@seams/wallet-server 0.6.2 → 0.7.3

package/dist/types/wallet-server/src/core/authService/thresholdEcdsaKeyInventory.d.ts

@@ -10,16 +10,6 @@ export type ThresholdEcdsaKeyInventoryDiagnostics = {
     publicCapabilityStorePresent: boolean;
     rejected: Record<string, number>;
 };
-export type ThresholdEcdsaKeyInventorySelector = {
-    kind: 'key_handle';
-    keyHandle: string;
-    ecdsaThresholdKeyId?: never;
-};
-export type ThresholdEcdsaKeyInventoryTarget = {
-    keySelector: ThresholdEcdsaKeyInventorySelector;
-    selectorKey: string;
-    chainTarget: ThresholdEcdsaChainTarget;
-};
 export type ThresholdEcdsaKeyInventoryRecord = {
     keyHandle: string;
     ecdsaThresholdKeyId: string;
@@ -42,19 +32,6 @@ export type ThresholdEcdsaKeyInventoryRecord = {
         thresholdOwnerAddress: string;
     };
 };
-export declare function incrementCount(bucket: Record<string, number>, reason: string): void;
-export declare function thresholdEcdsaKeyInventorySelectorMatchesIdentity(selector: ThresholdEcdsaKeyInventorySelector, identity: {
-    keyHandle: string;
-    ecdsaThresholdKeyId: string;
-}): boolean;
-export declare function parseThresholdEcdsaKeyInventoryTarget(raw: unknown): {
-    ok: true;
-    value: ThresholdEcdsaKeyInventoryTarget;
-} | {
-    ok: false;
-    reason: string;
-};
-export declare function normalizeEvmAddress(value: unknown): string;
 export declare function listThresholdEcdsaKeyIdentityTargetsForUser(input: {
     userId: string;
     rpId: string;

package/dist/types/wallet-server/src/core/authService/webauthn.d.ts

@@ -11,7 +11,8 @@ import type { WebAuthnAuthenticationCredential } from '../types';
 import { type ResolvedEd25519WalletBinding } from './webauthnWalletBinding';
 import type { DigestB64u } from '../../../../shared-ts/src/utils/canonicalPrimitives';
 import { type WalletId } from '../../../../shared-ts/src/utils/registrationIntent';
-export type WebAuthnCredentialVerificationResult = {
+import { type WebAuthnLoginEd25519 } from './webauthnVerificationOutcomes';
+type WebAuthnCredentialVerificationResult = {
     ok: true;
     credential: {
         credentialIdB64u: string;
@@ -23,7 +24,7 @@ export type WebAuthnCredentialVerificationResult = {
     code: string;
     message: string;
 };
-export type WebAuthnAuthenticationLiteResult = {
+type WebAuthnAuthenticationLiteResult = {
     success: boolean;
     verified: boolean;
     code?: string;
@@ -34,7 +35,7 @@ export type WebAuthnAuthenticationLiteResult = {
  * contract declares it, and a binding with no authenticator row still gets the
  * `Unknown device` fallback rather than an absent field.
  */
-export type WebAuthnAuthenticatorListEntry = {
+type WebAuthnAuthenticatorListEntry = {
     credentialIdB64u: string;
     signerSlot?: number;
     publicKey?: string;
@@ -48,7 +49,7 @@ export type WebAuthnAuthenticatorListResult = {
     message?: string;
     authenticators?: WebAuthnAuthenticatorListEntry[];
 };
-export type WebAuthnLoginOptionsResult = {
+type WebAuthnLoginOptionsResult = {
     ok: boolean;
     challengeId?: string;
     challengeB64u?: string;
@@ -112,17 +113,7 @@ export type WebAuthnLoginVerificationResult = {
     userId: string;
     rpId: string;
     credentialIdB64u: string;
-    ed25519: {
-        readonly kind: 'absent';
-    } | {
-        readonly kind: 'active';
-        readonly nearAccountId: string;
-        readonly nearEd25519SigningKeyId: string;
-        readonly signerSlot: number;
-        readonly publicKey: string;
-        readonly relayerKeyId: string;
-        readonly participantIds: readonly [number, number];
-    };
+    ed25519: WebAuthnLoginEd25519;
 } | {
     ok: false;
     verified?: false;
@@ -175,7 +166,7 @@ export declare function createWebAuthnSyncAccountOptionsWithStores(input: {
  * The one signer read sync needs. Shaped as the wallet store's own reader so
  * the existing store satisfies it structurally, with no adapter.
  */
-export type SyncAccountEd25519SignerReader = {
+type SyncAccountEd25519SignerReader = {
     getEd25519SignerBySlot(input: {
         walletId: WalletId;
         signerSlot: number;
@@ -204,4 +195,5 @@ export declare function verifyWebAuthnLoginWithStores(input: {
     identityStore: IdentityStore;
     logger: NormalizedLogger;
 }): Promise<WebAuthnLoginVerificationResult>;
+export {};
 //# sourceMappingURL=webauthn.d.ts.map

package/dist/types/wallet-server/src/core/authService/webauthnOidcHelpers.d.ts

@@ -1,5 +1,5 @@
 import type { WebAuthnRpId } from '../../../../shared-ts/src/utils/domainIds';
-export type SimpleWebAuthnRegistrationVerification = {
+type SimpleWebAuthnRegistrationVerification = {
     verified?: boolean;
     registrationInfo?: {
         credential?: {
@@ -9,22 +9,22 @@ export type SimpleWebAuthnRegistrationVerification = {
         };
     };
 };
-export type SimpleWebAuthnAuthenticationVerification = {
+type SimpleWebAuthnAuthenticationVerification = {
     verified?: boolean;
     authenticationInfo?: {
         newCounter?: number;
     };
 };
-export type SimpleWebAuthnRegistrationVerifier = (args: SimpleWebAuthnRegistrationVerificationInput) => Promise<SimpleWebAuthnRegistrationVerification>;
-export type SimpleWebAuthnAuthenticationVerifier = (args: SimpleWebAuthnAuthenticationVerificationInput) => Promise<SimpleWebAuthnAuthenticationVerification>;
-export type SimpleWebAuthnRegistrationVerificationInput = {
+type SimpleWebAuthnRegistrationVerifier = (args: SimpleWebAuthnRegistrationVerificationInput) => Promise<SimpleWebAuthnRegistrationVerification>;
+type SimpleWebAuthnAuthenticationVerifier = (args: SimpleWebAuthnAuthenticationVerificationInput) => Promise<SimpleWebAuthnAuthenticationVerification>;
+type SimpleWebAuthnRegistrationVerificationInput = {
     response: unknown;
     expectedChallenge: string;
     expectedOrigin: string;
     expectedRPID: string;
     requireUserVerification: boolean;
 };
-export type SimpleWebAuthnAuthenticationVerificationInput = {
+type SimpleWebAuthnAuthenticationVerificationInput = {
     response: unknown;
     expectedChallenge: string;
     expectedOrigin: string;
@@ -46,7 +46,7 @@ export declare function parseClientDataJsonBase64url(clientDataJSONB64u: string)
 export declare function originHostnameOrEmpty(origin: string): string;
 export declare function isHostWithinRpId(host: string, rpId: WebAuthnRpId): boolean;
 export declare function parseCacheControlMaxAgeSec(cacheControl: string | null): number | null;
-export declare function normalizeOidcIssuer(input: string): string;
 export declare function parseJwtSegmentJson(input: string): Record<string, unknown> | null;
 export declare function parseJwtAud(input: unknown): string[];
+export {};
 //# sourceMappingURL=webauthnOidcHelpers.d.ts.map

package/dist/types/wallet-server/src/core/authService/webauthnVerificationOutcomes.d.ts

@@ -0,0 +1,43 @@
+import type { WebAuthnCredentialBindingRecord } from '../WebAuthnCredentialBindingStore';
+import type { ResolvedEd25519WalletBinding } from './webauthnWalletBinding';
+type WebAuthnVerificationFailure = {
+    ok: false;
+    verified: false;
+    code: string;
+    message: string;
+};
+export type WebAuthnLoginEd25519 = {
+    readonly kind: 'absent';
+} | {
+    readonly kind: 'active';
+    readonly nearAccountId: string;
+    readonly nearEd25519SigningKeyId: string;
+    readonly signerSlot: number;
+    readonly publicKey: string;
+    readonly relayerKeyId: string;
+    readonly participantIds: readonly [number, number];
+};
+/** The failure a login or sync returns when its assertion did not verify; null when it did. */
+export declare function webAuthnAuthenticationFailure(verification: {
+    readonly success: boolean;
+    readonly verified: boolean;
+    readonly code?: string;
+    readonly message?: string;
+}): WebAuthnVerificationFailure | null;
+/**
+ * The logged-in credential's Ed25519 signer. It is active only when the binding carries every
+ * fact signing needs, and absent while the wallet's Ed25519 signer has not settled.
+ */
+export declare function webAuthnLoginEd25519(binding: WebAuthnCredentialBindingRecord | null, walletBinding: Pick<ResolvedEd25519WalletBinding, 'nearAccountId' | 'nearEd25519SigningKeyId' | 'signerSlot'> | null): {
+    ok: true;
+    ed25519: WebAuthnLoginEd25519;
+} | WebAuthnVerificationFailure;
+/** The sync credential's binding, if it exists and belongs to the account the challenge expects. */
+export declare function webAuthnSyncCredentialBinding(binding: WebAuthnCredentialBindingRecord | null, challenge: {
+    readonly expectedUserId?: string;
+}): {
+    ok: true;
+    binding: WebAuthnCredentialBindingRecord;
+} | WebAuthnVerificationFailure;
+export {};
+//# sourceMappingURL=webauthnVerificationOutcomes.d.ts.map

package/dist/types/wallet-server/src/core/authService/webauthnWalletBinding.d.ts

@@ -1,11 +1,4 @@
-import type { WebAuthnCredentialBindingRecord, WebAuthnCredentialBindingStore } from '../WebAuthnCredentialBindingStore';
-import type { Ed25519SessionPolicy, ThresholdRuntimePolicyScope } from '../types';
-import { type WalletAuthMethodId } from '../../../../shared-ts/src/utils/domainIds';
-export declare function resolveExistingThresholdEd25519Binding(args: {
-    bindingStore: WebAuthnCredentialBindingStore;
-    userId: string;
-    rpId: string;
-}): Promise<WebAuthnCredentialBindingRecord | undefined>;
+import type { WebAuthnCredentialBindingRecord } from '../WebAuthnCredentialBindingStore';
 export declare function parseBoundaryWalletId(raw: unknown): string | null;
 export type ResolvedEd25519WalletBinding = {
     walletId: string;
@@ -25,24 +18,4 @@ export declare function resolvedEd25519WalletBindingFromCredentialBinding(args:
     binding: WebAuthnCredentialBindingRecord;
     signerSlot?: number;
 }): ResolvedEd25519WalletBinding | null;
-export declare function resolveThresholdEd25519SessionPolicyForBinding(args: {
-    requestedSessionPolicy: Record<string, unknown>;
-    binding: ResolvedEd25519WalletBinding;
-    walletAuthMethodId: WalletAuthMethodId;
-    relayerKeyId: string;
-    persistedRuntimePolicyScope?: ThresholdRuntimePolicyScope;
-}): {
-    sessionPolicy: Ed25519SessionPolicy;
-    runtimePolicyScope?: ThresholdRuntimePolicyScope;
-};
-export declare function resolveRecoveryThresholdEd25519SessionPolicyForBinding(args: {
-    requestedSessionPolicy: Record<string, unknown>;
-    binding: ResolvedEd25519WalletBinding;
-    walletAuthMethodId: WalletAuthMethodId;
-    relayerKeyId: string;
-    persistedRuntimePolicyScope?: ThresholdRuntimePolicyScope;
-}): {
-    sessionPolicy: Ed25519SessionPolicy;
-    runtimePolicyScope?: ThresholdRuntimePolicyScope;
-};
 //# sourceMappingURL=webauthnWalletBinding.d.ts.map

package/dist/types/wallet-server/src/core/d1EcdsaSignerRead.d.ts

@@ -0,0 +1,39 @@
+import type { InstalledEcdsaCustodySnapshotV1 } from '../router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService';
+import { type RouterAbMpcMaterialActivationRefWire } from '../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
+import { EcdsaMaterialReadSnapshot } from './ecdsaMaterialReadSnapshot';
+import type { WalletId } from '../../../shared-ts/src/utils/domainIds';
+import type { D1WalletStoreScope } from './d1WalletStore';
+import { type WalletEcdsaSignerRecord } from './WalletStore';
+import type { D1DatabaseLike, D1PreparedStatementLike } from '../storage/tenantRoute';
+export declare function prepareWalletEcdsaSignersRead(database: D1DatabaseLike, scope: D1WalletStoreScope, walletId: WalletId): D1PreparedStatementLike;
+export declare function parseWalletEcdsaSignerRows(rows: readonly Readonly<Record<string, unknown>>[], walletId: WalletId): readonly WalletEcdsaSignerRecord[];
+/** Parsed persistence evidence; material failures are surfaced after session validation. */
+export declare class EcdsaMaterialRead {
+    #private;
+    readonly walletId: WalletId;
+    private readonly scope;
+    private readonly activation;
+    private readonly linkedSnapshot;
+    private constructor();
+    static fromRows(scope: D1WalletStoreScope, walletId: WalletId, activation: RouterAbMpcMaterialActivationRefWire, rows: unknown, linkedSnapshot: InstalledEcdsaCustodySnapshotV1 | null): EcdsaMaterialRead;
+    resolveLinked(scope: D1WalletStoreScope, walletId: WalletId, activation: RouterAbMpcMaterialActivationRefWire): InstalledEcdsaCustodySnapshotV1 | null;
+    resolve(scope: D1WalletStoreScope, walletId: WalletId, activation: RouterAbMpcMaterialActivationRefWire): CanonicalMaterialSnapshot | null;
+}
+type CanonicalMaterialSnapshot = {
+    readonly signer: WalletEcdsaSignerRecord;
+    readonly readSnapshot: EcdsaMaterialReadSnapshot;
+};
+export type EcdsaMaterialReadSource = {
+    readonly kind: 'database';
+    readonly materialRead?: never;
+} | {
+    readonly kind: 'credential_snapshot';
+    readonly materialRead: EcdsaMaterialRead;
+};
+export type EcdsaMaterialActivationReadInput = {
+    readonly walletId: string;
+    readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
+    readonly source: EcdsaMaterialReadSource;
+};
+export {};
+//# sourceMappingURL=d1EcdsaSignerRead.d.ts.map

package/dist/types/wallet-server/src/core/d1IdentityStore.d.ts

@@ -1,29 +1,19 @@
-import type { D1DatabaseLike } from '../storage/tenantRoute';
+import { type D1SchemaOptions, type D1TenantStoreOptions } from './d1TenantStore';
 import type { IdentityStore, LinkIdentityResult, UnlinkIdentityResult } from './IdentityStore';
-export interface D1IdentityStoreSchemaOptions {
-    readonly database: D1DatabaseLike;
+export interface D1IdentityStoreSchemaOptions extends D1SchemaOptions {
 }
-export interface D1IdentityStoreOptions {
-    readonly database: D1DatabaseLike;
-    readonly namespace: string;
-    readonly orgId: string;
-    readonly projectId: string;
-    readonly envId: string;
-    readonly ensureSchema?: boolean;
+export interface D1IdentityStoreOptions extends D1TenantStoreOptions {
     readonly now?: () => Date;
 }
+/** Names the identity store in D1 scope errors. */
+export declare const IDENTITY_D1_STORE = "identity store";
 export declare const IDENTITY_STORE_D1_SCHEMA_SQL: readonly ["\n    CREATE TABLE IF NOT EXISTS identity_links (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      subject TEXT NOT NULL,\n      user_id TEXT NOT NULL,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      updated_at_ms INTEGER NOT NULL,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, subject),\n      CHECK (length(namespace) > 0),\n      CHECK (length(org_id) > 0),\n      CHECK (length(project_id) > 0),\n      CHECK (length(env_id) > 0),\n      CHECK (length(subject) > 0),\n      CHECK (length(user_id) > 0),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms > 0),\n      CHECK (updated_at_ms >= created_at_ms),\n      CHECK (COALESCE(json_extract(record_json, '$.version') = 'identity_subject_v1', 0)),\n      CHECK (COALESCE(json_extract(record_json, '$.subject') = subject, 0)),\n      CHECK (COALESCE(json_extract(record_json, '$.userId') = user_id, 0)),\n      CHECK (COALESCE(json_extract(record_json, '$.createdAtMs') = created_at_ms, 0)),\n      CHECK (COALESCE(json_extract(record_json, '$.updatedAtMs') = updated_at_ms, 0))\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS identity_links_user_idx\n      ON identity_links (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        user_id,\n        created_at_ms\n      )\n  "];
 export declare function ensureIdentityStoreD1Schema(options: D1IdentityStoreSchemaOptions): Promise<void>;
 export declare class D1IdentityStore implements IdentityStore {
     readonly adapterKind = "d1";
-    private readonly database;
-    private readonly scope;
-    private readonly ensureSchemaOnUse;
+    private readonly table;
     private readonly now;
-    private schemaReady;
     constructor(input: D1IdentityStoreOptions);
-    private ensureSchema;
-    private bindScope;
     getUserIdBySubject(subject: string): Promise<string | null>;
     listSubjectsByUserId(userId: string): Promise<string[]>;
     linkSubjectToUserId(input: {

package/dist/types/wallet-server/src/core/d1TenantStore.d.ts

@@ -0,0 +1,51 @@
+import type { D1DatabaseLike, D1PreparedStatementLike } from '../storage/tenantRoute';
+/**
+ * A store's key prefix, which is also its D1 namespace: the first of `explicitKeys` set in
+ * `config`, else `<THRESHOLD_PREFIX>:<segment>`. It always ends with a colon.
+ */
+export declare function resolveStorePrefix(config: Record<string, unknown>, explicitKeys: readonly string[], segment: string): string;
+/** The tenant scope that leads the key of every D1 table. */
+export type D1TenantScope = {
+    readonly namespace: string;
+    readonly orgId: string;
+    readonly projectId: string;
+    readonly envId: string;
+};
+export interface D1SchemaOptions {
+    readonly database: D1DatabaseLike;
+}
+export interface D1TenantStoreOptions {
+    readonly database: D1DatabaseLike;
+    readonly namespace: string;
+    readonly orgId: string;
+    readonly projectId: string;
+    readonly envId: string;
+    readonly ensureSchema?: boolean;
+}
+/** The scope env-shaped store config names (`orgId` or `ORG_ID`, and so on) under `namespace`. */
+export declare function d1TenantScopeFromConfig(config: Record<string, unknown>, namespace: string, store: string): D1TenantScope;
+export declare function ensureD1Schema(database: D1DatabaseLike, statements: readonly string[]): Promise<void>;
+/** A schema a store creates once, on first use, unless its caller manages it (`enabled: false`). */
+export declare class D1Schema {
+    private readonly database;
+    private readonly statements;
+    private readonly enabled;
+    private ready;
+    constructor(database: D1DatabaseLike, statements: readonly string[], enabled?: boolean);
+    ensure(): Promise<void>;
+}
+/** Prepares `sql` with the scope bound to its first four parameters and `values` after them. */
+export declare function prepareD1TenantStatement(database: D1DatabaseLike, scope: D1TenantScope, sql: string, values?: readonly unknown[]): D1PreparedStatementLike;
+/**
+ * A store's tables in one tenant scope. `store` names it in scope errors, e.g. `identity store`,
+ * and the schema is created on first use unless the caller manages it (`ensureSchema: false`).
+ */
+export declare class D1TenantTable {
+    readonly database: D1DatabaseLike;
+    readonly scope: D1TenantScope;
+    private readonly schema;
+    constructor(input: D1TenantStoreOptions, store: string, schema: readonly string[]);
+    ensureSchema(): Promise<void>;
+    prepare(sql: string, values?: readonly unknown[]): D1PreparedStatementLike;
+}
+//# sourceMappingURL=d1TenantStore.d.ts.map

package/dist/types/wallet-server/src/core/d1WalletAuthMethodStore.d.ts

@@ -1,17 +1,15 @@
 import { type WalletAuthMethodId, type WalletAuthorityId, type WalletId } from '../../../shared-ts/src/utils/domainIds';
 import type { DigestB64u } from '../../../shared-ts/src/utils/canonicalPrimitives';
-import { type WalletAuthMethodRecord as SharedWalletAuthMethodRecord, type WalletAuthMethodRecordV2 } from '../../../shared-ts/src/utils/registrationIntent';
+import { type ActiveWalletAuthMethodRecordV2, type WalletAuthMethodRecord as SharedWalletAuthMethodRecord, type WalletAuthMethodRecordV2 } from '../../../shared-ts/src/utils/walletAuthMethodRecord';
 import type { D1DatabaseLike, D1PreparedStatementLike } from '../storage/tenantRoute';
+import { type D1SchemaOptions, type D1TenantScope, type D1TenantStoreOptions } from './d1TenantStore';
 export type WalletAuthMethodRecord = SharedWalletAuthMethodRecord;
 /**
- * R103E's auth-method row. The v1 record remains exported for the older
+ * The V2 auth-method row. The v1 record remains exported for the older
  * registration/add-factor surface while the authority cutover is composed.
  * New authority-owned writes use this type and the V2 statements below.
  */
 export type WalletAuthMethodRecordV2Owned = WalletAuthMethodRecordV2;
-type ActiveWalletAuthMethodRecordV2 = Extract<WalletAuthMethodRecordV2, {
-    readonly status: 'active';
-}>;
 export type WalletAuthMethodV2Store = {
     putV2(record: WalletAuthMethodRecordV2): Promise<void>;
     insertActiveV2Atomically(input: {
@@ -58,23 +56,13 @@ export interface WalletAuthMethodStore {
         rpId?: string;
     }): Promise<WalletAuthMethodRecord[]>;
 }
-export interface D1WalletAuthMethodStoreSchemaOptions {
-    readonly database: D1DatabaseLike;
+export interface D1WalletAuthMethodStoreSchemaOptions extends D1SchemaOptions {
 }
-export interface D1WalletAuthMethodStoreOptions {
-    readonly database: D1DatabaseLike;
-    readonly namespace: string;
-    readonly orgId: string;
-    readonly projectId: string;
-    readonly envId: string;
-    readonly ensureSchema?: boolean;
+export interface D1WalletAuthMethodStoreOptions extends D1TenantStoreOptions {
 }
-export type D1WalletAuthMethodStoreScope = {
-    readonly namespace: string;
-    readonly orgId: string;
-    readonly projectId: string;
-    readonly envId: string;
-};
+export type D1WalletAuthMethodStoreScope = D1TenantScope;
+/** Names the wallet auth-method store in D1 scope errors. */
+export declare const WALLET_AUTH_METHOD_D1_STORE = "wallet auth-method store";
 export declare const WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL: readonly ["\n    CREATE TABLE IF NOT EXISTS wallet_auth_methods (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      wallet_id TEXT NOT NULL,\n      rp_id TEXT NOT NULL DEFAULT '',\n      kind TEXT NOT NULL,\n      status TEXT NOT NULL,\n      wallet_auth_method_id TEXT NOT NULL,\n      auth_identifier_key TEXT NOT NULL,\n      credential_id_b64u TEXT,\n      credential_public_key_b64u TEXT,\n      email_hash_hex TEXT,\n      registration_authority_id TEXT,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      updated_at_ms INTEGER NOT NULL,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_auth_method_id),\n      CHECK (length(wallet_id) > 0),\n      CHECK (kind IN ('passkey', 'email_otp')),\n      CHECK (status IN ('active', 'revoked')),\n      CHECK (length(wallet_auth_method_id) > 0),\n      CHECK (length(auth_identifier_key) > 0),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms >= 0),\n      CHECK (updated_at_ms >= created_at_ms),\n      CHECK (\n        (\n          kind = 'passkey'\n          AND length(rp_id) > 0\n          AND credential_id_b64u IS NOT NULL\n          AND length(credential_id_b64u) > 0\n          AND credential_public_key_b64u IS NOT NULL\n          AND length(credential_public_key_b64u) > 0\n          AND email_hash_hex IS NULL\n          AND registration_authority_id IS NULL\n          AND auth_identifier_key = credential_id_b64u\n          AND wallet_auth_method_id = 'passkey:' || rp_id || ':' || credential_id_b64u\n        )\n        OR\n        (\n          kind = 'email_otp'\n          AND rp_id = ''\n          AND credential_id_b64u IS NULL\n          AND credential_public_key_b64u IS NULL\n          AND email_hash_hex IS NOT NULL\n          AND length(email_hash_hex) > 0\n          AND registration_authority_id IS NOT NULL\n          AND length(registration_authority_id) > 0\n          AND auth_identifier_key = email_hash_hex\n          AND wallet_auth_method_id = 'email_otp:' || wallet_id || ':' || email_hash_hex\n        )\n      )\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS wallet_auth_methods_wallet_idx\n      ON wallet_auth_methods (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        wallet_id,\n        rp_id,\n        status\n      )\n  ", "\n    CREATE INDEX IF NOT EXISTS wallet_auth_methods_identifier_idx\n      ON wallet_auth_methods (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        kind,\n        auth_identifier_key\n      )\n  ", "\n    CREATE UNIQUE INDEX IF NOT EXISTS wallet_auth_methods_passkey_uidx\n      ON wallet_auth_methods (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        rp_id,\n        credential_id_b64u\n      )\n      WHERE kind = 'passkey' AND credential_id_b64u IS NOT NULL\n  ", "\n    CREATE UNIQUE INDEX IF NOT EXISTS wallet_auth_methods_email_uidx\n      ON wallet_auth_methods (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        wallet_id,\n        email_hash_hex\n      )\n      WHERE kind = 'email_otp' AND email_hash_hex IS NOT NULL\n  "];
 /**
  * The authority-owned table shape is kept separate from the historical
@@ -128,14 +116,9 @@ export declare function prepareD1WalletAuthMethodInsertStatement(input: {
 }): D1PreparedStatementLike;
 export declare class D1WalletAuthMethodStore implements WalletAuthMethodStore, WalletAuthMethodV2Store {
     readonly adapterKind = "d1";
-    private readonly database;
-    private readonly scope;
-    private readonly ensureSchemaOnUse;
-    private schemaReady;
-    private v2SchemaReady;
+    private readonly table;
+    private readonly v2Schema;
     constructor(input: D1WalletAuthMethodStoreOptions);
-    private ensureSchema;
-    private ensureV2Schema;
     put(record: WalletAuthMethodRecord): Promise<void>;
     /**
      * Prepares the insert-only wallet auth-method mutation used by custody
@@ -171,7 +154,7 @@ export declare class D1WalletAuthMethodStore implements WalletAuthMethodStore, W
      * Aborts the surrounding batch if the authority already holds an active
      * method of this family.
      *
-     * Refactor 109C's admission answers `already_configured` before a ceremony
+     * Add-auth-method admission answers `already_configured` before a ceremony
      * starts, but an admission read cannot close a race: two ceremonies can pass
      * it concurrently and both insert. The auth-method insert's own guard covers
      * only the allocated method id, and migration `0011` deliberately dropped
@@ -210,5 +193,4 @@ export declare class D1WalletAuthMethodStore implements WalletAuthMethodStore, W
         rpId?: string;
     }): Promise<WalletAuthMethodRecordV2[]>;
 }
-export {};
 //# sourceMappingURL=d1WalletAuthMethodStore.d.ts.map

package/dist/types/wallet-server/src/core/d1WalletStore.d.ts

@@ -1,3 +1,5 @@
+import type { EcdsaMaterialReadSnapshot } from './ecdsaMaterialReadSnapshot';
+import { type EcdsaMaterialReadSource } from './d1EcdsaSignerRead';
 import type { D1DatabaseLike, D1PreparedStatementLike } from '../storage/tenantRoute';
 import type { WalletId, WalletRegistrationEcdsaWalletKey } from './registrationContracts';
 import { type ThresholdEcdsaChainTarget } from './thresholdEcdsaChainTarget';
@@ -71,6 +73,14 @@ export declare class D1WalletStore implements WalletStore {
         walletId: WalletId;
         materialActivation: RouterAbMpcMaterialActivationRefWire;
     }): Promise<WalletEcdsaSignerRecord | null>;
+    readEcdsaSignerMaterialSnapshot(input: {
+        readonly source: EcdsaMaterialReadSource;
+        walletId: WalletId;
+        materialActivation: RouterAbMpcMaterialActivationRefWire;
+    }): Promise<{
+        readonly signer: WalletEcdsaSignerRecord;
+        readonly readSnapshot: EcdsaMaterialReadSnapshot;
+    } | null>;
     getEcdsaSignerByPostRegistrationRequest(input: {
         walletId: WalletId;
         request: WalletEcdsaPostRegistrationPublicRequest;
@@ -102,7 +112,12 @@ export declare class D1WalletStore implements WalletStore {
     }): Promise<readonly WalletEd25519SignerRecord[]>;
     putSubject(record: WalletRecord): Promise<void>;
     putSigner(record: WalletSignerRecord): Promise<void>;
-    putEd25519SignerIfSlotAvailable(record: WalletEd25519SignerRecord): Promise<boolean>;
+    /**
+     * The statements that insert an Ed25519 signer into its slot, for a batch
+     * owned elsewhere. The batch aborts unless the slot was free: slot
+     * uniqueness rests on this check alone.
+     */
+    prepareEd25519SignerIfSlotAvailableStatements(record: WalletEd25519SignerRecord): Promise<readonly D1PreparedStatementLike[]>;
     putSigners(records: readonly WalletSignerRecord[]): Promise<void>;
 }
 //# sourceMappingURL=d1WalletStore.d.ts.map

package/dist/types/wallet-server/src/core/deviceLinking/linkedDeviceEd25519ExportRoot.d.ts

@@ -5,7 +5,7 @@
  */
 import type { LinkedDeviceEd25519ExportRootPackageV1, LinkedDeviceEd25519ExportRootRecipientV1 } from '../../../../shared-ts/src/device-linking/ed25519ExportRoot';
 import type { LinkDeviceSessionId } from '../../../../shared-ts/src/signing-lanes/ids';
-export type LinkedDeviceEd25519ExportRootConflictV1 = 'recipient_already_registered_with_another_key' | 'recipient_not_registered' | 'package_addressed_to_another_recipient' | 'package_already_sealed_differently';
+type LinkedDeviceEd25519ExportRootConflictV1 = 'recipient_already_registered_with_another_key' | 'recipient_not_registered' | 'package_addressed_to_another_recipient' | 'package_already_sealed_differently';
 export type LinkedDeviceEd25519ExportRootWriteResultV1 = {
     readonly outcome: 'applied';
 } | {
@@ -33,4 +33,5 @@ export type LinkedDeviceEd25519ExportRootPortV1 = {
     }) => Promise<LinkedDeviceEd25519ExportRootWriteResultV1>;
     readonly readTransferV1: (linkSessionId: LinkDeviceSessionId) => Promise<LinkedDeviceEd25519ExportRootRecordV1 | null>;
 };
+export {};
 //# sourceMappingURL=linkedDeviceEd25519ExportRoot.d.ts.map

package/dist/types/wallet-server/src/core/deviceLinking/linkedDeviceEmailOtpGrant.d.ts

@@ -20,7 +20,7 @@ export declare function computeLinkedDeviceEmailOtpChallengeBindingDigestV1(inpu
     readonly baseWalletAuthMethodId?: WalletAuthMethodId;
     readonly walletAuthMethodId: WalletAuthMethodId;
 }): Promise<DigestB64u>;
-export type LinkedDeviceEmailOtpGrantStateV1 = {
+type LinkedDeviceEmailOtpGrantStateV1 = {
     readonly kind: 'issued';
     readonly consumedAtMs?: never;
 } | {
@@ -84,4 +84,5 @@ export declare function computeLinkedDeviceEmailOtpAuthorityDigestV1(input: {
  * Deterministic, so replays reproduce byte-identical descriptor requests.
  */
 export declare function linkedDeviceEmailOtpDescriptorCredentialIdV1(walletAuthMethodId: WalletAuthMethodId): Promise<WebAuthnCredentialIdB64u>;
+export {};
 //# sourceMappingURL=linkedDeviceEmailOtpGrant.d.ts.map