@seams/wallet-server 0.8.0 → 0.9.0

package/dist/types/wallet-server/src/core/ThresholdService/routerAb/ecdsaDerivationPoolFillHandlers.d.ts

@@ -9,6 +9,7 @@ export type RouterAbEcdsaOwnerWalletScope = {
     readonly walletId: string;
 };
 export type RouterAbEcdsaDerivationPoolFillBinding = {
+    readonly ownershipGeneration: number;
     readonly walletId: string;
     readonly relayerKeyId: string;
     readonly keyHandle: string;

package/dist/types/wallet-server/src/core/ThresholdService/routerAb/ecdsaDerivationPresignBridge.d.ts

@@ -6,6 +6,7 @@ export type RouterAbEcdsaDerivationPresignaturePoolFillAuth = {
 };
 export type RouterAbEcdsaPresignAuthorityV1 = {
     readonly kind: 'owner_wallet_session';
+    readonly ownership_generation: number;
     readonly wallet_scope: {
         readonly org_id: string;
         readonly project_id: string;
@@ -14,6 +15,7 @@ export type RouterAbEcdsaPresignAuthorityV1 = {
     };
 } | {
     readonly kind: 'operation_step_up';
+    readonly ownership_generation: number;
     readonly wallet_scope: {
         readonly org_id: string;
         readonly project_id: string;
@@ -91,6 +93,8 @@ export declare function stepRouterAbEcdsaPresignSession(input: {
  * uses a separate private-worker route from the owner pool-fill protocol.
  */
 export declare function startRouterAbLinkedDeviceEcdsaPresignSession(input: {
+    ownershipGeneration: number;
+    walletScope: RouterAbEcdsaPresignAuthorityV1['wallet_scope'];
     signingWorkerBaseUrl: string;
     request: Record<string, unknown>;
     materialSource: Record<string, unknown>;
@@ -100,6 +104,8 @@ export declare function startRouterAbLinkedDeviceEcdsaPresignSession(input: {
     fetchImpl: typeof fetch;
 }): Promise<RouterAbEcdsaPresignSessionHttpResult>;
 export declare function stepRouterAbLinkedDeviceEcdsaPresignSession(input: {
+    ownershipGeneration: number;
+    walletScope: RouterAbEcdsaPresignAuthorityV1['wallet_scope'];
     signingWorkerBaseUrl: string;
     request: Record<string, unknown>;
     materialSource: Record<string, unknown>;

package/dist/types/wallet-server/src/core/ThresholdService/routerAb/internalServiceHttp.d.ts

@@ -26,6 +26,7 @@ export declare function postRouterAbInternalServiceJson(input: {
     body: unknown;
     authSecret: string;
     fetchImpl: typeof fetch;
+    headers?: Readonly<Record<string, string>>;
     onServerTiming?: (header: string | null) => void;
 }): Promise<RouterAbInternalServiceJsonResult>;
 export {};

package/dist/types/wallet-server/src/core/d1Ed25519SignerRead.d.ts

@@ -0,0 +1,17 @@
+import type { WalletId } from '../../../shared-ts/src/utils/domainIds';
+import { type RouterAbMpcMaterialActivationRefWire } from '../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
+import type { WalletEd25519SignerRecord } from './WalletStore';
+import { type RouterAbEd25519YaoActiveCapabilityLookupV1 } from '../router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery';
+/** Signer rows read with a Wallet Session; a failure surfaces after session validation. */
+export declare class Ed25519SignerRead {
+    #private;
+    private readonly walletId;
+    private readonly activation;
+    private readonly capabilities;
+    private constructor();
+    static fromRows(walletId: WalletId, activation: RouterAbMpcMaterialActivationRefWire, rows: unknown, capabilityPartition: unknown): Ed25519SignerRead;
+    resolveActiveCapability(input: RouterAbEd25519YaoActiveCapabilityLookupV1): import("../router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery").RouterAbEd25519YaoActiveCapabilityLookupResultV1 | null;
+    /** The session wallet's signer for the activation this read selected, or null. */
+    resolve(walletId: WalletId, activation: RouterAbMpcMaterialActivationRefWire): WalletEd25519SignerRecord | null;
+}
+//# sourceMappingURL=d1Ed25519SignerRead.d.ts.map

package/dist/types/wallet-server/src/core/d1WalletStore.d.ts

@@ -28,6 +28,12 @@ export type D1WalletStoreScope = {
 };
 export declare const WALLET_STORE_D1_SCHEMA_SQL: readonly ["\n    CREATE TABLE IF NOT EXISTS wallets (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      wallet_id TEXT NOT NULL,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      updated_at_ms INTEGER NOT NULL,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_id),\n      CHECK (length(wallet_id) > 0),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms >= 0),\n      CHECK (updated_at_ms >= created_at_ms),\n      CHECK (COALESCE(json_extract(record_json, '$.version') = 'wallet_v1', 0)),\n      CHECK (COALESCE(json_extract(record_json, '$.walletId') = wallet_id, 0))\n    )\n  ", "\n    CREATE TABLE IF NOT EXISTS wallet_signers (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      wallet_id TEXT NOT NULL,\n      signer_family TEXT NOT NULL,\n      signer_id TEXT NOT NULL,\n      chain_target_key TEXT,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      updated_at_ms INTEGER NOT NULL,\n      PRIMARY KEY (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        wallet_id,\n        signer_family,\n        signer_id\n      ),\n      CHECK (length(wallet_id) > 0),\n      CHECK (signer_family IN ('ed25519', 'ecdsa')),\n      CHECK (length(signer_id) > 0),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms >= 0),\n      CHECK (updated_at_ms >= created_at_ms),\n      CHECK (COALESCE(json_extract(record_json, '$.walletId') = wallet_id, 0)),\n      CHECK (COALESCE(json_extract(record_json, '$.signerId') = signer_id, 0)),\n      CHECK (\n        (\n          signer_family = 'ed25519'\n          AND chain_target_key IS NULL\n          AND substr(signer_id, 1, 8) = 'ed25519:'\n          AND COALESCE(\n            json_extract(record_json, '$.version') = 'wallet_signer_ed25519_v1',\n            0\n          )\n        )\n        OR\n        (\n          signer_family = 'ecdsa'\n          AND chain_target_key IS NOT NULL\n          AND length(chain_target_key) > 0\n          AND signer_id = 'ecdsa:' || chain_target_key\n          AND COALESCE(\n            json_extract(record_json, '$.version') = 'wallet_signer_ecdsa_v1',\n            0\n          )\n          AND COALESCE(json_extract(record_json, '$.chainTargetKey') = chain_target_key, 0)\n        )\n      )\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS wallet_signers_wallet_idx\n      ON wallet_signers (namespace, org_id, project_id, env_id, wallet_id, signer_family)\n  ", "\n    CREATE INDEX IF NOT EXISTS wallet_signers_chain_target_idx\n      ON wallet_signers (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        signer_family,\n        chain_target_key\n      )\n  ", "\n    CREATE TABLE IF NOT EXISTS wallet_ecdsa_pending_session_activations (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      wallet_id TEXT NOT NULL,\n      lifecycle_id TEXT NOT NULL,\n      request_id TEXT NOT NULL,\n      record_json TEXT NOT NULL,\n      expires_at_ms INTEGER NOT NULL,\n      PRIMARY KEY (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        wallet_id,\n        lifecycle_id,\n        request_id\n      ),\n      CHECK (json_valid(record_json)),\n      CHECK (expires_at_ms > 0)\n    )\n  "];
 export declare function ensureWalletStoreD1Schema(options: D1WalletStoreSchemaOptions): Promise<void>;
+/** Where an Ed25519 signer row names the material activation it serves. */
+export declare const ED25519_SIGNER_ACTIVATION_ID_PATH = "$.activeYaoCapability.admissionRequest.scope.material_activation.activation_id";
+/** The wallet's signer for one material activation, among the rows that name its id. */
+export declare function selectWalletEd25519Signer(rows: readonly {
+    readonly record_json?: unknown;
+}[], walletId: string, materialActivation: RouterAbMpcMaterialActivationRefWire): WalletEd25519SignerRecord | null;
 export declare function parseWalletEd25519SignerRecord(raw: unknown): WalletEd25519SignerRecord | null;
 export declare function prepareD1WalletPutSubjectStatement(input: {
     readonly database: D1DatabaseLike;

package/dist/types/wallet-server/src/core/emailOtpD1Statements.d.ts

@@ -5,6 +5,7 @@ export type ScopedD1Prepare = (sql: string, values: readonly unknown[]) => D1Pre
 /** Statements on `email_otp_challenges`. */
 export declare const emailOtpChallengeRows: {
     insert: (prepare: ScopedD1Prepare, record: EmailOtpChallengeRecord) => D1PreparedStatementLike;
+    insertIfAbsent: (prepare: ScopedD1Prepare, record: EmailOtpChallengeRecord) => D1PreparedStatementLike;
     delete: (prepare: ScopedD1Prepare, challengeId: string) => D1PreparedStatementLike;
 };
 /** Statements on `email_otp_grants`. */

package/dist/types/wallet-server/src/core/routerAbSigning/RouterAbEcdsaPresignRuntime.d.ts

@@ -1,5 +1,5 @@
 import { RouterAbEcdsaDerivationPoolFillHandlers } from '../ThresholdService/routerAb/ecdsaDerivationPoolFillHandlers';
-import { type RouterAbLinkedDeviceEcdsaExportShareHttpResult, type RouterAbEcdsaPresignSessionHttpResult } from '../ThresholdService/routerAb/ecdsaDerivationPresignBridge';
+import { type RouterAbLinkedDeviceEcdsaExportShareHttpResult, type RouterAbEcdsaPresignSessionHttpResult, type RouterAbEcdsaPresignAuthorityV1 } from '../ThresholdService/routerAb/ecdsaDerivationPresignBridge';
 import type { RouterAbEcdsaSigningWorkerExportShareBindingV1 } from '../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
 import type { RouterAbConfiguredSigningWorkerPrivateTransport } from './RouterAbNormalSigningRuntime';
 export type RouterAbEcdsaPresignRuntimeConfig = {
@@ -28,12 +28,16 @@ export declare class RouterAbEcdsaPresignRuntime {
     initializePoolFill(input: RouterAbEcdsaPresignInitInput): Promise<RouterAbEcdsaPresignInitResult>;
     advancePoolFill(input: RouterAbEcdsaPresignStepInput): Promise<RouterAbEcdsaPresignStepResult>;
     initializeLinkedDevicePresign(input: {
+        readonly ownershipGeneration: number;
+        readonly walletScope: RouterAbEcdsaPresignAuthorityV1['wallet_scope'];
         readonly request: Record<string, unknown>;
         readonly materialSource: Record<string, unknown>;
         readonly presignSessionId: string;
         readonly expiresAtMs: number;
     }): Promise<RouterAbEcdsaPresignSessionHttpResult>;
     advanceLinkedDevicePresign(input: {
+        readonly ownershipGeneration: number;
+        readonly walletScope: RouterAbEcdsaPresignAuthorityV1['wallet_scope'];
         readonly request: Record<string, unknown>;
         readonly materialSource: Record<string, unknown>;
         readonly presignSessionId: string;

package/dist/types/wallet-server/src/core/signingMaterial/ordinaryInactiveSignerMaterialReservation.d.ts

@@ -76,6 +76,7 @@ export type OrdinaryEd25519SignerMaterialReservationRequestV1 = OrdinarySignerMa
 export type OrdinaryEcdsaSignerMaterialReservationRequestV1 = OrdinarySignerMaterialReservationRequestV1<'ecdsa_secp256k1'>;
 export type OrdinaryInactiveSignerMaterialReservationRequestV1 = OrdinaryEd25519SignerMaterialReservationRequestV1 | OrdinaryEcdsaSignerMaterialReservationRequestV1;
 type OrdinarySignerMaterialReservationRequestV1<F extends OrdinarySignerFamilyV1> = {
+    readonly ownershipGeneration: number;
     readonly kind: OrdinaryRequestKindByFamilyV1[F];
     readonly keyFamily: F;
     readonly signer: OrdinarySignerByFamilyV1[F];

package/dist/types/wallet-server/src/core/threeRouteRegistrationContracts.d.ts

@@ -1,3 +1,4 @@
+import type { WalletSessionHome } from '../../../shared-ts/src/device-linking/contracts';
 import type { ActiveWalletAuthMethodRecordV2 } from '../../../shared-ts/src/utils/walletAuthMethodRecord';
 import type { WalletRegistrationEcdsaPreparePayload, WalletRegistrationFinalizeSuccess, WalletRegistrationStartRequest, WalletRegistrationStartResponse, WalletRegistrationEcdsaActivationResponse, WalletRegistrationEcdsaWalletKey, WalletRegistrationEd25519YaoPublicResult, WalletRegistrationRouteDiagnostics } from './registrationContracts';
 import type { WalletRegistrationFinalizeAuthMethod } from '../../../shared-ts/src/utils/registrationContracts';
@@ -10,6 +11,7 @@ import type { RegistrationAuthority } from '../../../shared-ts/src/utils/registr
 import type { WalletAuthAuthority } from '../../../shared-ts/src/utils/walletAuthAuthority';
 import type { WalletCustodyRegistrationOutcome } from '../../../shared-ts/src/passkey-custody';
 import type { DigestB64u } from '../../../shared-ts/src/utils/canonicalPrimitives';
+import type { RouterAbEd25519YaoActivationAdmissionReceiptV1 } from '../../../shared-ts/src/utils/routerAbEd25519Yao';
 import type { ThresholdEd25519AuthorityScope, EcdsaDerivationServerBootstrapResponse } from './types';
 import type { StoredWalletRegistrationNearEd25519YaoAuthorizedBranch, StoredWalletRegistrationPreparedContext } from './RegistrationCeremonyStore';
 /**
@@ -100,14 +102,7 @@ export type WalletRegistrationSessionCommitReceiptV2 = {
         readonly kind: 'error';
         readonly error: WalletRegistrationRouteErrorV2;
     };
-} | (WalletRegistrationSessionCommitReceiptMetadataV2 & {
-    readonly committed: {
-        readonly kind: 'near_pending';
-        readonly nearProvisioning: {
-            readonly status: 'near_pending';
-        };
-    };
-}) | (WalletRegistrationSessionCommitReadyBaseV2 & {
+} | (WalletRegistrationSessionCommitReadyBaseV2 & {
     readonly committed: WalletRegistrationEcdsaReadyCommitV2;
 }) | (WalletRegistrationSessionCommitReadyBaseV2 & {
     readonly committed: {
@@ -158,6 +153,7 @@ export type WalletRegistrationRouteErrorV2 = {
  * both methods.
  */
 type WalletRegistrationSetupSuccessBase = {
+    readonly home: WalletSessionHome;
     ok: true;
     registrationCeremonyId: string;
     walletId: string;
@@ -192,9 +188,9 @@ export type WalletRegistrationSetupResponseV2 = (WalletRegistrationSetupSuccessB
  * `ed25519` field: a mixed plan always carries its deferred NEAR work, and an
  * ECDSA-only plan has no arm to omit.
  *
- * The NEAR work is deferred, not pending-in-progress. The client starts it
- * asynchronously and must not await it: the wallet is usable on ECDSA alone,
- * and blocking registration on Yao is the coupling this refactor removes.
+ * Mixed wallets defer NEAR work because their ECDSA signer is already usable.
+ * NEAR-only wallets receive an admitted Yao session and complete it before
+ * finalization.
  */
 type WalletRegistrationRespondSignerPlanV2 = {
     kind: 'evm_family_ecdsa';
@@ -206,19 +202,14 @@ type WalletRegistrationRespondSignerPlanV2 = {
     /** Authority-bound admission, derived here because the proof now exists. */
     ed25519: RespondEd25519DeferredWorkV2;
 } | {
-    /**
-     * Ed25519-only: no ECDSA leg ran, so there is no proof bundle — `ecdsa`
-     * is `never`, not an empty object.
-     *
-     * The admission is deferred, exactly as on a mixed plan. Yao being the
-     * wallet's sole signer is not a reason to block on it: the client starts
-     * the computation and calls activate without awaiting it, and the wallet
-     * exists in `near_pending` until Yao produces its signer. There is
-     * deliberately no second, blocking Yao lifecycle.
-     */
+    /** The client completes Yao and recovery backup before committing this wallet. */
     kind: 'near_ed25519';
     ecdsa?: never;
-    ed25519: RespondEd25519DeferredWorkV2;
+    ed25519: {
+        readonly status: 'admitted';
+        readonly admissionRequest: RespondEd25519DeferredWorkV2['admissionRequest'];
+        readonly admissionReceipt: RouterAbEd25519YaoActivationAdmissionReceiptV1<'registration'>;
+    };
 };
 /** Exact A/B role bundles, unchanged from the derivation respond leg. */
 type RespondEcdsaProofBundles = {
@@ -253,32 +244,7 @@ type ActivateEcdsaTerminalPayload = EcdsaFinalizeSuccess['ecdsa'] & {
     activation: EcdsaActivationSuccess['ecdsa']['activation'];
     bootstrap: EcdsaActivationSuccess['ecdsa']['bootstrap'];
 };
-type Ed25519FinalizeSuccess = Extract<WalletRegistrationFinalizeSuccess, {
-    kind: 'near_ed25519';
-}>;
 type DistributiveOmit<T, K extends keyof any> = T extends unknown ? Omit<T, K> : never;
-/**
- * Activate's Ed25519-only terminal result: a wallet that exists and cannot
- * yet sign.
- *
- * Activate does not wait for Yao. It persists the wallet, profile, and
- * authentication state plus the `near_pending` provisioning record, and that
- * pending response is the committed terminal projection, and a retry
- * reconstructs that projection from the receipt. Every field that only
- * completed Yao can produce is `never`, so a caller cannot read a signer, a
- * resolved account, or a key identity that does not exist yet. The wallet
- * becomes signable when deferred Yao reaches `near_ready`.
- */
-export type WalletRegistrationActivateEd25519PendingV2 = DistributiveOmit<Ed25519FinalizeSuccess, 'ed25519' | 'resolvedAccount' | 'accountProvisioning' | 'authorityScope' | 'foundingAuthority' | 'foundingAuthMethod' | 'custodyKeyManifestDigestB64u'> & {
-    nearProvisioning: {
-        status: 'near_pending';
-    };
-    ed25519?: never;
-    resolvedAccount?: never;
-    accountProvisioning?: never;
-    authorityScope?: never;
-    ecdsa?: never;
-};
 export type WalletRegistrationActivateResponseV2 = (DistributiveOmit<EcdsaFinalizeSuccess, 'ecdsa'> & {
     ecdsa: ActivateEcdsaTerminalPayload;
     registrationEstablishedSession: RegistrationEstablishedSessionResultV2;
@@ -286,7 +252,7 @@ export type WalletRegistrationActivateResponseV2 = (DistributiveOmit<EcdsaFinali
     nearProvisioning?: {
         status: 'near_pending';
     };
-}) | WalletRegistrationActivateEd25519PendingV2 | WalletRegistrationRouteErrorV2;
+}) | WalletRegistrationRouteErrorV2;
 type ActivateSuccessV2 = Exclude<WalletRegistrationActivateResponseV2, WalletRegistrationRouteErrorV2>;
 export type WalletRegistrationActivateRouteResponseV2 = ActivateSuccessV2 | WalletRegistrationRouteErrorV2;
 type WalletRegistrationNearProvisioningFinalizeSuccessV2 = Extract<WalletRegistrationFinalizeSuccess, {

package/dist/types/wallet-server/src/hosted-wallet-gateway.d.ts

@@ -1,3 +1,4 @@
+import type { WalletRegistrationContextResolver } from './router/framework/apiCredentialPorts';
 import type { WalletLifecycleRoutingPublisher } from './authorization/lifecycleRouting';
 import { type D1DatabaseLike } from './cloud-host';
 import { type WalletConsoleServiceBinding } from './cloud-host';
@@ -78,8 +79,8 @@ export interface CloudflareD1GatewayEnv extends CloudflareD1GatewayBaseEnv {
     readonly WALLET_CONSOLE: WalletConsoleServiceBinding;
 }
 export interface HostedWalletGatewayDependenciesV1 {
+    readonly registrationContext?: WalletRegistrationContextResolver;
     readonly identityStore?: CloudflareD1RouterApiAuthServiceOptions['identityStore'];
-    readonly emailOtpRateLimitCounter?: CloudflareD1RouterApiAuthServiceOptions['emailOtpRateLimitCounter'];
     readonly googleRegistrationAttempts?: CloudflareD1RouterApiAuthServiceOptions['googleRegistrationAttempts'];
     readonly sessionRouting?: CloudflareD1RouterApiAuthServiceOptions['sessionRouting'];
     readonly lifecycleRouting?: WalletLifecycleRoutingPublisher;
@@ -102,12 +103,12 @@ export declare function createStagingEd25519YaoBackend(env: CloudflareD1GatewayB
  * stay on the Wallet Console deployment until policy/sponsorship resolution
  * operations join the binding.
  */
-export declare function createHostedWalletGatewayCompositionV1(env: CloudflareD1GatewayEnv, dependencies?: HostedWalletGatewayDependenciesV1): Promise<{
+export declare function createHostedWalletGatewayCompositionV1(env: CloudflareD1GatewayEnv, dependencies?: HostedWalletGatewayDependenciesV1, background?: CfExecutionContext | null): Promise<{
     handler: FetchHandler;
     service: import("./cloud-host").CloudflareD1RouterApiAuthService;
     session: import("./cloud-host").SessionAdapter;
 }>;
-export declare function createSplitGatewayRouterHandler(env: CloudflareD1GatewayEnv, dependencies?: HostedWalletGatewayDependenciesV1): Promise<FetchHandler>;
+export declare function createSplitGatewayRouterHandler(env: CloudflareD1GatewayEnv, dependencies?: HostedWalletGatewayDependenciesV1, background?: CfExecutionContext | null): Promise<FetchHandler>;
 export declare function handleSplitGatewayWalletRuntimeRequest(request: Request, env: CloudflareD1GatewayEnv & WalletControlRuntimeBindings, dependencies?: HostedWalletGatewayDependenciesV1): Promise<Response | null>;
 export declare function readWalletRuntimeIdentities(env: CloudflareD1GatewayEnv, input: WalletRuntimeWalletIdentityRequest): Promise<WalletRuntimeWalletIdentitiesResult>;
 export declare function handleSplitGatewayRequest(request: Request, env: CloudflareD1GatewayEnv, ctx: CfExecutionContext, dependencies?: HostedWalletGatewayDependenciesV1): Promise<Response>;

package/dist/types/wallet-server/src/localIntendedYaoSigningFault.d.ts

@@ -11,15 +11,8 @@ export declare const ROUTER_AB_ED25519_SIGNING_FINALIZE_PATH_V1 = "/router-ab/ed
  *   authorized but not yet made. The Gateway's answer is a refusal.
  * - `release_signing_finalize` sends a kept finalize to the Router again,
  *   exactly, and answers with the Router's reply.
- * - `arm_signing_worker_hold` asks the SigningWorker to hold the next NEAR
- *   finalize of the wallet the body names after it signs and before it
- *   commits, until its activation is retired: a finalize that loaded its
- *   material just before a recovery promoted. Dev builds of the Workers D1
- *   SigningWorker only; the wallet object and the VM SigningWorker sign and
- *   commit in one step.
- * - `read_signing_worker_hold` reads that hold's state.
  */
-type LocalIntendedYaoSigningFaultModeV1 = 'capture_signing_finalize' | 'withhold_signing_finalize' | 'release_signing_finalize' | 'arm_signing_worker_hold' | 'read_signing_worker_hold';
+type LocalIntendedYaoSigningFaultModeV1 = 'capture_signing_finalize' | 'withhold_signing_finalize' | 'release_signing_finalize';
 export declare function parseLocalIntendedYaoSigningFaultModeV1(value: string | null): LocalIntendedYaoSigningFaultModeV1 | null;
 export declare function parseLocalIntendedYaoSigningFaultTokenV1(value: string | null): string | null;
 /** The Gateway's Router binding, keeping the first NEAR finalize it carries. */
@@ -37,14 +30,6 @@ export declare class LocalIntendedYaoSigningFaultControllerV1 {
 export declare function releaseLocalIntendedYaoSigningFinalizeV1(router: {
     fetch(request: Request): Promise<Response>;
 }, token: string): Promise<Response>;
-/**
- * Arms or reads the SigningWorker's hold on one wallet's next NEAR finalize,
- * with the Gateway's own SigningWorker credential, and answers with the
- * SigningWorker's reply.
- */
-export declare function commandLocalIntendedSigningWorkerHoldV1(signingWorker: {
-    fetch(request: Request): Promise<Response>;
-}, credential: string | undefined, mode: 'arm_signing_worker_hold' | 'read_signing_worker_hold', body: unknown): Promise<Response>;
 export declare function requestWithoutLocalIntendedYaoSigningFaultHeadersV1(request: Request): Request;
 export declare function responseWithLocalIntendedYaoSigningFaultOutcomeV1(response: Response, outcome: string): Response;
 export {};

package/dist/types/wallet-server/src/localRegistrationSetupAuthority.d.ts

@@ -8,6 +8,6 @@ export declare class LocalRegistrationSetupAuthority implements WalletRegistrati
     constructor(database: D1DatabaseLike, scope: D1TenantScope);
     reserve(input: WalletRegistrationSetupInput): Promise<WalletRegistrationSetupReservationResult>;
     admitHome(input: Parameters<WalletRegistrationReservationAuthority['admitHome']>[0]): Promise<Awaited<ReturnType<WalletRegistrationReservationAuthority['admitHome']>>>;
-    complete(input: Parameters<WalletRegistrationReservationAuthority['complete']>[0]): Promise<Awaited<ReturnType<WalletRegistrationReservationAuthority['admitHome']>>>;
+    complete(input: Parameters<WalletRegistrationReservationAuthority['complete']>[0]): Promise<Awaited<ReturnType<WalletRegistrationReservationAuthority['complete']>>>;
 }
 //# sourceMappingURL=localRegistrationSetupAuthority.d.ts.map

package/dist/types/wallet-server/src/router/auth/commonRouterUtils.d.ts

@@ -1,5 +1,6 @@
-import type { D1EcdsaAdmissionPolicyRead } from '../cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore';
+import type { D1EcdsaAdmissionPolicyRead, D1Ed25519AdmissionPolicyRead } from '../cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore';
 import type { EcdsaMaterialRead } from '../../core/d1EcdsaSignerRead';
+import type { Ed25519SignerRead } from '../../core/d1Ed25519SignerRead';
 import type { ThresholdRuntimePolicyScope } from '../../core/types';
 import type { RouterApiAuthorizationSessionService } from '../framework/authServicePort';
 import type { RouterApiWalletSessionAuthorizationV2AdmissionContext, RouterApiWalletSessionExactOperationContext, RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext } from '../framework/authServicePort';
@@ -84,6 +85,9 @@ export type ThresholdEd25519SessionInputs = {
         readonly curve: 'ed25519';
     }>;
     readonly context: RouterApiWalletSessionAuthorizationV2AdmissionContext;
+    /** The session wallet's signer and policy rows, read in the session's statement. */
+    readonly signerRead: Ed25519SignerRead;
+    readonly policyRead: D1Ed25519AdmissionPolicyRead;
 } | AuthorizeErr;
 export declare function validateRouterAbEd25519WalletSessionInputs(input: {
     headers: Record<string, string | string[] | undefined>;
@@ -92,6 +96,8 @@ export declare function validateRouterAbEd25519WalletSessionInputs(input: {
     operationKind: Extract<WalletSessionAuthorizationV2RequestedOperation, {
         readonly keyFamily: 'ed25519';
     }>['operationKind'];
+    /** The material the request names; the session must admit exactly this activation. */
+    materialActivation: import('../../../../shared-ts/src/utils/routerAbNormalSigningIdentity').RouterAbMpcMaterialActivationRefWire;
 }): Promise<ThresholdEd25519SessionInputs>;
 export type ThresholdEcdsaSessionInputs = {
     readonly ok: true;

package/dist/types/wallet-server/src/router/auth/routerApiCredentialAuth.d.ts

@@ -1,18 +1,21 @@
-import { type RoutePolicyResolutionResult } from '../framework/enforceRoutePolicy';
+import { type RoutePolicyResolutionResult, type RoutePolicyResolutionFailure } from '../framework/enforceRoutePolicy';
 import type { RouterApiKeyAuthAdapter, RouterApiPublishableKeyAuthAdapter } from '../framework/routerApi';
+import type { RouterApiKeyPrincipal, WalletRegistrationContextResolver, WalletRegistrationContextResult } from '../framework/apiCredentialPorts';
 import type { HeaderRecord } from '../framework/routeExecutionContext';
 import type { RouteDefinition } from '../framework/routeDefinitions';
-interface ResolvePublishableKeyApiCredentialAuthInput {
+interface PublishableKeyRequestInput {
     environmentId?: string | null;
     headers: HeaderRecord;
     missingEnvironmentMessage: string;
     missingOriginMessage: string;
     missingPublishableKeyMessage: string;
     origin?: string;
-    publishableKeyAuth: RouterApiPublishableKeyAuthAdapter;
     route: RouteDefinition;
     routeAuthNotConfiguredMessage: string;
 }
+interface ResolvePublishableKeyApiCredentialAuthInput extends PublishableKeyRequestInput {
+    publishableKeyAuth: RouterApiPublishableKeyAuthAdapter;
+}
 interface ResolveSecretKeyApiCredentialAuthInput {
     apiKeyAuth?: RouterApiKeyAuthAdapter | null;
     headers: HeaderRecord;
@@ -20,7 +23,12 @@ interface ResolveSecretKeyApiCredentialAuthInput {
     sourceIp?: string;
     routeAuthNotConfiguredMessage: string;
 }
+export declare function resolveWalletRegistrationContext(input: PublishableKeyRequestInput & {
+    registrationContext: WalletRegistrationContextResolver;
+    registration: Parameters<WalletRegistrationContextResolver['resolve']>[0]['registration'];
+}): Promise<WalletRegistrationContextResult | RoutePolicyResolutionFailure>;
 export declare function resolvePublishableKeyApiCredentialAuth(input: ResolvePublishableKeyApiCredentialAuthInput): Promise<RoutePolicyResolutionResult>;
+export declare function publishableKeyRoutePrincipal(principal: RouterApiKeyPrincipal): Promise<RoutePolicyResolutionResult>;
 export declare function resolveSecretKeyApiCredentialAuth(input: ResolveSecretKeyApiCredentialAuthInput): Promise<RoutePolicyResolutionResult>;
 export {};
 //# sourceMappingURL=routerApiCredentialAuth.d.ts.map

package/dist/types/wallet-server/src/router/auth/walletRegistrationContext.d.ts

@@ -0,0 +1,8 @@
+import type { RouterApiKeyPrincipal, RouterApiProjectEnvironment, RouterApiProjectEnvironmentResolver, RouterApiPublishableKeyAuthAdapter, RouterApiPublishableKeyAuthRequest, WalletRegistrationContextResult } from '../framework/apiCredentialPorts';
+export declare function unavailableRegistrationContext(): WalletRegistrationContextResult;
+/** Join the authenticated credential to its exact active environment at the boundary. */
+export declare function walletRegistrationContext(input: RouterApiPublishableKeyAuthRequest, principal: RouterApiKeyPrincipal, environment: RouterApiProjectEnvironment): WalletRegistrationContextResult;
+export declare function createWalletRegistrationContextResolver(auth: RouterApiPublishableKeyAuthAdapter, environments: RouterApiProjectEnvironmentResolver): {
+    resolve: (input: RouterApiPublishableKeyAuthRequest) => Promise<WalletRegistrationContextResult>;
+};
+//# sourceMappingURL=walletRegistrationContext.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1AuthorizationAssembly.d.ts

@@ -12,7 +12,7 @@ export declare function createD1AuthorizationAssembly(options: D1AuthorizationSt
     authorizationStore: CloudflareD1AuthorizationStore;
     authorizationService: AuthorizationService;
 };
-export declare function createD1WalletCustodyStore(options: NormalizedCloudflareD1RouterApiAuthServiceOptions): CloudflareD1WalletCustodyCommitStore;
+export declare function createD1WalletCustodyStore(options: NormalizedCloudflareD1RouterApiAuthServiceOptions, walletAuthMethodStore: D1WalletAuthMethodStore): CloudflareD1WalletCustodyCommitStore;
 export declare function createD1WebAuthnAssembly(options: NormalizedCloudflareD1RouterApiAuthServiceOptions, walletAuthMethodStore: D1WalletAuthMethodStore, walletManifestSource: D1WebAuthnWalletManifestSource): {
     webAuthnStore: CloudflareD1WebAuthnStore;
     webAuthnAuthService: CloudflareD1WebAuthnAuthService;

package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1EmailOtpRouteService.d.ts

@@ -0,0 +1,16 @@
+import type { RouterApiServiceBag } from '../../../framework/authServicePort';
+import type { CloudflareD1EmailOtpServerSealRuntime } from '../emailOtp/d1EmailOtpServerSealRuntime';
+import type { CloudflareD1EmailOtpChallengeService } from '../emailOtp/d1EmailOtpChallengeService';
+import type { CloudflareD1EmailOtpRecoveryService } from '../emailOtp/d1EmailOtpRecoveryService';
+import type { CloudflareD1GoogleEmailOtpSessionResolver } from '../emailOtp/d1GoogleEmailOtpSessionResolver';
+import type { CloudflareD1OidcVerificationService } from '../oidc/d1OidcVerificationService';
+type D1EmailOtpRouteServiceAssembly = {
+    readonly emailOtpServerSeal: CloudflareD1EmailOtpServerSealRuntime;
+    readonly emailOtpChallengeService: CloudflareD1EmailOtpChallengeService;
+    readonly emailOtpRecoveryService: CloudflareD1EmailOtpRecoveryService;
+    readonly googleEmailOtpSessions: CloudflareD1GoogleEmailOtpSessionResolver;
+    readonly oidcVerification: CloudflareD1OidcVerificationService;
+};
+export declare function createD1EmailOtpRouteService(assembly: D1EmailOtpRouteServiceAssembly): RouterApiServiceBag['emailOtp'];
+export {};
+//# sourceMappingURL=d1EmailOtpRouteService.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1RouterApiAuthConfig.d.ts

@@ -2,14 +2,14 @@ import type { LinkedDeviceBootstrapStore } from '../../../../core/deviceLinking/
 import type { LinkedDeviceRequestProofNonceStoreV1 } from '../../../../core/deviceLinking/requestProof';
 import type { WebAuthnSyncChallengeStore } from '../../../../core/WebAuthnSyncChallengeStore';
 import type { PasskeyCredentialClaims } from '../../../../core/passkeyCredentialClaims';
-import type { EmailOtpRateLimitCounter } from '../emailOtp/d1EmailOtpRateLimitStore';
 import type { GoogleEmailOtpRegistrationAttemptStore } from '../emailOtp/d1GoogleEmailOtpRegistrationAttemptStore';
 import type { IdentityStore } from '../../../../core/IdentityStore';
 import type { WalletLifecycleRoutingPublisher } from '../../../../authorization/lifecycleRouting';
 import type { WalletRecoveryRoutingPublisher } from '../../../../authorization/recoveryRouting';
 import type { WalletSessionRoutingPublisher } from '../../../../authorization/sessionRouting';
 import type { WalletRegistrationSetupDispatcher } from '../../../framework/registrationSetupDispatch';
-import type { WalletRegistrationReservationAuthority } from '../../../domains/walletRegistration/walletRegistrationReservation';
+import type { RegistrationWalletStarter, WalletExecutionAuthority, WalletRegistrationReservationAuthority } from '../../../domains/walletRegistration/walletRegistrationReservation';
+import { D1WalletExecutionAuthority } from '../registration/d1WalletExecutionAuthority';
 import type { LinkedDevicePasskeyTargetConfigurationFieldsV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
 import type { WalletEmailOtpChannel } from '../../../../../../shared-ts/src/utils/emailOtpDomain';
 import type { EmailOtpChallengeAction, EmailOtpChallengeOperation } from '../../../../core/EmailOtpStores';
@@ -109,7 +109,6 @@ export type CloudflareD1GithubOAuthConfig = {
 };
 export interface CloudflareD1RouterApiAuthServiceOptions {
     readonly identityStore?: IdentityStore;
-    readonly emailOtpRateLimitCounter?: EmailOtpRateLimitCounter;
     readonly credentialClaims?: PasskeyCredentialClaims;
     readonly linkedDeviceBootstrap?: LinkedDeviceBootstrapStore;
     readonly linkedDeviceProofNonces?: LinkedDeviceRequestProofNonceStoreV1;
@@ -120,6 +119,7 @@ export interface CloudflareD1RouterApiAuthServiceOptions {
     readonly recoveryRouting?: WalletRecoveryRoutingPublisher;
     readonly registrationSetupDispatcher?: WalletRegistrationSetupDispatcher;
     readonly registrationAuthority?: WalletRegistrationReservationAuthority;
+    readonly startRegistrationWallets?: RegistrationWalletStarter;
     readonly database: D1DatabaseLike;
     readonly namespace: string;
     readonly orgId: string;
@@ -194,7 +194,10 @@ export type EmailOtpServerSealRuntimeConfig = {
     readonly configured: false;
     readonly message: string;
 };
-export type NormalizedCloudflareD1RouterApiAuthServiceOptions = Omit<CloudflareD1RouterApiAuthServiceOptions, 'relayerAccount' | 'relayerPublicKey' | 'relayerPrivateKey' | 'nearRpcUrl' | 'accountInitialBalance' | 'implicitNearAccountTestFundingEnabled' | 'googleOidcClientId' | 'emailOtpServerSeal' | 'emailOtpDeliveryMode' | 'emailOtpRuntimeProfile' | 'emailOtpDemoAllowedOrigins' | 'emailOtpDeliveryProvider' | 'emailOtpDevOutboxEnabled' | 'emailOtpProduction' | 'emailOtpChallengeTtlMs' | 'emailOtpGrantTtlMs' | 'emailOtpMaxAttempts' | 'emailOtpLockoutTtlMs' | 'emailOtpCodeLength' | 'emailOtpMaxActiveChallengesPerContext' | 'emailOtpChallengeRateLimitMax' | 'emailOtpChallengeRateLimitWindowMs' | 'emailOtpVerifyRateLimitMax' | 'emailOtpVerifyRateLimitWindowMs' | 'emailOtpGrantRateLimitMax' | 'emailOtpGrantRateLimitWindowMs' | 'emailOtpGoogleRegistrationAttemptRateLimitMax' | 'emailOtpGoogleRegistrationAttemptRateLimitWindowMs' | 'routerAbEcdsaPresignRuntime'> & {
+export type NormalizedCloudflareD1RouterApiAuthServiceOptions = Omit<CloudflareD1RouterApiAuthServiceOptions, 'registrationAuthority' | 'relayerAccount' | 'relayerPublicKey' | 'relayerPrivateKey' | 'nearRpcUrl' | 'accountInitialBalance' | 'implicitNearAccountTestFundingEnabled' | 'googleOidcClientId' | 'emailOtpServerSeal' | 'emailOtpDeliveryMode' | 'emailOtpRuntimeProfile' | 'emailOtpDemoAllowedOrigins' | 'emailOtpDeliveryProvider' | 'emailOtpDevOutboxEnabled' | 'emailOtpProduction' | 'emailOtpChallengeTtlMs' | 'emailOtpGrantTtlMs' | 'emailOtpMaxAttempts' | 'emailOtpLockoutTtlMs' | 'emailOtpCodeLength' | 'emailOtpMaxActiveChallengesPerContext' | 'emailOtpChallengeRateLimitMax' | 'emailOtpChallengeRateLimitWindowMs' | 'emailOtpVerifyRateLimitMax' | 'emailOtpVerifyRateLimitWindowMs' | 'emailOtpGrantRateLimitMax' | 'emailOtpGrantRateLimitWindowMs' | 'emailOtpGoogleRegistrationAttemptRateLimitMax' | 'emailOtpGoogleRegistrationAttemptRateLimitWindowMs' | 'routerAbEcdsaPresignRuntime'> & {
+    /** The host's registration authority, with this home's execution state around it. */
+    readonly registrationAuthority?: D1WalletExecutionAuthority;
+    readonly walletExecution: WalletExecutionAuthority;
     readonly relayerAccount?: string;
     readonly relayerPublicKey?: string;
     readonly relayerPrivateKey?: string;

package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1RouterApiAuthService.d.ts

@@ -1,9 +1,12 @@
+import type { WalletRelocationEmailOtpServices } from '../wallet/d1WalletRelocationEmailOtp';
 import { type ExecuteSignedDelegateRequest, type ExecuteSignedDelegateResult } from '../../../../delegateAction';
 import { type RouterApiServiceBag } from '../../../framework/authServicePort';
-import { type CloudflareD1RouterApiAuthServiceOptions } from './d1RouterApiAuthConfig';
+import { type CloudflareD1RouterApiAuthServiceOptions, type NormalizedCloudflareD1RouterApiAuthServiceOptions } from './d1RouterApiAuthConfig';
 import { D1LinkedDeviceAuthorityInstallServiceV1 } from '../deviceLinking/d1LinkedDeviceAuthorityInstallService';
 export type { CloudflareD1EmailOtpDeliveryProvider, CloudflareD1EmailOtpDeliveryProviderInput, CloudflareD1EmailOtpDeliveryProviderResult, CloudflareD1EmailOtpServerSealConfig, CloudflareD1LinkedDeviceAuthorityInstallationOptionsV1, CloudflareD1LinkedDeviceCompositionOptionsV1, CloudflareD1LinkedDeviceManagementOptionsV1, CloudflareD1LinkedDeviceSessionOptionsV1, CloudflareD1RouterApiAuthServiceOptions, } from './d1RouterApiAuthConfig';
 export type CloudflareD1RouterApiAuthService = Omit<RouterApiServiceBag, 'thresholdRuntime'> & {
+    readonly walletExecution: NormalizedCloudflareD1RouterApiAuthServiceOptions['walletExecution'];
+    readonly relocationEmailOtp: WalletRelocationEmailOtpServices;
     readonly thresholdRuntime: RouterApiServiceBag['thresholdRuntime'];
     readonly executeSignedDelegate: (input: ExecuteSignedDelegateRequest) => Promise<ExecuteSignedDelegateResult>;
     readonly linkedDeviceEd25519AuthorityReader?: LinkedDeviceEd25519AuthorityReader;

package/dist/types/wallet-server/src/router/cloudflare/d1/auth/walletSessionCredentialReaders.d.ts

@@ -1,8 +1,14 @@
 import type { AuthorizationService } from '../../../../authorization/service';
-import type { RouterApiWalletSessionAuthorizationV2AdmissionContext, RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext, RouterApiWalletSessionSigningCandidate } from '../../../framework/authServicePort';
+import type { RouterApiEd25519WalletSessionSigningRead, RouterApiWalletSessionAuthorizationV2AdmissionContext, RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext, RouterApiWalletSessionSigningCandidate } from '../../../framework/authServicePort';
 type CredentialInput = Parameters<AuthorizationService['readWalletSessionAdmissionSnapshotByOperationCredential']>[0];
 type AdmissionSnapshotReader = Pick<AuthorizationService, 'readWalletSessionAdmissionSnapshotByOperationCredential'>;
 export declare function readActiveWalletSessionCredential(service: AdmissionSnapshotReader, input: CredentialInput): Promise<RouterApiWalletSessionAuthorizationV2AdmissionContext | null>;
+/**
+ * The active session with its wallet's Ed25519 signer and policy rows. An
+ * exhausted session throws, as the plain credential read does: its caller
+ * resolves the exhausted candidate separately.
+ */
+export declare function readEd25519WalletSessionSigningRead(service: Pick<AuthorizationService, 'readEd25519WalletSessionAdmissionSnapshotByOperationCredential'>, input: Parameters<AuthorizationService['readEd25519WalletSessionAdmissionSnapshotByOperationCredential']>[0]): Promise<RouterApiEd25519WalletSessionSigningRead | null>;
 export declare function readWalletSessionSigningCandidate(service: Pick<AuthorizationService, 'readEcdsaWalletSessionAdmissionSnapshotByOperationCredential'>, input: Parameters<AuthorizationService['readEcdsaWalletSessionAdmissionSnapshotByOperationCredential']>[0]): Promise<RouterApiWalletSessionSigningCandidate | null>;
 export declare function readExhaustedWalletSessionCredential(service: Pick<AuthorizationService, 'readExactWalletSessionStatusSnapshotByOperationCredential'>, input: CredentialInput): Promise<RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext | null>;
 export {};

package/dist/types/wallet-server/src/router/cloudflare/d1/authorization/d1AuthorizationStore.d.ts

@@ -1,6 +1,8 @@
-import type { EcdsaWalletSessionAdmissionRead } from '../../../../authorization/service';
+import type { EcdsaWalletSessionAdmissionRead, Ed25519WalletSessionAdmissionRead, DirectWalletSessionCommitPurpose } from '../../../../authorization/service';
+import type { D1RegistrationCommitBatch } from '../registration/d1WalletRegistrationCommitStore';
 import type { RouterAbMpcMaterialActivationRefWire } from '../../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
 import type { EcdsaWalletSessionAdmissionInput, EcdsaWalletSessionAdmissionResult, EcdsaWalletSessionResolutionResult, PinnedOwnerWalletScope } from '../../../../authorization/ecdsaWalletSessionAdmission';
+import type { Ed25519WalletSessionAdmissionInput, Ed25519WalletSessionAdmissionResult, Ed25519WalletSessionResolutionInput, Ed25519WalletSessionResolutionResult } from '../../../../authorization/ed25519WalletSessionAdmission';
 import { type MpcMaterialActivationRef, type WalletAuthorityId, type WalletAuthMethodId, type WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
 import { type AuthorizedOperationId, type TenantId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
 import type { AuthorizedOperation, AuthorizedOperationInput, IssuedWalletSessionAuthorizationV2, LiveWalletSessionAuthorizationProjectionV2, WalletSessionAuthorizationV2, ActiveWalletSessionQuota, PersistedActiveWalletSessionAuthorizationV2, DirectV2CommitResult, WalletSessionAuthorizationV2MintLookup, WalletSessionAuthorizationV2MintRead, AuthorizedOperationReplayResponse, CompletedCapabilityOperationResult, IssuedHostedWalletSeamsSessionExchangeV2, RedeemHostedWalletSeamsSessionExchangeV2Input, PersistedHostedWalletSeamsSessionExchangeV2Result, ExactWalletSessionQuotaProjectionV1, ExactWalletSessionStatusV2, ExactWalletSessionStatusSnapshotV2, WalletSessionAdmissionSnapshotV2, WalletSessionExactOperationContext, ResolvedHostedWalletSessionOperationCredentialV2, VerifiedAuthorizationEvidenceSet, VerifiedOwnerProof } from '../../../../authorization/domain';
@@ -72,11 +74,19 @@ export declare class CloudflareD1AuthorizationStore implements AuthorizationSess
     commitDirectWalletSessionAuthorizationV2(input: {
         readonly persisted: PersistedActiveWalletSessionAuthorizationV2;
     }): Promise<DirectV2CommitResult>;
+    readWalletSessionIssuanceGeneration(walletId: WalletId): Promise<number>;
+    private prepareWalletSessionIssuanceGenerationRead;
     /** The service validates the committed winner against its caller-specific replay contract. */
     commitDirectReplayableWalletSessionAuthorizationV2(input: {
         readonly persisted: PersistedActiveWalletSessionAuthorizationV2;
+        readonly purpose: DirectWalletSessionCommitPurpose;
+    }): Promise<DirectV2CommitResult>;
+    commitRegistrationWalletSessionAuthorizationV2(commitWallet: (executeBatch: D1RegistrationCommitBatch) => Promise<void>, input: {
+        readonly persisted: PersistedActiveWalletSessionAuthorizationV2;
+        readonly purpose: DirectWalletSessionCommitPurpose;
     }): Promise<DirectV2CommitResult>;
     private commitDirectWalletSessionAuthorizationV2WithMode;
+    private prepareRegistrationSessionCompletion;
     /**
      * Builds the one batch used by direct issuance. Every predecessor mutation
      * is gated by the candidate identity check, so a same-mint replay leaves
@@ -99,6 +109,7 @@ export declare class CloudflareD1AuthorizationStore implements AuthorizationSess
         readonly promotionAtMs: number;
     }): readonly [D1PreparedStatementLike, D1PreparedStatementLike, D1PreparedStatementLike];
     readWalletSessionAuthorizationV2ByMint(input: WalletSessionAuthorizationV2MintLookup): Promise<WalletSessionAuthorizationV2MintRead | null>;
+    private prepareWalletSessionAuthorizationV2ByMintRead;
     readLiveWalletSessionAuthorizationProjectionV2(input: {
         readonly expected: WalletSessionAuthorizationV2;
         readonly nowMs: number;
@@ -142,6 +153,17 @@ export declare class CloudflareD1AuthorizationStore implements AuthorizationSess
         readonly nowMs: number;
         readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
     }): Promise<EcdsaWalletSessionAdmissionRead | null>;
+    /**
+     * The session with the Ed25519 signer and the policy rows its admission
+     * needs, in one statement. The signer and the policy are those of the
+     * session's own wallet, whatever wallet the request names.
+     */
+    readEd25519WalletSessionAdmissionSnapshotByOperationCredential(input: {
+        readonly tenantId: WalletSessionAuthorizationV2['tenantId'];
+        readonly tokenHash: import('../../../../../../shared-ts/src/utils/canonicalPrimitives').DigestB64u;
+        readonly nowMs: number;
+        readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
+    }): Promise<Ed25519WalletSessionAdmissionRead | null>;
     readWalletSessionExactOperationContextByCredential(input: {
         readonly tenantId: WalletSessionAuthorizationV2['tenantId'];
         readonly tokenHash: import('../../../../../../shared-ts/src/utils/canonicalPrimitives').DigestB64u;
@@ -203,7 +225,16 @@ export declare class CloudflareD1AuthorizationStore implements AuthorizationSess
         readonly material?: AuthorizedOperationMaterialScope;
     }): Promise<AuthorizedOperationAdmissionResult>;
     resolveEcdsaWalletSessionOperation(input: EcdsaWalletSessionAdmissionInput): Promise<EcdsaWalletSessionResolutionResult>;
+    /**
+     * The stored operation answers for itself: its own grant must still be
+     * active, as when a finalize request admitted it again.
+     */
+    resolveEd25519WalletSessionOperation(input: Ed25519WalletSessionResolutionInput): Promise<Ed25519WalletSessionResolutionResult>;
+    private pinExistingWalletSessionOperation;
     admitEcdsaWalletSessionOperation(input: EcdsaWalletSessionAdmissionInput): Promise<EcdsaWalletSessionAdmissionResult>;
+    admitEd25519WalletSessionOperation(input: Ed25519WalletSessionAdmissionInput): Promise<Ed25519WalletSessionAdmissionResult>;
+    /** A live operation's owner scope comes from the row its own admission read back. */
+    private pinWalletSessionAdmission;
     private admitAuthorizedOperationRecord;
     completeAuthorizedOperation(input: {
         readonly operation: AuthorizedOperation;

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService.d.ts

@@ -41,6 +41,7 @@ type WorkerOrdinarySignerMaterialReservationPreparationV1 = {
 /** The only worker authority mutation accepted by the linked-device cutover. */
 export type OrdinaryInactiveSignerMaterialActivationPortV1 = {
     activateOrdinaryInactiveSignerMaterialV1(input: {
+        readonly ownershipGeneration: number;
         readonly keyFamily: 'ed25519' | 'ecdsa_secp256k1';
         readonly reservationId: string;
         readonly materialActivation: MpcMaterialActivationRef;
@@ -199,6 +200,7 @@ export type InstalledLinkedDeviceEcdsaAuthorityProjectionV1 = {
     readonly activatedAtMs: number;
 };
 type ServerReservationRecordV1<F extends 'ed25519' | 'ecdsa_secp256k1'> = {
+    readonly ownershipGeneration: number;
     readonly reservationId: string;
     readonly preparation: Extract<WorkerOrdinarySignerMaterialReservationPreparationV1, {
         readonly keyFamily: F;