@seams/wallet-server 0.8.0 → 0.9.1

package/dist/types/wallet-server/src/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoLifecycleDecisionStore.d.ts

@@ -1,4 +1,4 @@
-import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import type { D1DatabaseLike, D1PreparedStatementLike, D1ResultLike } from '../../../../storage/tenantRoute';
 import type { RouterAbEd25519YaoLifecycleDecisionV1 } from '../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoLifecycleDecision';
 /**
  * The Gateway's Ed25519 Yao lifecycle decisions, in the signer database. A
@@ -16,6 +16,8 @@ export declare class CloudflareD1Ed25519YaoLifecycleDecisionStoreV1 {
         readonly envId: string;
     });
     read(lifecycleId: string): Promise<RouterAbEd25519YaoLifecycleDecisionV1 | null>;
+    prepareRead(lifecycleId: string): D1PreparedStatementLike;
+    parseRead(lifecycleId: string, result: D1ResultLike<Record<string, unknown>>): RouterAbEd25519YaoLifecycleDecisionV1 | null;
     /**
      * The statements that record `decision`, for a batch whose other statements
      * make its finalization visible. The batch aborts unless they insert the

package/dist/types/wallet-server/src/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoProductRegistrationPartitionedStateStore.d.ts

@@ -3,4 +3,5 @@ import type { VersionedJsonObject } from '../../../framework/versionedJsonRecord
 import { type RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1 } from '../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore';
 export type RouterAbEd25519YaoProductRegistrationPartitionedStateD1OptionsV1 = Omit<CloudflareD1VersionedJsonRecordStoreOptions<VersionedJsonObject>, 'encode' | 'parse'>;
 export declare function createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1(options: RouterAbEd25519YaoProductRegistrationPartitionedStateD1OptionsV1): RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1;
+export declare function evictWalletEd25519CapabilityCache(options: RouterAbEd25519YaoProductRegistrationPartitionedStateD1OptionsV1, walletId: string): Promise<void>;
 //# sourceMappingURL=d1Ed25519YaoProductRegistrationPartitionedStateStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoStateWriteFence.d.ts

@@ -0,0 +1,8 @@
+import { type WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
+import type { D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import type { VersionedJsonObject } from '../../../framework/versionedJsonRecordStore';
+import type { CloudflareD1VersionedJsonRecordStoreOptions } from '../versionedJson/d1VersionedJsonRecordStore';
+import { type RouterAbEd25519YaoProductRegistrationPartitionRecordV1 } from '../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore';
+export declare function collectChangedStateWallets(before: RouterAbEd25519YaoProductRegistrationPartitionRecordV1 | null, after: RouterAbEd25519YaoProductRegistrationPartitionRecordV1, wallets: Set<WalletId>): void;
+export declare function lifecycleWriteFenceStatements(options: Pick<CloudflareD1VersionedJsonRecordStoreOptions<VersionedJsonObject>, 'database' | 'scope'>, wallets: ReadonlySet<WalletId>): D1PreparedStatementLike[];
+//# sourceMappingURL=d1Ed25519YaoStateWriteFence.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/ed25519Yao/d1WalletCeremonyActivity.d.ts

@@ -0,0 +1,15 @@
+import type { WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
+import { type D1TenantScope } from '../../../../core/d1TenantStore';
+import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import type { RouterAbEd25519YaoProductRegistrationCeremonyStateV1 } from '../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitioning';
+type Ceremony = RouterAbEd25519YaoProductRegistrationCeremonyStateV1;
+export declare class D1WalletCeremonyActivity {
+    private readonly database;
+    private readonly scope;
+    constructor(database: D1DatabaseLike, scope: D1TenantScope);
+    hasPending(walletId: WalletId): Promise<boolean>;
+    project(recordKey: string, walletId: WalletId, settled: boolean): D1PreparedStatementLike;
+}
+export declare function ceremonySettled(ceremony: Ceremony): boolean;
+export {};
+//# sourceMappingURL=d1WalletCeremonyActivity.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeIssuer.d.ts

@@ -1,4 +1,4 @@
-import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from '../../../../../../shared-ts/src/utils/emailOtpDomain';
+import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION, WALLET_EMAIL_OTP_RELOCATION_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from '../../../../../../shared-ts/src/utils/emailOtpDomain';
 import type { EmailOtpChallengeOperation, EmailOtpLoginChallengeOperation } from '../../../../core/EmailOtpStores';
 import { EMAIL_OTP_CODE_LENGTH } from '../../../../core/authService/emailOtpConfig';
 import type { CloudflareD1EmailOtpChallengeStore } from './d1EmailOtpChallengeStore';
@@ -19,6 +19,10 @@ type EmailOtpChallengeIssueBaseInput = {
     readonly requestOrigin?: unknown;
 };
 type EmailOtpChallengeIssueInput = (EmailOtpChallengeIssueBaseInput & {
+    readonly action: typeof WALLET_EMAIL_OTP_ACTIONS.relocation;
+    readonly operation: typeof WALLET_EMAIL_OTP_RELOCATION_OPERATION;
+    readonly expiresAtMs: number;
+}) | (EmailOtpChallengeIssueBaseInput & {
     readonly action: typeof WALLET_EMAIL_OTP_ACTIONS.login;
     readonly operation: EmailOtpLoginChallengeOperation;
 }) | (EmailOtpChallengeIssueBaseInput & {
@@ -73,6 +77,7 @@ export declare class CloudflareD1EmailOtpChallengeIssuer {
         readonly emailOtpEnrollments: CloudflareD1EmailOtpEnrollmentStore;
         readonly emailOtpRateLimits: CloudflareD1EmailOtpRateLimitStore;
     });
+    challengeExpiresAt(nowMs: number): number;
     create(input: EmailOtpChallengeIssueInput): Promise<EmailOtpChallengeIssueResult>;
     private readActiveEnrollment;
 }

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeStore.d.ts

@@ -45,6 +45,7 @@ export declare class CloudflareD1EmailOtpChallengeStore {
     deleteActiveOverflow(input: EmailOtpChallengeContextInput & {
         readonly maxActiveChallenges: number;
     }): Promise<EmailOtpChallengeRecord[]>;
+    putIfAbsent(record: EmailOtpChallengeRecord): Promise<EmailOtpChallengeRecord>;
     put(record: EmailOtpChallengeRecord): Promise<void>;
     updateAttemptCount(record: EmailOtpChallengeRecord, attemptCount: number): Promise<void>;
     delete(challengeId: string): Promise<void>;

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeVerifier.d.ts

@@ -1,5 +1,5 @@
 import type { D1PreparedStatementLike } from '../../../../storage/tenantRoute';
-import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from '../../../../../../shared-ts/src/utils/emailOtpDomain';
+import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION, WALLET_EMAIL_OTP_RELOCATION_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from '../../../../../../shared-ts/src/utils/emailOtpDomain';
 import type { EmailOtpLoginChallengeOperation, EmailOtpWalletEnrollmentRecord } from '../../../../core/EmailOtpStores';
 import type { CloudflareD1EmailOtpChallengeStore } from './d1EmailOtpChallengeStore';
 import type { CloudflareD1EmailOtpEnrollmentStore } from './d1EmailOtpEnrollmentStore';
@@ -17,6 +17,9 @@ type EmailOtpExistingChallengeVerifyBaseInput = {
 export type EmailOtpExistingChallengeVerifyInput = (EmailOtpExistingChallengeVerifyBaseInput & {
     readonly action: typeof WALLET_EMAIL_OTP_ACTIONS.login;
     readonly operation: EmailOtpLoginChallengeOperation;
+}) | (EmailOtpExistingChallengeVerifyBaseInput & {
+    readonly action: typeof WALLET_EMAIL_OTP_ACTIONS.relocation;
+    readonly operation: typeof WALLET_EMAIL_OTP_RELOCATION_OPERATION;
 }) | (EmailOtpExistingChallengeVerifyBaseInput & {
     readonly action: typeof WALLET_EMAIL_OTP_ACTIONS.deviceLink;
     readonly operation: typeof WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION;

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpCounters.typecheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=d1EmailOtpCounters.typecheck.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpRateLimitStore.d.ts

@@ -1,45 +1,22 @@
+import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
 import type { ScopedD1Prepare } from '../../../../core/emailOtpD1Statements';
 import type { RateLimitResult } from '../../../../core/authService/rateLimits';
 import type { EmailOtpRateLimitPolicy } from '../auth/d1RouterApiAuthConfig';
-import { type EmailOtpRateLimitScope } from './d1EmailOtpRecords';
+import { type EmailOtpRateLimitScope, type EmailOtpRateLimitConsumeInput } from './d1EmailOtpRecords';
 type EmailOtpRateLimitPolicies = {
     readonly [K in EmailOtpRateLimitScope]: EmailOtpRateLimitPolicy;
 };
-type EmailOtpRateLimitConsumeInput = {
-    readonly scope: EmailOtpRateLimitScope;
-    readonly action?: string;
-    readonly userId?: string;
-    readonly walletId?: string;
-    readonly providerSubject?: string;
-    readonly orgId?: string;
-    readonly clientIp?: string;
-};
 type EmailOtpRateLimitConsumeResult = Readonly<RateLimitResult>;
 export declare class CloudflareD1EmailOtpRateLimitStore {
-    private readonly rateLimits;
-    private readonly counter;
+    private readonly input;
     constructor(input: {
         readonly prepare: ScopedD1Prepare;
+        readonly batch: D1DatabaseLike['batch'];
         readonly rateLimits: EmailOtpRateLimitPolicies;
-        readonly counter?: EmailOtpRateLimitCounter;
     });
     consume(input: EmailOtpRateLimitConsumeInput): Promise<EmailOtpRateLimitConsumeResult>;
-}
-export interface EmailOtpRateLimitCounter {
-    consume(input: {
-        readonly key: string;
-        readonly limit: number;
-        readonly windowMs: number;
-    }): Promise<EmailOtpRateLimitConsumeResult>;
-}
-export declare class D1EmailOtpRateLimitCounter implements EmailOtpRateLimitCounter {
-    private readonly prepare;
-    constructor(prepare: ScopedD1Prepare);
-    consume(input: {
-        readonly key: string;
-        readonly limit: number;
-        readonly windowMs: number;
-    }): Promise<EmailOtpRateLimitConsumeResult>;
+    private prepareConsume;
+    private readCounter;
 }
 export {};
 //# sourceMappingURL=d1EmailOtpRateLimitStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpRecords.d.ts

@@ -72,19 +72,33 @@ export declare function generateNumericOtp(length: number): string;
 export declare function clampedEmailOtpUnlockTtlMs(input: unknown): number;
 export declare function decodeFixedBase64Url(input: string, byteLength: number): Uint8Array | null;
 export declare function bytesEqual(left: Uint8Array, right: Uint8Array): boolean;
-export declare function emailOtpRateLimitKeys(input: {
+export type EmailOtpCounterKey = {
+    readonly kind: 'wallet';
+    readonly walletId: string;
+    readonly key: string;
+} | {
+    readonly kind: 'regional';
+    readonly walletId?: never;
+    readonly key: string;
+};
+export type EmailOtpRateLimitConsumeInput = {
     readonly scope: EmailOtpRateLimitScope;
     readonly action?: string;
-    readonly policy: {
-        readonly limit: number;
-        readonly windowMs: number;
-    };
     readonly userId?: string;
-    readonly walletId?: string;
     readonly providerSubject?: string;
     readonly orgId?: string;
     readonly clientIp?: string;
-}): readonly string[];
+} & ({
+    readonly kind: 'wallet';
+    readonly walletId: string;
+} | {
+    readonly kind: 'regional';
+    readonly walletId?: never;
+});
+export declare function emailOtpRateLimitKeys(input: EmailOtpRateLimitConsumeInput, policy: {
+    readonly limit: number;
+    readonly windowMs: number;
+}): readonly EmailOtpCounterKey[];
 export declare function emailOtpRateLimitExceeded(row: D1EmailOtpRateLimitRow | null): {
     readonly ok: false;
     readonly code: 'rate_limited';

package/dist/types/wallet-server/src/router/cloudflare/d1/passkeyCustody/d1WalletCustodyCommitStore.d.ts

@@ -37,6 +37,16 @@ export type WalletRecoveryCodeLocatorRecord = {
     readonly walletId: WalletId;
     readonly recoveryKeyId: DerivedWalletRecoveryKeyId;
 };
+/**
+ * A registration commit whose recovery-code routes are claimed. `commit`
+ * writes the records, and it needs the wallet that the registration commits.
+ */
+export type WalletCustodyRegistrationReservation = Extract<WalletCustodyRegistrationCommitResult, {
+    kind: 'inconsistent';
+}> | {
+    readonly kind: 'reserved';
+    readonly commit: () => Promise<WalletCustodyRegistrationCommitResult>;
+};
 export type WalletCustodyRegistrationCommitResult = {
     readonly kind: 'committed';
     readonly envelopeStoreVersion: string;
@@ -137,6 +147,12 @@ export declare class CloudflareD1WalletCustodyCommitStore {
     private readEmailOtpEnrollment;
     private walletRecoveryGoogleEmailOtpFinalizedAttemptMatches;
     private walletRecoveryGoogleEmailOtpChallengeExists;
+    /**
+     * Checks the commit and claims its recovery-code routes. The claim is an
+     * exact-retryable directory write that needs no local record, so a caller
+     * may run it beside its other remote effects and write afterwards.
+     */
+    reserveRegistration(commit: WalletCustodyRegistrationCommit): Promise<WalletCustodyRegistrationReservation>;
     /**
      * Writes the envelope and the recovery set in one transaction.
      *
@@ -144,7 +160,7 @@ export declare class CloudflareD1WalletCustodyCommitStore {
      * key already holds a row, so a repeated registration cannot silently replace
      * an established wallet's custody.
      */
-    commitRegistration(commit: WalletCustodyRegistrationCommit): Promise<WalletCustodyRegistrationCommitResult>;
+    private commitReservedRegistration;
     /**
      * Reads a wallet's recovery envelope set. Returns null when absent, and also
      * when the stored row is not a recovery set — a row that fails its own parser

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore.d.ts

@@ -17,18 +17,41 @@ type D1RegistrationCeremonyRecordMutation = {
     readonly value: Record<string, unknown>;
     readonly expiresAtMs: number;
 };
+type D1RegistrationCeremonyVersionedUpdate = {
+    readonly scope: string;
+    readonly id: string;
+    readonly expectedVersion: number;
+    readonly next: Record<string, unknown>;
+    readonly expiresAtMs: number;
+};
 type D1RegistrationCeremonyAtomicBranchClaim = {
     readonly value: Record<string, unknown>;
     readonly version: number;
 };
+type StoredRow = {
+    readonly version?: unknown;
+    readonly record_json?: unknown;
+    readonly expires_at_ms?: unknown;
+};
 export declare class D1RegistrationCeremonyRecordStore {
     private readonly database;
     private readonly tenantScope;
     private readonly keyPrefix;
     constructor(options: D1RegistrationCeremonyRecordStoreOptions);
     get(scope: string, id: string): Promise<D1RegistrationCeremonyStoredRecord | null>;
+    prepareGet(scope: string, id: string): D1PreparedStatementLike;
+    parseGet(scope: string, id: string, row: StoredRow | null): Promise<D1RegistrationCeremonyStoredRecord | null>;
     putExact(mutation: D1RegistrationCeremonyRecordMutation): Promise<void>;
     insertOrRead(mutation: D1RegistrationCeremonyRecordMutation): Promise<D1RegistrationCeremonyStoredRecord>;
+    /**
+     * Stores `mutation` and opens `copyScope` with the value that `mutation`'s
+     * key then holds, in one batch. A competing insert leaves its winner in both
+     * records, as two `insertOrRead` calls in series would.
+     */
+    insertOrReadWithCopy(mutation: D1RegistrationCeremonyRecordMutation, copyScope: string, companion: readonly D1PreparedStatementLike[]): Promise<{
+        readonly record: D1RegistrationCeremonyStoredRecord;
+        readonly copy: D1RegistrationCeremonyStoredRecord;
+    }>;
     updateExpected(input: {
         readonly scope: string;
         readonly id: string;
@@ -48,13 +71,14 @@ export declare class D1RegistrationCeremonyRecordStore {
         };
         readonly patch: Record<string, unknown>;
     }): Promise<D1RegistrationCeremonyAtomicBranchClaim | null>;
-    updateExpectedVersion(input: {
-        readonly scope: string;
-        readonly id: string;
-        readonly expectedVersion: number;
-        readonly next: Record<string, unknown>;
-        readonly expiresAtMs: number;
-    }): Promise<number>;
+    updateExpectedVersion(input: D1RegistrationCeremonyVersionedUpdate): Promise<number>;
+    /**
+     * The update of `updateExpectedVersion` with its guard, for a batch that
+     * another store owns on this database. The guard fails that batch when the
+     * record is no longer at the expected version.
+     */
+    prepareExpectedVersionUpdate(input: D1RegistrationCeremonyVersionedUpdate): readonly D1PreparedStatementLike[];
+    private prepareVersionedUpdate;
     take(scope: string, id: string): Promise<Record<string, unknown> | null>;
     delete(scope: string, id: string): Promise<boolean>;
     /**
@@ -68,6 +92,7 @@ export declare class D1RegistrationCeremonyRecordStore {
     private prepareExactMutations;
     putManyExact(mutations: readonly D1RegistrationCeremonyRecordMutation[]): Promise<void>;
     private allRecordsMatch;
+    private prepareRead;
     private insert;
     private prepareInsert;
     private deleteVersion;

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationCeremonyStore.d.ts

@@ -1,4 +1,4 @@
-import type { D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import type { D1PreparedStatementLike, D1ResultLike } from '../../../../storage/tenantRoute';
 import { StoredAddAuthMethodIntent, StoredAddSignerIntent, StoredWalletAddAuthMethodCeremony, StoredWalletAddSignerCeremony, StoredWalletAddSignerFinalizeReplay, StoredWalletAddAuthMethodFinalizeReplay, StoredWalletRegistrationCeremony, type StoredWalletRegistrationEvmFamilyEcdsaActivationClaimedBranch, type StoredWalletRegistrationEvmFamilyEcdsaResponseClaimedBranch, type TerminalRegistrationCeremonyCancellationResult } from '../../../../core/RegistrationCeremonyStore';
 import type { WalletId } from '../../../../core/registrationContracts';
 import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
@@ -13,13 +13,21 @@ type D1WalletRegistrationEcdsaCeremonyClaimV1 = {
     readonly ceremony: StoredWalletRegistrationCeremony;
     readonly version: number;
 };
+type D1WalletRegistrationCeremonyCommitV1 = {
+    readonly expected: D1WalletRegistrationEcdsaCeremonyClaimV1;
+    readonly next: StoredWalletRegistrationCeremony;
+};
 export declare class CloudflareD1RegistrationCeremonyIntentStore {
+    private readonly input;
     private readonly storage;
     constructor(input: RegistrationCeremonyIntentStoreConfig);
     getSetupCeremony(ceremonyId: string): Promise<StoredWalletRegistrationCeremony | null>;
-    reserveSetupCeremony(proposed: StoredWalletRegistrationCeremony): Promise<StoredWalletRegistrationCeremony>;
-    ensureSetupCeremony(setup: StoredWalletRegistrationCeremony): Promise<void>;
+    /** One batch stores the setup snapshot, ceremony, and authenticated execution identity. */
+    reserveSetupCeremony(proposed: StoredWalletRegistrationCeremony, ownershipGeneration: number): Promise<StoredWalletRegistrationCeremony>;
     getCeremony(registrationCeremonyId: string): Promise<StoredWalletRegistrationCeremony | null>;
+    prepareCeremonyRead(registrationCeremonyId: string): D1PreparedStatementLike;
+    parseCeremonyRead(registrationCeremonyId: string, result: D1ResultLike<Record<string, unknown>>): Promise<StoredWalletRegistrationCeremony | null>;
+    parseCeremonySnapshotRead(registrationCeremonyId: string, result: D1ResultLike<Record<string, unknown>>): Promise<D1WalletRegistrationEcdsaCeremonyClaimV1 | null>;
     getCeremonySnapshot(registrationCeremonyId: string): Promise<D1WalletRegistrationEcdsaCeremonyClaimV1 | null>;
     updateCeremony(input: {
         readonly expected: StoredWalletRegistrationCeremony;
@@ -39,10 +47,11 @@ export declare class CloudflareD1RegistrationCeremonyIntentStore {
         readonly activationRequestDigestB64u: string;
         readonly activationOwner: string;
     }): Promise<D1WalletRegistrationEcdsaCeremonyClaimV1 | null>;
-    commitEcdsaClaim(input: {
-        readonly expected: D1WalletRegistrationEcdsaCeremonyClaimV1;
-        readonly next: StoredWalletRegistrationCeremony;
-    }): Promise<void>;
+    commitEcdsaClaim(input: D1WalletRegistrationCeremonyCommitV1): Promise<void>;
+    /** `commitEcdsaClaim` as statements for a batch that another store owns on this database. */
+    prepareEcdsaClaimCommit(input: D1WalletRegistrationCeremonyCommitV1): {
+        readonly statements: readonly D1PreparedStatementLike[];
+    };
     deleteCeremony(registrationCeremonyId: string): Promise<boolean>;
     cancelTerminalCeremony(input: {
         readonly registrationCeremonyId: string;

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationSessionTransaction.d.ts

@@ -0,0 +1,13 @@
+import type { D1Row } from '../../../../storage/d1Sql';
+import type { D1DatabaseLike, D1PreparedStatementLike, D1ResultLike } from '../../../../storage/tenantRoute';
+import type { D1RegistrationCommitBatch } from './d1WalletRegistrationCommitStore';
+/** The wallet's version checks and the session's winner read share one batch. */
+export declare class D1RegistrationSessionTransaction {
+    private readonly database;
+    private readonly commitWallet;
+    private sessionResults;
+    constructor(database: D1DatabaseLike, commitWallet: (executeBatch: D1RegistrationCommitBatch) => Promise<void>);
+    execute(sessionStatements: readonly D1PreparedStatementLike[]): Promise<readonly D1ResultLike<D1Row>[]>;
+    private commit;
+}
+//# sourceMappingURL=d1RegistrationSessionTransaction.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationSetupSupport.d.ts

@@ -47,5 +47,12 @@ type RegistrationIntentSignerBranches = {
     readonly nearEd25519: RegistrationNearEd25519SignerPlan | null;
     readonly evmFamilyEcdsa: RegistrationEvmFamilyEcdsaSignerPlan | null;
 };
+export declare function recordRegistrationServerTiming(sink: Array<readonly [string, number]>, name: string, startedAtMs: number): void;
+export declare function recordRegistrationPromiseTiming<T>(args: {
+    readonly sink: Array<readonly [string, number]>;
+    readonly name: string;
+    readonly startedAtMs: number;
+    readonly promise: T | Promise<T>;
+}): Promise<T>;
 export {};
 //# sourceMappingURL=d1RegistrationSetupSupport.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletExecutionAuthority.d.ts

@@ -0,0 +1,41 @@
+import { type D1TenantScope } from '../../../../core/d1TenantStore';
+import type { D1DatabaseLike, D1ResultLike } from '../../../../storage/tenantRoute';
+import type { RegistrationEstablishedPublication, WalletExecutionAuthority, WalletRegistrationHomeAuthority, WalletRegistrationReservationAuthority } from '../../../domains/walletRegistration/walletRegistrationReservation';
+type Authority = WalletRegistrationReservationAuthority;
+type HomeAdmission = Awaited<ReturnType<Authority['admitHome']>>;
+type OrdinaryAdmission = Awaited<ReturnType<WalletExecutionAuthority['admitEstablishedHome']>>;
+type RegistrationHomeRow = {
+    readonly generation: number;
+    readonly state: string;
+    readonly registration_completion: string;
+    readonly relocation_blocked: number;
+};
+export declare class D1WalletExecutionAuthority implements WalletRegistrationHomeAuthority, WalletExecutionAuthority {
+    private readonly database;
+    private readonly scope;
+    private readonly registration;
+    constructor(database: D1DatabaseLike, scope: D1TenantScope, registration: Authority);
+    reserve(input: Parameters<Authority['reserve']>[0]): Promise<import("../../../domains/walletRegistration/walletRegistrationReservation").WalletRegistrationSetupReservationResult>;
+    admitHome(input: Parameters<Authority['admitHome']>[0]): Promise<HomeAdmission>;
+    prepareHomeRead(input: Parameters<Authority['admitHome']>[0]): import("../../../cloudflare-adaptor").D1PreparedStatementLike;
+    admitHomeRead(input: Parameters<Authority['admitHome']>[0], result: D1ResultLike<Partial<Record<keyof RegistrationHomeRow, unknown>>>): Promise<HomeAdmission>;
+    cancel(input: Parameters<WalletRegistrationHomeAuthority['cancel']>[0]): Promise<{
+        readonly ok: true;
+    } | {
+        readonly ok: false;
+        readonly code: string;
+        readonly message: string;
+    }>;
+    publishEstablished(input: Parameters<WalletRegistrationHomeAuthority['publishEstablished']>[0]): Promise<RegistrationEstablishedPublication>;
+    private fixCancellation;
+    /** The state update with its guard. The guard reads the row count of the update before it. */
+    private prepareState;
+    admitEstablishedHome(input: Parameters<WalletExecutionAuthority['admitEstablishedHome']>[0]): Promise<OrdinaryAdmission>;
+}
+/** Records the authenticated reservation beside setup without reopening a retired home. */
+export declare function prepareD1RegistrationHomeReservation(database: D1DatabaseLike, scope: D1TenantScope, input: Parameters<Authority['admitHome']>[0] & {
+    readonly ownershipGeneration: number;
+}): import("../../../cloudflare-adaptor").D1PreparedStatementLike[];
+export declare function admitD1EstablishedWalletHome(database: D1DatabaseLike, scope: D1TenantScope, input: Parameters<WalletExecutionAuthority['admitEstablishedHome']>[0]): Promise<OrdinaryAdmission>;
+export {};
+//# sourceMappingURL=d1WalletExecutionAuthority.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletOperationStore.d.ts

@@ -0,0 +1,28 @@
+import type { WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
+import type { VersionedJsonRecordPutResult } from '../../../framework/versionedJsonRecordStore';
+import type { D1PreparedStatementLike, D1ResultLike } from '../../../../storage/tenantRoute';
+import { type CloudflareD1VersionedJsonRecordStoreOptions } from '../versionedJson/d1VersionedJsonRecordStore';
+type WalletOperation = {
+    readonly kind: 'router_ab_ed25519_yao_registration_side_effect_claim_v1' | 'router_ab_ed25519_yao_registration_side_effect_completion_v1' | 'router_ab_ed25519_yao_registration_side_effect_completion_v2';
+};
+export declare class D1WalletOperationStore<T extends WalletOperation> {
+    private readonly options;
+    private readonly walletId;
+    private readonly records;
+    private readonly activity;
+    constructor(options: CloudflareD1VersionedJsonRecordStoreOptions<T>, walletId: (record: T) => WalletId);
+    read(key: string): Promise<import("../../../cloudflare-adaptor").VersionedJsonRecordReadResult<T>>;
+    prepareRead(key: string): D1PreparedStatementLike;
+    parseReadResult(result: D1ResultLike<Record<string, unknown>>): import("../../../cloudflare-adaptor").VersionedJsonRecordReadResult<T>;
+    listByKeyPrefix(key: string, options?: {
+        readonly limit?: number;
+    }): Promise<readonly import("../versionedJson/d1VersionedJsonRecordStore").CloudflareD1VersionedJsonRecordReadManyEntryV1<T>[]>;
+    put(key: string, value: T, expectedVersion: string | null): Promise<VersionedJsonRecordPutResult>;
+    /** As `put`, with another store's write on this database in the same batch. */
+    putWithCompanion(key: string, value: T, expectedVersion: string | null, companionWrite: {
+        readonly statements: readonly D1PreparedStatementLike[];
+    }): Promise<VersionedJsonRecordPutResult>;
+    private commit;
+}
+export {};
+//# sourceMappingURL=d1WalletOperationStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationCommitStore.d.ts

@@ -3,8 +3,10 @@ import type { ActiveWalletAuthorityV1 } from '../../../../../../shared-ts/src/au
 import { type ActiveWalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
 import { type RegistrationAuthority } from '../../../../../../shared-ts/src/utils/registrationAuthMethodInput';
 import type { WalletRecord, WalletSignerRecord } from '../../../../core/WalletStore';
-import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import type { D1DatabaseLike, D1PreparedStatementLike, D1ResultLike } from '../../../../storage/tenantRoute';
 import type { D1EmailOtpRegistrationCommitPlan } from '../emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer';
+export type D1RegistrationCommitBatch = (statements: readonly D1PreparedStatementLike[]) => Promise<readonly D1ResultLike[]>;
+type ReservedWalletRegistrationCommit = (input: D1WalletRegistrationCommitInput, executeBatch?: D1RegistrationCommitBatch) => Promise<void>;
 type D1WalletRegistrationCommitBase = {
     readonly wallet: WalletRecord;
     readonly walletSigners: readonly WalletSignerRecord[];
@@ -24,19 +26,13 @@ type D1WalletRegistrationFoundingFields = {
 };
 type D1WalletRegistrationCommitInput = (D1WalletRegistrationCommitBase & D1WalletRegistrationFoundingFields & {
     readonly kind: 'passkey_wallet_registration_commit_v1';
-    readonly authority: Extract<RegistrationAuthority, {
-        readonly kind: 'passkey';
-    }>;
     readonly emailOtp?: never;
 }) | (D1WalletRegistrationCommitBase & D1WalletRegistrationFoundingFields & {
     readonly kind: 'email_otp_wallet_registration_commit_v1';
-    readonly authority: Extract<RegistrationAuthority, {
-        readonly kind: 'email_otp';
-    }>;
     readonly emailOtp: D1EmailOtpRegistrationCommitPlan;
 });
 export interface D1WalletRegistrationCommitStore {
-    commit(input: D1WalletRegistrationCommitInput): Promise<void>;
+    reserveAuthority(authority: RegistrationAuthority): Promise<ReservedWalletRegistrationCommit>;
 }
 export declare class CloudflareD1WalletRegistrationCommitStore implements D1WalletRegistrationCommitStore {
     private readonly database;
@@ -50,7 +46,8 @@ export declare class CloudflareD1WalletRegistrationCommitStore implements D1Wall
         readonly projectId: string;
         readonly envId: string;
     });
-    commit(input: D1WalletRegistrationCommitInput): Promise<void>;
+    reserveAuthority(authority: RegistrationAuthority): Promise<ReservedWalletRegistrationCommit>;
+    private commit;
 }
 export {};
 //# sourceMappingURL=d1WalletRegistrationCommitStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationInitialSession.d.ts

@@ -0,0 +1,17 @@
+import type { CloudflareD1AuthorizationStore } from '../authorization/d1AuthorizationStore';
+import type { D1WalletRegistrationCommitStore } from './d1WalletRegistrationCommitStore';
+import { commitInitialEd25519RegistrationSession, type RegistrationInitialSessionCommit } from './walletRegistrationEstablishedSessionIssuer';
+export type RegistrationSessionTransactionStore = Pick<CloudflareD1AuthorizationStore, 'commitRegistrationWalletSessionAuthorizationV2'>;
+export type RegistrationInitialSessionPlan = {
+    readonly kind: 'separate';
+    readonly store?: never;
+    readonly request?: never;
+} | {
+    readonly kind: 'initial_near';
+    readonly store: RegistrationSessionTransactionStore;
+    readonly request: Omit<Parameters<typeof commitInitialEd25519RegistrationSession>[0], 'foundingAuthority'>;
+};
+type ReservedWalletCommit = Awaited<ReturnType<D1WalletRegistrationCommitStore['reserveAuthority']>>;
+export declare function commitWalletRegistration(commitWallet: ReservedWalletCommit, input: Parameters<ReservedWalletCommit>[0], session: RegistrationInitialSessionPlan): Promise<RegistrationInitialSessionCommit>;
+export {};
+//# sourceMappingURL=d1WalletRegistrationInitialSession.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationPreparation.d.ts

@@ -0,0 +1,12 @@
+import type { DeviceId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
+import type { WalletAuthMethodId, WalletAuthorityId, WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
+import type { StoredWalletRegistrationCeremony } from '../../../../core/RegistrationCeremonyStore';
+export type D1WalletRegistrationOperationPreparedV1 = {
+    readonly kind: 'd1_wallet_registration_operation_prepared_v1';
+    readonly walletId: WalletId;
+    readonly walletAuthorityId: WalletAuthorityId;
+    readonly deviceId: DeviceId;
+    readonly walletAuthMethodId: WalletAuthMethodId;
+};
+export declare function walletRegistrationOperationPreparedFromCeremony(ceremony: StoredWalletRegistrationCeremony, allocated: D1WalletRegistrationOperationPreparedV1 | null): D1WalletRegistrationOperationPreparedV1;
+//# sourceMappingURL=d1WalletRegistrationPreparation.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationRead.d.ts

@@ -0,0 +1,43 @@
+import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
+import type { WalletRegistrationHomeAuthority } from '../../../domains/walletRegistration/walletRegistrationReservation';
+import type { CloudflareD1RegistrationCeremonyIntentStore } from './d1RegistrationCeremonyStore';
+import type { D1WalletExecutionAuthority } from './d1WalletExecutionAuthority';
+import type { D1WalletOperationStore } from './d1WalletOperationStore';
+import type { D1WalletRegistrationNearProvisioningSideEffectRecord } from './d1WalletRegistrationService';
+import type { CloudflareD1Ed25519YaoLifecycleDecisionStoreV1 } from '../ed25519Yao/d1Ed25519YaoLifecycleDecisionStore';
+/** Read admission and immutable finalization state from one D1 snapshot. */
+export declare class D1WalletRegistrationRead {
+    private readonly database;
+    private readonly authority;
+    readonly operations: D1WalletOperationStore<D1WalletRegistrationNearProvisioningSideEffectRecord>;
+    private readonly getCeremonies;
+    private readonly decisions;
+    constructor(database: D1DatabaseLike, authority: D1WalletExecutionAuthority | null, operations: D1WalletOperationStore<D1WalletRegistrationNearProvisioningSideEffectRecord>, getCeremonies: () => CloudflareD1RegistrationCeremonyIntentStore, decisions: CloudflareD1Ed25519YaoLifecycleDecisionStoreV1);
+    readRespond(home: Parameters<WalletRegistrationHomeAuthority['admitHome']>[0]): Promise<{
+        readonly ok: false;
+        readonly code: string;
+        readonly message: string;
+        readonly ownershipGeneration?: never;
+        readonly purpose?: never;
+    } | {
+        ok: true;
+        ownershipGeneration: number;
+        snapshot: {
+            readonly ceremony: import("../../../../core/RegistrationCeremonyStore").StoredWalletRegistrationCeremony;
+            readonly version: number;
+        } | null;
+    }>;
+    readFinalization(home: Parameters<WalletRegistrationHomeAuthority['admitHome']>[0], operationKey: string): Promise<{
+        readonly ok: false;
+        readonly code: string;
+        readonly message: string;
+        readonly ownershipGeneration?: never;
+        readonly purpose?: never;
+    } | {
+        ok: true;
+        operation: import("../../../cloudflare-adaptor").VersionedJsonRecordReadResult<D1WalletRegistrationNearProvisioningSideEffectRecord>;
+        decision: import("../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoLifecycleDecision").RouterAbEd25519YaoLifecycleDecisionV1 | null;
+        readCeremony: () => Promise<import("../../../../core/RegistrationCeremonyStore").StoredWalletRegistrationCeremony | null>;
+    }>;
+}
+//# sourceMappingURL=d1WalletRegistrationRead.d.ts.map