@seams/wallet-server 0.7.3 → 0.9.0

package/dist/types/wallet-server/src/hosted-wallet-gateway.d.ts

@@ -1,6 +1,8 @@
+import type { WalletRegistrationContextResolver } from './router/framework/apiCredentialPorts';
+import type { WalletLifecycleRoutingPublisher } from './authorization/lifecycleRouting';
 import { type D1DatabaseLike } from './cloud-host';
 import { type WalletConsoleServiceBinding } from './cloud-host';
-import { type WalletControlRuntimeBindings } from './cloud-host';
+import { type WalletControlRuntimeBindings, type WalletRuntimeWalletIdentitiesResult, type WalletRuntimeWalletIdentityRequest } from './cloud-host';
 import { createCloudflareD1RouterApiAuthService, type CloudflareD1RouterApiAuthServiceOptions } from './cloud-host';
 import type { SigningSessionSealRoutesOptions } from './cloud-host';
 import type { CfExecutionContext, FetchHandler } from './cloud-host';
@@ -35,8 +37,6 @@ export interface CloudflareD1GatewayBaseEnv extends Readonly<Record<string, unkn
     readonly GITHUB_OAUTH_CLIENT_ID?: string;
     readonly GITHUB_OAUTH_CLIENT_SECRET?: string;
     readonly GITHUB_OAUTH_CALLBACK_URL?: string;
-    readonly ACCOUNT_ID_DERIVATION_SECRET?: string;
-    readonly ROUTER_AB_NORMAL_SIGNING_WORKER_ID?: string;
     readonly SIGNING_WORKER_ID?: string;
     readonly ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET?: string;
     readonly ROUTER_AB_GATEWAY_TO_ROUTER_AUTH_SECRET?: string;
@@ -79,6 +79,18 @@ export interface CloudflareD1GatewayEnv extends CloudflareD1GatewayBaseEnv {
     readonly WALLET_CONSOLE: WalletConsoleServiceBinding;
 }
 export interface HostedWalletGatewayDependenciesV1 {
+    readonly registrationContext?: WalletRegistrationContextResolver;
+    readonly identityStore?: CloudflareD1RouterApiAuthServiceOptions['identityStore'];
+    readonly googleRegistrationAttempts?: CloudflareD1RouterApiAuthServiceOptions['googleRegistrationAttempts'];
+    readonly sessionRouting?: CloudflareD1RouterApiAuthServiceOptions['sessionRouting'];
+    readonly lifecycleRouting?: WalletLifecycleRoutingPublisher;
+    readonly recoveryRouting?: CloudflareD1RouterApiAuthServiceOptions['recoveryRouting'];
+    readonly registrationSetupDispatcher?: CloudflareD1RouterApiAuthServiceOptions['registrationSetupDispatcher'];
+    readonly registrationAuthority?: CloudflareD1RouterApiAuthServiceOptions['registrationAuthority'];
+    readonly credentialClaims?: CloudflareD1RouterApiAuthServiceOptions['credentialClaims'];
+    readonly linkedDeviceBootstrap?: CloudflareD1RouterApiAuthServiceOptions['linkedDeviceBootstrap'];
+    readonly linkedDeviceProofNonces?: CloudflareD1RouterApiAuthServiceOptions['linkedDeviceProofNonces'];
+    readonly syncChallenges?: CloudflareD1RouterApiAuthServiceOptions['syncChallenges'];
     readonly emailOtpDeliveryProvider?: CloudflareD1RouterApiAuthServiceOptions['emailOtpDeliveryProvider'];
     /** Host loader for the signer WASM; defaults to the Workers module import. */
     readonly signerWasm?: CloudflareD1RouterApiAuthServiceOptions['signerWasmModuleOrPath'];
@@ -91,13 +103,14 @@ export declare function createStagingEd25519YaoBackend(env: CloudflareD1GatewayB
  * stay on the Wallet Console deployment until policy/sponsorship resolution
  * operations join the binding.
  */
-export declare function createHostedWalletGatewayCompositionV1(env: CloudflareD1GatewayEnv, dependencies?: HostedWalletGatewayDependenciesV1): Promise<{
+export declare function createHostedWalletGatewayCompositionV1(env: CloudflareD1GatewayEnv, dependencies?: HostedWalletGatewayDependenciesV1, background?: CfExecutionContext | null): Promise<{
     handler: FetchHandler;
     service: import("./cloud-host").CloudflareD1RouterApiAuthService;
     session: import("./cloud-host").SessionAdapter;
 }>;
-export declare function createSplitGatewayRouterHandler(env: CloudflareD1GatewayEnv, dependencies?: HostedWalletGatewayDependenciesV1): Promise<FetchHandler>;
+export declare function createSplitGatewayRouterHandler(env: CloudflareD1GatewayEnv, dependencies?: HostedWalletGatewayDependenciesV1, background?: CfExecutionContext | null): Promise<FetchHandler>;
 export declare function handleSplitGatewayWalletRuntimeRequest(request: Request, env: CloudflareD1GatewayEnv & WalletControlRuntimeBindings, dependencies?: HostedWalletGatewayDependenciesV1): Promise<Response | null>;
+export declare function readWalletRuntimeIdentities(env: CloudflareD1GatewayEnv, input: WalletRuntimeWalletIdentityRequest): Promise<WalletRuntimeWalletIdentitiesResult>;
 export declare function handleSplitGatewayRequest(request: Request, env: CloudflareD1GatewayEnv, ctx: CfExecutionContext, dependencies?: HostedWalletGatewayDependenciesV1): Promise<Response>;
 export declare function stagingSigningSessionSealOptions(env: Pick<CloudflareD1GatewayBaseEnv, 'SIGNING_SESSION_SEAL_ROOT_SECRET_B64U' | 'SIGNING_SESSION_SEAL_CURRENT_KEY_VERSION' | 'SIGNING_SESSION_SEAL_ACCEPTED_WARM_KEY_VERSIONS'>): SigningSessionSealRoutesOptions | undefined;
 declare function createStagingYaoPartitionedStateStore(env: CloudflareD1GatewayBaseEnv): ReturnType<typeof createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1>;

package/dist/types/wallet-server/src/index.d.ts

@@ -1,28 +1,23 @@
 export * from './core/types';
 export * from './core/config';
-export * from './core/defaultConfigsServer';
 export { formatSigningSessionSealKeyVersionForWire, parseSigningSessionSealKeyVersion, type SigningSessionSealKeyVersion, } from './core/keyMaterialBrands';
-export { AuthService } from './core/AuthService';
 export * from './authorization/domain';
 export * from './authorization/service';
 export * from './authorization/vaultProxyUse';
 export { SessionService, parseCsvList, buildCorsOrigins } from './core/SessionService';
 export type { SessionConfig } from './core/SessionService';
-export { createThresholdEd25519KeyStore, createThresholdEd25519SessionStore, createEd25519WalletSessionStore, createEcdsaWalletSessionStore, } from './core/ThresholdService';
-export { createRouterAbSigningRuntimes, type RouterAbSigningRuntimeBundle, } from './core/routerAbSigning/createRouterAbSigningRuntimes';
 export { RouterAbEcdsaPresignRuntime } from './core/routerAbSigning/RouterAbEcdsaPresignRuntime';
 export { ensureEvmCryptoWasm, computeEip1559TxHash, signSecp256k1Recoverable, encodeEip1559SignedTxFromSignature65, secp256k1PrivateKey32ToPublicKey33, secp256k1PublicKey33ToEthereumAddress, } from './core/ThresholdService/evmCryptoWasm';
 export type { ServerEip1559UnsignedTx } from './core/ThresholdService/evmCryptoWasm';
-export type { ThresholdEd25519KeyStore, ThresholdEd25519KeyRecord, ThresholdEd25519SessionStore, ThresholdEd25519MpcSessionRecord, ThresholdEd25519SigningSessionRecord, ThresholdEd25519Commitments, Ed25519WalletSessionStore, Ed25519WalletSessionRecord, } from './core/ThresholdService';
+export type { Ed25519WalletSessionStore, Ed25519WalletSessionRecord, } from './core/ThresholdService';
 export * from './core/signingMaterial/ordinaryInactiveSignerMaterialReservation';
-export { D1WalletAuthMethodStore, createWalletAuthMethodStore, ensureWalletAuthMethodStoreD1Schema, normalizeWalletAuthMethod, resolveWalletAuthMethodStoreNamespace, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, type D1WalletAuthMethodStoreOptions, type D1WalletAuthMethodStoreSchemaOptions, type WalletAuthMethodRecord, type WalletAuthMethodStore, } from './core/WalletAuthMethodStore';
-export { D1WalletStore, WALLET_STORE_D1_SCHEMA_SQL, buildWalletEcdsaSignerRecord, buildWalletEd25519SignerId, createWalletStore, ensureWalletStoreD1Schema, resolveWalletStoreNamespace, type D1WalletStoreOptions, type D1WalletStoreSchemaOptions, type WalletEcdsaSignerRecord, type WalletEd25519SignerRecord, type WalletRecord, type WalletSignerRecord, type WalletStore, } from './core/WalletStore';
-export { D1WebAuthnAuthenticatorStore, WEBAUTHN_AUTHENTICATOR_STORE_D1_SCHEMA_SQL, createWebAuthnAuthenticatorStore, ensureWebAuthnAuthenticatorStoreD1Schema, resolveWebAuthnAuthenticatorStoreNamespace, type D1WebAuthnAuthenticatorStoreOptions, type D1WebAuthnAuthenticatorStoreSchemaOptions, type WebAuthnAuthenticatorRecord, type WebAuthnAuthenticatorStore, } from './core/WebAuthnAuthenticatorStore';
-export { D1WebAuthnCredentialBindingStore, WEBAUTHN_CREDENTIAL_BINDING_STORE_D1_SCHEMA_SQL, createWebAuthnCredentialBindingStore, ensureWebAuthnCredentialBindingStoreD1Schema, resolveWebAuthnCredentialBindingStoreNamespace, type D1WebAuthnCredentialBindingStoreOptions, type D1WebAuthnCredentialBindingStoreSchemaOptions, type WebAuthnCredentialBindingRecord, type WebAuthnCredentialBindingStore, } from './core/WebAuthnCredentialBindingStore';
-export { D1WebAuthnLoginChallengeStore, WEBAUTHN_LOGIN_CHALLENGE_STORE_D1_SCHEMA_SQL, createWebAuthnLoginChallengeStore, ensureWebAuthnLoginChallengeStoreD1Schema, type D1WebAuthnLoginChallengeStoreOptions, type D1WebAuthnLoginChallengeStoreSchemaOptions, type WebAuthnLoginChallengeRecord, type WebAuthnLoginChallengeStore, } from './core/WebAuthnLoginChallengeStore';
-export { D1WebAuthnSyncChallengeStore, WEBAUTHN_SYNC_CHALLENGE_STORE_D1_SCHEMA_SQL, createWebAuthnSyncChallengeStore, ensureWebAuthnSyncChallengeStoreD1Schema, type D1WebAuthnSyncChallengeStoreOptions, type D1WebAuthnSyncChallengeStoreSchemaOptions, type WebAuthnSyncChallengeRecord, type WebAuthnSyncChallengeStore, } from './core/WebAuthnSyncChallengeStore';
-export { D1IdentityStore, IDENTITY_STORE_D1_SCHEMA_SQL, createIdentityStore, ensureIdentityStoreD1Schema, resolveIdentityStoreNamespace, type D1IdentityStoreOptions, type D1IdentityStoreSchemaOptions, type IdentityStore, type IdentitySubjectRecord, type IdentityUserRecord, type LinkIdentityResult, type UnlinkIdentityResult, } from './core/IdentityStore';
-export { D1NearPublicKeyStore, NEAR_PUBLIC_KEY_STORE_D1_SCHEMA_SQL, createNearPublicKeyStore, ensureNearPublicKeyStoreD1Schema, type D1NearPublicKeyStoreOptions, type D1NearPublicKeyStoreSchemaOptions, type NearPublicKeyKind, type NearPublicKeyRecord, type NearPublicKeyStore, } from './core/NearPublicKeyStore';
+export { D1WalletAuthMethodStore, ensureWalletAuthMethodStoreD1Schema, normalizeWalletAuthMethod, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, type D1WalletAuthMethodStoreOptions, type D1WalletAuthMethodStoreSchemaOptions, type WalletAuthMethodRecord, type WalletAuthMethodStore, } from './core/WalletAuthMethodStore';
+export { D1WalletStore, WALLET_STORE_D1_SCHEMA_SQL, buildWalletEcdsaSignerRecord, buildWalletEd25519SignerId, ensureWalletStoreD1Schema, type D1WalletStoreOptions, type D1WalletStoreSchemaOptions, type WalletEcdsaSignerRecord, type WalletEd25519SignerRecord, type WalletRecord, type WalletSignerRecord, type WalletStore, } from './core/WalletStore';
+export { type WebAuthnAuthenticatorRecord, type WebAuthnAuthenticatorStore, } from './core/WebAuthnAuthenticatorStore';
+export { type WebAuthnCredentialBindingRecord, type WebAuthnCredentialBindingStore, } from './core/WebAuthnCredentialBindingStore';
+export { type WebAuthnLoginChallengeRecord } from './core/WebAuthnLoginChallengeStore';
+export { type WebAuthnSyncChallengeRecord } from './core/WebAuthnSyncChallengeStore';
+export { D1IdentityStore, IDENTITY_STORE_D1_SCHEMA_SQL, ensureIdentityStoreD1Schema, type D1IdentityStoreOptions, type D1IdentityStoreSchemaOptions, type IdentityStore, type IdentitySubjectRecord, type LinkIdentityResult, type UnlinkIdentityResult, } from './core/IdentityStore';
 export { InMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createRouterAbNormalSigningAdmissionAdapter, type RouterAbNormalSigningAbuseDecision, type RouterAbNormalSigningPolicyDecision, type RouterAbNormalSigningAdmissionStore, type RouterAbNormalSigningProjectPolicyDecision, } from './router/domains/signingOperations/routerAbNormalSigningAdmissionCore';
 export { CloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1RouterAbNormalSigningAdmissionStore, type CloudflareD1RouterAbNormalSigningAdmissionStoreOptions, } from './router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore';
 export * from './threshold/session/signingSessionSeal';

package/dist/types/wallet-server/src/localIntendedYaoSigningFault.d.ts

@@ -11,15 +11,8 @@ export declare const ROUTER_AB_ED25519_SIGNING_FINALIZE_PATH_V1 = "/router-ab/ed
  *   authorized but not yet made. The Gateway's answer is a refusal.
  * - `release_signing_finalize` sends a kept finalize to the Router again,
  *   exactly, and answers with the Router's reply.
- * - `arm_signing_worker_hold` asks the SigningWorker to hold the next NEAR
- *   finalize of the wallet the body names after it signs and before it
- *   commits, until its activation is retired: a finalize that loaded its
- *   material just before a recovery promoted. Dev builds of the Workers D1
- *   SigningWorker only; the wallet object and the VM SigningWorker sign and
- *   commit in one step.
- * - `read_signing_worker_hold` reads that hold's state.
  */
-type LocalIntendedYaoSigningFaultModeV1 = 'capture_signing_finalize' | 'withhold_signing_finalize' | 'release_signing_finalize' | 'arm_signing_worker_hold' | 'read_signing_worker_hold';
+type LocalIntendedYaoSigningFaultModeV1 = 'capture_signing_finalize' | 'withhold_signing_finalize' | 'release_signing_finalize';
 export declare function parseLocalIntendedYaoSigningFaultModeV1(value: string | null): LocalIntendedYaoSigningFaultModeV1 | null;
 export declare function parseLocalIntendedYaoSigningFaultTokenV1(value: string | null): string | null;
 /** The Gateway's Router binding, keeping the first NEAR finalize it carries. */
@@ -37,14 +30,6 @@ export declare class LocalIntendedYaoSigningFaultControllerV1 {
 export declare function releaseLocalIntendedYaoSigningFinalizeV1(router: {
     fetch(request: Request): Promise<Response>;
 }, token: string): Promise<Response>;
-/**
- * Arms or reads the SigningWorker's hold on one wallet's next NEAR finalize,
- * with the Gateway's own SigningWorker credential, and answers with the
- * SigningWorker's reply.
- */
-export declare function commandLocalIntendedSigningWorkerHoldV1(signingWorker: {
-    fetch(request: Request): Promise<Response>;
-}, credential: string | undefined, mode: 'arm_signing_worker_hold' | 'read_signing_worker_hold', body: unknown): Promise<Response>;
 export declare function requestWithoutLocalIntendedYaoSigningFaultHeadersV1(request: Request): Request;
 export declare function responseWithLocalIntendedYaoSigningFaultOutcomeV1(response: Response, outcome: string): Response;
 export {};

package/dist/types/wallet-server/src/localRegistrationSetupAuthority.d.ts

@@ -0,0 +1,13 @@
+import type { D1DatabaseLike } from './storage/tenantRoute';
+import type { D1TenantScope } from './core/d1TenantStore';
+import { type WalletRegistrationReservationAuthority, type WalletRegistrationSetupReservationResult } from './router/domains/walletRegistration/walletRegistrationReservation';
+import type { WalletRegistrationSetupInput } from './router/domains/walletRegistration/walletRegistrationInputs';
+export declare class LocalRegistrationSetupAuthority implements WalletRegistrationReservationAuthority {
+    private readonly scope;
+    private readonly storage;
+    constructor(database: D1DatabaseLike, scope: D1TenantScope);
+    reserve(input: WalletRegistrationSetupInput): Promise<WalletRegistrationSetupReservationResult>;
+    admitHome(input: Parameters<WalletRegistrationReservationAuthority['admitHome']>[0]): Promise<Awaited<ReturnType<WalletRegistrationReservationAuthority['admitHome']>>>;
+    complete(input: Parameters<WalletRegistrationReservationAuthority['complete']>[0]): Promise<Awaited<ReturnType<WalletRegistrationReservationAuthority['complete']>>>;
+}
+//# sourceMappingURL=localRegistrationSetupAuthority.d.ts.map

package/dist/types/wallet-server/src/router/auth/commonRouterUtils.d.ts

@@ -1,5 +1,6 @@
-import type { D1EcdsaAdmissionPolicyRead } from '../cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore';
+import type { D1EcdsaAdmissionPolicyRead, D1Ed25519AdmissionPolicyRead } from '../cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore';
 import type { EcdsaMaterialRead } from '../../core/d1EcdsaSignerRead';
+import type { Ed25519SignerRead } from '../../core/d1Ed25519SignerRead';
 import type { ThresholdRuntimePolicyScope } from '../../core/types';
 import type { RouterApiAuthorizationSessionService } from '../framework/authServicePort';
 import type { RouterApiWalletSessionAuthorizationV2AdmissionContext, RouterApiWalletSessionExactOperationContext, RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext } from '../framework/authServicePort';
@@ -84,6 +85,9 @@ export type ThresholdEd25519SessionInputs = {
         readonly curve: 'ed25519';
     }>;
     readonly context: RouterApiWalletSessionAuthorizationV2AdmissionContext;
+    /** The session wallet's signer and policy rows, read in the session's statement. */
+    readonly signerRead: Ed25519SignerRead;
+    readonly policyRead: D1Ed25519AdmissionPolicyRead;
 } | AuthorizeErr;
 export declare function validateRouterAbEd25519WalletSessionInputs(input: {
     headers: Record<string, string | string[] | undefined>;
@@ -92,6 +96,8 @@ export declare function validateRouterAbEd25519WalletSessionInputs(input: {
     operationKind: Extract<WalletSessionAuthorizationV2RequestedOperation, {
         readonly keyFamily: 'ed25519';
     }>['operationKind'];
+    /** The material the request names; the session must admit exactly this activation. */
+    materialActivation: import('../../../../shared-ts/src/utils/routerAbNormalSigningIdentity').RouterAbMpcMaterialActivationRefWire;
 }): Promise<ThresholdEd25519SessionInputs>;
 export type ThresholdEcdsaSessionInputs = {
     readonly ok: true;

package/dist/types/wallet-server/src/router/auth/routerApiCredentialAuth.d.ts

@@ -1,18 +1,21 @@
-import { type RoutePolicyResolutionResult } from '../framework/enforceRoutePolicy';
+import { type RoutePolicyResolutionResult, type RoutePolicyResolutionFailure } from '../framework/enforceRoutePolicy';
 import type { RouterApiKeyAuthAdapter, RouterApiPublishableKeyAuthAdapter } from '../framework/routerApi';
+import type { RouterApiKeyPrincipal, WalletRegistrationContextResolver, WalletRegistrationContextResult } from '../framework/apiCredentialPorts';
 import type { HeaderRecord } from '../framework/routeExecutionContext';
 import type { RouteDefinition } from '../framework/routeDefinitions';
-interface ResolvePublishableKeyApiCredentialAuthInput {
+interface PublishableKeyRequestInput {
     environmentId?: string | null;
     headers: HeaderRecord;
     missingEnvironmentMessage: string;
     missingOriginMessage: string;
     missingPublishableKeyMessage: string;
     origin?: string;
-    publishableKeyAuth: RouterApiPublishableKeyAuthAdapter;
     route: RouteDefinition;
     routeAuthNotConfiguredMessage: string;
 }
+interface ResolvePublishableKeyApiCredentialAuthInput extends PublishableKeyRequestInput {
+    publishableKeyAuth: RouterApiPublishableKeyAuthAdapter;
+}
 interface ResolveSecretKeyApiCredentialAuthInput {
     apiKeyAuth?: RouterApiKeyAuthAdapter | null;
     headers: HeaderRecord;
@@ -20,7 +23,12 @@ interface ResolveSecretKeyApiCredentialAuthInput {
     sourceIp?: string;
     routeAuthNotConfiguredMessage: string;
 }
+export declare function resolveWalletRegistrationContext(input: PublishableKeyRequestInput & {
+    registrationContext: WalletRegistrationContextResolver;
+    registration: Parameters<WalletRegistrationContextResolver['resolve']>[0]['registration'];
+}): Promise<WalletRegistrationContextResult | RoutePolicyResolutionFailure>;
 export declare function resolvePublishableKeyApiCredentialAuth(input: ResolvePublishableKeyApiCredentialAuthInput): Promise<RoutePolicyResolutionResult>;
+export declare function publishableKeyRoutePrincipal(principal: RouterApiKeyPrincipal): Promise<RoutePolicyResolutionResult>;
 export declare function resolveSecretKeyApiCredentialAuth(input: ResolveSecretKeyApiCredentialAuthInput): Promise<RoutePolicyResolutionResult>;
 export {};
 //# sourceMappingURL=routerApiCredentialAuth.d.ts.map

package/dist/types/wallet-server/src/router/auth/walletRegistrationContext.d.ts

@@ -0,0 +1,8 @@
+import type { RouterApiKeyPrincipal, RouterApiProjectEnvironment, RouterApiProjectEnvironmentResolver, RouterApiPublishableKeyAuthAdapter, RouterApiPublishableKeyAuthRequest, WalletRegistrationContextResult } from '../framework/apiCredentialPorts';
+export declare function unavailableRegistrationContext(): WalletRegistrationContextResult;
+/** Join the authenticated credential to its exact active environment at the boundary. */
+export declare function walletRegistrationContext(input: RouterApiPublishableKeyAuthRequest, principal: RouterApiKeyPrincipal, environment: RouterApiProjectEnvironment): WalletRegistrationContextResult;
+export declare function createWalletRegistrationContextResolver(auth: RouterApiPublishableKeyAuthAdapter, environments: RouterApiProjectEnvironmentResolver): {
+    resolve: (input: RouterApiPublishableKeyAuthRequest) => Promise<WalletRegistrationContextResult>;
+};
+//# sourceMappingURL=walletRegistrationContext.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1AuthorizationAssembly.d.ts

@@ -0,0 +1,23 @@
+import { CloudflareD1EmailOtpRateLimitStore } from '../emailOtp/d1EmailOtpRateLimitStore';
+import type { ScopedD1Prepare } from '../../../../core/emailOtpD1Statements';
+import { CloudflareD1WebAuthnAuthService, type D1WebAuthnWalletManifestSource } from '../webauthn/d1WebAuthnAuthService';
+import { CloudflareD1WebAuthnStore } from '../webauthn/d1WebAuthnStore';
+import type { D1WalletAuthMethodStore } from '../../../../core/d1WalletAuthMethodStore';
+import { CloudflareD1WalletCustodyCommitStore } from '../passkeyCustody/d1WalletCustodyCommitStore';
+import type { NormalizedCloudflareD1RouterApiAuthServiceOptions } from './d1RouterApiAuthConfig';
+import { AuthorizationService } from '../../../../authorization/service';
+import type { WalletSessionRoutingPublisher } from '../../../../authorization/sessionRouting';
+import { CloudflareD1AuthorizationStore, type D1AuthorizationStoreOptions } from '../authorization/d1AuthorizationStore';
+export declare function createD1AuthorizationAssembly(options: D1AuthorizationStoreOptions, sessionRouting: WalletSessionRoutingPublisher | undefined): {
+    authorizationStore: CloudflareD1AuthorizationStore;
+    authorizationService: AuthorizationService;
+};
+export declare function createD1WalletCustodyStore(options: NormalizedCloudflareD1RouterApiAuthServiceOptions, walletAuthMethodStore: D1WalletAuthMethodStore): CloudflareD1WalletCustodyCommitStore;
+export declare function createD1WebAuthnAssembly(options: NormalizedCloudflareD1RouterApiAuthServiceOptions, walletAuthMethodStore: D1WalletAuthMethodStore, walletManifestSource: D1WebAuthnWalletManifestSource): {
+    webAuthnStore: CloudflareD1WebAuthnStore;
+    webAuthnAuthService: CloudflareD1WebAuthnAuthService;
+};
+export declare function createD1IdentityStore(options: NormalizedCloudflareD1RouterApiAuthServiceOptions): import("../../../..").IdentityStore;
+export declare function createD1GoogleRegistrationAttempts(options: NormalizedCloudflareD1RouterApiAuthServiceOptions, prepare: ScopedD1Prepare): import("../emailOtp/d1GoogleEmailOtpRegistrationAttemptStore").GoogleEmailOtpRegistrationAttemptStore;
+export declare function createD1EmailOtpRateLimits(options: NormalizedCloudflareD1RouterApiAuthServiceOptions, prepare: ScopedD1Prepare): CloudflareD1EmailOtpRateLimitStore;
+//# sourceMappingURL=d1AuthorizationAssembly.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1EmailOtpRouteService.d.ts

@@ -0,0 +1,16 @@
+import type { RouterApiServiceBag } from '../../../framework/authServicePort';
+import type { CloudflareD1EmailOtpServerSealRuntime } from '../emailOtp/d1EmailOtpServerSealRuntime';
+import type { CloudflareD1EmailOtpChallengeService } from '../emailOtp/d1EmailOtpChallengeService';
+import type { CloudflareD1EmailOtpRecoveryService } from '../emailOtp/d1EmailOtpRecoveryService';
+import type { CloudflareD1GoogleEmailOtpSessionResolver } from '../emailOtp/d1GoogleEmailOtpSessionResolver';
+import type { CloudflareD1OidcVerificationService } from '../oidc/d1OidcVerificationService';
+type D1EmailOtpRouteServiceAssembly = {
+    readonly emailOtpServerSeal: CloudflareD1EmailOtpServerSealRuntime;
+    readonly emailOtpChallengeService: CloudflareD1EmailOtpChallengeService;
+    readonly emailOtpRecoveryService: CloudflareD1EmailOtpRecoveryService;
+    readonly googleEmailOtpSessions: CloudflareD1GoogleEmailOtpSessionResolver;
+    readonly oidcVerification: CloudflareD1OidcVerificationService;
+};
+export declare function createD1EmailOtpRouteService(assembly: D1EmailOtpRouteServiceAssembly): RouterApiServiceBag['emailOtp'];
+export {};
+//# sourceMappingURL=d1EmailOtpRouteService.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1RouterApiAuthConfig.d.ts

@@ -1,3 +1,15 @@
+import type { LinkedDeviceBootstrapStore } from '../../../../core/deviceLinking/linkedDeviceBootstrap';
+import type { LinkedDeviceRequestProofNonceStoreV1 } from '../../../../core/deviceLinking/requestProof';
+import type { WebAuthnSyncChallengeStore } from '../../../../core/WebAuthnSyncChallengeStore';
+import type { PasskeyCredentialClaims } from '../../../../core/passkeyCredentialClaims';
+import type { GoogleEmailOtpRegistrationAttemptStore } from '../emailOtp/d1GoogleEmailOtpRegistrationAttemptStore';
+import type { IdentityStore } from '../../../../core/IdentityStore';
+import type { WalletLifecycleRoutingPublisher } from '../../../../authorization/lifecycleRouting';
+import type { WalletRecoveryRoutingPublisher } from '../../../../authorization/recoveryRouting';
+import type { WalletSessionRoutingPublisher } from '../../../../authorization/sessionRouting';
+import type { WalletRegistrationSetupDispatcher } from '../../../framework/registrationSetupDispatch';
+import type { RegistrationWalletStarter, WalletExecutionAuthority, WalletRegistrationReservationAuthority } from '../../../domains/walletRegistration/walletRegistrationReservation';
+import { D1WalletExecutionAuthority } from '../registration/d1WalletExecutionAuthority';
 import type { LinkedDevicePasskeyTargetConfigurationFieldsV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
 import type { WalletEmailOtpChannel } from '../../../../../../shared-ts/src/utils/emailOtpDomain';
 import type { EmailOtpChallengeAction, EmailOtpChallengeOperation } from '../../../../core/EmailOtpStores';
@@ -96,6 +108,18 @@ export type CloudflareD1GithubOAuthConfig = {
     readonly callbackUrl: string;
 };
 export interface CloudflareD1RouterApiAuthServiceOptions {
+    readonly identityStore?: IdentityStore;
+    readonly credentialClaims?: PasskeyCredentialClaims;
+    readonly linkedDeviceBootstrap?: LinkedDeviceBootstrapStore;
+    readonly linkedDeviceProofNonces?: LinkedDeviceRequestProofNonceStoreV1;
+    readonly syncChallenges?: WebAuthnSyncChallengeStore;
+    readonly googleRegistrationAttempts?: GoogleEmailOtpRegistrationAttemptStore;
+    readonly sessionRouting?: WalletSessionRoutingPublisher;
+    readonly lifecycleRouting?: WalletLifecycleRoutingPublisher;
+    readonly recoveryRouting?: WalletRecoveryRoutingPublisher;
+    readonly registrationSetupDispatcher?: WalletRegistrationSetupDispatcher;
+    readonly registrationAuthority?: WalletRegistrationReservationAuthority;
+    readonly startRegistrationWallets?: RegistrationWalletStarter;
     readonly database: D1DatabaseLike;
     readonly namespace: string;
     readonly orgId: string;
@@ -110,7 +134,6 @@ export interface CloudflareD1RouterApiAuthServiceOptions {
     readonly implicitNearAccountTestFundingEnabled?: boolean | string;
     readonly googleOidcClientId?: string;
     readonly githubOAuth?: CloudflareD1GithubOAuthConfig;
-    readonly accountIdDerivationSecret?: string;
     readonly emailOtpServerSeal?: CloudflareD1EmailOtpServerSealConfig;
     readonly emailOtpDeliveryMode?: string;
     readonly emailOtpRuntimeProfile?: string;
@@ -171,7 +194,10 @@ export type EmailOtpServerSealRuntimeConfig = {
     readonly configured: false;
     readonly message: string;
 };
-export type NormalizedCloudflareD1RouterApiAuthServiceOptions = Omit<CloudflareD1RouterApiAuthServiceOptions, 'relayerAccount' | 'relayerPublicKey' | 'relayerPrivateKey' | 'nearRpcUrl' | 'accountInitialBalance' | 'implicitNearAccountTestFundingEnabled' | 'googleOidcClientId' | 'accountIdDerivationSecret' | 'emailOtpServerSeal' | 'emailOtpDeliveryMode' | 'emailOtpRuntimeProfile' | 'emailOtpDemoAllowedOrigins' | 'emailOtpDeliveryProvider' | 'emailOtpDevOutboxEnabled' | 'emailOtpProduction' | 'emailOtpChallengeTtlMs' | 'emailOtpGrantTtlMs' | 'emailOtpMaxAttempts' | 'emailOtpLockoutTtlMs' | 'emailOtpCodeLength' | 'emailOtpMaxActiveChallengesPerContext' | 'emailOtpChallengeRateLimitMax' | 'emailOtpChallengeRateLimitWindowMs' | 'emailOtpVerifyRateLimitMax' | 'emailOtpVerifyRateLimitWindowMs' | 'emailOtpGrantRateLimitMax' | 'emailOtpGrantRateLimitWindowMs' | 'emailOtpGoogleRegistrationAttemptRateLimitMax' | 'emailOtpGoogleRegistrationAttemptRateLimitWindowMs' | 'routerAbEcdsaPresignRuntime'> & {
+export type NormalizedCloudflareD1RouterApiAuthServiceOptions = Omit<CloudflareD1RouterApiAuthServiceOptions, 'registrationAuthority' | 'relayerAccount' | 'relayerPublicKey' | 'relayerPrivateKey' | 'nearRpcUrl' | 'accountInitialBalance' | 'implicitNearAccountTestFundingEnabled' | 'googleOidcClientId' | 'emailOtpServerSeal' | 'emailOtpDeliveryMode' | 'emailOtpRuntimeProfile' | 'emailOtpDemoAllowedOrigins' | 'emailOtpDeliveryProvider' | 'emailOtpDevOutboxEnabled' | 'emailOtpProduction' | 'emailOtpChallengeTtlMs' | 'emailOtpGrantTtlMs' | 'emailOtpMaxAttempts' | 'emailOtpLockoutTtlMs' | 'emailOtpCodeLength' | 'emailOtpMaxActiveChallengesPerContext' | 'emailOtpChallengeRateLimitMax' | 'emailOtpChallengeRateLimitWindowMs' | 'emailOtpVerifyRateLimitMax' | 'emailOtpVerifyRateLimitWindowMs' | 'emailOtpGrantRateLimitMax' | 'emailOtpGrantRateLimitWindowMs' | 'emailOtpGoogleRegistrationAttemptRateLimitMax' | 'emailOtpGoogleRegistrationAttemptRateLimitWindowMs' | 'routerAbEcdsaPresignRuntime'> & {
+    /** The host's registration authority, with this home's execution state around it. */
+    readonly registrationAuthority?: D1WalletExecutionAuthority;
+    readonly walletExecution: WalletExecutionAuthority;
     readonly relayerAccount?: string;
     readonly relayerPublicKey?: string;
     readonly relayerPrivateKey?: string;
@@ -180,7 +206,6 @@ export type NormalizedCloudflareD1RouterApiAuthServiceOptions = Omit<CloudflareD
     readonly implicitNearAccountTestFundingEnabled: boolean;
     readonly googleOidcClientId?: string;
     readonly githubOAuth?: CloudflareD1GithubOAuthConfig;
-    readonly accountIdDerivationSecret?: string;
     readonly emailOtp: EmailOtpRuntimeConfig;
     readonly emailOtpServerSeal: EmailOtpServerSealRuntimeConfig;
     readonly routerAbEcdsaPresignRuntime?: RouterAbEcdsaPresignRuntime | null;

package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1RouterApiAuthService.d.ts

@@ -1,9 +1,12 @@
+import type { WalletRelocationEmailOtpServices } from '../wallet/d1WalletRelocationEmailOtp';
 import { type ExecuteSignedDelegateRequest, type ExecuteSignedDelegateResult } from '../../../../delegateAction';
 import { type RouterApiServiceBag } from '../../../framework/authServicePort';
-import { type CloudflareD1RouterApiAuthServiceOptions } from './d1RouterApiAuthConfig';
+import { type CloudflareD1RouterApiAuthServiceOptions, type NormalizedCloudflareD1RouterApiAuthServiceOptions } from './d1RouterApiAuthConfig';
 import { D1LinkedDeviceAuthorityInstallServiceV1 } from '../deviceLinking/d1LinkedDeviceAuthorityInstallService';
 export type { CloudflareD1EmailOtpDeliveryProvider, CloudflareD1EmailOtpDeliveryProviderInput, CloudflareD1EmailOtpDeliveryProviderResult, CloudflareD1EmailOtpServerSealConfig, CloudflareD1LinkedDeviceAuthorityInstallationOptionsV1, CloudflareD1LinkedDeviceCompositionOptionsV1, CloudflareD1LinkedDeviceManagementOptionsV1, CloudflareD1LinkedDeviceSessionOptionsV1, CloudflareD1RouterApiAuthServiceOptions, } from './d1RouterApiAuthConfig';
 export type CloudflareD1RouterApiAuthService = Omit<RouterApiServiceBag, 'thresholdRuntime'> & {
+    readonly walletExecution: NormalizedCloudflareD1RouterApiAuthServiceOptions['walletExecution'];
+    readonly relocationEmailOtp: WalletRelocationEmailOtpServices;
     readonly thresholdRuntime: RouterApiServiceBag['thresholdRuntime'];
     readonly executeSignedDelegate: (input: ExecuteSignedDelegateRequest) => Promise<ExecuteSignedDelegateResult>;
     readonly linkedDeviceEd25519AuthorityReader?: LinkedDeviceEd25519AuthorityReader;

package/dist/types/wallet-server/src/router/cloudflare/d1/auth/walletSessionCredentialReaders.d.ts

@@ -1,8 +1,14 @@
 import type { AuthorizationService } from '../../../../authorization/service';
-import type { RouterApiWalletSessionAuthorizationV2AdmissionContext, RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext, RouterApiWalletSessionSigningCandidate } from '../../../framework/authServicePort';
+import type { RouterApiEd25519WalletSessionSigningRead, RouterApiWalletSessionAuthorizationV2AdmissionContext, RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext, RouterApiWalletSessionSigningCandidate } from '../../../framework/authServicePort';
 type CredentialInput = Parameters<AuthorizationService['readWalletSessionAdmissionSnapshotByOperationCredential']>[0];
 type AdmissionSnapshotReader = Pick<AuthorizationService, 'readWalletSessionAdmissionSnapshotByOperationCredential'>;
 export declare function readActiveWalletSessionCredential(service: AdmissionSnapshotReader, input: CredentialInput): Promise<RouterApiWalletSessionAuthorizationV2AdmissionContext | null>;
+/**
+ * The active session with its wallet's Ed25519 signer and policy rows. An
+ * exhausted session throws, as the plain credential read does: its caller
+ * resolves the exhausted candidate separately.
+ */
+export declare function readEd25519WalletSessionSigningRead(service: Pick<AuthorizationService, 'readEd25519WalletSessionAdmissionSnapshotByOperationCredential'>, input: Parameters<AuthorizationService['readEd25519WalletSessionAdmissionSnapshotByOperationCredential']>[0]): Promise<RouterApiEd25519WalletSessionSigningRead | null>;
 export declare function readWalletSessionSigningCandidate(service: Pick<AuthorizationService, 'readEcdsaWalletSessionAdmissionSnapshotByOperationCredential'>, input: Parameters<AuthorizationService['readEcdsaWalletSessionAdmissionSnapshotByOperationCredential']>[0]): Promise<RouterApiWalletSessionSigningCandidate | null>;
 export declare function readExhaustedWalletSessionCredential(service: Pick<AuthorizationService, 'readExactWalletSessionStatusSnapshotByOperationCredential'>, input: CredentialInput): Promise<RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext | null>;
 export {};

package/dist/types/wallet-server/src/router/cloudflare/d1/authorization/d1AuthorizationStore.d.ts

@@ -1,6 +1,8 @@
-import type { EcdsaWalletSessionAdmissionRead } from '../../../../authorization/service';
+import type { EcdsaWalletSessionAdmissionRead, Ed25519WalletSessionAdmissionRead, DirectWalletSessionCommitPurpose } from '../../../../authorization/service';
+import type { D1RegistrationCommitBatch } from '../registration/d1WalletRegistrationCommitStore';
 import type { RouterAbMpcMaterialActivationRefWire } from '../../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
 import type { EcdsaWalletSessionAdmissionInput, EcdsaWalletSessionAdmissionResult, EcdsaWalletSessionResolutionResult, PinnedOwnerWalletScope } from '../../../../authorization/ecdsaWalletSessionAdmission';
+import type { Ed25519WalletSessionAdmissionInput, Ed25519WalletSessionAdmissionResult, Ed25519WalletSessionResolutionInput, Ed25519WalletSessionResolutionResult } from '../../../../authorization/ed25519WalletSessionAdmission';
 import { type MpcMaterialActivationRef, type WalletAuthorityId, type WalletAuthMethodId, type WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
 import { type AuthorizedOperationId, type TenantId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
 import type { AuthorizedOperation, AuthorizedOperationInput, IssuedWalletSessionAuthorizationV2, LiveWalletSessionAuthorizationProjectionV2, WalletSessionAuthorizationV2, ActiveWalletSessionQuota, PersistedActiveWalletSessionAuthorizationV2, DirectV2CommitResult, WalletSessionAuthorizationV2MintLookup, WalletSessionAuthorizationV2MintRead, AuthorizedOperationReplayResponse, CompletedCapabilityOperationResult, IssuedHostedWalletSeamsSessionExchangeV2, RedeemHostedWalletSeamsSessionExchangeV2Input, PersistedHostedWalletSeamsSessionExchangeV2Result, ExactWalletSessionQuotaProjectionV1, ExactWalletSessionStatusV2, ExactWalletSessionStatusSnapshotV2, WalletSessionAdmissionSnapshotV2, WalletSessionExactOperationContext, ResolvedHostedWalletSessionOperationCredentialV2, VerifiedAuthorizationEvidenceSet, VerifiedOwnerProof } from '../../../../authorization/domain';
@@ -60,7 +62,7 @@ export declare class CloudflareD1AuthorizationStore implements AuthorizationSess
     }): readonly D1PreparedStatementLike[];
     private prepareRetireHostedChildrenForParentSelection;
     putIssuedHostedWalletSeamsSessionExchange(exchange: IssuedHostedWalletSeamsSessionExchangeV2): Promise<void>;
-    redeemHostedWalletSeamsSessionExchange(input: RedeemHostedWalletSeamsSessionExchangeV2Input): Promise<PersistedHostedWalletSeamsSessionExchangeV2Result>;
+    redeemHostedWalletSeamsSessionExchange(input: RedeemHostedWalletSeamsSessionExchangeV2Input, publishCredentialLocator?: () => Promise<void>): Promise<PersistedHostedWalletSeamsSessionExchangeV2Result>;
     readHostedWalletSessionOperationCredentialV2(input: {
         readonly tenantId: TenantId;
         readonly tokenHash: import('../../../../../../shared-ts/src/utils/canonicalPrimitives').DigestB64u;
@@ -72,11 +74,19 @@ export declare class CloudflareD1AuthorizationStore implements AuthorizationSess
     commitDirectWalletSessionAuthorizationV2(input: {
         readonly persisted: PersistedActiveWalletSessionAuthorizationV2;
     }): Promise<DirectV2CommitResult>;
+    readWalletSessionIssuanceGeneration(walletId: WalletId): Promise<number>;
+    private prepareWalletSessionIssuanceGenerationRead;
     /** The service validates the committed winner against its caller-specific replay contract. */
     commitDirectReplayableWalletSessionAuthorizationV2(input: {
         readonly persisted: PersistedActiveWalletSessionAuthorizationV2;
+        readonly purpose: DirectWalletSessionCommitPurpose;
+    }): Promise<DirectV2CommitResult>;
+    commitRegistrationWalletSessionAuthorizationV2(commitWallet: (executeBatch: D1RegistrationCommitBatch) => Promise<void>, input: {
+        readonly persisted: PersistedActiveWalletSessionAuthorizationV2;
+        readonly purpose: DirectWalletSessionCommitPurpose;
     }): Promise<DirectV2CommitResult>;
     private commitDirectWalletSessionAuthorizationV2WithMode;
+    private prepareRegistrationSessionCompletion;
     /**
      * Builds the one batch used by direct issuance. Every predecessor mutation
      * is gated by the candidate identity check, so a same-mint replay leaves
@@ -99,6 +109,7 @@ export declare class CloudflareD1AuthorizationStore implements AuthorizationSess
         readonly promotionAtMs: number;
     }): readonly [D1PreparedStatementLike, D1PreparedStatementLike, D1PreparedStatementLike];
     readWalletSessionAuthorizationV2ByMint(input: WalletSessionAuthorizationV2MintLookup): Promise<WalletSessionAuthorizationV2MintRead | null>;
+    private prepareWalletSessionAuthorizationV2ByMintRead;
     readLiveWalletSessionAuthorizationProjectionV2(input: {
         readonly expected: WalletSessionAuthorizationV2;
         readonly nowMs: number;
@@ -142,6 +153,17 @@ export declare class CloudflareD1AuthorizationStore implements AuthorizationSess
         readonly nowMs: number;
         readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
     }): Promise<EcdsaWalletSessionAdmissionRead | null>;
+    /**
+     * The session with the Ed25519 signer and the policy rows its admission
+     * needs, in one statement. The signer and the policy are those of the
+     * session's own wallet, whatever wallet the request names.
+     */
+    readEd25519WalletSessionAdmissionSnapshotByOperationCredential(input: {
+        readonly tenantId: WalletSessionAuthorizationV2['tenantId'];
+        readonly tokenHash: import('../../../../../../shared-ts/src/utils/canonicalPrimitives').DigestB64u;
+        readonly nowMs: number;
+        readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
+    }): Promise<Ed25519WalletSessionAdmissionRead | null>;
     readWalletSessionExactOperationContextByCredential(input: {
         readonly tenantId: WalletSessionAuthorizationV2['tenantId'];
         readonly tokenHash: import('../../../../../../shared-ts/src/utils/canonicalPrimitives').DigestB64u;
@@ -203,7 +225,16 @@ export declare class CloudflareD1AuthorizationStore implements AuthorizationSess
         readonly material?: AuthorizedOperationMaterialScope;
     }): Promise<AuthorizedOperationAdmissionResult>;
     resolveEcdsaWalletSessionOperation(input: EcdsaWalletSessionAdmissionInput): Promise<EcdsaWalletSessionResolutionResult>;
+    /**
+     * The stored operation answers for itself: its own grant must still be
+     * active, as when a finalize request admitted it again.
+     */
+    resolveEd25519WalletSessionOperation(input: Ed25519WalletSessionResolutionInput): Promise<Ed25519WalletSessionResolutionResult>;
+    private pinExistingWalletSessionOperation;
     admitEcdsaWalletSessionOperation(input: EcdsaWalletSessionAdmissionInput): Promise<EcdsaWalletSessionAdmissionResult>;
+    admitEd25519WalletSessionOperation(input: Ed25519WalletSessionAdmissionInput): Promise<Ed25519WalletSessionAdmissionResult>;
+    /** A live operation's owner scope comes from the row its own admission read back. */
+    private pinWalletSessionAdmission;
     private admitAuthorizedOperationRecord;
     completeAuthorizedOperation(input: {
         readonly operation: AuthorizedOperation;

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService.d.ts

@@ -1,3 +1,4 @@
+import { type PasskeyCredentialClaims } from '../../../../core/passkeyCredentialClaims';
 import { EcdsaMaterialReadSnapshot } from '../../../../core/ecdsaMaterialReadSnapshot';
 import { type EcdsaMaterialReadSource } from '../../../../core/d1EcdsaSignerRead';
 import type { WalletEcdsaSignerRecord } from '../../../../core/WalletStore';
@@ -40,6 +41,7 @@ type WorkerOrdinarySignerMaterialReservationPreparationV1 = {
 /** The only worker authority mutation accepted by the linked-device cutover. */
 export type OrdinaryInactiveSignerMaterialActivationPortV1 = {
     activateOrdinaryInactiveSignerMaterialV1(input: {
+        readonly ownershipGeneration: number;
         readonly keyFamily: 'ed25519' | 'ecdsa_secp256k1';
         readonly reservationId: string;
         readonly materialActivation: MpcMaterialActivationRef;
@@ -48,6 +50,7 @@ export type OrdinaryInactiveSignerMaterialActivationPortV1 = {
     }): Promise<void>;
 };
 export type D1LinkedDeviceAuthorityInstallServiceOptionsV1 = {
+    readonly credentialClaims?: PasskeyCredentialClaims;
     readonly database: D1DatabaseLike;
     readonly scope: D1WalletAuthorityStoreScope;
     readonly authorityStore: D1WalletAuthorityStore;
@@ -75,7 +78,7 @@ export type D1LinkedDeviceAuthorityInstallServiceOptionsV1 = {
     };
     readonly reservationService: OrdinaryInactiveSignerMaterialReservationServiceV1;
     readonly materialActivation: OrdinaryInactiveSignerMaterialActivationPortV1;
-    readonly authorizationService: Pick<AuthorizationService, 'prepareWalletSessionAuthorizationV2' | 'readWalletSessionAuthorizationV2ByMint'>;
+    readonly authorizationService: Pick<AuthorizationService, 'prepareWalletSessionAuthorizationV2' | 'readWalletSessionAuthorizationV2ByMint' | 'prepareDirectWalletSessionCredential'>;
     readonly authorizationStore: {
         prepareDirectWalletSessionAuthorizationV2Statements(persisted: PersistedActiveWalletSessionAuthorizationV2): readonly [
             D1PreparedStatementLike,
@@ -197,6 +200,7 @@ export type InstalledLinkedDeviceEcdsaAuthorityProjectionV1 = {
     readonly activatedAtMs: number;
 };
 type ServerReservationRecordV1<F extends 'ed25519' | 'ecdsa_secp256k1'> = {
+    readonly ownershipGeneration: number;
     readonly reservationId: string;
     readonly preparation: Extract<WorkerOrdinarySignerMaterialReservationPreparationV1, {
         readonly keyFamily: F;

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEmailOtpGrantStore.d.ts

@@ -16,7 +16,13 @@ export declare class D1LinkedDeviceEmailOtpGrantStoreV1 {
         readonly database: D1DatabaseLike;
         readonly scope: D1LinkedDeviceSessionScopeV1;
     });
-    issueV1(record: LinkedDeviceEmailOtpGrantRecordV1): Promise<void>;
+    issueV1(record: LinkedDeviceEmailOtpGrantRecordV1): Promise<{
+        readonly kind: 'issued';
+    } | {
+        readonly kind: 'refused';
+        readonly code: 'link_session_inactive';
+        readonly message: string;
+    }>;
     readByIdV1(grantId: string): Promise<LinkedDeviceEmailOtpGrantRecordV1 | null>;
     /**
      * The consumption as statements: a CAS flip from `issued` to `consumed`

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRequestProofNonceStore.d.ts

@@ -1,5 +1,3 @@
-import { type LinkDeviceSessionId } from '../../../../../../shared-ts/src/signing-lanes/ids';
-import { type DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
 import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
 import type { LinkedDeviceRequestProofNonceStoreV1 } from '../../../../core/deviceLinking/requestProof';
 import type { D1LinkedDeviceSessionScopeV1 } from './d1LinkedDeviceSessionStore';
@@ -11,14 +9,7 @@ export declare class D1LinkedDeviceRequestProofNonceStoreV1 implements LinkedDev
     private readonly database;
     private readonly scope;
     constructor(options: D1LinkedDeviceRequestProofNonceStoreOptionsV1);
-    consumeRequestProofNonceV1(input: {
-        readonly linkSessionId: LinkDeviceSessionId;
-        readonly requestNonceB64u: string;
-        readonly proofDigestB64u: DigestB64u;
-        readonly issuedAtMs: number;
-        readonly expiresAtMs: number;
-        readonly consumedAtMs: number;
-    }): Promise<{
+    consumeRequestProofNonceV1(input: unknown): Promise<{
         readonly outcome: 'consumed';
     } | {
         readonly outcome: 'already_used';

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRouteService.d.ts

@@ -1,8 +1,12 @@
+import type { LinkedDeviceBootstrapStore } from '../../../../core/deviceLinking/linkedDeviceBootstrap';
 import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
 import type { DeviceLinkingAuthDeniedV1, DeviceLinkingAuthenticatedRequestV1, DeviceLinkingOwnerRequestInputV1, DeviceLinkingRouteServiceV1 } from '../../../../router/transport/fetch/routes/deviceLinking';
+import { type LinkedDeviceRequestProofNonceStoreV1 } from '../../../../core/deviceLinking/requestProof';
 import type { LinkedDeviceOwnerAuthorizationPortV1 } from '../../../../core/deviceLinking/linkedDeviceSession';
 import { type D1LinkedDeviceSessionScopeV1 } from './d1LinkedDeviceSessionStore';
 export type D1LinkedDeviceRouteServiceOptionsV1 = {
+    readonly bootstrap?: LinkedDeviceBootstrapStore;
+    readonly proofNonces?: LinkedDeviceRequestProofNonceStoreV1;
     readonly database: D1DatabaseLike;
     readonly scope: D1LinkedDeviceSessionScopeV1;
     readonly ownerAuthorization: LinkedDeviceOwnerAuthorizationPortV1;

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionStore.d.ts

@@ -1,3 +1,4 @@
+import { type LinkedDeviceBootstrapStore } from '../../../../core/deviceLinking/linkedDeviceBootstrap';
 import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
 import type { LinkedDeviceApprovalV1, LinkedDeviceSessionClaimV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
 import type { LinkedDeviceSessionListCursorV1, LinkedDeviceSessionListPageV1, LinkedDeviceSessionStoreV1 } from '../../../../core/deviceLinking/linkedDeviceSession';
@@ -8,6 +9,7 @@ import type { WalletAuthorityId, WalletId } from '../../../../../../shared-ts/sr
 import type { D1TenantScope } from '../../../../core/d1TenantStore';
 export type D1LinkedDeviceSessionScopeV1 = D1TenantScope;
 export type D1LinkedDeviceSessionStoreOptionsV1 = {
+    readonly bootstrap?: LinkedDeviceBootstrapStore;
     readonly database: D1DatabaseLike;
     readonly scope: D1LinkedDeviceSessionScopeV1;
     readonly now?: () => number;
@@ -15,11 +17,15 @@ export type D1LinkedDeviceSessionStoreOptionsV1 = {
 /** Aborts the batch it is in when the statement just before it changed no row. */
 export declare const SESSION_CAS_GUARD_SQL = "INSERT INTO linked_device_session_cas_guard (guard_id)\nSELECT 1\n WHERE changes() = 0";
 export declare class D1LinkedDeviceSessionStoreV1 implements LinkedDeviceSessionStoreV1 {
+    private readonly bootstrap;
     private readonly database;
     private readonly scope;
     constructor(options: D1LinkedDeviceSessionStoreOptionsV1);
     createUnclaimedSessionV1(record: LinkedDeviceSessionRecordV1): Promise<LinkedDeviceSessionMutationResultV1>;
     getSessionV1(linkSessionId: LinkDeviceSessionId): Promise<LinkedDeviceSessionRecordV1 | null>;
+    private sessionInsertStatement;
+    private importClaimedSession;
+    private readLocalSession;
     private deleteRetiredShapeSessionRowV1;
     listSessionsForWalletV1(input: {
         readonly walletId: WalletId;

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetPlanner.d.ts

@@ -1,8 +1,7 @@
 import type { LinkedDeviceApprovalV1, LinkedDeviceTargetPreparationV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
 import type { DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
 import type { MpcMaterialActivationRef, WebAuthnRpId } from '../../../../../../shared-ts/src/utils/domainIds';
-import type { ActiveLaneProtocolSourceV1, EcdsaTargetCapabilityBindingV1, LaneTargetSigningWorkerV1 } from '../../../../../../shared-ts/src/signing-lanes/rotation';
-import type { LaneHolderParticipantId } from '../../../../../../shared-ts/src/signing-lanes/participants';
+import type { ActiveLaneProtocolSourceV1 } from '../../../../../../shared-ts/src/signing-lanes/rotation';
 import type { EvmFamilySigningKeySlotId } from '../../../../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId';
 import type { KeyCreationSignerSlot } from '../../../../../../shared-ts/src/passkey-custody/primitives';
 import type { Ed25519PublicKeyB64u } from '../../../../../../shared-ts/src/passkey-custody/primitives';
@@ -44,17 +43,6 @@ type LinkedDeviceOwnerEcdsaSourceChildResolutionV1 = LinkedDeviceOwnerSourceChil
     readonly linkedSourceMaterialActivation?: MpcMaterialActivationRef;
 };
 export type LinkedDeviceOwnerSourceChildResolutionV1 = LinkedDeviceOwnerEd25519SourceChildResolutionV1 | LinkedDeviceOwnerEcdsaSourceChildResolutionV1;
-export type LinkedDeviceTargetEnrichedChildResolutionV1 = (LinkedDeviceOwnerEd25519SourceChildResolutionV1 & {
-    readonly targetHolderParticipantId: LaneHolderParticipantId;
-    readonly targetSigningWorker: LaneTargetSigningWorkerV1;
-    readonly yaoSuiteId: import('../../../../../../shared-ts/src/signing-lanes/ids').Ed25519YaoSuiteId;
-    readonly circuitDigestB64u: string;
-}) | (LinkedDeviceOwnerEcdsaSourceChildResolutionV1 & {
-    readonly targetHolderParticipantId: LaneHolderParticipantId;
-    readonly targetSigningWorker: LaneTargetSigningWorkerV1;
-    readonly targetCapability: EcdsaTargetCapabilityBindingV1;
-    readonly reshareChannelBindingDigestB64u: string;
-});
 export type LinkedDeviceTargetPreparationResolutionV1 = LinkedDeviceOwnerSourceChildResolutionV1;
 export type LinkedDeviceOwnerSourceChildResolutionRequestV1 = {
     readonly kind: 'preparation';