@seams/wallet-server 0.54.0 → 0.56.0

package/README.md

@@ -4,17 +4,17 @@ This package owns the reusable signer server surface: route adapters,
 WebAuthn verification policy, threshold signing services, signer storage
 adapters, and server wasm bindings.
 
-The package version is `@seams/wallet-server@0.54.0`. Pair it with
-`@seams/wallet@0.54.0` and matching hosted assets. Use `@seams/wallet-cli@0.29.0`.
+The package version is `@seams/wallet-server@0.56.0`. Pair it with
+`@seams/wallet@0.56.0` and matching hosted assets. Use `@seams/wallet-cli@0.29.0`.
 The wallet iframe protocol is **23.0.0**.
 
 ```sh
-pnpm add @seams/wallet-server@0.54.0
+pnpm add @seams/wallet-server@0.56.0
 ```
 
 ## Google BYO authentication
 
-Version 0.54.0 verifies a configured application's signed session assertion or the app's Google ID token or exchanges it for a browser-bound handoff.
+Version 0.56.0 verifies a configured application's signed session assertion or the app's Google ID token or exchanges it for a browser-bound handoff.
 An environment-specific Google client configuration and an owner-approved wallet association are required.
 Apply the packaged signer migrations before enabling the feature.
 External sessions grant settings reads and remain separate from owner and signing credentials.

package/artifact-manifest.json

@@ -3,17 +3,17 @@
   "walletSecurityPolicy": "scoped_seals_and_owner_proofs_v1",
   "package": {
     "name": "@seams/wallet-server",
-    "version": "0.54.0"
+    "version": "0.56.0"
   },
   "workers": {
     "router": {
       "entry": "cloudflare-router-ab/build/router/worker/shim.mjs",
-      "fingerprint": "22e885129a9dbc5ad00599cc4dc3b4ce71a833fa3fa26993530200abda4a47d1",
+      "fingerprint": "2bce0668c0ea0ebe987780665679d355755c54dba199037d2888b2f45618bd9f",
       "files": [
         {
           "path": "cloudflare-router-ab/build/router/build-stamp.json",
           "bytes": 119,
-          "sha256": "8a75df14351fb43abefdd49c9660727594a5b751ad61d8916aabffe8492f78ff"
+          "sha256": "e52ab10f7f5ccbc3489faa7dedbe99411a921f3a337c02a9dbc6157c270b5837"
         },
         {
           "path": "cloudflare-router-ab/build/router/index.js",
@@ -39,12 +39,12 @@
     },
     "deriver-a": {
       "entry": "cloudflare-router-ab/build/deriver-a/worker/shim.mjs",
-      "fingerprint": "bdd26687d013f61d6e6638fe29b0d457813fd4ee7bc731c6a9f2d4ba1b0faa28",
+      "fingerprint": "64b21a5543d049faf93a8c811df01b3189f237a78525d794ab8fed4d363d5c77",
       "files": [
         {
           "path": "cloudflare-router-ab/build/deriver-a/build-stamp.json",
           "bytes": 122,
-          "sha256": "06905532466e1015afdd6c5ae77945cc5fd117548e10769f3c26027d82d94a0c"
+          "sha256": "12a004595c4e75fc0c60eb4a86c1d097b60219a12a87e72629fec88de3c5c9aa"
         },
         {
           "path": "cloudflare-router-ab/build/deriver-a/index.js",
@@ -70,12 +70,12 @@
     },
     "deriver-b": {
       "entry": "cloudflare-router-ab/build/deriver-b/worker/shim.mjs",
-      "fingerprint": "d998751bf0efb8861236a8b8f6b0314dd8d41eaaca2f542497085e9d8b62e504",
+      "fingerprint": "c5176d3f8dccc72bb1dc577d975470b4213f1a72ded5e66bab8ff7f34c190724",
       "files": [
         {
           "path": "cloudflare-router-ab/build/deriver-b/build-stamp.json",
           "bytes": 122,
-          "sha256": "fdec4e26b25e217da83b6f6c82c014d4689a95dbb47fd14333cd01f4f870e97b"
+          "sha256": "740681c46eb3400e69130059ef4a9423e9e06b3da129e8b834e0b82227003861"
         },
         {
           "path": "cloudflare-router-ab/build/deriver-b/index.js",
@@ -101,12 +101,12 @@
     },
     "signing-worker": {
       "entry": "cloudflare-router-ab/build/signing-worker/worker/shim.mjs",
-      "fingerprint": "2d666492dbaa78826cedd663257c2eab86fe23ec5552a1b59b683717aebfbe3e",
+      "fingerprint": "4ea33a63250bfbf073102ceafb22193d3f300a562bba4537d067ef2a8de07b44",
       "files": [
         {
           "path": "cloudflare-router-ab/build/signing-worker/build-stamp.json",
           "bytes": 127,
-          "sha256": "1ace62b6964ee4b8b9ac30bb49f315890e2742be54e14c1b8ee78237f3e808c3"
+          "sha256": "b0dacdc6a53ebd644b08f9f186ba0eed59a3a4a5f3a14936fc2197138c13e20a"
         },
         {
           "path": "cloudflare-router-ab/build/signing-worker/index.js",
@@ -132,12 +132,12 @@
     },
     "tenant-root-control-plane": {
       "entry": "cloudflare-router-ab/build/tenant-root-control-plane/worker/shim.mjs",
-      "fingerprint": "9fa94f9d652e8e36e68f318ff2a44be844ff398f6317d80467d0e0fa836d522f",
+      "fingerprint": "e79512250e1c788de74dcb29fdb56c004ab511ad58b41be8bc7af14bc777ad2a",
       "files": [
         {
           "path": "cloudflare-router-ab/build/tenant-root-control-plane/build-stamp.json",
           "bytes": 139,
-          "sha256": "2e7804f6e031ad965621682f581c0540069c2a25a182dd763c80d7f4d75dd98a"
+          "sha256": "c375a2555ade8c3bff20b13436430e608bfdc2388e709f4e02f959722723c679"
         },
         {
           "path": "cloudflare-router-ab/build/tenant-root-control-plane/index.js",

package/cloudflare-router-ab/build/deriver-a/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":true,"features":"strict-worker-deriver-a-entrypoint","started_at_ms":1794125422353}
+{"profile":"release","wallet_objects":true,"features":"strict-worker-deriver-a-entrypoint","started_at_ms":1794146490393}

package/cloudflare-router-ab/build/deriver-b/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":true,"features":"strict-worker-deriver-b-entrypoint","started_at_ms":1794125619132}
+{"profile":"release","wallet_objects":true,"features":"strict-worker-deriver-b-entrypoint","started_at_ms":1794146682144}

package/cloudflare-router-ab/build/router/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":true,"features":"strict-worker-router-entrypoint","started_at_ms":1794125797895}
+{"profile":"release","wallet_objects":true,"features":"strict-worker-router-entrypoint","started_at_ms":1794146860888}

package/cloudflare-router-ab/build/signing-worker/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":true,"features":"strict-worker-signing-worker-entrypoint","started_at_ms":1794125116180}
+{"profile":"release","wallet_objects":true,"features":"strict-worker-signing-worker-entrypoint","started_at_ms":1794146191911}

package/cloudflare-router-ab/build/tenant-root-control-plane/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":false,"features":"strict-worker-tenant-root-control-plane-entrypoint","started_at_ms":1794126001644}
+{"profile":"release","wallet_objects":false,"features":"strict-worker-tenant-root-control-plane-entrypoint","started_at_ms":1794147071629}

package/dist/esm/cloud-host.js

@@ -77,6 +77,8 @@ import { CloudflareD1WebAuthnStore, prepareD1WebAuthnAuthenticatorInsertStatemen
 import { CloudflareD1WebAuthnAuthService } from "./router/cloudflare/d1/webauthn/d1WebAuthnAuthService.js";
 import { admitD1EstablishedWalletHome, resumeRegistrationDirectoryPublicationsV1 } from "./router/cloudflare/d1/registration/d1WalletExecutionAuthority.js";
 import { parseLinkedDeviceSessionRecordV1 } from "./core/deviceLinking/linkedDeviceSessionRecord.js";
+import { parseD1LinkedDeviceSessionRowV1, parseD1LinkedDeviceSessionTranscriptRowV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionRecords.js";
+import { D1LinkedDeviceSessionStoreV1, SESSION_CAS_GUARD_SQL } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionStore.js";
 import { D1LinkedDeviceSourceContributionPreparationPlannerV1, createD1LinkedDeviceSourceContributionPreparationPlannerV1, linkedDeviceX25519RecipientPublicKeyB64uV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceSourceContributionPreparationPlanner.js";
 import { D1LinkedDeviceAuthorityInstallServiceV1, parseInstalledEcdsaCustodySnapshotV1, readD1LinkedDeviceEcdsaSourceV1, readD1LinkedDeviceEd25519SourceV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService.js";
 import { CloudflareD1AuthorizationStore } from "./router/cloudflare/d1/authorization/d1AuthorizationStore.js";
@@ -113,8 +115,6 @@ import { D1IdentityStore } from "./core/d1IdentityStore.js";
 import { D1LinkedDeviceEd25519ExportRootStoreV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceEd25519ExportRootStore.js";
 import { D1LinkedDeviceRequestProofNonceStoreV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceRequestProofNonceStore.js";
 import { createD1LinkedDeviceSessionServiceV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionService.js";
-import { parseD1LinkedDeviceSessionRowV1, parseD1LinkedDeviceSessionTranscriptRowV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionRecords.js";
-import { D1LinkedDeviceSessionStoreV1, SESSION_CAS_GUARD_SQL } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionStore.js";
 import { createD1LinkedDeviceRouteServiceV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceRouteService.js";
 import { LinkedDeviceSourceFamilyUnavailableErrorV1, createD1LinkedDeviceVerifiedLinkSourceReaderV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceVerifiedLinkSourceReader.js";
 import { buildVerifiedLinkInputV1, buildVerifiedTargetFactorV1, computeVerifiedTargetFactorVerificationDigestV1, linkedDeviceSignerManifestsEqualV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceVerifiedLinkBuilder.js";

package/dist/esm/router/cloudflare/d1/auth/d1RouterApiAuthService.js

@@ -16,6 +16,7 @@ import { resolveActiveOwnerWalletExecutionLane, resolveWalletAuthMethodIdForAuth
 import { DEFAULT_WALLET_SESSION_TTL_MS, LINKED_DEVICE_WALLET_SESSION_TTL_MS } from "../../../../shared-ts/src/threshold/sessionPolicy.js";
 import { createDeviceLinkingOwnerRequestAuthenticatorV1 } from "../../../transport/fetch/routes/deviceLinkingOwnerAuthorization.js";
 import { verifyD1LinkedDeviceFreshRevokeProofV1 } from "../wallet/d1WalletAuthMethodBoundary.js";
+import { D1LinkedDeviceSessionStoreV1 } from "../deviceLinking/d1LinkedDeviceSessionStore.js";
 import { D1LinkedDeviceAuthorityInstallServiceV1 } from "../deviceLinking/d1LinkedDeviceAuthorityInstallService.js";
 import { D1WalletAuthorityStore } from "../wallet/d1WalletAuthorityStore.js";
 import { createD1Ed25519YaoLifecycleRecords } from "../ed25519Yao/d1Ed25519YaoProductRegistrationPartitionedStateStore.js";
@@ -68,7 +69,6 @@ import { CloudflareD1WalletRecoveryGoogleEmailOtpService } from "../passkeyCusto
 import { CloudflareD1WalletAddSignerService, parseD1WalletAddSignerStartSideEffectRecord } from "../wallet/d1WalletAddSignerService.js";
 import { CloudflareD1RegistrationIntentService } from "../registration/d1RegistrationIntentService.js";
 import { createD1LinkedDeviceSessionServiceV1 } from "../deviceLinking/d1LinkedDeviceSessionService.js";
-import { D1LinkedDeviceSessionStoreV1 } from "../deviceLinking/d1LinkedDeviceSessionStore.js";
 import { createD1LinkedDeviceRouteServiceV1 } from "../deviceLinking/d1LinkedDeviceRouteService.js";
 import { D1LinkedDeviceEmailOtpGrantStoreV1 } from "../deviceLinking/d1LinkedDeviceEmailOtpGrantStore.js";
 import { createD1LinkedDeviceManagementServiceV1 } from "../deviceLinking/d1LinkedDeviceManagementService.js";

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService.js

@@ -28,6 +28,7 @@ import { prepareD1WebAuthnAuthenticatorInsertStatement } from "../webauthn/d1Web
 import { admitD1EstablishedWalletHome } from "../registration/d1WalletExecutionAuthority.js";
 import { findInstalledEcdsaAuthority, installedEcdsaAuthorityChain, projectInstalledEcdsaAuthority } from "./installedEcdsaAuthority.js";
 import { buildAuthorityActiveSessionRecordV1, buildAuthorityPendingLocalInstallSessionRecordV1 } from "../../../../core/deviceLinking/linkedDeviceSessionRecord.js";
+import { SESSION_CAS_GUARD_SQL } from "./d1LinkedDeviceSessionStore.js";
 import { linkedDeviceX25519RecipientPublicKeyB64uV1 } from "./d1LinkedDeviceSourceContributionPreparationPlanner.js";
 //#region src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService.ts
 var LinkedDeviceActivationIntegrityErrorV1 = class extends Error {
@@ -580,9 +581,10 @@ var D1LinkedDeviceAuthorityInstallServiceV1 = class {
 		});
 	}
 	async commitAcknowledgementCleanupV1(input) {
+		const allocationDelete = this.buildAuthorityAllocationDeleteStatement(input.prepared.acknowledgement.linkSessionId);
 		const beforeDeleteStatements = [
 			this.buildCredentialDeliveryAcknowledgementStatement(input.prepared),
-			this.buildAuthorityAllocationDeleteStatement(input.prepared.acknowledgement.linkSessionId),
+			allocationDelete,
 			this.buildCredentialDeliveryCleanupStateStatement({
 				linkSessionId: input.prepared.acknowledgement.linkSessionId,
 				from: "pending",
@@ -609,7 +611,7 @@ var D1LinkedDeviceAuthorityInstallServiceV1 = class {
 					const detail = "message" in deleted && deleted.message ? `: ${deleted.message}` : "";
 					throw new Error(`active authority cleanup failed: ${deleted.outcome}${detail}`);
 				}
-			} else await this.options.database.batch([...beforeDeleteStatements, ...afterDeleteStatements]);
+			} else await this.options.database.batch([...beforeDeleteStatements, ...afterDeleteStatements].flatMap((statement) => statement === allocationDelete ? [statement] : [statement, this.options.database.prepare(SESSION_CAS_GUARD_SQL)]));
 		} catch (error) {
 			const replay = await this.readActivationCleanupReceiptV1({
 				linkSessionId: input.prepared.acknowledgement.linkSessionId,

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRouteService.js

@@ -1,10 +1,10 @@
 import { parseLinkDeviceSessionId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { readJson } from "../../../framework/http.js";
 import { LinkedDeviceRequestProofVerifierV1 } from "../../../../core/deviceLinking/requestProof.js";
+import { D1LinkedDeviceSessionStoreV1 } from "./d1LinkedDeviceSessionStore.js";
 import { D1LinkedDeviceEd25519ExportRootStoreV1 } from "./d1LinkedDeviceEd25519ExportRootStore.js";
 import { D1LinkedDeviceRequestProofNonceStoreV1 } from "./d1LinkedDeviceRequestProofNonceStore.js";
 import { createD1LinkedDeviceSessionServiceV1 } from "./d1LinkedDeviceSessionService.js";
-import { D1LinkedDeviceSessionStoreV1 } from "./d1LinkedDeviceSessionStore.js";
 //#region src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRouteService.ts
 function createD1LinkedDeviceRouteServiceV1(options) {
 	const nowV1 = options.nowV1 ?? Date.now;

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetCredentialProvider.js

@@ -10,9 +10,9 @@ import { assertLinkedDeviceTargetCredentialRegistrationMatchesPreparationV1, com
 import { d1ChangedRows } from "../../../../storage/d1Sql.js";
 import { errorMessage } from "../../../../shared-ts/src/utils/errors.js";
 import { parseClientDataJsonBase64url } from "../../../../core/authService/webauthnOidcHelpers.js";
+import { SESSION_CAS_GUARD_SQL } from "./d1LinkedDeviceSessionStore.js";
 import { linkedDeviceX25519RecipientPublicKeyB64uV1 } from "./d1LinkedDeviceSourceContributionPreparationPlanner.js";
 import { verifyWebAuthnRegistrationCredentialForIntent } from "../../../../core/authService/webauthn.js";
-import { SESSION_CAS_GUARD_SQL } from "./d1LinkedDeviceSessionStore.js";
 import { linkedDeviceEmailOtpDescriptorCredentialIdV1 } from "../../../../core/deviceLinking/linkedDeviceEmailOtpGrant.js";
 import { buildVerifiedLinkInputV1, buildVerifiedTargetFactorV1 } from "./d1LinkedDeviceVerifiedLinkBuilder.js";
 //#region src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetCredentialProvider.ts

package/dist/esm/router/cloudflare/d1/deviceLinking/index.js

@@ -1,10 +1,10 @@
+import { parseD1LinkedDeviceSessionRowV1, parseD1LinkedDeviceSessionTranscriptRowV1 } from "./d1LinkedDeviceSessionRecords.js";
+import { D1LinkedDeviceSessionStoreV1, SESSION_CAS_GUARD_SQL } from "./d1LinkedDeviceSessionStore.js";
 import { D1LinkedDeviceSourceContributionPreparationPlannerV1, createD1LinkedDeviceSourceContributionPreparationPlannerV1, linkedDeviceX25519RecipientPublicKeyB64uV1 } from "./d1LinkedDeviceSourceContributionPreparationPlanner.js";
 import { D1LinkedDeviceAuthorityInstallServiceV1, parseInstalledEcdsaCustodySnapshotV1, readD1LinkedDeviceEcdsaSourceV1, readD1LinkedDeviceEd25519SourceV1 } from "./d1LinkedDeviceAuthorityInstallService.js";
 import { D1LinkedDeviceEd25519ExportRootStoreV1 } from "./d1LinkedDeviceEd25519ExportRootStore.js";
 import { D1LinkedDeviceRequestProofNonceStoreV1 } from "./d1LinkedDeviceRequestProofNonceStore.js";
 import { createD1LinkedDeviceSessionServiceV1 } from "./d1LinkedDeviceSessionService.js";
-import { parseD1LinkedDeviceSessionRowV1, parseD1LinkedDeviceSessionTranscriptRowV1 } from "./d1LinkedDeviceSessionRecords.js";
-import { D1LinkedDeviceSessionStoreV1, SESSION_CAS_GUARD_SQL } from "./d1LinkedDeviceSessionStore.js";
 import { createD1LinkedDeviceRouteServiceV1 } from "./d1LinkedDeviceRouteService.js";
 import { LinkedDeviceSourceFamilyUnavailableErrorV1, createD1LinkedDeviceVerifiedLinkSourceReaderV1 } from "./d1LinkedDeviceVerifiedLinkSourceReader.js";
 import { buildVerifiedLinkInputV1, buildVerifiedTargetFactorV1, computeVerifiedTargetFactorVerificationDigestV1, linkedDeviceSignerManifestsEqualV1 } from "./d1LinkedDeviceVerifiedLinkBuilder.js";

package/dist/esm/router/cloudflare/d1/registration/d1WalletExecutionAuthority.js

@@ -82,10 +82,7 @@ var D1WalletExecutionAuthority = class {
 			outcome: "cancelled"
 		};
 		await this.fixCancellation(input);
-		const completed = await this.registration.complete(completion);
-		if (!completed.ok) return completed;
-		await this.database.batch(this.prepareState(input, "retired"));
-		return completed;
+		return await this.registration.complete(completion);
 	}
 	prepareEstablished(input) {
 		if (input.registration.state === "active") return null;
@@ -96,7 +93,7 @@ var D1WalletExecutionAuthority = class {
 			attempts: 0
 		};
 		return {
-			statements: [...this.prepareState(input.registration, "active"), prepareD1TenantStatement(this.database, this.scope, `INSERT INTO wallet_registration_directory_publications
+			statements: [...this.prepareEstablishedState(input.registration), prepareD1TenantStatement(this.database, this.scope, `INSERT INTO wallet_registration_directory_publications
              (namespace, org_id, project_id, env_id, wallet_id, ceremony_id,
               session_json, next_attempt_at_ms)
            VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8)
@@ -185,16 +182,12 @@ var D1WalletExecutionAuthority = class {
            AND registration_completion IN ('pending', 'cancelled')
            AND state IN ('registering', 'retired')`, [input.walletId, input.ceremonyId]), this.database.prepare(D1_BATCH_CAS_GUARD_SQL)]);
 	}
-	/** The state update with its guard. The guard reads the row count of the update before it. */
-	prepareState(input, state) {
-		return [prepareD1TenantStatement(this.database, this.scope, `UPDATE wallet_execution_generations SET state = ?7, registration_completion = CASE WHEN ?7 = 'active' THEN 'established' ELSE registration_completion END
+	/** The established-state update with its guard. The guard reads the row count of the update before it. */
+	prepareEstablishedState(input) {
+		return [prepareD1TenantStatement(this.database, this.scope, `UPDATE wallet_execution_generations SET state = 'active', registration_completion = 'established'
          WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
            AND wallet_id = ?5 AND origin = 'registration' AND origin_id = ?6
-           AND state IN ('registering', ?7)`, [
-			input.walletId,
-			input.ceremonyId,
-			state
-		]), this.database.prepare(D1_BATCH_CAS_GUARD_SQL)];
+           AND state IN ('registering', 'active')`, [input.walletId, input.ceremonyId]), this.database.prepare(D1_BATCH_CAS_GUARD_SQL)];
 	}
 	async admitEstablishedHome(input) {
 		return admitD1EstablishedWalletHome(this.database, this.scope, input);

package/dist/esm/router/domains/speakToSign/speakToSignVerify.js

@@ -4,11 +4,14 @@ import { routerAbMpcMaterialActivationRefToWire } from "../../../shared-ts/src/u
 import { hasExactKeys } from "../../../shared-ts/src/utils/exactKeys.js";
 import { extractBearerCredential } from "../../auth/routerApiKeyAuth.js";
 import { defineRoute } from "../../framework/routeDefinitions.js";
-import { resolveWalletSessionOperationCredentialAdmissionFromContext } from "../../auth/commonRouterUtils.js";
+import { resolveWalletSessionAuthorizationV2Admission } from "../signingOperations/walletExecutionAdmission.js";
 //#region src/router/domains/speakToSign/speakToSignVerify.ts
 const SPEAK_TO_SIGN_VERIFY_PATH = "/speak-to-sign/v1/verify";
-/** 8 s of 16 kHz PCM16 is 256,000 bytes, about 341 KB in base64, with room for the fields. */
-const SPEAK_TO_SIGN_VERIFY_MAX_BODY_BYTES = 400 * 1024;
+/**
+* An enrollment carries three clips. 8 s of 16 kHz PCM16 is 256,000 bytes, about 341 KB in
+* base64, so three clips are about 1,000 KB, with room for the fields.
+*/
+const SPEAK_TO_SIGN_VERIFY_MAX_BODY_BYTES = 1100 * 1024;
 /** The verifier calls two remote models; the whole flow has a 10 s budget. */
 const OUTLAYER_TIMEOUT_MS = 2e4;
 const OUTLAYER_RESOURCE_LIMITS = Object.freeze({
@@ -81,10 +84,10 @@ var SpeakToSignVerifyRoutes = class {
 		path: SPEAK_TO_SIGN_VERIFY_PATH,
 		auth: {
 			plane: "public",
-			rationale: "The handler requires an active Wallet Session operation credential."
+			rationale: "The handler requires a live Wallet Session operation credential of the owner."
 		},
 		metering: { kind: "none" },
-		summary: "Run the pinned OutLayer voice verifier for a spoken payment"
+		summary: "Run the pinned OutLayer voice verifier for a spoken payment or an enrollment"
 	})];
 	now;
 	constructor(config, dependencies) {
@@ -94,8 +97,10 @@ var SpeakToSignVerifyRoutes = class {
 	}
 	async handleFetchRoute(input) {
 		const startedAtMs = this.now();
-		const subject = await this.authenticate(input.request, startedAtMs);
-		if (!subject) return failure(401, "unauthorized");
+		const authentication = await this.authenticate(input.request, startedAtMs, input.logger);
+		if (authentication.kind === "unauthorized") return failure(401, "unauthorized");
+		if (authentication.kind === "unavailable") return failure(503, "session_unavailable");
+		const { subject } = authentication;
 		const { walletId } = subject;
 		if (this.dependencies.rateLimit) {
 			if (!(await this.dependencies.rateLimit({ walletId })).allowed) return failure(429, "rate_limited");
@@ -109,32 +114,53 @@ var SpeakToSignVerifyRoutes = class {
 		if (verifierInput.owner !== owner) return failure(403, "owner_mismatch");
 		return await this.callVerifier(verifierInput, input.logger, startedAtMs);
 	}
-	async authenticate(request, nowMs) {
+	/**
+	* The route needs the owner's identity, not a signing allowance: the vault transfer is signed
+	* later through the Wallet's own signing path, which spends the quota. An exhausted session
+	* still names its owner, so the identity read admits it.
+	*/
+	async authenticate(request, nowMs, logger) {
 		const token = extractBearerCredential(request.headers);
-		if (!token) return null;
+		if (!token) return { kind: "unauthorized" };
 		const sessions = this.dependencies.authorizationSessions;
-		const context = await sessions.readWalletSessionAuthorizationV2ByOperationCredential({
-			tenantId: sessions.tenantId,
-			token,
-			nowMs
-		});
-		if (!context) return null;
-		if (resolveWalletSessionOperationCredentialAdmissionFromContext({
-			context,
+		let context;
+		try {
+			context = await sessions.readWalletSessionExactOperationContextByCredential({
+				tenantId: sessions.tenantId,
+				token,
+				nowMs
+			});
+		} catch (error) {
+			logger.warn("[speak-to-sign] Wallet Session read failed", { error: error instanceof Error ? error.message : "unknown" });
+			return { kind: "unavailable" };
+		}
+		if (!context) return { kind: "unauthorized" };
+		const { session } = context;
+		const admission = resolveWalletSessionAuthorizationV2Admission({
+			authorization: session,
+			authority: context.authority,
+			authMethod: context.authMethod,
+			retiredAtMs: context.retiredAtMs,
 			nowMs,
 			operation: {
+				tenantId: session.tenantId,
+				principalId: session.principalId,
+				walletId: session.walletId,
 				keyFamily: "ed25519",
 				operationKind: NEAR_ED25519_MPC_OPERATION_KINDS.signTransaction
 			}
-		}).kind !== "admitted") return null;
+		});
+		if (!admission.ok || admission.keyFamily !== "ed25519") return { kind: "unauthorized" };
 		return {
-			walletId: context.authorization.session.walletId,
-			ed25519: context.authority.signerActivations.ed25519?.materialActivation ?? null
+			kind: "admitted",
+			subject: {
+				walletId: session.walletId,
+				ed25519: admission.materialActivation
+			}
 		};
 	}
-	/** The NEAR account of the session's Ed25519 signer, or null when the wallet has none. */
+	/** The NEAR account of the session's Ed25519 signer, or null when it has none. */
 	async sessionNearAccount(subject) {
-		if (!subject.ed25519) return null;
 		const resolved = await this.dependencies.walletRegistration.resolveEd25519MaterialActivation({
 			walletId: String(subject.walletId),
 			materialActivation: routerAbMpcMaterialActivationRefToWire(subject.ed25519)

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService.d.ts

@@ -17,7 +17,7 @@ import type { LinkedDeviceEcdsaSourcePreservingActivationReceiptV1 } from '../..
 import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
 import { type RouterAbEd25519YaoActivationPublicReceiptV1, type RouterAbEd25519YaoApplicationBindingFactsV1, type RouterAbEd25519YaoCeremonyBindingV1 } from '../../../../../../shared-ts/src/utils/routerAbEd25519Yao';
 import { D1WalletAuthorityStore, type D1WalletAuthorityStoreScope } from '../wallet/d1WalletAuthorityStore';
-import type { D1LinkedDeviceSessionStoreV1 } from './d1LinkedDeviceSessionStore';
+import { type D1LinkedDeviceSessionStoreV1 } from './d1LinkedDeviceSessionStore';
 import type { D1WalletAuthMethodStore } from '../../../../core/d1WalletAuthMethodStore';
 import type { WalletEd25519SignerRecord } from '../../../../core/WalletStore';
 import type { AuthorizationService } from '../../../../authorization/service';

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletExecutionAuthority.d.ts

@@ -36,8 +36,8 @@ export declare class D1WalletExecutionAuthority implements WalletRegistrationHom
     private deliver;
     private preparePublicationUpdate;
     private fixCancellation;
-    /** The state update with its guard. The guard reads the row count of the update before it. */
-    private prepareState;
+    /** The established-state update with its guard. The guard reads the row count of the update before it. */
+    private prepareEstablishedState;
     admitEstablishedHome(input: Parameters<WalletExecutionAuthority['admitEstablishedHome']>[0]): Promise<OrdinaryAdmission>;
 }
 /** Records the authenticated reservation beside setup without reopening a retired home. */

package/dist/types/wallet-server/src/router/domains/speakToSign/speakToSignVerify.d.ts

@@ -2,7 +2,10 @@ import type { WalletId } from '../../../../../shared-ts/src/utils/domainIds';
 import type { RouterApiAuthorizationSessionService, RouterApiWalletRegistrationService } from '../../framework/authServicePort';
 import type { RouterApiRouteExtension } from '../../framework/routeExtensions';
 export declare const SPEAK_TO_SIGN_VERIFY_PATH = "/speak-to-sign/v1/verify";
-/** 8 s of 16 kHz PCM16 is 256,000 bytes, about 341 KB in base64, with room for the fields. */
+/**
+ * An enrollment carries three clips. 8 s of 16 kHz PCM16 is 256,000 bytes, about 341 KB in
+ * base64, so three clips are about 1,000 KB, with room for the fields.
+ */
 export declare const SPEAK_TO_SIGN_VERIFY_MAX_BODY_BYTES: number;
 /** The route exists only when the server configuration holds every field. */
 export type SpeakToSignVerifyConfig = Readonly<{
@@ -25,7 +28,8 @@ export type SpeakToSignVerifyRateLimit = (input: {
     readonly allowed: boolean;
 }>;
 export type SpeakToSignVerifyDependencies = Readonly<{
-    authorizationSessions: Pick<RouterApiAuthorizationSessionService, 'tenantId' | 'readWalletSessionAuthorizationV2ByOperationCredential'>;
+    /** The identity read: it admits an exhausted session, because the route spends no quota. */
+    authorizationSessions: Pick<RouterApiAuthorizationSessionService, 'tenantId' | 'readWalletSessionExactOperationContextByCredential'>;
     /** Resolves the NEAR account of the session's Ed25519 signer for the owner check. */
     walletRegistration: Pick<RouterApiWalletRegistrationService, 'resolveEd25519MaterialActivation'>;
     fetch: typeof fetch;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seams/wallet-server",
-  "version": "0.54.0",
+  "version": "0.56.0",
   "type": "module",
   "description": "Seams server TypeScript SDK for NEAR and EVM-family wallets",
   "main": "./dist/esm/index.js",