@seams/wallet-server 0.7.1 → 0.7.3

package/dist/types/wallet-server/src/core/signingLanes/WalletExecutionLaneProjection.d.ts

@@ -1,18 +1,9 @@
-import { type SigningLaneRecord, type WalletKeyRecord } from '../../../../shared-ts/src/signing-lanes';
-import { type DigestB64u } from '../../../../shared-ts/src/utils/canonicalPrimitives';
+import { type OwnerWalletExecutionLaneProjectionV1 } from '../../../../shared-ts/src/signing-lanes';
 import type { MpcMaterialActivationRef, ProviderSubject, WalletAuthMethodId, WalletId } from '../../../../shared-ts/src/utils/domainIds';
 import { type WalletAuthMethodRecordV2 } from '../../../../shared-ts/src/utils/walletAuthMethodRecord';
 import { type WalletAuthAuthorityRef } from '../../../../shared-ts/src/utils/walletAuthAuthority';
 import type { WalletSignerRecord } from '../WalletStore';
-export type ActiveOwnerWalletExecutionLaneProjection = {
-    readonly kind: 'active_owner_wallet_execution_lane_projection_v1';
-    readonly walletKey: WalletKeyRecord;
-    readonly lane: Extract<SigningLaneRecord, {
-        readonly laneKind: 'owner_passkey' | 'owner_email_otp';
-    }>;
-    readonly materialActivation: MpcMaterialActivationRef;
-    readonly verifiedActivationReceiptDigestB64u: DigestB64u;
-};
+export type ActiveOwnerWalletExecutionLaneProjection = OwnerWalletExecutionLaneProjectionV1;
 type WalletExecutionLaneProjectionRefusalReason = 'auth_method_missing' | 'auth_method_ambiguous' | 'auth_method_inactive' | 'auth_method_mismatch' | 'signer_missing' | 'signer_ambiguous' | 'signer_conflict' | 'signer_invalid';
 export type WalletExecutionLaneProjectionResult = {
     readonly kind: 'projected';

package/dist/types/wallet-server/src/core/signingLanes/signingWorkerLaneMaterialIdentity.d.ts

@@ -1,21 +1,4 @@
-import type { LaneEnrollmentId, LaneOperationId, LaneShareEpoch, SigningLaneId, WalletKeyId } from '../../../../shared-ts/src/signing-lanes';
-import type { DigestB64u } from '../../../../shared-ts/src/utils/canonicalPrimitives';
-import type { MpcMaterialActivationId, WalletId } from '../../../../shared-ts/src/utils/domainIds';
-export type SigningWorkerLaneMaterialIdentityV1<TKeyFamily extends 'ed25519' | 'ecdsa_secp256k1' = 'ed25519' | 'ecdsa_secp256k1'> = {
-    readonly operationId: LaneOperationId;
-    readonly enrollmentId: LaneEnrollmentId;
-    readonly walletId: WalletId;
-    readonly walletKeyId: WalletKeyId;
-    readonly targetLaneId: SigningLaneId;
-    readonly targetLaneShareEpoch: LaneShareEpoch;
-    readonly targetMaterialActivationId: MpcMaterialActivationId;
-    readonly keyFamily: TKeyFamily;
-    readonly holderParticipantBindingDigestB64u: DigestB64u;
-    readonly signingWorkerParticipantBindingDigestB64u: DigestB64u;
-    readonly holderRecipientKeyDigestB64u: DigestB64u;
-    readonly serverRecipientKeyDigestB64u: DigestB64u;
-    readonly transcriptHashB64u: DigestB64u;
-    readonly protocolCommitReceiptDigestB64u: DigestB64u;
-};
+import type { SigningWorkerLaneMaterialIdentityV1 as SharedSigningWorkerLaneMaterialIdentityV1 } from '../../../../shared-ts/src/signing-lanes';
+export type SigningWorkerLaneMaterialIdentityV1<TKeyFamily extends 'ed25519' | 'ecdsa_secp256k1' = 'ed25519' | 'ecdsa_secp256k1'> = Readonly<SharedSigningWorkerLaneMaterialIdentityV1<TKeyFamily>>;
 export type EcdsaSigningWorkerLaneMaterialIdentityV1 = SigningWorkerLaneMaterialIdentityV1<'ecdsa_secp256k1'>;
 //# sourceMappingURL=signingWorkerLaneMaterialIdentity.d.ts.map

package/dist/types/wallet-server/src/core/thresholdEcdsaChainTarget.d.ts

@@ -1,14 +1,6 @@
-export type ThresholdEcdsaChainTarget = {
-    kind: 'evm';
-    namespace: 'eip155';
-    chainId: number;
-    networkSlug?: string;
-} | {
-    kind: 'tempo';
-    chainId: number;
-    networkSlug?: string;
-};
+import { thresholdEcdsaChainTargetKey, type ThresholdEcdsaChainTargetWire } from '../../../shared-ts/src/utils/thresholdEcdsaChainTarget';
+export { thresholdEcdsaChainTargetKey };
+export type ThresholdEcdsaChainTarget = ThresholdEcdsaChainTargetWire;
 export declare function thresholdEcdsaChainTargetFromValue(value: unknown): ThresholdEcdsaChainTarget | null;
-export declare function thresholdEcdsaChainTargetKey(target: ThresholdEcdsaChainTarget): string;
 export declare function thresholdEcdsaChainTargetsEqual(left: ThresholdEcdsaChainTarget, right: ThresholdEcdsaChainTarget): boolean;
 //# sourceMappingURL=thresholdEcdsaChainTarget.d.ts.map

package/dist/types/wallet-server/src/core/types.d.ts

@@ -3,7 +3,7 @@ import type { InitInput } from '../../../../wasm/near_signer/pkg/wasm_signer_wor
 import type { Logger } from './logger';
 import type { Ed25519AuthorityScope } from '../../../shared-ts/src/threshold/sessionPolicy';
 import type { RuntimePolicyScope } from '../../../shared-ts/src/threshold/signingRootScope';
-import type { EcdsaClientRootPublicKey33B64u, DerivationClientSharePublicKey33B64u, EcdsaDerivationRelayerPublicKey33B64u } from '../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap';
+import type { EcdsaClientRootPublicKey33B64u, DerivationClientSharePublicKey33B64u, EcdsaDerivationRoleLocalPublicIdentity } from '../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap';
 import type { RouterAbEd25519NormalSigningState } from '../../../shared-ts/src/utils/signingSessionSeal';
 import type { RouterAbEcdsaDerivationNormalSigningScopeV1, RouterAbEcdsaDerivationNormalSigningStateV1 } from '../../../shared-ts/src/utils/routerAbEcdsaDerivation';
 import type { WalletAuthAuthority } from '../../../shared-ts/src/utils/walletAuthAuthority';
@@ -544,11 +544,7 @@ export type EcdsaDerivationRouteResult<T> = {
 };
 export type EcdsaDerivationRoleLocalFormatVersion = 'ecdsa-derivation-role-local';
 export type EcdsaDerivationKeyScope = 'evm-family';
-export interface EcdsaDerivationPublicIdentity {
-    derivationClientSharePublicKey33B64u: DerivationClientSharePublicKey33B64u;
-    relayerPublicKey33B64u: EcdsaDerivationRelayerPublicKey33B64u;
-    groupPublicKey33B64u: string;
-    ethereumAddress: string;
+export interface EcdsaDerivationPublicIdentity extends EcdsaDerivationRoleLocalPublicIdentity {
 }
 export interface EcdsaDerivationClientRootProof {
     version: 'ecdsa-derivation:role-local:first-bootstrap-root-proof:v2';

package/dist/types/wallet-server/src/localIntendedMaterialAdmissionFault.d.ts

@@ -0,0 +1,38 @@
+import type { D1DatabaseLike, D1PreparedStatementLike, D1ResultLike } from './storage/tenantRoute';
+type Mode = 'canonical_claim' | 'canonical_existing' | 'linked_claim' | 'linked_existing';
+type Role = 'material' | 'claim' | 'existing';
+type LocalMaterialAdmissionFault = {
+    readonly database: LocalMaterialAdmissionFaultDatabase;
+    readonly request: Request;
+    readonly token: string;
+};
+export declare function localMaterialAdmissionFault(request: Request, database: D1DatabaseLike): LocalMaterialAdmissionFault | Response | null;
+/** Retire material after resolution and before one admission statement, then restore it. */
+declare class LocalMaterialAdmissionFaultDatabase implements D1DatabaseLike {
+    private readonly base;
+    private readonly mode;
+    private scope;
+    private state;
+    constructor(base: D1DatabaseLike, mode: Mode);
+    prepare(query: string): D1PreparedStatementLike;
+    captureScope(values: readonly unknown[]): void;
+    batch<T = unknown>(statements: readonly D1PreparedStatementLike[]): Promise<readonly T[]>;
+    exec(query: string): Promise<unknown>;
+    first<T>(statement: FaultStatement, columnName: string | undefined): Promise<T | null>;
+    private shouldRetire;
+    private execute;
+    response(response: Response, token: string): Response;
+    private target;
+}
+declare class FaultStatement implements D1PreparedStatementLike {
+    private readonly database;
+    readonly inner: D1PreparedStatementLike;
+    readonly role: Role;
+    constructor(database: LocalMaterialAdmissionFaultDatabase, inner: D1PreparedStatementLike, role: Role);
+    bind(...values: readonly unknown[]): D1PreparedStatementLike;
+    first<T = unknown>(columnName?: string): Promise<T | null>;
+    all<T = unknown>(): Promise<D1ResultLike<T>>;
+    run<T = unknown>(): Promise<D1ResultLike<T>>;
+}
+export {};
+//# sourceMappingURL=localIntendedMaterialAdmissionFault.d.ts.map

package/dist/types/wallet-server/src/localIntendedPresignCancellation.d.ts

@@ -0,0 +1,4 @@
+import { type CloudflareD1GatewayEnv, type HostedWalletGatewayDependenciesV1 } from './hosted-wallet-gateway';
+import type { CfExecutionContext } from './router/cloudflare/runtime/cloudflare.types';
+export declare function localPresignCancellationProbe(request: Request, env: CloudflareD1GatewayEnv, ctx: CfExecutionContext, dependencies: HostedWalletGatewayDependenciesV1 | undefined): Promise<Response | null>;
+//# sourceMappingURL=localIntendedPresignCancellation.d.ts.map

package/dist/types/wallet-server/src/router/auth/authRequestValidation.d.ts

@@ -15,7 +15,7 @@ type PasskeyLoginOptionsRequest = {
     rp_id: string;
     ttl_ms?: number;
 };
-type PasskeyLoginVerifyRequest = {
+export type PasskeyVerifyRequest = {
     challengeId: string;
     webauthn_authentication: WebAuthnAuthenticationCredential;
     expected_origin: string;
@@ -34,19 +34,14 @@ type GoogleLoginVerifyRequest = {
      */
     restartRegistrationOffer: boolean;
 };
-export type AuthPasskeyStepUpRequest = {
-    challengeId: string;
-    webauthn_authentication: WebAuthnAuthenticationCredential;
-    expected_origin: string;
-};
 type AuthLinkIdentityRequest = {
     provider: 'google';
     idToken: string;
-    stepUp: AuthPasskeyStepUpRequest;
+    stepUp: PasskeyVerifyRequest;
 };
 type AuthUnlinkIdentityRequest = {
     subject: string;
-    stepUp: AuthPasskeyStepUpRequest;
+    stepUp: PasskeyVerifyRequest;
 };
 type AuthIdentityMutationRequest = {
     kind: 'link';
@@ -75,7 +70,7 @@ export declare function parsePasskeyLoginOptionsRequest(raw: unknown): AuthRoute
 export declare function parsePasskeyLoginVerifyRequest(input: {
     body: unknown;
     origin: unknown;
-}): AuthRouteParseResult<PasskeyLoginVerifyRequest>;
+}): AuthRouteParseResult<PasskeyVerifyRequest>;
 export declare function parseGoogleLoginVerifyRequest(raw: unknown): AuthRouteParseResult<GoogleLoginVerifyRequest>;
 export declare function parseAuthIdentityMutationRequest(input: {
     pathname: unknown;

package/dist/types/wallet-server/src/router/auth/commonRouterUtils.d.ts

@@ -1,6 +1,8 @@
+import type { D1EcdsaAdmissionPolicyRead } from '../cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore';
+import type { EcdsaMaterialRead } from '../../core/d1EcdsaSignerRead';
 import type { ThresholdRuntimePolicyScope } from '../../core/types';
 import type { RouterApiAuthorizationSessionService } from '../framework/authServicePort';
-import type { RouterApiWalletSessionAuthorizationV2AdmissionContext, RouterApiWalletSessionExactOperationContext } from '../framework/authServicePort';
+import type { RouterApiWalletSessionAuthorizationV2AdmissionContext, RouterApiWalletSessionExactOperationContext, RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext } from '../framework/authServicePort';
 import type { RouterApiProjectEnvironmentResolver, RouterApiPublishableKeyAuthAdapter } from '../framework/routerApi';
 import { type WalletSessionFailureCode } from './walletSessionFailure';
 import { type WalletSessionAuthorizationV2AdministrationAdmissionResult, type WalletSessionAuthorizationV2AdministrationOperation, type WalletSessionAuthorizationV2AdmissionResult, type WalletSessionAuthorizationV2RequestedOperation } from '../domains/signingOperations/walletExecutionAdmission';
@@ -93,11 +95,22 @@ export declare function validateRouterAbEd25519WalletSessionInputs(input: {
 }): Promise<ThresholdEd25519SessionInputs>;
 export type ThresholdEcdsaSessionInputs = {
     readonly ok: true;
+    readonly materialRead: EcdsaMaterialRead;
+    readonly policyRead: D1EcdsaAdmissionPolicyRead;
     readonly kind: 'wallet_session_operation_credential_v1';
     readonly admission: Extract<WalletSessionOperationCredentialAdmission, {
         readonly curve: 'ecdsa';
     }>;
     readonly context: RouterApiWalletSessionAuthorizationV2AdmissionContext;
+    readonly candidate?: never;
+} | {
+    readonly ok: true;
+    readonly materialRead: EcdsaMaterialRead;
+    readonly policyRead: D1EcdsaAdmissionPolicyRead;
+    readonly kind: 'wallet_session_operation_credential_exhausted_candidate_v1';
+    readonly candidate: RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext;
+    readonly admission?: never;
+    readonly context?: never;
 } | AuthorizeErr;
 export declare function validateEcdsaPreprocessingSession(input: {
     readonly headers: Record<string, string | string[] | undefined>;
@@ -117,6 +130,7 @@ export declare function validateEcdsaPreprocessingSession(input: {
     }>['materialActivation'];
 }>;
 export declare function validateRouterAbEcdsaDerivationWalletSessionInputs(input: {
+    materialActivation: import('../../../../shared-ts/src/utils/routerAbNormalSigningIdentity').RouterAbMpcMaterialActivationRefWire;
     headers: Record<string, string | string[] | undefined>;
     authorizationSessions: RouterApiAuthorizationSessionService | null | undefined;
     nowMs?: () => number;

package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1RouterApiAuthBoundary.d.ts

@@ -23,7 +23,6 @@ type D1MutationResultLike = {
 };
 export declare function parseD1NonNegativeCount(input: unknown): number;
 export declare function d1MutationChanges(result: D1MutationResultLike): number;
-export declare function toArrayBufferCopy(bytes: Uint8Array): ArrayBuffer;
 export declare function sha256BytesPortable(input: Uint8Array): Promise<Uint8Array>;
 export {};
 //# sourceMappingURL=d1RouterApiAuthBoundary.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1RouterApiAuthService.d.ts

@@ -8,6 +8,6 @@ export type CloudflareD1RouterApiAuthService = Omit<RouterApiServiceBag, 'thresh
     readonly executeSignedDelegate: (input: ExecuteSignedDelegateRequest) => Promise<ExecuteSignedDelegateResult>;
     readonly linkedDeviceEd25519AuthorityReader?: LinkedDeviceEd25519AuthorityReader;
 };
-type LinkedDeviceEd25519AuthorityReader = Pick<D1LinkedDeviceAuthorityInstallServiceV1, 'readInstalledEd25519AuthorityByIdentityV1' | 'readInstalledEd25519AuthorityByMaterialActivationV1' | 'readInstalledEcdsaAuthorityByMaterialActivationV1' | 'readInstalledEcdsaAuthorityChainByMaterialActivationV1'>;
+type LinkedDeviceEd25519AuthorityReader = Pick<D1LinkedDeviceAuthorityInstallServiceV1, 'readInstalledEd25519AuthorityByIdentityV1' | 'readInstalledEd25519AuthorityByMaterialActivationV1' | 'readInstalledEcdsaAuthorityByMaterialActivationV1' | 'readInstalledEcdsaCustodySnapshotV1'>;
 export declare function createCloudflareD1RouterApiAuthService(input: CloudflareD1RouterApiAuthServiceOptions): CloudflareD1RouterApiAuthService;
 //# sourceMappingURL=d1RouterApiAuthService.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/auth/walletSessionCredentialReaders.d.ts

@@ -0,0 +1,9 @@
+import type { AuthorizationService } from '../../../../authorization/service';
+import type { RouterApiWalletSessionAuthorizationV2AdmissionContext, RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext, RouterApiWalletSessionSigningCandidate } from '../../../framework/authServicePort';
+type CredentialInput = Parameters<AuthorizationService['readWalletSessionAdmissionSnapshotByOperationCredential']>[0];
+type AdmissionSnapshotReader = Pick<AuthorizationService, 'readWalletSessionAdmissionSnapshotByOperationCredential'>;
+export declare function readActiveWalletSessionCredential(service: AdmissionSnapshotReader, input: CredentialInput): Promise<RouterApiWalletSessionAuthorizationV2AdmissionContext | null>;
+export declare function readWalletSessionSigningCandidate(service: Pick<AuthorizationService, 'readEcdsaWalletSessionAdmissionSnapshotByOperationCredential'>, input: Parameters<AuthorizationService['readEcdsaWalletSessionAdmissionSnapshotByOperationCredential']>[0]): Promise<RouterApiWalletSessionSigningCandidate | null>;
+export declare function readExhaustedWalletSessionCredential(service: Pick<AuthorizationService, 'readExactWalletSessionStatusSnapshotByOperationCredential'>, input: CredentialInput): Promise<RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext | null>;
+export {};
+//# sourceMappingURL=walletSessionCredentialReaders.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/authorization/authorizedOperationStatements.d.ts

@@ -1,3 +1,4 @@
+import type { EcdsaMaterialReadSnapshot } from '../../../../core/ecdsaMaterialReadSnapshot';
 import type { AuthorizedOperation } from '../../../../authorization/domain';
 import type { AuthorizedOperationMaterialScope } from '../../../../authorization/service';
 import type { D1WalletStoreScope } from '../../../../core/d1WalletStore';
@@ -19,6 +20,7 @@ export declare function prepareAuthorizedOperationAdmissionRead(input: {
     readonly tenantId: TenantId;
     readonly operationFingerprintDigest: CapabilityOperationFingerprintDigest;
     readonly nowMs: number;
+    readonly materialSnapshot: EcdsaMaterialReadSnapshot | null;
 }): D1PreparedStatementLike;
 export declare function prepareAuthorizedOperationInsert(input: {
     readonly database: D1DatabaseLike;
@@ -26,5 +28,7 @@ export declare function prepareAuthorizedOperationInsert(input: {
     readonly walletSignerScope: D1WalletStoreScope;
     readonly operation: AuthorizedOperation;
     readonly material: AuthorizedOperationMaterialScope | null;
+    readonly materialSnapshot: EcdsaMaterialReadSnapshot | null;
+    readonly existingOperation: 'reject' | 'preserve';
 }): D1PreparedStatementLike;
 //# sourceMappingURL=authorizedOperationStatements.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/authorization/d1AuthorizationStore.d.ts

@@ -1,4 +1,6 @@
-import type { EcdsaWalletSessionAdmissionInput, EcdsaWalletSessionAdmissionResult, PinnedOwnerWalletScope } from '../../../../authorization/ecdsaWalletSessionAdmission';
+import type { EcdsaWalletSessionAdmissionRead } from '../../../../authorization/service';
+import type { RouterAbMpcMaterialActivationRefWire } from '../../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
+import type { EcdsaWalletSessionAdmissionInput, EcdsaWalletSessionAdmissionResult, EcdsaWalletSessionResolutionResult, PinnedOwnerWalletScope } from '../../../../authorization/ecdsaWalletSessionAdmission';
 import { type MpcMaterialActivationRef, type WalletAuthorityId, type WalletAuthMethodId, type WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
 import { type AuthorizedOperationId, type TenantId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
 import type { AuthorizedOperation, AuthorizedOperationInput, IssuedWalletSessionAuthorizationV2, LiveWalletSessionAuthorizationProjectionV2, WalletSessionAuthorizationV2, ActiveWalletSessionQuota, PersistedActiveWalletSessionAuthorizationV2, DirectV2CommitResult, WalletSessionAuthorizationV2MintLookup, WalletSessionAuthorizationV2MintRead, AuthorizedOperationReplayResponse, CompletedCapabilityOperationResult, IssuedHostedWalletSeamsSessionExchangeV2, RedeemHostedWalletSeamsSessionExchangeV2Input, PersistedHostedWalletSeamsSessionExchangeV2Result, ExactWalletSessionQuotaProjectionV1, ExactWalletSessionStatusV2, ExactWalletSessionStatusSnapshotV2, WalletSessionAdmissionSnapshotV2, WalletSessionExactOperationContext, ResolvedHostedWalletSessionOperationCredentialV2, VerifiedAuthorizationEvidenceSet, VerifiedOwnerProof } from '../../../../authorization/domain';
@@ -134,6 +136,12 @@ export declare class CloudflareD1AuthorizationStore implements AuthorizationSess
         readonly tokenHash: import('../../../../../../shared-ts/src/utils/canonicalPrimitives').DigestB64u;
         readonly nowMs: number;
     }): Promise<WalletSessionAdmissionSnapshotV2 | null>;
+    readEcdsaWalletSessionAdmissionSnapshotByOperationCredential(input: {
+        readonly tenantId: WalletSessionAuthorizationV2['tenantId'];
+        readonly tokenHash: import('../../../../../../shared-ts/src/utils/canonicalPrimitives').DigestB64u;
+        readonly nowMs: number;
+        readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
+    }): Promise<EcdsaWalletSessionAdmissionRead | null>;
     readWalletSessionExactOperationContextByCredential(input: {
         readonly tenantId: WalletSessionAuthorizationV2['tenantId'];
         readonly tokenHash: import('../../../../../../shared-ts/src/utils/canonicalPrimitives').DigestB64u;
@@ -194,6 +202,7 @@ export declare class CloudflareD1AuthorizationStore implements AuthorizationSess
         readonly operation: AuthorizedOperationInput;
         readonly material?: AuthorizedOperationMaterialScope;
     }): Promise<AuthorizedOperationAdmissionResult>;
+    resolveEcdsaWalletSessionOperation(input: EcdsaWalletSessionAdmissionInput): Promise<EcdsaWalletSessionResolutionResult>;
     admitEcdsaWalletSessionOperation(input: EcdsaWalletSessionAdmissionInput): Promise<EcdsaWalletSessionAdmissionResult>;
     private admitAuthorizedOperationRecord;
     completeAuthorizedOperation(input: {

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService.d.ts

@@ -1,3 +1,6 @@
+import { EcdsaMaterialReadSnapshot } from '../../../../core/ecdsaMaterialReadSnapshot';
+import { type EcdsaMaterialReadSource } from '../../../../core/d1EcdsaSignerRead';
+import type { WalletEcdsaSignerRecord } from '../../../../core/WalletStore';
 import type { ActiveWalletAuthorityV1 } from '../../../../../../shared-ts/src/authorization/walletAuthority';
 import { type LinkDeviceSessionId, type MpcMaterialActivationRef, type WalletAuthMethodId, type WalletAuthorityId, type WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
 import { type DeviceId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
@@ -20,6 +23,11 @@ import type { AuthorizationService } from '../../../../authorization/service';
 import { type PersistedActiveWalletSessionAuthorizationV2, type IssuedWalletSessionAuthorizationV2 } from '../../../../authorization/domain';
 import { type DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
 import type { CloudflareD1EmailOtpRegistrationEnrollmentFinalizer } from '../emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer';
+export type InstalledEcdsaCustodySnapshotV1 = {
+    readonly readSnapshot: EcdsaMaterialReadSnapshot;
+    readonly chain: readonly InstalledLinkedDeviceEcdsaAuthorityProjectionV1[];
+    readonly signers: readonly WalletEcdsaSignerRecord[];
+};
 type ExactSigner = ExactAdministeredSignerV1;
 type ListWalletEd25519SignersV1 = (walletId: WalletId) => Promise<readonly WalletEd25519SignerRecord[]>;
 type WorkerOrdinarySignerMaterialReservationPreparationV1 = {
@@ -226,10 +234,11 @@ export declare class D1LinkedDeviceAuthorityInstallServiceV1 {
         readonly walletId: WalletId;
         readonly materialActivation: MpcMaterialActivationRef;
     }): Promise<InstalledLinkedDeviceEcdsaAuthorityProjectionV1 | null>;
-    readInstalledEcdsaAuthorityChainByMaterialActivationV1(input: {
+    readInstalledEcdsaCustodySnapshotV1(input: {
+        readonly source: EcdsaMaterialReadSource;
         readonly walletId: WalletId;
         readonly materialActivation: MpcMaterialActivationRef;
-    }): Promise<readonly InstalledLinkedDeviceEcdsaAuthorityProjectionV1[]>;
+    }): Promise<InstalledEcdsaCustodySnapshotV1 | null>;
     private readVerifiedEcdsaInstallations;
     readActivationCleanupReceiptV1(input: {
         readonly linkSessionId: LinkDeviceSessionId;
@@ -264,7 +273,15 @@ export declare class D1LinkedDeviceAuthorityInstallServiceV1 {
     private readInstallation;
     private readInstallationByAuthority;
     private readInstallationsByWallet;
+    private prepareInstallationsByWalletRead;
 }
+export declare function parseInstalledEcdsaCustodySnapshotV1(input: {
+    readonly scope: D1LinkedDeviceAuthorityInstallServiceOptionsV1['scope'];
+    readonly walletId: WalletId;
+    readonly materialActivation: MpcMaterialActivationRef;
+    readonly installations: unknown;
+    readonly signers: unknown;
+}): Promise<InstalledEcdsaCustodySnapshotV1 | null>;
 /**
  * The installed Ed25519 authority of a linked device, read from Gateway SQL
  * alone: a linked device approving another link names its own binding as the

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionStore.d.ts

@@ -5,12 +5,8 @@ import { type LinkedDeviceSessionMutationResultV1, type LinkedDeviceSessionRecor
 import { type LinkDeviceSessionId } from '../../../../../../shared-ts/src/signing-lanes/ids';
 import type { DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
 import type { WalletAuthorityId, WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
-export type D1LinkedDeviceSessionScopeV1 = {
-    readonly namespace: string;
-    readonly orgId: string;
-    readonly projectId: string;
-    readonly envId: string;
-};
+import type { D1TenantScope } from '../../../../core/d1TenantStore';
+export type D1LinkedDeviceSessionScopeV1 = D1TenantScope;
 export type D1LinkedDeviceSessionStoreOptionsV1 = {
     readonly database: D1DatabaseLike;
     readonly scope: D1LinkedDeviceSessionScopeV1;

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetCredentialProvider.d.ts

@@ -6,6 +6,7 @@ import type { LinkedDeviceSessionRecordV1 } from '../../../../core/deviceLinking
 import type { DeviceLinkingTargetCredentialProviderV1, LinkedDeviceTargetPreparationResultV1 } from '../../../../router/transport/fetch/routes/deviceLinking';
 import { type D1LinkedDeviceSessionScopeV1 } from './d1LinkedDeviceSessionStore';
 import { type VerifiedLinkSourceReadV1, type VerifiedLinkSourceReaderV1 } from './d1LinkedDeviceVerifiedLinkBuilder';
+import type { ReadonlyExclusiveUnion } from '../../../../../../shared-ts/src/utils/variant';
 export type VerifiedLinkedDeviceWebAuthnCredentialV1 = {
     readonly credentialIdB64u: string;
     readonly credentialPublicKeyB64u: string;
@@ -36,15 +37,13 @@ export type VerifiedLinkedDeviceEmailOtpGrantV1 = (VerifiedLinkedDeviceEmailOtpG
  * per target factor. A Passkey commit cannot carry a grant and an Email OTP
  * commit cannot carry WebAuthn material.
  */
-export type VerifiedLinkedDeviceTargetFactorEvidenceV1 = {
+export type VerifiedLinkedDeviceTargetFactorEvidenceV1 = ReadonlyExclusiveUnion<{
     readonly kind: 'passkey_prf';
     readonly credential: VerifiedLinkedDeviceWebAuthnCredentialV1;
-    readonly grant?: never;
 } | {
     readonly kind: 'email_otp';
     readonly grant: VerifiedLinkedDeviceEmailOtpGrantV1;
-    readonly credential?: never;
-};
+}>;
 /**
  * The complete registered-target replay record. It is kept as one payload so
  * a retry can finish the session CAS without rereading mutable source state.
@@ -171,15 +170,13 @@ export declare class D1LinkedDeviceTargetCredentialProviderV1 implements DeviceL
         readonly session: LinkedDeviceSessionRecordV1;
         readonly approval: LinkedDeviceApprovalV1;
         readonly requestedAtMs: number;
-    } & ({
+    } & ReadonlyExclusiveUnion<{
         readonly access: 'create_or_replay';
         readonly expectedOrigin: string;
         readonly deliveryRecipientPublicKey65B64u: string;
     } | {
         readonly access: 'replay_only';
-        readonly expectedOrigin?: never;
-        readonly deliveryRecipientPublicKey65B64u?: never;
-    })): Promise<LinkedDeviceTargetPreparationResultV1>;
+    }>): Promise<LinkedDeviceTargetPreparationResultV1>;
     registerTargetCredentialV1(input: {
         readonly registration: LinkedDeviceTargetCredentialRegistrationV1;
         readonly preparation: LinkedDeviceTargetPreparationV1;

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpEnrollmentStore.d.ts

@@ -1,15 +1,9 @@
 import type { EmailOtpAuthStateRecord, EmailOtpWalletEnrollmentRecord } from '../../../../core/EmailOtpStores';
 import { type ScopedD1Prepare } from '../../../../core/emailOtpD1Statements';
 import type { D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import type { EmailOtpAuthStateReadResult as CoreEmailOtpAuthStateReadResult } from '../../../../core/authService/emailOtpEnrollment';
 import { type EmailOtpAuthStatePatch } from './d1EmailOtpRecords';
-export type EmailOtpAuthStateReadResult = {
-    readonly ok: true;
-    readonly state: EmailOtpAuthStateRecord | null;
-} | {
-    readonly ok: false;
-    readonly code: string;
-    readonly message: string;
-};
+export type EmailOtpAuthStateReadResult = Readonly<CoreEmailOtpAuthStateReadResult>;
 export declare class CloudflareD1EmailOtpEnrollmentStore {
     private readonly prepare;
     constructor(input: {

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpRateLimitStore.d.ts

@@ -1,4 +1,5 @@
 import type { ScopedD1Prepare } from '../../../../core/emailOtpD1Statements';
+import type { RateLimitResult } from '../../../../core/authService/rateLimits';
 import type { EmailOtpRateLimitPolicy } from '../auth/d1RouterApiAuthConfig';
 import { type EmailOtpRateLimitScope } from './d1EmailOtpRecords';
 type EmailOtpRateLimitPolicies = {
@@ -13,15 +14,7 @@ type EmailOtpRateLimitConsumeInput = {
     readonly orgId?: string;
     readonly clientIp?: string;
 };
-type EmailOtpRateLimitConsumeResult = {
-    readonly ok: true;
-} | {
-    readonly ok: false;
-    readonly code: 'rate_limited';
-    readonly message: string;
-    readonly retryAfterMs?: number;
-    readonly resetAtMs?: number;
-};
+type EmailOtpRateLimitConsumeResult = Readonly<RateLimitResult>;
 export declare class CloudflareD1EmailOtpRateLimitStore {
     private readonly prepare;
     private readonly rateLimits;

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpRecords.d.ts

@@ -1,7 +1,8 @@
-import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS } from '../../../../../../shared-ts/src/utils/emailOtpDomain';
-import type { EmailOtpAuthStateRecord, EmailOtpChallengeOperation, EmailOtpChallengeRecord, EmailOtpGrantAction, EmailOtpGrantRecord, EmailOtpLoginChallengeOperation, EmailOtpUnlockChallengeRecord, EmailOtpWalletEnrollmentRecord } from '../../../../core/EmailOtpStores';
-export type EmailOtpChallengeIssueAction = typeof WALLET_EMAIL_OTP_ACTIONS.login | typeof WALLET_EMAIL_OTP_ACTIONS.registration | typeof WALLET_EMAIL_OTP_ACTIONS.recoveryBootstrap | typeof WALLET_EMAIL_OTP_ACTIONS.deviceLink;
-export type EmailOtpRateLimitScope = 'challenge' | 'verify' | 'grant' | 'googleRegistrationAttempt';
+import { EMAIL_OTP_CHANNEL } from '../../../../../../shared-ts/src/utils/emailOtpDomain';
+import type { EmailOtpAuthStateRecord, EmailOtpChallengeAction, EmailOtpChallengeOperation, EmailOtpChallengeRecord, EmailOtpGrantAction, EmailOtpGrantRecord, EmailOtpLoginChallengeOperation, EmailOtpUnlockChallengeRecord, EmailOtpWalletEnrollmentRecord } from '../../../../core/EmailOtpStores';
+import type { EmailOtpRateLimitScope } from '../../../../core/authService/emailOtpConfig';
+export type EmailOtpChallengeIssueAction = EmailOtpChallengeAction;
+export type { EmailOtpRateLimitScope };
 export type EmailOtpAuthStatePatch = {
     readonly otpFailureCount?: number | null;
     readonly lastOtpFailureAtMs?: number | null;
@@ -183,5 +184,4 @@ export declare function emailOtpChallengePurposeIsValid(input: {
     readonly action: EmailOtpChallengeIssueAction;
     readonly operation: EmailOtpChallengeOperation;
 }): boolean;
-export {};
 //# sourceMappingURL=d1EmailOtpRecords.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpServerSealRuntime.d.ts

@@ -1,22 +1,12 @@
 import type { EmailOtpServerSealRuntimeConfig } from '../auth/d1RouterApiAuthConfig';
-type EmailOtpServerSealInput = {
-    readonly wrappedCiphertext?: unknown;
-};
-type EmailOtpServerSealResult = {
-    readonly ok: true;
-    readonly ciphertext: string;
-    readonly enrollmentSealKeyVersion: string;
-} | {
-    readonly ok: false;
-    readonly code: string;
-    readonly message: string;
-};
+import type { EmailOtpServerSealRequest, EmailOtpServerSealResult as CoreEmailOtpServerSealResult } from '../../../../core/authService/emailOtpSeal';
+type EmailOtpServerSealResult = Readonly<CoreEmailOtpServerSealResult>;
 export declare class CloudflareD1EmailOtpServerSealRuntime {
     private readonly config;
     private readonly cipherResult;
     constructor(config: EmailOtpServerSealRuntimeConfig);
-    removeEmailOtpServerSeal(input: EmailOtpServerSealInput): Promise<EmailOtpServerSealResult>;
-    applyEmailOtpServerSeal(input: EmailOtpServerSealInput): Promise<EmailOtpServerSealResult>;
+    removeEmailOtpServerSeal(input: EmailOtpServerSealRequest): Promise<EmailOtpServerSealResult>;
+    applyEmailOtpServerSeal(input: EmailOtpServerSealRequest): Promise<EmailOtpServerSealResult>;
     private runServerSealOperation;
     private createCipher;
 }

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore.d.ts

@@ -1,10 +1,6 @@
 import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
-export type D1RegistrationCeremonyRecordScope = {
-    readonly namespace: string;
-    readonly orgId: string;
-    readonly projectId: string;
-    readonly envId: string;
-};
+import type { D1TenantScope } from '../../../../core/d1TenantStore';
+export type D1RegistrationCeremonyRecordScope = D1TenantScope;
 type D1RegistrationCeremonyRecordStoreOptions = {
     readonly database: D1DatabaseLike;
     readonly scope: D1RegistrationCeremonyRecordScope;

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationService.d.ts

@@ -1,3 +1,6 @@
+import type { EcdsaMaterialActivationReadInput } from '../../../../core/d1EcdsaSignerRead';
+import type { EcdsaMaterialReadSnapshot } from '../../../../core/ecdsaMaterialReadSnapshot';
+import type { InstalledEcdsaCustodySnapshotV1 } from '../deviceLinking/d1LinkedDeviceAuthorityInstallService';
 import type { VerifiedNearRegistrationContinuationV1 } from '../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationIntentAuthorization';
 import { type DeviceId, type TenantId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
 import type { AuthorizationService } from '../../../../authorization/service';
@@ -55,10 +58,11 @@ type D1LinkedDeviceEd25519AuthorityReaderV1 = {
         readonly authorityId: WalletAuthorityId;
         readonly walletAuthMethodId: WalletAuthMethodId;
     }) => Promise<InstalledLinkedDeviceEcdsaAuthorityProjectionV1 | null>;
-    readInstalledEcdsaAuthorityChainByMaterialActivationV1(input: {
+    readInstalledEcdsaCustodySnapshotV1(input: {
+        readonly source: EcdsaMaterialActivationReadInput['source'];
         readonly walletId: WalletId;
         readonly materialActivation: MpcMaterialActivationRef;
-    }): Promise<readonly InstalledLinkedDeviceEcdsaAuthorityProjectionV1[]>;
+    }): Promise<InstalledEcdsaCustodySnapshotV1 | null>;
 };
 export type D1WalletRegistrationOperationPreparedV1 = {
     readonly kind: 'd1_wallet_registration_operation_prepared_v1';
@@ -176,11 +180,9 @@ export declare class CloudflareD1WalletRegistrationService {
         readonly code: 'not_found' | 'internal';
         readonly message: string;
     }>;
-    resolveEcdsaMaterialActivation(input: {
-        readonly walletId: string;
-        readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
-    }): Promise<{
+    resolveEcdsaMaterialActivation(input: EcdsaMaterialActivationReadInput): Promise<{
         readonly ok: true;
+        readonly readSnapshot: EcdsaMaterialReadSnapshot;
         readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
         readonly keyHandle: string;
         readonly relayerKeyId: string;

package/dist/types/wallet-server/src/router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.d.ts

@@ -1,4 +1,4 @@
-import type { RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
+import { type RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
 import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
 import type { RouterAbNormalSigningAdmissionInput } from '../../../domains/signingOperations/routerAbNormalSigningAdmission';
 import type { RouterAbNormalSigningAbuseDecision, RouterAbNormalSigningAdmissionStore, RouterAbNormalSigningProjectPolicyDecision, RouterAbNormalSigningPolicyDecision } from '../../../domains/signingOperations/routerAbNormalSigningAdmissionCore';
@@ -21,4 +21,17 @@ export declare class CloudflareD1RouterAbNormalSigningAdmissionStore implements
     private deleteRecord;
 }
 export declare function createCloudflareD1RouterAbNormalSigningAdmissionStore(options: CloudflareD1RouterAbNormalSigningAdmissionStoreOptions): CloudflareD1RouterAbNormalSigningAdmissionStore;
+export declare class D1EcdsaAdmissionPolicyRead {
+    #private;
+    private readonly database;
+    private readonly namespace;
+    private readonly walletId;
+    private readonly activationId;
+    private constructor();
+    static fromRows(database: D1DatabaseLike, namespace: string, walletId: string, activationId: string, rows: unknown): D1EcdsaAdmissionPolicyRead;
+    resolve(database: D1DatabaseLike, namespace: string, input: RouterAbNormalSigningAdmissionInput & {
+        readonly curve: 'ecdsa';
+    }): RouterAbNormalSigningPolicyDecision | null;
+}
+export declare const ECDSA_CREDENTIAL_POLICY_PROJECTION = "\n  (WITH candidates AS (\n     SELECT DISTINCT json_extract(signer.record_json, '$.runtimePolicyScope') AS scope_json\n       FROM wallet_signers AS signer\n      WHERE signer.namespace = session.namespace AND signer.org_id = session.org_id\n        AND signer.project_id = session.project_id AND signer.env_id = session.env_id\n        AND signer.wallet_id = session.wallet_id AND signer.signer_family = 'ecdsa'\n        AND json_valid(signer.record_json)\n   ), scopes AS (\n     SELECT scope_json,\n            json_extract(scope_json, '$.orgId') AS org_id,\n            json_extract(scope_json, '$.projectId') AS project_id,\n            json_extract(scope_json, '$.envId') AS env_id,\n            json_extract(scope_json, '$.signingRootVersion') AS signing_root_version,\n            json_extract(scope_json, '$.orgId') || char(31) ||\n            json_extract(scope_json, '$.projectId') || char(31) ||\n            json_extract(scope_json, '$.envId') || char(31) ||\n            json_extract(scope_json, '$.signingRootVersion') AS project_key\n       FROM candidates\n   )\n   SELECT json_group_array(json_object(\n     'scope_json', scopes.scope_json,\n     'project_key', project.record_key, 'project_decision', project.decision,\n     'project_retry_after_ms', project.retry_after_ms,\n     'abuse_key', abuse.record_key, 'abuse_decision', abuse.decision,\n     'abuse_retry_after_ms', abuse.retry_after_ms))\n     FROM scopes\n     LEFT JOIN router_ab_normal_signing_admission_records AS project\n       ON project.namespace = session.namespace AND project.org_id = scopes.org_id\n      AND project.project_id = scopes.project_id AND project.env_id = scopes.env_id\n      AND project.signing_root_version = scopes.signing_root_version\n      AND project.record_kind = 'project_policy' AND project.record_key = scopes.project_key\n     LEFT JOIN router_ab_normal_signing_admission_records AS abuse\n       ON abuse.namespace = session.namespace AND abuse.org_id = scopes.org_id\n      AND abuse.project_id = scopes.project_id AND abuse.env_id = scopes.env_id\n      AND abuse.signing_root_version = scopes.signing_root_version\n      AND abuse.record_kind = 'abuse'\n      AND abuse.record_key = scopes.project_key || char(31) || session.wallet_id || char(31) ||\n          'material_activation:' || ? || char(31) || 'ecdsa'\n  ) AS ecdsa_policy_records_json,";
 //# sourceMappingURL=d1RouterAbNormalSigningAdmissionStore.d.ts.map