@seams/wallet-server 0.7.1 → 0.7.3

package/dist/esm/router/cloudflare/d1/passkeyCustody/d1PasskeyCustodyRouteService.js

@@ -5,6 +5,7 @@ import "../../../../shared-ts/src/utils/encoders.js";
 import { isActiveRecoveredWalletAuthorityV1, walletAuthorityDigestsMatchV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { PASSKEY_PRF_FIRST_SALT_V1, PASSKEY_PRF_SECOND_SALT_V1 } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { isHostWithinRpId, originHostnameOrEmpty } from "../../../../core/authService/webauthnOidcHelpers.js";
 import { buildWalletRecoveryBackupAcknowledgementV1, walletRecoveryBackupIsOutstanding } from "../../../../shared-ts/src/wallet-recovery/backupAcknowledgement.js";
 import "../../../../shared-ts/src/wallet-recovery/recoveryCodes.js";
@@ -251,20 +252,12 @@ function createD1PasskeyCustodyRouteService(assembly) {
 			const expectedOrigin = String(request.expectedOrigin || "").trim();
 			if (!challengeId || !expectedOrigin) return {
 				status: 400,
-				body: {
-					ok: false,
-					code: "challenge_required",
-					message: "custody retrieval needs a server-issued challenge and an origin"
-				}
+				body: failure("challenge_required", "custody retrieval needs a server-issued challenge and an origin")
 			};
 			const challenge = await assembly.webAuthnStore.consumeLoginChallenge(challengeId);
 			if (!challenge) return {
 				status: 401,
-				body: {
-					ok: false,
-					code: "challenge_unknown",
-					message: "the challenge is unknown, expired, or already used"
-				}
+				body: failure("challenge_unknown", "the challenge is unknown, expired, or already used")
 			};
 			const projections = await assembly.passkeyCustodyEnvelopes.listWalletCredentialActivity(request.locator.walletId);
 			const requestedFactor = request.locator.factor;
@@ -275,11 +268,7 @@ function createD1PasskeyCustodyRouteService(assembly) {
 			const projection = matchingProjections.find((entry) => entry.index.lifecycle.state === "active") ?? matchingProjections[0];
 			if (!projection || projection.index.factor.kind !== "passkey") return {
 				status: 404,
-				body: {
-					ok: false,
-					code: "envelope_missing",
-					message: "no custody envelope for this wallet and credential"
-				}
+				body: failure("envelope_missing", "no custody envelope for this wallet and credential")
 			};
 			const locator = {
 				walletId: request.locator.walletId,

package/dist/esm/router/cloudflare/d1/passkeyCustody/d1WalletCustodyCommitStore.js

@@ -1,4 +1,4 @@
-import { mpcMaterialActivationRefsEqual, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { buildDelegatedWalletAuthorityV1, buildFullOwnerDelegatedWalletAuthorityV1, sameDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { sameWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
@@ -20,6 +20,7 @@ import { CloudflareD1VersionedJsonRecordStore } from "../versionedJson/d1Version
 import { parseEmailOtpWalletEnrollmentRow } from "../emailOtp/d1EmailOtpRecords.js";
 import "../../../../shared-ts/src/wallet-recovery/index.js";
 import "../../../../shared-ts/src/authorization/index.js";
+import { sameWalletEcdsaSignerActivationV1, sameWalletEd25519SignerActivationV1 } from "../../../../shared-ts/src/authorization/walletSignerActivationEquality.js";
 import { PASSKEY_ENVELOPE_KEY_PREFIX, passkeyCustodyEnvelopeLocatorOf, passkeyCustodyEnvelopeRecordKey } from "./d1PasskeyCustodyEnvelopeStore.js";
 import { parseWalletRecoveryGoogleEmailOtpAttemptRecord, sameWalletRecoveryGoogleEmailOtpFinalizationInputV1, walletRecoveryGoogleEmailOtpAttemptKey, walletRecoveryGoogleEmailOtpFinalizationInput } from "./d1WalletRecoveryGoogleEmailOtpRecords.js";
 import { sameWalletCustodyRecoveryReplacementEnvelopeV1 } from "../../../domains/passkeyCustody/walletRecoveryFinalization.js";
@@ -36,12 +37,6 @@ function sameWalletSignerActivationSetV1(left, right) {
 	if (leftEd25519 === void 0 !== (rightEd25519 === void 0)) return false;
 	return leftEd25519 === void 0 || rightEd25519 === void 0 || sameWalletEd25519SignerActivationV1(leftEd25519, rightEd25519);
 }
-function sameWalletEcdsaSignerActivationV1(left, right) {
-	return left.kind === right.kind && left.signer.kind === right.signer.kind && left.signer.keyFamily === right.signer.keyFamily && left.signer.walletId === right.signer.walletId && left.signer.walletKeyId === right.signer.walletKeyId && left.signer.thresholdPublicKey33B64u === right.signer.thresholdPublicKey33B64u && left.signer.evmAddress === right.signer.evmAddress && mpcMaterialActivationRefsEqual(left.materialActivation, right.materialActivation);
-}
-function sameWalletEd25519SignerActivationV1(left, right) {
-	return left.kind === right.kind && left.signer.kind === right.signer.kind && left.signer.keyFamily === right.signer.keyFamily && left.signer.walletId === right.signer.walletId && left.signer.walletKeyId === right.signer.walletKeyId && left.signer.registeredPublicKeyB64u === right.signer.registeredPublicKeyB64u && mpcMaterialActivationRefsEqual(left.materialActivation, right.materialActivation);
-}
 function hasFullOwnerPermissionsV1(permissions) {
 	return sameDelegatedWalletAuthorityV1(buildDelegatedWalletAuthorityV1({ permissions }), buildFullOwnerDelegatedWalletAuthorityV1());
 }

package/dist/esm/router/cloudflare/d1/passkeyCustody/d1WalletRecoveryGoogleEmailOtpRecords.js

@@ -4,6 +4,7 @@ import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimit
 import { parseEnvelopeRevision } from "../../../../shared-ts/src/passkey-custody/primitives.js";
 import { parseWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
+import { hasExactKeys } from "../../../../shared-ts/src/utils/exactKeys.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
 import { parseRecoveryCodeReservationId } from "../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
 //#region src/router/cloudflare/d1/passkeyCustody/d1WalletRecoveryGoogleEmailOtpRecords.ts
@@ -125,14 +126,14 @@ function parseWalletRecoveryGoogleEmailOtpAttemptRecord(raw) {
 		expiresAtMs
 	};
 	if (record.state === "prepared") {
-		if (!hasExactFields(record, [...expectedCommonFields])) return null;
+		if (!hasExactKeys(record, [...expectedCommonFields])) return null;
 		return {
 			...common,
 			state: "prepared"
 		};
 	}
 	if (record.state !== "otp_issued" && record.state !== "otp_verified" && record.state !== "finalized") return null;
-	if (!hasExactFields(record, [
+	if (!hasExactKeys(record, [
 		...expectedCommonFields,
 		"providerSubject",
 		"verifiedEmail",
@@ -164,7 +165,7 @@ function parseWalletRecoveryGoogleEmailOtpAttemptRecord(raw) {
 function parseContinuityAnchor(raw) {
 	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
 	const record = raw;
-	if (!hasExactFields(record, [
+	if (!hasExactKeys(record, [
 		"kind",
 		"authority",
 		"method",
@@ -207,7 +208,7 @@ function parseContinuityEnvelope(raw) {
 	const updatedAtMs = parsePositiveMs(record.updatedAtMs);
 	if (!envelopeId.ok || !walletId.ok || updatedAtMs === null || record.bindingKind !== "wallet_custody_seed_v1") return null;
 	if (record.kind === "passkey") {
-		if (!hasExactFields(record, [
+		if (!hasExactKeys(record, [
 			...commonFields,
 			"rpId",
 			"credentialIdB64u"
@@ -227,7 +228,7 @@ function parseContinuityEnvelope(raw) {
 		};
 	}
 	if (record.kind === "email_otp") {
-		if (!hasExactFields(record, [
+		if (!hasExactKeys(record, [
 			...commonFields,
 			"enrollmentId",
 			"enrollmentSealKeyVersion"
@@ -251,7 +252,7 @@ function parseContinuityEnvelope(raw) {
 function parseTarget(raw) {
 	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
 	const record = raw;
-	return hasExactFields(record, ["kind", "googleProvider"]) && record.kind === "google_email_otp" && record.googleProvider === "google" ? {
+	return hasExactKeys(record, ["kind", "googleProvider"]) && record.kind === "google_email_otp" && record.googleProvider === "google" ? {
 		kind: "google_email_otp",
 		googleProvider: "google"
 	} : null;
@@ -261,7 +262,7 @@ function parseTargetEnrollment(raw) {
 	const record = raw;
 	if (typeof record.kind !== "string") return null;
 	if (record.kind === "existing") {
-		if (!hasExactFields(record, [
+		if (!hasExactKeys(record, [
 			"kind",
 			"enrollmentId",
 			"enrollmentSealKeyVersion"
@@ -275,7 +276,7 @@ function parseTargetEnrollment(raw) {
 		} : null;
 	}
 	if (record.kind === "create") {
-		if (!hasExactFields(record, [
+		if (!hasExactKeys(record, [
 			"kind",
 			"providerSubject",
 			"verifiedEmail"
@@ -303,11 +304,6 @@ function parsePositiveMs(raw) {
 function nonEmpty(raw) {
 	return typeof raw === "string" && raw.trim() ? raw.trim() : null;
 }
-function hasExactFields(record, fields) {
-	const actual = Object.keys(record).sort();
-	const expected = [...fields].sort();
-	return actual.length === expected.length && actual.every((field, index) => field === expected[index]);
-}
 function hasFields(record, fields) {
 	return fields.every((field) => Object.hasOwn(record, field));
 }

package/dist/esm/router/cloudflare/d1/passkeyCustody/d1WalletRecoveryGoogleEmailOtpService.js

@@ -4,6 +4,7 @@ import { alphabetizeStringify, sha256BytesUtf8, sha256HexUtf8 } from "../../../.
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import "../../../../shared-ts/src/utils/encoders.js";
 import { buildWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { consumeReservedRecoveryCode } from "../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
 import { hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
@@ -129,24 +130,12 @@ var CloudflareD1WalletRecoveryGoogleEmailOtpService = class {
 			enrollment: attempt.targetEnrollment
 		};
 		const workerEphemeralPublicKey65B64u = nonEmpty(input.workerEphemeralPublicKey65B64u);
-		if (!workerEphemeralPublicKey65B64u) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Email OTP recovery factor release key is required"
-		};
+		if (!workerEphemeralPublicKey65B64u) return failure("invalid_body", "Email OTP recovery factor release key is required");
 		const enrollment = await this.enrollments.readEnrollment(String(attempt.walletId));
-		if (!enrollment || enrollment.orgId !== attempt.orgId || enrollment.providerUserId !== attempt.providerSubject || enrollment.verifiedEmail !== attempt.verifiedEmail || enrollment.enrollmentId !== attempt.targetEnrollment.enrollmentId || enrollment.enrollmentSealKeyVersion !== attempt.targetEnrollment.enrollmentSealKeyVersion) return {
-			ok: false,
-			code: "recovery_conflict",
-			message: "Email OTP recovery enrollment changed after verification"
-		};
+		if (!enrollment || enrollment.orgId !== attempt.orgId || enrollment.providerUserId !== attempt.providerSubject || enrollment.verifiedEmail !== attempt.verifiedEmail || enrollment.enrollmentId !== attempt.targetEnrollment.enrollmentId || enrollment.enrollmentSealKeyVersion !== attempt.targetEnrollment.enrollmentSealKeyVersion) return failure("recovery_conflict", "Email OTP recovery enrollment changed after verification");
 		const unsealed = await this.serverSeal.removeEmailOtpServerSeal({ wrappedCiphertext: enrollment.serverSealedFactorCiphertextB64u });
 		if (!unsealed.ok) return unsealed;
-		if (unsealed.enrollmentSealKeyVersion !== enrollment.enrollmentSealKeyVersion) return {
-			ok: false,
-			code: "recovery_conflict",
-			message: "Email OTP recovery enrollment seal changed after verification"
-		};
+		if (unsealed.enrollmentSealKeyVersion !== enrollment.enrollmentSealKeyVersion) return failure("recovery_conflict", "Email OTP recovery enrollment seal changed after verification");
 		const sealed = await sealEmailOtpFactorSecretForWorker({
 			factorSecret32B64u: unsealed.ciphertext,
 			workerEphemeralPublicKey65B64u,
@@ -464,18 +453,10 @@ async function replayGoogleEmailOtpRecovery(input) {
 	};
 }
 function parseGoogleIdentity(result) {
-	if (!result.ok || result.verified !== true) return {
-		ok: false,
-		code: result.code || "not_verified",
-		message: result.message || "Google verification failed"
-	};
+	if (!result.ok || result.verified !== true) return failure(result.code || "not_verified", result.message || "Google verification failed");
 	const providerSubject = parseProviderSubject(result.providerSubject);
 	const email = parseVerifiedGoogleEmail(result.email);
-	if (!providerSubject.ok || !email.ok || result.emailVerified !== true) return {
-		ok: false,
-		code: "provider_identity_mismatch",
-		message: "Google verification did not provide a verified identity email"
-	};
+	if (!providerSubject.ok || !email.ok || result.emailVerified !== true) return failure("provider_identity_mismatch", "Google verification did not provide a verified identity email");
 	return {
 		ok: true,
 		providerSubject: providerSubject.value,
@@ -484,27 +465,15 @@ function parseGoogleIdentity(result) {
 }
 function resolveTargetEnrollment(input) {
 	if (input.enrollment) {
-		if (input.enrollment.orgId !== input.orgId || input.enrollment.providerUserId !== input.identity.providerSubject || input.enrollment.verifiedEmail !== input.identity.verifiedEmail) return {
-			ok: false,
-			code: "provider_identity_mismatch",
-			message: "Google identity does not match the wallet Email enrollment"
-		};
-		if (input.anchor.envelope.kind === "email_otp" && (input.anchor.envelope.enrollmentId !== input.enrollment.enrollmentId || input.anchor.envelope.enrollmentSealKeyVersion !== input.enrollment.enrollmentSealKeyVersion)) return {
-			ok: false,
-			code: "recovery_conflict",
-			message: "Wallet Email custody enrollment changed after preparation"
-		};
+		if (input.enrollment.orgId !== input.orgId || input.enrollment.providerUserId !== input.identity.providerSubject || input.enrollment.verifiedEmail !== input.identity.verifiedEmail) return failure("provider_identity_mismatch", "Google identity does not match the wallet Email enrollment");
+		if (input.anchor.envelope.kind === "email_otp" && (input.anchor.envelope.enrollmentId !== input.enrollment.enrollmentId || input.anchor.envelope.enrollmentSealKeyVersion !== input.enrollment.enrollmentSealKeyVersion)) return failure("recovery_conflict", "Wallet Email custody enrollment changed after preparation");
 		return {
 			kind: "existing",
 			enrollmentId: input.enrollment.enrollmentId,
 			enrollmentSealKeyVersion: input.enrollment.enrollmentSealKeyVersion
 		};
 	}
-	if (input.anchor.envelope.kind === "email_otp") return {
-		ok: false,
-		code: "recovery_conflict",
-		message: "Wallet Email custody enrollment is missing after preparation"
-	};
+	if (input.anchor.envelope.kind === "email_otp") return failure("recovery_conflict", "Wallet Email custody enrollment is missing after preparation");
 	return {
 		kind: "create",
 		providerSubject: input.identity.providerSubject,
@@ -565,18 +534,10 @@ function nonEmpty(value) {
 	return typeof value === "string" && value.trim() ? value.trim() : null;
 }
 function recoveryAttemptUnavailable() {
-	return {
-		ok: false,
-		code: "recovery_attempt_unavailable",
-		message: "Wallet recovery operation is unavailable"
-	};
+	return failure("recovery_attempt_unavailable", "Wallet recovery operation is unavailable");
 }
 function recoveryAttemptConflict() {
-	return {
-		ok: false,
-		code: "recovery_conflict",
-		message: "Wallet recovery operation changed; retry recovery"
-	};
+	return failure("recovery_conflict", "Wallet recovery operation changed; retry recovery");
 }
 function recoveryFinalizationRefused(reason) {
 	return {

package/dist/esm/router/cloudflare/d1/registration/d1EvmFamilyEcdsaRegistrationBranch.js

@@ -3,6 +3,7 @@ import { deriveEvmFamilySigningKeySlotId } from "../../../../shared-ts/src/signi
 import { computeEcdsaDerivationRoleLocalRelayerKeyId, computeEcdsaDerivationRoleLocalThresholdKeyId, computeSdkEcdsaDerivationApplicationBindingDigestB64u, parseSdkEcdsaDerivationSigningRootId, parseSdkEcdsaDerivationSigningRootVersion, parseSdkEcdsaDerivationThresholdKeyId } from "../../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { buildRouterAbEcdsaDerivationActiveStateIdV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import "./d1RegistrationCeremonyRecords.js";
 //#region src/router/cloudflare/d1/registration/d1EvmFamilyEcdsaRegistrationBranch.ts
 const REGISTRATION_WALLET_SIGNING_SESSION_REMAINING_USES = 3;
@@ -13,28 +14,12 @@ function requireRegistrationRootShareEpoch(value) {
 	return parsed.value;
 }
 async function buildD1EvmFamilyEcdsaRegistrationPrepare(input) {
-	if (!input.chainTargets) return {
-		ok: false,
-		code: "invalid_body",
-		message: "ECDSA registration contains an invalid chain target"
-	};
-	if (input.chainTargets.length === 0) return {
-		ok: false,
-		code: "invalid_body",
-		message: "ECDSA registration requires at least one chain target"
-	};
+	if (!input.chainTargets) return failure("invalid_body", "ECDSA registration contains an invalid chain target");
+	if (input.chainTargets.length === 0) return failure("invalid_body", "ECDSA registration requires at least one chain target");
 	const firstChainTarget = input.chainTargets[0];
-	if (!firstChainTarget) return {
-		ok: false,
-		code: "invalid_body",
-		message: "ECDSA registration requires at least one chain target"
-	};
+	if (!firstChainTarget) return failure("invalid_body", "ECDSA registration requires at least one chain target");
 	const chainTargets = [firstChainTarget, ...input.chainTargets.slice(1)];
-	if (input.participantIds.length !== 2 || input.participantIds[0] !== 1 || input.participantIds[1] !== 2) return {
-		ok: false,
-		code: "invalid_body",
-		message: "ECDSA registration requires participant pair [1, 2]"
-	};
+	if (input.participantIds.length !== 2 || input.participantIds[0] !== 1 || input.participantIds[1] !== 2) return failure("invalid_body", "ECDSA registration requires participant pair [1, 2]");
 	const evmFamilySigningKeySlotId = deriveEvmFamilySigningKeySlotId({
 		walletId: input.walletId,
 		signingRootId: input.signingRootId,

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore.js

@@ -64,14 +64,14 @@ var D1RegistrationCeremonyRecordStore = class {
 	async updateExpected(input) {
 		const key = this.normalizeKey(input.scope, input.id);
 		const current = await this.get(input.scope, input.id);
-		if (!current || stableJson(current.value) !== stableJson(input.expected)) throw conflict("Registration ceremony record changed before update");
+		if (!current || alphabetizeStringify(current.value) !== alphabetizeStringify(input.expected)) throw conflict("Registration ceremony record changed before update");
 		const next = prepareValue(input.next, input.expiresAtMs);
 		if (changes(await this.database.prepare(UPDATE_EXPECTED_VERSION_SQL).bind(...this.bindKey(key), next.recordJson, next.expiresAtMs, Date.now(), current.version).run()) !== 1) throw conflict("Registration ceremony record changed during update");
 	}
 	async claimEcdsaRegistrationBranch(input) {
 		const key = this.normalizeKey(input.scope, input.id);
 		const strictRegistrationBindingJson = input.binding.kind === "strict_registration" ? normalizeKeyPart(input.binding.strictRegistrationBindingJson, "strictRegistrationBindingJson", 16384) : "";
-		const patchJson = stableJson(input.patch);
+		const patchJson = alphabetizeStringify(input.patch);
 		const nowMs = Date.now();
 		const row = await this.database.prepare(`WITH target(branch_index) AS (
            SELECT CAST(branch.key AS INTEGER)
@@ -236,7 +236,7 @@ function prepareValue(value, expiresAtMs) {
 	if (!Number.isSafeInteger(normalizedExpiresAtMs) || normalizedExpiresAtMs <= Date.now()) throw new Error("Registration ceremony record expiry must be in the future");
 	return {
 		value,
-		recordJson: stableJson(value),
+		recordJson: alphabetizeStringify(value),
 		expiresAtMs: normalizedExpiresAtMs
 	};
 }
@@ -259,10 +259,7 @@ function parseStoredRow(row) {
 	};
 }
 function recordsMatch(current, next) {
-	return current.expiresAtMs === next.expiresAtMs && stableJson(current.value) === next.recordJson;
-}
-function stableJson(value) {
-	return alphabetizeStringify(value);
+	return current.expiresAtMs === next.expiresAtMs && alphabetizeStringify(current.value) === next.recordJson;
 }
 function changes(result) {
 	if (!result.success) throw new Error("Registration ceremony D1 mutation failed");

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyRecords.js

@@ -16,8 +16,9 @@ import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/
 import { parseWebAuthnAuthenticatorDeviceInfo, unknownWebAuthnAuthenticatorDeviceInfo } from "../../../../shared-ts/src/utils/webauthnDeviceInfo.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { parseRouterAbEd25519NormalSigningState } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
-import { thresholdEcdsaChainTargetFromValue, thresholdEcdsaChainTargetKey } from "../../../../core/thresholdEcdsaChainTarget.js";
 import { parseEcdsaDerivationPublicIdentity, parseThresholdEd25519AuthorityScope, thresholdEd25519AuthorityScopeFromWalletAuthAuthority, thresholdEd25519AuthorityScopesMatch } from "../../../../core/ThresholdService/validation.js";
+import { thresholdEcdsaChainTargetKey } from "../../../../shared-ts/src/utils/thresholdEcdsaChainTarget.js";
+import { thresholdEcdsaChainTargetFromValue } from "../../../../core/thresholdEcdsaChainTarget.js";
 import { buildWalletEcdsaSignerRecord, parseWalletEd25519SignerRecord } from "../../../../core/d1WalletStore.js";
 import { createServerAllocatedWalletId, nearEd25519SigningKeyIdFromString, walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { registrationPreparationIdFromString } from "../../../../core/types.js";

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationIntentService.js

@@ -3,6 +3,7 @@ import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/
 import "../../../../shared-ts/src/utils/validation.js";
 import { normalizeAddAuthMethodInput } from "../../../../shared-ts/src/utils/registrationAuthMethodInput.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { thresholdEcdsaChainTargetFromValue } from "../../../../core/thresholdEcdsaChainTarget.js";
 import { normalizeAddSignerSelection } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
 import { addAuthMethodIntentGrantFromString, addSignerIntentGrantFromString, computeAddAuthMethodIntentDigestB64u, computeAddSignerIntentDigestB64u } from "../../../../shared-ts/src/utils/registrationIntent.js";
@@ -19,11 +20,7 @@ var CloudflareD1RegistrationIntentService = class {
 		try {
 			const store = this.getRegistrationCeremonyIntentStore();
 			const walletId = parseWalletIdForIntent(input.command.subject.walletId);
-			if (!walletId) return {
-				ok: false,
-				code: "invalid_body",
-				message: "walletId is required"
-			};
+			if (!walletId) return failure("invalid_body", "walletId is required");
 			const signerSelection = normalizeAddSignerSelection(input.command.signerSelection, { normalizeEcdsaChainTarget: thresholdEcdsaChainTargetFromValue });
 			if (!signerSelection.ok) return signerSelection;
 			const runtimePolicyScope = input.runtimePolicyScope || inferRuntimePolicyScopeFromSigningRoot(input);
@@ -52,35 +49,19 @@ var CloudflareD1RegistrationIntentService = class {
 				expiresAtMs
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				code: "internal",
-				message: errorMessage(error) || "Failed to create add-signer intent"
-			};
+			return failure("internal", errorMessage(error) || "Failed to create add-signer intent");
 		}
 	}
 	async createAddAuthMethodIntent(input) {
 		try {
 			const store = this.getRegistrationCeremonyIntentStore();
 			const walletId = parseWalletIdForIntent(input.command.subject.walletId);
-			if (!walletId) return {
-				ok: false,
-				code: "invalid_body",
-				message: "walletId is required"
-			};
+			if (!walletId) return failure("invalid_body", "walletId is required");
 			const authMethod = normalizeAddAuthMethodInput(input.command.authMethod);
-			if (!authMethod) return {
-				ok: false,
-				code: "invalid_body",
-				message: "authMethod is required"
-			};
+			if (!authMethod) return failure("invalid_body", "authMethod is required");
 			const runtimePolicyScope = input.runtimePolicyScope || inferRuntimePolicyScopeFromSigningRoot(input);
 			const targetWalletAuthMethodId = parseWalletAuthMethodId(`wallet-auth-method:${secureRandomBase64Url(32)}`);
-			if (!targetWalletAuthMethodId.ok) return {
-				ok: false,
-				code: "internal",
-				message: "Failed to allocate a target auth-method id"
-			};
+			if (!targetWalletAuthMethodId.ok) return failure("internal", "Failed to allocate a target auth-method id");
 			const intent = buildAddAuthMethodIntent({
 				walletId,
 				authMethod,
@@ -108,11 +89,7 @@ var CloudflareD1RegistrationIntentService = class {
 				expiresAtMs
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				code: "internal",
-				message: errorMessage(error) || "Failed to create add-auth-method intent"
-			};
+			return failure("internal", errorMessage(error) || "Failed to create add-auth-method intent");
 		}
 	}
 };

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationService.js

@@ -1078,38 +1078,43 @@ var CloudflareD1WalletRegistrationService = class {
 	async resolveEcdsaMaterialActivation(input) {
 		try {
 			const walletId = walletIdFromString(input.walletId);
-			const store = this.getWalletStore();
-			const signer = await store.getEcdsaSignerByMaterialActivation({
+			const canonical = await this.getWalletStore().readEcdsaSignerMaterialSnapshot({
+				source: input.source,
 				walletId,
 				materialActivation: input.materialActivation
 			});
-			if (signer) return {
-				ok: true,
-				materialActivation: signer.walletKey.publicCapability.material_activation,
-				keyHandle: signer.walletKey.keyHandle,
-				relayerKeyId: signer.walletKey.relayerKeyId,
-				participantIds: signer.walletKey.participantIds,
-				runtimePolicyScope: signer.runtimePolicyScope,
-				routerAbEcdsaDerivationNormalSigning: buildPostRegistrationEcdsaNormalSigningState({
-					walletKey: signer.walletKey,
-					publicCapability: signer.walletKey.publicCapability
-				})
-			};
+			if (canonical) {
+				const { signer, readSnapshot } = canonical;
+				return {
+					readSnapshot,
+					ok: true,
+					materialActivation: signer.walletKey.publicCapability.material_activation,
+					keyHandle: signer.walletKey.keyHandle,
+					relayerKeyId: signer.walletKey.relayerKeyId,
+					participantIds: signer.walletKey.participantIds,
+					runtimePolicyScope: signer.runtimePolicyScope,
+					routerAbEcdsaDerivationNormalSigning: buildPostRegistrationEcdsaNormalSigningState({
+						walletKey: signer.walletKey,
+						publicCapability: signer.walletKey.publicCapability
+					})
+				};
+			}
 			const linkedDeviceReader = this.getLinkedDeviceEd25519AuthorityReader();
-			const custodyChain = linkedDeviceReader ? await linkedDeviceReader.readInstalledEcdsaAuthorityChainByMaterialActivationV1({
+			const custodySnapshot = linkedDeviceReader ? await linkedDeviceReader.readInstalledEcdsaCustodySnapshotV1({
+				source: input.source,
 				walletId,
 				materialActivation: routerAbMpcMaterialActivationRefFromWire(input.materialActivation)
-			}) : [];
-			const projection = custodyChain[0];
-			if (!projection) return {
+			}) : null;
+			const projection = custodySnapshot?.chain[0];
+			if (!custodySnapshot || !projection) return {
 				ok: false,
 				code: "not_found",
 				message: "ECDSA material activation is not active for this wallet"
 			};
-			const walletSigners = await store.listEcdsaSignersForWallet({ walletId });
+			const { chain, signers } = custodySnapshot;
 			let matchingSourceSigners = [];
-			for (const custodySource of custodyChain) {
-				matchingSourceSigners = walletSigners.filter(linkedEcdsaProjectionMatchesSigner.bind(null, custodySource));
+			for (const custodySource of chain) {
+				matchingSourceSigners = signers.filter(linkedEcdsaProjectionMatchesSigner.bind(null, custodySource));
 				if (matchingSourceSigners.length > 0) break;
 			}
 			const canonicalSigner = matchingSourceSigners[0];
@@ -1125,6 +1130,7 @@ var CloudflareD1WalletRegistrationService = class {
 			};
 			return {
 				ok: true,
+				readSnapshot: custodySnapshot.readSnapshot,
 				materialActivation: routerAbMpcMaterialActivationRefToWire(projection.materialActivation),
 				keyHandle: canonicalSigner.walletKey.keyHandle,
 				relayerKeyId: canonicalSigner.walletKey.relayerKeyId,
@@ -1174,7 +1180,11 @@ var CloudflareD1WalletRegistrationService = class {
 		}
 	}
 	async resolveActiveEcdsaTenantRoot(input) {
-		const activeMaterial = await this.resolveEcdsaMaterialActivation(input);
+		const activeMaterial = await this.resolveEcdsaMaterialActivation({
+			walletId: input.walletId,
+			materialActivation: input.materialActivation,
+			source: { kind: "database" }
+		});
 		if (!activeMaterial.ok) return activeMaterial;
 		const identity = resolveTenantRootIdentityV1({
 			kind: "ecdsa_b5_active_material",

package/dist/esm/router/cloudflare/d1/registration/walletRegistrationSessionCommitReceipt.js

@@ -5,6 +5,7 @@ import { parseWalletAuthAuthority } from "../../../../shared-ts/src/utils/wallet
 import { parseWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { parseSessionOrigin } from "../../../../authorization/domain.js";
+import { hasExactKeys } from "../../../../shared-ts/src/utils/exactKeys.js";
 import { parseWalletCustodyRegistrationOutcome } from "../../../../shared-ts/src/passkey-custody/ceremonyCommitPayload.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
 //#region src/router/cloudflare/d1/registration/walletRegistrationSessionCommitReceipt.ts
@@ -466,10 +467,6 @@ function parsePositiveSafeInteger(value) {
 function parseNonNegativeSafeInteger(value) {
 	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : null;
 }
-function hasExactKeys(record, expected) {
-	const actual = Object.keys(record);
-	return actual.length === expected.length && expected.every((key) => actual.includes(key));
-}
 function containsPersistedRegistrationCredential(value) {
 	if (Array.isArray(value)) return value.some(containsPersistedRegistrationCredential);
 	if (value === null || typeof value !== "object") return false;