>>;
+}
+//# sourceMappingURL=localRegistrationSetupAuthority.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1AuthorizationAssembly.d.ts

@@ -0,0 +1,23 @@
+import { CloudflareD1EmailOtpRateLimitStore } from '../emailOtp/d1EmailOtpRateLimitStore';
+import type { ScopedD1Prepare } from '../../../../core/emailOtpD1Statements';
+import { CloudflareD1WebAuthnAuthService, type D1WebAuthnWalletManifestSource } from '../webauthn/d1WebAuthnAuthService';
+import { CloudflareD1WebAuthnStore } from '../webauthn/d1WebAuthnStore';
+import type { D1WalletAuthMethodStore } from '../../../../core/d1WalletAuthMethodStore';
+import { CloudflareD1WalletCustodyCommitStore } from '../passkeyCustody/d1WalletCustodyCommitStore';
+import type { NormalizedCloudflareD1RouterApiAuthServiceOptions } from './d1RouterApiAuthConfig';
+import { AuthorizationService } from '../../../../authorization/service';
+import type { WalletSessionRoutingPublisher } from '../../../../authorization/sessionRouting';
+import { CloudflareD1AuthorizationStore, type D1AuthorizationStoreOptions } from '../authorization/d1AuthorizationStore';
+export declare function createD1AuthorizationAssembly(options: D1AuthorizationStoreOptions, sessionRouting: WalletSessionRoutingPublisher | undefined): {
+    authorizationStore: CloudflareD1AuthorizationStore;
+    authorizationService: AuthorizationService;
+};
+export declare function createD1WalletCustodyStore(options: NormalizedCloudflareD1RouterApiAuthServiceOptions): CloudflareD1WalletCustodyCommitStore;
+export declare function createD1WebAuthnAssembly(options: NormalizedCloudflareD1RouterApiAuthServiceOptions, walletAuthMethodStore: D1WalletAuthMethodStore, walletManifestSource: D1WebAuthnWalletManifestSource): {
+    webAuthnStore: CloudflareD1WebAuthnStore;
+    webAuthnAuthService: CloudflareD1WebAuthnAuthService;
+};
+export declare function createD1IdentityStore(options: NormalizedCloudflareD1RouterApiAuthServiceOptions): import("../../../..").IdentityStore;
+export declare function createD1GoogleRegistrationAttempts(options: NormalizedCloudflareD1RouterApiAuthServiceOptions, prepare: ScopedD1Prepare): import("../emailOtp/d1GoogleEmailOtpRegistrationAttemptStore").GoogleEmailOtpRegistrationAttemptStore;
+export declare function createD1EmailOtpRateLimits(options: NormalizedCloudflareD1RouterApiAuthServiceOptions, prepare: ScopedD1Prepare): CloudflareD1EmailOtpRateLimitStore;
+//# sourceMappingURL=d1AuthorizationAssembly.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1RouterApiAuthConfig.d.ts

@@ -1,3 +1,15 @@
+import type { LinkedDeviceBootstrapStore } from '../../../../core/deviceLinking/linkedDeviceBootstrap';
+import type { LinkedDeviceRequestProofNonceStoreV1 } from '../../../../core/deviceLinking/requestProof';
+import type { WebAuthnSyncChallengeStore } from '../../../../core/WebAuthnSyncChallengeStore';
+import type { PasskeyCredentialClaims } from '../../../../core/passkeyCredentialClaims';
+import type { EmailOtpRateLimitCounter } from '../emailOtp/d1EmailOtpRateLimitStore';
+import type { GoogleEmailOtpRegistrationAttemptStore } from '../emailOtp/d1GoogleEmailOtpRegistrationAttemptStore';
+import type { IdentityStore } from '../../../../core/IdentityStore';
+import type { WalletLifecycleRoutingPublisher } from '../../../../authorization/lifecycleRouting';
+import type { WalletRecoveryRoutingPublisher } from '../../../../authorization/recoveryRouting';
+import type { WalletSessionRoutingPublisher } from '../../../../authorization/sessionRouting';
+import type { WalletRegistrationSetupDispatcher } from '../../../framework/registrationSetupDispatch';
+import type { WalletRegistrationReservationAuthority } from '../../../domains/walletRegistration/walletRegistrationReservation';
 import type { LinkedDevicePasskeyTargetConfigurationFieldsV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
 import type { WalletEmailOtpChannel } from '../../../../../../shared-ts/src/utils/emailOtpDomain';
 import type { EmailOtpChallengeAction, EmailOtpChallengeOperation } from '../../../../core/EmailOtpStores';
@@ -96,6 +108,18 @@ export type CloudflareD1GithubOAuthConfig = {
     readonly callbackUrl: string;
 };
 export interface CloudflareD1RouterApiAuthServiceOptions {
+    readonly identityStore?: IdentityStore;
+    readonly emailOtpRateLimitCounter?: EmailOtpRateLimitCounter;
+    readonly credentialClaims?: PasskeyCredentialClaims;
+    readonly linkedDeviceBootstrap?: LinkedDeviceBootstrapStore;
+    readonly linkedDeviceProofNonces?: LinkedDeviceRequestProofNonceStoreV1;
+    readonly syncChallenges?: WebAuthnSyncChallengeStore;
+    readonly googleRegistrationAttempts?: GoogleEmailOtpRegistrationAttemptStore;
+    readonly sessionRouting?: WalletSessionRoutingPublisher;
+    readonly lifecycleRouting?: WalletLifecycleRoutingPublisher;
+    readonly recoveryRouting?: WalletRecoveryRoutingPublisher;
+    readonly registrationSetupDispatcher?: WalletRegistrationSetupDispatcher;
+    readonly registrationAuthority?: WalletRegistrationReservationAuthority;
     readonly database: D1DatabaseLike;
     readonly namespace: string;
     readonly orgId: string;
@@ -110,7 +134,6 @@ export interface CloudflareD1RouterApiAuthServiceOptions {
     readonly implicitNearAccountTestFundingEnabled?: boolean | string;
     readonly googleOidcClientId?: string;
     readonly githubOAuth?: CloudflareD1GithubOAuthConfig;
-    readonly accountIdDerivationSecret?: string;
     readonly emailOtpServerSeal?: CloudflareD1EmailOtpServerSealConfig;
     readonly emailOtpDeliveryMode?: string;
     readonly emailOtpRuntimeProfile?: string;
@@ -171,7 +194,7 @@ export type EmailOtpServerSealRuntimeConfig = {
     readonly configured: false;
     readonly message: string;
 };
-export type NormalizedCloudflareD1RouterApiAuthServiceOptions = Omit<CloudflareD1RouterApiAuthServiceOptions, 'relayerAccount' | 'relayerPublicKey' | 'relayerPrivateKey' | 'nearRpcUrl' | 'accountInitialBalance' | 'implicitNearAccountTestFundingEnabled' | 'googleOidcClientId' | 'accountIdDerivationSecret' | 'emailOtpServerSeal' | 'emailOtpDeliveryMode' | 'emailOtpRuntimeProfile' | 'emailOtpDemoAllowedOrigins' | 'emailOtpDeliveryProvider' | 'emailOtpDevOutboxEnabled' | 'emailOtpProduction' | 'emailOtpChallengeTtlMs' | 'emailOtpGrantTtlMs' | 'emailOtpMaxAttempts' | 'emailOtpLockoutTtlMs' | 'emailOtpCodeLength' | 'emailOtpMaxActiveChallengesPerContext' | 'emailOtpChallengeRateLimitMax' | 'emailOtpChallengeRateLimitWindowMs' | 'emailOtpVerifyRateLimitMax' | 'emailOtpVerifyRateLimitWindowMs' | 'emailOtpGrantRateLimitMax' | 'emailOtpGrantRateLimitWindowMs' | 'emailOtpGoogleRegistrationAttemptRateLimitMax' | 'emailOtpGoogleRegistrationAttemptRateLimitWindowMs' | 'routerAbEcdsaPresignRuntime'> & {
+export type NormalizedCloudflareD1RouterApiAuthServiceOptions = Omit<CloudflareD1RouterApiAuthServiceOptions, 'relayerAccount' | 'relayerPublicKey' | 'relayerPrivateKey' | 'nearRpcUrl' | 'accountInitialBalance' | 'implicitNearAccountTestFundingEnabled' | 'googleOidcClientId' | 'emailOtpServerSeal' | 'emailOtpDeliveryMode' | 'emailOtpRuntimeProfile' | 'emailOtpDemoAllowedOrigins' | 'emailOtpDeliveryProvider' | 'emailOtpDevOutboxEnabled' | 'emailOtpProduction' | 'emailOtpChallengeTtlMs' | 'emailOtpGrantTtlMs' | 'emailOtpMaxAttempts' | 'emailOtpLockoutTtlMs' | 'emailOtpCodeLength' | 'emailOtpMaxActiveChallengesPerContext' | 'emailOtpChallengeRateLimitMax' | 'emailOtpChallengeRateLimitWindowMs' | 'emailOtpVerifyRateLimitMax' | 'emailOtpVerifyRateLimitWindowMs' | 'emailOtpGrantRateLimitMax' | 'emailOtpGrantRateLimitWindowMs' | 'emailOtpGoogleRegistrationAttemptRateLimitMax' | 'emailOtpGoogleRegistrationAttemptRateLimitWindowMs' | 'routerAbEcdsaPresignRuntime'> & {
     readonly relayerAccount?: string;
     readonly relayerPublicKey?: string;
     readonly relayerPrivateKey?: string;
@@ -180,7 +203,6 @@ export type NormalizedCloudflareD1RouterApiAuthServiceOptions = Omit<CloudflareD
     readonly implicitNearAccountTestFundingEnabled: boolean;
     readonly googleOidcClientId?: string;
     readonly githubOAuth?: CloudflareD1GithubOAuthConfig;
-    readonly accountIdDerivationSecret?: string;
     readonly emailOtp: EmailOtpRuntimeConfig;
     readonly emailOtpServerSeal: EmailOtpServerSealRuntimeConfig;
     readonly routerAbEcdsaPresignRuntime?: RouterAbEcdsaPresignRuntime | null;

package/dist/types/wallet-server/src/router/cloudflare/d1/authorization/d1AuthorizationStore.d.ts

@@ -60,7 +60,7 @@ export declare class CloudflareD1AuthorizationStore implements AuthorizationSess
     }): readonly D1PreparedStatementLike[];
     private prepareRetireHostedChildrenForParentSelection;
     putIssuedHostedWalletSeamsSessionExchange(exchange: IssuedHostedWalletSeamsSessionExchangeV2): Promise<void>;
-    redeemHostedWalletSeamsSessionExchange(input: RedeemHostedWalletSeamsSessionExchangeV2Input): Promise<PersistedHostedWalletSeamsSessionExchangeV2Result>;
+    redeemHostedWalletSeamsSessionExchange(input: RedeemHostedWalletSeamsSessionExchangeV2Input, publishCredentialLocator?: () => Promise<void>): Promise<PersistedHostedWalletSeamsSessionExchangeV2Result>;
     readHostedWalletSessionOperationCredentialV2(input: {
         readonly tenantId: TenantId;
         readonly tokenHash: import('../../../../../../shared-ts/src/utils/canonicalPrimitives').DigestB64u;

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService.d.ts

@@ -1,3 +1,4 @@
+import { type PasskeyCredentialClaims } from '../../../../core/passkeyCredentialClaims';
 import { EcdsaMaterialReadSnapshot } from '../../../../core/ecdsaMaterialReadSnapshot';
 import { type EcdsaMaterialReadSource } from '../../../../core/d1EcdsaSignerRead';
 import type { WalletEcdsaSignerRecord } from '../../../../core/WalletStore';
@@ -48,6 +49,7 @@ export type OrdinaryInactiveSignerMaterialActivationPortV1 = {
     }): Promise<void>;
 };
 export type D1LinkedDeviceAuthorityInstallServiceOptionsV1 = {
+    readonly credentialClaims?: PasskeyCredentialClaims;
     readonly database: D1DatabaseLike;
     readonly scope: D1WalletAuthorityStoreScope;
     readonly authorityStore: D1WalletAuthorityStore;
@@ -75,7 +77,7 @@ export type D1LinkedDeviceAuthorityInstallServiceOptionsV1 = {
     };
     readonly reservationService: OrdinaryInactiveSignerMaterialReservationServiceV1;
     readonly materialActivation: OrdinaryInactiveSignerMaterialActivationPortV1;
-    readonly authorizationService: Pick<AuthorizationService, 'prepareWalletSessionAuthorizationV2' | 'readWalletSessionAuthorizationV2ByMint'>;
+    readonly authorizationService: Pick<AuthorizationService, 'prepareWalletSessionAuthorizationV2' | 'readWalletSessionAuthorizationV2ByMint' | 'prepareDirectWalletSessionCredential'>;
     readonly authorizationStore: {
         prepareDirectWalletSessionAuthorizationV2Statements(persisted: PersistedActiveWalletSessionAuthorizationV2): readonly [
             D1PreparedStatementLike,

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEmailOtpGrantStore.d.ts

@@ -16,7 +16,13 @@ export declare class D1LinkedDeviceEmailOtpGrantStoreV1 {
         readonly database: D1DatabaseLike;
         readonly scope: D1LinkedDeviceSessionScopeV1;
     });
-    issueV1(record: LinkedDeviceEmailOtpGrantRecordV1): Promise<void>;
+    issueV1(record: LinkedDeviceEmailOtpGrantRecordV1): Promise<{
+        readonly kind: 'issued';
+    } | {
+        readonly kind: 'refused';
+        readonly code: 'link_session_inactive';
+        readonly message: string;
+    }>;
     readByIdV1(grantId: string): Promise<LinkedDeviceEmailOtpGrantRecordV1 | null>;
     /**
      * The consumption as statements: a CAS flip from `issued` to `consumed`

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRequestProofNonceStore.d.ts

@@ -1,5 +1,3 @@
-import { type LinkDeviceSessionId } from '../../../../../../shared-ts/src/signing-lanes/ids';
-import { type DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
 import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
 import type { LinkedDeviceRequestProofNonceStoreV1 } from '../../../../core/deviceLinking/requestProof';
 import type { D1LinkedDeviceSessionScopeV1 } from './d1LinkedDeviceSessionStore';
@@ -11,14 +9,7 @@ export declare class D1LinkedDeviceRequestProofNonceStoreV1 implements LinkedDev
     private readonly database;
     private readonly scope;
     constructor(options: D1LinkedDeviceRequestProofNonceStoreOptionsV1);
-    consumeRequestProofNonceV1(input: {
-        readonly linkSessionId: LinkDeviceSessionId;
-        readonly requestNonceB64u: string;
-        readonly proofDigestB64u: DigestB64u;
-        readonly issuedAtMs: number;
-        readonly expiresAtMs: number;
-        readonly consumedAtMs: number;
-    }): Promise<{
+    consumeRequestProofNonceV1(input: unknown): Promise<{
         readonly outcome: 'consumed';
     } | {
         readonly outcome: 'already_used';

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRouteService.d.ts

@@ -1,8 +1,12 @@
+import type { LinkedDeviceBootstrapStore } from '../../../../core/deviceLinking/linkedDeviceBootstrap';
 import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
 import type { DeviceLinkingAuthDeniedV1, DeviceLinkingAuthenticatedRequestV1, DeviceLinkingOwnerRequestInputV1, DeviceLinkingRouteServiceV1 } from '../../../../router/transport/fetch/routes/deviceLinking';
+import { type LinkedDeviceRequestProofNonceStoreV1 } from '../../../../core/deviceLinking/requestProof';
 import type { LinkedDeviceOwnerAuthorizationPortV1 } from '../../../../core/deviceLinking/linkedDeviceSession';
 import { type D1LinkedDeviceSessionScopeV1 } from './d1LinkedDeviceSessionStore';
 export type D1LinkedDeviceRouteServiceOptionsV1 = {
+    readonly bootstrap?: LinkedDeviceBootstrapStore;
+    readonly proofNonces?: LinkedDeviceRequestProofNonceStoreV1;
     readonly database: D1DatabaseLike;
     readonly scope: D1LinkedDeviceSessionScopeV1;
     readonly ownerAuthorization: LinkedDeviceOwnerAuthorizationPortV1;

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionStore.d.ts

@@ -1,3 +1,4 @@
+import { type LinkedDeviceBootstrapStore } from '../../../../core/deviceLinking/linkedDeviceBootstrap';
 import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
 import type { LinkedDeviceApprovalV1, LinkedDeviceSessionClaimV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
 import type { LinkedDeviceSessionListCursorV1, LinkedDeviceSessionListPageV1, LinkedDeviceSessionStoreV1 } from '../../../../core/deviceLinking/linkedDeviceSession';
@@ -8,6 +9,7 @@ import type { WalletAuthorityId, WalletId } from '../../../../../../shared-ts/sr
 import type { D1TenantScope } from '../../../../core/d1TenantStore';
 export type D1LinkedDeviceSessionScopeV1 = D1TenantScope;
 export type D1LinkedDeviceSessionStoreOptionsV1 = {
+    readonly bootstrap?: LinkedDeviceBootstrapStore;
     readonly database: D1DatabaseLike;
     readonly scope: D1LinkedDeviceSessionScopeV1;
     readonly now?: () => number;
@@ -15,11 +17,15 @@ export type D1LinkedDeviceSessionStoreOptionsV1 = {
 /** Aborts the batch it is in when the statement just before it changed no row. */
 export declare const SESSION_CAS_GUARD_SQL = "INSERT INTO linked_device_session_cas_guard (guard_id)\nSELECT 1\n WHERE changes() = 0";
 export declare class D1LinkedDeviceSessionStoreV1 implements LinkedDeviceSessionStoreV1 {
+    private readonly bootstrap;
     private readonly database;
     private readonly scope;
     constructor(options: D1LinkedDeviceSessionStoreOptionsV1);
     createUnclaimedSessionV1(record: LinkedDeviceSessionRecordV1): Promise<LinkedDeviceSessionMutationResultV1>;
     getSessionV1(linkSessionId: LinkDeviceSessionId): Promise<LinkedDeviceSessionRecordV1 | null>;
+    private sessionInsertStatement;
+    private importClaimedSession;
+    private readLocalSession;
     private deleteRetiredShapeSessionRowV1;
     listSessionsForWalletV1(input: {
         readonly walletId: WalletId;

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetPlanner.d.ts

@@ -1,8 +1,7 @@
 import type { LinkedDeviceApprovalV1, LinkedDeviceTargetPreparationV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
 import type { DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
 import type { MpcMaterialActivationRef, WebAuthnRpId } from '../../../../../../shared-ts/src/utils/domainIds';
-import type { ActiveLaneProtocolSourceV1, EcdsaTargetCapabilityBindingV1, LaneTargetSigningWorkerV1 } from '../../../../../../shared-ts/src/signing-lanes/rotation';
-import type { LaneHolderParticipantId } from '../../../../../../shared-ts/src/signing-lanes/participants';
+import type { ActiveLaneProtocolSourceV1 } from '../../../../../../shared-ts/src/signing-lanes/rotation';
 import type { EvmFamilySigningKeySlotId } from '../../../../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId';
 import type { KeyCreationSignerSlot } from '../../../../../../shared-ts/src/passkey-custody/primitives';
 import type { Ed25519PublicKeyB64u } from '../../../../../../shared-ts/src/passkey-custody/primitives';
@@ -44,17 +43,6 @@ type LinkedDeviceOwnerEcdsaSourceChildResolutionV1 = LinkedDeviceOwnerSourceChil
     readonly linkedSourceMaterialActivation?: MpcMaterialActivationRef;
 };
 export type LinkedDeviceOwnerSourceChildResolutionV1 = LinkedDeviceOwnerEd25519SourceChildResolutionV1 | LinkedDeviceOwnerEcdsaSourceChildResolutionV1;
-export type LinkedDeviceTargetEnrichedChildResolutionV1 = (LinkedDeviceOwnerEd25519SourceChildResolutionV1 & {
-    readonly targetHolderParticipantId: LaneHolderParticipantId;
-    readonly targetSigningWorker: LaneTargetSigningWorkerV1;
-    readonly yaoSuiteId: import('../../../../../../shared-ts/src/signing-lanes/ids').Ed25519YaoSuiteId;
-    readonly circuitDigestB64u: string;
-}) | (LinkedDeviceOwnerEcdsaSourceChildResolutionV1 & {
-    readonly targetHolderParticipantId: LaneHolderParticipantId;
-    readonly targetSigningWorker: LaneTargetSigningWorkerV1;
-    readonly targetCapability: EcdsaTargetCapabilityBindingV1;
-    readonly reshareChannelBindingDigestB64u: string;
-});
 export type LinkedDeviceTargetPreparationResolutionV1 = LinkedDeviceOwnerSourceChildResolutionV1;
 export type LinkedDeviceOwnerSourceChildResolutionRequestV1 = {
     readonly kind: 'preparation';

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeService.d.ts

@@ -4,7 +4,7 @@ import type { CloudflareD1EmailOtpChallengeStore } from './d1EmailOtpChallengeSt
 import type { CloudflareD1EmailOtpChallengeVerifier } from './d1EmailOtpChallengeVerifier';
 import type { CloudflareD1EmailOtpGrantStore } from './d1EmailOtpGrantStore';
 import type { CloudflareD1EmailOtpRegistrationEnrollmentFinalizer } from './d1EmailOtpRegistrationEnrollmentFinalizer';
-import type { CloudflareD1GoogleEmailOtpRegistrationAttemptStore } from './d1GoogleEmailOtpRegistrationAttemptStore';
+import type { GoogleEmailOtpRegistrationAttemptStore } from './d1GoogleEmailOtpRegistrationAttemptStore';
 type CreateEmailOtpChallengeInput = Parameters<RouterApiEmailOtpRouteService['createEmailOtpChallenge']>[0];
 type CreateEmailOtpChallengeResult = Awaited<ReturnType<RouterApiEmailOtpRouteService['createEmailOtpChallenge']>>;
 type CreateEmailOtpEnrollmentChallengeInput = Parameters<RouterApiEmailOtpRouteService['createEmailOtpEnrollmentChallenge']>[0];
@@ -33,7 +33,7 @@ export declare class CloudflareD1EmailOtpChallengeService {
         readonly grantTtlMs: number;
         readonly grants: CloudflareD1EmailOtpGrantStore;
         readonly issuer: CloudflareD1EmailOtpChallengeIssuer;
-        readonly registrationAttempts: CloudflareD1GoogleEmailOtpRegistrationAttemptStore;
+        readonly registrationAttempts: GoogleEmailOtpRegistrationAttemptStore;
         readonly verifier: CloudflareD1EmailOtpChallengeVerifier;
     });
     createEmailOtpChallenge(input: CreateEmailOtpChallengeInput): Promise<CreateEmailOtpChallengeResult>;

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeStore.d.ts

@@ -12,7 +12,7 @@ type EmailOtpRegistrationVerificationReceiptConsumeResult = {
 } | {
     readonly kind: 'challenge_missing';
 };
-export type EmailOtpChallengeContextInput = {
+type EmailOtpChallengeContextInput = {
     readonly challengeSubjectId: string;
     readonly walletId: string;
     readonly orgId: string;

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpGrantStore.d.ts

@@ -7,7 +7,5 @@ export declare class CloudflareD1EmailOtpGrantStore {
     });
     put(record: EmailOtpGrantRecord): Promise<void>;
     consume(grantToken: string): Promise<EmailOtpGrantRecord | null>;
-    read(grantToken: string): Promise<EmailOtpGrantRecord | null>;
-    delete(grantToken: string): Promise<void>;
 }
 //# sourceMappingURL=d1EmailOtpGrantStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpRateLimitStore.d.ts

@@ -16,14 +16,30 @@ type EmailOtpRateLimitConsumeInput = {
 };
 type EmailOtpRateLimitConsumeResult = Readonly<RateLimitResult>;
 export declare class CloudflareD1EmailOtpRateLimitStore {
-    private readonly prepare;
     private readonly rateLimits;
+    private readonly counter;
     constructor(input: {
         readonly prepare: ScopedD1Prepare;
         readonly rateLimits: EmailOtpRateLimitPolicies;
+        readonly counter?: EmailOtpRateLimitCounter;
     });
     consume(input: EmailOtpRateLimitConsumeInput): Promise<EmailOtpRateLimitConsumeResult>;
-    private consumeKey;
+}
+export interface EmailOtpRateLimitCounter {
+    consume(input: {
+        readonly key: string;
+        readonly limit: number;
+        readonly windowMs: number;
+    }): Promise<EmailOtpRateLimitConsumeResult>;
+}
+export declare class D1EmailOtpRateLimitCounter implements EmailOtpRateLimitCounter {
+    private readonly prepare;
+    constructor(prepare: ScopedD1Prepare);
+    consume(input: {
+        readonly key: string;
+        readonly limit: number;
+        readonly windowMs: number;
+    }): Promise<EmailOtpRateLimitConsumeResult>;
 }
 export {};
 //# sourceMappingURL=d1EmailOtpRateLimitStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationAttemptStore.d.ts

@@ -1,13 +1,25 @@
+import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
 import type { RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
 import type { GoogleEmailOtpRegistrationAttemptRecord, NonEmptyGoogleEmailOtpRegistrationOfferCandidates, PendingGoogleEmailOtpRegistrationAttemptRecord } from '../../../../core/EmailOtpStores';
 import { type ScopedD1Prepare } from '../../../../core/emailOtpD1Statements';
 export declare class CloudflareD1GoogleEmailOtpRegistrationAttemptStore {
     private readonly prepare;
     private readonly orgId;
+    private readonly batch;
     constructor(input: {
         readonly prepare: ScopedD1Prepare;
         readonly orgId: string;
+        readonly batch: D1DatabaseLike['batch'];
     });
+    complete(input: {
+        readonly attemptId: string;
+        readonly walletId: string;
+    }): Promise<import("./d1GoogleRegistrationCompletion").GoogleRegistrationCompletionResult>;
+    completeCommitted(input: {
+        readonly attemptId: string;
+        readonly walletId: string;
+        readonly intentDigest: string;
+    }): Promise<import("./d1GoogleRegistrationCompletion").GoogleRegistrationCompletionResult>;
     cleanupExpired(nowMs: number): Promise<number>;
     create(input: {
         readonly providerSubject: string;
@@ -42,8 +54,24 @@ export declare class CloudflareD1GoogleEmailOtpRegistrationAttemptStore {
         readonly walletId: string;
         readonly nowMs: number;
     }): Promise<boolean>;
+    claimCandidate(input: {
+        readonly attemptId: string;
+        readonly candidateId: string;
+        readonly walletId: string;
+        readonly intentDigest: string;
+    }): Promise<RegistrationCandidateClaimResult>;
     read(attemptId: string): Promise<GoogleEmailOtpRegistrationAttemptRecord | null>;
     put(record: GoogleEmailOtpRegistrationAttemptRecord): Promise<void>;
-    delete(attemptId: string): Promise<void>;
+    private deleteMalformedUnclaimed;
 }
+export type GoogleEmailOtpRegistrationAttemptStore = Pick<CloudflareD1GoogleEmailOtpRegistrationAttemptStore, keyof CloudflareD1GoogleEmailOtpRegistrationAttemptStore>;
+export type RegistrationCandidateClaimResult = {
+    readonly ok: true;
+    readonly code?: never;
+    readonly message?: never;
+} | {
+    readonly ok: false;
+    readonly code: 'registration_candidate_unavailable';
+    readonly message: string;
+};
 //# sourceMappingURL=d1GoogleEmailOtpRegistrationAttemptStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationRecords.d.ts

@@ -1,5 +1,5 @@
 import type { RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
-import type { GoogleEmailOtpRegistrationAttemptRecord, GoogleEmailOtpRegistrationOfferCandidateRecord, PendingGoogleEmailOtpRegistrationAttemptRecord } from '../../../../core/EmailOtpStores';
+import type { GoogleEmailOtpRegistrationAttemptRecord, NonEmptyGoogleEmailOtpRegistrationOfferCandidates, PendingGoogleEmailOtpRegistrationAttemptRecord } from '../../../../core/EmailOtpStores';
 export type D1EmailOtpRegistrationAttemptRow = {
     readonly attempt_id?: unknown;
     readonly record_json?: unknown;
@@ -21,31 +21,18 @@ type GoogleEmailOtpRegistrationOfferForResponse = {
     ];
 };
 export declare function requireRuntimePolicyScope(input: unknown): RuntimePolicyScope;
-export declare function activeGoogleEmailOtpRegistrationAttemptRecord(input: {
-    readonly record: PendingGoogleEmailOtpRegistrationAttemptRecord;
-    readonly updatedAtMs: number;
-}): GoogleEmailOtpRegistrationAttemptRecord;
 export declare function expiredGoogleEmailOtpRegistrationAttemptRecord(input: {
     readonly record: GoogleEmailOtpRegistrationAttemptRecord;
     readonly updatedAtMs: number;
 }): GoogleEmailOtpRegistrationAttemptRecord;
-export declare function failedGoogleEmailOtpRegistrationAttemptWithCode(input: {
-    readonly record: PendingGoogleEmailOtpRegistrationAttemptRecord;
-    readonly failureCode: string;
-    readonly updatedAtMs: number;
-}): GoogleEmailOtpRegistrationAttemptRecord;
+export declare function parseGoogleEmailOtpRegistrationAttemptRecord(input: unknown): GoogleEmailOtpRegistrationAttemptRecord | null;
 export declare function parseGoogleEmailOtpRegistrationAttemptRow(row: D1EmailOtpRegistrationAttemptRow | null): GoogleEmailOtpRegistrationAttemptRecord | null;
 export declare function googleEmailOtpRegistrationOfferForResponse(input: Pick<PendingGoogleEmailOtpRegistrationAttemptRecord, 'offerId' | 'offerCandidates' | 'selectedCandidateId'>): GoogleEmailOtpRegistrationOfferForResponse;
-export declare function pendingGoogleEmailOtpRegistrationAttemptWithUpdatedAt(record: PendingGoogleEmailOtpRegistrationAttemptRecord, updatedAtMs: number): PendingGoogleEmailOtpRegistrationAttemptRecord;
-export declare function pendingGoogleEmailOtpRegistrationAttemptWithSelectedCandidate(input: {
-    readonly record: PendingGoogleEmailOtpRegistrationAttemptRecord;
-    readonly candidate: GoogleEmailOtpRegistrationOfferCandidateRecord;
-    readonly updatedAtMs: number;
-}): PendingGoogleEmailOtpRegistrationAttemptRecord;
 export declare function abandonedGoogleEmailOtpRegistrationAttemptRecord(input: {
     readonly record: PendingGoogleEmailOtpRegistrationAttemptRecord;
     readonly failureCode: 'owner_proof_binding_replaced' | 'offer_restarted_by_user';
     readonly updatedAtMs: number;
 }): GoogleEmailOtpRegistrationAttemptRecord;
+export declare function parseGoogleEmailOtpRegistrationOfferCandidates(input: unknown): NonEmptyGoogleEmailOtpRegistrationOfferCandidates | null;
 export {};
 //# sourceMappingURL=d1GoogleEmailOtpRegistrationRecords.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpSessionResolver.d.ts

@@ -2,7 +2,7 @@ import type { IdentityStore, LinkIdentityResult } from '../../../../core/Identit
 import type { RouterApiEmailOtpRouteService, RouterApiIdentityService } from '../../../framework/authServicePort';
 import type { CloudflareD1EmailOtpEnrollmentStore } from './d1EmailOtpEnrollmentStore';
 import type { CloudflareD1EmailOtpRateLimitStore } from './d1EmailOtpRateLimitStore';
-import type { CloudflareD1GoogleEmailOtpRegistrationAttemptStore } from './d1GoogleEmailOtpRegistrationAttemptStore';
+import type { GoogleEmailOtpRegistrationAttemptStore } from './d1GoogleEmailOtpRegistrationAttemptStore';
 type ResolveGoogleEmailOtpSessionInput = Parameters<RouterApiIdentityService['resolveGoogleEmailOtpSession']>[0];
 type ResolveGoogleEmailOtpSessionResult = Awaited<ReturnType<RouterApiIdentityService['resolveGoogleEmailOtpSession']>>;
 type CleanupGoogleEmailOtpDevRegistrationStateInput = Parameters<RouterApiEmailOtpRouteService['cleanupGoogleEmailOtpDevRegistrationState']>[0];
@@ -36,11 +36,16 @@ export declare class CloudflareD1GoogleEmailOtpSessionResolver {
         readonly identityStore: IdentityStore;
         readonly linkIdentity: GoogleEmailOtpIdentityLinker;
         readonly production: boolean;
-        readonly registrationAttempts: CloudflareD1GoogleEmailOtpRegistrationAttemptStore;
+        readonly registrationAttempts: GoogleEmailOtpRegistrationAttemptStore;
     });
     resolve(input: ResolveGoogleEmailOtpSessionInput): Promise<ResolveGoogleEmailOtpSessionResult>;
     cleanupDevRegistrationState(input: CleanupGoogleEmailOtpDevRegistrationStateInput): Promise<CleanupGoogleEmailOtpDevRegistrationStateResult>;
     consumeRegistrationAttemptRateLimit(input: ConsumeGoogleEmailOtpRegistrationAttemptRateLimitInput): Promise<ConsumeGoogleEmailOtpRegistrationAttemptRateLimitResult>;
+    completeCommittedRegistrationAttempt(input: {
+        readonly registrationAttemptId: string;
+        readonly walletId: string;
+        readonly intentDigest: string;
+    }): Promise<import("./d1GoogleRegistrationCompletion").GoogleRegistrationCompletionResult>;
     completeRegistrationAttempt(input: {
         readonly registrationAttemptId?: unknown;
         readonly walletId?: unknown;

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1GoogleRegistrationCompletion.d.ts

@@ -0,0 +1,23 @@
+import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
+import type { ScopedD1Prepare } from '../../../../core/emailOtpD1Statements';
+export type GoogleRegistrationCompletionResult = {
+    readonly ok: true;
+    readonly code?: never;
+    readonly message?: never;
+} | {
+    readonly ok: false;
+    readonly code: 'registration_incomplete';
+    readonly message: string;
+};
+export declare function completeGoogleRegistration(prepare: ScopedD1Prepare, batch: D1DatabaseLike['batch'], input: {
+    readonly kind: 'live_offer';
+    readonly attemptId: string;
+    readonly walletId: string;
+    readonly intentDigest?: never;
+} | {
+    readonly kind: 'committed_wallet';
+    readonly attemptId: string;
+    readonly walletId: string;
+    readonly intentDigest: string;
+}): Promise<GoogleRegistrationCompletionResult>;
+//# sourceMappingURL=d1GoogleRegistrationCompletion.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/identity/d1IdentityService.d.ts

@@ -6,26 +6,14 @@ type LinkIdentityInput = Parameters<RouterApiIdentityService['linkIdentity']>[0]
 type LinkIdentityResult = Awaited<ReturnType<RouterApiIdentityService['linkIdentity']>>;
 type UnlinkIdentityInput = Parameters<RouterApiIdentityService['unlinkIdentity']>[0];
 type UnlinkIdentityResult = Awaited<ReturnType<RouterApiIdentityService['unlinkIdentity']>>;
-type ResolveOidcWalletIdInput = Parameters<RouterApiIdentityService['resolveOidcWalletId']>[0];
-type ResolveOidcWalletIdResult = Awaited<ReturnType<RouterApiIdentityService['resolveOidcWalletId']>>;
-type ResolveGoogleEmailOtpSessionInput = Parameters<RouterApiIdentityService['resolveGoogleEmailOtpSession']>[0];
-type ResolveGoogleEmailOtpSessionResult = Awaited<ReturnType<RouterApiIdentityService['resolveGoogleEmailOtpSession']>>;
-type ResolveGoogleEmailOtpSession = (input: ResolveGoogleEmailOtpSessionInput) => Promise<ResolveGoogleEmailOtpSessionResult>;
 export declare class CloudflareD1IdentityService {
-    private readonly accountIdDerivationSecret;
     private readonly identityStore;
-    private readonly relayerAccount;
-    private readonly resolveGoogleEmailOtpSession;
     constructor(input: {
-        readonly accountIdDerivationSecret: unknown;
         readonly identityStore: IdentityStore;
-        readonly relayerAccount: unknown;
-        readonly resolveGoogleEmailOtpSession: ResolveGoogleEmailOtpSession;
     });
     listIdentities(input: ListIdentitiesInput): Promise<ListIdentitiesResult>;
     linkIdentity(input: LinkIdentityInput): Promise<LinkIdentityResult>;
     unlinkIdentity(input: UnlinkIdentityInput): Promise<UnlinkIdentityResult>;
-    resolveOidcWalletId(input: ResolveOidcWalletIdInput): Promise<ResolveOidcWalletIdResult>;
 }
 export {};
 //# sourceMappingURL=d1IdentityService.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/near/d1SponsoredNearAccount.d.ts

@@ -0,0 +1,24 @@
+import { type WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
+import type { SponsoredNamedNearAccountCreationResult } from '../registration/d1WalletRegistrationService';
+import type { NormalizedCloudflareD1RouterApiAuthServiceOptions } from '../auth/d1RouterApiAuthConfig';
+type SponsoredAccountOptions = Pick<NormalizedCloudflareD1RouterApiAuthServiceOptions, 'database' | 'namespace' | 'orgId' | 'projectId' | 'envId' | 'relayerAccount' | 'relayerPrivateKey' | 'relayerPublicKey' | 'nearRpcUrl' | 'accountInitialBalance'>;
+export type SponsoredNamedNearAccountInput = {
+    readonly walletId: WalletId;
+    readonly accountId: string;
+    readonly publicKey: string;
+    /**
+     * Registration-scoped key for the durable claim. Two attempts at the same
+     * registration share a key so the second replays the first's transaction.
+     */
+    readonly idempotencyKey: string;
+};
+/**
+ * Creates the sponsored account through a durable claim. The signed transaction
+ * and its hash are persisted before the broadcast, so a lost response replays
+ * those exact bytes instead of building a second transaction under a fresh
+ * nonce. Rebroadcasting an identical signed transaction reuses its hash, so the
+ * network treats the retry as the same transaction.
+ */
+export declare function createSponsoredNamedNearAccountForOptions(options: SponsoredAccountOptions, input: SponsoredNamedNearAccountInput): Promise<SponsoredNamedNearAccountCreationResult>;
+export {};
+//# sourceMappingURL=d1SponsoredNearAccount.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/near/d1SponsoredNearAccount.typecheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=d1SponsoredNearAccount.typecheck.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/oidc/d1OidcVerificationService.d.ts

@@ -15,7 +15,6 @@ export declare class CloudflareD1OidcVerificationService {
     private readonly githubOAuth;
     private readonly identityStore;
     private readonly linkIdentity;
-    private readonly oidcJwksCache;
     constructor(input: {
         readonly googleOidcClientId: string | undefined;
         readonly githubOAuth: GithubOAuthConfig | undefined;

package/dist/types/wallet-server/src/router/cloudflare/d1/oidc/googleOidcToken.d.ts

@@ -0,0 +1,4 @@
+import { type GoogleIdTokenClaimValidationResult } from './d1OidcBoundary';
+/** Verifies provider proof without reading or mutating wallet identity state. */
+export declare function verifyGoogleOidcToken(configuredClientId: string | undefined, rawToken: unknown): Promise<GoogleIdTokenClaimValidationResult>;
+//# sourceMappingURL=googleOidcToken.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/passkeyCustody/d1PasskeyCustodyRouteService.d.ts

@@ -335,6 +335,11 @@ type WalletRecoveryRoutePreparationResult = (Extract<WalletRecoveryPreparationRe
 }) | Exclude<WalletRecoveryPreparationResult, {
     readonly kind: 'prepared';
 }> | {
+    readonly kind: 'routing_unavailable';
+    readonly walletId?: never;
+    readonly recoveryOperationId?: never;
+    readonly registration?: never;
+} | {
     readonly kind: 'manifest_unavailable';
     readonly reason: string;
 } | {