@seams/wallet-server 0.8.0 → 0.9.0

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationService.d.ts

@@ -1,5 +1,6 @@
+import type { WalletSessionHome } from '../../../../../../shared-ts/src/device-linking/contracts';
 import type { SponsoredNamedNearAccountInput } from '../near/d1SponsoredNearAccount';
-import { type DeviceId, type TenantId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
+import { type TenantId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
 import { type RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
 import type { DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
 import { type MpcMaterialActivationRef, type WalletAuthMethodId, type WalletAuthorityId } from '../../../../../../shared-ts/src/utils/domainIds';
@@ -13,6 +14,7 @@ import { type ThresholdEcdsaKeyInventoryDiagnostics, type ThresholdEcdsaKeyInven
 import type { EcdsaMaterialActivationReadInput } from '../../../../core/d1EcdsaSignerRead';
 import type { D1WalletStore } from '../../../../core/d1WalletStore';
 import type { EcdsaMaterialReadSnapshot } from '../../../../core/ecdsaMaterialReadSnapshot';
+import type { Ed25519SignerRead } from '../../../../core/d1Ed25519SignerRead';
 import { type StoredWalletRegistrationEvmFamilyEcdsaPendingActivationBranch } from '../../../../core/RegistrationCeremonyStore';
 import { WalletRegistrationEcdsaActivationResponse } from '../../../../core/registrationContracts';
 import type { WalletRegistrationActivateResponseV2, WalletRegistrationNearAdmissionResponseV2, WalletRegistrationNearProvisioningResponseV2, WalletRegistrationRespondResponseV2, WalletRegistrationSessionCommitReceiptV2, WalletRegistrationSetupResponseV2 } from '../../../../core/threeRouteRegistrationContracts';
@@ -26,7 +28,9 @@ import type { RouterAbEd25519YaoBudgetRefreshRequestV1, RouterAbEd25519YaoBudget
 import type { TenantRootCustodyLineageResolverV1 } from '../../../domains/tenantRoot/tenantRootCustodyLineage';
 import { type TenantRootIdentityV1 } from '../../../domains/tenantRoot/tenantRootIdentityResolution';
 import type { WalletRegistrationActivateInput, WalletRegistrationNearAdmissionInput, WalletRegistrationNearProvisioningInput, WalletRegistrationRespondInput, WalletRegistrationSetupInput } from '../../../domains/walletRegistration/walletRegistrationInputs';
-import type { WalletRegistrationReservationAuthority } from '../../../domains/walletRegistration/walletRegistrationReservation';
+import type { WalletExecutionAuthority, RegistrationWalletStarter, WalletRegistrationHomeAuthority } from '../../../domains/walletRegistration/walletRegistrationReservation';
+import type { D1WalletRegistrationRead } from './d1WalletRegistrationRead';
+import { type D1WalletRegistrationOperationPreparedV1 } from './d1WalletRegistrationPreparation';
 import type { InstalledEcdsaCustodySnapshotV1, InstalledLinkedDeviceEcdsaAuthorityProjectionV1, InstalledLinkedDeviceEd25519AuthorityProjectionV1 } from '../deviceLinking/d1LinkedDeviceAuthorityInstallService';
 import type { CloudflareD1Ed25519YaoLifecycleDecisionStoreV1 } from '../ed25519Yao/d1Ed25519YaoLifecycleDecisionStore';
 import { CloudflareD1EmailOtpRegistrationEnrollmentFinalizer } from '../emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer';
@@ -35,6 +39,7 @@ import type { CloudflareD1VersionedJsonRecordReadManyEntryV1 } from '../versione
 import { CloudflareD1WalletAuthMethodService } from '../wallet/d1WalletAuthMethodService';
 import { CloudflareD1RegistrationCeremonyIntentStore } from './d1RegistrationCeremonyStore';
 import type { D1WalletRegistrationCommitStore } from './d1WalletRegistrationCommitStore';
+import { type RegistrationSessionTransactionStore } from './d1WalletRegistrationInitialSession';
 type ActivateWalletRegistrationEcdsaInput = {
     readonly registrationCeremonyId: string;
     readonly ecdsa: {
@@ -65,12 +70,6 @@ type D1LinkedDeviceEd25519AuthorityReaderV1 = {
         readonly materialActivation: MpcMaterialActivationRef;
     }): Promise<InstalledEcdsaCustodySnapshotV1 | null>;
 };
-export type D1WalletRegistrationOperationPreparedV1 = {
-    readonly kind: 'd1_wallet_registration_operation_prepared_v1';
-    readonly walletAuthorityId: WalletAuthorityId;
-    readonly deviceId: DeviceId;
-    readonly walletAuthMethodId: WalletAuthMethodId;
-};
 /** The activate operation row stores one credential-free commit receipt. */
 export type D1WalletRegistrationActivateSideEffectRecord = RouterAbEd25519YaoRegistrationSideEffectRecordV2<WalletRegistrationSessionCommitReceiptV2, D1WalletRegistrationOperationPreparedV1>;
 export type D1WalletRegistrationActivateSideEffectStore = RouterAbEd25519YaoRegistrationSideEffectStoreV2<WalletRegistrationSessionCommitReceiptV2, D1WalletRegistrationOperationPreparedV1> & {
@@ -78,7 +77,6 @@ export type D1WalletRegistrationActivateSideEffectStore = RouterAbEd25519YaoRegi
         readonly limit?: number;
     }): Promise<readonly CloudflareD1VersionedJsonRecordReadManyEntryV1<D1WalletRegistrationActivateSideEffectRecord>[]>;
 };
-export type D1WalletRegistrationNearProvisioningSideEffectStore = RouterAbEd25519YaoRegistrationSideEffectStoreV2<WalletRegistrationSessionCommitReceiptV2, D1WalletRegistrationOperationPreparedV1>;
 export type D1WalletRegistrationNearProvisioningSideEffectRecord = RouterAbEd25519YaoRegistrationSideEffectRecordV2<WalletRegistrationSessionCommitReceiptV2, D1WalletRegistrationOperationPreparedV1>;
 type RegistrationCeremonyStoreProvider = () => CloudflareD1RegistrationCeremonyIntentStore;
 type WalletStoreProvider = () => D1WalletStore;
@@ -118,8 +116,10 @@ type EcdsaPostRegistrationProofInput = {
     readonly response: RouterAbEcdsaDerivationActivationRefreshForwardedResponseV1;
 };
 export declare class CloudflareD1WalletRegistrationService {
+    private readonly executionAuthority;
     private readonly registrationAuthority;
     private readonly authorizationService;
+    private readonly registrationSessionStore;
     private readonly authorizationTenantId;
     private readonly createSponsoredNamedNearAccount;
     private readonly emailOtpRegistrationEnrollmentFinalizer;
@@ -130,17 +130,23 @@ export declare class CloudflareD1WalletRegistrationService {
     private readonly getWalletStore;
     /** The single Gateway operation row for activate-with-finalize. */
     private readonly activateSideEffects;
-    /** Deferred NEAR provisioning's own operation row. */
-    private readonly nearProvisioningSideEffects;
+    /** Registration admission and state loaded in one database snapshot. */
+    private readonly registrationRead;
     private readonly walletRegistrationCommitStore;
     /** Where a ceremony's sealed custody seed and its recovery set land. */
     private readonly walletCustodyCommitStore;
     private readonly walletAuthMethods;
     private readonly getLinkedDeviceEd25519AuthorityReader;
     private readonly yaoLifecycleDecisions;
+    private readonly home;
+    private readonly startRegistrationWallets;
     constructor(input: {
-        readonly registrationAuthority: WalletRegistrationReservationAuthority | null;
+        readonly home: WalletSessionHome;
+        readonly executionAuthority: WalletExecutionAuthority;
+        readonly registrationAuthority: WalletRegistrationHomeAuthority | null;
+        readonly startRegistrationWallets: RegistrationWalletStarter | null;
         readonly authorizationService: AuthorizationService;
+        readonly registrationSessionStore: RegistrationSessionTransactionStore;
         readonly authorizationTenantId: TenantId;
         readonly createSponsoredNamedNearAccount: SponsoredNamedNearAccountCreator;
         readonly emailOtpRegistrationEnrollmentFinalizer: CloudflareD1EmailOtpRegistrationEnrollmentFinalizer;
@@ -150,7 +156,7 @@ export declare class CloudflareD1WalletRegistrationService {
         readonly tenantRootCustodyLineage: TenantRootCustodyLineageResolverV1;
         readonly getWalletStore: WalletStoreProvider;
         readonly activateSideEffects: D1WalletRegistrationActivateSideEffectStore;
-        readonly nearProvisioningSideEffects: D1WalletRegistrationNearProvisioningSideEffectStore;
+        readonly registrationRead: D1WalletRegistrationRead;
         readonly walletRegistrationCommitStore: D1WalletRegistrationCommitStore;
         readonly walletCustodyCommitStore: CloudflareD1WalletCustodyCommitStore;
         readonly walletAuthMethods: CloudflareD1WalletAuthMethodService;
@@ -160,6 +166,7 @@ export declare class CloudflareD1WalletRegistrationService {
     resolveEd25519MaterialActivation(input: {
         readonly walletId: string;
         readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
+        readonly signerRead?: Ed25519SignerRead;
     }): Promise<{
         readonly ok: true;
         readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
@@ -206,6 +213,7 @@ export declare class CloudflareD1WalletRegistrationService {
         readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
     }): Promise<{
         readonly ok: true;
+        readonly ownershipGeneration: number;
         readonly identityDigestB64u: string;
         readonly custodyLineageB64u: string;
         readonly projectEnvironmentId: string;
@@ -253,12 +261,6 @@ export declare class CloudflareD1WalletRegistrationService {
     setupWalletRegistration(input: WalletRegistrationSetupInput): Promise<WalletRegistrationSetupResponseV2>;
     authorizeWalletRegistrationNearAdmission(input: WalletRegistrationNearAdmissionInput): Promise<WalletRegistrationNearAdmissionResponseV2>;
     respondWalletRegistration(input: WalletRegistrationRespondInput, traceContext?: RouterAbTraceContextV1, timingSink?: Array<readonly [string, number]>): Promise<WalletRegistrationRespondResponseV2>;
-    /**
-     * The Ed25519 commit core, extracted so deferred provisioning reaches it
-     * without going through the standalone finalize wrapper. The operation row
-     * owns idempotency here, so the commit keeps no replay cache of its own.
-     */
-    private readRegistrationOwnerProofContext;
     /** For callers that must read the context before finalize tombstones it. */
     private registrationOwnerProofWithContext;
     authorizeNearRegistrationContinuation(input: {
@@ -267,37 +269,14 @@ export declare class CloudflareD1WalletRegistrationService {
     }): Promise<VerifiedNearRegistrationContinuationV1 | null>;
     private readNearRegistrationContinuationContext;
     private readCommittedRegistrationInstallation;
+    /** Carries the preparation's ceremony into this request's execution. */
     private prepareNearProvisioningOperation;
     private commitDeferredEd25519Signer;
     private replayWalletRegistrationActivateCommit;
     private replayWalletRegistrationNearProvisioningCommit;
-    /**
-     * Deferred NEAR provisioning. Verifies the signed setup, then reuses the
-     * existing deferred Ed25519 commit — the same path lazy-Yao 4+5 built — so
-     * signer installation and the implicit-account projection keep one
-     * implementation across both plans.
-     *
-     * A retryable failure leaves the pending wallet intact: the wallet must not
-     * be destroyed because its signer ceremony needs another attempt.
-     */
+    /** Verifies registration or continuation authority without destroying retryable state. */
     private verifyNearProvisioningAuthority;
-    completeWalletRegistrationNearProvisioning(input: WalletRegistrationNearProvisioningInput, timingSink?: Array<readonly [string, number]>): Promise<WalletRegistrationNearProvisioningResponseV2>;
-    /**
-     * Persists the Ed25519-only wallet in `near_pending`: wallet, profile, and
-     * authentication state, and no signer record — the signer does not exist
-     * until deferred Yao produces it.
-     *
-     * The terminal response carries no signer, resolved account, or key
-     * identity, because none of those are known yet. Reporting them would be
-     * fabricating readiness.
-     */
-    private commitEd25519PendingWallet;
-    /**
-     * Ed25519-only respond. The wallet's sole signer is Yao, and that is
-     * deliberately not a reason to block: the admission is returned as deferred
-     * work exactly as on a mixed plan, and the wallet lives in `near_pending`
-     * until the computation completes.
-     */
+    completeWalletRegistrationNearProvisioning(input: WalletRegistrationNearProvisioningInput, timingSink?: Array<readonly [string, number]>, waitUntil?: (promise: Promise<unknown>) => void): Promise<WalletRegistrationNearProvisioningResponseV2>;
     /**
      * Respond replay stays authority-bound.
      *

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationSetupExecution.d.ts

@@ -1,11 +1,16 @@
+import type { WalletSessionHome } from '../../../../../../shared-ts/src/device-linking/contracts';
 import type { WalletRegistrationSetupResponseV2 } from '../../../../core/threeRouteRegistrationContracts';
 import { type RouterAbEcdsaStrictRegistrationPort } from '../../../domains/ecdsa/routerAbEcdsaStrictRegistration';
 import type { WalletRegistrationSetupInput } from '../../../domains/walletRegistration/walletRegistrationInputs';
-import type { WalletRegistrationReservationAuthority } from '../../../domains/walletRegistration/walletRegistrationReservation';
+import type { RegistrationWalletStarter, WalletRegistrationReservationAuthority } from '../../../domains/walletRegistration/walletRegistrationReservation';
 import { CloudflareD1RegistrationCeremonyIntentStore } from './d1RegistrationCeremonyStore';
-export declare function executeD1WalletRegistrationSetup(input: WalletRegistrationSetupInput, dependencies: {
-    readonly reservation: WalletRegistrationReservationAuthority | null;
+type WalletRegistrationSetupDependencies = {
+    readonly home: WalletSessionHome;
+    readonly reservation: Pick<WalletRegistrationReservationAuthority, 'reserve'> | null;
     readonly store: CloudflareD1RegistrationCeremonyIntentStore;
     readonly ecdsaStrictRegistration: RouterAbEcdsaStrictRegistrationPort;
-}): Promise<WalletRegistrationSetupResponseV2>;
+    readonly startRegistrationWallets: RegistrationWalletStarter | null;
+};
+export declare function executeD1WalletRegistrationSetup(input: WalletRegistrationSetupInput, dependencies: WalletRegistrationSetupDependencies): Promise<WalletRegistrationSetupResponseV2>;
+export {};
 //# sourceMappingURL=d1WalletRegistrationSetupExecution.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/walletRegistrationEstablishedSessionIssuer.d.ts

@@ -1,11 +1,11 @@
+import type { RegistrationActivationWrite, WalletRegistrationHomeAuthority } from '../../../domains/walletRegistration/walletRegistrationReservation';
 import type { WalletRegistrationEd25519YaoPublicResult } from '../../../../core/registrationContracts';
 import type { WalletRegistrationFinalizeAuthMethod } from '../../../../../../shared-ts/src/utils/registrationContracts';
 import { type VerifiedOwnerProof } from '../../../../authorization/factorEvidence';
-import type { AuthorizationService } from '../../../../authorization/service';
-import type { LiveWalletSessionAuthorizationProjectionV2 } from '../../../../authorization/domain';
+import type { AuthorizationGrantPort, AuthorizationService } from '../../../../authorization/service';
+import type { DirectV2IssueResult, LiveWalletSessionAuthorizationProjectionV2 } from '../../../../authorization/domain';
 import type { EcdsaDerivationServerBootstrapResponse } from '../../../../core/types';
 import type { WalletRegistrationSessionCommitReceiptV2 } from '../../../../core/threeRouteRegistrationContracts';
-import type { StoredRegistrationAuthority } from '../../../../core/RegistrationCeremonyStore';
 import { type PrincipalId, type TenantId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
 import type { ActiveWalletAuthorityV1 } from '../../../../../../shared-ts/src/authorization/walletAuthority';
 import { type WalletAuthMethodId } from '../../../../../../shared-ts/src/utils/domainIds';
@@ -13,18 +13,40 @@ import { type WalletAuthAuthority } from '../../../../../../shared-ts/src/utils/
 import { type DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
 import type { RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
 import type { RegistrationEstablishedSessionProjectionTokensV2, RegistrationEstablishedSessionProjectionV2, RegistrationEstablishedSessionResultV2, RegistrationEstablishedSessionV2 } from '../../../../../../shared-ts/src/utils/registrationEstablishedSession';
-type RegistrationEstablishedSessionIssuerAuthorizationService = Pick<AuthorizationService, 'issueDirectWalletSessionAuthorizationV2' | 'issueDirectRegistrationPromotedWalletSessionAuthorizationV2' | 'readWalletSessionAuthorizationV2ByMint' | 'readWalletSessionAuthorizationV2ByAuthorizationId' | 'refreshWalletSessionAuthorizationV2AuthorityProjection'>;
-type RegistrationEstablishedSessionIssuerWalletAuthMethodReader = {
-    readonly readActiveRegistrationAuthority: (authority: StoredRegistrationAuthority) => Promise<{
-        readonly authority: ActiveWalletAuthorityV1;
-        readonly walletAuthMethodId: WalletAuthMethodId;
-    } | null>;
-};
+type RegistrationEstablishedSessionIssuerAuthorizationService = Pick<AuthorizationService, 'commitDirectWalletSessionAuthorizationV2' | 'readWalletSessionAuthorizationV2ByMint' | 'readWalletSessionAuthorizationV2ByAuthorizationId' | 'refreshWalletSessionAuthorizationV2AuthorityProjection'>;
 type RegistrationEstablishedSessionIssuanceDependencies = {
     readonly authorizationService: RegistrationEstablishedSessionIssuerAuthorizationService;
     readonly authorizationTenantId: TenantId;
-    readonly walletAuthMethods: RegistrationEstablishedSessionIssuerWalletAuthMethodReader;
+    readonly foundingAuthority: ActiveWalletAuthorityV1;
+    readonly homeCompletion: Pick<WalletRegistrationHomeAuthority, 'publishEstablished'>;
+};
+export type RegistrationInitialSessionCommit = {
+    readonly kind: 'uncommitted';
+    readonly value?: never;
+} | {
+    readonly kind: 'committed';
+    readonly value: Awaited<ReturnType<AuthorizationService['commitDirectWalletSessionAuthorizationV2']>>;
 };
+type InitialEd25519RegistrationSessionInput = {
+    readonly authorizationService: RegistrationEstablishedSessionIssuerAuthorizationService;
+    readonly authorizationTenantId: TenantId;
+    readonly foundingAuthority: ActiveWalletAuthorityV1;
+    readonly registrationCeremonyId: string;
+    readonly authority: WalletAuthAuthority;
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly expiresAtMs: number;
+    readonly remainingUses: number;
+    readonly proof: Extract<VerifiedOwnerProof, {
+        readonly purpose: 'wallet_session';
+    }>;
+};
+export declare function commitInitialEd25519RegistrationSession(input: InitialEd25519RegistrationSessionInput, commitSession?: AuthorizationGrantPort['commitDirectReplayableWalletSessionAuthorizationV2']): Promise<{
+    readonly result: DirectV2IssueResult;
+    readonly publication: import("../../../../cloud-host").WalletSessionLocatorPublication & {
+        readonly kind: "credential";
+    };
+    readonly registration: import("../../../..").DirectV2CommitResult["registration"];
+}>;
 export declare function walletSessionPrincipalId(authority: WalletAuthAuthority): PrincipalId;
 export declare function buildRegistrationOwnerProof(input: {
     readonly registrationCeremonyId: string;
@@ -36,7 +58,7 @@ export declare function buildRegistrationOwnerProof(input: {
 }): Promise<Extract<VerifiedOwnerProof, {
     readonly purpose: 'wallet_session';
 }>>;
-export type RegistrationEstablishedSessionIssuanceResultV2 = {
+export type RegistrationEstablishedSessionIssuanceResultV2 = ({
     readonly kind: 'issued';
     readonly session: RegistrationEstablishedSessionV2;
     readonly issuedAtMs: number;
@@ -45,6 +67,12 @@ export type RegistrationEstablishedSessionIssuanceResultV2 = {
     readonly session: RegistrationEstablishedSessionProjectionV2;
     readonly next: 'unlock_exact_method';
     readonly issuedAtMs: number;
+}) & {
+    /**
+     * The home's activation, which the caller commits with the record that
+     * completes its operation. None when the home is already active.
+     */
+    readonly activation: RegistrationActivationWrite | null;
 };
 export type Ed25519RegistrationSessionPredecessor = {
     readonly kind: 'ed25519_only';
@@ -73,7 +101,6 @@ export declare function assertDirectWalletSessionOwnerProof(input: {
 export declare function issueDirectRegistrationEstablishedEcdsaSession(input: RegistrationEstablishedSessionIssuanceDependencies & {
     readonly registrationCeremonyId: string;
     readonly authority: WalletAuthAuthority;
-    readonly registrationAuthority: StoredRegistrationAuthority;
     readonly walletAuthMethodId: WalletAuthMethodId;
     readonly expiresAtMs: number;
     readonly remainingUses: number;
@@ -87,16 +114,17 @@ export declare function issueDirectRegistrationEstablishedEcdsaSession(input: Re
 export declare function issueDirectRegistrationEstablishedEd25519Session(input: RegistrationEstablishedSessionIssuanceDependencies & {
     readonly registrationCeremonyId: string;
     readonly authority: WalletAuthAuthority;
-    readonly registrationAuthority: StoredRegistrationAuthority;
     readonly walletAuthMethodId: WalletAuthMethodId;
     readonly expiresAtMs: number;
     readonly remainingUses: number;
     readonly publicResult: WalletRegistrationEd25519YaoPublicResult;
     readonly predecessor: Ed25519RegistrationSessionPredecessor;
+    readonly initialSession: RegistrationInitialSessionCommit;
     readonly keyManifestDigestB64u: DigestB64u;
     readonly proof: Extract<VerifiedOwnerProof, {
         readonly purpose: 'wallet_session';
     }>;
+    readonly onSessionCommitted?: (session: RegistrationEstablishedSessionProjectionV2) => Promise<void>;
 }): Promise<RegistrationEstablishedSessionIssuanceResultV2>;
 export declare function projectCurrentNearRegistrationSession(authorization: LiveWalletSessionAuthorizationProjectionV2, tokens: Extract<RegistrationEstablishedSessionProjectionTokensV2, {
     readonly kind: 'near_ed25519_and_evm_family_ecdsa';

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/walletRegistrationSessionCommitReceipt.d.ts

@@ -1,5 +1,6 @@
 import type { WalletRegistrationFinalizeResponse, WalletRegistrationFinalizeSuccess } from '../../../../core/registrationContracts';
 import type { WalletRegistrationFinalizeAuthMethod } from '../../../../../../shared-ts/src/utils/registrationContracts';
+import type { RegistrationActivationWrite } from '../../../domains/walletRegistration/walletRegistrationReservation';
 import type { WalletRegistrationActivateResponseV2, WalletRegistrationCommittedInstallationProjectionV1, WalletRegistrationSessionCommitReceiptV2 } from '../../../../core/threeRouteRegistrationContracts';
 import type { RegistrationEstablishedSessionResultV2 } from '../../../../../../shared-ts/src/utils/registrationEstablishedSession';
 import { type WalletSessionMintId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
@@ -14,23 +15,23 @@ export type RegistrationCommitExecution<T> = {
 } | {
     readonly kind: 'replayed';
     readonly response: T;
-} | {
-    readonly kind: 'near_pending';
-    readonly response: T;
-    readonly expectedOrigin: string;
 } | {
     readonly kind: 'session_issued';
     readonly response: T;
     readonly issuedAtMs: number;
     readonly expectedOrigin: string;
+    readonly activation: RegistrationActivationWrite | null;
     readonly installationProjection?: never;
 } | {
     readonly kind: 'session_issued_with_installation_projection';
     readonly response: T;
     readonly issuedAtMs: number;
     readonly expectedOrigin: string;
+    readonly activation: RegistrationActivationWrite | null;
     readonly installationProjection: WalletRegistrationCommittedInstallationProjectionV1;
 };
+/** The home activation that a commit left for the record that completes its operation. */
+export declare function registrationCommitActivation<T>(execution: RegistrationCommitExecution<T>): RegistrationActivationWrite | null;
 export declare function unissuedRegistrationCommit<T>(response: T): RegistrationCommitExecution<T>;
 export declare function replayedRegistrationCommit<T>(response: T): RegistrationCommitExecution<T>;
 export declare function projectWalletRegistrationSessionCommitReceiptV2(input: {

package/dist/types/wallet-server/src/router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.d.ts

@@ -33,5 +33,28 @@ export declare class D1EcdsaAdmissionPolicyRead {
         readonly curve: 'ecdsa';
     }): RouterAbNormalSigningPolicyDecision | null;
 }
-export declare const ECDSA_CREDENTIAL_POLICY_PROJECTION = "\n  (WITH candidates AS (\n     SELECT DISTINCT json_extract(signer.record_json, '$.runtimePolicyScope') AS scope_json\n       FROM wallet_signers AS signer\n      WHERE signer.namespace = session.namespace AND signer.org_id = session.org_id\n        AND signer.project_id = session.project_id AND signer.env_id = session.env_id\n        AND signer.wallet_id = session.wallet_id AND signer.signer_family = 'ecdsa'\n        AND json_valid(signer.record_json)\n   ), scopes AS (\n     SELECT scope_json,\n            json_extract(scope_json, '$.orgId') AS org_id,\n            json_extract(scope_json, '$.projectId') AS project_id,\n            json_extract(scope_json, '$.envId') AS env_id,\n            json_extract(scope_json, '$.signingRootVersion') AS signing_root_version,\n            json_extract(scope_json, '$.orgId') || char(31) ||\n            json_extract(scope_json, '$.projectId') || char(31) ||\n            json_extract(scope_json, '$.envId') || char(31) ||\n            json_extract(scope_json, '$.signingRootVersion') AS project_key\n       FROM candidates\n   )\n   SELECT json_group_array(json_object(\n     'scope_json', scopes.scope_json,\n     'project_key', project.record_key, 'project_decision', project.decision,\n     'project_retry_after_ms', project.retry_after_ms,\n     'abuse_key', abuse.record_key, 'abuse_decision', abuse.decision,\n     'abuse_retry_after_ms', abuse.retry_after_ms))\n     FROM scopes\n     LEFT JOIN router_ab_normal_signing_admission_records AS project\n       ON project.namespace = session.namespace AND project.org_id = scopes.org_id\n      AND project.project_id = scopes.project_id AND project.env_id = scopes.env_id\n      AND project.signing_root_version = scopes.signing_root_version\n      AND project.record_kind = 'project_policy' AND project.record_key = scopes.project_key\n     LEFT JOIN router_ab_normal_signing_admission_records AS abuse\n       ON abuse.namespace = session.namespace AND abuse.org_id = scopes.org_id\n      AND abuse.project_id = scopes.project_id AND abuse.env_id = scopes.env_id\n      AND abuse.signing_root_version = scopes.signing_root_version\n      AND abuse.record_kind = 'abuse'\n      AND abuse.record_key = scopes.project_key || char(31) || session.wallet_id || char(31) ||\n          'material_activation:' || ? || char(31) || 'ecdsa'\n  ) AS ecdsa_policy_records_json,";
+/** Policy rows read with an Ed25519 Wallet Session, for the scopes of its signer. */
+export declare class D1Ed25519AdmissionPolicyRead {
+    #private;
+    private readonly database;
+    private readonly namespace;
+    private readonly walletId;
+    private readonly authorityId;
+    private constructor();
+    static fromRows(database: D1DatabaseLike, namespace: string, walletId: string, authorityId: string, rows: unknown): D1Ed25519AdmissionPolicyRead;
+    /**
+     * Null sends the caller to the database: another store, or a scope this read
+     * did not select. Linked-device material has no signer row to select from.
+     */
+    resolve(database: D1DatabaseLike, namespace: string, input: Ed25519WalletAuthorityAdmissionInput): RouterAbNormalSigningPolicyDecision | null;
+}
+type Ed25519WalletAuthorityAdmissionInput = Extract<RouterAbNormalSigningAdmissionInput, {
+    readonly curve: 'ed25519';
+    readonly authorityKind: 'wallet_authority_v1';
+}>;
+/** Binds the material activation id. */
+export declare const ECDSA_CREDENTIAL_POLICY_PROJECTION: string;
+/** Binds the signer scope (namespace, organization, project, environment) and the activation id. */
+export declare const ED25519_CREDENTIAL_POLICY_PROJECTION: string;
+export {};
 //# sourceMappingURL=d1RouterAbNormalSigningAdmissionStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/versionedJson/d1VersionedJsonRecordStore.d.ts

@@ -1,4 +1,4 @@
-import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import type { D1DatabaseLike, D1PreparedStatementLike, D1ResultLike } from '../../../../storage/tenantRoute';
 import type { VersionedJsonObject, VersionedJsonRecordPutResult, VersionedJsonRecordReadResult } from '../../../framework/versionedJsonRecordStore';
 export type CloudflareD1VersionedJsonRecordScopeV1 = {
     readonly namespace: string;
@@ -32,6 +32,10 @@ export type CloudflareD1VersionedJsonRecordBatchPutResultV1 = {
     readonly kind: 'version_mismatch';
     readonly key: string;
 };
+type StoredRecord = {
+    readonly version?: unknown;
+    readonly record_json?: unknown;
+};
 export declare class CloudflareD1VersionedJsonRecordStoreError extends Error {
     readonly code: 'invalid_record' | 'invalid_response' | 'request_failed';
     constructor(code: 'invalid_record' | 'invalid_response' | 'request_failed', message: string);
@@ -66,7 +70,8 @@ export declare class CloudflareD1VersionedJsonRecordStore<T> {
         readonly limit?: number;
     }): Promise<readonly CloudflareD1VersionedJsonRecordReadManyEntryV1<T>[]>;
     readMany(keys: readonly string[]): Promise<readonly CloudflareD1VersionedJsonRecordReadManyEntryV1<T>[]>;
-    private parseReadResult;
+    prepareRead(key: string): D1PreparedStatementLike;
+    parseReadResult(result: D1ResultLike<StoredRecord> | undefined): VersionedJsonRecordReadResult<T>;
     put(key: string, value: T, expectedVersion: string | null): Promise<VersionedJsonRecordPutResult>;
     /**
      * Applies multiple records in one D1 transaction. The guard statement turns
@@ -80,7 +85,7 @@ export declare class CloudflareD1VersionedJsonRecordStore<T> {
      * commit spans this JSON store and a normalized table (for example, a
      * recovery envelope plus its WebAuthn authenticator and binding).
      */
-    putManyWithAdditionalStatements(mutations: readonly CloudflareD1VersionedJsonRecordMutationV1<T>[], additionalStatements: readonly D1PreparedStatementLike[]): Promise<CloudflareD1VersionedJsonRecordBatchPutResultV1>;
+    putManyWithAdditionalStatements(mutations: readonly CloudflareD1VersionedJsonRecordMutationV1<T>[], additionalStatements: readonly D1PreparedStatementLike[], executeBatch?: (statements: readonly D1PreparedStatementLike[]) => Promise<readonly D1ResultLike[]>): Promise<CloudflareD1VersionedJsonRecordBatchPutResultV1>;
     /**
      * The same mutation + CAS-guard statements `putManyWithAdditionalStatements`
      * would run, returned instead of executed, so a caller whose transaction is
@@ -96,7 +101,8 @@ export declare class CloudflareD1VersionedJsonRecordStore<T> {
     private findBatchConflict;
     private insert;
     private update;
-    private storageKey;
+    storageKey(key: string): string;
 }
 export declare function createCloudflareD1VersionedJsonRecordStore<T>(options: CloudflareD1VersionedJsonRecordStoreOptions<T>): CloudflareD1VersionedJsonRecordStore<T>;
+export {};
 //# sourceMappingURL=d1VersionedJsonRecordStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/authorizationSnapshotLayout.d.ts

@@ -0,0 +1,21 @@
+import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
+declare const TABLES: readonly ["wallet_email_otp_rate_limits", "email_otp_wallet_enrollments", "email_otp_auth_states", "wallets", "wallet_signers", "wallet_recovery_code_locators", "wallet_authorities", "wallet_auth_methods", "wallet_relocation_approvals", "webauthn_credential_bindings", "webauthn_authenticators", "router_ab_yao_versioned_json_records", "authorization_wallet_session_quotas", "wallet_session_authorizations_v2", "wallet_session_hosted_credentials_v2", "wallet_session_hosted_exchange_codes_v2", "verified_wallet_operation_evidence_sets", "authorized_operations", "authorized_operation_audit_events", "linked_device_sessions", "linked_device_authority_allocations", "linked_device_authority_installations", "linked_device_target_credentials", "linked_device_target_commit_reservations", "linked_device_session_transcripts", "linked_device_ed25519_export_root_transfers", "linked_device_email_otp_grants", "linked_device_request_proof_nonces", "linked_device_bootstrap_imports", "linked_device_wallet_session_credential_deliveries_v1"];
+type Table = (typeof TABLES)[number];
+export declare class AuthorizationSnapshotLayout {
+    #private;
+    readonly table: Table;
+    readonly columns: readonly string[];
+    readonly keyColumns: readonly string[];
+    private constructor();
+    static read(database: D1DatabaseLike): Promise<readonly AuthorizationSnapshotLayout[]>;
+    static parse(raw: unknown): readonly AuthorizationSnapshotLayout[];
+    expressions(): {
+        readonly key: string;
+        readonly record: string;
+        readonly ownership: string;
+    };
+    snapshotSelection(): string;
+    static ownership(table: Table): string;
+}
+export {};
+//# sourceMappingURL=authorizationSnapshotLayout.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAddSignerService.d.ts

@@ -1,3 +1,4 @@
+import type { WalletExecutionAuthority } from '../../../domains/walletRegistration/walletRegistrationReservation';
 import { type D1WalletAddSignerFinalizeSideEffectStore } from './d1WalletAddSignerFinalizeRecord';
 import type { WalletAddSignerStartSuccess } from '../../../../core/registrationContracts';
 import type { CloudflareD1Ed25519YaoLifecycleDecisionStoreV1 } from '../ed25519Yao/d1Ed25519YaoLifecycleDecisionStore';
@@ -59,6 +60,7 @@ export type D1WalletAddSignerStartSideEffectStore = RouterAbEd25519YaoRegistrati
 export type D1WalletAddSignerStartSideEffectRecord = RouterAbEd25519YaoRegistrationSideEffectRecordV1<D1WalletAddSignerStartTerminalV1, D1WalletAddSignerStartPreparedV1>;
 export declare function parseD1WalletAddSignerStartSideEffectRecord(raw: unknown): D1WalletAddSignerStartSideEffectRecord | null;
 export declare class CloudflareD1WalletAddSignerService {
+    private readonly executionAuthority;
     private readonly getRegistrationCeremonyIntentStore;
     private readonly getEd25519YaoProductRegistration;
     private readonly ecdsaStrictRegistration;
@@ -70,6 +72,7 @@ export declare class CloudflareD1WalletAddSignerService {
     private readonly finalizeSideEffects;
     private readonly yaoLifecycleDecisions;
     constructor(input: {
+        readonly executionAuthority: WalletExecutionAuthority;
         readonly getRegistrationCeremonyIntentStore: RegistrationCeremonyStoreProvider;
         readonly getEd25519YaoProductRegistration: Ed25519YaoProductRegistrationProvider;
         readonly ecdsaStrictRegistration: RouterAbEcdsaStrictRegistrationPort;

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthMethodService.d.ts

@@ -1,6 +1,6 @@
 import { type WebAuthnCredentialIdB64u, type WebAuthnRpId, type WalletAuthMethodId, type WalletAuthorityId } from '../../../../../../shared-ts/src/utils/domainIds';
 import { type AddAuthMethodIntentGrant, type AddAuthMethodIntentV1, type AddSignerIntentV1, type RegistrationIntentV1, type WalletId } from '../../../../../../shared-ts/src/utils/registrationIntent';
-import { type ActivePasskeyWalletAuthMethodRecordV2, type ActiveWalletAuthMethodRecordV2, type WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
+import { type ActivePasskeyWalletAuthMethodRecordV2, type ActiveWalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
 import { type RegistrationAuthority } from '../../../../../../shared-ts/src/utils/registrationAuthMethodInput';
 import { type EmailOtpWalletAuthAuthority, type PasskeyWalletAuthAuthority, type WalletAuthAuthorityRef } from '../../../../../../shared-ts/src/utils/walletAuthAuthority';
 import type { D1PreparedStatementLike } from '../../../../storage/tenantRoute';
@@ -332,15 +332,11 @@ export declare class CloudflareD1WalletAuthMethodService {
      * Ed25519 leg arrives, so that leg must address the same rows.
      */
     readActiveRegistrationIdentity(authority: RegistrationAuthority): Promise<{
-        readonly walletAuthorityId: WalletAuthMethodRecordV2['walletAuthorityId'];
-        readonly walletAuthMethodId: WalletAuthMethodRecordV2['walletAuthMethodId'];
+        readonly walletAuthorityId: WalletAuthorityId;
+        readonly walletAuthMethodId: WalletAuthMethodId;
         readonly authority: ActiveWalletAuthorityV1;
         readonly authMethod: ActiveWalletAuthMethodRecordV2;
     } | null>;
-    readActiveRegistrationAuthority(authority: RegistrationAuthority): Promise<{
-        readonly authority: ActiveWalletAuthorityV1;
-        readonly walletAuthMethodId: WalletAuthMethodId;
-    } | null>;
     /**
      * Verifies a revocation's source proof: bound to this operation, and from a
      * different active method on an active full-owner authority. An Email OTP

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthorityStore.d.ts

@@ -2,6 +2,7 @@ import { type ActiveWalletAuthorityV1, type PendingWalletAuthorityV1, type Walle
 import { type DeviceId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
 import { type WalletAuthorityId, type WalletAuthMethodId, type WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
 import { type ActiveWalletAuthMethodRecordV2, type RevokedWalletAuthMethodRecordV2, type WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
+import type { RegistrationAuthority } from '../../../../../../shared-ts/src/utils/registrationAuthMethodInput';
 import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
 import { type WalletSignerRecord } from '../../../../core/d1WalletStore';
 export type D1WalletAuthorityStoreScope = {
@@ -123,6 +124,13 @@ export declare class D1WalletAuthorityStore {
         readonly promotionAtMs: number;
     }): Promise<void>;
     readById(authorityId: WalletAuthorityId): Promise<WalletAuthorityV1 | null>;
+    /** Reads the method and its authority from one database snapshot. */
+    readActiveRegistrationIdentity(expected: RegistrationAuthority): Promise<{
+        readonly walletAuthorityId: WalletAuthorityId;
+        readonly walletAuthMethodId: WalletAuthMethodId;
+        readonly authority: ActiveWalletAuthorityV1;
+        readonly authMethod: ActiveWalletAuthMethodRecordV2;
+    } | null>;
     readByWalletAndDevice(input: {
         readonly walletId: WalletId;
         readonly deviceId: DeviceId;

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthorizationCleanup.d.ts

@@ -0,0 +1,20 @@
+import { type D1TenantScope } from '../../../../core/d1TenantStore';
+import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
+import { WalletRelocationSessionSource } from './d1WalletRelocationSessions';
+type CleanupProgress = {
+    readonly state: 'cleaning';
+    readonly completedAtMs?: never;
+} | {
+    readonly state: 'cleaned';
+    readonly completedAtMs: number;
+};
+export declare class D1WalletAuthorizationCleanup {
+    private readonly database;
+    private readonly scope;
+    constructor(database: D1DatabaseLike, scope: D1TenantScope);
+    advance(source: WalletRelocationSessionSource, rawManifest: unknown, commandDigest: string, nowMs: number): Promise<CleanupProgress>;
+    private manifest;
+    private read;
+}
+export {};
+//# sourceMappingURL=d1WalletAuthorizationCleanup.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthorizationFreeze.d.ts

@@ -0,0 +1,12 @@
+import { type D1TenantScope } from '../../../../core/d1TenantStore';
+import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import { WalletRelocationSessionSource } from './d1WalletRelocationSessions';
+export declare class D1WalletAuthorizationFreeze {
+    private readonly database;
+    private readonly scope;
+    constructor(database: D1DatabaseLike, scope: D1TenantScope);
+    freeze(source: WalletRelocationSessionSource, nowMs: number): Promise<number>;
+    freezeStatements(source: WalletRelocationSessionSource, nowMs: number): readonly D1PreparedStatementLike[];
+    private read;
+}
+//# sourceMappingURL=d1WalletAuthorizationFreeze.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthorizationHistory.d.ts

@@ -0,0 +1,20 @@
+import { type D1TenantScope } from '../../../../core/d1TenantStore';
+import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import { AuthorizationSnapshotLayout } from './authorizationSnapshotLayout';
+import { WalletRelocationSessionSource } from './d1WalletRelocationSessions';
+export declare class D1WalletAuthorizationHistory {
+    private readonly database;
+    private readonly scope;
+    constructor(database: D1DatabaseLike, scope: D1TenantScope);
+    prepare(source: WalletRelocationSessionSource): Promise<void>;
+    restoreSnapshot(source: WalletRelocationSessionSource, records: readonly {
+        readonly table: AuthorizationSnapshotLayout;
+        readonly recordKey: string;
+        readonly recordJson: string;
+    }[], completion: readonly D1PreparedStatementLike[]): Promise<void>;
+    private restoreStatements;
+    private closeStatements;
+    private readImport;
+    private validateRow;
+}
+//# sourceMappingURL=d1WalletAuthorizationHistory.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthorizationIntake.d.ts

@@ -0,0 +1,29 @@
+import { type D1TenantScope } from '../../../../core/d1TenantStore';
+import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
+import { WalletRelocationSessionSource } from './d1WalletRelocationSessions';
+type IntakeProgress = {
+    readonly state: 'receiving';
+    readonly nextIndex: number;
+    readonly chunkCount: number;
+    readonly digestHex?: never;
+} | {
+    readonly state: 'verified';
+    readonly digestHex: string;
+    readonly nextIndex?: never;
+    readonly chunkCount?: never;
+};
+export declare class D1WalletAuthorizationIntake {
+    private readonly database;
+    private readonly scope;
+    constructor(database: D1DatabaseLike, scope: D1TenantScope);
+    prepare(source: WalletRelocationSessionSource, rawManifest: unknown): Promise<IntakeProgress>;
+    acceptSnapshot(source: WalletRelocationSessionSource, raw: unknown): Promise<string>;
+    activate(source: WalletRelocationSessionSource, rawManifest: unknown, commandDigest: string, nowMs: number): Promise<{
+        readonly digestHex: string;
+        readonly activatedAtMs: number;
+    }>;
+    private readActivation;
+    private read;
+}
+export {};
+//# sourceMappingURL=d1WalletAuthorizationIntake.d.ts.map