@seams/wallet-server 0.7.3 → 0.9.0

package/dist/types/wallet-server/src/router/cloudflare/runtime/walletPlacementRoutes.d.ts

@@ -0,0 +1,30 @@
+import type { WalletRelocationEmailOtpServices } from '../d1/wallet/d1WalletRelocationEmailOtp';
+import type { TenantId } from '../../../../../shared-ts/src/authorization/capabilityKinds';
+import type { SessionOrigin } from '../../../authorization/domain';
+import type { AuthorizationService } from '../../../authorization/service';
+import type { D1TenantScope } from '../../../core/d1TenantStore';
+import type { D1DatabaseLike } from '../../../storage/tenantRoute';
+import type { RouterApiRouteExtension, RouterApiFetchRouteExtensionInput } from '../../framework/routeExtensions';
+import type { WalletConsoleServiceBinding } from './walletConsoleOpsClient';
+export declare class WalletPlacementRoutes implements RouterApiRouteExtension {
+    private readonly options;
+    readonly kind = "fetch_route_extension";
+    readonly id = "wallet_placement";
+    readonly routes: RouterApiRouteExtension['routes'];
+    constructor(options: {
+        readonly emailOtp: WalletRelocationEmailOtpServices;
+        readonly database: D1DatabaseLike;
+        readonly scope: D1TenantScope;
+        readonly tenantId: TenantId;
+        readonly allowedOrigins: readonly SessionOrigin[];
+        readonly authorizationSessions: Pick<AuthorizationService, 'readWalletSessionExactOperationContextByCredential'>;
+        readonly directory: WalletConsoleServiceBinding;
+    });
+    handleFetchRoute(input: RouterApiFetchRouteExtensionInput): Promise<Response>;
+    handle(request: Request): Promise<Response>;
+    private challenge;
+    private relocate;
+    private walletKey;
+    private dispatch;
+}
+//# sourceMappingURL=walletPlacementRoutes.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/runtime/walletRelocationDeriver.d.ts

@@ -0,0 +1,11 @@
+import type { CloudflareServiceBindingFetcher } from './routerAbServiceBindings';
+import type { RuntimeSourceDirectory } from './walletRelocationSource';
+type Role = 'deriver-a' | 'deriver-b';
+type Operation = 'fence' | 'capture' | 'export' | 'import' | 'status' | 'verify' | 'activate' | 'cleanup';
+export declare function deriverRuntimeOperation(value: string): {
+    role: Role;
+    operation: Operation;
+} | null;
+export declare function forwardDeriverRelocation(input: unknown, role: Role, operation: Operation, binding: CloudflareServiceBindingFetcher, credential: string, directory: RuntimeSourceDirectory): Promise<Response>;
+export {};
+//# sourceMappingURL=walletRelocationDeriver.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/runtime/walletRelocationEcdsa.d.ts

@@ -0,0 +1,7 @@
+import type { CloudflareServiceBindingFetcher } from './routerAbServiceBindings';
+import { type RuntimeSourceDirectory } from './walletRelocationSource';
+type Operation = 'freeze' | 'export' | 'import' | 'status' | 'verify' | 'activate' | 'cleanup';
+export declare function ecdsaRuntimeOperation(operation: string): Operation | null;
+export declare function forwardEcdsaRelocation(input: unknown, operation: Operation, router: CloudflareServiceBindingFetcher, credential: string, directory: RuntimeSourceDirectory): Promise<Response>;
+export {};
+//# sourceMappingURL=walletRelocationEcdsa.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/runtime/walletRelocationEd25519.d.ts

@@ -0,0 +1,7 @@
+import type { CloudflareServiceBindingFetcher } from './routerAbServiceBindings';
+import { type RuntimeSourceDirectory } from './walletRelocationSource';
+type Operation = 'capture' | 'export' | 'import' | 'status' | 'verify' | 'activate' | 'cleanup';
+export declare function ed25519RuntimeOperation(operation: string): Operation | null;
+export declare function forwardEd25519Snapshot(input: unknown, operation: Operation, router: CloudflareServiceBindingFetcher, credential: string, directory: RuntimeSourceDirectory): Promise<Response>;
+export {};
+//# sourceMappingURL=walletRelocationEd25519.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/runtime/walletRelocationOps.d.ts

@@ -0,0 +1,11 @@
+import { type RuntimeSourceDirectory } from './walletRelocationSource';
+import type { CloudflareServiceBindingFetcher } from './routerAbServiceBindings';
+export type WalletRelocationRuntimeBindings = RuntimeSourceDirectory & {
+    readonly MPC_ROUTER: CloudflareServiceBindingFetcher;
+    readonly DERIVER_A: CloudflareServiceBindingFetcher;
+    readonly DERIVER_B: CloudflareServiceBindingFetcher;
+    readonly ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET?: string;
+    readonly ROUTER_AB_GATEWAY_TO_ROUTER_AUTH_SECRET?: string;
+};
+export declare function handleWalletRelocationRequest(request: Request, env: WalletRelocationRuntimeBindings): Promise<Response | null>;
+//# sourceMappingURL=walletRelocationOps.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/runtime/walletRelocationPresign.d.ts

@@ -0,0 +1,7 @@
+import type { CloudflareServiceBindingFetcher } from './routerAbServiceBindings';
+import type { RuntimeSourceDirectory } from './walletRelocationSource';
+type Operation = 'inventory' | 'fence' | 'freeze' | 'export' | 'import' | 'verify' | 'status' | 'cleanup';
+export declare function presignSourceOperation(operation: string): Operation | null;
+export declare function forwardPresignSource(input: unknown, operation: Operation, router: CloudflareServiceBindingFetcher, credential: string, directory: RuntimeSourceDirectory): Promise<Response>;
+export {};
+//# sourceMappingURL=walletRelocationPresign.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/runtime/walletRelocationSource.d.ts

@@ -0,0 +1,26 @@
+import { type WalletObjectIdentity } from './walletObjectAddresses';
+import type { WalletConsoleServiceBinding } from './walletConsoleOpsClient';
+export type RuntimeSourceOperation = 'ed25519-settle' | 'ed25519-capture' | 'ecdsa-freeze' | 'router-freeze' | 'router-export' | 'router-status' | 'router-verify' | 'router-import' | 'router-activate' | 'router-cleanup';
+export type RuntimeSourceDirectory = {
+    readonly WALLET_CONSOLE: WalletConsoleServiceBinding;
+    readonly CF_VERSION_METADATA: {
+        readonly id: unknown;
+    };
+    readonly SEAMS_D1_HOME_ACCOUNT_ID: string;
+    readonly SEAMS_D1_HOME_DATABASE_ID: string;
+};
+type SourceAuthorization = {
+    readonly ok: true;
+    readonly body: string;
+    readonly identity: WalletObjectIdentity;
+    readonly code?: never;
+} | {
+    readonly ok: false;
+    readonly code: 'invalid_input' | 'source_command_unavailable' | 'source_command_denied';
+    readonly body?: never;
+    readonly identity?: never;
+};
+export declare function authorizeRuntimeSource(input: unknown, operation: RuntimeSourceOperation, env: RuntimeSourceDirectory): Promise<SourceAuthorization>;
+export declare function recordRuntimeRouterReceipt(operation: 'router-freeze' | 'router-activate', input: unknown, response: Response, env: RuntimeSourceDirectory): Promise<Response>;
+export {};
+//# sourceMappingURL=walletRelocationSource.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/runtime/walletRuntimeOps.d.ts

@@ -31,10 +31,13 @@ export interface WalletRuntimeWalletIdentityRequest {
     readonly wallets: readonly {
         readonly walletId: string;
         readonly projectId: string;
+        readonly envId: string;
     }[];
 }
 export interface WalletRuntimeWalletIdentity {
     readonly walletId: string;
+    readonly projectId: string;
+    readonly envId: string;
     readonly nearAccountId: string;
     readonly evmAddress: `0x${string}`;
 }

package/dist/types/wallet-server/src/router/cloudflare/signingLanes/cloudflareOrdinaryInactiveSignerMaterialReservation.d.ts

@@ -1,3 +1,4 @@
+import type { WalletExecutionAuthority } from '../../domains/walletRegistration/walletRegistrationReservation';
 import { type OrdinaryEcdsaSignerMaterialReservationRequestV1, type OrdinaryEcdsaSignerMaterialDeactivationRequestV1, type OrdinaryEcdsaSignerMaterialWorkerReservationV1, type OrdinaryEd25519SignerMaterialReservationRequestV1, type OrdinaryEd25519SignerMaterialDeactivationRequestV1, type OrdinaryEd25519SignerMaterialWorkerReservationV1, type OrdinaryInactiveSignerMaterialDeactivationPortV1, type OrdinaryInactiveSignerMaterialDeactivationRequestV1, type OrdinaryInactiveSignerMaterialReservationServiceV1, type OrdinaryInactiveSignerMaterialReservationWorkerPortV1 } from '../../../core/signingMaterial/ordinaryInactiveSignerMaterialReservation';
 import { type LinkedDeviceEd25519SourceContributionPreparationV1 } from '../../../../../shared-ts/src/device-linking/sourceContribution';
 import type { DeviceLinkingEd25519SourcePreservingRouterPortV1 } from '../../transport/fetch/routes/deviceLinking';
@@ -34,16 +35,19 @@ export type CloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1 = {
 };
 export type CloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1 = DeviceLinkingEd25519SourcePreservingRouterPortV1;
 export declare function createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1(input: {
+    readonly admitEstablishedHome: WalletExecutionAuthority['admitEstablishedHome'];
     readonly fetch: typeof fetch;
     readonly internalServiceAuthSecret: string;
     readonly resolveTenantRoot: (context: Pick<LinkedDeviceEd25519SourceContributionPreparationV1, 'applicationBinding' | 'targetAdmission' | 'participantIds'>) => Promise<RouterAbEd25519YaoResolvedTenantRootV1>;
 }): CloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1;
 export type CloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1 = {
     activateInactiveEd25519SignerMaterialV1(input: {
+        readonly ownershipGeneration: number;
         readonly sourceContribution: OrdinaryEd25519SignerMaterialReservationPreparationV1['sourceContribution'];
         readonly reservationId: string;
     }): Promise<unknown>;
     activateInactiveEcdsaSignerMaterialV1(input: {
+        readonly ownershipGeneration: number;
         readonly preparation: OrdinaryEcdsaSignerMaterialReservationPreparationV1;
         readonly reservationId: string;
     }): Promise<unknown>;
@@ -67,6 +71,7 @@ export declare function createCloudflareOrdinaryInactiveSignerMaterialActivation
     readonly tenant: CloudflareSigningWorkerTenantV1;
 }): CloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1;
 export declare function createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1(input: {
+    readonly admitEstablishedHome: WalletExecutionAuthority['admitEstablishedHome'];
     readonly fetch: typeof fetch;
     readonly internalServiceAuthSecret: string;
     readonly tenant: CloudflareSigningWorkerTenantV1;

package/dist/types/wallet-server/src/router/cloudflare-adaptor.d.ts

@@ -46,7 +46,6 @@ export { extractBearerCredential, extractRouterApiEnvironmentId, resolveSourceIp
 export { createCloudflareRouter } from './cloudflare/runtime/createCloudflareRouter';
 export type { SelfHostedCloudflareSigningWorkerFactoryInput } from './cloudflare/runtime/createSelfHostedCloudflareSigningWorker';
 export { createSelfHostedCloudflareSigningRouter, createSelfHostedCloudflareSigningWorker, } from './cloudflare/runtime/createSelfHostedCloudflareSigningWorker';
-export { ThresholdStoreDurableObject } from './cloudflare/durableObjects/thresholdStore';
 export { CloudflareDurableObjectVersionedJsonRecordStore, CloudflareVersionedJsonRecordStoreError, createCloudflareDurableObjectVersionedJsonRecordStore, } from './cloudflare/durableObjects/versionedJsonRecordStore';
 export type { CloudflareVersionedJsonRecordStoreOptions } from './cloudflare/durableObjects/versionedJsonRecordStore';
 export type { VersionedJsonObject, VersionedJsonRecordPutResult, VersionedJsonRecordReadResult, VersionedJsonValue, } from './framework/versionedJsonRecordStore';

package/dist/types/wallet-server/src/router/domains/ecdsa/routerAbEcdsaStrictRegistration.d.ts

@@ -64,6 +64,7 @@ export type RouterAbEcdsaRegistrationRequestPolicyV1 = {
     readonly requestDigestB64u: string;
 };
 export type RouterAbEcdsaRegistrationTenantRootV1 = {
+    readonly ownershipGeneration: number;
     readonly identityDigestB64u: string;
     readonly custodyLineageB64u: string;
     readonly projectEnvironmentId: string;
@@ -145,6 +146,7 @@ export interface RouterAbEcdsaStrictPostRegistrationPort {
     }): Promise<RouterAbEcdsaStrictRefreshResult>;
 }
 export type RouterAbEcdsaCeremonyTokenClaims = {
+    readonly ownershipGeneration: number;
     readonly subjectId: string;
     readonly sessionId: string;
     readonly orgId: string;
@@ -174,6 +176,7 @@ export interface RouterAbEcdsaCeremonyTokenIssuer {
     };
 }
 type StrictRegistrationForwarderConfig = {
+    readonly internalServiceAuthSecret: string;
     readonly router: {
         fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
     };

package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoCapabilityCommit.d.ts

@@ -0,0 +1,7 @@
+import type { WalletEd25519YaoActiveCapabilityRecord } from '../../../../core/WalletStore';
+import { type RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallationV1, type RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallResultV1 } from '../recovery/routerAbEd25519YaoRecovery';
+import type { RouterAbEd25519YaoPreparedWriteV1, RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1 } from './routerAbEd25519YaoProductRegistrationPartitionedStateStore';
+/** The wallet and its initial capability become visible in the same transaction. */
+export declare function commitRouterAbEd25519YaoRegistrationCapability(store: RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, installation: RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallationV1, walletWrite: Promise<RouterAbEd25519YaoPreparedWriteV1>): Promise<RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallResultV1>;
+export declare function rehydrateRouterAbEd25519YaoCapability(store: RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, capability: WalletEd25519YaoActiveCapabilityRecord): Promise<RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallResultV1>;
+//# sourceMappingURL=routerAbEd25519YaoCapabilityCommit.d.ts.map

package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.d.ts

@@ -4,18 +4,20 @@ import { type RegistrationNearEd25519SignerPlan } from '../../../../../../shared
 import { type RouterAbEd25519YaoActivationAdmissionReceiptV1, type RouterAbEd25519YaoRegistrationAdmissionRequestV1 } from '../../../../../../shared-ts/src/utils/routerAbEd25519Yao';
 import { type RouterAbMpcMaterialActivationRefWire } from '../../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
 import type { RouterAbEd25519YaoActivationConsumerV1, RouterAbEd25519YaoActivationConsumptionRequestV1, RouterAbEd25519YaoActivationConsumptionResultV1, RouterAbEd25519YaoRegistrationServiceResult } from '../registration/routerAbEd25519YaoRegistration';
-import { InMemoryRouterAbEd25519YaoRegistrationStateV1, type RouterAbEd25519YaoRegistrationAuthorizationAdapter, type RouterAbEd25519YaoRegistrationService } from '../registration/routerAbEd25519YaoRegistration';
+import { InMemoryRouterAbEd25519YaoRegistrationStateV1, type RouterAbEd25519YaoRegistrationAuthorizationAdapter, type RouterAbEd25519YaoRegistrationAuthorizationResult, type RouterAbEd25519YaoRegistrationAuthorizationFailure, type RouterAbEd25519YaoRegistrationService } from '../registration/routerAbEd25519YaoRegistration';
 import { InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationStateV1, type RouterAbEd25519YaoVerifiedActivationIntentV1, type RouterAbEd25519YaoRegistrationIntentBindingResult } from '../registration/routerAbEd25519YaoRegistrationIntentAuthorization';
 import { type RouterApiModule } from '../../../framework/modules';
 import type { MpcWalletSigningQuotaId, WalletSessionAuthorizationId, WalletSessionId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
-import type { ThresholdEd25519SessionId } from '../../../../../../shared-ts/src/utils/domainIds';
+import { type ThresholdEd25519SessionId } from '../../../../../../shared-ts/src/utils/domainIds';
 import { type RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
 import type { WalletAuthAuthority } from '../../../../../../shared-ts/src/utils/walletAuthAuthority';
 import type { WalletSessionOperationCredentialV1 } from '../../../../../../shared-ts/src/device-linking';
 import type { WalletRegistrationEd25519YaoBootstrapSession } from '../../../../../../shared-ts/src/utils/registrationContracts';
-import { InMemoryRouterAbEd25519YaoRecoveryStateV1, type RouterAbEd25519YaoActiveCapabilityLookupV1, type RouterAbEd25519YaoActiveCapabilityResolverV1, type RouterAbEd25519YaoPersistedActiveCapabilityInstallerV1, type RouterAbEd25519YaoRecoveryAuthorizationAdapter, type RouterAbEd25519YaoRecoveryService, type RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallerV1, type WarmBootstrapLinkedEd25519AuthorityReaderV1 } from '../recovery/routerAbEd25519YaoRecovery';
+import { InMemoryRouterAbEd25519YaoRecoveryStateV1, type RouterAbEd25519YaoActiveCapabilityLookupV1, type RouterAbEd25519YaoActiveCapabilityResolverV1, type RouterAbEd25519YaoPersistedActiveCapabilityInstallerV1, type RouterAbEd25519YaoRecoveryAuthorizationAdapter, type RouterAbEd25519YaoRecoveryService, type WarmBootstrapLinkedEd25519AuthorityReaderV1 } from '../recovery/routerAbEd25519YaoRecovery';
 import type { WalletEd25519YaoActiveCapabilityRecord } from '../../../../core/WalletStore';
 import { InMemoryRouterAbEd25519YaoExportStateV1, type RouterAbEd25519YaoExportAuthorizationAdapter, type RouterAbEd25519YaoExportService } from '../export/routerAbEd25519YaoExport';
+import { type RouterAbEd25519YaoRegistrationSigningRootIdV1, type RouterAbEd25519YaoTenantRootWireV1 } from '../routerAbEd25519YaoGatewayEnvelope';
+import type { RouterAbEd25519YaoPreparedWriteV1 } from './routerAbEd25519YaoProductRegistrationPartitionedStateStore';
 import type { DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
 /**
  * How the Ed25519 Yao session response reaches its primary credential. A
@@ -54,16 +56,47 @@ export type RouterAbEd25519YaoWalletSessionMintInputV1 = (RouterAbEd25519YaoWall
     readonly expiresAtMs: number;
     readonly remainingUses: number;
 });
-export type RouterAbEd25519YaoProductRegistrationRuntimeV1 = RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallerV1 & RouterAbEd25519YaoPersistedActiveCapabilityInstallerV1 & RouterAbEd25519YaoActiveCapabilityResolverV1 & {
+export type RouterAbEd25519YaoProductRegistrationRuntimeV1 = RouterAbEd25519YaoPersistedActiveCapabilityInstallerV1 & RouterAbEd25519YaoActiveCapabilityResolverV1 & {
     readonly kind: 'router_ab_ed25519_yao_product_registration_runtime_v1';
     readonly signingWorkerId: string;
-    bindAndAdmitVerifiedRegistration(input: RouterAbEd25519YaoVerifiedActivationIntentV1): Promise<RouterAbEd25519YaoVerifiedRegistrationAdmissionResultV1>;
+    /**
+     * Starts the tenant-root read of a registration admission. The read
+     * needs the signing root ID and epoch alone, so it can run before the
+     * proof is verified. A runtime that pins no tenant root at admission
+     * starts nothing.
+     */
+    startRegistrationDispatchRoot(signingRootId: RouterAbEd25519YaoRegistrationSigningRootIdV1): RouterAbEd25519YaoStartedDispatchRootV1 | null;
+    bindAndAdmitVerifiedRegistration(input: RouterAbEd25519YaoVerifiedActivationIntentV1, companionWrite: RouterAbEd25519YaoAdmissionCompanionWriteV1 | null, startedDispatchRoot: RouterAbEd25519YaoStartedDispatchRootV1 | null): Promise<RouterAbEd25519YaoVerifiedRegistrationAdmissionResultV1>;
     bindVerifiedIntent(input: RouterAbEd25519YaoVerifiedActivationIntentV1): Promise<RouterAbEd25519YaoRegistrationIntentBindingResult>;
     consumeActivated(request: RouterAbEd25519YaoActivationConsumptionRequestV1): Promise<RouterAbEd25519YaoActivationConsumptionResultV1>;
 };
+/** A tenant-root read in flight, with the signing root ID that it was started for. */
+export type RouterAbEd25519YaoStartedDispatchRootV1 = {
+    readonly signingRootId: RouterAbEd25519YaoRegistrationSigningRootIdV1;
+    readonly dispatchRoot: Promise<RouterAbEd25519YaoTenantRootWireV1>;
+};
+/**
+ * Prepares another store's write for the admission request that was bound.
+ * It commits in the batch of a new admission, or it does not run.
+ */
+export type RouterAbEd25519YaoAdmissionCompanionWriteV1 = (admissionRequest: RouterAbEd25519YaoRegistrationAdmissionRequestV1) => RouterAbEd25519YaoPreparedWriteV1;
 export type RouterAbEd25519YaoVerifiedRegistrationAdmissionResultV1 = Extract<RouterAbEd25519YaoRegistrationIntentBindingResult, {
     readonly ok: false;
-}> | RouterAbEd25519YaoRegistrationServiceResult<RouterAbEd25519YaoActivationAdmissionReceiptV1<'registration'>>;
+}> | Extract<RouterAbEd25519YaoRegistrationAuthorizationResult, {
+    readonly ok: false;
+}> | Extract<RouterAbEd25519YaoRegistrationServiceResult<never>, {
+    readonly ok: false;
+}> | {
+    readonly ok: true;
+    readonly status: 200;
+    readonly admissionRequest: RouterAbEd25519YaoRegistrationAdmissionRequestV1;
+    readonly value: RouterAbEd25519YaoActivationAdmissionReceiptV1<'registration'>;
+    /**
+     * `not_committed` when the admission already existed, or when this
+     * runtime has no batch to share: the caller then writes for itself.
+     */
+    readonly companionWrite: 'committed' | 'not_committed';
+};
 export type RouterAbEd25519YaoProductRegistrationCompositionV1 = {
     readonly kind: 'router_ab_ed25519_yao_product_registration_composition_v1';
     readonly registrationService: RouterAbEd25519YaoProductRegistrationServicePortV1;
@@ -78,9 +111,10 @@ export type RouterAbEd25519YaoProductRegistrationCompositionV1 = {
 export interface RouterAbEd25519YaoProductRegistrationServicePortV1 extends RouterAbEd25519YaoRegistrationService, RouterAbEd25519YaoActivationConsumerV1 {
 }
 export interface RouterAbEd25519YaoProductRegistrationAuthorizationPortV1 extends RouterAbEd25519YaoRegistrationAuthorizationAdapter {
+    bindAndAuthorizeAdmission(input: RouterAbEd25519YaoVerifiedActivationIntentV1): Promise<RouterAbEd25519YaoRegistrationIntentBindingResult | RouterAbEd25519YaoRegistrationAuthorizationFailure>;
     bindVerifiedIntent(input: RouterAbEd25519YaoVerifiedActivationIntentV1): Promise<RouterAbEd25519YaoRegistrationIntentBindingResult>;
 }
-export interface RouterAbEd25519YaoProductRecoveryServicePortV1 extends RouterAbEd25519YaoRecoveryService, RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallerV1, RouterAbEd25519YaoPersistedActiveCapabilityInstallerV1, RouterAbEd25519YaoActiveCapabilityResolverV1 {
+export interface RouterAbEd25519YaoProductRecoveryServicePortV1 extends RouterAbEd25519YaoRecoveryService, RouterAbEd25519YaoPersistedActiveCapabilityInstallerV1, RouterAbEd25519YaoActiveCapabilityResolverV1 {
 }
 export type RouterAbEd25519YaoProductRegistrationPortsV1 = {
     readonly signingWorkerId: string;
@@ -130,7 +164,7 @@ export declare function createRouterAbEd25519YaoProductRegistrationRuntimeV1(inp
     readonly signingWorkerId: string;
     readonly registrationService: RouterAbEd25519YaoProductRegistrationServicePortV1;
     readonly authorization: RouterAbEd25519YaoProductRegistrationAuthorizationPortV1;
-    readonly capabilityInstaller: RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallerV1 & RouterAbEd25519YaoPersistedActiveCapabilityInstallerV1;
+    readonly capabilityInstaller: RouterAbEd25519YaoPersistedActiveCapabilityInstallerV1;
     readonly capabilityResolver: RouterAbEd25519YaoActiveCapabilityResolverV1;
 }): RouterAbEd25519YaoProductRegistrationRuntimeV1;
 export declare function routerAbEd25519YaoPersistedCapabilityMatchesLookupV1(capability: WalletEd25519YaoActiveCapabilityRecord, lookup: RouterAbEd25519YaoActiveCapabilityLookupV1): boolean;

package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore.d.ts

@@ -1,5 +1,6 @@
 import type { VersionedJsonObject, VersionedJsonRecordReadResult } from '../../../framework/versionedJsonRecordStore';
-import type { D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import type { D1PreparedStatementLike, D1ResultLike } from '../../../../storage/tenantRoute';
+import type { InMemoryRouterAbEd25519YaoRecoveryStateV1 } from '../recovery/routerAbEd25519YaoRecovery';
 import { type RouterAbEd25519YaoRegistrationExecutionAuthorityV1 } from '../registration/routerAbEd25519YaoRegistrationExecutionRecord';
 import type { RouterAbEd25519YaoProductRegistrationStateV1 } from './routerAbEd25519YaoProductRegistration';
 import { type RouterAbEd25519YaoProductRegistrationCeremonyStateV1, type RouterAbEd25519YaoProductRegistrationSharedStateV1 } from './routerAbEd25519YaoProductRegistrationPartitioning';
@@ -35,6 +36,7 @@ export type RouterAbEd25519YaoProductRegistrationPartitionBatchResultV1 = {
  */
 export type RouterAbEd25519YaoPreparedWriteV1 = {
     readonly statements: readonly D1PreparedStatementLike[];
+    readonly executeBatch?: (statements: readonly D1PreparedStatementLike[]) => Promise<readonly D1ResultLike[]>;
 };
 export type RouterAbEd25519YaoProductRegistrationPartitionRecordStoreV1 = {
     readonly readMany: (keys: readonly string[]) => Promise<readonly {
@@ -71,7 +73,36 @@ export type RouterAbEd25519YaoProductRegistrationPartitionedStateCommitResultV1
     readonly kind: 'version_mismatch';
     readonly key: 'shared' | 'ceremony';
 };
+/** Registration changes only its own ceremony. Shared capabilities are inaccessible here. */
+export type RouterAbEd25519YaoRegistrationCeremonySnapshotV1 = {
+    readonly lifecycleId: string;
+    readonly state: {
+        readonly registration: RouterAbEd25519YaoProductRegistrationStateV1['registration'];
+        readonly authorization: RouterAbEd25519YaoProductRegistrationStateV1['authorization'];
+        readonly recovery?: never;
+        readonly export?: never;
+    };
+    readonly baseline: {
+        readonly version: string | null;
+        readonly recovery: RouterAbEd25519YaoProductRegistrationCeremonyStateV1['recovery'];
+        readonly export: RouterAbEd25519YaoProductRegistrationCeremonyStateV1['export'];
+    };
+};
+export type RouterAbEd25519YaoCapabilitySnapshotV1 = {
+    readonly value: RouterAbEd25519YaoProductRegistrationSharedStateV1;
+    readonly version: string | null;
+};
+export type RouterAbEd25519YaoCapabilityMutationV1 = {
+    readonly capabilities: InMemoryRouterAbEd25519YaoRecoveryStateV1['capabilities'];
+    readonly identityCapabilities: InMemoryRouterAbEd25519YaoRecoveryStateV1['identityCapabilities'];
+    readonly recoveries?: never;
+    readonly recoverySessions?: never;
+};
 export interface RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1 {
+    loadCapabilities(): Promise<RouterAbEd25519YaoCapabilitySnapshotV1>;
+    commitCapabilities(snapshot: RouterAbEd25519YaoCapabilitySnapshotV1, mutation: RouterAbEd25519YaoCapabilityMutationV1, companionWrite: RouterAbEd25519YaoPreparedWriteV1 | null): Promise<RouterAbEd25519YaoProductRegistrationPartitionBatchResultV1>;
+    loadRegistration(lifecycleId: string): Promise<RouterAbEd25519YaoRegistrationCeremonySnapshotV1>;
+    commitRegistration(snapshot: RouterAbEd25519YaoRegistrationCeremonySnapshotV1, companionWrite: RouterAbEd25519YaoPreparedWriteV1 | null): Promise<RouterAbEd25519YaoProductRegistrationPartitionBatchResultV1>;
     load(lifecycleId: string): Promise<RouterAbEd25519YaoProductRegistrationPartitionedStateV1>;
     commit(input: RouterAbEd25519YaoProductRegistrationPartitionedStateCommitInputV1): Promise<RouterAbEd25519YaoProductRegistrationPartitionedStateCommitResultV1>;
 }
@@ -87,7 +118,7 @@ export declare function createRouterAbEd25519YaoProductRegistrationPartitionedSt
  * The admitted authority a registration execute is checked against, from a
  * loaded ceremony state, or `null` when the lifecycle is not admitted.
  */
-export declare function routerAbEd25519YaoAdmittedRegistrationAuthorityV1(state: RouterAbEd25519YaoProductRegistrationStateV1, lifecycleId: string): RouterAbEd25519YaoRegistrationExecutionAuthorityV1 | null;
+export declare function routerAbEd25519YaoAdmittedRegistrationAuthorityV1(state: RouterAbEd25519YaoRegistrationCeremonySnapshotV1['state'], lifecycleId: string): RouterAbEd25519YaoRegistrationExecutionAuthorityV1 | null;
 export declare function encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1(record: RouterAbEd25519YaoProductRegistrationPartitionRecordV1): VersionedJsonObject;
 export declare function sameRouterAbEd25519YaoSharedStateCanonicalEncodingV1(left: RouterAbEd25519YaoSharedStateCanonicalEncodingV1, right: RouterAbEd25519YaoSharedStateCanonicalEncodingV1): boolean;
 export declare function parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1(input: unknown): RouterAbEd25519YaoProductRegistrationPartitionRecordV1 | null;

package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitioning.d.ts

@@ -16,8 +16,8 @@ export type RouterAbEd25519YaoProductRegistrationSharedStateV1 = {
     readonly recoveryCapabilities: ReadonlyMap<string, RecoveryCapabilityState>;
     readonly recoveryIdentityCapabilities: ReadonlyMap<string, string>;
     readonly recoverySessions: ReadonlyMap<string, string>;
-    readonly exportAuthorizationNonces: ReadonlySet<string>;
-    readonly exportAuthorizationUncertain: ReadonlySet<string>;
+    readonly exportAuthorizationNonceOwners: ReadonlyMap<string, string>;
+    readonly exportAuthorizationUncertainOwners: ReadonlyMap<string, string>;
 };
 export type RouterAbEd25519YaoProductRegistrationCeremonyStateV1 = {
     readonly kind: 'router_ab_ed25519_yao_product_registration_ceremony_state_v1';

package/dist/types/wallet-server/src/router/domains/ed25519Yao/export/routerAbEd25519YaoExport.d.ts

@@ -1,3 +1,4 @@
+import type { WalletExecutionAuthority } from '../../walletRegistration/walletRegistrationReservation';
 import { type RouterAbEd25519YaoExportAdmissionReceiptV1, type RouterAbEd25519YaoExportAdmissionRequestV1, type RouterAbEd25519YaoExportExecuteRequestV1, type RouterAbEd25519YaoExportResultV1 } from '../../../../../../shared-ts/src/utils/routerAbEd25519Yao';
 import { type RouterAbTraceContextV1 } from '../../../../../../shared-ts/src/utils/routerAbTraceContext';
 import { type ThresholdEd25519SessionId } from '../../../../../../shared-ts/src/utils/domainIds';
@@ -29,10 +30,10 @@ export type RouterAbEd25519YaoExportBackendResult = {
 };
 export interface RouterAbEd25519YaoExportBackend {
     admitExport(request: RouterAbEd25519YaoExportAdmissionRequestV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoExportBackendResult> | RouterAbEd25519YaoExportBackendResult;
-    executeExport(request: RouterAbEd25519YaoExportExecuteRequestV1, admissionRequest: RouterAbEd25519YaoExportExecuteAdmissionContextV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoExportBackendResult> | RouterAbEd25519YaoExportBackendResult;
+    executeExport(request: RouterAbEd25519YaoExportExecuteRequestV1, claim: RouterAbEd25519YaoExportExecuteClaimV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoExportBackendResult> | RouterAbEd25519YaoExportBackendResult;
 }
 export interface RouterAbEd25519YaoExportService {
-    admitExport(request: RouterAbEd25519YaoExportAdmissionRequestV1, authorizationIdentity: RouterAbEd25519YaoExportServerAuthorizationIdentityV1, admission: RouterAbEd25519YaoExportOperationAdmissionV1, factorRelease: RouterAbEd25519YaoExportEmailOtpFactorReleaseV1 | null, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoExportServiceResult<RouterAbEd25519YaoExportAdmissionReceiptV1>>;
+    admitExport(request: RouterAbEd25519YaoExportAdmissionRequestV1, authorizationIdentity: RouterAbEd25519YaoExportServerAuthorizationIdentityV1, ownershipGeneration: number, admission: RouterAbEd25519YaoExportOperationAdmissionV1, factorRelease: RouterAbEd25519YaoExportEmailOtpFactorReleaseV1 | null, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoExportServiceResult<RouterAbEd25519YaoExportAdmissionReceiptV1>>;
     executeExport(request: RouterAbEd25519YaoExportExecuteRequestV1, authorizationIdentity: RouterAbEd25519YaoExportServerAuthorizationIdentityV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoExportServiceResult<RouterAbEd25519YaoExportResultV1>>;
 }
 /**
@@ -77,6 +78,7 @@ export type RouterAbEd25519YaoExportExecuteClaimV1 = {
     readonly sessionId: string;
     readonly executeFingerprint: string;
     readonly admissionRequest: RouterAbEd25519YaoExportExecuteAdmissionContextV1;
+    readonly ownershipGeneration: number;
 };
 export type RouterAbEd25519YaoExportExecutePreparationV1 = {
     readonly kind: 'claimed';
@@ -131,6 +133,7 @@ export type RouterAbEd25519YaoExportAuthorizationResult = {
     readonly factorRelease?: RouterAbEd25519YaoExportEmailOtpFactorReleaseV1;
 } | {
     readonly ok: false;
+    readonly ownershipGeneration?: never;
     readonly status: 401 | 403 | 409 | 429 | 503;
     readonly code: string;
     readonly message: string;
@@ -167,6 +170,7 @@ export type RouterAbEd25519YaoExportAdmissionAuthorizationResultV1 = {
     readonly ok: true;
     readonly authorizationIdentity: RouterAbEd25519YaoExportServerAuthorizationIdentityV1;
     readonly admission: RouterAbEd25519YaoExportOperationAdmissionV1;
+    readonly ownershipGeneration: number;
     readonly factorRelease?: RouterAbEd25519YaoExportEmailOtpFactorReleaseV1;
 } | RouterAbEd25519YaoExportAuthorizationFailure;
 export type RouterAbEd25519YaoExportAuthorizationIdentityResolutionResult = {
@@ -182,6 +186,7 @@ export interface RouterAbEd25519YaoExportAuthorizationAdapter {
     resolveAuthorizationIdentity(body: RouterAbEd25519YaoExportAdmissionRequestV1): Promise<RouterAbEd25519YaoExportAuthorizationIdentityResolutionResult> | RouterAbEd25519YaoExportAuthorizationIdentityResolutionResult;
 }
 type ExportAuthorizationContext = {
+    readonly ownershipGeneration: number;
     readonly request: RouterAbEd25519YaoExportAdmissionRequestV1;
     readonly authorizationFingerprint: string;
     readonly authorizationIdentity: RouterAbEd25519YaoExportServerAuthorizationIdentityV1;
@@ -225,8 +230,8 @@ type ExportCompletedState = ExportAuthorizationContext & {
 type ExportLifecycleState = ExportAuthorizedState | ExportAdmittingState | ExportAdmissionFailedState | ExportAdmittedState | ExportExecutingState | ExportExecutionFailedState | ExportCompletedState;
 export declare class InMemoryRouterAbEd25519YaoExportStateV1 {
     readonly exports: Map<string, ExportLifecycleState>;
-    readonly authorizationNonces: Set<string>;
-    readonly authorizationUncertain: Set<string>;
+    readonly authorizationNonceOwners: Map<string, string>;
+    readonly authorizationUncertainOwners: Map<string, string>;
 }
 export declare class InMemoryRouterAbEd25519YaoExportService implements RouterAbEd25519YaoExportService {
     private readonly backend;
@@ -235,15 +240,15 @@ export declare class InMemoryRouterAbEd25519YaoExportService implements RouterAb
     constructor(backend: RouterAbEd25519YaoExportBackend, capabilities: RouterAbEd25519YaoActiveCapabilityResolverV1, state?: InMemoryRouterAbEd25519YaoExportStateV1);
     authorizationIsUncertain(request: RouterAbEd25519YaoExportAdmissionRequestV1): boolean;
     recordAuthorizationUncertain(request: RouterAbEd25519YaoExportAdmissionRequestV1): void;
-    admitExport(request: RouterAbEd25519YaoExportAdmissionRequestV1, authorizationIdentity: RouterAbEd25519YaoExportServerAuthorizationIdentityV1, admission: RouterAbEd25519YaoExportOperationAdmissionV1, factorRelease: RouterAbEd25519YaoExportEmailOtpFactorReleaseV1 | null, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoExportServiceResult<RouterAbEd25519YaoExportAdmissionReceiptV1>>;
+    admitExport(request: RouterAbEd25519YaoExportAdmissionRequestV1, authorizationIdentity: RouterAbEd25519YaoExportServerAuthorizationIdentityV1, ownershipGeneration: number, admission: RouterAbEd25519YaoExportOperationAdmissionV1, factorRelease: RouterAbEd25519YaoExportEmailOtpFactorReleaseV1 | null, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoExportServiceResult<RouterAbEd25519YaoExportAdmissionReceiptV1>>;
     /**
      * Authorizes one export: its nonce claimed and its state `authorized`, in
      * this state for the caller to commit with the export's operation
      * admission. An export already here answers from its state instead, with
      * the factor release it recorded.
      */
-    authorizeExport(request: RouterAbEd25519YaoExportAdmissionRequestV1, authorizationFingerprint: string, authorizationIdentity: RouterAbEd25519YaoExportServerAuthorizationIdentityV1, factorRelease: RouterAbEd25519YaoExportEmailOtpFactorReleaseV1 | null): RouterAbEd25519YaoExportAuthorizationDecisionV1;
-    readAuthorizationIdentity(request: RouterAbEd25519YaoExportAdmissionRequestV1): RouterAbEd25519YaoExportServerAuthorizationIdentityV1 | null;
+    authorizeExport(request: RouterAbEd25519YaoExportAdmissionRequestV1, authorizationFingerprint: string, authorizationIdentity: RouterAbEd25519YaoExportServerAuthorizationIdentityV1, ownershipGeneration: number, factorRelease: RouterAbEd25519YaoExportEmailOtpFactorReleaseV1 | null): RouterAbEd25519YaoExportAuthorizationDecisionV1;
+    readAdmissionAuthority(request: RouterAbEd25519YaoExportAdmissionRequestV1): Pick<ExportAuthorizationContext, 'authorizationIdentity' | 'ownershipGeneration'> | null;
     prepareAdmitExport(request: RouterAbEd25519YaoExportAdmissionRequestV1, _authorizationIdentity: RouterAbEd25519YaoExportServerAuthorizationIdentityV1): Promise<RouterAbEd25519YaoExportAdmissionPreparationV1>;
     commitAdmitExport(input: RouterAbEd25519YaoExportAdmissionCommitInputV1): RouterAbEd25519YaoExportServiceResult<RouterAbEd25519YaoExportAdmissionReceiptV1>;
     executeExport(request: RouterAbEd25519YaoExportExecuteRequestV1, authorizationIdentity: RouterAbEd25519YaoExportServerAuthorizationIdentityV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoExportServiceResult<RouterAbEd25519YaoExportResultV1>>;
@@ -261,7 +266,8 @@ export declare class RouterAbEd25519YaoExportOwnerProofAuthorizationAdapter impl
     private readonly walletAuthMethods;
     private readonly authorizedOperations;
     private readonly resolveEd25519MaterialActivation;
-    constructor(webAuthn: Pick<RouterApiWebAuthnService, 'verifyWebAuthnAuthenticationLite'>, emailOtp: Pick<RouterApiEmailOtpRouteService, 'verifyEmailOtpChallenge'>, walletAuthMethods: Pick<RouterApiWalletAuthMethodService, 'resolveActivePasskeyAuthorityForVerifiedCredential' | 'resolveActiveEmailOtpAuthorityForVerifiedMethod'>, authorizedOperations: RouterApiAuthorizedOperationService, resolveEd25519MaterialActivation: RouterApiWalletRegistrationService['resolveEd25519MaterialActivation']);
+    private readonly admitEstablishedHome;
+    constructor(webAuthn: Pick<RouterApiWebAuthnService, 'verifyWebAuthnAuthenticationLite'>, emailOtp: Pick<RouterApiEmailOtpRouteService, 'verifyEmailOtpChallenge'>, walletAuthMethods: Pick<RouterApiWalletAuthMethodService, 'resolveActivePasskeyAuthorityForVerifiedCredential' | 'resolveActiveEmailOtpAuthorityForVerifiedMethod'>, authorizedOperations: RouterApiAuthorizedOperationService, resolveEd25519MaterialActivation: RouterApiWalletRegistrationService['resolveEd25519MaterialActivation'], admitEstablishedHome: WalletExecutionAuthority['admitEstablishedHome']);
     authorizeAdmission(input: RouterAbEd25519YaoExportAdmissionAuthorizationInputV1): Promise<RouterAbEd25519YaoExportAdmissionAuthorizationResultV1>;
     authorizeExecution(input: RouterAbEd25519YaoExportExecutionAuthorizationInputV1): RouterAbEd25519YaoExportAuthorizationIdentityResolutionResult;
     resolveAuthorizationIdentity(body: RouterAbEd25519YaoExportAdmissionRequestV1): Promise<RouterAbEd25519YaoExportAuthorizationIdentityResolutionResult>;

package/dist/types/wallet-server/src/router/domains/ed25519Yao/export/routerAbEd25519YaoExport.typecheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=routerAbEd25519YaoExport.typecheck.d.ts.map

package/dist/types/wallet-server/src/router/domains/ed25519Yao/export/routerAbEd25519YaoExportRequestScopedCloudflare.d.ts

@@ -1,7 +1,9 @@
+import { type WalletLifecycleRoutingPublisher } from '../../../../authorization/lifecycleRouting';
 import { type RouterAbEd25519YaoExportAuthorizationAdapter, type RouterAbEd25519YaoExportBackend } from './routerAbEd25519YaoExport';
 import type { RouterAbEd25519YaoActiveCapabilityResolverV1 } from '../recovery/routerAbEd25519YaoRecovery';
 import type { RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1 } from '../capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore';
 export type RouterAbEd25519YaoExportRequestScopedCloudflareInputV1 = {
+    readonly lifecycleRouting?: WalletLifecycleRoutingPublisher;
     readonly request: Request;
     readonly store: RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1;
     readonly backend: RouterAbEd25519YaoExportBackend;

package/dist/types/wallet-server/src/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery.d.ts

@@ -41,6 +41,8 @@ type RouterAbEd25519YaoRecoveryAuthorityProjectionV1 = {
     readonly kind: 'replace_active_authority_projection';
 };
 type RouterAbEd25519YaoRecoveryAuthorizationBindingV1 = {
+    readonly ownershipGeneration: number;
+} & ({
     readonly kind: 'wallet_recovery';
     readonly walletId: string;
 } | {
@@ -54,7 +56,7 @@ type RouterAbEd25519YaoRecoveryAuthorizationBindingV1 = {
     readonly authorizationId: RouterApiWalletSessionAuthorizationV2AdmissionContext['authorization']['session']['authorizationId'];
     readonly walletSessionId: RouterApiWalletSessionAuthorizationV2AdmissionContext['authorization']['session']['walletSessionId'];
     readonly quotaId: RouterApiWalletSessionAuthorizationV2AdmissionContext['authorization']['session']['quotaId'];
-};
+});
 export interface RouterAbEd25519YaoRecoveryBackend {
     admitRecovery(request: RouterAbEd25519YaoRecoveryAdmissionRequestV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRecoveryBackendResult> | RouterAbEd25519YaoRecoveryBackendResult;
     /**
@@ -68,11 +70,12 @@ export interface RouterAbEd25519YaoRecoveryBackend {
      * the Router, which then reconciles the roles' records instead of starting
      * fresh.
      */
-    executeRecovery(request: RecoveryExecuteRequest, admissionRequest: RouterAbEd25519YaoRecoveryExecuteAdmissionContextV1, dispatchRoot: RouterAbEd25519YaoTenantRootWireV1, attempt: number, replay: boolean, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRecoveryBackendResult> | RouterAbEd25519YaoRecoveryBackendResult;
+    executeRecovery(request: RecoveryExecuteRequest, claim: RouterAbEd25519YaoRecoveryExecuteClaimV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRecoveryBackendResult> | RouterAbEd25519YaoRecoveryBackendResult;
     /** Promotes the recovery at the SigningWorker of the attempt's tenant root. */
-    activateRecovery(request: RouterAbEd25519YaoRecoveryActivationRequestV1, dispatchRoot: RouterAbEd25519YaoTenantRootWireV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRecoveryBackendResult> | RouterAbEd25519YaoRecoveryBackendResult;
+    activateRecovery(request: RouterAbEd25519YaoRecoveryActivationRequestV1, dispatchRoot: RouterAbEd25519YaoTenantRootWireV1, ownershipGeneration: number, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRecoveryBackendResult> | RouterAbEd25519YaoRecoveryBackendResult;
 }
 export interface RouterAbEd25519YaoRecoveryService {
+    recoveryOwnershipGeneration(binding: RecoveryExecuteRequest['binding']): RouterAbEd25519YaoRecoveryServiceResult<number>;
     admitRecovery(request: RouterAbEd25519YaoRecoveryAdmissionRequestV1, authorization: RouterAbEd25519YaoRecoveryAuthorizationBindingV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRecoveryServiceResult<RecoveryAdmissionReceipt>>;
     executeRecovery(request: RecoveryExecuteRequest, authorization: RouterAbEd25519YaoRecoveryAuthorizationBindingV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRecoveryServiceResult<RecoveryExecutionResult>>;
     activateRecovery(request: RouterAbEd25519YaoRecoveryActivationRequestV1, authorization: RouterAbEd25519YaoRecoveryAuthorizationBindingV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRecoveryServiceResult<RouterAbEd25519YaoRecoveryActivationReceiptV1>>;
@@ -106,6 +109,7 @@ interface RouterAbEd25519YaoRecoveryAdmissionBoundaryV1 {
 }
 export type RouterAbEd25519YaoRecoveryExecuteClaimV1 = {
     readonly kind: 'router_ab_ed25519_yao_recovery_execute_claim_v1';
+    readonly ownershipGeneration: number;
     readonly lifecycleId: string;
     readonly recoveryKey: string;
     readonly sessionId: string;
@@ -140,6 +144,7 @@ interface RouterAbEd25519YaoRecoveryExecuteBoundaryV1 {
     commitExecuteRecovery(input: RouterAbEd25519YaoRecoveryExecuteCommitInputV1): RouterAbEd25519YaoRecoveryServiceResult<RecoveryExecutionResult>;
 }
 export type RouterAbEd25519YaoRecoveryActivationClaimV1 = {
+    readonly ownershipGeneration: number;
     readonly kind: 'router_ab_ed25519_yao_recovery_activation_claim_v1';
     readonly lifecycleId: string;
     readonly recoveryKey: string;
@@ -201,15 +206,18 @@ export type RouterAbEd25519YaoRecoveryAuthorizationInput = {
     readonly body: RouterAbEd25519YaoRecoveryAdmissionRequestV1;
 } | {
     readonly kind: 'execute';
+    readonly ownershipGeneration: number;
     readonly request: Request;
     readonly body: RecoveryExecuteRequest;
 } | {
     readonly kind: 'activate';
+    readonly ownershipGeneration: number;
     readonly request: Request;
     readonly body: RouterAbEd25519YaoRecoveryActivationRequestV1;
 };
 export type RouterAbEd25519YaoRecoveryAuthorizationResult = {
     readonly ok: true;
+    readonly ownershipGeneration: number;
     readonly authorization: {
         readonly kind: 'wallet_session_v2';
         readonly context: RouterApiWalletSessionAuthorizationV2AdmissionContext;
@@ -222,13 +230,14 @@ export type RouterAbEd25519YaoRecoveryAuthorizationResult = {
     };
 } | {
     readonly ok: false;
+    readonly ownershipGeneration?: never;
     readonly status: 401 | 403 | 409 | 429 | 503;
     readonly code: string;
     readonly message: string;
 };
-export declare function recoveryAuthorizationBinding(authorization: Extract<RouterAbEd25519YaoRecoveryAuthorizationResult, {
+export declare function recoveryAuthorizationBinding(admitted: Extract<RouterAbEd25519YaoRecoveryAuthorizationResult, {
     readonly ok: true;
-}>['authorization']): RouterAbEd25519YaoRecoveryAuthorizationBindingV1;
+}>): RouterAbEd25519YaoRecoveryAuthorizationBindingV1;
 type WarmBootstrapWalletSessionContext = {
     readonly session: RouterApiWalletSessionAuthorizationV2AdmissionContext['authorization']['session'];
     readonly quota: RouterApiWalletSessionAuthorizationV2AdmissionContext['authorization']['quota'] | RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext['status']['quota'];
@@ -259,9 +268,6 @@ export type RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallResultV1 = {
     readonly code: 'invalid_installation' | 'capability_conflict' | 'capability_retired';
     readonly message: string;
 };
-export interface RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallerV1 {
-    installRegistrationFinalizeCapability(input: RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallationV1): Promise<RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallResultV1> | RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallResultV1;
-}
 export interface RouterAbEd25519YaoPersistedActiveCapabilityInstallerV1 {
     installPersistedActiveCapability(input: WalletEd25519YaoActiveCapabilityRecord): Promise<RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallResultV1> | RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallResultV1;
 }
@@ -540,7 +546,8 @@ type RouterAbEd25519YaoActiveCapabilityRecordBuildResultV1 = {
     readonly ok: false;
 }>;
 export declare function buildRouterAbEd25519YaoRegistrationCapabilityRecordV1(input: RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallationV1): RouterAbEd25519YaoActiveCapabilityRecordBuildResultV1;
-export declare class InMemoryRouterAbEd25519YaoRecoveryService implements RouterAbEd25519YaoRecoveryService, RouterAbEd25519YaoRecoveryAdmissionBoundaryV1, RouterAbEd25519YaoRecoveryExecuteBoundaryV1, RouterAbEd25519YaoRecoveryActivationBoundaryV1, RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallerV1, RouterAbEd25519YaoPersistedActiveCapabilityInstallerV1, RouterAbEd25519YaoActiveCapabilityResolverV1 {
+export declare function resolveRouterAbEd25519YaoActiveCapability(capabilities: ReadonlyMap<string, CapabilityState>, input: RouterAbEd25519YaoActiveCapabilityLookupV1): RouterAbEd25519YaoActiveCapabilityLookupResultV1;
+export declare class InMemoryRouterAbEd25519YaoRecoveryService implements RouterAbEd25519YaoRecoveryService, RouterAbEd25519YaoRecoveryAdmissionBoundaryV1, RouterAbEd25519YaoRecoveryExecuteBoundaryV1, RouterAbEd25519YaoRecoveryActivationBoundaryV1, RouterAbEd25519YaoPersistedActiveCapabilityInstallerV1, RouterAbEd25519YaoActiveCapabilityResolverV1 {
     private readonly backend;
     private readonly capabilityPersistence;
     private readonly capabilities;
@@ -557,6 +564,7 @@ export declare class InMemoryRouterAbEd25519YaoRecoveryService implements Router
     prepareAdmitRecovery(request: RouterAbEd25519YaoRecoveryAdmissionRequestV1, authorization: RouterAbEd25519YaoRecoveryAuthorizationBindingV1, dispatchRoot: RouterAbEd25519YaoTenantRootWireV1, nowMs: number): RouterAbEd25519YaoRecoveryAdmissionPreparationV1;
     commitAdmitRecovery(input: RouterAbEd25519YaoRecoveryAdmissionCommitInputV1): RouterAbEd25519YaoRecoveryServiceResult<RecoveryAdmissionReceipt>;
     executeRecovery(request: RecoveryExecuteRequest, authorization: RouterAbEd25519YaoRecoveryAuthorizationBindingV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRecoveryServiceResult<RecoveryExecutionResult>>;
+    recoveryOwnershipGeneration(binding: RecoveryExecuteRequest['binding']): RouterAbEd25519YaoRecoveryServiceResult<number>;
     prepareExecuteRecovery(request: RecoveryExecuteRequest, authorization: RouterAbEd25519YaoRecoveryAuthorizationBindingV1, nowMs: number): RouterAbEd25519YaoRecoveryExecutePreparationV1;
     commitExecuteRecovery(input: RouterAbEd25519YaoRecoveryExecuteCommitInputV1): RouterAbEd25519YaoRecoveryServiceResult<RecoveryExecutionResult>;
     activateRecovery(request: RouterAbEd25519YaoRecoveryActivationRequestV1, authorization: RouterAbEd25519YaoRecoveryAuthorizationBindingV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRecoveryServiceResult<RouterAbEd25519YaoRecoveryActivationReceiptV1>>;