@seams/wallet-server 0.7.1 → 0.8.0

package/dist/esm/core/authService/webauthnVerificationOutcomes.js

@@ -1,12 +1,8 @@
+import { failedVerification } from "../../shared-ts/src/utils/failure.js";
 //#region src/core/authService/webauthnVerificationOutcomes.ts
 /** The failure a login or sync returns when its assertion did not verify; null when it did. */
 function webAuthnAuthenticationFailure(verification) {
-	if (!verification.success || !verification.verified) return {
-		ok: false,
-		verified: false,
-		code: verification.code || "not_verified",
-		message: verification.message || "Authentication verification failed"
-	};
+	if (!verification.success || !verification.verified) return failedVerification(verification.code || "not_verified", verification.message || "Authentication verification failed");
 	return null;
 }
 /**
@@ -16,12 +12,7 @@ function webAuthnAuthenticationFailure(verification) {
 function webAuthnLoginEd25519(binding, walletBinding) {
 	const firstParticipantId = binding?.participantIds?.[0];
 	const secondParticipantId = binding?.participantIds?.[1];
-	if (!binding) return {
-		ok: false,
-		verified: false,
-		code: "unknown_credential",
-		message: "Credential has no wallet binding"
-	};
+	if (!binding) return failedVerification("unknown_credential", "Credential has no wallet binding");
 	return {
 		ok: true,
 		ed25519: walletBinding && binding.publicKey && binding.relayerKeyId && firstParticipantId !== void 0 && secondParticipantId !== void 0 ? {
@@ -37,18 +28,8 @@ function webAuthnLoginEd25519(binding, walletBinding) {
 }
 /** The sync credential's binding, if it exists and belongs to the account the challenge expects. */
 function webAuthnSyncCredentialBinding(binding, challenge) {
-	if (!binding) return {
-		ok: false,
-		verified: false,
-		code: "unknown_credential",
-		message: "Credential is not registered on this relay"
-	};
-	if (challenge.expectedUserId && binding.userId !== challenge.expectedUserId) return {
-		ok: false,
-		verified: false,
-		code: "unknown_credential",
-		message: `Credential is not registered for account ${challenge.expectedUserId}`
-	};
+	if (!binding) return failedVerification("unknown_credential", "Credential is not registered on this relay");
+	if (challenge.expectedUserId && binding.userId !== challenge.expectedUserId) return failedVerification("unknown_credential", `Credential is not registered for account ${challenge.expectedUserId}`);
 	return {
 		ok: true,
 		binding

package/dist/esm/core/authService/webauthnWalletBinding.js

@@ -1,37 +0,0 @@
-import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import "../../shared-ts/src/utils/validation.js";
-import { walletIdFromString } from "../../shared-ts/src/utils/registrationIds.js";
-//#region src/core/authService/webauthnWalletBinding.ts
-function parseBoundaryWalletId(raw) {
-	const value = normalizeOptionalTrimmedString(raw);
-	if (!value) return null;
-	try {
-		return String(walletIdFromString(value));
-	} catch {
-		return null;
-	}
-}
-/**
-* Returns `null` when the binding carries no Ed25519 identity, which is the
-* valid state for a wallet whose Ed25519 Yao ceremony has not settled yet.
-* Callers must surface that as a typed "not provisioned" outcome rather than
-* treating it as a missing credential.
-*/
-function resolvedEd25519WalletBindingFromCredentialBinding(args) {
-	const { nearAccountId, nearEd25519SigningKeyId } = args.binding;
-	if (!nearAccountId || !nearEd25519SigningKeyId) return null;
-	const resolvedSignerSlot = Number.isSafeInteger(args.signerSlot) && Number(args.signerSlot) > 0 ? Math.floor(Number(args.signerSlot)) : args.binding.signerSlot;
-	if (!Number.isSafeInteger(resolvedSignerSlot) || Number(resolvedSignerSlot) < 1) return null;
-	return {
-		walletId: args.binding.userId,
-		nearAccountId,
-		nearEd25519SigningKeyId,
-		rpId: args.binding.rpId,
-		credentialIdB64u: args.binding.credentialIdB64u,
-		signerSlot: Number(resolvedSignerSlot)
-	};
-}
-//#endregion
-export { parseBoundaryWalletId, resolvedEd25519WalletBindingFromCredentialBinding };
-
-//# sourceMappingURL=webauthnWalletBinding.js.map

package/dist/esm/core/config.js

@@ -1,98 +1,4 @@
-import { normalizeOptionalTrimmedString, normalizeTrimmedString } from "../shared-ts/src/utils/normalize.js";
-import "../shared-ts/src/utils/validation.js";
-import { THRESHOLD_DO_OBJECT_NAME_DEFAULT } from "./defaultConfigsServer.js";
 //#region src/core/config.ts
-const AUTH_SERVICE_CONFIG_DEFAULTS = {
-	nearRpcUrlTestnet: "https://rpc.testnet.fastnear.com",
-	nearRpcUrlMainnet: "https://rpc.mainnet.near.org",
-	networkId: "testnet",
-	accountInitialBalance: "30000000000000000000000",
-	createAccountAndRegisterGas: "85000000000000"
-};
-function defaultNearRpcUrl(networkId) {
-	if (String(networkId || "").trim().toLowerCase() === "mainnet") return AUTH_SERVICE_CONFIG_DEFAULTS.nearRpcUrlMainnet;
-	return AUTH_SERVICE_CONFIG_DEFAULTS.nearRpcUrlTestnet;
-}
-function parseCsv(input) {
-	return String(input || "").split(",").map((s) => s.trim()).filter(Boolean);
-}
-function normalizeGoogleOidcConfig(input) {
-	if (!input) return void 0;
-	if (typeof input === "object" && !Array.isArray(input) && Array.isArray(input.clientIds)) {
-		const clientIds = Array.from(new Set(input.clientIds.map((v) => String(v || "").trim()).filter(Boolean)));
-		if (!clientIds.length) return void 0;
-		const hostedDomains = Array.isArray(input.hostedDomains) ? Array.from(new Set(input.hostedDomains.map((v) => String(v || "").trim().toLowerCase()).filter(Boolean))) : [];
-		return {
-			clientIds,
-			...hostedDomains.length ? { hostedDomains } : {}
-		};
-	}
-	const envInput = input;
-	const single = normalizeOptionalTrimmedString(envInput.GOOGLE_OIDC_CLIENT_ID);
-	const csv = normalizeOptionalTrimmedString(envInput.GOOGLE_OIDC_CLIENT_IDS);
-	const hostedRaw = normalizeOptionalTrimmedString(envInput.GOOGLE_OIDC_HOSTED_DOMAINS);
-	if (!Boolean(single || csv || hostedRaw)) return void 0;
-	const clientIds = Array.from(new Set([...single ? [single] : [], ...parseCsv(csv)]));
-	if (!clientIds.length) throw new Error("googleOidc enabled but GOOGLE_OIDC_CLIENT_ID(S) is not set");
-	const hostedDomains = hostedRaw ? Array.from(new Set(parseCsv(hostedRaw).map((d) => d.toLowerCase()))) : [];
-	return {
-		clientIds,
-		...hostedDomains.length ? { hostedDomains } : {}
-	};
-}
-function normalizeGithubOAuthConfig(input) {
-	if (!input) return void 0;
-	const candidate = input;
-	const clientId = normalizeOptionalTrimmedString(candidate.clientId ?? candidate.GITHUB_OAUTH_CLIENT_ID);
-	const clientSecret = normalizeOptionalTrimmedString(candidate.clientSecret ?? candidate.GITHUB_OAUTH_CLIENT_SECRET);
-	const callbackUrl = normalizeOptionalTrimmedString(candidate.callbackUrl ?? candidate.GITHUB_OAUTH_CALLBACK_URL);
-	if (!clientId && !clientSecret && !callbackUrl) return void 0;
-	if (!clientId || !clientSecret || !callbackUrl) throw new Error("githubOAuth requires clientId, clientSecret, and callbackUrl");
-	const parsedCallbackUrl = new URL(callbackUrl);
-	const localCallbackHost = parsedCallbackUrl.hostname === "localhost" || parsedCallbackUrl.hostname.endsWith(".localhost");
-	if (parsedCallbackUrl.protocol !== "https:" && !localCallbackHost) throw new Error("githubOAuth.callbackUrl must use HTTPS outside localhost");
-	return {
-		clientId,
-		clientSecret,
-		callbackUrl: parsedCallbackUrl.toString()
-	};
-}
-function normalizeThresholdStoreConfig(input) {
-	if (!input) return void 0;
-	if (typeof input !== "object" || Array.isArray(input)) return void 0;
-	const c = input;
-	if (!Boolean(normalizeOptionalTrimmedString(c.THRESHOLD_NODE_ROLE) || normalizeOptionalTrimmedString(c.THRESHOLD_COORDINATOR_SHARED_SECRET_B64U) || normalizeOptionalTrimmedString(c.THRESHOLD_ED25519_RELAYER_COSIGNERS) || normalizeOptionalTrimmedString(c.THRESHOLD_ED25519_RELAYER_COSIGNER_ID) || normalizeOptionalTrimmedString(c.THRESHOLD_ED25519_RELAYER_COSIGNER_T) || normalizeOptionalTrimmedString(c.THRESHOLD_ED25519_CLIENT_PARTICIPANT_ID) || normalizeOptionalTrimmedString(c.THRESHOLD_ED25519_RELAYER_PARTICIPANT_ID) || normalizeOptionalTrimmedString(c.THRESHOLD_ED25519_SHARE_MODE) || normalizeOptionalTrimmedString(c.THRESHOLD_PREFIX) || normalizeOptionalTrimmedString(c.THRESHOLD_ED25519_WALLET_SESSION_PREFIX) || normalizeOptionalTrimmedString(c.THRESHOLD_ED25519_SESSION_PREFIX) || normalizeOptionalTrimmedString(c.THRESHOLD_ED25519_KEYSTORE_PREFIX) || normalizeOptionalTrimmedString(c.THRESHOLD_ECDSA_WALLET_SESSION_PREFIX) || normalizeOptionalTrimmedString(c.THRESHOLD_ECDSA_SESSION_PREFIX) || normalizeOptionalTrimmedString(c.THRESHOLD_ECDSA_KEYSTORE_PREFIX) || normalizeOptionalTrimmedString(c.ROUTER_AB_NORMAL_SIGNING_WORKER_ID) || normalizeOptionalTrimmedString(c.ROUTER_AB_SIGNING_WORKER_URL) || normalizeOptionalTrimmedString(c.ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET) || typeof c.routerAbSigningWorkerFetch === "function" || normalizeOptionalTrimmedString(c.SIGNING_SESSION_SEAL_ROOT_SECRET_B64U) || normalizeOptionalTrimmedString(c.SIGNING_SESSION_SEAL_CURRENT_KEY_VERSION) || normalizeOptionalTrimmedString(c.SIGNING_SESSION_SEAL_ACCEPTED_WARM_KEY_VERSIONS) || normalizeOptionalTrimmedString(c.SIGNING_SESSION_SEAL_IDEMPOTENCY_KIND) || normalizeOptionalTrimmedString(c.SIGNING_SESSION_SEAL_IDEMPOTENCY_UPSTASH_URL) || normalizeOptionalTrimmedString(c.SIGNING_SESSION_SEAL_IDEMPOTENCY_UPSTASH_TOKEN) || normalizeOptionalTrimmedString(c.SIGNING_SESSION_SEAL_IDEMPOTENCY_REDIS_URL) || normalizeOptionalTrimmedString(c.SIGNING_SESSION_SEAL_IDEMPOTENCY_KEY_PREFIX) || normalizeOptionalTrimmedString(c.SIGNING_SESSION_SEAL_IDEMPOTENCY_TTL_MS) || normalizeOptionalTrimmedString(c.kind) || normalizeOptionalTrimmedString(c.url) || normalizeOptionalTrimmedString(c.token) || normalizeOptionalTrimmedString(c.redisUrl) || normalizeOptionalTrimmedString(c.UPSTASH_REDIS_REST_URL) || normalizeOptionalTrimmedString(c.UPSTASH_REDIS_REST_TOKEN) || normalizeOptionalTrimmedString(c.REDIS_URL))) return void 0;
-	const normalized = { ...input };
-	if (normalizeOptionalTrimmedString(normalized.kind) === "cloudflare-do") {
-		if (!normalizeOptionalTrimmedString(normalized.name)) normalized.name = THRESHOLD_DO_OBJECT_NAME_DEFAULT;
-		const thresholdPrefix = normalizeOptionalTrimmedString(normalized.THRESHOLD_PREFIX);
-		const anySpecificPrefix = Boolean(normalizeOptionalTrimmedString(normalized.THRESHOLD_ED25519_WALLET_SESSION_PREFIX) || normalizeOptionalTrimmedString(normalized.THRESHOLD_ED25519_SESSION_PREFIX) || normalizeOptionalTrimmedString(normalized.THRESHOLD_ED25519_KEYSTORE_PREFIX));
-		if (!thresholdPrefix && !anySpecificPrefix) normalized.THRESHOLD_PREFIX = "w3a";
-	}
-	return normalized;
-}
-function createAuthServiceConfig(input) {
-	const networkId = normalizeTrimmedString(input.networkId) || AUTH_SERVICE_CONFIG_DEFAULTS.networkId;
-	const config = {
-		relayerAccount: normalizeTrimmedString(input.relayerAccount),
-		relayerPrivateKey: normalizeTrimmedString(input.relayerPrivateKey),
-		nearRpcUrl: normalizeTrimmedString(input.nearRpcUrl) || defaultNearRpcUrl(networkId),
-		networkId,
-		accountInitialBalance: normalizeTrimmedString(input.accountInitialBalance) || AUTH_SERVICE_CONFIG_DEFAULTS.accountInitialBalance,
-		createAccountAndRegisterGas: normalizeTrimmedString(input.createAccountAndRegisterGas) || AUTH_SERVICE_CONFIG_DEFAULTS.createAccountAndRegisterGas,
-		signerWasm: input.signerWasm,
-		thresholdStore: normalizeThresholdStoreConfig(input.thresholdStore),
-		logger: input.logger,
-		googleOidc: normalizeGoogleOidcConfig(input.googleOidc),
-		githubOAuth: normalizeGithubOAuthConfig(input.githubOAuth)
-	};
-	validateConfigs(config);
-	return config;
-}
-function validateConfigs(config) {
-	for (const key of ["relayerAccount", "relayerPrivateKey"]) if (!config[key]) throw new Error(`Missing required config variable: ${key}`);
-	if (!config.relayerPrivateKey?.startsWith("ed25519:")) throw new Error("Relayer private key must be in format \"ed25519:base58privatekey\"");
-}
 function parseBool(v) {
 	const s = String(v ?? "").trim().toLowerCase();
 	return s === "1" || s === "true" || s === "yes" || s === "on";
@@ -105,6 +11,6 @@ function requireEnvVar(env, name) {
 	return v;
 }
 //#endregion
-export { AUTH_SERVICE_CONFIG_DEFAULTS, createAuthServiceConfig, parseBool, requireEnvVar, validateConfigs };
+export { parseBool, requireEnvVar };
 
 //# sourceMappingURL=config.js.map

package/dist/esm/core/d1EcdsaSignerRead.js

@@ -0,0 +1,76 @@
+import { isPlainObject } from "../shared-ts/src/utils/validation.js";
+import { sameRouterAbMpcMaterialActivationRef } from "../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { EcdsaMaterialReadSnapshot } from "./ecdsaMaterialReadSnapshot.js";
+import { parseWalletEcdsaSignerRecord } from "./WalletStore.js";
+import { parseD1JsonColumn } from "../storage/d1Sql.js";
+//#region src/core/d1EcdsaSignerRead.ts
+function prepareWalletEcdsaSignersRead(database, scope, walletId) {
+	return database.prepare(`SELECT record_json FROM wallet_signers
+      WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
+        AND wallet_id = ? AND signer_family = 'ecdsa'
+      ORDER BY signer_id`).bind(scope.namespace, scope.orgId, scope.projectId, scope.envId, walletId);
+}
+function parseWalletEcdsaSignerRows(rows, walletId) {
+	const signers = [];
+	for (const row of rows) {
+		const signer = parseWalletEcdsaSignerRecord(parseD1JsonColumn(row.record_json));
+		if (!signer || signer.walletId !== walletId) throw new Error("Wallet ECDSA signer record is invalid");
+		signers.push(signer);
+	}
+	return signers;
+}
+/** Parsed persistence evidence; material failures are surfaced after session validation. */
+var EcdsaMaterialRead = class EcdsaMaterialRead {
+	#result;
+	constructor(walletId, scope, activation, result, linkedSnapshot) {
+		this.walletId = walletId;
+		this.scope = scope;
+		this.activation = activation;
+		this.linkedSnapshot = linkedSnapshot;
+		this.#result = result;
+	}
+	static fromRows(scope, walletId, activation, rows, linkedSnapshot) {
+		try {
+			if (!Array.isArray(rows)) throw new Error("ECDSA material rows are invalid");
+			const storedRows = [];
+			const matches = [];
+			for (const raw of rows) {
+				if (!isPlainObject(raw) || typeof raw.record_json !== "string") throw new Error("ECDSA material row is invalid");
+				storedRows.push({ record_json: raw.record_json });
+				const signer = parseWalletEcdsaSignerRecord(parseD1JsonColumn(raw.record_json));
+				if (signer && signer.walletId === walletId && sameRouterAbMpcMaterialActivationRef(signer.walletKey.publicCapability.material_activation, activation)) matches.push(signer);
+			}
+			const signer = matches[0];
+			if (!signer) return new EcdsaMaterialRead(walletId, scope, activation, {
+				ok: true,
+				value: null
+			}, linkedSnapshot);
+			for (const other of matches) if (!signer.walletKey.keyHandle || other.walletKey.keyHandle !== signer.walletKey.keyHandle) throw new Error("Wallet has conflicting ECDSA material activations");
+			return new EcdsaMaterialRead(walletId, scope, activation, {
+				ok: true,
+				value: {
+					signer,
+					readSnapshot: EcdsaMaterialReadSnapshot.canonical(scope, walletId, activation.activation_id, storedRows)
+				}
+			}, linkedSnapshot);
+		} catch (error) {
+			return new EcdsaMaterialRead(walletId, scope, activation, {
+				ok: false,
+				message: error instanceof Error ? error.message : "ECDSA material read failed"
+			}, linkedSnapshot);
+		}
+	}
+	resolveLinked(scope, walletId, activation) {
+		this.resolve(scope, walletId, activation);
+		return this.linkedSnapshot;
+	}
+	resolve(scope, walletId, activation) {
+		if (walletId !== this.walletId || !sameRouterAbMpcMaterialActivationRef(activation, this.activation) || scope.namespace !== this.scope.namespace || scope.orgId !== this.scope.orgId || scope.projectId !== this.scope.projectId || scope.envId !== this.scope.envId) throw new Error("ECDSA material read scope does not match");
+		if (!this.#result.ok) throw new Error(this.#result.message);
+		return this.#result.value;
+	}
+};
+//#endregion
+export { EcdsaMaterialRead, parseWalletEcdsaSignerRows, prepareWalletEcdsaSignersRead };
+
+//# sourceMappingURL=d1EcdsaSignerRead.js.map

package/dist/esm/core/d1IdentityStore.js

@@ -1,5 +1,5 @@
 import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
-import "../shared-ts/src/utils/validation.js";
+import { failure } from "../shared-ts/src/utils/failure.js";
 import { d1ChangedRows } from "../storage/d1Sql.js";
 import { D1TenantTable, ensureD1Schema } from "./d1TenantStore.js";
 //#region src/core/d1IdentityStore.ts
@@ -112,16 +112,8 @@ var D1IdentityStore = class {
 		await this.table.ensureSchema();
 		const userId = normalizeOptionalTrimmedString(input.userId);
 		const subject = normalizeOptionalTrimmedString(input.subject);
-		if (!userId) return {
-			ok: false,
-			code: "invalid_args",
-			message: "Missing userId"
-		};
-		if (!subject) return {
-			ok: false,
-			code: "invalid_args",
-			message: "Missing subject"
-		};
+		if (!userId) return failure("invalid_args", "Missing userId");
+		if (!subject) return failure("invalid_args", "Missing subject");
 		const now = this.now().getTime();
 		const existing = await this.table.prepare(`SELECT user_id, created_at_ms
          FROM identity_links
@@ -135,11 +127,7 @@ var D1IdentityStore = class {
 		const existingCreatedAtMs = Number(existing?.created_at_ms);
 		const createdAtMs = Number.isFinite(existingCreatedAtMs) && existingCreatedAtMs > 0 ? Math.floor(existingCreatedAtMs) : now;
 		if (existingUserId && existingUserId !== userId) {
-			if (!input.allowMoveIfSoleIdentity) return {
-				ok: false,
-				code: "already_linked",
-				message: "Subject is already linked to a different user"
-			};
+			if (!input.allowMoveIfSoleIdentity) return failure("already_linked", "Subject is already linked to a different user");
 			if (d1ChangedRows(await this.table.database.prepare(`UPDATE identity_links
             SET user_id = ?,
                 record_json = ?,
@@ -167,16 +155,8 @@ var D1IdentityStore = class {
 				ok: true,
 				movedFromUserId: existingUserId
 			};
-			if (parseSubjectCount((await this.table.prepare(SUBJECT_COUNT_SQL, [existingUserId]).first())?.subject_count) !== 1) return {
-				ok: false,
-				code: "already_linked",
-				message: "Subject is linked to a different user with other identities; merge is not allowed"
-			};
-			return {
-				ok: false,
-				code: "already_linked",
-				message: "Subject is already linked to a different user"
-			};
+			if (parseSubjectCount((await this.table.prepare(SUBJECT_COUNT_SQL, [existingUserId]).first())?.subject_count) !== 1) return failure("already_linked", "Subject is linked to a different user with other identities; merge is not allowed");
+			return failure("already_linked", "Subject is already linked to a different user");
 		}
 		await this.table.prepare(`INSERT INTO identity_links (
         namespace,
@@ -209,31 +189,15 @@ var D1IdentityStore = class {
 		]).run();
 		const finalUserId = await this.getUserIdBySubject(subject);
 		if (finalUserId === userId) return { ok: true };
-		if (finalUserId) return {
-			ok: false,
-			code: "already_linked",
-			message: "Subject is already linked to a different user"
-		};
-		return {
-			ok: false,
-			code: "internal",
-			message: "Failed to link identity"
-		};
+		if (finalUserId) return failure("already_linked", "Subject is already linked to a different user");
+		return failure("internal", "Failed to link identity");
 	}
 	async unlinkSubjectFromUserId(input) {
 		await this.table.ensureSchema();
 		const userId = normalizeOptionalTrimmedString(input.userId);
 		const subject = normalizeOptionalTrimmedString(input.subject);
-		if (!userId) return {
-			ok: false,
-			code: "invalid_args",
-			message: "Missing userId"
-		};
-		if (!subject) return {
-			ok: false,
-			code: "invalid_args",
-			message: "Missing subject"
-		};
+		if (!userId) return failure("invalid_args", "Missing userId");
+		if (!subject) return failure("invalid_args", "Missing subject");
 		if (d1ChangedRows(await this.table.database.prepare(`DELETE FROM identity_links
             WHERE namespace = ?
               AND org_id = ?
@@ -250,44 +214,20 @@ var D1IdentityStore = class {
                    AND env_id = ?
                    AND user_id = ?
               ) > 1`).bind(this.table.scope.namespace, this.table.scope.orgId, this.table.scope.projectId, this.table.scope.envId, subject, userId, this.table.scope.namespace, this.table.scope.orgId, this.table.scope.projectId, this.table.scope.envId, userId).run()) > 0) return { ok: true };
-		if (await this.getUserIdBySubject(subject) !== userId) return {
-			ok: false,
-			code: "not_found",
-			message: "Subject is not linked to this user"
-		};
-		if (parseSubjectCount((await this.table.prepare(SUBJECT_COUNT_SQL, [userId]).first())?.subject_count) <= 1) return {
-			ok: false,
-			code: "cannot_unlink_last_identity",
-			message: "Refusing to remove the last remaining identity"
-		};
-		return {
-			ok: false,
-			code: "internal",
-			message: "Failed to unlink identity"
-		};
+		if (await this.getUserIdBySubject(subject) !== userId) return failure("not_found", "Subject is not linked to this user");
+		if (parseSubjectCount((await this.table.prepare(SUBJECT_COUNT_SQL, [userId]).first())?.subject_count) <= 1) return failure("cannot_unlink_last_identity", "Refusing to remove the last remaining identity");
+		return failure("internal", "Failed to unlink identity");
 	}
 	async deleteSubjectLinkForDevCleanup(input) {
 		await this.table.ensureSchema();
 		const userId = normalizeOptionalTrimmedString(input.userId);
 		const subject = normalizeOptionalTrimmedString(input.subject);
-		if (!userId) return {
-			ok: false,
-			code: "invalid_args",
-			message: "Missing userId"
-		};
-		if (!subject) return {
-			ok: false,
-			code: "invalid_args",
-			message: "Missing subject"
-		};
+		if (!userId) return failure("invalid_args", "Missing userId");
+		if (!subject) return failure("invalid_args", "Missing subject");
 		if (await this.deleteIdentityLink({
 			userId,
 			subject
-		}) === 0) return {
-			ok: false,
-			code: "not_found",
-			message: "Subject is not linked to this user"
-		};
+		}) === 0) return failure("not_found", "Subject is not linked to this user");
 		return { ok: true };
 	}
 	async deleteIdentityLink(input) {
@@ -301,6 +241,6 @@ var D1IdentityStore = class {
 	}
 };
 //#endregion
-export { D1IdentityStore, IDENTITY_D1_STORE, IDENTITY_STORE_D1_SCHEMA_SQL, ensureIdentityStoreD1Schema };
+export { D1IdentityStore, IDENTITY_STORE_D1_SCHEMA_SQL, ensureIdentityStoreD1Schema };
 
 //# sourceMappingURL=d1IdentityStore.js.map

package/dist/esm/core/d1TenantStore.js

@@ -1,20 +1,6 @@
 import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
-import "../shared-ts/src/utils/validation.js";
 import { formatD1ExecStatement } from "../storage/d1Sql.js";
-import "./defaultConfigsServer.js";
-import { toPrefixWithColon } from "./ThresholdService/validation.js";
 //#region src/core/d1TenantStore.ts
-/**
-* A store's key prefix, which is also its D1 namespace: the first of `explicitKeys` set in
-* `config`, else `<THRESHOLD_PREFIX>:<segment>`. It always ends with a colon.
-*/
-function resolveStorePrefix(config, explicitKeys, segment) {
-	for (const key of explicitKeys) {
-		const explicit = normalizeOptionalTrimmedString(config[key]);
-		if (explicit) return toPrefixWithColon(explicit, "");
-	}
-	return `${toPrefixWithColon(normalizeOptionalTrimmedString(config.THRESHOLD_PREFIX) || "w3a", `w3a:`)}${segment}`;
-}
 /** Requires each part of the scope; `store` ends the error, e.g. `identity store`. */
 function requireD1TenantScope(input, store) {
 	const field = (value, name) => {
@@ -29,15 +15,6 @@ function requireD1TenantScope(input, store) {
 		envId: field(input.envId, "envId")
 	};
 }
-/** The scope env-shaped store config names (`orgId` or `ORG_ID`, and so on) under `namespace`. */
-function d1TenantScopeFromConfig(config, namespace, store) {
-	return requireD1TenantScope({
-		namespace,
-		orgId: config.orgId || config.ORG_ID,
-		projectId: config.projectId || config.PROJECT_ID,
-		envId: config.envId || config.ENV_ID
-	}, store);
-}
 async function ensureD1Schema(database, statements) {
 	for (const statement of statements) await database.exec(formatD1ExecStatement(statement));
 }
@@ -77,6 +54,6 @@ var D1TenantTable = class {
 	}
 };
 //#endregion
-export { D1Schema, D1TenantTable, d1TenantScopeFromConfig, ensureD1Schema, prepareD1TenantStatement, resolveStorePrefix };
+export { D1Schema, D1TenantTable, ensureD1Schema, prepareD1TenantStatement };
 
 //# sourceMappingURL=d1TenantStore.js.map

package/dist/esm/core/d1WalletAuthMethodStore.js

@@ -3,8 +3,8 @@ import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize
 import { isPlainObject } from "../shared-ts/src/utils/validation.js";
 import { parseWalletAuthMethodRecordV2, walletAuthMethodRecordId } from "../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { D1_BATCH_CAS_GUARD_SQL, parseD1JsonColumn } from "../storage/d1Sql.js";
-import { D1Schema, D1TenantTable, ensureD1Schema } from "./d1TenantStore.js";
 import { walletIdFromString } from "../shared-ts/src/utils/registrationIds.js";
+import { D1Schema, D1TenantTable, ensureD1Schema } from "./d1TenantStore.js";
 //#region src/core/d1WalletAuthMethodStore.ts
 /** Names the wallet auth-method store in D1 scope errors. */
 const WALLET_AUTH_METHOD_D1_STORE = "wallet auth-method store";
@@ -243,9 +243,6 @@ const WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL = Object.freeze([
 async function ensureWalletAuthMethodStoreD1Schema(options) {
 	await ensureD1Schema(options.database, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL);
 }
-async function ensureWalletAuthMethodStoreD1SchemaV2(options) {
-	await ensureD1Schema(options.database, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL);
-}
 function trimString(value) {
 	return typeof value === "string" ? value.trim() : "";
 }
@@ -712,6 +709,6 @@ var D1WalletAuthMethodStore = class {
 	}
 };
 //#endregion
-export { D1WalletAuthMethodStore, WALLET_AUTH_METHOD_D1_STORE, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL, bindWalletAuthMethodIdentity, bindWalletAuthMethodIdentityV2, ensureWalletAuthMethodStoreD1Schema, ensureWalletAuthMethodStoreD1SchemaV2, normalizeWalletAuthMethod, normalizeWalletAuthMethodV2, prepareD1WalletAuthMethodInsertStatement, prepareD1WalletAuthMethodPutStatement, prepareD1WalletAuthMethodV2PutStatement, walletAuthMethodId, walletAuthMethodV2Id };
+export { D1WalletAuthMethodStore, WALLET_AUTH_METHOD_D1_STORE, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL, bindWalletAuthMethodIdentity, bindWalletAuthMethodIdentityV2, ensureWalletAuthMethodStoreD1Schema, normalizeWalletAuthMethod, normalizeWalletAuthMethodV2, prepareD1WalletAuthMethodInsertStatement, prepareD1WalletAuthMethodPutStatement, prepareD1WalletAuthMethodV2PutStatement, walletAuthMethodId, walletAuthMethodV2Id };
 
 //# sourceMappingURL=d1WalletAuthMethodStore.js.map

package/dist/esm/core/d1WalletStore.js

@@ -5,10 +5,11 @@ import { sameRouterAbMpcMaterialActivationRef } from "../shared-ts/src/utils/rou
 import { parseRouterAbEd25519YaoRecoveryActivationResultV1, parseRouterAbEd25519YaoRecoveryAdmissionRequestV1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationActivationResultV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { normalizeRuntimePolicyScope, signingRootScopeFromRuntimePolicyScope } from "../shared-ts/src/threshold/signingRootScope.js";
 import { sameRouterAbEcdsaDerivationPublicCapabilityV1 } from "../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { thresholdEcdsaChainTargetKey } from "../shared-ts/src/utils/thresholdEcdsaChainTarget.js";
+import { ecdsaPostRegistrationRequestMatchesCapability, parseWalletEcdsaPendingSessionActivationRecord, parseWalletEcdsaSignerRecord } from "./WalletStore.js";
 import { D1_BATCH_CAS_GUARD_SQL, formatD1ExecStatement, parseD1JsonColumn } from "../storage/d1Sql.js";
-import { thresholdEcdsaChainTargetKey } from "./thresholdEcdsaChainTarget.js";
+import { EcdsaMaterialRead, parseWalletEcdsaSignerRows, prepareWalletEcdsaSignersRead } from "./d1EcdsaSignerRead.js";
 import { normalizeThresholdEd25519ParticipantIds } from "../shared-ts/src/threshold/participants.js";
-import { ecdsaPostRegistrationRequestMatchesCapability, parseWalletEcdsaPendingSessionActivationRecord, parseWalletEcdsaSignerRecord } from "./WalletStore.js";
 //#region src/core/d1WalletStore.ts
 function sameD1WalletRuntimePolicyScopeV1(left, right) {
 	return left.orgId === right.orgId && left.projectId === right.projectId && left.envId === right.envId && left.signingRootVersion === right.signingRootVersion;
@@ -455,10 +456,18 @@ var D1WalletStore = class {
 		return matches[0] ?? null;
 	}
 	async getEcdsaSignerByMaterialActivation(input) {
+		return (await this.readEcdsaSignerMaterialSnapshot({
+			walletId: input.walletId,
+			materialActivation: input.materialActivation,
+			source: { kind: "database" }
+		}))?.signer ?? null;
+	}
+	async readEcdsaSignerMaterialSnapshot(input) {
+		if (input.source.kind === "credential_snapshot") return input.source.materialRead.resolve(this.scope, input.walletId, input.materialActivation);
 		await this.ensureSchema();
 		const walletId = normalizeOptionalTrimmedString(input.walletId);
 		if (!walletId) return null;
-		const matches = ((await this.database.prepare(`SELECT record_json
+		const result = await this.database.prepare(`SELECT record_json
            FROM wallet_signers
           WHERE namespace = ?
             AND org_id = ?
@@ -469,12 +478,8 @@ var D1WalletStore = class {
             AND json_extract(
               record_json,
               '$.walletKey.publicCapability.material_activation.activation_id'
-            ) = ?
-          LIMIT 4`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, walletId, input.materialActivation.activation_id).all()).results || []).map((row) => parseWalletEcdsaSignerRecord(parseD1JsonColumn(row.record_json))).filter((record) => record !== null && record.walletId === walletId && sameRouterAbMpcMaterialActivationRef(record.walletKey.publicCapability.material_activation, input.materialActivation));
-		if (matches.length === 0) return null;
-		const keyHandle = matches[0]?.walletKey.keyHandle;
-		if (!keyHandle || matches.some((record) => record.walletKey.keyHandle !== keyHandle)) throw new Error("Wallet has conflicting ECDSA material activations");
-		return matches[0] ?? null;
+            ) = ?`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, walletId, input.materialActivation.activation_id).all();
+		return EcdsaMaterialRead.fromRows(this.scope, input.walletId, input.materialActivation, result.results ?? [], null).resolve(this.scope, input.walletId, input.materialActivation);
 	}
 	async getEcdsaSignerByPostRegistrationRequest(input) {
 		await this.ensureSchema();
@@ -503,22 +508,7 @@ var D1WalletStore = class {
 	}
 	async listEcdsaSignersForWallet(input) {
 		await this.ensureSchema();
-		const result = await this.database.prepare(`SELECT record_json
-           FROM wallet_signers
-          WHERE namespace = ?
-            AND org_id = ?
-            AND project_id = ?
-            AND env_id = ?
-            AND wallet_id = ?
-            AND signer_family = 'ecdsa'
-          ORDER BY signer_id`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, input.walletId).all();
-		const signers = [];
-		for (const row of result.results || []) {
-			const signer = parseWalletEcdsaSignerRecord(parseD1JsonColumn(row.record_json));
-			if (!signer || signer.walletId !== input.walletId) throw new Error("Wallet ECDSA signer record is invalid");
-			signers.push(signer);
-		}
-		return signers;
+		return parseWalletEcdsaSignerRows((await prepareWalletEcdsaSignersRead(this.database, this.scope, input.walletId).all()).results ?? [], input.walletId);
 	}
 	async listEcdsaPendingSessionActivationsForLifecycle(input) {
 		await this.ensureSchema();

package/dist/esm/core/deviceLinking/linkedDeviceBootstrap.js

@@ -0,0 +1,13 @@
+//#region src/core/deviceLinking/linkedDeviceBootstrap.ts
+function requireLinkedDeviceBootstrapRecord(result) {
+	if (result.ok) return result.record;
+	throw Object.assign(/* @__PURE__ */ new Error("Linked-device bootstrap authority rejected the request"), { code: result.code });
+}
+function linkedDeviceBootstrapFailure(error) {
+	if (error && typeof error === "object" && "code" in error && (error.code === "home_conflict" || error.code === "home_unavailable")) return error.code;
+	return null;
+}
+//#endregion
+export { linkedDeviceBootstrapFailure, requireLinkedDeviceBootstrapRecord };
+
+//# sourceMappingURL=linkedDeviceBootstrap.js.map

package/dist/esm/core/deviceLinking/linkedDeviceEmailOtpGrant.js

@@ -4,7 +4,7 @@ import { sha256BytesUtf8 } from "../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u, sha256Utf8DigestB64u } from "../../shared-ts/src/utils/canonicalPrimitives.js";
 import { requireRecord } from "../../shared-ts/src/utils/validation.js";
 import { rejectUnknownFields } from "../../shared-ts/src/utils/exactRecord.js";
-import { parseUnixMs } from "../../shared-ts/src/passkey-custody/primitives.js";
+import { parseUnixMs, requireParsed } from "../../shared-ts/src/passkey-custody/primitives.js";
 //#region src/core/deviceLinking/linkedDeviceEmailOtpGrant.ts
 /**
 * The durable one-time Email OTP verification grant.
@@ -203,10 +203,6 @@ function requireGrantDigest(raw, label) {
 		throw new Error(`${label} ${error instanceof Error ? error.message : "is invalid"}`);
 	}
 }
-function requireParsed(parsed, label) {
-	if (!parsed.ok) throw new Error(`${label} ${parsed.error.message}`);
-	return parsed.value;
-}
 //#endregion
 export { computeLinkedDeviceEmailOtpAuthorityDigestV1, computeLinkedDeviceEmailOtpChallengeBindingDigestV1, computeLinkedDeviceEmailOtpGrantTokenDigestV1, linkedDeviceEmailOtpDescriptorCredentialIdV1, linkedDeviceEmailOtpGrantAdmitsUseV1, parseLinkedDeviceEmailOtpGrantRecordV1 };