@seams/wallet-server 0.6.2 → 0.7.3

package/dist/types/wallet-server/src/router/transport/fetch/routes/deviceLinkingOwnerAuthorization.d.ts

@@ -8,8 +8,9 @@ import type { RouterApiAuthorizationSessionService } from '../../../framework/au
 import type { FetchRouterApiContext } from '../createFetchRouter';
 import type { DeviceLinkingAuthDeniedV1, DeviceLinkingOwnerRequestInputV1 } from './deviceLinking';
 import type { WalletExecutionLaneAuthSource } from '../../../../core/signingLanes/WalletExecutionLaneProjection';
-import { type DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
+import type { DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
 import type { ExactAdministeredSignerManifestV1 } from '../../../../../../shared-ts/src/device-linking/delegatedActivationPlan';
+import type { ReadonlyExclusiveUnion } from '../../../../../../shared-ts/src/utils/variant';
 export declare const LINKED_DEVICE_OWNER_AUTHORIZATION_PATH_V1: "/wallet/device-linking/v1/owner-authorization";
 export type DeviceLinkingOwnerAuthorizationAuthenticationV1 = {
     readonly kind: 'link_session_authenticated_request_v1';
@@ -23,7 +24,7 @@ export type DeviceLinkingOwnerAuthorizationResponseV1 = {
     readonly sourceSignerManifest: ExactAdministeredSignerManifestV1;
     readonly expiresAtMs: number;
 };
-export type DeviceLinkingOwnerWalletSessionContextV1 = {
+export type DeviceLinkingOwnerWalletSessionContextV1 = ReadonlyExclusiveUnion<{
     readonly walletId: WalletId;
     readonly walletSessionId: WalletSessionId;
     readonly authorizationId: WalletSessionAuthorizationId;
@@ -34,8 +35,6 @@ export type DeviceLinkingOwnerWalletSessionContextV1 = {
     readonly curve: 'ed25519';
     readonly authority: WalletAuthAuthority;
     readonly authorityScope: ThresholdEd25519AuthorityScope;
-    readonly walletAuthAuthorityRef?: never;
-    readonly authSource?: never;
 } | {
     readonly walletId: WalletId;
     readonly walletSessionId: WalletSessionId;
@@ -47,10 +46,8 @@ export type DeviceLinkingOwnerWalletSessionContextV1 = {
     readonly curve: 'ecdsa';
     readonly walletAuthAuthorityRef: WalletAuthAuthorityRef;
     readonly authSource: WalletExecutionLaneAuthSource;
-    readonly authority?: never;
-    readonly authorityScope?: never;
-};
-export type DeviceLinkingOwnerRequestAuthenticationV1 = {
+}>;
+type DeviceLinkingOwnerRequestAuthenticationV1 = {
     readonly kind: 'authorized';
     readonly body: unknown;
     readonly binding: {

package/dist/types/wallet-server/src/router/transport/fetch/routes/deviceManagement.d.ts

@@ -1,28 +1,26 @@
-import { type DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
-import { type WalletAuthMethodId, type WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
+import type { LinkedDeviceRevokeRequestV1, LinkedDeviceRevokeResultV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
 import type { DeviceLinkingAuthDeniedV1, DeviceLinkingAuthenticatedRequestV1, DeviceLinkingOwnerRequestInputV1 } from './deviceLinking';
-import { type LinkedDeviceManagementServiceV1 } from '../../../../core/deviceLinking/linkedDeviceManagement';
+import { type LinkedDeviceManagementSourceV1, type LinkedDeviceManagementServiceV1 } from '../../../../core/deviceLinking/linkedDeviceManagement';
 import type { D1LinkedDeviceFreshRevokeProofV1 } from '../../../cloudflare/d1/wallet/d1WalletAuthMethodBoundary';
 import type { FetchRouterApiContext } from '../createFetchRouter';
 export declare const LINKED_DEVICE_MANAGEMENT_BASE_V1 = "/wallet/device-linking/v1/devices";
-export declare const LINKED_DEVICE_MANAGEMENT_MAX_PAGE_SIZE_V1 = 50;
 export type DeviceManagementRouteServiceV1 = {
-    readonly management: Pick<LinkedDeviceManagementServiceV1, 'listLinkedDevicesV1' | 'revokeLinkedDeviceV1'>;
+    readonly management: Pick<LinkedDeviceManagementServiceV1, 'listLinkedDevicesV1'>;
     readonly nowV1: () => number;
     authenticateOwnerRequestV1(input: DeviceLinkingOwnerRequestInputV1): Promise<DeviceLinkingAuthenticatedRequestV1 | DeviceLinkingAuthDeniedV1>;
-    verifyFreshRevokeProofV1(input: {
-        readonly walletId: WalletId;
-        readonly targetWalletAuthMethodId: WalletAuthMethodId;
+    /**
+     * Verifies the fresh proof and revokes in one call. An exact retry of a
+     * committed revocation is answered from its record, before its proof is
+     * examined again.
+     */
+    revokeLinkedDeviceWithFreshProofV1(input: {
+        readonly request: LinkedDeviceRevokeRequestV1;
+        readonly owner: LinkedDeviceManagementSourceV1;
         readonly proof: D1LinkedDeviceFreshRevokeProofV1;
-        readonly request: Request;
-        readonly method: string;
-        readonly pathname: string;
-        readonly bodyDigestB64u: DigestB64u;
-        readonly requestedAtMs: number;
+        readonly httpRequest: Request;
     }): Promise<{
-        readonly kind: 'authorized';
-        readonly walletAuthMethodId: WalletAuthMethodId;
-        readonly verifiedAtMs: number;
+        readonly kind: 'answered';
+        readonly result: LinkedDeviceRevokeResultV1;
     } | DeviceLinkingAuthDeniedV1>;
 };
 export declare function handleDeviceManagement(ctx: FetchRouterApiContext, service: DeviceManagementRouteServiceV1): Promise<Response | null>;

package/dist/types/wallet-server/src/router/transport/fetch/routes/normalSigningRouterProxy.d.ts

@@ -1,9 +1,7 @@
 import type { RouterAbNormalSigningRouterProxy } from '../../../framework/routerApi';
 import type { RouterApiWalletRegistrationService } from '../../../framework/authServicePort';
 import type { AuthorizedOperation } from '../../../../authorization/domain';
-import type { RouterAbNormalSigningMaterialSourceV1 } from '../../../domains/signingOperations/routerAbPrivateSigningWorker';
 import type { RouterAbMpcMaterialActivationRefWire } from '../../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
-export declare const ROUTER_AB_ECDSA_DERIVATION_LINKED_DEVICE_SIGN_PATH: "/router-ab/ecdsa-derivation/linked-device/sign";
 export declare function proxyNormalSigningRequestToMpcRouter(input: {
     readonly request: Request;
     readonly proxy: RouterAbNormalSigningRouterProxy | null | undefined;
@@ -20,14 +18,4 @@ export declare function proxyOwnerLaneAdmittedNormalSigningRequest(input: {
     readonly authorization: Parameters<RouterApiWalletRegistrationService['resolveActiveOwnerWalletExecutionLane']>[0]['authorization'];
     readonly walletRegistration: Pick<RouterApiWalletRegistrationService, 'resolveActiveOwnerWalletExecutionLane'>;
 }): Promise<Response>;
-/** Forwards a Gateway-admitted rotatable lane source to the private Router. */
-export declare function proxyRotatableLaneAdmittedNormalSigningRequest(input: {
-    readonly request: Request;
-    readonly proxy: RouterAbNormalSigningRouterProxy | null | undefined;
-    readonly body: Record<string, unknown>;
-    readonly materialSource: Extract<RouterAbNormalSigningMaterialSourceV1, {
-        readonly kind: 'rotatable_lane';
-    }>;
-    readonly targetPath?: string;
-}): Promise<Response>;
 //# sourceMappingURL=normalSigningRouterProxy.d.ts.map

package/dist/types/wallet-server/src/router/transport/fetch/routes/passkeyCustody.d.ts

@@ -5,7 +5,7 @@ export declare function handleWalletCustodyEmailOtpChallenge(ctx: FetchRouterApi
 /** Lists public passkey envelope identities with their sibling activity rows. */
 export declare function handleWalletCustodyCredentialsList(ctx: FetchRouterApiContext): Promise<Response | null>;
 /**
- * Refactor 109C: binds a pre-109C custody envelope to the method that opened it.
+ * Binds an unbound custody envelope to the method that opened it.
  *
  * The exact operation credential names the auth method that opened the
  * envelope. Unlock already proved that method, so finishing the ownership

package/dist/types/wallet-server/src/router/transport/fetch/routes/sessions.d.ts

@@ -3,7 +3,7 @@ import { type WalletUnlockEcdsaCustodySignerV1 } from '../../../domains/walletUn
 import { parseRouterAbEcdsaPostRegistrationSessionActivationPolicyV1, type RouterAbEcdsaPostRegistrationSessionActivationRequestV1 } from '../../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
 export declare function handleHostedWalletSessionExchangeIssue(ctx: FetchRouterApiContext): Promise<Response | null>;
 export declare function handleHostedWalletSessionExchangeRedeem(ctx: FetchRouterApiContext): Promise<Response | null>;
-export type WalletUnlockEcdsaAuthoredRequest = {
+type WalletUnlockEcdsaAuthoredRequest = {
     readonly request: RouterAbEcdsaPostRegistrationSessionActivationRequestV1;
     readonly activationReceipt: WalletUnlockEcdsaCustodySignerV1['activationReceipt'];
     readonly continuity: {
@@ -28,4 +28,5 @@ export declare function handleWalletUnlockVerify(ctx: FetchRouterApiContext): Pr
 export declare function handleWalletEmailOtpDevCleanupGoogleRegistration(ctx: FetchRouterApiContext): Promise<Response | null>;
 export declare function handleWalletEmailOtpRegistrationSeal(ctx: FetchRouterApiContext): Promise<Response | null>;
 export declare function handleWalletEmailOtpDevOutbox(ctx: FetchRouterApiContext): Promise<Response | null>;
+export {};
 //# sourceMappingURL=sessions.d.ts.map

package/dist/types/wallet-server/src/router/transport/fetch/routes/syncAccountBootstrap.d.ts

@@ -3,7 +3,7 @@ import { type WalletSessionMintId } from '../../../../../../shared-ts/src/author
 import { type WalletAuthMethodId, type WalletAuthorityId } from '../../../../../../shared-ts/src/utils/domainIds';
 import type { WalletAuthAuthority, WalletAuthAuthorityRef } from '../../../../../../shared-ts/src/utils/walletAuthAuthority';
 import type { ActiveWalletAuthorityV1 } from '../../../../../../shared-ts/src/authorization/walletAuthority';
-import { type WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import { type ActivePasskeyWalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
 import type { MpcWalletSigningQuotaId, WalletSessionId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
 import type { ActiveWalletSessionV1, WalletSessionOperationCredentialV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
 import type { RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
@@ -13,7 +13,8 @@ import type { FetchRouterApiContext } from '../createFetchRouter';
 import type { WebAuthnSyncAccountVerificationResult } from '../../../../core/authService/webauthn';
 import type { WalletEcdsaSignerRecord } from '../../../../core/WalletStore';
 import type { RouterAbEd25519YaoActiveCapabilityDescriptorV1 } from '../../../domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery';
-export type VerifiedSyncAccountResultV1 = Extract<WebAuthnSyncAccountVerificationResult, {
+import type { ReadonlyExclusiveUnion } from '../../../../../../shared-ts/src/utils/variant';
+type VerifiedSyncAccountResultV1 = Extract<WebAuthnSyncAccountVerificationResult, {
     readonly ok: true;
     readonly verified: true;
 }>;
@@ -42,10 +43,7 @@ type SyncAccountExactBootstrapBodyBaseV1 = {
     readonly walletAuthMethodId: WalletAuthMethodId;
     readonly walletAuthorityId: WalletAuthorityId;
     readonly foundingAuthority: ActiveWalletAuthorityV1;
-    readonly foundingAuthMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly kind: 'passkey';
-        readonly status: 'active';
-    }>;
+    readonly foundingAuthMethod: ActivePasskeyWalletAuthMethodRecordV2;
     readonly custodyKeyManifestDigestB64u: VerifiedSyncAccountResultV1['custodyKeyManifestDigestB64u'];
     readonly walletBinding: VerifiedSyncAccountResultV1['walletBinding'];
     readonly rpId: string;
@@ -77,22 +75,16 @@ type SyncAccountExactBootstrapBodyBaseV1 = {
         readonly signers: readonly Pick<WalletEcdsaSignerRecord, 'chainTarget' | 'walletKey' | 'activationReceipt' | 'runtimePolicyScope'>[];
     };
 };
-export type SyncAccountExactBootstrapBodyV1 = SyncAccountExactBootstrapBodyBaseV1 & ({
-    readonly ecdsaSession?: never;
-    readonly ecdsaActivationReceipt?: never;
-} | {
+type SyncAccountExactBootstrapBodyV1 = SyncAccountExactBootstrapBodyBaseV1 & ReadonlyExclusiveUnion<{} | {
     readonly ecdsaSession: RouterAbEcdsaCredentialFreeSessionActivationResponseV1;
     readonly ecdsaActivationReceipt: RouterAbEcdsaRegistrationActivationReceiptV1;
-});
-export type SyncAccountBootstrapInputV1 = {
+}>;
+type SyncAccountBootstrapInputV1 = {
     readonly ctx: FetchRouterApiContext;
     readonly result: VerifiedSyncAccountResultV1;
     readonly authority: WalletAuthAuthority;
     readonly activeAuthority: ActiveWalletAuthorityV1;
-    readonly foundingAuthMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly kind: 'passkey';
-        readonly status: 'active';
-    }>;
+    readonly foundingAuthMethod: ActivePasskeyWalletAuthMethodRecordV2;
     readonly walletAuthMethodId: WalletAuthMethodId;
     readonly authorityRef: WalletAuthAuthorityRef;
     readonly proof: Extract<VerifiedOwnerProof, {
@@ -109,7 +101,7 @@ export type SyncAccountBootstrapInputV1 = {
         readonly storeVersion: string;
     };
 };
-export type SyncAccountBootstrapResultV1 = {
+type SyncAccountBootstrapResultV1 = {
     readonly kind: 'ok';
     readonly body: SyncAccountExactBootstrapBodyV1;
 } | {

package/dist/types/wallet-server/src/router/transport/fetch/routes/thresholdEcdsa.d.ts

@@ -1,30 +1,12 @@
 import type { FetchRouterApiContext } from '../createFetchRouter';
-import { type WalletSessionOperationCredentialAdmission } from '../../../auth/commonRouterUtils';
-import { type RouterAbEcdsaOperationStepUpPreparationV1Wire } from '../../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
-import { type RouterAbEcdsaOperationAdmissionKind } from '../../../domains/signingOperations/routerAbPrivateSigningWorker';
 import { type RouterAbEcdsaPoolFillInitRouteRequest, type RouterAbEcdsaPoolFillStepRouteRequest } from '../../../domains/ecdsa/thresholdEcdsaRequestValidation';
-import type { RouterApiAuthorizedOperationService, RouterApiWalletRegistrationService } from '../../../framework/authServicePort';
-import { type WalletSessionBoundaryFailure } from '../../../auth/walletSessionFailure';
-import { type EcdsaAuthorizationSessionId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
+import type { RouterAbEcdsaDerivationPoolFillBinding } from '../../../../core/ThresholdService/routerAb/ecdsaDerivationPoolFillHandlers';
+import type { RouterApiAuthorizedOperationService } from '../../../framework/authServicePort';
 import type { WalletSessionOperationCredentialV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
 import { type AuthorizedOperation, type VerifiedOwnerProof } from '../../../../authorization/domain';
 type VerifiedOwnerWalletSessionProof = Extract<VerifiedOwnerProof, {
     readonly purpose: 'wallet_session';
 }>;
-type RouterAbEcdsaOperationStepUpExecutionDecision = {
-    readonly kind: 'execute';
-    readonly operation: AuthorizedOperation;
-} | {
-    readonly kind: 'replay';
-    readonly operation: AuthorizedOperation;
-} | {
-    readonly kind: 'missing';
-};
-export declare function decideRouterAbEcdsaOperationStepUpExecution(input: {
-    readonly phase: 'prepare' | 'finalize';
-    readonly admissionKind: RouterAbEcdsaOperationAdmissionKind;
-    readonly operation: AuthorizedOperation;
-}): RouterAbEcdsaOperationStepUpExecutionDecision;
 type EcdsaSigningGatewayTiming = {
     authorize: number | null;
     admit: number | null;
@@ -40,22 +22,9 @@ export declare function finishRouterAbEcdsaSigningResponse(input: {
     readonly timing: Pick<EcdsaSigningGatewayTiming, 'proxy' | 'complete'>;
     readonly proxyStartedAt: number;
 }): Promise<Response>;
-type RouterAbEcdsaActiveMaterial = Extract<Awaited<ReturnType<RouterApiWalletRegistrationService['resolveEcdsaMaterialActivation']>>, {
-    readonly ok: true;
-}>;
-type RouterAbEcdsaPoolFillBinding = Pick<RouterAbEcdsaActiveMaterial, 'keyHandle' | 'relayerKeyId' | 'runtimePolicyScope' | 'participantIds' | 'routerAbEcdsaDerivationNormalSigning'> & {
-    readonly walletId: string;
-    readonly thresholdExpiresAtMs: number;
-    readonly authorization: {
-        readonly kind: 'wallet_session';
-    } | {
-        readonly kind: 'operation_step_up';
-        readonly materialExpiresAtMs: number;
-    };
-};
 type RouterAbEcdsaPoolFillAuthorizationResult = {
     readonly ok: true;
-    readonly binding: RouterAbEcdsaPoolFillBinding;
+    readonly binding: RouterAbEcdsaDerivationPoolFillBinding;
 } | {
     readonly ok: false;
     readonly error: {
@@ -64,7 +33,6 @@ type RouterAbEcdsaPoolFillAuthorizationResult = {
     };
 };
 type EcdsaPresignGatewayTiming = {
-    queue: number | null;
     authenticate: number | null;
     material: number | null;
     admit: number | null;
@@ -76,29 +44,6 @@ export declare function authorizeEcdsaPoolFill(input: {
     readonly request: RouterAbEcdsaPoolFillInitRouteRequest | RouterAbEcdsaPoolFillStepRouteRequest;
     readonly timing: EcdsaPresignGatewayTiming;
 }): Promise<RouterAbEcdsaPoolFillAuthorizationResult>;
-type RouterAbEcdsaCustodySigner = Awaited<ReturnType<RouterApiWalletRegistrationService['listWalletEcdsaCustodyContinuity']>>[number];
-export declare function resolveV2EcdsaCustodySigner(input: {
-    readonly continuity: readonly RouterAbEcdsaCustodySigner[];
-    readonly walletId: string;
-    readonly admittedThresholdPublicKey33B64u: string;
-    readonly admittedEvmAddress: string;
-    readonly operation: RouterAbEcdsaOperationStepUpPreparationV1Wire;
-}): RouterAbEcdsaCustodySigner | null;
-export type StrictEcdsaOperationCredentialAuthorization = {
-    readonly ok: true;
-    readonly kind: 'wallet_session_operation_credential_v1';
-    readonly proof: VerifiedOwnerWalletSessionProof;
-    readonly admission: Extract<WalletSessionOperationCredentialAdmission, {
-        readonly curve: 'ecdsa';
-    }>;
-    readonly authorizationSessionId: EcdsaAuthorizationSessionId;
-} | WalletSessionBoundaryFailure;
-export declare function authorizeStrictEcdsaSessionActivationFromOperationCredential(input: {
-    readonly authorizationSessions: FetchRouterApiContext['service']['authorizationSessions'];
-    readonly walletId: string;
-    readonly operationCredential: WalletSessionOperationCredentialV1;
-    readonly proof: VerifiedOwnerWalletSessionProof;
-}): Promise<StrictEcdsaOperationCredentialAuthorization>;
 type StrictEcdsaSessionActivationInput = {
     readonly ctx: FetchRouterApiContext;
     readonly body: unknown;

package/dist/types/wallet-server/src/router/transport/fetch/routes/thresholdEd25519.d.ts

@@ -1,47 +1,3 @@
 import type { FetchRouterApiContext } from '../createFetchRouter';
-import { type RouterAbEd25519NormalSigningRoutePhase } from '../../../domains/signingOperations/routerAbPrivateSigningWorker';
-import { type AuthorizedOperation, type AuthorizedOperationReplayResponse } from '../../../../authorization/domain';
-export declare function replayCompletedEd25519Operation(operation: AuthorizedOperation): Response | null;
-/**
- * Completion readback is the authority for a terminal response. A claimed
- * operation must never fall back to the live upstream response after the
- * completion write, since that would make retries non-idempotent.
- */
-export declare function requireCompletedEd25519OperationResponse(operation: AuthorizedOperation): Response;
-export declare function buildEd25519ReplayResponse(input: {
-    readonly response: Response;
-    readonly bodyText: string;
-}): AuthorizedOperationReplayResponse;
-type Ed25519NormalSigningExecutionDecision = {
-    readonly kind: 'execute';
-    readonly operation: AuthorizedOperation;
-} | {
-    readonly kind: 'operation_in_progress';
-    readonly response: Response;
-} | {
-    readonly kind: 'replayed';
-    readonly response: Response;
-};
-export declare function decideEd25519NormalSigningExecution(input: {
-    readonly phase: RouterAbEd25519NormalSigningRoutePhase;
-    readonly admissionKind: 'claimed' | 'operation_in_progress' | 'replayed';
-    readonly operation: AuthorizedOperation;
-}): Ed25519NormalSigningExecutionDecision;
-type Ed25519OperationStepUpExecutionDecision = {
-    readonly kind: 'execute';
-    readonly operation: AuthorizedOperation;
-} | {
-    readonly kind: 'replay';
-    readonly response: Response;
-};
-export declare function decideEd25519OperationStepUpExecution(input: {
-    readonly admissionKind: 'claimed' | 'operation_in_progress' | 'replayed';
-    readonly operation: AuthorizedOperation;
-}): Ed25519OperationStepUpExecutionDecision;
-export declare function isRouterAbEd25519OperationInProgressResponse(input: {
-    readonly status: number;
-    readonly bodyText: string;
-}): boolean;
 export declare function handleThresholdEd25519(ctx: FetchRouterApiContext): Promise<Response | null>;
-export {};
 //# sourceMappingURL=thresholdEd25519.d.ts.map

package/dist/types/wallet-server/src/storage/d1Sql.d.ts

@@ -11,4 +11,11 @@ export declare function parseD1JsonArrayColumn(value: unknown): readonly unknown
 export declare function parseD1JsonObjectColumn(value: unknown): Record<string, unknown>;
 export declare function isD1DatabaseLike(value: unknown): value is D1DatabaseLike;
 export declare function resolveD1DatabaseFromConfig(config: Record<string, unknown>): D1DatabaseLike | null;
+/**
+ * Aborts the D1 batch it is in when the statement just before it changed no
+ * row: it collides with the guard table's immutable singleton, and the
+ * constraint failure rolls the whole batch back. The singleton is seeded by
+ * migration 0012.
+ */
+export declare const D1_BATCH_CAS_GUARD_SQL = "INSERT INTO router_ab_yao_versioned_json_cas_guard (guard_id)\nSELECT 1\n WHERE changes() = 0";
 //# sourceMappingURL=d1Sql.d.ts.map

package/dist/types/wallet-server/src/storage/syncSqlite.d.ts

@@ -0,0 +1,28 @@
+import type { D1DatabaseLike } from './tenantRoute';
+/**
+ * A value SQLite accepts as a bound parameter on every supported host.
+ */
+export type SyncSqliteValue = string | number | null | Uint8Array;
+export type SyncSqliteRow = Record<string, unknown>;
+/**
+ * One synchronous SQLite connection owned by a single role store: a Durable
+ * Object's SQLite storage on Cloudflare, or a role-private SQLite file opened
+ * by an ordinary process on a VM. Host adapters implement only these three
+ * operations; the store logic above them is shared.
+ */
+export interface SyncSqliteConnectionV1 {
+    /** Executes exactly one statement and returns its rows (none for writes). */
+    execute(sql: string, params: readonly SyncSqliteValue[]): readonly SyncSqliteRow[];
+    /** Runs `body` in one SQLite transaction. A thrown error rolls it back. */
+    transaction<T>(body: () => T): T;
+    /** Executes trusted schema text that may contain several statements. */
+    executeScript(sql: string): void;
+}
+/**
+ * Presents a synchronous SQLite connection through the async SQL shape used
+ * by the shared stores. `batch` is one SQLite transaction: a failing statement
+ * rolls back every earlier statement, so guarded compare-and-set batches keep
+ * the all-or-nothing semantics they have on D1.
+ */
+export declare function createSyncSqliteDatabase(connection: SyncSqliteConnectionV1): D1DatabaseLike;
+//# sourceMappingURL=syncSqlite.d.ts.map

package/dist/types/wallet-server/src/threshold/session/signingSessionSeal/crypto/shamir3PassWasm.d.ts

@@ -1,4 +1,3 @@
-export declare function ensureSigningSessionSealShamir3PassWasm(): Promise<void>;
 export declare function deriveSigningSessionSealLockKeyHandle(input: {
     readonly groupId: string;
     readonly rootSecret32: Uint8Array;

package/dist/types/wallet-server/src/threshold/session/signingSessionSeal/idempotencyRecords.d.ts

@@ -1,22 +1,20 @@
-import type { SigningSessionSealRouteResult } from './signingSessionSeal.types';
-export type CurrentSigningSessionSealSuccessIdempotencyResultRecord = {
+type CurrentSigningSessionSealSuccessIdempotencyResultRecord = {
     ok: true;
     ciphertext: string;
     keyVersion?: string;
     expiresAtMs?: number;
 };
-export type CurrentSigningSessionSealFailureIdempotencyResultRecord = {
+type CurrentSigningSessionSealFailureIdempotencyResultRecord = {
     ok: false;
     code: string;
     message: string;
 };
-export type CurrentSigningSessionSealIdempotencyResultRecord = CurrentSigningSessionSealSuccessIdempotencyResultRecord | CurrentSigningSessionSealFailureIdempotencyResultRecord;
-export type CurrentSigningSessionSealIdempotencyStoredEntry = {
+type CurrentSigningSessionSealIdempotencyResultRecord = CurrentSigningSessionSealSuccessIdempotencyResultRecord | CurrentSigningSessionSealFailureIdempotencyResultRecord;
+type CurrentSigningSessionSealIdempotencyStoredEntry = {
     result: CurrentSigningSessionSealIdempotencyResultRecord;
     expiresAtMs: number;
 };
-export declare const parseCurrentSigningSessionSealIdempotencyRecord: typeof parseCurrentSigningSessionSealIdempotencyResultRecord;
 export declare function parseCurrentSigningSessionSealIdempotencyResultRecord(raw: unknown): CurrentSigningSessionSealIdempotencyResultRecord | null;
 export declare function parseCurrentSigningSessionSealIdempotencyStoredEntry(raw: unknown): CurrentSigningSessionSealIdempotencyStoredEntry | null;
-export declare function parseCurrentSigningSessionSealIdempotencyRouteResult(raw: unknown): SigningSessionSealRouteResult | null;
+export {};
 //# sourceMappingURL=idempotencyRecords.d.ts.map

package/dist/types/wallet-server/src/threshold/session/signingSessionSeal/signingSessionSeal.types.d.ts

@@ -21,17 +21,16 @@ export type SigningSessionSealAuthorizeResult = {
     message?: string;
     status?: number;
 };
-export interface SigningSessionSealApplyServerSealRequest {
+/** Applying and removing the server seal take the same request. */
+export interface SigningSessionSealServerSealRequest {
     thresholdSessionId: string;
     ciphertext: string;
     keyVersion?: string;
     metadata?: Record<string, unknown>;
 }
-export interface SigningSessionSealRemoveServerSealRequest {
-    thresholdSessionId: string;
-    ciphertext: string;
-    keyVersion?: string;
-    metadata?: Record<string, unknown>;
+export interface SigningSessionSealApplyServerSealRequest extends SigningSessionSealServerSealRequest {
+}
+export interface SigningSessionSealRemoveServerSealRequest extends SigningSessionSealServerSealRequest {
 }
 type SigningSessionSealRouteSuccessBase = {
     ok: true;
@@ -77,7 +76,7 @@ export interface SigningSessionSealStartupCapabilities {
     currentKeyVersion: string;
 }
 export type SigningSessionSealOperation = 'apply-server-seal' | 'remove-server-seal';
-export type SigningSessionSealCurve = 'ecdsa' | 'ed25519';
+export type { SigningSessionSealCurve } from '../../../../../shared-ts/src/utils/signingSessionSeal';
 type SigningSessionSealAuthorizationSessionRecordBase = {
     userId: string;
     expiresAtMs: number;
@@ -144,5 +143,4 @@ export interface CreateSigningSessionSealServiceOptions {
     logger?: NormalizedLogger;
     nowMs?: () => number;
 }
-export {};
 //# sourceMappingURL=signingSessionSeal.types.d.ts.map

package/dist/types/wallet-server/src/threshold/session/signingSessionSeal/transport/shared.d.ts

@@ -11,6 +11,7 @@ export declare function resolveSigningSessionSealBasePath(input: string | undefi
 export declare function buildSigningSessionSealApplyPath(basePath: string): string;
 export declare function buildSigningSessionSealRemovePath(basePath: string): string;
 export declare function parseSigningSessionSealApplyBody(body: unknown): ParseResult<SigningSessionSealApplyServerSealRequest>;
+/** Removal takes the same body as apply. */
 export declare function parseSigningSessionSealRemoveBody(body: unknown): ParseResult<SigningSessionSealRemoveServerSealRequest>;
 export declare function authorizeSigningSessionSealRequest(args: {
     options: SigningSessionSealRoutesOptions;

package/dist/types/wallet-server/src/threshold/statusCodes.d.ts

@@ -1,10 +1,10 @@
-export type ThresholdRouteResult = {
+type ThresholdRouteResult = {
     ok: boolean;
     code?: string;
 };
-export type ThresholdEd25519RouteResult = ThresholdRouteResult;
-export type ThresholdEcdsaRouteResult = ThresholdRouteResult;
-export declare function thresholdStatusCode(result: ThresholdRouteResult): number;
+type ThresholdEd25519RouteResult = ThresholdRouteResult;
+type ThresholdEcdsaRouteResult = ThresholdRouteResult;
 export declare function thresholdEd25519StatusCode(result: ThresholdEd25519RouteResult): number;
 export declare function thresholdEcdsaStatusCode(result: ThresholdEcdsaRouteResult): number;
+export {};
 //# sourceMappingURL=statusCodes.d.ts.map

package/migrations/d1-signer/0036_r150_yao_lifecycle_decisions.sql

@@ -0,0 +1,22 @@
+-- R150: one finalization decision per Ed25519 Yao lifecycle.
+--
+-- The Router's wallet object records each registration's execution and binds
+-- the first finalization that consumes it. The decision is the Gateway's fact:
+-- a row here commits in the same batch as the writes that make the
+-- finalization visible (the wallet's signer rows), so the result is visible if
+-- and only if its decision exists. A row is written once and never changes.
+CREATE TABLE yao_lifecycle_decisions (
+  namespace TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  project_id TEXT NOT NULL,
+  env_id TEXT NOT NULL,
+  lifecycle_id TEXT NOT NULL,
+  decision_kind TEXT NOT NULL,
+  decision_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL,
+  decided_at_ms INTEGER NOT NULL,
+  PRIMARY KEY (namespace, org_id, project_id, env_id, lifecycle_id),
+  CHECK (decision_kind IN ('registration_finalized', 'add_signer_finalized')),
+  CHECK (length(decision_id) > 0),
+  CHECK (length(wallet_id) > 0)
+);

package/migrations/d1-signer/0037_r150_wallet_auth_method_revocation_replays.sql

@@ -0,0 +1,26 @@
+-- R150: the committed answer to one auth-method revocation.
+--
+-- A revocation commits its method, session and envelope writes in one batch,
+-- and this row with them: the exact answer the request received, bound to the
+-- operation it named and to a digest of the proof that authorized it, never
+-- the proof itself. An exact retry after a lost answer is answered from this
+-- row instead of presenting its single-use proof again. A method is revoked
+-- once, so the row is keyed by the method, and it never changes.
+CREATE TABLE wallet_auth_method_revocation_replays (
+  namespace TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  project_id TEXT NOT NULL,
+  env_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL,
+  target_wallet_auth_method_id TEXT NOT NULL,
+  operation_fingerprint_digest_b64u TEXT NOT NULL,
+  source_wallet_auth_method_id TEXT NOT NULL,
+  source_proof_digest_b64u TEXT NOT NULL,
+  response_json TEXT NOT NULL,
+  committed_at_ms INTEGER NOT NULL,
+  PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_id, target_wallet_auth_method_id),
+  CHECK (length(operation_fingerprint_digest_b64u) > 0),
+  CHECK (length(source_proof_digest_b64u) > 0),
+  CHECK (json_valid(response_json)),
+  CHECK (committed_at_ms >= 0)
+);

package/migrations/d1-signer/0038_r150_registration_ceremony_cas_guard_seed.sql

@@ -0,0 +1,8 @@
+-- R150: seed the registration ceremony CAS guard.
+--
+-- Guarded D1 batches abort by colliding with this immutable singleton when a
+-- preceding compare-and-swap statement changes no row. 0001 created the table
+-- but not its row, so the first guard to fire on each database inserted the
+-- row and let its batch commit instead of aborting. Registration ceremony
+-- records and the Email OTP registration receipt use this guard.
+INSERT OR IGNORE INTO registration_ceremony_cas_guard (guard_id) VALUES (1);

package/migrations/d1-signer/0039_r150_revocation_replay_answer_kind.sql

@@ -0,0 +1,9 @@
+-- R150: which route answered a recorded revocation.
+--
+-- A linked device's method is revoked through the device-management route,
+-- whose answer names the device's authority and its revocation epoch; the
+-- auth-method route answers with the method's kind. Both record the answer
+-- here, keyed by the method and bound to the same operation fingerprint, so
+-- each route reads back only an answer it recorded itself.
+ALTER TABLE wallet_auth_method_revocation_replays
+  ADD COLUMN answer_kind TEXT NOT NULL DEFAULT 'wallet_auth_method_revocation_v1';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seams/wallet-server",
-  "version": "0.6.2",
+  "version": "0.7.3",
   "type": "module",
   "description": "Seams server TypeScript SDK for NEAR and EVM-family wallets",
   "main": "./dist/esm/index.js",

package/dist/esm/core/ThresholdService/ecdsaClientRootProof.js

@@ -1,27 +0,0 @@
-import { base64UrlDecode, base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
-import "../../shared-ts/src/utils/encoders.js";
-import { verifySecp256k1RecoverableSignatureAgainstPublicKey33 } from "./evmCryptoWasm.js";
-//#region src/core/ThresholdService/ecdsaClientRootProof.ts
-async function verifyEcdsaClientRootProof(proof) {
-	try {
-		if (base64UrlEncode(await verifySecp256k1RecoverableSignatureAgainstPublicKey33(base64UrlDecode(proof.digest32B64u), base64UrlDecode(proof.signature65B64u), base64UrlDecode(proof.clientRootPublicKey33B64u))) !== proof.clientRootPublicKey33B64u) return {
-			ok: false,
-			code: "unauthorized",
-			message: "Invalid client root proof"
-		};
-		return {
-			ok: true,
-			clientRootPublicKey33B64u: proof.clientRootPublicKey33B64u
-		};
-	} catch {
-		return {
-			ok: false,
-			code: "unauthorized",
-			message: "Invalid client root proof"
-		};
-	}
-}
-//#endregion
-export { verifyEcdsaClientRootProof };
-
-//# sourceMappingURL=ecdsaClientRootProof.js.map