@seams/wallet-server 0.7.3 → 0.9.0

package/dist/types/wallet-server/src/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoLifecycleDecisionStore.d.ts

@@ -1,4 +1,4 @@
-import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import type { D1DatabaseLike, D1PreparedStatementLike, D1ResultLike } from '../../../../storage/tenantRoute';
 import type { RouterAbEd25519YaoLifecycleDecisionV1 } from '../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoLifecycleDecision';
 /**
  * The Gateway's Ed25519 Yao lifecycle decisions, in the signer database. A
@@ -16,6 +16,8 @@ export declare class CloudflareD1Ed25519YaoLifecycleDecisionStoreV1 {
         readonly envId: string;
     });
     read(lifecycleId: string): Promise<RouterAbEd25519YaoLifecycleDecisionV1 | null>;
+    prepareRead(lifecycleId: string): D1PreparedStatementLike;
+    parseRead(lifecycleId: string, result: D1ResultLike<Record<string, unknown>>): RouterAbEd25519YaoLifecycleDecisionV1 | null;
     /**
      * The statements that record `decision`, for a batch whose other statements
      * make its finalization visible. The batch aborts unless they insert the

package/dist/types/wallet-server/src/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoProductRegistrationPartitionedStateStore.d.ts

@@ -3,4 +3,5 @@ import type { VersionedJsonObject } from '../../../framework/versionedJsonRecord
 import { type RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1 } from '../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore';
 export type RouterAbEd25519YaoProductRegistrationPartitionedStateD1OptionsV1 = Omit<CloudflareD1VersionedJsonRecordStoreOptions<VersionedJsonObject>, 'encode' | 'parse'>;
 export declare function createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1(options: RouterAbEd25519YaoProductRegistrationPartitionedStateD1OptionsV1): RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1;
+export declare function evictWalletEd25519CapabilityCache(options: RouterAbEd25519YaoProductRegistrationPartitionedStateD1OptionsV1, walletId: string): Promise<void>;
 //# sourceMappingURL=d1Ed25519YaoProductRegistrationPartitionedStateStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoStateWriteFence.d.ts

@@ -0,0 +1,8 @@
+import { type WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
+import type { D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import type { VersionedJsonObject } from '../../../framework/versionedJsonRecordStore';
+import type { CloudflareD1VersionedJsonRecordStoreOptions } from '../versionedJson/d1VersionedJsonRecordStore';
+import { type RouterAbEd25519YaoProductRegistrationPartitionRecordV1 } from '../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore';
+export declare function collectChangedStateWallets(before: RouterAbEd25519YaoProductRegistrationPartitionRecordV1 | null, after: RouterAbEd25519YaoProductRegistrationPartitionRecordV1, wallets: Set<WalletId>): void;
+export declare function lifecycleWriteFenceStatements(options: Pick<CloudflareD1VersionedJsonRecordStoreOptions<VersionedJsonObject>, 'database' | 'scope'>, wallets: ReadonlySet<WalletId>): D1PreparedStatementLike[];
+//# sourceMappingURL=d1Ed25519YaoStateWriteFence.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/ed25519Yao/d1WalletCeremonyActivity.d.ts

@@ -0,0 +1,15 @@
+import type { WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
+import { type D1TenantScope } from '../../../../core/d1TenantStore';
+import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import type { RouterAbEd25519YaoProductRegistrationCeremonyStateV1 } from '../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitioning';
+type Ceremony = RouterAbEd25519YaoProductRegistrationCeremonyStateV1;
+export declare class D1WalletCeremonyActivity {
+    private readonly database;
+    private readonly scope;
+    constructor(database: D1DatabaseLike, scope: D1TenantScope);
+    hasPending(walletId: WalletId): Promise<boolean>;
+    project(recordKey: string, walletId: WalletId, settled: boolean): D1PreparedStatementLike;
+}
+export declare function ceremonySettled(ceremony: Ceremony): boolean;
+export {};
+//# sourceMappingURL=d1WalletCeremonyActivity.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeIssuer.d.ts

@@ -1,4 +1,4 @@
-import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from '../../../../../../shared-ts/src/utils/emailOtpDomain';
+import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION, WALLET_EMAIL_OTP_RELOCATION_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from '../../../../../../shared-ts/src/utils/emailOtpDomain';
 import type { EmailOtpChallengeOperation, EmailOtpLoginChallengeOperation } from '../../../../core/EmailOtpStores';
 import { EMAIL_OTP_CODE_LENGTH } from '../../../../core/authService/emailOtpConfig';
 import type { CloudflareD1EmailOtpChallengeStore } from './d1EmailOtpChallengeStore';
@@ -19,6 +19,10 @@ type EmailOtpChallengeIssueBaseInput = {
     readonly requestOrigin?: unknown;
 };
 type EmailOtpChallengeIssueInput = (EmailOtpChallengeIssueBaseInput & {
+    readonly action: typeof WALLET_EMAIL_OTP_ACTIONS.relocation;
+    readonly operation: typeof WALLET_EMAIL_OTP_RELOCATION_OPERATION;
+    readonly expiresAtMs: number;
+}) | (EmailOtpChallengeIssueBaseInput & {
     readonly action: typeof WALLET_EMAIL_OTP_ACTIONS.login;
     readonly operation: EmailOtpLoginChallengeOperation;
 }) | (EmailOtpChallengeIssueBaseInput & {
@@ -73,6 +77,7 @@ export declare class CloudflareD1EmailOtpChallengeIssuer {
         readonly emailOtpEnrollments: CloudflareD1EmailOtpEnrollmentStore;
         readonly emailOtpRateLimits: CloudflareD1EmailOtpRateLimitStore;
     });
+    challengeExpiresAt(nowMs: number): number;
     create(input: EmailOtpChallengeIssueInput): Promise<EmailOtpChallengeIssueResult>;
     private readActiveEnrollment;
 }

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeService.d.ts

@@ -4,7 +4,7 @@ import type { CloudflareD1EmailOtpChallengeStore } from './d1EmailOtpChallengeSt
 import type { CloudflareD1EmailOtpChallengeVerifier } from './d1EmailOtpChallengeVerifier';
 import type { CloudflareD1EmailOtpGrantStore } from './d1EmailOtpGrantStore';
 import type { CloudflareD1EmailOtpRegistrationEnrollmentFinalizer } from './d1EmailOtpRegistrationEnrollmentFinalizer';
-import type { CloudflareD1GoogleEmailOtpRegistrationAttemptStore } from './d1GoogleEmailOtpRegistrationAttemptStore';
+import type { GoogleEmailOtpRegistrationAttemptStore } from './d1GoogleEmailOtpRegistrationAttemptStore';
 type CreateEmailOtpChallengeInput = Parameters<RouterApiEmailOtpRouteService['createEmailOtpChallenge']>[0];
 type CreateEmailOtpChallengeResult = Awaited<ReturnType<RouterApiEmailOtpRouteService['createEmailOtpChallenge']>>;
 type CreateEmailOtpEnrollmentChallengeInput = Parameters<RouterApiEmailOtpRouteService['createEmailOtpEnrollmentChallenge']>[0];
@@ -33,7 +33,7 @@ export declare class CloudflareD1EmailOtpChallengeService {
         readonly grantTtlMs: number;
         readonly grants: CloudflareD1EmailOtpGrantStore;
         readonly issuer: CloudflareD1EmailOtpChallengeIssuer;
-        readonly registrationAttempts: CloudflareD1GoogleEmailOtpRegistrationAttemptStore;
+        readonly registrationAttempts: GoogleEmailOtpRegistrationAttemptStore;
         readonly verifier: CloudflareD1EmailOtpChallengeVerifier;
     });
     createEmailOtpChallenge(input: CreateEmailOtpChallengeInput): Promise<CreateEmailOtpChallengeResult>;

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeStore.d.ts

@@ -12,7 +12,7 @@ type EmailOtpRegistrationVerificationReceiptConsumeResult = {
 } | {
     readonly kind: 'challenge_missing';
 };
-export type EmailOtpChallengeContextInput = {
+type EmailOtpChallengeContextInput = {
     readonly challengeSubjectId: string;
     readonly walletId: string;
     readonly orgId: string;
@@ -45,6 +45,7 @@ export declare class CloudflareD1EmailOtpChallengeStore {
     deleteActiveOverflow(input: EmailOtpChallengeContextInput & {
         readonly maxActiveChallenges: number;
     }): Promise<EmailOtpChallengeRecord[]>;
+    putIfAbsent(record: EmailOtpChallengeRecord): Promise<EmailOtpChallengeRecord>;
     put(record: EmailOtpChallengeRecord): Promise<void>;
     updateAttemptCount(record: EmailOtpChallengeRecord, attemptCount: number): Promise<void>;
     delete(challengeId: string): Promise<void>;

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeVerifier.d.ts

@@ -1,5 +1,5 @@
 import type { D1PreparedStatementLike } from '../../../../storage/tenantRoute';
-import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from '../../../../../../shared-ts/src/utils/emailOtpDomain';
+import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION, WALLET_EMAIL_OTP_RELOCATION_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from '../../../../../../shared-ts/src/utils/emailOtpDomain';
 import type { EmailOtpLoginChallengeOperation, EmailOtpWalletEnrollmentRecord } from '../../../../core/EmailOtpStores';
 import type { CloudflareD1EmailOtpChallengeStore } from './d1EmailOtpChallengeStore';
 import type { CloudflareD1EmailOtpEnrollmentStore } from './d1EmailOtpEnrollmentStore';
@@ -17,6 +17,9 @@ type EmailOtpExistingChallengeVerifyBaseInput = {
 export type EmailOtpExistingChallengeVerifyInput = (EmailOtpExistingChallengeVerifyBaseInput & {
     readonly action: typeof WALLET_EMAIL_OTP_ACTIONS.login;
     readonly operation: EmailOtpLoginChallengeOperation;
+}) | (EmailOtpExistingChallengeVerifyBaseInput & {
+    readonly action: typeof WALLET_EMAIL_OTP_ACTIONS.relocation;
+    readonly operation: typeof WALLET_EMAIL_OTP_RELOCATION_OPERATION;
 }) | (EmailOtpExistingChallengeVerifyBaseInput & {
     readonly action: typeof WALLET_EMAIL_OTP_ACTIONS.deviceLink;
     readonly operation: typeof WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION;

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpCounters.typecheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=d1EmailOtpCounters.typecheck.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpGrantStore.d.ts

@@ -7,7 +7,5 @@ export declare class CloudflareD1EmailOtpGrantStore {
     });
     put(record: EmailOtpGrantRecord): Promise<void>;
     consume(grantToken: string): Promise<EmailOtpGrantRecord | null>;
-    read(grantToken: string): Promise<EmailOtpGrantRecord | null>;
-    delete(grantToken: string): Promise<void>;
 }
 //# sourceMappingURL=d1EmailOtpGrantStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpRateLimitStore.d.ts

@@ -1,29 +1,22 @@
+import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
 import type { ScopedD1Prepare } from '../../../../core/emailOtpD1Statements';
 import type { RateLimitResult } from '../../../../core/authService/rateLimits';
 import type { EmailOtpRateLimitPolicy } from '../auth/d1RouterApiAuthConfig';
-import { type EmailOtpRateLimitScope } from './d1EmailOtpRecords';
+import { type EmailOtpRateLimitScope, type EmailOtpRateLimitConsumeInput } from './d1EmailOtpRecords';
 type EmailOtpRateLimitPolicies = {
     readonly [K in EmailOtpRateLimitScope]: EmailOtpRateLimitPolicy;
 };
-type EmailOtpRateLimitConsumeInput = {
-    readonly scope: EmailOtpRateLimitScope;
-    readonly action?: string;
-    readonly userId?: string;
-    readonly walletId?: string;
-    readonly providerSubject?: string;
-    readonly orgId?: string;
-    readonly clientIp?: string;
-};
 type EmailOtpRateLimitConsumeResult = Readonly<RateLimitResult>;
 export declare class CloudflareD1EmailOtpRateLimitStore {
-    private readonly prepare;
-    private readonly rateLimits;
+    private readonly input;
     constructor(input: {
         readonly prepare: ScopedD1Prepare;
+        readonly batch: D1DatabaseLike['batch'];
         readonly rateLimits: EmailOtpRateLimitPolicies;
     });
     consume(input: EmailOtpRateLimitConsumeInput): Promise<EmailOtpRateLimitConsumeResult>;
-    private consumeKey;
+    private prepareConsume;
+    private readCounter;
 }
 export {};
 //# sourceMappingURL=d1EmailOtpRateLimitStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpRecords.d.ts

@@ -72,19 +72,33 @@ export declare function generateNumericOtp(length: number): string;
 export declare function clampedEmailOtpUnlockTtlMs(input: unknown): number;
 export declare function decodeFixedBase64Url(input: string, byteLength: number): Uint8Array | null;
 export declare function bytesEqual(left: Uint8Array, right: Uint8Array): boolean;
-export declare function emailOtpRateLimitKeys(input: {
+export type EmailOtpCounterKey = {
+    readonly kind: 'wallet';
+    readonly walletId: string;
+    readonly key: string;
+} | {
+    readonly kind: 'regional';
+    readonly walletId?: never;
+    readonly key: string;
+};
+export type EmailOtpRateLimitConsumeInput = {
     readonly scope: EmailOtpRateLimitScope;
     readonly action?: string;
-    readonly policy: {
-        readonly limit: number;
-        readonly windowMs: number;
-    };
     readonly userId?: string;
-    readonly walletId?: string;
     readonly providerSubject?: string;
     readonly orgId?: string;
     readonly clientIp?: string;
-}): readonly string[];
+} & ({
+    readonly kind: 'wallet';
+    readonly walletId: string;
+} | {
+    readonly kind: 'regional';
+    readonly walletId?: never;
+});
+export declare function emailOtpRateLimitKeys(input: EmailOtpRateLimitConsumeInput, policy: {
+    readonly limit: number;
+    readonly windowMs: number;
+}): readonly EmailOtpCounterKey[];
 export declare function emailOtpRateLimitExceeded(row: D1EmailOtpRateLimitRow | null): {
     readonly ok: false;
     readonly code: 'rate_limited';

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationAttemptStore.d.ts

@@ -1,13 +1,25 @@
+import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
 import type { RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
 import type { GoogleEmailOtpRegistrationAttemptRecord, NonEmptyGoogleEmailOtpRegistrationOfferCandidates, PendingGoogleEmailOtpRegistrationAttemptRecord } from '../../../../core/EmailOtpStores';
 import { type ScopedD1Prepare } from '../../../../core/emailOtpD1Statements';
 export declare class CloudflareD1GoogleEmailOtpRegistrationAttemptStore {
     private readonly prepare;
     private readonly orgId;
+    private readonly batch;
     constructor(input: {
         readonly prepare: ScopedD1Prepare;
         readonly orgId: string;
+        readonly batch: D1DatabaseLike['batch'];
     });
+    complete(input: {
+        readonly attemptId: string;
+        readonly walletId: string;
+    }): Promise<import("./d1GoogleRegistrationCompletion").GoogleRegistrationCompletionResult>;
+    completeCommitted(input: {
+        readonly attemptId: string;
+        readonly walletId: string;
+        readonly intentDigest: string;
+    }): Promise<import("./d1GoogleRegistrationCompletion").GoogleRegistrationCompletionResult>;
     cleanupExpired(nowMs: number): Promise<number>;
     create(input: {
         readonly providerSubject: string;
@@ -42,8 +54,24 @@ export declare class CloudflareD1GoogleEmailOtpRegistrationAttemptStore {
         readonly walletId: string;
         readonly nowMs: number;
     }): Promise<boolean>;
+    claimCandidate(input: {
+        readonly attemptId: string;
+        readonly candidateId: string;
+        readonly walletId: string;
+        readonly intentDigest: string;
+    }): Promise<RegistrationCandidateClaimResult>;
     read(attemptId: string): Promise<GoogleEmailOtpRegistrationAttemptRecord | null>;
     put(record: GoogleEmailOtpRegistrationAttemptRecord): Promise<void>;
-    delete(attemptId: string): Promise<void>;
+    private deleteMalformedUnclaimed;
 }
+export type GoogleEmailOtpRegistrationAttemptStore = Pick<CloudflareD1GoogleEmailOtpRegistrationAttemptStore, keyof CloudflareD1GoogleEmailOtpRegistrationAttemptStore>;
+export type RegistrationCandidateClaimResult = {
+    readonly ok: true;
+    readonly code?: never;
+    readonly message?: never;
+} | {
+    readonly ok: false;
+    readonly code: 'registration_candidate_unavailable';
+    readonly message: string;
+};
 //# sourceMappingURL=d1GoogleEmailOtpRegistrationAttemptStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationRecords.d.ts

@@ -1,5 +1,5 @@
 import type { RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
-import type { GoogleEmailOtpRegistrationAttemptRecord, GoogleEmailOtpRegistrationOfferCandidateRecord, PendingGoogleEmailOtpRegistrationAttemptRecord } from '../../../../core/EmailOtpStores';
+import type { GoogleEmailOtpRegistrationAttemptRecord, NonEmptyGoogleEmailOtpRegistrationOfferCandidates, PendingGoogleEmailOtpRegistrationAttemptRecord } from '../../../../core/EmailOtpStores';
 export type D1EmailOtpRegistrationAttemptRow = {
     readonly attempt_id?: unknown;
     readonly record_json?: unknown;
@@ -21,31 +21,18 @@ type GoogleEmailOtpRegistrationOfferForResponse = {
     ];
 };
 export declare function requireRuntimePolicyScope(input: unknown): RuntimePolicyScope;
-export declare function activeGoogleEmailOtpRegistrationAttemptRecord(input: {
-    readonly record: PendingGoogleEmailOtpRegistrationAttemptRecord;
-    readonly updatedAtMs: number;
-}): GoogleEmailOtpRegistrationAttemptRecord;
 export declare function expiredGoogleEmailOtpRegistrationAttemptRecord(input: {
     readonly record: GoogleEmailOtpRegistrationAttemptRecord;
     readonly updatedAtMs: number;
 }): GoogleEmailOtpRegistrationAttemptRecord;
-export declare function failedGoogleEmailOtpRegistrationAttemptWithCode(input: {
-    readonly record: PendingGoogleEmailOtpRegistrationAttemptRecord;
-    readonly failureCode: string;
-    readonly updatedAtMs: number;
-}): GoogleEmailOtpRegistrationAttemptRecord;
+export declare function parseGoogleEmailOtpRegistrationAttemptRecord(input: unknown): GoogleEmailOtpRegistrationAttemptRecord | null;
 export declare function parseGoogleEmailOtpRegistrationAttemptRow(row: D1EmailOtpRegistrationAttemptRow | null): GoogleEmailOtpRegistrationAttemptRecord | null;
 export declare function googleEmailOtpRegistrationOfferForResponse(input: Pick<PendingGoogleEmailOtpRegistrationAttemptRecord, 'offerId' | 'offerCandidates' | 'selectedCandidateId'>): GoogleEmailOtpRegistrationOfferForResponse;
-export declare function pendingGoogleEmailOtpRegistrationAttemptWithUpdatedAt(record: PendingGoogleEmailOtpRegistrationAttemptRecord, updatedAtMs: number): PendingGoogleEmailOtpRegistrationAttemptRecord;
-export declare function pendingGoogleEmailOtpRegistrationAttemptWithSelectedCandidate(input: {
-    readonly record: PendingGoogleEmailOtpRegistrationAttemptRecord;
-    readonly candidate: GoogleEmailOtpRegistrationOfferCandidateRecord;
-    readonly updatedAtMs: number;
-}): PendingGoogleEmailOtpRegistrationAttemptRecord;
 export declare function abandonedGoogleEmailOtpRegistrationAttemptRecord(input: {
     readonly record: PendingGoogleEmailOtpRegistrationAttemptRecord;
     readonly failureCode: 'owner_proof_binding_replaced' | 'offer_restarted_by_user';
     readonly updatedAtMs: number;
 }): GoogleEmailOtpRegistrationAttemptRecord;
+export declare function parseGoogleEmailOtpRegistrationOfferCandidates(input: unknown): NonEmptyGoogleEmailOtpRegistrationOfferCandidates | null;
 export {};
 //# sourceMappingURL=d1GoogleEmailOtpRegistrationRecords.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpSessionResolver.d.ts

@@ -2,7 +2,7 @@ import type { IdentityStore, LinkIdentityResult } from '../../../../core/Identit
 import type { RouterApiEmailOtpRouteService, RouterApiIdentityService } from '../../../framework/authServicePort';
 import type { CloudflareD1EmailOtpEnrollmentStore } from './d1EmailOtpEnrollmentStore';
 import type { CloudflareD1EmailOtpRateLimitStore } from './d1EmailOtpRateLimitStore';
-import type { CloudflareD1GoogleEmailOtpRegistrationAttemptStore } from './d1GoogleEmailOtpRegistrationAttemptStore';
+import type { GoogleEmailOtpRegistrationAttemptStore } from './d1GoogleEmailOtpRegistrationAttemptStore';
 type ResolveGoogleEmailOtpSessionInput = Parameters<RouterApiIdentityService['resolveGoogleEmailOtpSession']>[0];
 type ResolveGoogleEmailOtpSessionResult = Awaited<ReturnType<RouterApiIdentityService['resolveGoogleEmailOtpSession']>>;
 type CleanupGoogleEmailOtpDevRegistrationStateInput = Parameters<RouterApiEmailOtpRouteService['cleanupGoogleEmailOtpDevRegistrationState']>[0];
@@ -36,11 +36,16 @@ export declare class CloudflareD1GoogleEmailOtpSessionResolver {
         readonly identityStore: IdentityStore;
         readonly linkIdentity: GoogleEmailOtpIdentityLinker;
         readonly production: boolean;
-        readonly registrationAttempts: CloudflareD1GoogleEmailOtpRegistrationAttemptStore;
+        readonly registrationAttempts: GoogleEmailOtpRegistrationAttemptStore;
     });
     resolve(input: ResolveGoogleEmailOtpSessionInput): Promise<ResolveGoogleEmailOtpSessionResult>;
     cleanupDevRegistrationState(input: CleanupGoogleEmailOtpDevRegistrationStateInput): Promise<CleanupGoogleEmailOtpDevRegistrationStateResult>;
     consumeRegistrationAttemptRateLimit(input: ConsumeGoogleEmailOtpRegistrationAttemptRateLimitInput): Promise<ConsumeGoogleEmailOtpRegistrationAttemptRateLimitResult>;
+    completeCommittedRegistrationAttempt(input: {
+        readonly registrationAttemptId: string;
+        readonly walletId: string;
+        readonly intentDigest: string;
+    }): Promise<import("./d1GoogleRegistrationCompletion").GoogleRegistrationCompletionResult>;
     completeRegistrationAttempt(input: {
         readonly registrationAttemptId?: unknown;
         readonly walletId?: unknown;

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1GoogleRegistrationCompletion.d.ts

@@ -0,0 +1,23 @@
+import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
+import type { ScopedD1Prepare } from '../../../../core/emailOtpD1Statements';
+export type GoogleRegistrationCompletionResult = {
+    readonly ok: true;
+    readonly code?: never;
+    readonly message?: never;
+} | {
+    readonly ok: false;
+    readonly code: 'registration_incomplete';
+    readonly message: string;
+};
+export declare function completeGoogleRegistration(prepare: ScopedD1Prepare, batch: D1DatabaseLike['batch'], input: {
+    readonly kind: 'live_offer';
+    readonly attemptId: string;
+    readonly walletId: string;
+    readonly intentDigest?: never;
+} | {
+    readonly kind: 'committed_wallet';
+    readonly attemptId: string;
+    readonly walletId: string;
+    readonly intentDigest: string;
+}): Promise<GoogleRegistrationCompletionResult>;
+//# sourceMappingURL=d1GoogleRegistrationCompletion.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/identity/d1IdentityService.d.ts

@@ -6,26 +6,14 @@ type LinkIdentityInput = Parameters<RouterApiIdentityService['linkIdentity']>[0]
 type LinkIdentityResult = Awaited<ReturnType<RouterApiIdentityService['linkIdentity']>>;
 type UnlinkIdentityInput = Parameters<RouterApiIdentityService['unlinkIdentity']>[0];
 type UnlinkIdentityResult = Awaited<ReturnType<RouterApiIdentityService['unlinkIdentity']>>;
-type ResolveOidcWalletIdInput = Parameters<RouterApiIdentityService['resolveOidcWalletId']>[0];
-type ResolveOidcWalletIdResult = Awaited<ReturnType<RouterApiIdentityService['resolveOidcWalletId']>>;
-type ResolveGoogleEmailOtpSessionInput = Parameters<RouterApiIdentityService['resolveGoogleEmailOtpSession']>[0];
-type ResolveGoogleEmailOtpSessionResult = Awaited<ReturnType<RouterApiIdentityService['resolveGoogleEmailOtpSession']>>;
-type ResolveGoogleEmailOtpSession = (input: ResolveGoogleEmailOtpSessionInput) => Promise<ResolveGoogleEmailOtpSessionResult>;
 export declare class CloudflareD1IdentityService {
-    private readonly accountIdDerivationSecret;
     private readonly identityStore;
-    private readonly relayerAccount;
-    private readonly resolveGoogleEmailOtpSession;
     constructor(input: {
-        readonly accountIdDerivationSecret: unknown;
         readonly identityStore: IdentityStore;
-        readonly relayerAccount: unknown;
-        readonly resolveGoogleEmailOtpSession: ResolveGoogleEmailOtpSession;
     });
     listIdentities(input: ListIdentitiesInput): Promise<ListIdentitiesResult>;
     linkIdentity(input: LinkIdentityInput): Promise<LinkIdentityResult>;
     unlinkIdentity(input: UnlinkIdentityInput): Promise<UnlinkIdentityResult>;
-    resolveOidcWalletId(input: ResolveOidcWalletIdInput): Promise<ResolveOidcWalletIdResult>;
 }
 export {};
 //# sourceMappingURL=d1IdentityService.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/near/d1SponsoredNearAccount.d.ts

@@ -0,0 +1,24 @@
+import { type WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
+import type { SponsoredNamedNearAccountCreationResult } from '../registration/d1WalletRegistrationService';
+import type { NormalizedCloudflareD1RouterApiAuthServiceOptions } from '../auth/d1RouterApiAuthConfig';
+type SponsoredAccountOptions = Pick<NormalizedCloudflareD1RouterApiAuthServiceOptions, 'database' | 'namespace' | 'orgId' | 'projectId' | 'envId' | 'relayerAccount' | 'relayerPrivateKey' | 'relayerPublicKey' | 'nearRpcUrl' | 'accountInitialBalance'>;
+export type SponsoredNamedNearAccountInput = {
+    readonly walletId: WalletId;
+    readonly accountId: string;
+    readonly publicKey: string;
+    /**
+     * Registration-scoped key for the durable claim. Two attempts at the same
+     * registration share a key so the second replays the first's transaction.
+     */
+    readonly idempotencyKey: string;
+};
+/**
+ * Creates the sponsored account through a durable claim. The signed transaction
+ * and its hash are persisted before the broadcast, so a lost response replays
+ * those exact bytes instead of building a second transaction under a fresh
+ * nonce. Rebroadcasting an identical signed transaction reuses its hash, so the
+ * network treats the retry as the same transaction.
+ */
+export declare function createSponsoredNamedNearAccountForOptions(options: SponsoredAccountOptions, input: SponsoredNamedNearAccountInput): Promise<SponsoredNamedNearAccountCreationResult>;
+export {};
+//# sourceMappingURL=d1SponsoredNearAccount.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/near/d1SponsoredNearAccount.typecheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=d1SponsoredNearAccount.typecheck.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/oidc/d1OidcVerificationService.d.ts

@@ -15,7 +15,6 @@ export declare class CloudflareD1OidcVerificationService {
     private readonly githubOAuth;
     private readonly identityStore;
     private readonly linkIdentity;
-    private readonly oidcJwksCache;
     constructor(input: {
         readonly googleOidcClientId: string | undefined;
         readonly githubOAuth: GithubOAuthConfig | undefined;

package/dist/types/wallet-server/src/router/cloudflare/d1/oidc/googleOidcToken.d.ts

@@ -0,0 +1,4 @@
+import { type GoogleIdTokenClaimValidationResult } from './d1OidcBoundary';
+/** Verifies provider proof without reading or mutating wallet identity state. */
+export declare function verifyGoogleOidcToken(configuredClientId: string | undefined, rawToken: unknown): Promise<GoogleIdTokenClaimValidationResult>;
+//# sourceMappingURL=googleOidcToken.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/passkeyCustody/d1PasskeyCustodyRouteService.d.ts

@@ -335,6 +335,11 @@ type WalletRecoveryRoutePreparationResult = (Extract<WalletRecoveryPreparationRe
 }) | Exclude<WalletRecoveryPreparationResult, {
     readonly kind: 'prepared';
 }> | {
+    readonly kind: 'routing_unavailable';
+    readonly walletId?: never;
+    readonly recoveryOperationId?: never;
+    readonly registration?: never;
+} | {
     readonly kind: 'manifest_unavailable';
     readonly reason: string;
 } | {

package/dist/types/wallet-server/src/router/cloudflare/d1/passkeyCustody/d1WalletCustodyCommitStore.d.ts

@@ -1,3 +1,6 @@
+import { type PasskeyCredentialClaims } from '../../../../core/passkeyCredentialClaims';
+import type { WalletRecoveryRoutingPublisher } from '../../../../authorization/recoveryRouting';
+import type { WalletRecoveryOperationId } from '../../../../../../shared-ts/src/utils/domainIds';
 import { type WalletRecoveryBackupAcknowledgementV1 } from '../../../../../../shared-ts/src/wallet-recovery/recoveryCodes';
 import { type WalletRecoveryEnvelopeSetRecord } from '../../../../../../shared-ts/src/wallet-recovery';
 import { type PasskeyCustodyEnvelopeRecord } from '../../../../../../shared-ts/src/passkey-custody';
@@ -16,6 +19,8 @@ import { D1WalletAuthorityStore } from '../wallet/d1WalletAuthorityStore';
 import type { EmailOtpWalletEnrollmentRecord } from '../../../../core/EmailOtpStores';
 import { type WalletRecoveryGoogleEmailOtpFinalizationInput } from './d1WalletRecoveryGoogleEmailOtpRecords';
 type CloudflareD1WalletCustodyCommitStoreOptions = {
+    readonly credentialClaims?: PasskeyCredentialClaims;
+    readonly recoveryRouting?: WalletRecoveryRoutingPublisher;
     readonly database: D1DatabaseLike;
     readonly scope: CloudflareD1VersionedJsonRecordScopeV1;
     readonly walletAuthMethodStore?: D1WalletAuthMethodStore;
@@ -32,6 +37,16 @@ export type WalletRecoveryCodeLocatorRecord = {
     readonly walletId: WalletId;
     readonly recoveryKeyId: DerivedWalletRecoveryKeyId;
 };
+/**
+ * A registration commit whose recovery-code routes are claimed. `commit`
+ * writes the records, and it needs the wallet that the registration commits.
+ */
+export type WalletCustodyRegistrationReservation = Extract<WalletCustodyRegistrationCommitResult, {
+    kind: 'inconsistent';
+}> | {
+    readonly kind: 'reserved';
+    readonly commit: () => Promise<WalletCustodyRegistrationCommitResult>;
+};
 export type WalletCustodyRegistrationCommitResult = {
     readonly kind: 'committed';
     readonly envelopeStoreVersion: string;
@@ -104,12 +119,16 @@ export type WalletRecoveryAuthenticatorCommit = {
     readonly challengeDeleteStatement: D1PreparedStatementLike;
 };
 export declare class CloudflareD1WalletCustodyCommitStore {
+    private readonly recoveryRouting;
+    private readonly credentialClaims;
     private readonly database;
     private readonly scope;
     private readonly records;
     private readonly walletAuthMethodStore;
     private readonly walletAuthorityStore;
     constructor(options: CloudflareD1WalletCustodyCommitStoreOptions);
+    publishRecoveryOperation(walletId: WalletId, operationId: WalletRecoveryOperationId): Promise<void>;
+    private claimRecoveryCodeRoutes;
     readRecoveryCodeLocator(locatorB64u: RecoveryCodeLocatorV1): Promise<WalletRecoveryCodeLocatorRecord | null>;
     /** Reads locator metadata without ever materializing a recovery code. */
     readRecoveryCodeLocatorByRecoveryKey(input: {
@@ -128,6 +147,12 @@ export declare class CloudflareD1WalletCustodyCommitStore {
     private readEmailOtpEnrollment;
     private walletRecoveryGoogleEmailOtpFinalizedAttemptMatches;
     private walletRecoveryGoogleEmailOtpChallengeExists;
+    /**
+     * Checks the commit and claims its recovery-code routes. The claim is an
+     * exact-retryable directory write that needs no local record, so a caller
+     * may run it beside its other remote effects and write afterwards.
+     */
+    reserveRegistration(commit: WalletCustodyRegistrationCommit): Promise<WalletCustodyRegistrationReservation>;
     /**
      * Writes the envelope and the recovery set in one transaction.
      *
@@ -135,7 +160,7 @@ export declare class CloudflareD1WalletCustodyCommitStore {
      * key already holds a row, so a repeated registration cannot silently replace
      * an established wallet's custody.
      */
-    commitRegistration(commit: WalletCustodyRegistrationCommit): Promise<WalletCustodyRegistrationCommitResult>;
+    private commitReservedRegistration;
     /**
      * Reads a wallet's recovery envelope set. Returns null when absent, and also
      * when the stored row is not a recovery set — a row that fails its own parser

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore.d.ts

@@ -17,10 +17,21 @@ type D1RegistrationCeremonyRecordMutation = {
     readonly value: Record<string, unknown>;
     readonly expiresAtMs: number;
 };
+type D1RegistrationCeremonyVersionedUpdate = {
+    readonly scope: string;
+    readonly id: string;
+    readonly expectedVersion: number;
+    readonly next: Record<string, unknown>;
+    readonly expiresAtMs: number;
+};
 type D1RegistrationCeremonyAtomicBranchClaim = {
     readonly value: Record<string, unknown>;
     readonly version: number;
-    readonly expiresAtMs: number;
+};
+type StoredRow = {
+    readonly version?: unknown;
+    readonly record_json?: unknown;
+    readonly expires_at_ms?: unknown;
 };
 export declare class D1RegistrationCeremonyRecordStore {
     private readonly database;
@@ -28,7 +39,19 @@ export declare class D1RegistrationCeremonyRecordStore {
     private readonly keyPrefix;
     constructor(options: D1RegistrationCeremonyRecordStoreOptions);
     get(scope: string, id: string): Promise<D1RegistrationCeremonyStoredRecord | null>;
+    prepareGet(scope: string, id: string): D1PreparedStatementLike;
+    parseGet(scope: string, id: string, row: StoredRow | null): Promise<D1RegistrationCeremonyStoredRecord | null>;
     putExact(mutation: D1RegistrationCeremonyRecordMutation): Promise<void>;
+    insertOrRead(mutation: D1RegistrationCeremonyRecordMutation): Promise<D1RegistrationCeremonyStoredRecord>;
+    /**
+     * Stores `mutation` and opens `copyScope` with the value that `mutation`'s
+     * key then holds, in one batch. A competing insert leaves its winner in both
+     * records, as two `insertOrRead` calls in series would.
+     */
+    insertOrReadWithCopy(mutation: D1RegistrationCeremonyRecordMutation, copyScope: string, companion: readonly D1PreparedStatementLike[]): Promise<{
+        readonly record: D1RegistrationCeremonyStoredRecord;
+        readonly copy: D1RegistrationCeremonyStoredRecord;
+    }>;
     updateExpected(input: {
         readonly scope: string;
         readonly id: string;
@@ -48,13 +71,14 @@ export declare class D1RegistrationCeremonyRecordStore {
         };
         readonly patch: Record<string, unknown>;
     }): Promise<D1RegistrationCeremonyAtomicBranchClaim | null>;
-    updateExpectedVersion(input: {
-        readonly scope: string;
-        readonly id: string;
-        readonly expectedVersion: number;
-        readonly next: Record<string, unknown>;
-        readonly expiresAtMs: number;
-    }): Promise<number>;
+    updateExpectedVersion(input: D1RegistrationCeremonyVersionedUpdate): Promise<number>;
+    /**
+     * The update of `updateExpectedVersion` with its guard, for a batch that
+     * another store owns on this database. The guard fails that batch when the
+     * record is no longer at the expected version.
+     */
+    prepareExpectedVersionUpdate(input: D1RegistrationCeremonyVersionedUpdate): readonly D1PreparedStatementLike[];
+    private prepareVersionedUpdate;
     take(scope: string, id: string): Promise<Record<string, unknown> | null>;
     delete(scope: string, id: string): Promise<boolean>;
     /**
@@ -68,6 +92,7 @@ export declare class D1RegistrationCeremonyRecordStore {
     private prepareExactMutations;
     putManyExact(mutations: readonly D1RegistrationCeremonyRecordMutation[]): Promise<void>;
     private allRecordsMatch;
+    private prepareRead;
     private insert;
     private prepareInsert;
     private deleteVersion;