@seams/wallet-server 0.6.2 → 0.7.1

package/dist/types/wallet-server/src/router/transport/fetch/routes/normalSigningRouterProxy.d.ts

@@ -1,9 +1,7 @@
 import type { RouterAbNormalSigningRouterProxy } from '../../../framework/routerApi';
 import type { RouterApiWalletRegistrationService } from '../../../framework/authServicePort';
 import type { AuthorizedOperation } from '../../../../authorization/domain';
-import type { RouterAbNormalSigningMaterialSourceV1 } from '../../../domains/signingOperations/routerAbPrivateSigningWorker';
 import type { RouterAbMpcMaterialActivationRefWire } from '../../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
-export declare const ROUTER_AB_ECDSA_DERIVATION_LINKED_DEVICE_SIGN_PATH: "/router-ab/ecdsa-derivation/linked-device/sign";
 export declare function proxyNormalSigningRequestToMpcRouter(input: {
     readonly request: Request;
     readonly proxy: RouterAbNormalSigningRouterProxy | null | undefined;
@@ -20,14 +18,4 @@ export declare function proxyOwnerLaneAdmittedNormalSigningRequest(input: {
     readonly authorization: Parameters<RouterApiWalletRegistrationService['resolveActiveOwnerWalletExecutionLane']>[0]['authorization'];
     readonly walletRegistration: Pick<RouterApiWalletRegistrationService, 'resolveActiveOwnerWalletExecutionLane'>;
 }): Promise<Response>;
-/** Forwards a Gateway-admitted rotatable lane source to the private Router. */
-export declare function proxyRotatableLaneAdmittedNormalSigningRequest(input: {
-    readonly request: Request;
-    readonly proxy: RouterAbNormalSigningRouterProxy | null | undefined;
-    readonly body: Record<string, unknown>;
-    readonly materialSource: Extract<RouterAbNormalSigningMaterialSourceV1, {
-        readonly kind: 'rotatable_lane';
-    }>;
-    readonly targetPath?: string;
-}): Promise<Response>;
 //# sourceMappingURL=normalSigningRouterProxy.d.ts.map

package/dist/types/wallet-server/src/router/transport/fetch/routes/passkeyCustody.d.ts

@@ -5,7 +5,7 @@ export declare function handleWalletCustodyEmailOtpChallenge(ctx: FetchRouterApi
 /** Lists public passkey envelope identities with their sibling activity rows. */
 export declare function handleWalletCustodyCredentialsList(ctx: FetchRouterApiContext): Promise<Response | null>;
 /**
- * Refactor 109C: binds a pre-109C custody envelope to the method that opened it.
+ * Binds an unbound custody envelope to the method that opened it.
  *
  * The exact operation credential names the auth method that opened the
  * envelope. Unlock already proved that method, so finishing the ownership

package/dist/types/wallet-server/src/router/transport/fetch/routes/sessions.d.ts

@@ -3,7 +3,7 @@ import { type WalletUnlockEcdsaCustodySignerV1 } from '../../../domains/walletUn
 import { parseRouterAbEcdsaPostRegistrationSessionActivationPolicyV1, type RouterAbEcdsaPostRegistrationSessionActivationRequestV1 } from '../../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
 export declare function handleHostedWalletSessionExchangeIssue(ctx: FetchRouterApiContext): Promise<Response | null>;
 export declare function handleHostedWalletSessionExchangeRedeem(ctx: FetchRouterApiContext): Promise<Response | null>;
-export type WalletUnlockEcdsaAuthoredRequest = {
+type WalletUnlockEcdsaAuthoredRequest = {
     readonly request: RouterAbEcdsaPostRegistrationSessionActivationRequestV1;
     readonly activationReceipt: WalletUnlockEcdsaCustodySignerV1['activationReceipt'];
     readonly continuity: {
@@ -28,4 +28,5 @@ export declare function handleWalletUnlockVerify(ctx: FetchRouterApiContext): Pr
 export declare function handleWalletEmailOtpDevCleanupGoogleRegistration(ctx: FetchRouterApiContext): Promise<Response | null>;
 export declare function handleWalletEmailOtpRegistrationSeal(ctx: FetchRouterApiContext): Promise<Response | null>;
 export declare function handleWalletEmailOtpDevOutbox(ctx: FetchRouterApiContext): Promise<Response | null>;
+export {};
 //# sourceMappingURL=sessions.d.ts.map

package/dist/types/wallet-server/src/router/transport/fetch/routes/syncAccountBootstrap.d.ts

@@ -3,7 +3,7 @@ import { type WalletSessionMintId } from '../../../../../../shared-ts/src/author
 import { type WalletAuthMethodId, type WalletAuthorityId } from '../../../../../../shared-ts/src/utils/domainIds';
 import type { WalletAuthAuthority, WalletAuthAuthorityRef } from '../../../../../../shared-ts/src/utils/walletAuthAuthority';
 import type { ActiveWalletAuthorityV1 } from '../../../../../../shared-ts/src/authorization/walletAuthority';
-import { type WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import { type ActivePasskeyWalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
 import type { MpcWalletSigningQuotaId, WalletSessionId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
 import type { ActiveWalletSessionV1, WalletSessionOperationCredentialV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
 import type { RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
@@ -13,7 +13,7 @@ import type { FetchRouterApiContext } from '../createFetchRouter';
 import type { WebAuthnSyncAccountVerificationResult } from '../../../../core/authService/webauthn';
 import type { WalletEcdsaSignerRecord } from '../../../../core/WalletStore';
 import type { RouterAbEd25519YaoActiveCapabilityDescriptorV1 } from '../../../domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery';
-export type VerifiedSyncAccountResultV1 = Extract<WebAuthnSyncAccountVerificationResult, {
+type VerifiedSyncAccountResultV1 = Extract<WebAuthnSyncAccountVerificationResult, {
     readonly ok: true;
     readonly verified: true;
 }>;
@@ -42,10 +42,7 @@ type SyncAccountExactBootstrapBodyBaseV1 = {
     readonly walletAuthMethodId: WalletAuthMethodId;
     readonly walletAuthorityId: WalletAuthorityId;
     readonly foundingAuthority: ActiveWalletAuthorityV1;
-    readonly foundingAuthMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly kind: 'passkey';
-        readonly status: 'active';
-    }>;
+    readonly foundingAuthMethod: ActivePasskeyWalletAuthMethodRecordV2;
     readonly custodyKeyManifestDigestB64u: VerifiedSyncAccountResultV1['custodyKeyManifestDigestB64u'];
     readonly walletBinding: VerifiedSyncAccountResultV1['walletBinding'];
     readonly rpId: string;
@@ -77,22 +74,19 @@ type SyncAccountExactBootstrapBodyBaseV1 = {
         readonly signers: readonly Pick<WalletEcdsaSignerRecord, 'chainTarget' | 'walletKey' | 'activationReceipt' | 'runtimePolicyScope'>[];
     };
 };
-export type SyncAccountExactBootstrapBodyV1 = SyncAccountExactBootstrapBodyBaseV1 & ({
+type SyncAccountExactBootstrapBodyV1 = SyncAccountExactBootstrapBodyBaseV1 & ({
     readonly ecdsaSession?: never;
     readonly ecdsaActivationReceipt?: never;
 } | {
     readonly ecdsaSession: RouterAbEcdsaCredentialFreeSessionActivationResponseV1;
     readonly ecdsaActivationReceipt: RouterAbEcdsaRegistrationActivationReceiptV1;
 });
-export type SyncAccountBootstrapInputV1 = {
+type SyncAccountBootstrapInputV1 = {
     readonly ctx: FetchRouterApiContext;
     readonly result: VerifiedSyncAccountResultV1;
     readonly authority: WalletAuthAuthority;
     readonly activeAuthority: ActiveWalletAuthorityV1;
-    readonly foundingAuthMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly kind: 'passkey';
-        readonly status: 'active';
-    }>;
+    readonly foundingAuthMethod: ActivePasskeyWalletAuthMethodRecordV2;
     readonly walletAuthMethodId: WalletAuthMethodId;
     readonly authorityRef: WalletAuthAuthorityRef;
     readonly proof: Extract<VerifiedOwnerProof, {
@@ -109,7 +103,7 @@ export type SyncAccountBootstrapInputV1 = {
         readonly storeVersion: string;
     };
 };
-export type SyncAccountBootstrapResultV1 = {
+type SyncAccountBootstrapResultV1 = {
     readonly kind: 'ok';
     readonly body: SyncAccountExactBootstrapBodyV1;
 } | {

package/dist/types/wallet-server/src/router/transport/fetch/routes/thresholdEcdsa.d.ts

@@ -1,30 +1,12 @@
 import type { FetchRouterApiContext } from '../createFetchRouter';
-import { type WalletSessionOperationCredentialAdmission } from '../../../auth/commonRouterUtils';
-import { type RouterAbEcdsaOperationStepUpPreparationV1Wire } from '../../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
-import { type RouterAbEcdsaOperationAdmissionKind } from '../../../domains/signingOperations/routerAbPrivateSigningWorker';
 import { type RouterAbEcdsaPoolFillInitRouteRequest, type RouterAbEcdsaPoolFillStepRouteRequest } from '../../../domains/ecdsa/thresholdEcdsaRequestValidation';
-import type { RouterApiAuthorizedOperationService, RouterApiWalletRegistrationService } from '../../../framework/authServicePort';
-import { type WalletSessionBoundaryFailure } from '../../../auth/walletSessionFailure';
-import { type EcdsaAuthorizationSessionId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
+import type { RouterAbEcdsaDerivationPoolFillBinding } from '../../../../core/ThresholdService/routerAb/ecdsaDerivationPoolFillHandlers';
+import type { RouterApiAuthorizedOperationService } from '../../../framework/authServicePort';
 import type { WalletSessionOperationCredentialV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
 import { type AuthorizedOperation, type VerifiedOwnerProof } from '../../../../authorization/domain';
 type VerifiedOwnerWalletSessionProof = Extract<VerifiedOwnerProof, {
     readonly purpose: 'wallet_session';
 }>;
-type RouterAbEcdsaOperationStepUpExecutionDecision = {
-    readonly kind: 'execute';
-    readonly operation: AuthorizedOperation;
-} | {
-    readonly kind: 'replay';
-    readonly operation: AuthorizedOperation;
-} | {
-    readonly kind: 'missing';
-};
-export declare function decideRouterAbEcdsaOperationStepUpExecution(input: {
-    readonly phase: 'prepare' | 'finalize';
-    readonly admissionKind: RouterAbEcdsaOperationAdmissionKind;
-    readonly operation: AuthorizedOperation;
-}): RouterAbEcdsaOperationStepUpExecutionDecision;
 type EcdsaSigningGatewayTiming = {
     authorize: number | null;
     admit: number | null;
@@ -40,22 +22,9 @@ export declare function finishRouterAbEcdsaSigningResponse(input: {
     readonly timing: Pick<EcdsaSigningGatewayTiming, 'proxy' | 'complete'>;
     readonly proxyStartedAt: number;
 }): Promise<Response>;
-type RouterAbEcdsaActiveMaterial = Extract<Awaited<ReturnType<RouterApiWalletRegistrationService['resolveEcdsaMaterialActivation']>>, {
-    readonly ok: true;
-}>;
-type RouterAbEcdsaPoolFillBinding = Pick<RouterAbEcdsaActiveMaterial, 'keyHandle' | 'relayerKeyId' | 'runtimePolicyScope' | 'participantIds' | 'routerAbEcdsaDerivationNormalSigning'> & {
-    readonly walletId: string;
-    readonly thresholdExpiresAtMs: number;
-    readonly authorization: {
-        readonly kind: 'wallet_session';
-    } | {
-        readonly kind: 'operation_step_up';
-        readonly materialExpiresAtMs: number;
-    };
-};
 type RouterAbEcdsaPoolFillAuthorizationResult = {
     readonly ok: true;
-    readonly binding: RouterAbEcdsaPoolFillBinding;
+    readonly binding: RouterAbEcdsaDerivationPoolFillBinding;
 } | {
     readonly ok: false;
     readonly error: {
@@ -76,29 +45,6 @@ export declare function authorizeEcdsaPoolFill(input: {
     readonly request: RouterAbEcdsaPoolFillInitRouteRequest | RouterAbEcdsaPoolFillStepRouteRequest;
     readonly timing: EcdsaPresignGatewayTiming;
 }): Promise<RouterAbEcdsaPoolFillAuthorizationResult>;
-type RouterAbEcdsaCustodySigner = Awaited<ReturnType<RouterApiWalletRegistrationService['listWalletEcdsaCustodyContinuity']>>[number];
-export declare function resolveV2EcdsaCustodySigner(input: {
-    readonly continuity: readonly RouterAbEcdsaCustodySigner[];
-    readonly walletId: string;
-    readonly admittedThresholdPublicKey33B64u: string;
-    readonly admittedEvmAddress: string;
-    readonly operation: RouterAbEcdsaOperationStepUpPreparationV1Wire;
-}): RouterAbEcdsaCustodySigner | null;
-export type StrictEcdsaOperationCredentialAuthorization = {
-    readonly ok: true;
-    readonly kind: 'wallet_session_operation_credential_v1';
-    readonly proof: VerifiedOwnerWalletSessionProof;
-    readonly admission: Extract<WalletSessionOperationCredentialAdmission, {
-        readonly curve: 'ecdsa';
-    }>;
-    readonly authorizationSessionId: EcdsaAuthorizationSessionId;
-} | WalletSessionBoundaryFailure;
-export declare function authorizeStrictEcdsaSessionActivationFromOperationCredential(input: {
-    readonly authorizationSessions: FetchRouterApiContext['service']['authorizationSessions'];
-    readonly walletId: string;
-    readonly operationCredential: WalletSessionOperationCredentialV1;
-    readonly proof: VerifiedOwnerWalletSessionProof;
-}): Promise<StrictEcdsaOperationCredentialAuthorization>;
 type StrictEcdsaSessionActivationInput = {
     readonly ctx: FetchRouterApiContext;
     readonly body: unknown;

package/dist/types/wallet-server/src/router/transport/fetch/routes/thresholdEd25519.d.ts

@@ -1,47 +1,3 @@
 import type { FetchRouterApiContext } from '../createFetchRouter';
-import { type RouterAbEd25519NormalSigningRoutePhase } from '../../../domains/signingOperations/routerAbPrivateSigningWorker';
-import { type AuthorizedOperation, type AuthorizedOperationReplayResponse } from '../../../../authorization/domain';
-export declare function replayCompletedEd25519Operation(operation: AuthorizedOperation): Response | null;
-/**
- * Completion readback is the authority for a terminal response. A claimed
- * operation must never fall back to the live upstream response after the
- * completion write, since that would make retries non-idempotent.
- */
-export declare function requireCompletedEd25519OperationResponse(operation: AuthorizedOperation): Response;
-export declare function buildEd25519ReplayResponse(input: {
-    readonly response: Response;
-    readonly bodyText: string;
-}): AuthorizedOperationReplayResponse;
-type Ed25519NormalSigningExecutionDecision = {
-    readonly kind: 'execute';
-    readonly operation: AuthorizedOperation;
-} | {
-    readonly kind: 'operation_in_progress';
-    readonly response: Response;
-} | {
-    readonly kind: 'replayed';
-    readonly response: Response;
-};
-export declare function decideEd25519NormalSigningExecution(input: {
-    readonly phase: RouterAbEd25519NormalSigningRoutePhase;
-    readonly admissionKind: 'claimed' | 'operation_in_progress' | 'replayed';
-    readonly operation: AuthorizedOperation;
-}): Ed25519NormalSigningExecutionDecision;
-type Ed25519OperationStepUpExecutionDecision = {
-    readonly kind: 'execute';
-    readonly operation: AuthorizedOperation;
-} | {
-    readonly kind: 'replay';
-    readonly response: Response;
-};
-export declare function decideEd25519OperationStepUpExecution(input: {
-    readonly admissionKind: 'claimed' | 'operation_in_progress' | 'replayed';
-    readonly operation: AuthorizedOperation;
-}): Ed25519OperationStepUpExecutionDecision;
-export declare function isRouterAbEd25519OperationInProgressResponse(input: {
-    readonly status: number;
-    readonly bodyText: string;
-}): boolean;
 export declare function handleThresholdEd25519(ctx: FetchRouterApiContext): Promise<Response | null>;
-export {};
 //# sourceMappingURL=thresholdEd25519.d.ts.map

package/dist/types/wallet-server/src/storage/d1Sql.d.ts

@@ -11,4 +11,11 @@ export declare function parseD1JsonArrayColumn(value: unknown): readonly unknown
 export declare function parseD1JsonObjectColumn(value: unknown): Record<string, unknown>;
 export declare function isD1DatabaseLike(value: unknown): value is D1DatabaseLike;
 export declare function resolveD1DatabaseFromConfig(config: Record<string, unknown>): D1DatabaseLike | null;
+/**
+ * Aborts the D1 batch it is in when the statement just before it changed no
+ * row: it collides with the guard table's immutable singleton, and the
+ * constraint failure rolls the whole batch back. The singleton is seeded by
+ * migration 0012.
+ */
+export declare const D1_BATCH_CAS_GUARD_SQL = "INSERT INTO router_ab_yao_versioned_json_cas_guard (guard_id)\nSELECT 1\n WHERE changes() = 0";
 //# sourceMappingURL=d1Sql.d.ts.map

package/dist/types/wallet-server/src/storage/syncSqlite.d.ts

@@ -0,0 +1,28 @@
+import type { D1DatabaseLike } from './tenantRoute';
+/**
+ * A value SQLite accepts as a bound parameter on every supported host.
+ */
+export type SyncSqliteValue = string | number | null | Uint8Array;
+export type SyncSqliteRow = Record<string, unknown>;
+/**
+ * One synchronous SQLite connection owned by a single role store: a Durable
+ * Object's SQLite storage on Cloudflare, or a role-private SQLite file opened
+ * by an ordinary process on a VM. Host adapters implement only these three
+ * operations; the store logic above them is shared.
+ */
+export interface SyncSqliteConnectionV1 {
+    /** Executes exactly one statement and returns its rows (none for writes). */
+    execute(sql: string, params: readonly SyncSqliteValue[]): readonly SyncSqliteRow[];
+    /** Runs `body` in one SQLite transaction. A thrown error rolls it back. */
+    transaction<T>(body: () => T): T;
+    /** Executes trusted schema text that may contain several statements. */
+    executeScript(sql: string): void;
+}
+/**
+ * Presents a synchronous SQLite connection through the async SQL shape used
+ * by the shared stores. `batch` is one SQLite transaction: a failing statement
+ * rolls back every earlier statement, so guarded compare-and-set batches keep
+ * the all-or-nothing semantics they have on D1.
+ */
+export declare function createSyncSqliteDatabase(connection: SyncSqliteConnectionV1): D1DatabaseLike;
+//# sourceMappingURL=syncSqlite.d.ts.map

package/dist/types/wallet-server/src/threshold/session/signingSessionSeal/crypto/shamir3PassWasm.d.ts

@@ -1,4 +1,3 @@
-export declare function ensureSigningSessionSealShamir3PassWasm(): Promise<void>;
 export declare function deriveSigningSessionSealLockKeyHandle(input: {
     readonly groupId: string;
     readonly rootSecret32: Uint8Array;

package/dist/types/wallet-server/src/threshold/session/signingSessionSeal/idempotencyRecords.d.ts

@@ -1,22 +1,21 @@
 import type { SigningSessionSealRouteResult } from './signingSessionSeal.types';
-export type CurrentSigningSessionSealSuccessIdempotencyResultRecord = {
+type CurrentSigningSessionSealSuccessIdempotencyResultRecord = {
     ok: true;
     ciphertext: string;
     keyVersion?: string;
     expiresAtMs?: number;
 };
-export type CurrentSigningSessionSealFailureIdempotencyResultRecord = {
+type CurrentSigningSessionSealFailureIdempotencyResultRecord = {
     ok: false;
     code: string;
     message: string;
 };
-export type CurrentSigningSessionSealIdempotencyResultRecord = CurrentSigningSessionSealSuccessIdempotencyResultRecord | CurrentSigningSessionSealFailureIdempotencyResultRecord;
-export type CurrentSigningSessionSealIdempotencyStoredEntry = {
+type CurrentSigningSessionSealIdempotencyResultRecord = CurrentSigningSessionSealSuccessIdempotencyResultRecord | CurrentSigningSessionSealFailureIdempotencyResultRecord;
+type CurrentSigningSessionSealIdempotencyStoredEntry = {
     result: CurrentSigningSessionSealIdempotencyResultRecord;
     expiresAtMs: number;
 };
-export declare const parseCurrentSigningSessionSealIdempotencyRecord: typeof parseCurrentSigningSessionSealIdempotencyResultRecord;
-export declare function parseCurrentSigningSessionSealIdempotencyResultRecord(raw: unknown): CurrentSigningSessionSealIdempotencyResultRecord | null;
 export declare function parseCurrentSigningSessionSealIdempotencyStoredEntry(raw: unknown): CurrentSigningSessionSealIdempotencyStoredEntry | null;
 export declare function parseCurrentSigningSessionSealIdempotencyRouteResult(raw: unknown): SigningSessionSealRouteResult | null;
+export {};
 //# sourceMappingURL=idempotencyRecords.d.ts.map

package/dist/types/wallet-server/src/threshold/session/signingSessionSeal/transport/shared.d.ts

@@ -11,6 +11,7 @@ export declare function resolveSigningSessionSealBasePath(input: string | undefi
 export declare function buildSigningSessionSealApplyPath(basePath: string): string;
 export declare function buildSigningSessionSealRemovePath(basePath: string): string;
 export declare function parseSigningSessionSealApplyBody(body: unknown): ParseResult<SigningSessionSealApplyServerSealRequest>;
+/** Removal takes the same body as apply. */
 export declare function parseSigningSessionSealRemoveBody(body: unknown): ParseResult<SigningSessionSealRemoveServerSealRequest>;
 export declare function authorizeSigningSessionSealRequest(args: {
     options: SigningSessionSealRoutesOptions;

package/dist/types/wallet-server/src/threshold/statusCodes.d.ts

@@ -1,10 +1,10 @@
-export type ThresholdRouteResult = {
+type ThresholdRouteResult = {
     ok: boolean;
     code?: string;
 };
-export type ThresholdEd25519RouteResult = ThresholdRouteResult;
-export type ThresholdEcdsaRouteResult = ThresholdRouteResult;
-export declare function thresholdStatusCode(result: ThresholdRouteResult): number;
+type ThresholdEd25519RouteResult = ThresholdRouteResult;
+type ThresholdEcdsaRouteResult = ThresholdRouteResult;
 export declare function thresholdEd25519StatusCode(result: ThresholdEd25519RouteResult): number;
 export declare function thresholdEcdsaStatusCode(result: ThresholdEcdsaRouteResult): number;
+export {};
 //# sourceMappingURL=statusCodes.d.ts.map

package/migrations/d1-signer/0036_r150_yao_lifecycle_decisions.sql

@@ -0,0 +1,22 @@
+-- R150: one finalization decision per Ed25519 Yao lifecycle.
+--
+-- The Router's wallet object records each registration's execution and binds
+-- the first finalization that consumes it. The decision is the Gateway's fact:
+-- a row here commits in the same batch as the writes that make the
+-- finalization visible (the wallet's signer rows), so the result is visible if
+-- and only if its decision exists. A row is written once and never changes.
+CREATE TABLE yao_lifecycle_decisions (
+  namespace TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  project_id TEXT NOT NULL,
+  env_id TEXT NOT NULL,
+  lifecycle_id TEXT NOT NULL,
+  decision_kind TEXT NOT NULL,
+  decision_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL,
+  decided_at_ms INTEGER NOT NULL,
+  PRIMARY KEY (namespace, org_id, project_id, env_id, lifecycle_id),
+  CHECK (decision_kind IN ('registration_finalized', 'add_signer_finalized')),
+  CHECK (length(decision_id) > 0),
+  CHECK (length(wallet_id) > 0)
+);

package/migrations/d1-signer/0037_r150_wallet_auth_method_revocation_replays.sql

@@ -0,0 +1,26 @@
+-- R150: the committed answer to one auth-method revocation.
+--
+-- A revocation commits its method, session and envelope writes in one batch,
+-- and this row with them: the exact answer the request received, bound to the
+-- operation it named and to a digest of the proof that authorized it, never
+-- the proof itself. An exact retry after a lost answer is answered from this
+-- row instead of presenting its single-use proof again. A method is revoked
+-- once, so the row is keyed by the method, and it never changes.
+CREATE TABLE wallet_auth_method_revocation_replays (
+  namespace TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  project_id TEXT NOT NULL,
+  env_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL,
+  target_wallet_auth_method_id TEXT NOT NULL,
+  operation_fingerprint_digest_b64u TEXT NOT NULL,
+  source_wallet_auth_method_id TEXT NOT NULL,
+  source_proof_digest_b64u TEXT NOT NULL,
+  response_json TEXT NOT NULL,
+  committed_at_ms INTEGER NOT NULL,
+  PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_id, target_wallet_auth_method_id),
+  CHECK (length(operation_fingerprint_digest_b64u) > 0),
+  CHECK (length(source_proof_digest_b64u) > 0),
+  CHECK (json_valid(response_json)),
+  CHECK (committed_at_ms >= 0)
+);

package/migrations/d1-signer/0038_r150_registration_ceremony_cas_guard_seed.sql

@@ -0,0 +1,8 @@
+-- R150: seed the registration ceremony CAS guard.
+--
+-- Guarded D1 batches abort by colliding with this immutable singleton when a
+-- preceding compare-and-swap statement changes no row. 0001 created the table
+-- but not its row, so the first guard to fire on each database inserted the
+-- row and let its batch commit instead of aborting. Registration ceremony
+-- records and the Email OTP registration receipt use this guard.
+INSERT OR IGNORE INTO registration_ceremony_cas_guard (guard_id) VALUES (1);

package/migrations/d1-signer/0039_r150_revocation_replay_answer_kind.sql

@@ -0,0 +1,9 @@
+-- R150: which route answered a recorded revocation.
+--
+-- A linked device's method is revoked through the device-management route,
+-- whose answer names the device's authority and its revocation epoch; the
+-- auth-method route answers with the method's kind. Both record the answer
+-- here, keyed by the method and bound to the same operation fingerprint, so
+-- each route reads back only an answer it recorded itself.
+ALTER TABLE wallet_auth_method_revocation_replays
+  ADD COLUMN answer_kind TEXT NOT NULL DEFAULT 'wallet_auth_method_revocation_v1';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seams/wallet-server",
-  "version": "0.6.2",
+  "version": "0.7.1",
   "type": "module",
   "description": "Seams server TypeScript SDK for NEAR and EVM-family wallets",
   "main": "./dist/esm/index.js",

package/dist/esm/core/ThresholdService/ecdsaClientRootProof.js

@@ -1,27 +0,0 @@
-import { base64UrlDecode, base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
-import "../../shared-ts/src/utils/encoders.js";
-import { verifySecp256k1RecoverableSignatureAgainstPublicKey33 } from "./evmCryptoWasm.js";
-//#region src/core/ThresholdService/ecdsaClientRootProof.ts
-async function verifyEcdsaClientRootProof(proof) {
-	try {
-		if (base64UrlEncode(await verifySecp256k1RecoverableSignatureAgainstPublicKey33(base64UrlDecode(proof.digest32B64u), base64UrlDecode(proof.signature65B64u), base64UrlDecode(proof.clientRootPublicKey33B64u))) !== proof.clientRootPublicKey33B64u) return {
-			ok: false,
-			code: "unauthorized",
-			message: "Invalid client root proof"
-		};
-		return {
-			ok: true,
-			clientRootPublicKey33B64u: proof.clientRootPublicKey33B64u
-		};
-	} catch {
-		return {
-			ok: false,
-			code: "unauthorized",
-			message: "Invalid client root proof"
-		};
-	}
-}
-//#endregion
-export { verifyEcdsaClientRootProof };
-
-//# sourceMappingURL=ecdsaClientRootProof.js.map

package/dist/esm/core/ThresholdService/routerAbEcdsaSigningWorkerWasm.js

@@ -1,115 +0,0 @@
-import __wbg_init, { init_router_ab_ecdsa_signing_worker, router_ab_ecdsa_derivation_relayer_bootstrap } from "../../wasm/router_ab_ecdsa_signing_worker/pkg/router_ab_ecdsa_signing_worker.js";
-//#region src/core/ThresholdService/routerAbEcdsaSigningWorkerWasm.ts
-const WASM_PATH_CANDIDATES = [
-	"../../wasm/router_ab_ecdsa_signing_worker/pkg/router_ab_ecdsa_signing_worker_bg.wasm",
-	"../../wasm/router_ab_ecdsa_signing_worker/pkg/router_ab_ecdsa_signing_worker_bg.wasm",
-	"../../wasm/router_ab_ecdsa_signing_worker/pkg/router_ab_ecdsa_signing_worker_bg.wasm"
-];
-let initPromise = null;
-let isReady = false;
-function isNodeEnvironment() {
-	const processObject = globalThis.process;
-	const webSocketPair = globalThis.WebSocketPair;
-	const navigatorObject = globalThis.navigator;
-	const isCloudflareWorker = typeof webSocketPair !== "undefined" || typeof navigatorObject?.userAgent === "string" && navigatorObject.userAgent.includes("Cloudflare-Workers");
-	return Boolean(processObject?.versions?.node) && !isCloudflareWorker;
-}
-function resolveWasmUrls() {
-	const baseUrl = import.meta.url;
-	const resolved = [];
-	for (const candidate of WASM_PATH_CANDIDATES) try {
-		resolved.push(new URL(candidate, baseUrl));
-	} catch {
-		continue;
-	}
-	return resolved;
-}
-async function loadBundledModule() {
-	try {
-		const imported = await import("../../wasm/router_ab_ecdsa_signing_worker/pkg/router_ab_ecdsa_signing_worker_bg.wasm");
-		return imported.default instanceof WebAssembly.Module ? imported.default : null;
-	} catch {
-		return null;
-	}
-}
-async function initializeCompiledModule(module) {
-	await __wbg_init({ module_or_path: module });
-	init_router_ab_ecdsa_signing_worker();
-	isReady = true;
-}
-async function initializeNodeWasm(urls) {
-	const { fileURLToPath } = await import("node:url");
-	const { readFile } = await import("node:fs/promises");
-	for (const url of urls) try {
-		const bytes = await readFile(fileURLToPath(url));
-		const moduleBytes = new ArrayBuffer(bytes.byteLength);
-		new Uint8Array(moduleBytes).set(bytes);
-		await initializeCompiledModule(await WebAssembly.compile(moduleBytes));
-		return;
-	} catch {
-		continue;
-	}
-	throw new Error(`[threshold-ecdsa] Failed to initialize Router A/B signing worker WASM: ${urls.map(String).join(", ")}`);
-}
-async function initializeWorkerWasm(urls) {
-	let lastError = null;
-	const bundledModule = await loadBundledModule();
-	if (bundledModule) try {
-		await initializeCompiledModule(bundledModule);
-		return;
-	} catch (error) {
-		lastError = error;
-	}
-	for (const url of urls) try {
-		await __wbg_init({ module_or_path: url });
-		init_router_ab_ecdsa_signing_worker();
-		isReady = true;
-		return;
-	} catch (error) {
-		lastError = error;
-	}
-	throw lastError instanceof Error ? lastError : /* @__PURE__ */ new Error("Failed to initialize Router A/B signing worker WASM");
-}
-async function initializeWasm() {
-	const urls = resolveWasmUrls();
-	if (isNodeEnvironment()) {
-		await initializeNodeWasm(urls);
-		return;
-	}
-	await initializeWorkerWasm(urls);
-}
-function ensureRouterAbEcdsaSigningWorkerWasm() {
-	initPromise ??= initializeWasm();
-	return initPromise;
-}
-function requireReady() {
-	if (!isReady) throw new Error("[threshold-ecdsa] Router A/B signing worker WASM is not ready");
-}
-function checkedBytes(label, value, expectedLength) {
-	if (value.length !== expectedLength) throw new Error(`${label} must be ${expectedLength} bytes (got ${value.length})`);
-	return value;
-}
-async function roleLocalThresholdEcdsaDerivationRelayerBootstrap(input) {
-	await ensureRouterAbEcdsaSigningWorkerWasm();
-	requireReady();
-	const raw = router_ab_ecdsa_derivation_relayer_bootstrap({
-		applicationBindingDigest: Array.from(checkedBytes("applicationBindingDigest", input.applicationBindingDigest, 32)),
-		relayerKeyId: input.relayerKeyId,
-		yRelayer32Le: Array.from(checkedBytes("yRelayer32Le", input.yRelayer32Le, 32)),
-		clientPublicKey33: Array.from(checkedBytes("clientPublicKey33", input.clientPublicKey33, 33)),
-		clientShareRetryCounter: input.clientShareRetryCounter
-	});
-	return {
-		contextBinding32: checkedBytes("contextBinding32", raw.contextBinding32, 32),
-		relayerShare32: checkedBytes("relayerShare32", raw.relayerShare32, 32),
-		relayerPublicKey33: checkedBytes("relayerPublicKey33", raw.relayerPublicKey33, 33),
-		groupPublicKey33: checkedBytes("groupPublicKey33", raw.groupPublicKey33, 33),
-		ethereumAddress20: checkedBytes("ethereumAddress20", raw.ethereumAddress20, 20),
-		relayerShareRetryCounter: raw.relayerShareRetryCounter,
-		publicTranscriptDigest32: checkedBytes("publicTranscriptDigest32", raw.publicTranscriptDigest32, 32)
-	};
-}
-//#endregion
-export { ensureRouterAbEcdsaSigningWorkerWasm, roleLocalThresholdEcdsaDerivationRelayerBootstrap };
-
-//# sourceMappingURL=routerAbEcdsaSigningWorkerWasm.js.map

package/dist/esm/core/ThresholdService/secureRandomId.js

@@ -1,9 +0,0 @@
-import { secureRandomBase64Url } from "../../shared-ts/src/utils/secureRandomId.js";
-//#region src/core/ThresholdService/secureRandomId.ts
-function secureRandomIdFragment() {
-	return secureRandomBase64Url(32, "threshold session IDs");
-}
-//#endregion
-export { secureRandomIdFragment };
-
-//# sourceMappingURL=secureRandomId.js.map

package/dist/esm/core/authService/record.js

@@ -1,8 +0,0 @@
-//#region src/core/authService/record.ts
-function isObject(v) {
-	return !!v && typeof v === "object" && !Array.isArray(v);
-}
-//#endregion
-export { isObject };
-
-//# sourceMappingURL=record.js.map

package/dist/esm/core/authService/thresholdRuntimePolicy.js

@@ -1,19 +0,0 @@
-import { normalizeRuntimePolicyScope } from "../../shared-ts/src/threshold/signingRootScope.js";
-//#region src/core/authService/thresholdRuntimePolicy.ts
-function normalizeThresholdRuntimePolicyScope(raw) {
-	try {
-		return normalizeRuntimePolicyScope(raw);
-	} catch {
-		return;
-	}
-}
-function thresholdRuntimePolicyScopesEqual(leftRaw, rightRaw) {
-	const left = normalizeThresholdRuntimePolicyScope(leftRaw);
-	const right = normalizeThresholdRuntimePolicyScope(rightRaw);
-	if (!left || !right) return !left && !right;
-	return left.orgId === right.orgId && left.projectId === right.projectId && left.envId === right.envId && left.signingRootVersion === right.signingRootVersion;
-}
-//#endregion
-export { normalizeThresholdRuntimePolicyScope, thresholdRuntimePolicyScopesEqual };
-
-//# sourceMappingURL=thresholdRuntimePolicy.js.map