@seams/wallet-server 0.7.1 → 0.7.3

package/dist/esm/core/d1EcdsaSignerRead.js

@@ -0,0 +1,76 @@
+import { isPlainObject } from "../shared-ts/src/utils/validation.js";
+import { sameRouterAbMpcMaterialActivationRef } from "../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { EcdsaMaterialReadSnapshot } from "./ecdsaMaterialReadSnapshot.js";
+import { parseD1JsonColumn } from "../storage/d1Sql.js";
+import { parseWalletEcdsaSignerRecord } from "./WalletStore.js";
+//#region src/core/d1EcdsaSignerRead.ts
+function prepareWalletEcdsaSignersRead(database, scope, walletId) {
+	return database.prepare(`SELECT record_json FROM wallet_signers
+      WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
+        AND wallet_id = ? AND signer_family = 'ecdsa'
+      ORDER BY signer_id`).bind(scope.namespace, scope.orgId, scope.projectId, scope.envId, walletId);
+}
+function parseWalletEcdsaSignerRows(rows, walletId) {
+	const signers = [];
+	for (const row of rows) {
+		const signer = parseWalletEcdsaSignerRecord(parseD1JsonColumn(row.record_json));
+		if (!signer || signer.walletId !== walletId) throw new Error("Wallet ECDSA signer record is invalid");
+		signers.push(signer);
+	}
+	return signers;
+}
+/** Parsed persistence evidence; material failures are surfaced after session validation. */
+var EcdsaMaterialRead = class EcdsaMaterialRead {
+	#result;
+	constructor(walletId, scope, activation, result, linkedSnapshot) {
+		this.walletId = walletId;
+		this.scope = scope;
+		this.activation = activation;
+		this.linkedSnapshot = linkedSnapshot;
+		this.#result = result;
+	}
+	static fromRows(scope, walletId, activation, rows, linkedSnapshot) {
+		try {
+			if (!Array.isArray(rows)) throw new Error("ECDSA material rows are invalid");
+			const storedRows = [];
+			const matches = [];
+			for (const raw of rows) {
+				if (!isPlainObject(raw) || typeof raw.record_json !== "string") throw new Error("ECDSA material row is invalid");
+				storedRows.push({ record_json: raw.record_json });
+				const signer = parseWalletEcdsaSignerRecord(parseD1JsonColumn(raw.record_json));
+				if (signer && signer.walletId === walletId && sameRouterAbMpcMaterialActivationRef(signer.walletKey.publicCapability.material_activation, activation)) matches.push(signer);
+			}
+			const signer = matches[0];
+			if (!signer) return new EcdsaMaterialRead(walletId, scope, activation, {
+				ok: true,
+				value: null
+			}, linkedSnapshot);
+			for (const other of matches) if (!signer.walletKey.keyHandle || other.walletKey.keyHandle !== signer.walletKey.keyHandle) throw new Error("Wallet has conflicting ECDSA material activations");
+			return new EcdsaMaterialRead(walletId, scope, activation, {
+				ok: true,
+				value: {
+					signer,
+					readSnapshot: EcdsaMaterialReadSnapshot.canonical(scope, walletId, activation.activation_id, storedRows)
+				}
+			}, linkedSnapshot);
+		} catch (error) {
+			return new EcdsaMaterialRead(walletId, scope, activation, {
+				ok: false,
+				message: error instanceof Error ? error.message : "ECDSA material read failed"
+			}, linkedSnapshot);
+		}
+	}
+	resolveLinked(scope, walletId, activation) {
+		this.resolve(scope, walletId, activation);
+		return this.linkedSnapshot;
+	}
+	resolve(scope, walletId, activation) {
+		if (walletId !== this.walletId || !sameRouterAbMpcMaterialActivationRef(activation, this.activation) || scope.namespace !== this.scope.namespace || scope.orgId !== this.scope.orgId || scope.projectId !== this.scope.projectId || scope.envId !== this.scope.envId) throw new Error("ECDSA material read scope does not match");
+		if (!this.#result.ok) throw new Error(this.#result.message);
+		return this.#result.value;
+	}
+};
+//#endregion
+export { EcdsaMaterialRead, parseWalletEcdsaSignerRows, prepareWalletEcdsaSignersRead };
+
+//# sourceMappingURL=d1EcdsaSignerRead.js.map

package/dist/esm/core/d1IdentityStore.js

@@ -1,5 +1,6 @@
 import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
 import "../shared-ts/src/utils/validation.js";
+import { failure } from "../shared-ts/src/utils/failure.js";
 import { d1ChangedRows } from "../storage/d1Sql.js";
 import { D1TenantTable, ensureD1Schema } from "./d1TenantStore.js";
 //#region src/core/d1IdentityStore.ts
@@ -112,16 +113,8 @@ var D1IdentityStore = class {
 		await this.table.ensureSchema();
 		const userId = normalizeOptionalTrimmedString(input.userId);
 		const subject = normalizeOptionalTrimmedString(input.subject);
-		if (!userId) return {
-			ok: false,
-			code: "invalid_args",
-			message: "Missing userId"
-		};
-		if (!subject) return {
-			ok: false,
-			code: "invalid_args",
-			message: "Missing subject"
-		};
+		if (!userId) return failure("invalid_args", "Missing userId");
+		if (!subject) return failure("invalid_args", "Missing subject");
 		const now = this.now().getTime();
 		const existing = await this.table.prepare(`SELECT user_id, created_at_ms
          FROM identity_links
@@ -135,11 +128,7 @@ var D1IdentityStore = class {
 		const existingCreatedAtMs = Number(existing?.created_at_ms);
 		const createdAtMs = Number.isFinite(existingCreatedAtMs) && existingCreatedAtMs > 0 ? Math.floor(existingCreatedAtMs) : now;
 		if (existingUserId && existingUserId !== userId) {
-			if (!input.allowMoveIfSoleIdentity) return {
-				ok: false,
-				code: "already_linked",
-				message: "Subject is already linked to a different user"
-			};
+			if (!input.allowMoveIfSoleIdentity) return failure("already_linked", "Subject is already linked to a different user");
 			if (d1ChangedRows(await this.table.database.prepare(`UPDATE identity_links
             SET user_id = ?,
                 record_json = ?,
@@ -167,16 +156,8 @@ var D1IdentityStore = class {
 				ok: true,
 				movedFromUserId: existingUserId
 			};
-			if (parseSubjectCount((await this.table.prepare(SUBJECT_COUNT_SQL, [existingUserId]).first())?.subject_count) !== 1) return {
-				ok: false,
-				code: "already_linked",
-				message: "Subject is linked to a different user with other identities; merge is not allowed"
-			};
-			return {
-				ok: false,
-				code: "already_linked",
-				message: "Subject is already linked to a different user"
-			};
+			if (parseSubjectCount((await this.table.prepare(SUBJECT_COUNT_SQL, [existingUserId]).first())?.subject_count) !== 1) return failure("already_linked", "Subject is linked to a different user with other identities; merge is not allowed");
+			return failure("already_linked", "Subject is already linked to a different user");
 		}
 		await this.table.prepare(`INSERT INTO identity_links (
         namespace,
@@ -209,31 +190,15 @@ var D1IdentityStore = class {
 		]).run();
 		const finalUserId = await this.getUserIdBySubject(subject);
 		if (finalUserId === userId) return { ok: true };
-		if (finalUserId) return {
-			ok: false,
-			code: "already_linked",
-			message: "Subject is already linked to a different user"
-		};
-		return {
-			ok: false,
-			code: "internal",
-			message: "Failed to link identity"
-		};
+		if (finalUserId) return failure("already_linked", "Subject is already linked to a different user");
+		return failure("internal", "Failed to link identity");
 	}
 	async unlinkSubjectFromUserId(input) {
 		await this.table.ensureSchema();
 		const userId = normalizeOptionalTrimmedString(input.userId);
 		const subject = normalizeOptionalTrimmedString(input.subject);
-		if (!userId) return {
-			ok: false,
-			code: "invalid_args",
-			message: "Missing userId"
-		};
-		if (!subject) return {
-			ok: false,
-			code: "invalid_args",
-			message: "Missing subject"
-		};
+		if (!userId) return failure("invalid_args", "Missing userId");
+		if (!subject) return failure("invalid_args", "Missing subject");
 		if (d1ChangedRows(await this.table.database.prepare(`DELETE FROM identity_links
             WHERE namespace = ?
               AND org_id = ?
@@ -250,44 +215,20 @@ var D1IdentityStore = class {
                    AND env_id = ?
                    AND user_id = ?
               ) > 1`).bind(this.table.scope.namespace, this.table.scope.orgId, this.table.scope.projectId, this.table.scope.envId, subject, userId, this.table.scope.namespace, this.table.scope.orgId, this.table.scope.projectId, this.table.scope.envId, userId).run()) > 0) return { ok: true };
-		if (await this.getUserIdBySubject(subject) !== userId) return {
-			ok: false,
-			code: "not_found",
-			message: "Subject is not linked to this user"
-		};
-		if (parseSubjectCount((await this.table.prepare(SUBJECT_COUNT_SQL, [userId]).first())?.subject_count) <= 1) return {
-			ok: false,
-			code: "cannot_unlink_last_identity",
-			message: "Refusing to remove the last remaining identity"
-		};
-		return {
-			ok: false,
-			code: "internal",
-			message: "Failed to unlink identity"
-		};
+		if (await this.getUserIdBySubject(subject) !== userId) return failure("not_found", "Subject is not linked to this user");
+		if (parseSubjectCount((await this.table.prepare(SUBJECT_COUNT_SQL, [userId]).first())?.subject_count) <= 1) return failure("cannot_unlink_last_identity", "Refusing to remove the last remaining identity");
+		return failure("internal", "Failed to unlink identity");
 	}
 	async deleteSubjectLinkForDevCleanup(input) {
 		await this.table.ensureSchema();
 		const userId = normalizeOptionalTrimmedString(input.userId);
 		const subject = normalizeOptionalTrimmedString(input.subject);
-		if (!userId) return {
-			ok: false,
-			code: "invalid_args",
-			message: "Missing userId"
-		};
-		if (!subject) return {
-			ok: false,
-			code: "invalid_args",
-			message: "Missing subject"
-		};
+		if (!userId) return failure("invalid_args", "Missing userId");
+		if (!subject) return failure("invalid_args", "Missing subject");
 		if (await this.deleteIdentityLink({
 			userId,
 			subject
-		}) === 0) return {
-			ok: false,
-			code: "not_found",
-			message: "Subject is not linked to this user"
-		};
+		}) === 0) return failure("not_found", "Subject is not linked to this user");
 		return { ok: true };
 	}
 	async deleteIdentityLink(input) {

package/dist/esm/core/d1TenantStore.js

@@ -1,8 +1,8 @@
 import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
 import "../shared-ts/src/utils/validation.js";
-import { formatD1ExecStatement } from "../storage/d1Sql.js";
 import "./defaultConfigsServer.js";
 import { toPrefixWithColon } from "./ThresholdService/validation.js";
+import { formatD1ExecStatement } from "../storage/d1Sql.js";
 //#region src/core/d1TenantStore.ts
 /**
 * A store's key prefix, which is also its D1 namespace: the first of `explicitKeys` set in

package/dist/esm/core/d1WalletStore.js

@@ -5,10 +5,11 @@ import { sameRouterAbMpcMaterialActivationRef } from "../shared-ts/src/utils/rou
 import { parseRouterAbEd25519YaoRecoveryActivationResultV1, parseRouterAbEd25519YaoRecoveryAdmissionRequestV1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationActivationResultV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { normalizeRuntimePolicyScope, signingRootScopeFromRuntimePolicyScope } from "../shared-ts/src/threshold/signingRootScope.js";
 import { sameRouterAbEcdsaDerivationPublicCapabilityV1 } from "../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { D1_BATCH_CAS_GUARD_SQL, formatD1ExecStatement, parseD1JsonColumn } from "../storage/d1Sql.js";
-import { thresholdEcdsaChainTargetKey } from "./thresholdEcdsaChainTarget.js";
 import { normalizeThresholdEd25519ParticipantIds } from "../shared-ts/src/threshold/participants.js";
+import { D1_BATCH_CAS_GUARD_SQL, formatD1ExecStatement, parseD1JsonColumn } from "../storage/d1Sql.js";
+import { thresholdEcdsaChainTargetKey } from "../shared-ts/src/utils/thresholdEcdsaChainTarget.js";
 import { ecdsaPostRegistrationRequestMatchesCapability, parseWalletEcdsaPendingSessionActivationRecord, parseWalletEcdsaSignerRecord } from "./WalletStore.js";
+import { EcdsaMaterialRead, parseWalletEcdsaSignerRows, prepareWalletEcdsaSignersRead } from "./d1EcdsaSignerRead.js";
 //#region src/core/d1WalletStore.ts
 function sameD1WalletRuntimePolicyScopeV1(left, right) {
 	return left.orgId === right.orgId && left.projectId === right.projectId && left.envId === right.envId && left.signingRootVersion === right.signingRootVersion;
@@ -455,10 +456,18 @@ var D1WalletStore = class {
 		return matches[0] ?? null;
 	}
 	async getEcdsaSignerByMaterialActivation(input) {
+		return (await this.readEcdsaSignerMaterialSnapshot({
+			walletId: input.walletId,
+			materialActivation: input.materialActivation,
+			source: { kind: "database" }
+		}))?.signer ?? null;
+	}
+	async readEcdsaSignerMaterialSnapshot(input) {
+		if (input.source.kind === "credential_snapshot") return input.source.materialRead.resolve(this.scope, input.walletId, input.materialActivation);
 		await this.ensureSchema();
 		const walletId = normalizeOptionalTrimmedString(input.walletId);
 		if (!walletId) return null;
-		const matches = ((await this.database.prepare(`SELECT record_json
+		const result = await this.database.prepare(`SELECT record_json
            FROM wallet_signers
           WHERE namespace = ?
             AND org_id = ?
@@ -469,12 +478,8 @@ var D1WalletStore = class {
             AND json_extract(
               record_json,
               '$.walletKey.publicCapability.material_activation.activation_id'
-            ) = ?
-          LIMIT 4`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, walletId, input.materialActivation.activation_id).all()).results || []).map((row) => parseWalletEcdsaSignerRecord(parseD1JsonColumn(row.record_json))).filter((record) => record !== null && record.walletId === walletId && sameRouterAbMpcMaterialActivationRef(record.walletKey.publicCapability.material_activation, input.materialActivation));
-		if (matches.length === 0) return null;
-		const keyHandle = matches[0]?.walletKey.keyHandle;
-		if (!keyHandle || matches.some((record) => record.walletKey.keyHandle !== keyHandle)) throw new Error("Wallet has conflicting ECDSA material activations");
-		return matches[0] ?? null;
+            ) = ?`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, walletId, input.materialActivation.activation_id).all();
+		return EcdsaMaterialRead.fromRows(this.scope, input.walletId, input.materialActivation, result.results ?? [], null).resolve(this.scope, input.walletId, input.materialActivation);
 	}
 	async getEcdsaSignerByPostRegistrationRequest(input) {
 		await this.ensureSchema();
@@ -503,22 +508,7 @@ var D1WalletStore = class {
 	}
 	async listEcdsaSignersForWallet(input) {
 		await this.ensureSchema();
-		const result = await this.database.prepare(`SELECT record_json
-           FROM wallet_signers
-          WHERE namespace = ?
-            AND org_id = ?
-            AND project_id = ?
-            AND env_id = ?
-            AND wallet_id = ?
-            AND signer_family = 'ecdsa'
-          ORDER BY signer_id`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, input.walletId).all();
-		const signers = [];
-		for (const row of result.results || []) {
-			const signer = parseWalletEcdsaSignerRecord(parseD1JsonColumn(row.record_json));
-			if (!signer || signer.walletId !== input.walletId) throw new Error("Wallet ECDSA signer record is invalid");
-			signers.push(signer);
-		}
-		return signers;
+		return parseWalletEcdsaSignerRows((await prepareWalletEcdsaSignersRead(this.database, this.scope, input.walletId).all()).results ?? [], input.walletId);
 	}
 	async listEcdsaPendingSessionActivationsForLifecycle(input) {
 		await this.ensureSchema();

package/dist/esm/core/deviceLinking/linkedDeviceEmailOtpGrant.js

@@ -4,7 +4,7 @@ import { sha256BytesUtf8 } from "../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u, sha256Utf8DigestB64u } from "../../shared-ts/src/utils/canonicalPrimitives.js";
 import { requireRecord } from "../../shared-ts/src/utils/validation.js";
 import { rejectUnknownFields } from "../../shared-ts/src/utils/exactRecord.js";
-import { parseUnixMs } from "../../shared-ts/src/passkey-custody/primitives.js";
+import { parseUnixMs, requireParsed } from "../../shared-ts/src/passkey-custody/primitives.js";
 //#region src/core/deviceLinking/linkedDeviceEmailOtpGrant.ts
 /**
 * The durable one-time Email OTP verification grant.
@@ -203,10 +203,6 @@ function requireGrantDigest(raw, label) {
 		throw new Error(`${label} ${error instanceof Error ? error.message : "is invalid"}`);
 	}
 }
-function requireParsed(parsed, label) {
-	if (!parsed.ok) throw new Error(`${label} ${parsed.error.message}`);
-	return parsed.value;
-}
 //#endregion
 export { computeLinkedDeviceEmailOtpAuthorityDigestV1, computeLinkedDeviceEmailOtpChallengeBindingDigestV1, computeLinkedDeviceEmailOtpGrantTokenDigestV1, linkedDeviceEmailOtpDescriptorCredentialIdV1, linkedDeviceEmailOtpGrantAdmitsUseV1, parseLinkedDeviceEmailOtpGrantRecordV1 };
 

package/dist/esm/core/deviceLinking/linkedDeviceSessionApproval.js

@@ -1,6 +1,7 @@
 import { mpcMaterialActivationRefsEqual } from "../../shared-ts/src/utils/domainIds.js";
 import { hasDelegatedWalletPermissionV1, sameDelegatedWalletAuthorityV1, validateDelegatedWalletAuthorityAttenuationV1 } from "../../shared-ts/src/authorization/delegatedAuthority.js";
 import { routerAbMpcMaterialActivationRefFromWire, sameRouterAbMpcMaterialActivationRef } from "../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { sameRouterAbEd25519YaoByteSequence } from "../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { assertLinkedDeviceOrdinaryMaterialSourceContributionMatchesContextV1 } from "../../shared-ts/src/device-linking/sourceContribution.js";
 import { parseDeviceIdValue } from "./linkedDeviceSessionRecord.js";
 //#region src/core/deviceLinking/linkedDeviceSessionApproval.ts
@@ -93,9 +94,6 @@ function linkedDeviceOwnerAuthorizationsEqualV1(left, right) {
 function linkedDeviceEd25519BindingsEqualV1(left, right) {
 	return left.operation === right.operation && sameRouterAbEd25519YaoByteSequence(left.session_id, right.session_id) && sameRouterAbEd25519YaoByteSequence(left.stable_key_context_binding, right.stable_key_context_binding) && sameRouterAbMpcMaterialActivationRef(left.material_activation, right.material_activation) && left.lifecycle.lifecycle_id === right.lifecycle.lifecycle_id && left.lifecycle.work_kind === right.lifecycle.work_kind && left.lifecycle.primitive_request_kind === right.lifecycle.primitive_request_kind && left.lifecycle.root_share_epoch === right.lifecycle.root_share_epoch && left.lifecycle.account_id === right.lifecycle.account_id && left.lifecycle.session_id === right.lifecycle.session_id && left.lifecycle.signer_set_id === right.lifecycle.signer_set_id && left.lifecycle.selected_server_id === right.lifecycle.selected_server_id;
 }
-function sameRouterAbEd25519YaoByteSequence(left, right) {
-	return left.length === right.length && left.every((value, index) => value === right[index]);
-}
 //#endregion
 export { validateApprovalMatchesSession, validateLinkedDeviceRequestedAuthorityV1, validateSourceContributionApprovalMatchesSession, validateSourceContributionPreparationMatchesApproval };
 

package/dist/esm/core/deviceLinking/linkedDeviceSessionRecord.js

@@ -6,7 +6,7 @@ import { requireRecordCopy } from "../../shared-ts/src/utils/validation.js";
 import { sameDelegatedWalletAuthorityV1 } from "../../shared-ts/src/authorization/delegatedAuthority.js";
 import { parseExactAdministeredSignerManifestV1 } from "../../shared-ts/src/device-linking/delegatedActivationPlan.js";
 import { parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1 } from "../../shared-ts/src/device-linking/sourceContribution.js";
-import { parseLinkSessionStateV1, parseLinkedDeviceApprovalV1 as parseLinkedDeviceApprovalV1$1, parseLinkedDeviceSessionClaimV1, parseQrLinkedDeviceSessionPayloadV5 } from "../../shared-ts/src/device-linking/parsers.js";
+import { parseLinkSessionStateV1, parseLinkedDeviceApprovalV1, parseLinkedDeviceSessionClaimV1, parseQrLinkedDeviceSessionPayloadV5 } from "../../shared-ts/src/device-linking/parsers.js";
 import "../../shared-ts/src/device-linking/requestProof.js";
 //#region src/core/deviceLinking/linkedDeviceSessionRecord.ts
 function sourceKeyManifestDigestForFamilyV1(digests, keyFamily) {
@@ -377,19 +377,13 @@ function assertNeverLinkedDeviceEmailOtpChallengeV1(value) {
 function assertNeverLinkPrecommitFailureV1(value) {
 	throw new Error(`unsupported linked-device precommit failure: ${String(value)}`);
 }
-function parseLinkedDeviceApprovalV1(raw) {
-	return parseLinkedDeviceApprovalV1$1(raw);
-}
-function parseLinkedDeviceClaimV1(raw) {
-	return parseLinkedDeviceSessionClaimV1(raw);
-}
 function parseOptionalClaimTranscript(raw) {
 	if (raw === void 0) return void 0;
 	const record = requireRecordCopy(raw, "claimTranscript");
 	requireExactKeys(record, ["digestB64u", "value"]);
 	return {
 		digestB64u: requireDigest(record.digestB64u, "claimTranscript.digestB64u"),
-		value: parseLinkedDeviceClaimV1(record.value)
+		value: parseLinkedDeviceSessionClaimV1(record.value)
 	};
 }
 /**

package/dist/esm/core/deviceLinking/requestProof.js

@@ -2,6 +2,7 @@ import { parseLinkDeviceSessionId } from "../../shared-ts/src/utils/domainIds.js
 import { base64UrlDecode, base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
 import { parseDigestB64u } from "../../shared-ts/src/utils/canonicalPrimitives.js";
 import { LINKED_DEVICE_CLOCK_SKEW_TOLERANCE_MS_V1, LINKED_DEVICE_REQUEST_PROOF_HEADER_V1, LINKED_DEVICE_REQUEST_PROOF_MAX_TTL_MS_V1, computeLinkedDevicePublicKeyDigestV1, computeLinkedDeviceRequestProofDigestV1, encodeLinkedDeviceRequestProofV1 } from "../../shared-ts/src/device-linking/requestProof.js";
+import { hasExactKeys } from "../../shared-ts/src/utils/exactKeys.js";
 //#region src/core/deviceLinking/requestProof.ts
 var LinkedDeviceRequestProofVerifierV1 = class {
 	constructor(input) {
@@ -62,7 +63,18 @@ var LinkedDeviceRequestProofVerifierV1 = class {
 };
 function parseLinkedDeviceRequestProofV1(raw) {
 	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new Error("linked-device request proof must be an object");
-	if (!isLinkedDeviceRequestProofRecordV1(raw)) throw new Error("record contains invalid fields");
+	if (!hasExactKeys(raw, [
+		"kind",
+		"linkSessionId",
+		"devicePublicKeyDigestB64u",
+		"requestNonceB64u",
+		"method",
+		"canonicalPath",
+		"bodyDigestB64u",
+		"issuedAtMs",
+		"expiresAtMs",
+		"signatureB64u"
+	])) throw new Error("record contains invalid fields");
 	const record = raw;
 	if (record.kind !== "linked_device_request_proof_v1") throw new Error("linked-device request proof kind is invalid");
 	const linkSessionId = parseSessionId(record.linkSessionId);
@@ -152,9 +164,6 @@ function parseFixedB64u(raw, expectedBytes, field) {
 function toArrayBuffer(bytes) {
 	return bytes.slice().buffer;
 }
-function isLinkedDeviceRequestProofRecordV1(value) {
-	return Object.keys(value).sort().join("|") === "bodyDigestB64u|canonicalPath|devicePublicKeyDigestB64u|expiresAtMs|issuedAtMs|kind|linkSessionId|method|requestNonceB64u|signatureB64u";
-}
 function errorMessage(error) {
 	return error instanceof Error ? error.message : String(error || "invalid device request proof");
 }

package/dist/esm/core/ecdsaMaterialReadSnapshot.js

@@ -0,0 +1,85 @@
+//#region src/core/ecdsaMaterialReadSnapshot.ts
+const ECDSA_INSTALLATION_SNAPSHOT_COLUMNS = [
+	"link_session_id",
+	"authority_id",
+	"wallet_id",
+	"auth_method_id",
+	"device_id",
+	"package_set_digest_b64u",
+	"target_factor_verification_digest_b64u",
+	"target_factor_verified_at_ms",
+	"source_manifest_digest_b64u",
+	"delivery_recipient_public_key_b64u",
+	"packages_json",
+	"server_reservation_ids_json",
+	"installed_record_set_digest_b64u",
+	"activated_at_ms"
+];
+/** Request-local evidence of the exact records a material resolver examined. */
+var EcdsaMaterialReadSnapshot = class EcdsaMaterialReadSnapshot {
+	#scope;
+	#conditions;
+	constructor(walletId, scope, conditions) {
+		this.walletId = walletId;
+		this.#scope = scope;
+		this.#conditions = conditions;
+	}
+	static canonical(scope, walletId, activationId, rows) {
+		return new EcdsaMaterialReadSnapshot(walletId, scope, [recordSetCondition("wallet_signers", scope, walletId, ["record_json"], rows, "signer_family = 'ecdsa' AND json_extract(record_json, '$.walletKey.publicCapability.material_activation.activation_id') = ?", [activationId])]);
+	}
+	static linked(scope, walletId, installations, signers) {
+		return new EcdsaMaterialReadSnapshot(walletId, scope, [recordSetCondition("linked_device_authority_installations", scope, walletId, ECDSA_INSTALLATION_SNAPSHOT_COLUMNS, installations, "1", []), recordSetCondition("wallet_signers", scope, walletId, ["record_json"], signers, "signer_family = 'ecdsa'", [])]);
+	}
+	condition(scope) {
+		if (scope.namespace !== this.#scope.namespace || scope.orgId !== this.#scope.orgId || scope.projectId !== this.#scope.projectId || scope.envId !== this.#scope.envId) return {
+			sql: "0",
+			bindings: []
+		};
+		const clauses = [];
+		const bindings = [];
+		for (const condition of this.#conditions) {
+			clauses.push(`(${condition.sql})`);
+			bindings.push(...condition.bindings);
+		}
+		return {
+			sql: clauses.join(" AND "),
+			bindings
+		};
+	}
+};
+function recordSetCondition(table, scope, walletId, columns, rows, filter, filterBindings) {
+	const values = [];
+	for (const row of rows) {
+		const tuple = [];
+		for (const column of columns) {
+			const value = row[column];
+			if (value !== null && typeof value !== "string" && typeof value !== "number") throw new Error(`Invalid stored material column: ${column}`);
+			tuple.push(value);
+		}
+		values.push(tuple);
+	}
+	const predicate = `namespace = ? AND org_id = ? AND project_id = ? AND env_id = ? AND wallet_id = ? AND ${filter}`;
+	const identity = [
+		scope.namespace,
+		scope.orgId,
+		scope.projectId,
+		scope.envId,
+		walletId,
+		...filterBindings
+	];
+	return {
+		sql: `(SELECT COUNT(*) FROM ${table} WHERE ${predicate}) = ?
+      AND NOT EXISTS (SELECT 1 FROM ${table} WHERE ${predicate}
+        AND json_array(${columns.join(", ")}) NOT IN (SELECT value FROM json_each(?)))`,
+		bindings: [
+			...identity,
+			rows.length,
+			...identity,
+			JSON.stringify(values)
+		]
+	};
+}
+//#endregion
+export { ECDSA_INSTALLATION_SNAPSHOT_COLUMNS, EcdsaMaterialReadSnapshot };
+
+//# sourceMappingURL=ecdsaMaterialReadSnapshot.js.map

package/dist/esm/core/nearRelayerAccountProvisioning.js

@@ -4,6 +4,7 @@ import { base58Encode } from "../shared-ts/src/utils/base58.js";
 import "../shared-ts/src/utils/encoders.js";
 import { deriveImplicitNearAccountIdFromEd25519PublicKey, parseImplicitNearAccountId, parseNamedNearAccountId } from "../shared-ts/src/utils/near.js";
 import { coerceNonEmptyString, requireRecordOrArray } from "../shared-ts/src/utils/validation.js";
+import { failure } from "../shared-ts/src/utils/failure.js";
 import { ActionType, validateActionArgsWasm } from "../shared-ts/src/near/actions.js";
 import { errorMessage } from "../shared-ts/src/utils/errors.js";
 import { toPublicKeyStringFromSecretKey } from "./nearKeys.js";
@@ -265,11 +266,7 @@ async function fundImplicitNearAccountWithRelayer(input) {
 			message: "Implicit NEAR account funding transaction submitted"
 		};
 	} catch (error) {
-		return {
-			ok: false,
-			code: "funding_failed",
-			message: errorMessage(error) || "Failed to fund implicit NEAR account"
-		};
+		return failure("funding_failed", errorMessage(error) || "Failed to fund implicit NEAR account");
 	}
 }
 /**

package/dist/esm/core/signingLanes/WalletExecutionLaneProjection.js

@@ -1,4 +1,4 @@
-import { parseEmailOtpProviderUserId, parseLaneShareEpoch, parseMpcSigningWorkerRef, parseSigningLaneId, parseWalletKeyId, parseWebAuthnCredentialIdB64u } from "../../shared-ts/src/utils/domainIds.js";
+import { mpcMaterialActivationRefsEqual, parseEmailOtpProviderUserId, parseLaneShareEpoch, parseMpcSigningWorkerRef, parseSigningLaneId, parseWalletKeyId, parseWebAuthnCredentialIdB64u } from "../../shared-ts/src/utils/domainIds.js";
 import { base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify } from "../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u, sha256Utf8DigestB64u } from "../../shared-ts/src/utils/canonicalPrimitives.js";
@@ -218,13 +218,13 @@ function requireOnlyEcdsaSigners(signers) {
 function signerMatchesMaterialActivation(signer, expected) {
 	const wire = signer.version === "wallet_signer_ed25519_v1" ? signer.activeYaoCapability.activationResult.public_receipt.material_activation : signer.walletKey.publicCapability.material_activation;
 	try {
-		return sameMaterialActivation(routerAbMpcMaterialActivationRefFromWire(wire), expected);
+		return mpcMaterialActivationRefsEqual(routerAbMpcMaterialActivationRefFromWire(wire), expected);
 	} catch {
 		return false;
 	}
 }
 function assertExpectedActivation(wire, expected) {
-	if (!sameMaterialActivation(routerAbMpcMaterialActivationRefFromWire(wire), expected)) throw new Error("wallet signer material activation changed");
+	if (!mpcMaterialActivationRefsEqual(routerAbMpcMaterialActivationRefFromWire(wire), expected)) throw new Error("wallet signer material activation changed");
 }
 function assertEcdsaReceiptContinuity(signer) {
 	const capability = signer.walletKey.publicCapability;
@@ -241,9 +241,6 @@ async function digestPublicIdentity(value) {
 async function digestValue(domain, value) {
 	return sha256Utf8DigestB64u(`${domain}\u0000${alphabetizeStringify(value)}`);
 }
-function sameMaterialActivation(left, right) {
-	return left.activationId === right.activationId && left.capability === right.capability && left.materialOwner === right.materialOwner && left.keyBinding === right.keyBinding && left.lifecycleBinding === right.lifecycleBinding && left.signingWorker === right.signingWorker;
-}
 function requireParsed(result) {
 	if (result.ok) return result.value;
 	throw new Error("wallet execution lane identity is invalid");

package/dist/esm/core/signingMaterial/ordinaryInactiveSignerMaterialReservation.js

@@ -1,7 +1,7 @@
 import { hasWhitespaceOrControlCharacters, mpcMaterialActivationRefsEqual, parseMpcMaterialActivationRef } from "../../shared-ts/src/utils/domainIds.js";
 import { parseExactAdministeredSignerManifestV1 } from "../../shared-ts/src/device-linking/delegatedActivationPlan.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { parseRouterAbEd25519YaoActivationPublicReceiptV1, parseRouterAbEd25519YaoCeremonyBindingV1, parseRouterAbEd25519YaoEncryptedPackageV1, parseRouterAbEd25519YaoParticipantIdsV1 } from "../../shared-ts/src/utils/routerAbEd25519Yao.js";
+import { parseRouterAbEd25519YaoActivationPublicReceiptV1, parseRouterAbEd25519YaoCeremonyBindingV1, parseRouterAbEd25519YaoEncryptedPackageV1, parseRouterAbEd25519YaoParticipantIdsV1, sameRouterAbEd25519YaoByteSequence } from "../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { parseLinkedDeviceEcdsaEncryptedSourceContributionV1, parseLinkedDeviceEcdsaSourceContributionPackageV1, parseLinkedDeviceEcdsaSourceDerivationV1, parseLinkedDeviceEcdsaSourcePreservingActivationReceiptV1 } from "../../shared-ts/src/device-linking/sourceContribution.js";
 //#region src/core/signingMaterial/ordinaryInactiveSignerMaterialReservation.ts
 function validateOrdinaryInactiveSignerMaterialDeactivationRequestV1(request) {
@@ -130,7 +130,7 @@ function parseOrdinaryEd25519SignerMaterialWorkerReservationV1(request, raw) {
 	const activationReceipt = parseRouterAbEd25519YaoActivationPublicReceiptV1(reservation.activationReceipt);
 	assertMaterialActivationMatchesV1(request.plannedActivationRef, routerAbMpcMaterialActivationRefFromWire(activationReceipt.material_activation));
 	const clientMaterial = parseEd25519ClientMaterialV1(reservation.clientMaterial);
-	if (!sameBytes(activationReceipt.transcript, clientMaterial.deriver_a_client_package.transcript) || !sameBytes(activationReceipt.transcript, clientMaterial.deriver_b_client_package.transcript)) throw new Error("ordinary Ed25519 worker receipt transcript does not match client packages");
+	if (!sameRouterAbEd25519YaoByteSequence(activationReceipt.transcript, clientMaterial.deriver_a_client_package.transcript) || !sameRouterAbEd25519YaoByteSequence(activationReceipt.transcript, clientMaterial.deriver_b_client_package.transcript)) throw new Error("ordinary Ed25519 worker receipt transcript does not match client packages");
 	return {
 		kind: "ordinary_ed25519_signer_material_worker_reservation_v1",
 		keyFamily: "ed25519",
@@ -247,9 +247,6 @@ function sameEcdsaSourceSigner(left, right) {
 function sameEcdsaTarget(left, right) {
 	return mpcMaterialActivationRefsEqual(left.activation, right.activation) && String(left.targetDeviceId) === String(right.targetDeviceId) && left.targetFactorVerificationDigestB64u === right.targetFactorVerificationDigestB64u && left.clientRecipientPublicKeyB64u === right.clientRecipientPublicKeyB64u && left.signingWorkerRecipientPublicKeyB64u === right.signingWorkerRecipientPublicKeyB64u;
 }
-function sameBytes(left, right) {
-	return left.length === right.length && left.every((value, index) => value === right[index]);
-}
 function parseEd25519ClientPackageV1(raw, label, expectedRole) {
 	const parsed = parseRouterAbEd25519YaoEncryptedPackageV1(raw);
 	if (!parsed.ok) throw new Error(`${label} ${parsed.message}`);

package/dist/esm/core/storeBackends.js

@@ -1,7 +1,7 @@
 import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
 import { isObject, isPlainObject } from "../shared-ts/src/utils/validation.js";
-import { resolveD1DatabaseFromConfig } from "../storage/d1Sql.js";
 import "./defaultConfigsServer.js";
+import { resolveD1DatabaseFromConfig } from "../storage/d1Sql.js";
 import { d1TenantScopeFromConfig } from "./d1TenantStore.js";
 import { RedisTcpClient, UpstashRedisRestClient, redisDel, redisGetJson, redisGetdelJson, redisSetJson } from "./ThresholdService/kv.js";
 //#region src/core/storeBackends.ts

package/dist/esm/core/thresholdEcdsaChainTarget.js

@@ -1,3 +1,4 @@
+import { thresholdEcdsaChainTargetKey } from "../shared-ts/src/utils/thresholdEcdsaChainTarget.js";
 //#region src/core/thresholdEcdsaChainTarget.ts
 function positiveSafeInteger(value) {
 	return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : null;
@@ -31,9 +32,6 @@ function thresholdEcdsaChainTargetFromValue(value) {
 	}
 	return null;
 }
-function thresholdEcdsaChainTargetKey(target) {
-	return target.kind === "evm" ? `evm:eip155:${target.chainId}` : `tempo:${target.chainId}`;
-}
 function thresholdEcdsaChainTargetsEqual(left, right) {
 	return thresholdEcdsaChainTargetKey(left) === thresholdEcdsaChainTargetKey(right);
 }

package/dist/esm/hosted-wallet-gateway.js

@@ -16,6 +16,8 @@ import { handleWalletControlRequest } from "./router/cloudflare/runtime/walletCo
 import { resolveRuntimeTenantRootLineage } from "./router/cloudflare/runtime/walletConsoleTenantRootLineage.js";
 import { ROUTER_AB_MPC_ROUTER_ORIGIN, ROUTER_AB_SIGNING_WORKER_ORIGIN, createRouterAbServiceBindingFetch } from "./router/cloudflare/runtime/routerAbServiceBindings.js";
 import { readEnvironmentCsv, readEnvironmentString, requireEnvironmentString } from "./router/cloudflare/runtime/environment.js";
+import { createD1LinkedDeviceSourceContributionPreparationPlannerV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceSourceContributionPreparationPlanner.js";
+import { readD1LinkedDeviceEcdsaSourceV1, readD1LinkedDeviceEd25519SourceV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService.js";
 import { RouterAbEd25519YaoExportOwnerProofAuthorizationAdapter } from "./router/domains/ed25519Yao/export/routerAbEd25519YaoExport.js";
 import { createRouterAbEd25519YaoHttpRegistrationBackendFromEnv } from "./router/domains/ed25519Yao/registration/routerAbEd25519YaoHttpRegistrationBackend.js";
 import { createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1 } from "./router/cloudflare/d1/ed25519Yao/d1Ed25519YaoProductRegistrationPartitionedStateStore.js";
@@ -25,8 +27,6 @@ import { handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1 } from ".
 import { CloudflareD1RouterAbEd25519YaoCapabilityPersistence } from "./router/cloudflare/d1/ed25519Yao/d1Ed25519YaoCapabilityPersistence.js";
 import { createSigningSessionSealOptions } from "./threshold/session/signingSessionSeal/options.js";
 import { createRouterAbEcdsaEd25519CeremonyTokenIssuer, createRouterAbEcdsaStrictPostRegistrationPort, createRouterAbEcdsaStrictRegistrationPort, parseRouterAbEcdsaEd25519PrivateJwk, parseRouterAbEcdsaStrictRegistrationTopology } from "./router/domains/ecdsa/routerAbEcdsaStrictRegistration.js";
-import { createD1LinkedDeviceSourceContributionPreparationPlannerV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceSourceContributionPreparationPlanner.js";
-import { readD1LinkedDeviceEcdsaSourceV1, readD1LinkedDeviceEd25519SourceV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService.js";
 import { D1LinkedDeviceTargetCredentialProviderV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetCredentialProvider.js";
 import { createD1LinkedDeviceOwnerSourceChildReaderV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceOwnerAuthorizationProvider.js";
 import { createCloudflareD1RouterApiAuthService } from "./router/cloudflare/d1/auth/d1RouterApiAuthService.js";