@seams/wallet-server 0.6.1 → 0.7.1

package/dist/types/shared-ts/src/wallet-recovery/recoveryCodeReservation.d.ts

@@ -21,7 +21,7 @@ export declare function deriveWalletRecoveryKeyLifecycleId(input: {
     readonly reservationId: RecoveryCodeReservationId;
     readonly keySetId: WalletRecoveryKeySetId;
 }): Promise<CorrelationId>;
-export type RecoveryCodeTransitionResult = {
+type RecoveryCodeTransitionResult = {
     ok: true;
     lifecycle: RecoveryCodeLifecycleState;
 } | {
@@ -66,14 +66,5 @@ export declare function consumeReservedRecoveryCode(args: {
     reservationId: RecoveryCodeReservationId;
     nowMs: number;
 }): RecoveryCodeTransitionResult;
-/** Revocation is terminal from every state except consumption. */
-export declare function revokeRecoveryCode(args: {
-    lifecycle: RecoveryCodeLifecycleState;
-    nowMs: number;
-}): RecoveryCodeTransitionResult;
-/**
- * Whether a code can back a new recovery attempt right now. An expired
- * reservation counts as available, matching `reserveRecoveryCode`.
- */
-export declare function isRecoveryCodeAvailable(lifecycle: RecoveryCodeLifecycleState, nowMs: number): boolean;
+export {};
 //# sourceMappingURL=recoveryCodeReservation.d.ts.map

package/dist/types/shared-ts/src/wallet-recovery/walletRecoveryCommittedProjection.d.ts

@@ -1,7 +1,7 @@
 import { type ActiveRecoveredWalletAuthorityV1 } from '../authorization/walletAuthority';
 import { type DeviceId } from '../authorization/capabilityKinds';
 import { type EmailOtpProviderUserId, type WalletAuthMethodId, type WalletAuthorityId, type WalletId, type WalletRecoveryOperationId, type WebAuthnCredentialIdB64u, type WebAuthnRpId } from '../utils/domainIds';
-import { type WalletAuthMethodRecordV2 } from '../utils/registrationIntent';
+import { type ActiveEmailOtpWalletAuthMethodRecordV2, type ActivePasskeyWalletAuthMethodRecordV2 } from '../utils/walletAuthMethodRecord';
 export type WalletRecoveryEmailOtpEnrollmentReferenceV1 = {
     readonly kind: 'email_otp_enrollment_reference_v1';
     readonly enrollmentId: string;
@@ -19,10 +19,7 @@ type WalletRecoveryCommittedProjectionCommonV1 = {
 };
 export type WalletRecoveryCommittedProjectionV1 = (WalletRecoveryCommittedProjectionCommonV1 & {
     readonly kind: 'passkey';
-    readonly authMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly kind: 'passkey';
-        readonly status: 'active';
-    }>;
+    readonly authMethod: ActivePasskeyWalletAuthMethodRecordV2;
     readonly target: {
         readonly kind: 'passkey';
         readonly rpId: WebAuthnRpId;
@@ -30,10 +27,7 @@ export type WalletRecoveryCommittedProjectionV1 = (WalletRecoveryCommittedProjec
     };
 }) | (WalletRecoveryCommittedProjectionCommonV1 & {
     readonly kind: 'google_email_otp';
-    readonly authMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly kind: 'email_otp';
-        readonly status: 'active';
-    }>;
+    readonly authMethod: ActiveEmailOtpWalletAuthMethodRecordV2;
     readonly target: {
         readonly kind: 'google_email_otp';
         readonly provider: 'google';
@@ -64,7 +58,7 @@ export type WalletRecoveryCommittedProjectionExpectationV1 = {
     readonly registrationAuthorityId: string;
     readonly enrollment: WalletRecoveryEmailOtpEnrollmentReferenceV1;
 };
-export type WalletRecoveryCommittedProjectionBuilderInputV1 = {
+type WalletRecoveryCommittedProjectionBuilderInputV1 = {
     readonly kind: 'passkey';
     readonly storeVersion: string;
     readonly walletId: WalletId;
@@ -73,10 +67,7 @@ export type WalletRecoveryCommittedProjectionBuilderInputV1 = {
     readonly targetAuthorityId: WalletAuthorityId;
     readonly targetWalletAuthMethodId: WalletAuthMethodId;
     readonly authority: ActiveRecoveredWalletAuthorityV1;
-    readonly authMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly kind: 'passkey';
-        readonly status: 'active';
-    }>;
+    readonly authMethod: ActivePasskeyWalletAuthMethodRecordV2;
 } | {
     readonly kind: 'google_email_otp';
     readonly storeVersion: string;
@@ -86,10 +77,7 @@ export type WalletRecoveryCommittedProjectionBuilderInputV1 = {
     readonly targetAuthorityId: WalletAuthorityId;
     readonly targetWalletAuthMethodId: WalletAuthMethodId;
     readonly authority: ActiveRecoveredWalletAuthorityV1;
-    readonly authMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly kind: 'email_otp';
-        readonly status: 'active';
-    }>;
+    readonly authMethod: ActiveEmailOtpWalletAuthMethodRecordV2;
     readonly providerSubject: EmailOtpProviderUserId;
     readonly emailHashHex: string;
     readonly registrationAuthorityId: string;

package/dist/types/shared-ts/src/wallet-recovery/walletRecoveryEcdsaPossession.d.ts

@@ -22,8 +22,6 @@ export type WalletRecoveryEcdsaPossessionProofV1 = {
 };
 export declare function parseWalletRecoveryEcdsaPossessionChallengeV1(value: unknown): WalletRecoveryEcdsaPossessionChallengeV1;
 export declare function parseWalletRecoveryEcdsaPossessionProofV1(value: unknown): WalletRecoveryEcdsaPossessionProofV1;
-export declare function walletRecoveryEcdsaPossessionChallengeCanonicalBytesV1(challenge: WalletRecoveryEcdsaPossessionChallengeV1): Uint8Array;
 export declare function walletRecoveryEcdsaPossessionChallengeDigestB64uV1(challenge: WalletRecoveryEcdsaPossessionChallengeV1): Promise<DigestB64u>;
-export declare const WALLET_RECOVERY_ECDSA_POSSESSION_PROOF_SCHEME_V1 = "secp256k1_bip340_sha256_v1";
 export {};
 //# sourceMappingURL=walletRecoveryEcdsaPossession.d.ts.map

package/dist/types/shared-ts/src/wallet-recovery/walletRecoveryEnvelopeSet.d.ts

@@ -13,7 +13,7 @@ import type { RecoveryCodeLifecycleState } from './recoveryEnvelopes';
  * under that device's own factor, so it never depended on the owner credential
  * and survives owner recovery untouched; including it here would instead let an
  * owner recovery code reconstruct that device's material. A lost lane is
- * revoked and reprovisioned through Refactor 102, not recovered.
+ * revoked and reprovisioned, not recovered.
  */
 export type WalletRecoveryEnvelopeEntry = {
     custodySecretKind: 'wallet_custody_seed_v1';
@@ -110,6 +110,4 @@ export declare function parseWalletRecoveryEnvelopeSetRecord(raw: unknown, optio
     expectedWalletId: WalletId;
     label?: string;
 }): WalletRecoveryEnvelopeSetRecord;
-/** A set is openable while at least one recovery-code wrap remains active. */
-export declare function hasOpenableRecoveryCodeWrap(set: WalletRecoveryEnvelopeSetRecord): boolean;
 //# sourceMappingURL=walletRecoveryEnvelopeSet.d.ts.map

package/dist/types/wallet-server/src/authorization/capabilityPolicy.d.ts

@@ -39,7 +39,6 @@ export interface CapabilityPolicyPort {
     parseEvidenceRequirement(value: unknown): ParseAuthorizationEvidenceRequirementResult;
     evaluateEvidenceRequirement(requirement: AuthorizationEvidenceRequirement, evidenceSet: VerifiedAuthorizationEvidenceSet): AuthorizationEvidenceRequirementEvaluation;
 }
-export declare function parseAuthorizationEvidenceRequirement(value: unknown): ParseAuthorizationEvidenceRequirementResult;
 export declare function evaluateAuthorizationEvidenceRequirement(requirement: AuthorizationEvidenceRequirement, evidenceSet: VerifiedAuthorizationEvidenceSet): AuthorizationEvidenceRequirementEvaluation;
 export declare const capabilityPolicyPort: CapabilityPolicyPort;
 //# sourceMappingURL=capabilityPolicy.d.ts.map

package/dist/types/wallet-server/src/authorization/domain.d.ts

@@ -1,4 +1,4 @@
-import type { WalletAuthMethodRecordV2 } from '../../../shared-ts/src/utils/registrationIntent';
+import type { ActiveWalletAuthMethodRecordV2, WalletAuthMethodRecordV2 } from '../../../shared-ts/src/utils/walletAuthMethodRecord';
 import { CAPABILITY_KINDS, EVM_ECDSA_MPC_OPERATION_KINDS, NEAR_ED25519_MPC_OPERATION_KINDS } from '../../../shared-ts/src/authorization/capabilityKinds';
 import type { CapabilityOperationRef, AuthorizationAuditEventId, AuthorizationGrantRef, AuthorizedOperationId, WalletSessionAuthorizationId, AuthorizationEvidenceId, AuthorizationEvidenceKind, HostedWalletSessionExchangeCodeId, MpcWalletSigningQuotaId, PrincipalId, WalletSessionMintId, TenantId, WalletSessionId } from '../../../shared-ts/src/authorization/capabilityKinds';
 export { parseMpcWalletSigningQuotaId, parseWalletSessionId, } from '../../../shared-ts/src/authorization/capabilityKinds';
@@ -8,7 +8,7 @@ import { type DomainId, type MpcMaterialActivationRef, type WalletAuthMethodId,
 import type { ProviderSubject, WebAuthnCredentialIdB64u } from '../../../shared-ts/src/utils/domainIds';
 import { type DigestB64u } from '../../../shared-ts/src/utils/canonicalPrimitives';
 import type { AuthFactorIdentity, WalletAuthAuthorityRef } from '../../../shared-ts/src/utils/walletAuthAuthority';
-import type { ActiveWalletAuthorityV1, WalletSignerActivationSetV1 } from '../../../shared-ts/src/authorization/walletAuthority';
+import type { ActiveWalletAuthorityV1, WalletAuthorityV1, WalletSignerActivationSetV1 } from '../../../shared-ts/src/authorization/walletAuthority';
 import { type ActiveWalletSessionV1, type WalletSessionOperationCredentialV1 } from '../../../shared-ts/src/device-linking';
 /** A server-only identity for one consumed owner authentication result. */
 export type VerifiedOwnerProofId = DomainId<'VerifiedOwnerProofId'>;
@@ -209,10 +209,14 @@ export type ExactWalletSessionQuotaProjectionV1 = {
 export type WalletSessionExactOperationContext = {
     readonly session: WalletSessionAuthorizationV2;
     readonly authority: ActiveWalletAuthorityV1;
-    readonly authMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly status: 'active';
-    }>;
+    readonly authMethod: ActiveWalletAuthMethodRecordV2;
     readonly retiredAtMs: null;
+    readonly ownerWalletScope: {
+        readonly orgId: string;
+        readonly projectId: string;
+        readonly projectEnvironmentId: string;
+        readonly walletId: WalletId;
+    };
 };
 /**
  * The digest-free exact status projection. Every branch that observed a stored
@@ -237,6 +241,22 @@ export type ExactWalletSessionStatusV2 = {
     readonly session?: never;
     readonly quota?: never;
 };
+/**
+ * A live session with the authority and auth method read in the same
+ * statement. Admission judges all three from one snapshot, so a commit that
+ * lands between separate reads cannot pair a session with a newer authority.
+ */
+export type WalletSessionAdmissionSnapshotV2 = {
+    readonly authorization: IssuedWalletSessionAuthorizationV2;
+    readonly authority: WalletAuthorityV1 | null;
+    readonly authMethod: WalletAuthMethodRecordV2 | null;
+};
+/** An exact status with the authority and auth method it was judged against. */
+export type ExactWalletSessionStatusSnapshotV2 = {
+    readonly status: ExactWalletSessionStatusV2;
+    readonly authority: WalletAuthorityV1 | null;
+    readonly authMethod: WalletAuthMethodRecordV2 | null;
+};
 export declare function buildExactWalletSessionQuotaProjectionV1(fields: Omit<ExactWalletSessionQuotaProjectionV1, 'kind'>): ExactWalletSessionQuotaProjectionV1;
 /**
  * Every capability subject must resolve through the authoritative active

package/dist/types/wallet-server/src/authorization/ecdsaWalletSessionAdmission.d.ts

@@ -0,0 +1,37 @@
+import type { CapabilityOperationEnvelope } from '../../../shared-ts/src/authorization/operationFingerprint';
+import type { AuthorizedOperation, AuthorizedOperationInput } from './domain';
+import type { AuthorizedOperationAdmissionRejection, EcdsaMaterialActivationScope } from './service';
+export type EcdsaWalletSessionAdmissionInput = {
+    readonly operation: AuthorizedOperationInput & {
+        readonly operation: CapabilityOperationEnvelope<{
+            readonly capabilityKind: 'evm_ecdsa_mpc_signing';
+            readonly operationKind: 'evm.sign_transaction';
+        }>;
+        readonly authorization: {
+            readonly kind: 'authorization_grant';
+        };
+        readonly quota: {
+            readonly kind: 'consume_reusable_wallet_session';
+        };
+    };
+    readonly material: EcdsaMaterialActivationScope;
+};
+export type PinnedOwnerWalletScope = {
+    readonly orgId: string;
+    readonly projectId: string;
+    readonly projectEnvironmentId: string;
+};
+export type EcdsaWalletSessionAdmission = {
+    readonly kind: 'claimed' | 'operation_in_progress';
+    readonly operation: AuthorizedOperation;
+    readonly ownerScope: PinnedOwnerWalletScope;
+} | {
+    readonly kind: 'replayed';
+    readonly operation: AuthorizedOperation;
+    readonly ownerScope?: never;
+};
+export type EcdsaWalletSessionAdmissionResult = EcdsaWalletSessionAdmission | (AuthorizedOperationAdmissionRejection & {
+    readonly operation?: never;
+    readonly ownerScope?: never;
+});
+//# sourceMappingURL=ecdsaWalletSessionAdmission.d.ts.map

package/dist/types/wallet-server/src/authorization/ecdsaWalletSessionAdmission.typecheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ecdsaWalletSessionAdmission.typecheck.d.ts.map

package/dist/types/wallet-server/src/authorization/factorEvidence.d.ts

@@ -56,12 +56,12 @@ type VerifiedWalletOperationFactorBinding = {
     readonly verifiedAtMs: number;
     readonly expiresAtMs: number;
 };
-export type VerifiedWalletOperationPasskeyFactorResult = VerifiedWalletOperationFactorBinding & {
+type VerifiedWalletOperationPasskeyFactorResult = VerifiedWalletOperationFactorBinding & {
     readonly kind: 'verified_wallet_operation_passkey_factor';
     readonly credentialIdB64u: WebAuthnCredentialIdB64u;
     readonly assertionDigest: DigestB64u;
 };
-export type VerifiedWalletOperationEmailOtpFactorResult = VerifiedWalletOperationFactorBinding & {
+type VerifiedWalletOperationEmailOtpFactorResult = VerifiedWalletOperationFactorBinding & {
     readonly kind: 'verified_wallet_operation_email_otp_factor';
     readonly challengeId: EmailOtpChallengeId;
     readonly verificationReceiptDigest: DigestB64u;
@@ -78,12 +78,12 @@ type VerifiedWalletSessionFactorBinding = {
     readonly verifiedAtMs: number;
     readonly expiresAtMs: number;
 };
-export type VerifiedWalletSessionPasskeyFactorResult = VerifiedWalletSessionFactorBinding & {
+type VerifiedWalletSessionPasskeyFactorResult = VerifiedWalletSessionFactorBinding & {
     readonly kind: 'verified_wallet_session_passkey_factor';
     readonly credentialIdB64u: WebAuthnCredentialIdB64u;
     readonly assertionDigest: DigestB64u;
 };
-export type VerifiedWalletSessionEmailOtpFactorResult = VerifiedWalletSessionFactorBinding & {
+type VerifiedWalletSessionEmailOtpFactorResult = VerifiedWalletSessionFactorBinding & {
     readonly kind: 'verified_wallet_session_email_otp_factor';
     readonly challengeId: EmailOtpChallengeId;
     readonly verificationReceiptDigest: DigestB64u;
@@ -110,7 +110,7 @@ export declare function buildVerifiedWalletSessionPasskeyFactorResult(fields: Om
 export declare function buildVerifiedWalletSessionEmailOtpFactorResult(fields: Omit<VerifiedWalletSessionEmailOtpFactorResult, 'kind'>): VerifiedWalletSessionEmailOtpFactorResult;
 /** Nominal server-only owner proofs; private constructors block browser forgery. */
 declare class VerifiedOwnerWalletSessionProof {
-    private readonly __proofBrand;
+    protected readonly __proofBrand = true;
     readonly kind: "verified_owner_proof_v1";
     readonly proofId: VerifiedOwnerProofId;
     readonly method: VerifiedOwnerProofMethod;
@@ -131,7 +131,7 @@ declare class VerifiedOwnerWalletSessionProof {
     }>);
 }
 declare class VerifiedOwnerOperationProof {
-    private readonly __proofBrand;
+    protected readonly __proofBrand = true;
     readonly kind: "verified_owner_proof_v1";
     readonly proofId: VerifiedOwnerProofId;
     readonly method: VerifiedOwnerProofMethod;
@@ -160,6 +160,5 @@ export declare function buildVerifiedOwnerProof(input: Extract<VerifiedOwnerProo
 }>): Promise<VerifiedOwnerOperationProof>;
 export declare function buildVerifiedOwnerProof(input: VerifiedOwnerProofInput): Promise<VerifiedOwnerProof>;
 export declare function buildVerifiedWalletOperationFactorEvidenceSet(input: VerifiedWalletOperationFactorEvidenceSetInput): Promise<VerifiedAuthorizationEvidenceSet>;
-export declare function parseVerifiedAuthorizationEvidenceSetFromPersistence(raw: unknown): VerifiedAuthorizationEvidenceSet;
 export {};
 //# sourceMappingURL=factorEvidence.d.ts.map

package/dist/types/wallet-server/src/authorization/service.d.ts

@@ -1,6 +1,7 @@
+import type { D1PreparedStatementLike } from '../storage/tenantRoute';
 import type { WalletAuthMethodId, WalletId } from '../../../shared-ts/src/utils/domainIds';
 import type { ActiveWalletAuthorityV1 } from '../../../shared-ts/src/authorization/walletAuthority';
-import type { ActiveWalletSessionQuota, AuthorizedOperation, AuthorizedOperationInput, AuthorizedOperationReplayResponse, CompletedCapabilityOperationResult, HostedWalletSeamsSessionExchangeCode, HostedWalletSeamsSessionExchangeDeliveryV2, HostedWalletSeamsSessionExchangeNonce, IssuedHostedWalletSeamsSessionExchangeV2, PersistedHostedWalletSeamsSessionExchangeV2Result, RedeemHostedWalletSeamsSessionExchangeV2Input, RedeemHostedWalletSeamsSessionExchangeV2Result, ExactWalletSessionStatusV2, WalletSessionExactOperationContext, ResolvedHostedWalletSessionOperationCredentialV2, SessionOrigin, VerifiedAuthorizationEvidenceSet, IssuedWalletSessionAuthorizationV2, LiveWalletSessionAuthorizationProjectionV2, ExactWalletSessionQuotaProjectionV1, DirectV2CommitResult, DirectV2IssueResult, PersistedActiveWalletSessionAuthorizationV2, WalletSessionAuthorizationV2MintLookup, WalletSessionAuthorizationV2MintRead, WalletSessionAuthorizationV2, VerifiedOwnerProof } from './domain';
+import type { ActiveWalletSessionQuota, AuthorizedOperation, AuthorizedOperationInput, AuthorizedOperationReplayResponse, CompletedCapabilityOperationResult, HostedWalletSeamsSessionExchangeCode, HostedWalletSeamsSessionExchangeDeliveryV2, HostedWalletSeamsSessionExchangeNonce, IssuedHostedWalletSeamsSessionExchangeV2, PersistedHostedWalletSeamsSessionExchangeV2Result, RedeemHostedWalletSeamsSessionExchangeV2Input, RedeemHostedWalletSeamsSessionExchangeV2Result, ExactWalletSessionStatusV2, ExactWalletSessionStatusSnapshotV2, WalletSessionAdmissionSnapshotV2, WalletSessionExactOperationContext, ResolvedHostedWalletSessionOperationCredentialV2, SessionOrigin, VerifiedAuthorizationEvidenceSet, IssuedWalletSessionAuthorizationV2, LiveWalletSessionAuthorizationProjectionV2, ExactWalletSessionQuotaProjectionV1, DirectV2CommitResult, DirectV2IssueResult, PersistedActiveWalletSessionAuthorizationV2, WalletSessionAuthorizationV2MintLookup, WalletSessionAuthorizationV2MintRead, WalletSessionAuthorizationV2, VerifiedOwnerProof } from './domain';
 import { type AuthorizedOperationId, type PrincipalId, type WalletSessionMintId, type TenantId, type WalletSessionAuthorizationId, type WalletSessionId } from '../../../shared-ts/src/authorization/capabilityKinds';
 import { type VerifiedWalletOperationFactorEvidenceSetInput, type VerifiedOwnerProofInput } from './factorEvidence';
 import type { CapabilityPolicyPort, AuthorizationEvidenceRequirementEvaluation, ParseAuthorizationEvidenceRequirementResult } from './capabilityPolicy';
@@ -61,6 +62,11 @@ export interface AuthorizationGrantPort {
         readonly tokenHash: DigestB64u;
         readonly nowMs: number;
     }): Promise<IssuedWalletSessionAuthorizationV2 | null>;
+    readWalletSessionAdmissionSnapshotByOperationCredential(input: {
+        readonly tenantId: TenantId;
+        readonly tokenHash: DigestB64u;
+        readonly nowMs: number;
+    }): Promise<WalletSessionAdmissionSnapshotV2 | null>;
     readWalletSessionExactOperationContextByCredential(input: {
         readonly tenantId: TenantId;
         readonly tokenHash: DigestB64u;
@@ -71,6 +77,11 @@ export interface AuthorizationGrantPort {
         readonly tokenHash: DigestB64u;
         readonly nowMs: number;
     }): Promise<ExactWalletSessionStatusV2>;
+    readExactWalletSessionStatusSnapshotByOperationCredential(input: {
+        readonly tenantId: TenantId;
+        readonly tokenHash: DigestB64u;
+        readonly nowMs: number;
+    }): Promise<ExactWalletSessionStatusSnapshotV2>;
 }
 export interface AuthorizedOperationPort {
     readAuthorizedOperationById(input: {
@@ -85,6 +96,12 @@ export interface AuthorizedOperationPort {
         readonly operation: AuthorizedOperationInput;
         readonly material?: AuthorizedOperationMaterialScope;
     }): Promise<AuthorizedOperationAdmissionResult>;
+    /** The admission `admitAuthorizedOperation` would make, prepared, not applied. */
+    prepareAuthorizedOperationAdmission(input: {
+        readonly operation: AuthorizedOperationInput;
+    }): Promise<PreparedAuthorizedOperationAdmission>;
+    /** The rejection a prepared admission's failed batch stands for, if any. */
+    classifyAuthorizedOperationAdmissionFailure(error: unknown): AuthorizedOperationAdmissionRejection | null;
     completeAuthorizedOperation(input: {
         readonly operation: AuthorizedOperation;
         readonly result: CompletedCapabilityOperationResult;
@@ -92,6 +109,9 @@ export interface AuthorizedOperationPort {
         readonly completedAtMs: number;
     }): Promise<AuthorizedOperation>;
 }
+export type AuthorizedOperationAdmissionRejection = {
+    readonly kind: 'authorization_grant_rejected' | 'verified_step_up_rejected' | 'wallet_session_quota_exhausted' | 'material_mismatch';
+};
 export type AuthorizedOperationAdmissionResult = {
     readonly kind: 'claimed';
     readonly operation: AuthorizedOperation;
@@ -101,9 +121,22 @@ export type AuthorizedOperationAdmissionResult = {
 } | {
     readonly kind: 'operation_in_progress';
     readonly operation: AuthorizedOperation;
+} | AuthorizedOperationAdmissionRejection;
+/**
+ * An admission prepared for a batch another store owns, after the reads
+ * `admitAuthorizedOperation` makes: an operation already admitted for the
+ * fingerprint answers as that call would, and nothing is written.
+ */
+export type PreparedAuthorizedOperationAdmission = {
+    readonly kind: 'prepared';
+    readonly statements: readonly D1PreparedStatementLike[];
 } | {
-    readonly kind: 'authorization_grant_rejected' | 'verified_step_up_rejected' | 'wallet_session_quota_exhausted' | 'material_mismatch';
-};
+    readonly kind: 'replayed';
+    readonly operation: AuthorizedOperation;
+} | {
+    readonly kind: 'operation_in_progress';
+    readonly operation: AuthorizedOperation;
+} | AuthorizedOperationAdmissionRejection;
 export type EcdsaMaterialActivationScope = Readonly<{
     readonly walletId: WalletId;
     readonly keyHandle: string;
@@ -174,6 +207,10 @@ export declare class AuthorizationService {
         readonly operation: AuthorizedOperationInput;
         readonly material?: AuthorizedOperationMaterialScope;
     }): Promise<AuthorizedOperationAdmissionResult>;
+    prepareAuthorizedOperationAdmission(input: {
+        readonly operation: AuthorizedOperationInput;
+    }): Promise<PreparedAuthorizedOperationAdmission>;
+    classifyAuthorizedOperationAdmissionFailure(error: unknown): AuthorizedOperationAdmissionRejection | null;
     completeAuthorizedOperation(input: {
         readonly operation: AuthorizedOperation;
         readonly result: CompletedCapabilityOperationResult;
@@ -217,6 +254,12 @@ export declare class AuthorizationService {
         readonly token: string;
         readonly nowMs: number;
     }): Promise<IssuedWalletSessionAuthorizationV2 | null>;
+    /** The session, its authority and its auth method from one read. */
+    readWalletSessionAdmissionSnapshotByOperationCredential(input: {
+        readonly tenantId: TenantId;
+        readonly token: string;
+        readonly nowMs: number;
+    }): Promise<WalletSessionAdmissionSnapshotV2 | null>;
     readLiveWalletSessionAuthorizationProjectionByCredential(input: {
         readonly tenantId: TenantId;
         readonly token: string;
@@ -237,6 +280,12 @@ export declare class AuthorizationService {
         readonly token: string;
         readonly nowMs: number;
     }): Promise<ExactWalletSessionStatusV2>;
+    /** The exact status with the authority and auth method it was judged against. */
+    readExactWalletSessionStatusSnapshotByOperationCredential(input: {
+        readonly tenantId: TenantId;
+        readonly token: string;
+        readonly nowMs: number;
+    }): Promise<ExactWalletSessionStatusSnapshotV2>;
     readHostedWalletSessionOperationCredentialV2(input: {
         readonly tenantId: TenantId;
         readonly token: string;

package/dist/types/wallet-server/src/cloud-host.d.ts

@@ -63,7 +63,11 @@ export * from './router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryRe
 export * from './router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryWalletSessionAuthorization';
 export * from './router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationRequestScopedCloudflare';
 export * from './router/domains/signingOperations/routerAbNormalSigningAdmissionCore';
-export * from './router/domains/signingOperations/routerAbPrivateSigningWorker';
+export { buildRouterAbEcdsaAcceptedAuthorizedOperationV1, buildRouterAbEd25519AcceptedAuthorizedOperationV1, evaluateRouterAbNormalSigningAdmission, type RouterAbEcdsaOperationAdmission, type RouterAbEcdsaOperationAdmissionKind, type RouterAbJsonRouteResult, type RouterAbNormalSigningAdmissionAdapter, type RouterAbNormalSigningAdmissionEvaluationInput, type RouterAbNormalSigningAdmissionFailure, type RouterAbNormalSigningAdmissionFailureCode, type RouterAbNormalSigningAdmissionInput, type RouterAbNormalSigningAdmissionResult, type RouterAbNormalSigningRouteAdmission, type RouterAbNormalSigningRouteRuntime, type RouterAbSigningWorkerJsonResult, } from './router/domains/signingOperations/routerAbNormalSigningAdmission';
+export { authenticateRouterAbWalletOperationStepUpIdentity } from './router/domains/signingOperations/routerAbOperationStepUp';
+export { buildRouterAbEcdsaDerivationPrivateSigningWorkerBody, buildRouterAbEd25519PrivateSigningWorkerBody, computeRouterAbEd25519NormalSigningAdmissionMaterial, parseRouterAbEd25519NormalSigningScopeV2, postRouterAbSigningWorkerJson, ROUTER_AB_ECDSA_DERIVATION_PRIVATE_SIGNING_PATHS, ROUTER_AB_ED25519_PRIVATE_SIGNING_PATHS, type RouterAbEcdsaDerivationPrivateSigningPath, type RouterAbEcdsaDerivationPrivateSigningWorkerBody, type RouterAbEd25519NormalSigningScopeV2, type RouterAbEd25519PrivateSigningPath, type RouterAbEd25519PrivateSigningWorkerBody, routerAbNormalSigningMaterialSourceFromActiveLaneV1, type RouterAbNormalSigningMaterialSourceV1, } from './router/domains/signingOperations/routerAbPrivateSigningWorker';
+export * from './router/domains/signingOperations/routerAbEd25519NormalSigningRoute';
+export * from './router/domains/signingOperations/routerAbEcdsaDerivationNormalSigningRoute';
 export * from './router/framework/routerApi';
 export * from './router/auth/routerApiCredentialAuth';
 export * from './router/auth/routerApiKeyAuth';
@@ -84,7 +88,7 @@ export { keccak256Bytes } from '../../shared-ts/src/utils/keccak';
 export { normalizeBoundedPositiveInteger, normalizeLowercaseString, normalizeTrimmedString, } from '../../shared-ts/src/utils/normalize';
 export { ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, parseRouterAbPublicKeysetV2, type RouterAbPublicKeysetV2, } from '../../shared-ts/src/utils/routerAbPublicKeyset';
 export { secureRandomBase36, secureRandomBase64Url } from '../../shared-ts/src/utils/secureRandomId';
-export { ensureLeadingSlash, isPlainObject, toOptionalTrimmedString, } from '../../shared-ts/src/utils/validation';
+export { ensureLeadingSlash, isObject, isPlainObject, toOptionalTrimmedString, } from '../../shared-ts/src/utils/validation';
 export { ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_STATUS_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, } from '../../shared-ts/src/utils/routerAbEd25519Yao';
 export { ROUTER_AB_TRACE_ID_HEADER_V1 } from '../../shared-ts/src/utils/routerAbTraceContext';
 export type { RuntimePolicyScope } from '../../shared-ts/src/threshold/signingRootScope';

package/dist/types/wallet-server/src/core/EmailOtpRecords.d.ts

@@ -1,4 +1,7 @@
-import type { EmailOtpAuthStateRecord, EmailOtpChallengeRecord, EmailOtpGrantRecord, EmailOtpUnlockChallengeRecord, EmailOtpWalletEnrollmentRecord, GoogleEmailOtpRegistrationAttemptRecord } from './EmailOtpStores';
+import type { ThresholdRuntimePolicyScope } from './types';
+import type { EmailOtpAuthStateRecord, EmailOtpChallengeRecord, EmailOtpGrantRecord, EmailOtpUnlockChallengeRecord, EmailOtpWalletEnrollmentRecord, GoogleEmailOtpRegistrationAttemptRecord, GoogleEmailOtpRegistrationAttemptScopeInput, PendingGoogleEmailOtpRegistrationAttemptRecord } from './EmailOtpStores';
+/** Parses JSON text; any other value, and text that is not JSON, comes back unchanged. */
+export declare function parseJsonRecord(raw: unknown): unknown;
 export declare function parseCurrentEmailOtpChallengeRecord(raw: unknown): EmailOtpChallengeRecord | null;
 export declare function parseCurrentEmailOtpChallengeRow(input: {
     recordJson: unknown;
@@ -20,6 +23,12 @@ export declare function parseCurrentGoogleEmailOtpRegistrationAttemptRow(input:
     expiresAtMs: unknown;
     updatedAtMs: unknown;
 }): GoogleEmailOtpRegistrationAttemptRecord | null;
+/** The scope as one comparable string, as D1 stores it in `runtime_policy_key`; empty when unset. */
+export declare function runtimePolicyScopeKey(scope: ThresholdRuntimePolicyScope | undefined): string;
+/** The pending attempt a registration with this owner binding resumes. */
+export declare function registrationAttemptMatchesStartedScope(record: GoogleEmailOtpRegistrationAttemptRecord, input: Readonly<GoogleEmailOtpRegistrationAttemptScopeInput>): record is PendingGoogleEmailOtpRegistrationAttemptRecord;
+/** A pending attempt that a registration with a new owner binding replaces. */
+export declare function registrationAttemptMatchesReplacementScope(record: GoogleEmailOtpRegistrationAttemptRecord, input: Readonly<GoogleEmailOtpRegistrationAttemptScopeInput>): record is PendingGoogleEmailOtpRegistrationAttemptRecord;
 export declare function parseCurrentEmailOtpWalletEnrollmentRecord(raw: unknown): EmailOtpWalletEnrollmentRecord | null;
 export declare function parseCurrentEmailOtpWalletEnrollmentRow(input: {
     recordJson: unknown;