@seams/wallet-server 0.6.2 → 0.7.1

package/dist/types/wallet-server/src/localIntendedLinkExecuteFault.d.ts

@@ -0,0 +1,47 @@
+export declare const LOCAL_INTENDED_LINK_EXECUTE_FAULT_HEADER_V1 = "x-seams-intended-link-execute-fault-v1";
+export declare const LOCAL_INTENDED_LINK_EXECUTE_FAULT_TOKEN_HEADER_V1 = "x-seams-intended-link-execute-fault-token-v1";
+/**
+ * `drop_router_response_once` lets the Router run a linked device's
+ * source-preserving execution, then loses its answer. The Gateway must send
+ * the same request again, marked as the Router's replay, and the Router must
+ * answer it with the reservation the lost answer carried.
+ */
+type LocalIntendedLinkExecuteFaultModeV1 = 'drop_router_response_once';
+type LocalIntendedLinkExecuteFaultProofV1 = 'replay_answered_same_reservation';
+type LocalIntendedLinkExecuteFaultViolationV1 = 'router_execute_not_observed' | 'router_first_response_failed' | 'router_first_marked_as_replay' | 'router_retry_not_observed' | 'router_retry_body_changed' | 'router_retry_not_marked_as_replay' | 'router_retry_response_failed' | 'router_retry_answer_changed' | 'unexpected_additional_execute';
+type LocalIntendedLinkExecuteFaultStateV1 = {
+    readonly kind: 'armed';
+} | {
+    readonly kind: 'awaiting_replay';
+    readonly body: Uint8Array;
+    readonly answer: Uint8Array;
+} | {
+    readonly kind: 'proved';
+    readonly proof: LocalIntendedLinkExecuteFaultProofV1;
+} | {
+    readonly kind: 'violated';
+    readonly violation: LocalIntendedLinkExecuteFaultViolationV1;
+};
+type LocalIntendedLinkExecuteFaultOutcomeV1 = Extract<LocalIntendedLinkExecuteFaultStateV1, {
+    kind: 'proved';
+} | {
+    kind: 'violated';
+}>;
+type LocalIntendedLinkExecuteFaultTokenV1 = {
+    readonly value: string;
+};
+export declare function parseLocalIntendedLinkExecuteFaultModeV1(value: string | null): LocalIntendedLinkExecuteFaultModeV1 | null;
+export declare function parseLocalIntendedLinkExecuteFaultTokenV1(value: string | null): LocalIntendedLinkExecuteFaultTokenV1 | null;
+export declare class LocalIntendedLinkExecuteFaultControllerV1 {
+    private readonly baseFetch;
+    private state;
+    constructor(baseFetch: typeof globalThis.fetch);
+    fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
+    outcome(): LocalIntendedLinkExecuteFaultOutcomeV1;
+    private handleFirstExecute;
+    private handleReplay;
+}
+export declare function requestWithoutLocalIntendedLinkExecuteFaultHeadersV1(request: Request): Request;
+export declare function responseWithLocalIntendedLinkExecuteFaultOutcomeV1(response: Response, outcome: LocalIntendedLinkExecuteFaultOutcomeV1, token: LocalIntendedLinkExecuteFaultTokenV1): Response;
+export {};
+//# sourceMappingURL=localIntendedLinkExecuteFault.d.ts.map

package/dist/types/wallet-server/src/localIntendedRevokeFault.d.ts

@@ -0,0 +1,40 @@
+import type { D1DatabaseLike, D1PreparedStatementLike } from './storage/tenantRoute';
+export declare const LOCAL_INTENDED_REVOKE_FAULT_HEADER_V1 = "x-seams-intended-revoke-fault-v1";
+export declare const LOCAL_INTENDED_REVOKE_FAULT_TOKEN_HEADER_V1 = "x-seams-intended-revoke-fault-token-v1";
+export declare const WALLET_REVOKE_AUTH_METHOD_PATH_PATTERN_V1: RegExp;
+/** A linked device's method, revoked through device management. */
+export declare const LINKED_DEVICE_REVOKE_PATH_PATTERN_V1: RegExp;
+/**
+ * `refuse_revocation_batch_once` refuses the batch that would revoke an auth
+ * method, directly or as a linked device's, and record its answer, as a
+ * commit that failed: nothing in it is written. The proof says whether that batch carried the spend of the
+ * request's Email OTP code, and whether anything spent a code outside it. A
+ * code spent before its revocation commits is lost with a failed commit, and
+ * the request could not be sent again.
+ */
+type LocalIntendedRevokeFaultModeV1 = 'refuse_revocation_batch_once';
+type LocalIntendedRevokeFaultProofV1 = 'refused_revocation_with_its_code' | 'refused_revocation_without_code';
+type LocalIntendedRevokeFaultViolationV1 = 'revocation_batch_not_observed' | 'code_spent_outside_revocation' | 'additional_revocation_batch';
+export declare function parseLocalIntendedRevokeFaultModeV1(value: string | null): LocalIntendedRevokeFaultModeV1 | null;
+export declare function parseLocalIntendedRevokeFaultTokenV1(value: string | null): string | null;
+/** The signer database, refusing one auth-method revocation's batch. */
+export declare class LocalIntendedRevokeFaultDatabaseV1 implements D1DatabaseLike {
+    private readonly base;
+    private state;
+    constructor(base: D1DatabaseLike);
+    prepare(query: string): D1PreparedStatementLike;
+    batch<T = unknown>(statements: readonly D1PreparedStatementLike[]): Promise<readonly T[]>;
+    exec(query: string): Promise<unknown>;
+    spentCodeOutsideRevocation(): void;
+    outcome(): {
+        readonly kind: 'proved';
+        readonly proof: LocalIntendedRevokeFaultProofV1;
+    } | {
+        readonly kind: 'violated';
+        readonly violation: LocalIntendedRevokeFaultViolationV1;
+    };
+}
+export declare function requestWithoutLocalIntendedRevokeFaultHeadersV1(request: Request): Request;
+export declare function responseWithLocalIntendedRevokeFaultOutcomeV1(response: Response, outcome: ReturnType<LocalIntendedRevokeFaultDatabaseV1['outcome']>, token: string): Response;
+export {};
+//# sourceMappingURL=localIntendedRevokeFault.d.ts.map

package/dist/types/wallet-server/src/localIntendedSessionAdmissionFault.d.ts

@@ -0,0 +1,41 @@
+import type { D1DatabaseLike, D1PreparedStatementLike } from './storage/tenantRoute';
+export declare const LOCAL_INTENDED_SESSION_ADMISSION_FAULT_HEADER_V1 = "x-seams-intended-session-admission-fault-v1";
+export declare const LOCAL_INTENDED_SESSION_ADMISSION_FAULT_TOKEN_HEADER_V1 = "x-seams-intended-session-admission-fault-token-v1";
+export declare const LOCAL_INTENDED_SESSION_ADMISSION_FAULT_PROOF_HEADER_V1 = "x-seams-intended-session-admission-fault-proof-v1";
+/** The ECDSA signing prepare: it admits the Wallet Session's operation credential. */
+export declare const ECDSA_SIGN_PREPARE_PATH_V1 = "/router-ab/ecdsa-derivation/sign/prepare";
+/**
+ * `hold_after_session_read_until_authority_changes` lets the request's first
+ * operation-credential session read return, then holds the request until the
+ * wallet's stored authority digest differs from the one that read saw: another
+ * request, NEAR provisioning extending the authority, committed in between.
+ * The request then continues. Admission read the authority again at this
+ * point before it judged one snapshot, and paired the session with the newer
+ * authority.
+ */
+type LocalIntendedSessionAdmissionFaultModeV1 = 'hold_after_session_read_until_authority_changes';
+type LocalIntendedSessionAdmissionFaultProofV1 = 'held_until_authority_changed';
+type LocalIntendedSessionAdmissionFaultViolationV1 = 'session_read_not_observed' | 'authority_unchanged';
+export declare function parseLocalIntendedSessionAdmissionFaultModeV1(value: string | null): LocalIntendedSessionAdmissionFaultModeV1 | null;
+export declare function parseLocalIntendedSessionAdmissionFaultTokenV1(value: string | null): string | null;
+/** The signer database, holding one request after its session read. */
+export declare class LocalIntendedSessionAdmissionFaultDatabaseV1 implements D1DatabaseLike {
+    private readonly base;
+    private state;
+    constructor(base: D1DatabaseLike);
+    prepare(query: string): D1PreparedStatementLike;
+    batch<T = unknown>(statements: readonly D1PreparedStatementLike[]): Promise<readonly T[]>;
+    exec(query: string): Promise<unknown>;
+    holdAfterSessionRead(row: unknown): Promise<void>;
+    outcome(): {
+        readonly kind: 'proved';
+        readonly proof: LocalIntendedSessionAdmissionFaultProofV1;
+    } | {
+        readonly kind: 'violated';
+        readonly violation: LocalIntendedSessionAdmissionFaultViolationV1;
+    };
+}
+export declare function requestWithoutLocalIntendedSessionAdmissionFaultHeadersV1(request: Request): Request;
+export declare function responseWithLocalIntendedSessionAdmissionFaultOutcomeV1(response: Response, outcome: ReturnType<LocalIntendedSessionAdmissionFaultDatabaseV1['outcome']>, token: string): Response;
+export {};
+//# sourceMappingURL=localIntendedSessionAdmissionFault.d.ts.map

package/dist/types/wallet-server/src/localIntendedYaoExportFault.d.ts

@@ -0,0 +1,41 @@
+import type { D1DatabaseLike, D1PreparedStatementLike } from './storage/tenantRoute';
+export declare const LOCAL_INTENDED_YAO_EXPORT_FAULT_HEADER_V1 = "x-seams-intended-yao-export-fault-v1";
+export declare const LOCAL_INTENDED_YAO_EXPORT_FAULT_TOKEN_HEADER_V1 = "x-seams-intended-yao-export-fault-token-v1";
+/**
+ * An Ed25519 Yao export admission loses the Gateway's storage once, right
+ * after the batch that authorized the export committed: its next storage call
+ * fails, and the request ends there. The identical request is then sent
+ * again, and must admit the export from the authorization that batch made
+ * durable. Local only.
+ */
+type LocalIntendedYaoExportFaultModeV1 = 'lose_storage_after_export_authorization_once';
+type LocalIntendedYaoExportFaultProofV1 = 'export_authorization_committed_then_storage_lost';
+type LocalIntendedYaoExportFaultViolationV1 = 'export_authorization_not_committed' | 'no_storage_call_after_authorization' | 'interrupted_admission_answered' | 'retried_admission_failed';
+type LocalIntendedYaoExportFaultOutcomeV1 = {
+    readonly kind: 'proved';
+    readonly proof: LocalIntendedYaoExportFaultProofV1;
+} | {
+    readonly kind: 'violated';
+    readonly violation: LocalIntendedYaoExportFaultViolationV1;
+};
+export declare function parseLocalIntendedYaoExportFaultModeV1(value: string | null): LocalIntendedYaoExportFaultModeV1 | null;
+export declare function parseLocalIntendedYaoExportFaultTokenV1(value: string | null): string | null;
+/** The signer database, losing itself once after an export authorization commits. */
+export declare class LocalIntendedYaoExportFaultDatabaseV1 implements D1DatabaseLike {
+    private readonly base;
+    private state;
+    constructor(base: D1DatabaseLike);
+    prepare(query: string): D1PreparedStatementLike;
+    batch<T = unknown>(statements: readonly D1PreparedStatementLike[]): Promise<readonly T[]>;
+    exec(query: string): Promise<unknown>;
+    loseStorageIfAuthorized(): void;
+    /** The fault's outcome, from whether each of the two identical requests was admitted. */
+    outcome(answers: {
+        readonly interruptedOk: boolean;
+        readonly retriedOk: boolean;
+    }): LocalIntendedYaoExportFaultOutcomeV1;
+}
+export declare function requestWithoutLocalIntendedYaoExportFaultHeadersV1(request: Request): Request;
+export declare function responseWithLocalIntendedYaoExportFaultOutcomeV1(response: Response, outcome: LocalIntendedYaoExportFaultOutcomeV1, token: string): Response;
+export {};
+//# sourceMappingURL=localIntendedYaoExportFault.d.ts.map

package/dist/types/wallet-server/src/localIntendedYaoFault.d.ts

@@ -1,8 +1,14 @@
 export declare const LOCAL_INTENDED_YAO_FAULT_HEADER_V1 = "x-seams-intended-yao-fault-v1";
 export declare const LOCAL_INTENDED_YAO_FAULT_TOKEN_HEADER_V1 = "x-seams-intended-yao-fault-token-v1";
+/**
+ * - `drop_router_response_once` loses the Router's reply to the first
+ *   execute, and expects the Gateway to send the identical request again.
+ * - `return_terminal_burned_once` has the Router end the first execute
+ *   burned, and expects the Gateway to answer that failure without retrying.
+ */
 type LocalIntendedYaoFaultModeV1 = 'drop_router_response_once' | 'return_terminal_burned_once';
 type LocalIntendedYaoFaultProofV1 = 'exact_request_replayed' | 'terminal_failure_not_retried';
-type LocalIntendedYaoFaultViolationV1 = 'fault_already_armed' | 'router_execute_not_observed' | 'router_first_response_failed' | 'router_retry_not_observed' | 'router_retry_body_changed' | 'router_retry_trace_changed' | 'router_retry_marker_missing' | 'router_retry_response_failed' | 'unexpected_additional_execute';
+type LocalIntendedYaoFaultViolationV1 = 'fault_already_armed' | 'router_execute_not_observed' | 'router_first_response_failed' | 'router_retry_not_observed' | 'router_retry_body_changed' | 'router_retry_trace_changed' | 'router_retry_marked_as_replay' | 'router_retry_response_failed' | 'router_terminal_not_recorded' | 'unexpected_additional_execute';
 type LocalIntendedYaoFaultOutcomeV1 = {
     readonly kind: 'proved';
     readonly proof: LocalIntendedYaoFaultProofV1;

package/dist/types/wallet-server/src/localIntendedYaoFinalizeFault.d.ts

@@ -0,0 +1,37 @@
+import type { D1DatabaseLike, D1PreparedStatementLike } from './storage/tenantRoute';
+export declare const LOCAL_INTENDED_YAO_FINALIZE_FAULT_HEADER_V1 = "x-seams-intended-yao-finalize-fault-v1";
+export declare const LOCAL_INTENDED_YAO_FINALIZE_FAULT_TOKEN_HEADER_V1 = "x-seams-intended-yao-finalize-fault-token-v1";
+export declare const WALLET_REGISTRATION_NEAR_PROVISIONING_PATH_V1 = "/wallets/register/near-provisioning";
+/**
+ * The Gateway loses its storage once, right after the batch that made an
+ * Ed25519 Yao registration visible committed the lifecycle's decision: the
+ * finalize's next storage call fails. The finalize reports a retryable
+ * failure, and a retry must resume from the decision instead of committing
+ * the registration again.
+ */
+type LocalIntendedYaoFinalizeFaultModeV1 = 'lose_storage_after_decision_once';
+type LocalIntendedYaoFinalizeFaultProofV1 = 'decision_committed_then_storage_lost';
+type LocalIntendedYaoFinalizeFaultViolationV1 = 'decision_not_committed' | 'no_storage_call_after_decision';
+export declare function parseLocalIntendedYaoFinalizeFaultModeV1(value: string | null): LocalIntendedYaoFinalizeFaultModeV1 | null;
+export declare function parseLocalIntendedYaoFinalizeFaultTokenV1(value: string | null): string | null;
+/** The signer database, losing itself once after a Yao decision commits. */
+export declare class LocalIntendedYaoFinalizeFaultDatabaseV1 implements D1DatabaseLike {
+    private readonly base;
+    private state;
+    constructor(base: D1DatabaseLike);
+    prepare(query: string): D1PreparedStatementLike;
+    batch<T = unknown>(statements: readonly D1PreparedStatementLike[]): Promise<readonly T[]>;
+    exec(query: string): Promise<unknown>;
+    loseStorageIfDecided(): void;
+    outcome(): {
+        readonly kind: 'proved';
+        readonly proof: LocalIntendedYaoFinalizeFaultProofV1;
+    } | {
+        readonly kind: 'violated';
+        readonly violation: LocalIntendedYaoFinalizeFaultViolationV1;
+    };
+}
+export declare function requestWithoutLocalIntendedYaoFinalizeFaultHeadersV1(request: Request): Request;
+export declare function responseWithLocalIntendedYaoFinalizeFaultOutcomeV1(response: Response, outcome: ReturnType<LocalIntendedYaoFinalizeFaultDatabaseV1['outcome']>, token: string): Response;
+export {};
+//# sourceMappingURL=localIntendedYaoFinalizeFault.d.ts.map

package/dist/types/wallet-server/src/localIntendedYaoRecoveryFault.d.ts

@@ -0,0 +1,45 @@
+export declare const LOCAL_INTENDED_YAO_RECOVERY_FAULT_HEADER_V1 = "x-seams-intended-yao-recovery-fault-v1";
+export declare const LOCAL_INTENDED_YAO_RECOVERY_FAULT_TOKEN_HEADER_V1 = "x-seams-intended-yao-recovery-fault-token-v1";
+/**
+ * Faults on one recovery execution's way to the Router. Local only.
+ * - `lose_router_recovery_replies`: the execution completes at the Router,
+ *   and every reply to it is lost on its way back to the Gateway, the
+ *   Gateway's replay included. The Gateway records the execution as
+ *   interrupted, while the attempt's candidate is already staged at the
+ *   SigningWorker.
+ * - `withhold_router_recovery_execute`: the execution never reaches the
+ *   Router, and the Gateway keeps it; the Gateway records it as interrupted.
+ * - `release_router_recovery_execute`: a kept execution reaches the Router
+ *   now, exactly as the Gateway sent it: a late run of an attempt the Gateway
+ *   has since superseded.
+ */
+type LocalIntendedYaoRecoveryFaultModeV1 = 'lose_router_recovery_replies' | 'withhold_router_recovery_execute' | 'release_router_recovery_execute';
+type LocalIntendedYaoRecoveryFaultOutcomeV1 = {
+    readonly kind: 'proved';
+    readonly proof: 'recovery_replies_lost_after_router_executed' | 'recovery_execute_withheld';
+} | {
+    readonly kind: 'violated';
+    readonly violation: 'router_recovery_not_executed' | 'router_recovery_answer_failed' | 'router_recovery_execute_not_observed';
+};
+export declare function parseLocalIntendedYaoRecoveryFaultModeV1(value: string | null): LocalIntendedYaoRecoveryFaultModeV1 | null;
+export declare function parseLocalIntendedYaoRecoveryFaultTokenV1(value: string | null): string | null;
+/** The Gateway's Router binding, faulting every call to a recovery execution. */
+export declare class LocalIntendedYaoRecoveryFaultControllerV1 {
+    private readonly baseFetch;
+    private readonly mode;
+    private readonly token;
+    private executed;
+    private failed;
+    private kept;
+    constructor(baseFetch: typeof globalThis.fetch, mode: 'lose_router_recovery_replies' | 'withhold_router_recovery_execute', token: string);
+    fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
+    outcome(): LocalIntendedYaoRecoveryFaultOutcomeV1;
+}
+/** Sends the execution kept under `token` to the Router, exactly. */
+export declare function releaseLocalIntendedYaoRecoveryExecuteV1(router: {
+    fetch(request: Request): Promise<Response>;
+}, token: string): Promise<Response>;
+export declare function requestWithoutLocalIntendedYaoRecoveryFaultHeadersV1(request: Request): Request;
+export declare function responseWithLocalIntendedYaoRecoveryFaultOutcomeV1(response: Response, outcome: LocalIntendedYaoRecoveryFaultOutcomeV1, token: string): Response;
+export {};
+//# sourceMappingURL=localIntendedYaoRecoveryFault.d.ts.map

package/dist/types/wallet-server/src/localIntendedYaoSigningFault.d.ts

@@ -0,0 +1,51 @@
+export declare const LOCAL_INTENDED_YAO_SIGNING_FAULT_HEADER_V1 = "x-seams-intended-yao-signing-fault-v1";
+export declare const LOCAL_INTENDED_YAO_SIGNING_FAULT_TOKEN_HEADER_V1 = "x-seams-intended-yao-signing-fault-token-v1";
+export declare const ROUTER_AB_ED25519_SIGNING_FINALIZE_PATH_V1 = "/router-ab/ed25519/sign";
+/**
+ * A NEAR signature's finalize, as the Gateway sends it to the Router after
+ * authorizing it, kept to be sent again later: a request authorized before a
+ * recovery that arrives after it. Local only.
+ * - `capture_signing_finalize` lets the finalize run and keeps it: a
+ *   signature already made.
+ * - `withhold_signing_finalize` keeps it and never sends it: a signature
+ *   authorized but not yet made. The Gateway's answer is a refusal.
+ * - `release_signing_finalize` sends a kept finalize to the Router again,
+ *   exactly, and answers with the Router's reply.
+ * - `arm_signing_worker_hold` asks the SigningWorker to hold the next NEAR
+ *   finalize of the wallet the body names after it signs and before it
+ *   commits, until its activation is retired: a finalize that loaded its
+ *   material just before a recovery promoted. Dev builds of the Workers D1
+ *   SigningWorker only; the wallet object and the VM SigningWorker sign and
+ *   commit in one step.
+ * - `read_signing_worker_hold` reads that hold's state.
+ */
+type LocalIntendedYaoSigningFaultModeV1 = 'capture_signing_finalize' | 'withhold_signing_finalize' | 'release_signing_finalize' | 'arm_signing_worker_hold' | 'read_signing_worker_hold';
+export declare function parseLocalIntendedYaoSigningFaultModeV1(value: string | null): LocalIntendedYaoSigningFaultModeV1 | null;
+export declare function parseLocalIntendedYaoSigningFaultTokenV1(value: string | null): string | null;
+/** The Gateway's Router binding, keeping the first NEAR finalize it carries. */
+export declare class LocalIntendedYaoSigningFaultControllerV1 {
+    private readonly baseFetch;
+    private readonly mode;
+    private readonly token;
+    private kept;
+    constructor(baseFetch: typeof globalThis.fetch, mode: 'capture_signing_finalize' | 'withhold_signing_finalize', token: string);
+    fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
+    private keep;
+    outcome(): string;
+}
+/** Sends the finalize kept under `token` to the Router again, exactly. */
+export declare function releaseLocalIntendedYaoSigningFinalizeV1(router: {
+    fetch(request: Request): Promise<Response>;
+}, token: string): Promise<Response>;
+/**
+ * Arms or reads the SigningWorker's hold on one wallet's next NEAR finalize,
+ * with the Gateway's own SigningWorker credential, and answers with the
+ * SigningWorker's reply.
+ */
+export declare function commandLocalIntendedSigningWorkerHoldV1(signingWorker: {
+    fetch(request: Request): Promise<Response>;
+}, credential: string | undefined, mode: 'arm_signing_worker_hold' | 'read_signing_worker_hold', body: unknown): Promise<Response>;
+export declare function requestWithoutLocalIntendedYaoSigningFaultHeadersV1(request: Request): Request;
+export declare function responseWithLocalIntendedYaoSigningFaultOutcomeV1(response: Response, outcome: string): Response;
+export {};
+//# sourceMappingURL=localIntendedYaoSigningFault.d.ts.map

package/dist/types/wallet-server/src/router/auth/authRequestValidation.d.ts

@@ -1,5 +1,5 @@
 import type { WebAuthnAuthenticationCredential } from '../../core/types';
-export type AuthProviderActionRoute = {
+type AuthProviderActionRoute = {
     kind: 'passkey_options';
 } | {
     kind: 'passkey_verify';
@@ -10,17 +10,17 @@ export type AuthProviderActionRoute = {
 } | {
     kind: 'github_options';
 };
-export type PasskeyLoginOptionsRequest = {
+type PasskeyLoginOptionsRequest = {
     user_id: string;
     rp_id: string;
     ttl_ms?: number;
 };
-export type PasskeyLoginVerifyRequest = {
+type PasskeyLoginVerifyRequest = {
     challengeId: string;
     webauthn_authentication: WebAuthnAuthenticationCredential;
     expected_origin: string;
 };
-export type GoogleLoginVerifyRequest = {
+type GoogleLoginVerifyRequest = {
     idToken: string;
     accountMode: 'login' | 'register';
     projectEnvironmentId: string;
@@ -39,16 +39,16 @@ export type AuthPasskeyStepUpRequest = {
     webauthn_authentication: WebAuthnAuthenticationCredential;
     expected_origin: string;
 };
-export type AuthLinkIdentityRequest = {
+type AuthLinkIdentityRequest = {
     provider: 'google';
     idToken: string;
     stepUp: AuthPasskeyStepUpRequest;
 };
-export type AuthUnlinkIdentityRequest = {
+type AuthUnlinkIdentityRequest = {
     subject: string;
     stepUp: AuthPasskeyStepUpRequest;
 };
-export type AuthIdentityMutationRequest = {
+type AuthIdentityMutationRequest = {
     kind: 'link';
     source: 'auth.link';
     request: AuthLinkIdentityRequest;
@@ -57,12 +57,12 @@ export type AuthIdentityMutationRequest = {
     source: 'auth.unlink';
     request: AuthUnlinkIdentityRequest;
 };
-export type AuthRouteErrorBody = {
+type AuthRouteErrorBody = {
     ok: false;
     code: 'invalid_body';
     message: string;
 };
-export type AuthRouteParseResult<T> = {
+type AuthRouteParseResult<T> = {
     ok: true;
     request: T;
 } | {
@@ -70,10 +70,6 @@ export type AuthRouteParseResult<T> = {
     status: 400;
     body: AuthRouteErrorBody;
 };
-export declare function parseAuthProviderAction(input: {
-    provider: unknown;
-    action: unknown;
-}): AuthProviderActionRoute | null;
 export declare function parseAuthProviderActionPath(pathname: string): AuthProviderActionRoute | null;
 export declare function parsePasskeyLoginOptionsRequest(raw: unknown): AuthRouteParseResult<PasskeyLoginOptionsRequest>;
 export declare function parsePasskeyLoginVerifyRequest(input: {
@@ -81,17 +77,10 @@ export declare function parsePasskeyLoginVerifyRequest(input: {
     origin: unknown;
 }): AuthRouteParseResult<PasskeyLoginVerifyRequest>;
 export declare function parseGoogleLoginVerifyRequest(raw: unknown): AuthRouteParseResult<GoogleLoginVerifyRequest>;
-export declare function parseAuthLinkIdentityRequest(input: {
-    body: unknown;
-    origin: unknown;
-}): AuthRouteParseResult<AuthLinkIdentityRequest>;
-export declare function parseAuthUnlinkIdentityRequest(input: {
-    body: unknown;
-    origin: unknown;
-}): AuthRouteParseResult<AuthUnlinkIdentityRequest>;
 export declare function parseAuthIdentityMutationRequest(input: {
     pathname: unknown;
     body: unknown;
     origin: unknown;
 }): AuthRouteParseResult<AuthIdentityMutationRequest> | null;
+export {};
 //# sourceMappingURL=authRequestValidation.d.ts.map

package/dist/types/wallet-server/src/router/auth/commonRouterUtils.d.ts

@@ -26,7 +26,7 @@ export type WalletSessionOperationCredentialAdmission = {
         readonly keyFamily: 'ecdsa_secp256k1';
     }>;
 };
-export type WalletSessionOperationCredentialResolution = {
+type WalletSessionOperationCredentialResolution = {
     readonly kind: 'not_found';
 } | {
     readonly kind: 'rejected';
@@ -52,7 +52,7 @@ export declare function resolveWalletSessionOperationCredentialAdmission(input:
     readonly nowMs: number;
     readonly operation: WalletSessionOperationCredentialRequest;
 }): Promise<WalletSessionOperationCredentialResolution>;
-export type WalletSessionAdministrationRequest = Pick<WalletSessionAuthorizationV2AdministrationOperation, 'kind' | 'walletId'>;
+type WalletSessionAdministrationRequest = Pick<WalletSessionAuthorizationV2AdministrationOperation, 'kind' | 'walletId'>;
 export type WalletSessionAdministrationAdmission = {
     readonly kind: 'wallet_session_administration_v1';
     readonly operationKind: 'link_devices';
@@ -61,7 +61,7 @@ export type WalletSessionAdministrationAdmission = {
         readonly ok: true;
     }>;
 };
-export type WalletSessionAdministrationResolution = {
+type WalletSessionAdministrationResolution = {
     readonly kind: 'not_found';
 } | {
     readonly kind: 'rejected';
@@ -106,6 +106,7 @@ export declare function validateEcdsaPreprocessingSession(input: {
     readonly ok: true;
     readonly kind: 'ecdsa_preprocessing_session';
     readonly session: RouterApiWalletSessionExactOperationContext['session'];
+    readonly ownerWalletScope: RouterApiWalletSessionExactOperationContext['ownerWalletScope'];
     readonly signer: Extract<WalletSessionAuthorizationV2AdmissionResult, {
         readonly ok: true;
         readonly keyFamily: 'ecdsa_secp256k1';
@@ -123,7 +124,7 @@ export declare function validateRouterAbEcdsaDerivationWalletSessionInputs(input
         readonly keyFamily: 'ecdsa_secp256k1';
     }>['operationKind'];
 }): Promise<ThresholdEcdsaSessionInputs>;
-export type ThresholdRuntimePolicyScopeResolution = {
+type ThresholdRuntimePolicyScopeResolution = {
     ok: true;
     scope?: ThresholdRuntimePolicyScope;
 } | {
@@ -140,12 +141,6 @@ export declare function resolveThresholdRuntimePolicyScope(input: {
     publishableKeyAuth?: RouterApiPublishableKeyAuthAdapter | null;
     orgProjectEnv?: RouterApiProjectEnvironmentResolver | null;
 }): Promise<ThresholdRuntimePolicyScopeResolution>;
-export declare function resolveActiveRuntimePolicyScopeFromFields(input: {
-    orgProjectEnv: RouterApiProjectEnvironmentResolver | null;
-    fields: Omit<ThresholdRuntimePolicyScope, 'signingRootVersion'> & {
-        readonly signingRootVersion?: string;
-    };
-}): Promise<ThresholdRuntimePolicyScope>;
 export declare function resolveActiveRuntimePolicyScopeForEnvironment(input: {
     orgProjectEnv: RouterApiProjectEnvironmentResolver | null;
     orgId: string;

package/dist/types/wallet-server/src/router/auth/walletSessionFailure.d.ts

@@ -1,14 +1,11 @@
-import type { SessionParseFailureReason } from '../../core/sessionValidation';
-import { WALLET_SESSION_FAILURE_CODES, type WalletSessionFailureCode } from '../../../../shared-ts/src/utils/walletSessionFailure';
+import { type WalletSessionFailureCode } from '../../../../shared-ts/src/utils/walletSessionFailure';
 export type { WalletSessionFailureCode } from '../../../../shared-ts/src/utils/walletSessionFailure';
 export type WalletSessionBoundaryFailure = {
     readonly ok: false;
     readonly code: WalletSessionFailureCode;
     readonly message: string;
 };
-export declare function walletSessionFailureCodeFromParseReason(reason: SessionParseFailureReason): Exclude<WalletSessionFailureCode, typeof WALLET_SESSION_FAILURE_CODES.scopeMismatch | typeof WALLET_SESSION_FAILURE_CODES.unavailable | typeof WALLET_SESSION_FAILURE_CODES.budgetExhausted>;
 export declare function walletSessionFailureMessage(code: WalletSessionFailureCode): string;
 export declare function walletSessionFailureStatus(code: WalletSessionFailureCode): 401 | 403 | 409 | 503;
-export declare function walletSessionParseFailure(reason: SessionParseFailureReason): WalletSessionBoundaryFailure;
 export declare function walletSessionFailure(code: WalletSessionFailureCode): WalletSessionBoundaryFailure;
 //# sourceMappingURL=walletSessionFailure.d.ts.map

package/dist/types/wallet-server/src/router/auth/webAuthnCredentialCodecs.d.ts

@@ -1,5 +1,5 @@
 import type { WebAuthnAuthenticationCredential } from '../../core/types';
-export type WebAuthnCredentialIdParseResult = {
+type WebAuthnCredentialIdParseResult = {
     readonly ok: true;
     readonly credentialIdB64u: string;
 } | {
@@ -7,7 +7,7 @@ export type WebAuthnCredentialIdParseResult = {
     readonly code: string;
     readonly message: string;
 };
-export type WebAuthnClientDataJson = {
+type WebAuthnClientDataJson = {
     readonly challenge: string;
     readonly origin: string;
     readonly type: string;
@@ -17,4 +17,5 @@ export declare function parseWebAuthnClientDataJsonBase64url(clientDataJSONB64u:
 export declare function webAuthnOriginHostnameOrEmpty(origin: string): string;
 export declare function webAuthnCredentialIdB64uFromCredential(input: unknown): WebAuthnCredentialIdParseResult;
 export declare function parseWebAuthnAuthenticationCredential(input: unknown): WebAuthnAuthenticationCredential | null;
+export {};
 //# sourceMappingURL=webAuthnCredentialCodecs.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1AuthorizedOperationRouteService.d.ts

@@ -0,0 +1,12 @@
+import type { AuthorizationService } from '../../../../authorization/service';
+import type { RouterApiServiceBag } from '../../../framework/authServicePort';
+import type { CloudflareD1AuthorizationStore } from '../authorization/d1AuthorizationStore';
+import type { NormalizedCloudflareD1RouterApiAuthServiceOptions } from './d1RouterApiAuthConfig';
+type D1AuthorizedOperationRouteServiceAssembly = {
+    readonly authorizationService: AuthorizationService;
+    readonly authorizationStore: CloudflareD1AuthorizationStore;
+    readonly options: Pick<NormalizedCloudflareD1RouterApiAuthServiceOptions, 'orgId'>;
+};
+export declare function createD1AuthorizedOperationRouteService(assembly: D1AuthorizedOperationRouteServiceAssembly): RouterApiServiceBag['authorizedOperations'];
+export {};
+//# sourceMappingURL=d1AuthorizedOperationRouteService.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1RouterApiAuthBoundary.d.ts

@@ -1,5 +1,5 @@
 import { type WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
-export type D1BoundaryWalletIdParseResult = {
+type D1BoundaryWalletIdParseResult = {
     readonly ok: true;
     readonly value: WalletId;
 } | {
@@ -15,7 +15,7 @@ export declare function positiveInteger(input: unknown): number | null;
 export declare function positiveSafeInteger(input: unknown): number | null;
 export declare function nonNegativeSafeInteger(input: unknown): number | null;
 export declare function optionalNonNegativeInteger(input: unknown): number | undefined;
-export type D1MutationResultLike = {
+type D1MutationResultLike = {
     readonly meta?: {
         readonly changes?: unknown;
         readonly rows_written?: unknown;
@@ -25,4 +25,5 @@ export declare function parseD1NonNegativeCount(input: unknown): number;
 export declare function d1MutationChanges(result: D1MutationResultLike): number;
 export declare function toArrayBufferCopy(bytes: Uint8Array): ArrayBuffer;
 export declare function sha256BytesPortable(input: Uint8Array): Promise<Uint8Array>;
+export {};
 //# sourceMappingURL=d1RouterApiAuthBoundary.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1RouterApiAuthConfig.d.ts

@@ -86,8 +86,8 @@ type CloudflareD1LinkedDeviceCompositionDisabledV1 = {
     readonly management?: never;
 };
 /**
- * Optional R103 composition. Each enabled surface requires its complete
- * external boundary; omitted surfaces stay fail-closed at their route.
+ * Optional linked-device composition. Each enabled surface requires its
+ * complete external boundary; omitted surfaces stay fail-closed at their route.
  */
 export type CloudflareD1LinkedDeviceCompositionOptionsV1 = CloudflareD1LinkedDeviceCompositionDisabledV1 | CloudflareD1LinkedDeviceCompositionWithManagementV1 | CloudflareD1LinkedDeviceCompositionWithSessionV1;
 export type CloudflareD1GithubOAuthConfig = {

package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1RouterApiAuthService.d.ts

@@ -8,6 +8,6 @@ export type CloudflareD1RouterApiAuthService = Omit<RouterApiServiceBag, 'thresh
     readonly executeSignedDelegate: (input: ExecuteSignedDelegateRequest) => Promise<ExecuteSignedDelegateResult>;
     readonly linkedDeviceEd25519AuthorityReader?: LinkedDeviceEd25519AuthorityReader;
 };
-type LinkedDeviceEd25519AuthorityReader = Pick<D1LinkedDeviceAuthorityInstallServiceV1, 'readInstalledEd25519AuthorityByIdentityV1' | 'readInstalledEd25519AuthorityByMaterialActivationV1' | 'readInstalledEcdsaAuthorityByMaterialActivationV1'>;
+type LinkedDeviceEd25519AuthorityReader = Pick<D1LinkedDeviceAuthorityInstallServiceV1, 'readInstalledEd25519AuthorityByIdentityV1' | 'readInstalledEd25519AuthorityByMaterialActivationV1' | 'readInstalledEcdsaAuthorityByMaterialActivationV1' | 'readInstalledEcdsaAuthorityChainByMaterialActivationV1'>;
 export declare function createCloudflareD1RouterApiAuthService(input: CloudflareD1RouterApiAuthServiceOptions): CloudflareD1RouterApiAuthService;
 //# sourceMappingURL=d1RouterApiAuthService.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/authorization/authorizedOperationStatements.d.ts

@@ -0,0 +1,30 @@
+import type { AuthorizedOperation } from '../../../../authorization/domain';
+import type { AuthorizedOperationMaterialScope } from '../../../../authorization/service';
+import type { D1WalletStoreScope } from '../../../../core/d1WalletStore';
+import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import type { TenantId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
+import type { CapabilityOperationFingerprintDigest } from '../../../../../../shared-ts/src/authorization/operationFingerprint';
+export declare function prepareAuthorizedOperationCommittedRead(database: D1DatabaseLike, namespace: string, input: {
+    readonly tenantId: TenantId;
+    readonly operationFingerprintDigest: CapabilityOperationFingerprintDigest;
+}): D1PreparedStatementLike;
+export declare function prepareAuthorizedOperationRead(database: D1DatabaseLike, namespace: string, input: {
+    readonly tenantId: TenantId;
+    readonly operationFingerprintDigest: CapabilityOperationFingerprintDigest;
+}): D1PreparedStatementLike;
+export declare function prepareAuthorizedOperationAdmissionRead(input: {
+    readonly database: D1DatabaseLike;
+    readonly namespace: string;
+    readonly walletSignerScope: D1WalletStoreScope;
+    readonly tenantId: TenantId;
+    readonly operationFingerprintDigest: CapabilityOperationFingerprintDigest;
+    readonly nowMs: number;
+}): D1PreparedStatementLike;
+export declare function prepareAuthorizedOperationInsert(input: {
+    readonly database: D1DatabaseLike;
+    readonly namespace: string;
+    readonly walletSignerScope: D1WalletStoreScope;
+    readonly operation: AuthorizedOperation;
+    readonly material: AuthorizedOperationMaterialScope | null;
+}): D1PreparedStatementLike;
+//# sourceMappingURL=authorizedOperationStatements.d.ts.map