@seams/wallet-server 0.8.0 → 0.9.1

package/dist/types/wallet-server/src/router/cloudflare/runtime/walletRelocationSource.d.ts

@@ -0,0 +1,26 @@
+import { type WalletObjectIdentity } from './walletObjectAddresses';
+import type { WalletConsoleServiceBinding } from './walletConsoleOpsClient';
+export type RuntimeSourceOperation = 'ed25519-settle' | 'ed25519-capture' | 'ecdsa-freeze' | 'router-freeze' | 'router-export' | 'router-status' | 'router-verify' | 'router-import' | 'router-activate' | 'router-cleanup';
+export type RuntimeSourceDirectory = {
+    readonly WALLET_CONSOLE: WalletConsoleServiceBinding;
+    readonly CF_VERSION_METADATA: {
+        readonly id: unknown;
+    };
+    readonly SEAMS_D1_HOME_ACCOUNT_ID: string;
+    readonly SEAMS_D1_HOME_DATABASE_ID: string;
+};
+type SourceAuthorization = {
+    readonly ok: true;
+    readonly body: string;
+    readonly identity: WalletObjectIdentity;
+    readonly code?: never;
+} | {
+    readonly ok: false;
+    readonly code: 'invalid_input' | 'source_command_unavailable' | 'source_command_denied';
+    readonly body?: never;
+    readonly identity?: never;
+};
+export declare function authorizeRuntimeSource(input: unknown, operation: RuntimeSourceOperation, env: RuntimeSourceDirectory): Promise<SourceAuthorization>;
+export declare function recordRuntimeRouterReceipt(operation: 'router-freeze' | 'router-activate', input: unknown, response: Response, env: RuntimeSourceDirectory): Promise<Response>;
+export {};
+//# sourceMappingURL=walletRelocationSource.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/signingLanes/cloudflareOrdinaryInactiveSignerMaterialReservation.d.ts

@@ -1,3 +1,4 @@
+import type { WalletExecutionAuthority } from '../../domains/walletRegistration/walletRegistrationReservation';
 import { type OrdinaryEcdsaSignerMaterialReservationRequestV1, type OrdinaryEcdsaSignerMaterialDeactivationRequestV1, type OrdinaryEcdsaSignerMaterialWorkerReservationV1, type OrdinaryEd25519SignerMaterialReservationRequestV1, type OrdinaryEd25519SignerMaterialDeactivationRequestV1, type OrdinaryEd25519SignerMaterialWorkerReservationV1, type OrdinaryInactiveSignerMaterialDeactivationPortV1, type OrdinaryInactiveSignerMaterialDeactivationRequestV1, type OrdinaryInactiveSignerMaterialReservationServiceV1, type OrdinaryInactiveSignerMaterialReservationWorkerPortV1 } from '../../../core/signingMaterial/ordinaryInactiveSignerMaterialReservation';
 import { type LinkedDeviceEd25519SourceContributionPreparationV1 } from '../../../../../shared-ts/src/device-linking/sourceContribution';
 import type { DeviceLinkingEd25519SourcePreservingRouterPortV1 } from '../../transport/fetch/routes/deviceLinking';
@@ -34,16 +35,19 @@ export type CloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1 = {
 };
 export type CloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1 = DeviceLinkingEd25519SourcePreservingRouterPortV1;
 export declare function createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1(input: {
+    readonly admitEstablishedHome: WalletExecutionAuthority['admitEstablishedHome'];
     readonly fetch: typeof fetch;
     readonly internalServiceAuthSecret: string;
     readonly resolveTenantRoot: (context: Pick<LinkedDeviceEd25519SourceContributionPreparationV1, 'applicationBinding' | 'targetAdmission' | 'participantIds'>) => Promise<RouterAbEd25519YaoResolvedTenantRootV1>;
 }): CloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1;
 export type CloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1 = {
     activateInactiveEd25519SignerMaterialV1(input: {
+        readonly ownershipGeneration: number;
         readonly sourceContribution: OrdinaryEd25519SignerMaterialReservationPreparationV1['sourceContribution'];
         readonly reservationId: string;
     }): Promise<unknown>;
     activateInactiveEcdsaSignerMaterialV1(input: {
+        readonly ownershipGeneration: number;
         readonly preparation: OrdinaryEcdsaSignerMaterialReservationPreparationV1;
         readonly reservationId: string;
     }): Promise<unknown>;
@@ -67,6 +71,7 @@ export declare function createCloudflareOrdinaryInactiveSignerMaterialActivation
     readonly tenant: CloudflareSigningWorkerTenantV1;
 }): CloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1;
 export declare function createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1(input: {
+    readonly admitEstablishedHome: WalletExecutionAuthority['admitEstablishedHome'];
     readonly fetch: typeof fetch;
     readonly internalServiceAuthSecret: string;
     readonly tenant: CloudflareSigningWorkerTenantV1;

package/dist/types/wallet-server/src/router/domains/ecdsa/routerAbEcdsaStrictRegistration.d.ts

@@ -64,6 +64,7 @@ export type RouterAbEcdsaRegistrationRequestPolicyV1 = {
     readonly requestDigestB64u: string;
 };
 export type RouterAbEcdsaRegistrationTenantRootV1 = {
+    readonly ownershipGeneration: number;
     readonly identityDigestB64u: string;
     readonly custodyLineageB64u: string;
     readonly projectEnvironmentId: string;
@@ -145,6 +146,7 @@ export interface RouterAbEcdsaStrictPostRegistrationPort {
     }): Promise<RouterAbEcdsaStrictRefreshResult>;
 }
 export type RouterAbEcdsaCeremonyTokenClaims = {
+    readonly ownershipGeneration: number;
     readonly subjectId: string;
     readonly sessionId: string;
     readonly orgId: string;
@@ -174,6 +176,7 @@ export interface RouterAbEcdsaCeremonyTokenIssuer {
     };
 }
 type StrictRegistrationForwarderConfig = {
+    readonly internalServiceAuthSecret: string;
     readonly router: {
         fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
     };

package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoCapabilityCommit.d.ts

@@ -0,0 +1,7 @@
+import type { WalletEd25519YaoActiveCapabilityRecord } from '../../../../core/WalletStore';
+import { type RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallationV1, type RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallResultV1 } from '../recovery/routerAbEd25519YaoRecovery';
+import type { RouterAbEd25519YaoPreparedWriteV1, RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1 } from './routerAbEd25519YaoProductRegistrationPartitionedStateStore';
+/** The wallet and its initial capability become visible in the same transaction. */
+export declare function commitRouterAbEd25519YaoRegistrationCapability(store: RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, installation: RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallationV1, walletWrite: Promise<RouterAbEd25519YaoPreparedWriteV1>): Promise<RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallResultV1>;
+export declare function rehydrateRouterAbEd25519YaoCapability(store: RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, capability: WalletEd25519YaoActiveCapabilityRecord): Promise<RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallResultV1>;
+//# sourceMappingURL=routerAbEd25519YaoCapabilityCommit.d.ts.map

package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.d.ts

@@ -4,7 +4,7 @@ import { type RegistrationNearEd25519SignerPlan } from '../../../../../../shared
 import { type RouterAbEd25519YaoActivationAdmissionReceiptV1, type RouterAbEd25519YaoRegistrationAdmissionRequestV1 } from '../../../../../../shared-ts/src/utils/routerAbEd25519Yao';
 import { type RouterAbMpcMaterialActivationRefWire } from '../../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
 import type { RouterAbEd25519YaoActivationConsumerV1, RouterAbEd25519YaoActivationConsumptionRequestV1, RouterAbEd25519YaoActivationConsumptionResultV1, RouterAbEd25519YaoRegistrationServiceResult } from '../registration/routerAbEd25519YaoRegistration';
-import { InMemoryRouterAbEd25519YaoRegistrationStateV1, type RouterAbEd25519YaoRegistrationAuthorizationAdapter, type RouterAbEd25519YaoRegistrationService } from '../registration/routerAbEd25519YaoRegistration';
+import { InMemoryRouterAbEd25519YaoRegistrationStateV1, type RouterAbEd25519YaoRegistrationAuthorizationAdapter, type RouterAbEd25519YaoRegistrationAuthorizationResult, type RouterAbEd25519YaoRegistrationAuthorizationFailure, type RouterAbEd25519YaoRegistrationService } from '../registration/routerAbEd25519YaoRegistration';
 import { InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationStateV1, type RouterAbEd25519YaoVerifiedActivationIntentV1, type RouterAbEd25519YaoRegistrationIntentBindingResult } from '../registration/routerAbEd25519YaoRegistrationIntentAuthorization';
 import { type RouterApiModule } from '../../../framework/modules';
 import type { MpcWalletSigningQuotaId, WalletSessionAuthorizationId, WalletSessionId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
@@ -13,9 +13,11 @@ import { type RuntimePolicyScope } from '../../../../../../shared-ts/src/thresho
 import type { WalletAuthAuthority } from '../../../../../../shared-ts/src/utils/walletAuthAuthority';
 import type { WalletSessionOperationCredentialV1 } from '../../../../../../shared-ts/src/device-linking';
 import type { WalletRegistrationEd25519YaoBootstrapSession } from '../../../../../../shared-ts/src/utils/registrationContracts';
-import { InMemoryRouterAbEd25519YaoRecoveryStateV1, type RouterAbEd25519YaoActiveCapabilityLookupV1, type RouterAbEd25519YaoActiveCapabilityResolverV1, type RouterAbEd25519YaoPersistedActiveCapabilityInstallerV1, type RouterAbEd25519YaoRecoveryAuthorizationAdapter, type RouterAbEd25519YaoRecoveryService, type RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallerV1, type WarmBootstrapLinkedEd25519AuthorityReaderV1 } from '../recovery/routerAbEd25519YaoRecovery';
+import { InMemoryRouterAbEd25519YaoRecoveryStateV1, type RouterAbEd25519YaoActiveCapabilityLookupV1, type RouterAbEd25519YaoActiveCapabilityResolverV1, type RouterAbEd25519YaoPersistedActiveCapabilityInstallerV1, type RouterAbEd25519YaoRecoveryAuthorizationAdapter, type RouterAbEd25519YaoRecoveryService, type WarmBootstrapLinkedEd25519AuthorityReaderV1 } from '../recovery/routerAbEd25519YaoRecovery';
 import type { WalletEd25519YaoActiveCapabilityRecord } from '../../../../core/WalletStore';
 import { InMemoryRouterAbEd25519YaoExportStateV1, type RouterAbEd25519YaoExportAuthorizationAdapter, type RouterAbEd25519YaoExportService } from '../export/routerAbEd25519YaoExport';
+import { type RouterAbEd25519YaoRegistrationSigningRootIdV1, type RouterAbEd25519YaoTenantRootWireV1 } from '../routerAbEd25519YaoGatewayEnvelope';
+import type { RouterAbEd25519YaoPreparedWriteV1 } from './routerAbEd25519YaoProductRegistrationPartitionedStateStore';
 import type { DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
 /**
  * How the Ed25519 Yao session response reaches its primary credential. A
@@ -54,16 +56,47 @@ export type RouterAbEd25519YaoWalletSessionMintInputV1 = (RouterAbEd25519YaoWall
     readonly expiresAtMs: number;
     readonly remainingUses: number;
 });
-export type RouterAbEd25519YaoProductRegistrationRuntimeV1 = RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallerV1 & RouterAbEd25519YaoPersistedActiveCapabilityInstallerV1 & RouterAbEd25519YaoActiveCapabilityResolverV1 & {
+export type RouterAbEd25519YaoProductRegistrationRuntimeV1 = RouterAbEd25519YaoPersistedActiveCapabilityInstallerV1 & RouterAbEd25519YaoActiveCapabilityResolverV1 & {
     readonly kind: 'router_ab_ed25519_yao_product_registration_runtime_v1';
     readonly signingWorkerId: string;
-    bindAndAdmitVerifiedRegistration(input: RouterAbEd25519YaoVerifiedActivationIntentV1): Promise<RouterAbEd25519YaoVerifiedRegistrationAdmissionResultV1>;
+    /**
+     * Starts the tenant-root read of a registration admission. The read
+     * needs the signing root ID and epoch alone, so it can run before the
+     * proof is verified. A runtime that pins no tenant root at admission
+     * starts nothing.
+     */
+    startRegistrationDispatchRoot(signingRootId: RouterAbEd25519YaoRegistrationSigningRootIdV1): RouterAbEd25519YaoStartedDispatchRootV1 | null;
+    bindAndAdmitVerifiedRegistration(input: RouterAbEd25519YaoVerifiedActivationIntentV1, companionWrite: RouterAbEd25519YaoAdmissionCompanionWriteV1 | null, startedDispatchRoot: RouterAbEd25519YaoStartedDispatchRootV1 | null): Promise<RouterAbEd25519YaoVerifiedRegistrationAdmissionResultV1>;
     bindVerifiedIntent(input: RouterAbEd25519YaoVerifiedActivationIntentV1): Promise<RouterAbEd25519YaoRegistrationIntentBindingResult>;
     consumeActivated(request: RouterAbEd25519YaoActivationConsumptionRequestV1): Promise<RouterAbEd25519YaoActivationConsumptionResultV1>;
 };
+/** A tenant-root read in flight, with the signing root ID that it was started for. */
+export type RouterAbEd25519YaoStartedDispatchRootV1 = {
+    readonly signingRootId: RouterAbEd25519YaoRegistrationSigningRootIdV1;
+    readonly dispatchRoot: Promise<RouterAbEd25519YaoTenantRootWireV1>;
+};
+/**
+ * Prepares another store's write for the admission request that was bound.
+ * It commits in the batch of a new admission, or it does not run.
+ */
+export type RouterAbEd25519YaoAdmissionCompanionWriteV1 = (admissionRequest: RouterAbEd25519YaoRegistrationAdmissionRequestV1) => RouterAbEd25519YaoPreparedWriteV1;
 export type RouterAbEd25519YaoVerifiedRegistrationAdmissionResultV1 = Extract<RouterAbEd25519YaoRegistrationIntentBindingResult, {
     readonly ok: false;
-}> | RouterAbEd25519YaoRegistrationServiceResult<RouterAbEd25519YaoActivationAdmissionReceiptV1<'registration'>>;
+}> | Extract<RouterAbEd25519YaoRegistrationAuthorizationResult, {
+    readonly ok: false;
+}> | Extract<RouterAbEd25519YaoRegistrationServiceResult<never>, {
+    readonly ok: false;
+}> | {
+    readonly ok: true;
+    readonly status: 200;
+    readonly admissionRequest: RouterAbEd25519YaoRegistrationAdmissionRequestV1;
+    readonly value: RouterAbEd25519YaoActivationAdmissionReceiptV1<'registration'>;
+    /**
+     * `not_committed` when the admission already existed, or when this
+     * runtime has no batch to share: the caller then writes for itself.
+     */
+    readonly companionWrite: 'committed' | 'not_committed';
+};
 export type RouterAbEd25519YaoProductRegistrationCompositionV1 = {
     readonly kind: 'router_ab_ed25519_yao_product_registration_composition_v1';
     readonly registrationService: RouterAbEd25519YaoProductRegistrationServicePortV1;
@@ -78,9 +111,10 @@ export type RouterAbEd25519YaoProductRegistrationCompositionV1 = {
 export interface RouterAbEd25519YaoProductRegistrationServicePortV1 extends RouterAbEd25519YaoRegistrationService, RouterAbEd25519YaoActivationConsumerV1 {
 }
 export interface RouterAbEd25519YaoProductRegistrationAuthorizationPortV1 extends RouterAbEd25519YaoRegistrationAuthorizationAdapter {
+    bindAndAuthorizeAdmission(input: RouterAbEd25519YaoVerifiedActivationIntentV1): Promise<RouterAbEd25519YaoRegistrationIntentBindingResult | RouterAbEd25519YaoRegistrationAuthorizationFailure>;
     bindVerifiedIntent(input: RouterAbEd25519YaoVerifiedActivationIntentV1): Promise<RouterAbEd25519YaoRegistrationIntentBindingResult>;
 }
-export interface RouterAbEd25519YaoProductRecoveryServicePortV1 extends RouterAbEd25519YaoRecoveryService, RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallerV1, RouterAbEd25519YaoPersistedActiveCapabilityInstallerV1, RouterAbEd25519YaoActiveCapabilityResolverV1 {
+export interface RouterAbEd25519YaoProductRecoveryServicePortV1 extends RouterAbEd25519YaoRecoveryService, RouterAbEd25519YaoPersistedActiveCapabilityInstallerV1, RouterAbEd25519YaoActiveCapabilityResolverV1 {
 }
 export type RouterAbEd25519YaoProductRegistrationPortsV1 = {
     readonly signingWorkerId: string;
@@ -130,7 +164,7 @@ export declare function createRouterAbEd25519YaoProductRegistrationRuntimeV1(inp
     readonly signingWorkerId: string;
     readonly registrationService: RouterAbEd25519YaoProductRegistrationServicePortV1;
     readonly authorization: RouterAbEd25519YaoProductRegistrationAuthorizationPortV1;
-    readonly capabilityInstaller: RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallerV1 & RouterAbEd25519YaoPersistedActiveCapabilityInstallerV1;
+    readonly capabilityInstaller: RouterAbEd25519YaoPersistedActiveCapabilityInstallerV1;
     readonly capabilityResolver: RouterAbEd25519YaoActiveCapabilityResolverV1;
 }): RouterAbEd25519YaoProductRegistrationRuntimeV1;
 export declare function routerAbEd25519YaoPersistedCapabilityMatchesLookupV1(capability: WalletEd25519YaoActiveCapabilityRecord, lookup: RouterAbEd25519YaoActiveCapabilityLookupV1): boolean;

package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore.d.ts

@@ -1,5 +1,6 @@
 import type { VersionedJsonObject, VersionedJsonRecordReadResult } from '../../../framework/versionedJsonRecordStore';
-import type { D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import type { D1PreparedStatementLike, D1ResultLike } from '../../../../storage/tenantRoute';
+import type { InMemoryRouterAbEd25519YaoRecoveryStateV1 } from '../recovery/routerAbEd25519YaoRecovery';
 import { type RouterAbEd25519YaoRegistrationExecutionAuthorityV1 } from '../registration/routerAbEd25519YaoRegistrationExecutionRecord';
 import type { RouterAbEd25519YaoProductRegistrationStateV1 } from './routerAbEd25519YaoProductRegistration';
 import { type RouterAbEd25519YaoProductRegistrationCeremonyStateV1, type RouterAbEd25519YaoProductRegistrationSharedStateV1 } from './routerAbEd25519YaoProductRegistrationPartitioning';
@@ -35,6 +36,7 @@ export type RouterAbEd25519YaoProductRegistrationPartitionBatchResultV1 = {
  */
 export type RouterAbEd25519YaoPreparedWriteV1 = {
     readonly statements: readonly D1PreparedStatementLike[];
+    readonly executeBatch?: (statements: readonly D1PreparedStatementLike[]) => Promise<readonly D1ResultLike[]>;
 };
 export type RouterAbEd25519YaoProductRegistrationPartitionRecordStoreV1 = {
     readonly readMany: (keys: readonly string[]) => Promise<readonly {
@@ -71,7 +73,36 @@ export type RouterAbEd25519YaoProductRegistrationPartitionedStateCommitResultV1
     readonly kind: 'version_mismatch';
     readonly key: 'shared' | 'ceremony';
 };
+/** Registration changes only its own ceremony. Shared capabilities are inaccessible here. */
+export type RouterAbEd25519YaoRegistrationCeremonySnapshotV1 = {
+    readonly lifecycleId: string;
+    readonly state: {
+        readonly registration: RouterAbEd25519YaoProductRegistrationStateV1['registration'];
+        readonly authorization: RouterAbEd25519YaoProductRegistrationStateV1['authorization'];
+        readonly recovery?: never;
+        readonly export?: never;
+    };
+    readonly baseline: {
+        readonly version: string | null;
+        readonly recovery: RouterAbEd25519YaoProductRegistrationCeremonyStateV1['recovery'];
+        readonly export: RouterAbEd25519YaoProductRegistrationCeremonyStateV1['export'];
+    };
+};
+export type RouterAbEd25519YaoCapabilitySnapshotV1 = {
+    readonly value: RouterAbEd25519YaoProductRegistrationSharedStateV1;
+    readonly version: string | null;
+};
+export type RouterAbEd25519YaoCapabilityMutationV1 = {
+    readonly capabilities: InMemoryRouterAbEd25519YaoRecoveryStateV1['capabilities'];
+    readonly identityCapabilities: InMemoryRouterAbEd25519YaoRecoveryStateV1['identityCapabilities'];
+    readonly recoveries?: never;
+    readonly recoverySessions?: never;
+};
 export interface RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1 {
+    loadCapabilities(): Promise<RouterAbEd25519YaoCapabilitySnapshotV1>;
+    commitCapabilities(snapshot: RouterAbEd25519YaoCapabilitySnapshotV1, mutation: RouterAbEd25519YaoCapabilityMutationV1, companionWrite: RouterAbEd25519YaoPreparedWriteV1 | null): Promise<RouterAbEd25519YaoProductRegistrationPartitionBatchResultV1>;
+    loadRegistration(lifecycleId: string): Promise<RouterAbEd25519YaoRegistrationCeremonySnapshotV1>;
+    commitRegistration(snapshot: RouterAbEd25519YaoRegistrationCeremonySnapshotV1, companionWrite: RouterAbEd25519YaoPreparedWriteV1 | null): Promise<RouterAbEd25519YaoProductRegistrationPartitionBatchResultV1>;
     load(lifecycleId: string): Promise<RouterAbEd25519YaoProductRegistrationPartitionedStateV1>;
     commit(input: RouterAbEd25519YaoProductRegistrationPartitionedStateCommitInputV1): Promise<RouterAbEd25519YaoProductRegistrationPartitionedStateCommitResultV1>;
 }
@@ -87,7 +118,7 @@ export declare function createRouterAbEd25519YaoProductRegistrationPartitionedSt
  * The admitted authority a registration execute is checked against, from a
  * loaded ceremony state, or `null` when the lifecycle is not admitted.
  */
-export declare function routerAbEd25519YaoAdmittedRegistrationAuthorityV1(state: RouterAbEd25519YaoProductRegistrationStateV1, lifecycleId: string): RouterAbEd25519YaoRegistrationExecutionAuthorityV1 | null;
+export declare function routerAbEd25519YaoAdmittedRegistrationAuthorityV1(state: RouterAbEd25519YaoRegistrationCeremonySnapshotV1['state'], lifecycleId: string): RouterAbEd25519YaoRegistrationExecutionAuthorityV1 | null;
 export declare function encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1(record: RouterAbEd25519YaoProductRegistrationPartitionRecordV1): VersionedJsonObject;
 export declare function sameRouterAbEd25519YaoSharedStateCanonicalEncodingV1(left: RouterAbEd25519YaoSharedStateCanonicalEncodingV1, right: RouterAbEd25519YaoSharedStateCanonicalEncodingV1): boolean;
 export declare function parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1(input: unknown): RouterAbEd25519YaoProductRegistrationPartitionRecordV1 | null;

package/dist/types/wallet-server/src/router/domains/ed25519Yao/export/routerAbEd25519YaoExport.d.ts

@@ -1,3 +1,4 @@
+import type { WalletExecutionAuthority } from '../../walletRegistration/walletRegistrationReservation';
 import { type RouterAbEd25519YaoExportAdmissionReceiptV1, type RouterAbEd25519YaoExportAdmissionRequestV1, type RouterAbEd25519YaoExportExecuteRequestV1, type RouterAbEd25519YaoExportResultV1 } from '../../../../../../shared-ts/src/utils/routerAbEd25519Yao';
 import { type RouterAbTraceContextV1 } from '../../../../../../shared-ts/src/utils/routerAbTraceContext';
 import { type ThresholdEd25519SessionId } from '../../../../../../shared-ts/src/utils/domainIds';
@@ -29,10 +30,10 @@ export type RouterAbEd25519YaoExportBackendResult = {
 };
 export interface RouterAbEd25519YaoExportBackend {
     admitExport(request: RouterAbEd25519YaoExportAdmissionRequestV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoExportBackendResult> | RouterAbEd25519YaoExportBackendResult;
-    executeExport(request: RouterAbEd25519YaoExportExecuteRequestV1, admissionRequest: RouterAbEd25519YaoExportExecuteAdmissionContextV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoExportBackendResult> | RouterAbEd25519YaoExportBackendResult;
+    executeExport(request: RouterAbEd25519YaoExportExecuteRequestV1, claim: RouterAbEd25519YaoExportExecuteClaimV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoExportBackendResult> | RouterAbEd25519YaoExportBackendResult;
 }
 export interface RouterAbEd25519YaoExportService {
-    admitExport(request: RouterAbEd25519YaoExportAdmissionRequestV1, authorizationIdentity: RouterAbEd25519YaoExportServerAuthorizationIdentityV1, admission: RouterAbEd25519YaoExportOperationAdmissionV1, factorRelease: RouterAbEd25519YaoExportEmailOtpFactorReleaseV1 | null, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoExportServiceResult<RouterAbEd25519YaoExportAdmissionReceiptV1>>;
+    admitExport(request: RouterAbEd25519YaoExportAdmissionRequestV1, authorizationIdentity: RouterAbEd25519YaoExportServerAuthorizationIdentityV1, ownershipGeneration: number, admission: RouterAbEd25519YaoExportOperationAdmissionV1, factorRelease: RouterAbEd25519YaoExportEmailOtpFactorReleaseV1 | null, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoExportServiceResult<RouterAbEd25519YaoExportAdmissionReceiptV1>>;
     executeExport(request: RouterAbEd25519YaoExportExecuteRequestV1, authorizationIdentity: RouterAbEd25519YaoExportServerAuthorizationIdentityV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoExportServiceResult<RouterAbEd25519YaoExportResultV1>>;
 }
 /**
@@ -77,6 +78,7 @@ export type RouterAbEd25519YaoExportExecuteClaimV1 = {
     readonly sessionId: string;
     readonly executeFingerprint: string;
     readonly admissionRequest: RouterAbEd25519YaoExportExecuteAdmissionContextV1;
+    readonly ownershipGeneration: number;
 };
 export type RouterAbEd25519YaoExportExecutePreparationV1 = {
     readonly kind: 'claimed';
@@ -131,6 +133,7 @@ export type RouterAbEd25519YaoExportAuthorizationResult = {
     readonly factorRelease?: RouterAbEd25519YaoExportEmailOtpFactorReleaseV1;
 } | {
     readonly ok: false;
+    readonly ownershipGeneration?: never;
     readonly status: 401 | 403 | 409 | 429 | 503;
     readonly code: string;
     readonly message: string;
@@ -167,6 +170,7 @@ export type RouterAbEd25519YaoExportAdmissionAuthorizationResultV1 = {
     readonly ok: true;
     readonly authorizationIdentity: RouterAbEd25519YaoExportServerAuthorizationIdentityV1;
     readonly admission: RouterAbEd25519YaoExportOperationAdmissionV1;
+    readonly ownershipGeneration: number;
     readonly factorRelease?: RouterAbEd25519YaoExportEmailOtpFactorReleaseV1;
 } | RouterAbEd25519YaoExportAuthorizationFailure;
 export type RouterAbEd25519YaoExportAuthorizationIdentityResolutionResult = {
@@ -182,6 +186,7 @@ export interface RouterAbEd25519YaoExportAuthorizationAdapter {
     resolveAuthorizationIdentity(body: RouterAbEd25519YaoExportAdmissionRequestV1): Promise<RouterAbEd25519YaoExportAuthorizationIdentityResolutionResult> | RouterAbEd25519YaoExportAuthorizationIdentityResolutionResult;
 }
 type ExportAuthorizationContext = {
+    readonly ownershipGeneration: number;
     readonly request: RouterAbEd25519YaoExportAdmissionRequestV1;
     readonly authorizationFingerprint: string;
     readonly authorizationIdentity: RouterAbEd25519YaoExportServerAuthorizationIdentityV1;
@@ -235,15 +240,15 @@ export declare class InMemoryRouterAbEd25519YaoExportService implements RouterAb
     constructor(backend: RouterAbEd25519YaoExportBackend, capabilities: RouterAbEd25519YaoActiveCapabilityResolverV1, state?: InMemoryRouterAbEd25519YaoExportStateV1);
     authorizationIsUncertain(request: RouterAbEd25519YaoExportAdmissionRequestV1): boolean;
     recordAuthorizationUncertain(request: RouterAbEd25519YaoExportAdmissionRequestV1): void;
-    admitExport(request: RouterAbEd25519YaoExportAdmissionRequestV1, authorizationIdentity: RouterAbEd25519YaoExportServerAuthorizationIdentityV1, admission: RouterAbEd25519YaoExportOperationAdmissionV1, factorRelease: RouterAbEd25519YaoExportEmailOtpFactorReleaseV1 | null, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoExportServiceResult<RouterAbEd25519YaoExportAdmissionReceiptV1>>;
+    admitExport(request: RouterAbEd25519YaoExportAdmissionRequestV1, authorizationIdentity: RouterAbEd25519YaoExportServerAuthorizationIdentityV1, ownershipGeneration: number, admission: RouterAbEd25519YaoExportOperationAdmissionV1, factorRelease: RouterAbEd25519YaoExportEmailOtpFactorReleaseV1 | null, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoExportServiceResult<RouterAbEd25519YaoExportAdmissionReceiptV1>>;
     /**
      * Authorizes one export: its nonce claimed and its state `authorized`, in
      * this state for the caller to commit with the export's operation
      * admission. An export already here answers from its state instead, with
      * the factor release it recorded.
      */
-    authorizeExport(request: RouterAbEd25519YaoExportAdmissionRequestV1, authorizationFingerprint: string, authorizationIdentity: RouterAbEd25519YaoExportServerAuthorizationIdentityV1, factorRelease: RouterAbEd25519YaoExportEmailOtpFactorReleaseV1 | null): RouterAbEd25519YaoExportAuthorizationDecisionV1;
-    readAuthorizationIdentity(request: RouterAbEd25519YaoExportAdmissionRequestV1): RouterAbEd25519YaoExportServerAuthorizationIdentityV1 | null;
+    authorizeExport(request: RouterAbEd25519YaoExportAdmissionRequestV1, authorizationFingerprint: string, authorizationIdentity: RouterAbEd25519YaoExportServerAuthorizationIdentityV1, ownershipGeneration: number, factorRelease: RouterAbEd25519YaoExportEmailOtpFactorReleaseV1 | null): RouterAbEd25519YaoExportAuthorizationDecisionV1;
+    readAdmissionAuthority(request: RouterAbEd25519YaoExportAdmissionRequestV1): Pick<ExportAuthorizationContext, 'authorizationIdentity' | 'ownershipGeneration'> | null;
     prepareAdmitExport(request: RouterAbEd25519YaoExportAdmissionRequestV1, _authorizationIdentity: RouterAbEd25519YaoExportServerAuthorizationIdentityV1): Promise<RouterAbEd25519YaoExportAdmissionPreparationV1>;
     commitAdmitExport(input: RouterAbEd25519YaoExportAdmissionCommitInputV1): RouterAbEd25519YaoExportServiceResult<RouterAbEd25519YaoExportAdmissionReceiptV1>;
     executeExport(request: RouterAbEd25519YaoExportExecuteRequestV1, authorizationIdentity: RouterAbEd25519YaoExportServerAuthorizationIdentityV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoExportServiceResult<RouterAbEd25519YaoExportResultV1>>;
@@ -261,7 +266,8 @@ export declare class RouterAbEd25519YaoExportOwnerProofAuthorizationAdapter impl
     private readonly walletAuthMethods;
     private readonly authorizedOperations;
     private readonly resolveEd25519MaterialActivation;
-    constructor(webAuthn: Pick<RouterApiWebAuthnService, 'verifyWebAuthnAuthenticationLite'>, emailOtp: Pick<RouterApiEmailOtpRouteService, 'verifyEmailOtpChallenge'>, walletAuthMethods: Pick<RouterApiWalletAuthMethodService, 'resolveActivePasskeyAuthorityForVerifiedCredential' | 'resolveActiveEmailOtpAuthorityForVerifiedMethod'>, authorizedOperations: RouterApiAuthorizedOperationService, resolveEd25519MaterialActivation: RouterApiWalletRegistrationService['resolveEd25519MaterialActivation']);
+    private readonly admitEstablishedHome;
+    constructor(webAuthn: Pick<RouterApiWebAuthnService, 'verifyWebAuthnAuthenticationLite'>, emailOtp: Pick<RouterApiEmailOtpRouteService, 'verifyEmailOtpChallenge'>, walletAuthMethods: Pick<RouterApiWalletAuthMethodService, 'resolveActivePasskeyAuthorityForVerifiedCredential' | 'resolveActiveEmailOtpAuthorityForVerifiedMethod'>, authorizedOperations: RouterApiAuthorizedOperationService, resolveEd25519MaterialActivation: RouterApiWalletRegistrationService['resolveEd25519MaterialActivation'], admitEstablishedHome: WalletExecutionAuthority['admitEstablishedHome']);
     authorizeAdmission(input: RouterAbEd25519YaoExportAdmissionAuthorizationInputV1): Promise<RouterAbEd25519YaoExportAdmissionAuthorizationResultV1>;
     authorizeExecution(input: RouterAbEd25519YaoExportExecutionAuthorizationInputV1): RouterAbEd25519YaoExportAuthorizationIdentityResolutionResult;
     resolveAuthorizationIdentity(body: RouterAbEd25519YaoExportAdmissionRequestV1): Promise<RouterAbEd25519YaoExportAuthorizationIdentityResolutionResult>;

package/dist/types/wallet-server/src/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery.d.ts

@@ -41,6 +41,8 @@ type RouterAbEd25519YaoRecoveryAuthorityProjectionV1 = {
     readonly kind: 'replace_active_authority_projection';
 };
 type RouterAbEd25519YaoRecoveryAuthorizationBindingV1 = {
+    readonly ownershipGeneration: number;
+} & ({
     readonly kind: 'wallet_recovery';
     readonly walletId: string;
 } | {
@@ -54,7 +56,7 @@ type RouterAbEd25519YaoRecoveryAuthorizationBindingV1 = {
     readonly authorizationId: RouterApiWalletSessionAuthorizationV2AdmissionContext['authorization']['session']['authorizationId'];
     readonly walletSessionId: RouterApiWalletSessionAuthorizationV2AdmissionContext['authorization']['session']['walletSessionId'];
     readonly quotaId: RouterApiWalletSessionAuthorizationV2AdmissionContext['authorization']['session']['quotaId'];
-};
+});
 export interface RouterAbEd25519YaoRecoveryBackend {
     admitRecovery(request: RouterAbEd25519YaoRecoveryAdmissionRequestV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRecoveryBackendResult> | RouterAbEd25519YaoRecoveryBackendResult;
     /**
@@ -68,11 +70,12 @@ export interface RouterAbEd25519YaoRecoveryBackend {
      * the Router, which then reconciles the roles' records instead of starting
      * fresh.
      */
-    executeRecovery(request: RecoveryExecuteRequest, admissionRequest: RouterAbEd25519YaoRecoveryExecuteAdmissionContextV1, dispatchRoot: RouterAbEd25519YaoTenantRootWireV1, attempt: number, replay: boolean, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRecoveryBackendResult> | RouterAbEd25519YaoRecoveryBackendResult;
+    executeRecovery(request: RecoveryExecuteRequest, claim: RouterAbEd25519YaoRecoveryExecuteClaimV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRecoveryBackendResult> | RouterAbEd25519YaoRecoveryBackendResult;
     /** Promotes the recovery at the SigningWorker of the attempt's tenant root. */
-    activateRecovery(request: RouterAbEd25519YaoRecoveryActivationRequestV1, dispatchRoot: RouterAbEd25519YaoTenantRootWireV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRecoveryBackendResult> | RouterAbEd25519YaoRecoveryBackendResult;
+    activateRecovery(request: RouterAbEd25519YaoRecoveryActivationRequestV1, dispatchRoot: RouterAbEd25519YaoTenantRootWireV1, ownershipGeneration: number, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRecoveryBackendResult> | RouterAbEd25519YaoRecoveryBackendResult;
 }
 export interface RouterAbEd25519YaoRecoveryService {
+    recoveryOwnershipGeneration(binding: RecoveryExecuteRequest['binding']): RouterAbEd25519YaoRecoveryServiceResult<number>;
     admitRecovery(request: RouterAbEd25519YaoRecoveryAdmissionRequestV1, authorization: RouterAbEd25519YaoRecoveryAuthorizationBindingV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRecoveryServiceResult<RecoveryAdmissionReceipt>>;
     executeRecovery(request: RecoveryExecuteRequest, authorization: RouterAbEd25519YaoRecoveryAuthorizationBindingV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRecoveryServiceResult<RecoveryExecutionResult>>;
     activateRecovery(request: RouterAbEd25519YaoRecoveryActivationRequestV1, authorization: RouterAbEd25519YaoRecoveryAuthorizationBindingV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRecoveryServiceResult<RouterAbEd25519YaoRecoveryActivationReceiptV1>>;
@@ -106,6 +109,7 @@ interface RouterAbEd25519YaoRecoveryAdmissionBoundaryV1 {
 }
 export type RouterAbEd25519YaoRecoveryExecuteClaimV1 = {
     readonly kind: 'router_ab_ed25519_yao_recovery_execute_claim_v1';
+    readonly ownershipGeneration: number;
     readonly lifecycleId: string;
     readonly recoveryKey: string;
     readonly sessionId: string;
@@ -140,6 +144,7 @@ interface RouterAbEd25519YaoRecoveryExecuteBoundaryV1 {
     commitExecuteRecovery(input: RouterAbEd25519YaoRecoveryExecuteCommitInputV1): RouterAbEd25519YaoRecoveryServiceResult<RecoveryExecutionResult>;
 }
 export type RouterAbEd25519YaoRecoveryActivationClaimV1 = {
+    readonly ownershipGeneration: number;
     readonly kind: 'router_ab_ed25519_yao_recovery_activation_claim_v1';
     readonly lifecycleId: string;
     readonly recoveryKey: string;
@@ -201,15 +206,18 @@ export type RouterAbEd25519YaoRecoveryAuthorizationInput = {
     readonly body: RouterAbEd25519YaoRecoveryAdmissionRequestV1;
 } | {
     readonly kind: 'execute';
+    readonly ownershipGeneration: number;
     readonly request: Request;
     readonly body: RecoveryExecuteRequest;
 } | {
     readonly kind: 'activate';
+    readonly ownershipGeneration: number;
     readonly request: Request;
     readonly body: RouterAbEd25519YaoRecoveryActivationRequestV1;
 };
 export type RouterAbEd25519YaoRecoveryAuthorizationResult = {
     readonly ok: true;
+    readonly ownershipGeneration: number;
     readonly authorization: {
         readonly kind: 'wallet_session_v2';
         readonly context: RouterApiWalletSessionAuthorizationV2AdmissionContext;
@@ -222,13 +230,14 @@ export type RouterAbEd25519YaoRecoveryAuthorizationResult = {
     };
 } | {
     readonly ok: false;
+    readonly ownershipGeneration?: never;
     readonly status: 401 | 403 | 409 | 429 | 503;
     readonly code: string;
     readonly message: string;
 };
-export declare function recoveryAuthorizationBinding(authorization: Extract<RouterAbEd25519YaoRecoveryAuthorizationResult, {
+export declare function recoveryAuthorizationBinding(admitted: Extract<RouterAbEd25519YaoRecoveryAuthorizationResult, {
     readonly ok: true;
-}>['authorization']): RouterAbEd25519YaoRecoveryAuthorizationBindingV1;
+}>): RouterAbEd25519YaoRecoveryAuthorizationBindingV1;
 type WarmBootstrapWalletSessionContext = {
     readonly session: RouterApiWalletSessionAuthorizationV2AdmissionContext['authorization']['session'];
     readonly quota: RouterApiWalletSessionAuthorizationV2AdmissionContext['authorization']['quota'] | RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext['status']['quota'];
@@ -259,9 +268,6 @@ export type RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallResultV1 = {
     readonly code: 'invalid_installation' | 'capability_conflict' | 'capability_retired';
     readonly message: string;
 };
-export interface RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallerV1 {
-    installRegistrationFinalizeCapability(input: RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallationV1): Promise<RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallResultV1> | RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallResultV1;
-}
 export interface RouterAbEd25519YaoPersistedActiveCapabilityInstallerV1 {
     installPersistedActiveCapability(input: WalletEd25519YaoActiveCapabilityRecord): Promise<RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallResultV1> | RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallResultV1;
 }
@@ -540,7 +546,8 @@ type RouterAbEd25519YaoActiveCapabilityRecordBuildResultV1 = {
     readonly ok: false;
 }>;
 export declare function buildRouterAbEd25519YaoRegistrationCapabilityRecordV1(input: RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallationV1): RouterAbEd25519YaoActiveCapabilityRecordBuildResultV1;
-export declare class InMemoryRouterAbEd25519YaoRecoveryService implements RouterAbEd25519YaoRecoveryService, RouterAbEd25519YaoRecoveryAdmissionBoundaryV1, RouterAbEd25519YaoRecoveryExecuteBoundaryV1, RouterAbEd25519YaoRecoveryActivationBoundaryV1, RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallerV1, RouterAbEd25519YaoPersistedActiveCapabilityInstallerV1, RouterAbEd25519YaoActiveCapabilityResolverV1 {
+export declare function resolveRouterAbEd25519YaoActiveCapability(capabilities: ReadonlyMap<string, CapabilityState>, input: RouterAbEd25519YaoActiveCapabilityLookupV1): RouterAbEd25519YaoActiveCapabilityLookupResultV1;
+export declare class InMemoryRouterAbEd25519YaoRecoveryService implements RouterAbEd25519YaoRecoveryService, RouterAbEd25519YaoRecoveryAdmissionBoundaryV1, RouterAbEd25519YaoRecoveryExecuteBoundaryV1, RouterAbEd25519YaoRecoveryActivationBoundaryV1, RouterAbEd25519YaoPersistedActiveCapabilityInstallerV1, RouterAbEd25519YaoActiveCapabilityResolverV1 {
     private readonly backend;
     private readonly capabilityPersistence;
     private readonly capabilities;
@@ -557,6 +564,7 @@ export declare class InMemoryRouterAbEd25519YaoRecoveryService implements Router
     prepareAdmitRecovery(request: RouterAbEd25519YaoRecoveryAdmissionRequestV1, authorization: RouterAbEd25519YaoRecoveryAuthorizationBindingV1, dispatchRoot: RouterAbEd25519YaoTenantRootWireV1, nowMs: number): RouterAbEd25519YaoRecoveryAdmissionPreparationV1;
     commitAdmitRecovery(input: RouterAbEd25519YaoRecoveryAdmissionCommitInputV1): RouterAbEd25519YaoRecoveryServiceResult<RecoveryAdmissionReceipt>;
     executeRecovery(request: RecoveryExecuteRequest, authorization: RouterAbEd25519YaoRecoveryAuthorizationBindingV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRecoveryServiceResult<RecoveryExecutionResult>>;
+    recoveryOwnershipGeneration(binding: RecoveryExecuteRequest['binding']): RouterAbEd25519YaoRecoveryServiceResult<number>;
     prepareExecuteRecovery(request: RecoveryExecuteRequest, authorization: RouterAbEd25519YaoRecoveryAuthorizationBindingV1, nowMs: number): RouterAbEd25519YaoRecoveryExecutePreparationV1;
     commitExecuteRecovery(input: RouterAbEd25519YaoRecoveryExecuteCommitInputV1): RouterAbEd25519YaoRecoveryServiceResult<RecoveryExecutionResult>;
     activateRecovery(request: RouterAbEd25519YaoRecoveryActivationRequestV1, authorization: RouterAbEd25519YaoRecoveryAuthorizationBindingV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRecoveryServiceResult<RouterAbEd25519YaoRecoveryActivationReceiptV1>>;

package/dist/types/wallet-server/src/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryWalletSessionAuthorization.d.ts

@@ -1,3 +1,4 @@
+import type { WalletExecutionAuthority } from '../../walletRegistration/walletRegistrationReservation';
 import type { RouterApiAuthorizationSessionService, RouterApiWalletRegistrationService } from '../../../framework/authServicePort';
 import type { PreparedEd25519RecoveryAdmissionV1 } from '../../passkeyCustody/walletRecoveryKeyManifest';
 import type { RouterAbEd25519YaoRecoveryAuthorizationAdapter, RouterAbEd25519YaoRecoveryAuthorizationInput, RouterAbEd25519YaoRecoveryAuthorizationResult } from './routerAbEd25519YaoRecovery';
@@ -8,6 +9,7 @@ export interface PreparedEd25519RecoveryAdmissionReaderV1 {
     }): Promise<PreparedEd25519RecoveryAdmissionV1 | null>;
 }
 export type RouterAbEd25519YaoRecoveryAuthorizationServicesV1 = {
+    readonly admitEstablishedHome: WalletExecutionAuthority['admitEstablishedHome'];
     readonly authorizationSessions: RouterApiAuthorizationSessionService;
     readonly preparedRecoveryAdmission: PreparedEd25519RecoveryAdmissionReaderV1;
     readonly resolveEd25519MaterialActivation: RouterApiWalletRegistrationService['resolveEd25519MaterialActivation'];

package/dist/types/wallet-server/src/router/domains/ed25519Yao/registration/routerAbEd25519YaoHttpRegistrationBackend.d.ts

@@ -1,8 +1,9 @@
+import type { RouterAbEd25519YaoRegistrationExecutionAuthorityV1 } from './routerAbEd25519YaoRegistrationExecutionRecord';
 import { type RouterAbEd25519YaoActivationExecuteRequestV1, type RouterAbEd25519YaoActivationKeysetV1, type RouterAbEd25519YaoRecoveryActivationRequestV1, type RouterAbEd25519YaoRecoveryAdmissionRequestV1, type RouterAbEd25519YaoRegistrationAdmissionRequestV1, type RouterAbEd25519YaoExportAdmissionRequestV1, type RouterAbEd25519YaoExportExecuteRequestV1 } from '../../../../../../shared-ts/src/utils/routerAbEd25519Yao';
 import type { RouterAbEd25519YaoRegistrationBackend, RouterAbEd25519YaoRegistrationBackendResult } from './routerAbEd25519YaoRegistration';
-import type { RouterAbEd25519YaoExportBackend } from '../export/routerAbEd25519YaoExport';
-import type { RouterAbEd25519YaoRecoveryBackend } from '../recovery/routerAbEd25519YaoRecovery';
-import { type RouterAbEd25519YaoTenantRootResolverV1, type RouterAbEd25519YaoTenantRootWireV1 } from '../routerAbEd25519YaoGatewayEnvelope';
+import type { RouterAbEd25519YaoExportBackend, RouterAbEd25519YaoExportExecuteClaimV1 } from '../export/routerAbEd25519YaoExport';
+import type { RouterAbEd25519YaoRecoveryBackend, RouterAbEd25519YaoRecoveryExecuteClaimV1 } from '../recovery/routerAbEd25519YaoRecovery';
+import { type RouterAbEd25519YaoRegistrationSigningRootIdV1, type RouterAbEd25519YaoTenantRootResolverV1, type RouterAbEd25519YaoTenantRootWireV1 } from '../routerAbEd25519YaoGatewayEnvelope';
 import { type RouterAbTraceContextV1 } from '../../../../../../shared-ts/src/utils/routerAbTraceContext';
 type RouterAbEd25519YaoRegistrationExecuteRequestV1 = RouterAbEd25519YaoActivationExecuteRequestV1<'registration'>;
 type RouterAbEd25519YaoRecoveryExecuteRequestV1 = RouterAbEd25519YaoActivationExecuteRequestV1<'recovery'>;
@@ -28,14 +29,12 @@ export type RouterAbEd25519YaoGatewaySpanV1 = {
 export type RouterAbEd25519YaoHttpRegistrationBackendRawEnv = Readonly<Record<string, unknown>>;
 export declare function parseRouterAbEd25519YaoActivationKeysetFromEnvV1(env: RouterAbEd25519YaoHttpRegistrationBackendRawEnv): RouterAbEd25519YaoActivationKeysetV1;
 export interface RouterAbEd25519YaoPinnedRegistrationBackend extends RouterAbEd25519YaoRegistrationBackend {
-    resolveRegistrationDispatchRoot(admissionRequest: RouterAbEd25519YaoRegistrationAdmissionRequestV1): Promise<RouterAbEd25519YaoTenantRootWireV1>;
-    executePinnedRegistration(request: RouterAbEd25519YaoRegistrationExecuteRequestV1, admissionRequest: RouterAbEd25519YaoRegistrationAdmissionRequestV1, dispatchRoot: RouterAbEd25519YaoTenantRootWireV1, traceContext: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationBackendResult>;
+    resolveRegistrationDispatchRoot(signingRootId: RouterAbEd25519YaoRegistrationSigningRootIdV1): Promise<RouterAbEd25519YaoTenantRootWireV1>;
+    executePinnedRegistration(request: RouterAbEd25519YaoRegistrationExecuteRequestV1, authority: RouterAbEd25519YaoRegistrationExecutionAuthorityV1, traceContext: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationBackendResult>;
     consumeRegistration(input: RouterAbEd25519YaoRegistrationConsumeInputV1): Promise<RouterAbEd25519YaoRegistrationConsumeOutcomeV1>;
 }
 export type RouterAbEd25519YaoRegistrationConsumeInputV1 = {
-    readonly tenantRoot: RouterAbEd25519YaoTenantRootWireV1;
-    readonly walletId: string;
-    readonly lifecycleId: string;
+    readonly authority: RouterAbEd25519YaoRegistrationExecutionAuthorityV1;
     readonly sessionId: readonly number[];
     readonly consumerBinding: string;
 };
@@ -61,18 +60,18 @@ export declare class RouterAbEd25519YaoHttpRegistrationBackend implements Router
     admit(request: RouterAbEd25519YaoRegistrationAdmissionRequestV1, _traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationBackendResult>;
     admitRecovery(request: RouterAbEd25519YaoRecoveryAdmissionRequestV1, _traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationBackendResult>;
     admitExport(request: RouterAbEd25519YaoExportAdmissionRequestV1, _traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationBackendResult>;
-    executeExport(request: RouterAbEd25519YaoExportExecuteRequestV1, admissionRequest: RouterAbEd25519YaoExportAdmissionRequestV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationBackendResult>;
+    executeExport(request: RouterAbEd25519YaoExportExecuteRequestV1, claim: RouterAbEd25519YaoExportExecuteClaimV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationBackendResult>;
     private keyset;
     private admitActivation;
-    execute(request: RouterAbEd25519YaoRegistrationExecuteRequestV1, admissionRequest: RouterAbEd25519YaoRegistrationAdmissionRequestV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationBackendResult>;
-    resolveRegistrationDispatchRoot(admissionRequest: RouterAbEd25519YaoRegistrationAdmissionRequestV1): Promise<RouterAbEd25519YaoTenantRootWireV1>;
-    executePinnedRegistration(request: RouterAbEd25519YaoRegistrationExecuteRequestV1, admissionRequest: RouterAbEd25519YaoRegistrationAdmissionRequestV1, dispatchRoot: RouterAbEd25519YaoTenantRootWireV1, traceContext: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationBackendResult>;
+    execute(request: RouterAbEd25519YaoRegistrationExecuteRequestV1, admissionRequest: RouterAbEd25519YaoRegistrationAdmissionRequestV1, ownershipGeneration: number, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationBackendResult>;
+    resolveRegistrationDispatchRoot(signingRootId: RouterAbEd25519YaoRegistrationSigningRootIdV1): Promise<RouterAbEd25519YaoTenantRootWireV1>;
+    executePinnedRegistration(request: RouterAbEd25519YaoRegistrationExecuteRequestV1, authority: RouterAbEd25519YaoRegistrationExecutionAuthorityV1, traceContext: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationBackendResult>;
     consumeRegistration(input: RouterAbEd25519YaoRegistrationConsumeInputV1): Promise<RouterAbEd25519YaoRegistrationConsumeOutcomeV1>;
     resolveRecoveryDispatchRoot(admissionRequest: RouterAbEd25519YaoRecoveryAdmissionRequestV1): Promise<RouterAbEd25519YaoTenantRootWireV1>;
-    executeRecovery(request: RouterAbEd25519YaoRecoveryExecuteRequestV1, admissionRequest: RouterAbEd25519YaoRecoveryAdmissionRequestV1, dispatchRoot: RouterAbEd25519YaoTenantRootWireV1, attempt: number, replay: boolean, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationBackendResult>;
+    executeRecovery(request: RouterAbEd25519YaoRecoveryExecuteRequestV1, claim: RouterAbEd25519YaoRecoveryExecuteClaimV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationBackendResult>;
     private executeRouterRequest;
     private sendRouterRequest;
-    activateRecovery(request: RouterAbEd25519YaoRecoveryActivationRequestV1, dispatchRoot: RouterAbEd25519YaoTenantRootWireV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationBackendResult>;
+    activateRecovery(request: RouterAbEd25519YaoRecoveryActivationRequestV1, dispatchRoot: RouterAbEd25519YaoTenantRootWireV1, ownershipGeneration: number, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationBackendResult>;
     private post;
     private headers;
     private request;

package/dist/types/wallet-server/src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistration.d.ts

@@ -1,5 +1,6 @@
 import { type RouterAbEd25519YaoActivationAdmissionReceiptV1, type RouterAbEd25519YaoActivationExecuteRequestV1, type RouterAbEd25519YaoActivationResultV1, type RouterAbEd25519YaoRegistrationAdmissionRequestV1, type RouterAbEd25519YaoBytes32V1 } from '../../../../../../shared-ts/src/utils/routerAbEd25519Yao';
 import { type RouterAbTraceContextV1 } from '../../../../../../shared-ts/src/utils/routerAbTraceContext';
+import type { Variant } from '../../../../../../shared-ts/src/utils/variant';
 import { type RouterApiModule } from '../../../framework/modules';
 import type { RouterAbEd25519YaoRegistrationExecuteAdmissionContextV1, RouterAbEd25519YaoTenantRootWireV1 } from '../routerAbEd25519YaoGatewayEnvelope';
 type RouterAbEd25519YaoRegistrationAdmissionReceiptV1 = RouterAbEd25519YaoActivationAdmissionReceiptV1<'registration'>;
@@ -30,11 +31,11 @@ export type RouterAbEd25519YaoRegistrationBackendResult = {
 export interface RouterAbEd25519YaoRegistrationBackend {
     takeLastRouterServerTiming?(): string | null;
     admit(request: RouterAbEd25519YaoRegistrationAdmissionRequestV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationBackendResult> | RouterAbEd25519YaoRegistrationBackendResult;
-    execute(request: RouterAbEd25519YaoRegistrationExecuteRequestV1, admissionRequest: RouterAbEd25519YaoRegistrationExecuteAdmissionContextV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationBackendResult> | RouterAbEd25519YaoRegistrationBackendResult;
+    execute(request: RouterAbEd25519YaoRegistrationExecuteRequestV1, admissionRequest: RouterAbEd25519YaoRegistrationExecuteAdmissionContextV1, ownershipGeneration: number, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationBackendResult> | RouterAbEd25519YaoRegistrationBackendResult;
 }
 export interface RouterAbEd25519YaoRegistrationService {
     admit(request: RouterAbEd25519YaoRegistrationAdmissionRequestV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationServiceResult<RouterAbEd25519YaoRegistrationAdmissionReceiptV1>>;
-    execute(request: RouterAbEd25519YaoRegistrationExecuteRequestV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationServiceResult<RouterAbEd25519YaoRegistrationResultV1>>;
+    execute(request: RouterAbEd25519YaoRegistrationExecuteRequestV1, ownershipGeneration: number, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationServiceResult<RouterAbEd25519YaoRegistrationResultV1>>;
 }
 export type RouterAbEd25519YaoRegistrationAdmissionClaimV1 = {
     readonly kind: 'router_ab_ed25519_yao_registration_admission_claim_v1';
@@ -109,12 +110,15 @@ export type RouterAbEd25519YaoRegistrationAuthorizationInput = {
 };
 export type RouterAbEd25519YaoRegistrationAuthorizationResult = {
     ok: true;
+    ownershipGeneration: number;
 } | {
     ok: false;
+    ownershipGeneration?: never;
     status: 401 | 403 | 409 | 429 | 503;
     code: string;
     message: string;
 };
+export type RouterAbEd25519YaoRegistrationAuthorizationFailure = Variant<RouterAbEd25519YaoRegistrationAuthorizationResult, 'ok', false>;
 export interface RouterAbEd25519YaoRegistrationAuthorizationAdapter {
     authorize(input: RouterAbEd25519YaoRegistrationAuthorizationInput): Promise<RouterAbEd25519YaoRegistrationAuthorizationResult> | RouterAbEd25519YaoRegistrationAuthorizationResult;
 }
@@ -191,7 +195,7 @@ export declare class InMemoryRouterAbEd25519YaoRegistrationService implements Ro
     admit(request: RouterAbEd25519YaoRegistrationAdmissionRequestV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationServiceResult<RouterAbEd25519YaoRegistrationAdmissionReceiptV1>>;
     prepareAdmit(request: RouterAbEd25519YaoRegistrationAdmissionRequestV1): RouterAbEd25519YaoRegistrationAdmissionPreparationV1;
     commitAdmit(input: RouterAbEd25519YaoRegistrationAdmissionCommitInputV1): RouterAbEd25519YaoRegistrationServiceResult<RouterAbEd25519YaoRegistrationAdmissionReceiptV1>;
-    execute(request: RouterAbEd25519YaoRegistrationExecuteRequestV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationServiceResult<RouterAbEd25519YaoRegistrationResultV1>>;
+    execute(request: RouterAbEd25519YaoRegistrationExecuteRequestV1, ownershipGeneration: number, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationServiceResult<RouterAbEd25519YaoRegistrationResultV1>>;
     prepareExecute(request: RouterAbEd25519YaoRegistrationExecuteRequestV1): RouterAbEd25519YaoRegistrationExecutePreparationV1;
     commitExecute(input: RouterAbEd25519YaoRegistrationExecuteCommitInputV1): RouterAbEd25519YaoRegistrationServiceResult<RouterAbEd25519YaoRegistrationResultV1>;
     consumeActivated(request: RouterAbEd25519YaoActivationConsumptionRequestV1): RouterAbEd25519YaoActivationConsumptionResultV1;

package/dist/types/wallet-server/src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationExecutionRecord.d.ts

@@ -11,6 +11,7 @@ type AdmissionReceipt = RouterAbEd25519YaoActivationAdmissionReceiptV1<'registra
  * that consumes it) belongs to the Router's wallet object.
  */
 export type RouterAbEd25519YaoRegistrationExecutionAuthorityV1 = {
+    readonly ownershipGeneration: number;
     readonly lifecycleId: string;
     readonly admissionRequest: RouterAbEd25519YaoRegistrationAdmissionRequestV1;
     readonly admissionReceipt: AdmissionReceipt;