@seams/wallet-server 0.10.1 → 0.11.0

package/dist/esm/router/cloudflare/d1/auth/d1RouterApiAuthService.js

@@ -6,15 +6,17 @@ import { D1WalletStore } from "../../../../core/d1WalletStore.js";
 import { D1WalletAuthMethodStore } from "../../../../core/d1WalletAuthMethodStore.js";
 import { normalizeLogger } from "../../../../core/logger.js";
 import { executeSignedDelegateWithRelayer } from "../../../../delegateAction/index.js";
+import { sha256BytesPortable, toRecordValue } from "./d1RouterApiAuthBoundary.js";
+import { parseD1EcdsaDerivationServerBootstrapResponse, parseD1WalletRegistrationCommittedInstallationProjection, parseD1WalletRegistrationFinalizeReplayResponse } from "../registration/d1RegistrationCeremonyRecords.js";
 import { parseWalletUnlockIssuanceRejectionCode } from "../../../framework/authServicePort.js";
 import { parseWebAuthnAuthenticationCredential } from "../../../auth/webAuthnCredentialCodecs.js";
 import { resolveActiveOwnerWalletExecutionLane, resolveWalletAuthMethodIdForAuthority } from "../../../../core/signingLanes/WalletExecutionLaneProjection.js";
 import { DEFAULT_WALLET_SESSION_TTL_MS } from "../../../../shared-ts/src/threshold/sessionPolicy.js";
 import { createDeviceLinkingOwnerRequestAuthenticatorV1 } from "../../../transport/fetch/routes/deviceLinkingOwnerAuthorization.js";
-import { sha256BytesPortable, toRecordValue } from "./d1RouterApiAuthBoundary.js";
 import { verifyD1LinkedDeviceFreshRevokeProofV1 } from "../wallet/d1WalletAuthMethodBoundary.js";
 import { D1LinkedDeviceAuthorityInstallServiceV1 } from "../deviceLinking/d1LinkedDeviceAuthorityInstallService.js";
 import { D1WalletAuthorityStore } from "../wallet/d1WalletAuthorityStore.js";
+import { createD1Ed25519YaoLifecycleRecords } from "../ed25519Yao/d1Ed25519YaoProductRegistrationPartitionedStateStore.js";
 import { parseRouterAbEd25519YaoRegistrationSideEffectRecordV2 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
 import { createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1 } from "../../signingLanes/cloudflareOrdinaryInactiveSignerMaterialReservation.js";
 import { normalizeD1RouterApiAuthOptions } from "./d1RouterApiAuthConfig.js";
@@ -24,7 +26,6 @@ import { toPublicKeyStringFromSecretKey } from "../../../../core/nearKeys.js";
 import { MinimalNearClient } from "../../../../core/rpcClients/near/NearClient.js";
 import { fundImplicitNearAccountWithRelayer } from "../../../../core/nearRelayerAccountProvisioning.js";
 import { createSponsoredNamedNearAccountForOptions } from "../near/d1SponsoredNearAccount.js";
-import { parseD1EcdsaDerivationServerBootstrapResponse, parseD1WalletRegistrationCommittedInstallationProjection, parseD1WalletRegistrationFinalizeReplayResponse } from "../registration/d1RegistrationCeremonyRecords.js";
 import { parseD1WalletAddSignerFinalizeSideEffectRecord } from "../wallet/d1WalletAddSignerFinalizeRecord.js";
 import { dispatchWalletRegistrationSetup } from "../../../framework/registrationSetupDispatch.js";
 import { readActiveWalletSessionCredential, readEd25519WalletSessionSigningRead, readExhaustedWalletSessionCredential, readWalletSessionSigningCandidate } from "./walletSessionCredentialReaders.js";
@@ -52,8 +53,8 @@ import { D1WalletAuthMethodRevocationReplayStoreV1 } from "../wallet/d1WalletAut
 import { CloudflareD1WalletAuthMethodService } from "../wallet/d1WalletAuthMethodService.js";
 import { parseWalletRegistrationSessionCommitReceiptV2 } from "../registration/walletRegistrationSessionCommitReceipt.js";
 import { CloudflareD1WalletRegistrationService } from "../registration/d1WalletRegistrationService.js";
-import { D1WalletRegistrationRead } from "../registration/d1WalletRegistrationRead.js";
 import { CloudflareD1WalletRegistrationCommitStore } from "../registration/d1WalletRegistrationCommitStore.js";
+import { D1WalletRegistrationRead } from "../registration/d1WalletRegistrationRead.js";
 import { CloudflareD1Ed25519YaoLifecycleDecisionStoreV1 } from "../ed25519Yao/d1Ed25519YaoLifecycleDecisionStore.js";
 import { createD1PasskeyCustodyRouteService } from "../passkeyCustody/d1PasskeyCustodyRouteService.js";
 import { CloudflareD1WalletRecoveryGoogleEmailOtpAttemptStore } from "../passkeyCustody/d1WalletRecoveryGoogleEmailOtpAttemptStore.js";
@@ -846,7 +847,15 @@ function createCloudflareD1RouterApiAuthAssembly(input) {
 		tenantRootCustodyLineage: options.tenantRootCustodyLineage,
 		getWalletStore,
 		activateSideEffects: walletRegistrationActivateSideEffectStore(options),
-		registrationRead: new D1WalletRegistrationRead(options.database, options.registrationAuthority ?? null, walletRegistrationNearProvisioningSideEffectStore(options), getRegistrationCeremonyIntentStore, yaoLifecycleDecisions, walletRegistrationCommitStore),
+		registrationRead: new D1WalletRegistrationRead(options.database, options.registrationAuthority ?? null, walletRegistrationNearProvisioningSideEffectStore(options), getRegistrationCeremonyIntentStore, yaoLifecycleDecisions, createD1Ed25519YaoLifecycleRecords({
+			database: options.database,
+			scope: {
+				namespace: options.namespace,
+				orgId: options.orgId,
+				projectId: options.projectId,
+				envId: options.envId
+			}
+		}), walletRegistrationCommitStore),
 		walletRegistrationCommitStore,
 		walletCustodyCommitStore,
 		walletAuthMethods,

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceOwnerAuthorizationProvider.js

@@ -11,9 +11,9 @@ import { buildEmailOtpWalletAuthAuthority, buildPasskeyWalletAuthAuthority, wall
 import { walletAuthorityDigestsMatchV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { buildWalletSessionLinkedDeviceOwnerAuthorizationV1, parseQrLinkedDeviceSessionPayloadV5 } from "../../../../shared-ts/src/device-linking/parsers.js";
 import { computeLinkedDevicePublicKeyDigestV1 } from "../../../../shared-ts/src/device-linking/requestProof.js";
+import { thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
 import { resolveActiveOwnerWalletExecutionLane, resolveWalletAuthMethodIdForAuthority } from "../../../../core/signingLanes/WalletExecutionLaneProjection.js";
 import "../../../../core/deviceLinking/requestProof.js";
-import { thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
 import { sourceKeyManifestDigestForFamilyV1 } from "../../../../core/deviceLinking/linkedDeviceSessionRecord.js";
 import { LinkedDeviceSourceFamilyUnavailableErrorV1 } from "./d1LinkedDeviceVerifiedLinkSourceReader.js";
 import { linkedDeviceSignerManifestsEqualV1 } from "./d1LinkedDeviceVerifiedLinkBuilder.js";

package/dist/esm/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoProductRegistrationPartitionedStateStore.js

@@ -4,7 +4,7 @@ import { D1WalletCeremonyActivity, ceremonySettled } from "./d1WalletCeremonyAct
 import { collectChangedStateWallets, lifecycleWriteFenceStatements } from "./d1Ed25519YaoStateWriteFence.js";
 //#region src/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoProductRegistrationPartitionedStateStore.ts
 function createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1(options) {
-	return createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1(new D1LifecycleRecords(options, createLifecycleRecords(options)));
+	return createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1(new D1LifecycleRecords(options, createD1Ed25519YaoLifecycleRecords(options)));
 }
 var D1LifecycleRecords = class {
 	constructor(options, records) {
@@ -64,7 +64,7 @@ function readPartition(value) {
 	return record;
 }
 async function evictWalletEd25519CapabilityCache(options, walletId) {
-	const records = createLifecycleRecords(options);
+	const records = createD1Ed25519YaoLifecycleRecords(options);
 	const key = ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1;
 	const current = await records.read(key);
 	if (current.kind !== "present") return;
@@ -98,7 +98,7 @@ async function evictWalletEd25519CapabilityCache(options, walletId) {
 		expectedVersion: current.version
 	}])).kind !== "stored") throw new Error("Capability cache changed during cleanup");
 }
-function createLifecycleRecords(options) {
+function createD1Ed25519YaoLifecycleRecords(options) {
 	return createCloudflareD1VersionedJsonRecordStore({
 		...options,
 		encode: identityVersionedJsonObject,
@@ -106,6 +106,6 @@ function createLifecycleRecords(options) {
 	});
 }
 //#endregion
-export { createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1, evictWalletEd25519CapabilityCache };
+export { createD1Ed25519YaoLifecycleRecords, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1, evictWalletEd25519CapabilityCache };
 
 //# sourceMappingURL=d1Ed25519YaoProductRegistrationPartitionedStateStore.js.map

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRecords.js

@@ -3,8 +3,8 @@ import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
 import "../../../../shared-ts/src/utils/encoders.js";
 import { hasExactKeys } from "../../../../shared-ts/src/utils/exactKeys.js";
 import { failure } from "../../../../shared-ts/src/utils/failure.js";
-import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_UNLOCK_OPERATION, isWalletEmailOtpLoginOperation } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { isB64uString, nonNegativeSafeInteger, parseJsonObject, positiveSafeInteger } from "../auth/d1RouterApiAuthBoundary.js";
+import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_UNLOCK_OPERATION, isWalletEmailOtpLoginOperation } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { parseCurrentEmailOtpChallengeRow, parseCurrentEmailOtpGrantRow, parseCurrentEmailOtpUnlockChallengeRow, parseEmailOtpChallengePurpose } from "../../../../core/EmailOtpRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpRecords.ts
 function maskEmail(email) {

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRecoveryService.js

@@ -2,8 +2,8 @@ import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { failedVerification, failure } from "../../../../shared-ts/src/utils/failure.js";
 import { validateSecp256k1PublicKey33, verifySecp256k1RecoverableSignatureAgainstPublicKey33 } from "../../../../core/ThresholdService/evmCryptoWasm.js";
-import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { parseD1BoundaryWalletIdResult } from "../auth/d1RouterApiAuthBoundary.js";
+import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { bytesEqual, clampedEmailOtpUnlockTtlMs, decodeFixedBase64Url, emailOtpUnlockChallengeRecord } from "./d1EmailOtpRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpRecoveryService.ts
 function errorMessage(error) {

package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpSessionResolver.js

@@ -3,8 +3,8 @@ import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { createServerAllocatedWalletId } from "../../../../shared-ts/src/utils/registrationIds.js";
-import { hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
 import { parseD1BoundaryWalletId, parseD1BoundaryWalletIdResult } from "../auth/d1RouterApiAuthBoundary.js";
+import { hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
 import { abandonedGoogleEmailOtpRegistrationAttemptRecord, expiredGoogleEmailOtpRegistrationAttemptRecord, googleEmailOtpRegistrationOfferForResponse, requireRuntimePolicyScope } from "./d1GoogleEmailOtpRegistrationRecords.js";
 import { googleEmailOtpStaleIdentityMapping, hasDifferentWalletIdentitySubject } from "../identity/d1IdentityRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpSessionResolver.ts

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore.js

@@ -40,6 +40,25 @@ var D1RegistrationCeremonyRecordStore = class {
 	prepareGet(scope, id) {
 		return this.prepareRead(this.normalizeKey(scope, id));
 	}
+	/** Load the ceremony's immutable founding identities and their current records together. */
+	prepareFoundingRecordsRead(id) {
+		const key = this.normalizeKey("ceremony", id);
+		return this.database.prepare(`
+      SELECT json_extract(ceremony.record_json, '$.foundingWalletAuthorityId') AS authority_id,
+             json_extract(ceremony.record_json, '$.foundingWalletAuthMethodId') AS auth_method_id,
+             (SELECT record_json FROM wallet_authorities
+               WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+                 AND authority_id = json_extract(ceremony.record_json, '$.foundingWalletAuthorityId'))
+               AS authority_json,
+             (SELECT record_json FROM wallet_auth_methods
+               WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+                 AND wallet_auth_method_id = json_extract(ceremony.record_json, '$.foundingWalletAuthMethodId'))
+               AS auth_method_json
+        FROM registration_ceremony_records AS ceremony
+       WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+         AND record_scope = ?5 AND record_id = ?6
+    `).bind(...this.bindKey(key));
+	}
 	async parseGet(scope, id, row) {
 		if (!row) return null;
 		const parsed = parseStoredRow(row);

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyRecords.js

@@ -20,16 +20,16 @@ import { thresholdEcdsaChainTargetFromValue } from "../../../../core/thresholdEc
 import { buildWalletEcdsaSignerRecord, parseWalletEd25519SignerRecord } from "../../../../core/d1WalletStore.js";
 import { nearEd25519SigningKeyIdFromString, walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { registrationPreparationIdFromString } from "../../../../core/types.js";
-import "../../../../shared-ts/src/signing-lanes/index.js";
-import { parsePasskeyCustodyEnvelopeRecord } from "../../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
-import "../../../../shared-ts/src/passkey-custody/index.js";
 import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../../shared-ts/src/utils/near.js";
 import { findRegistrationSignerPlanNearEd25519Branch, normalizeAddSignerSelection, normalizeRegistrationSignerPlan, registrationSignerBranchKeyFromString, registrationSignerSetSelectionFromPlan } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
+import { parseStoredRegistrationSignerPlan, parseStoredWalletRegistrationPreparedContext, storedRegistrationSignerPlansMatch } from "../../../../core/RegistrationCeremonyStore.js";
+import "../../../../shared-ts/src/signing-lanes/index.js";
 import { addAuthMethodIntentGrantFromString, addSignerIntentGrantFromString, normalizeAddAuthMethodIntentCaller } from "../../../../shared-ts/src/utils/registrationIntent.js";
+import { parsePasskeyCustodyEnvelopeRecord } from "../../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
+import "../../../../shared-ts/src/passkey-custody/index.js";
 import { parseEcdsaDerivationPublicIdentity, parseThresholdEd25519AuthorityScope, thresholdEd25519AuthorityScopeFromWalletAuthAuthority, thresholdEd25519AuthorityScopesMatch } from "../../../../core/ThresholdService/validation.js";
-import { toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";
-import { parseStoredRegistrationSignerPlan, parseStoredWalletRegistrationPreparedContext, storedRegistrationSignerPlansMatch } from "../../../../core/RegistrationCeremonyStore.js";
 import { parseStoredRouterAbEcdsaPendingActivationV1 } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
+import { toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";
 //#region src/router/cloudflare/d1/registration/d1RegistrationCeremonyRecords.ts
 function inferRuntimePolicyScopeFromSigningRoot(input) {
 	const signingRootId = normalizeOptionalTrimmedString(input.signingRootId);

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyStore.js

@@ -1,9 +1,9 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
-import { prepareD1RegistrationHomeReservation } from "./d1WalletExecutionAuthority.js";
+import { D1RegistrationCeremonyRecordStore } from "./d1RegistrationCeremonyRecordStore.js";
 import { parseD1StoredAddAuthMethodIntent, parseD1StoredAddSignerIntent, parseD1StoredWalletAddAuthMethodCeremony, parseD1StoredWalletAddAuthMethodFinalizeReplay, parseD1StoredWalletAddSignerCeremony, parseD1StoredWalletAddSignerFinalizeReplay, parseD1StoredWalletRegistrationCeremony } from "./d1RegistrationCeremonyRecords.js";
+import { prepareD1RegistrationHomeReservation } from "./d1WalletExecutionAuthority.js";
 import { retryTransientD1 } from "../../../../storage/d1Retry.js";
-import { D1RegistrationCeremonyRecordStore } from "./d1RegistrationCeremonyRecordStore.js";
 //#region src/router/cloudflare/d1/registration/d1RegistrationCeremonyStore.ts
 var CloudflareD1RegistrationCeremonyIntentStore = class {
 	constructor(input) {
@@ -47,6 +47,9 @@ var CloudflareD1RegistrationCeremonyIntentStore = class {
 	prepareCeremonyRead(registrationCeremonyId) {
 		return this.storage.prepareGet("ceremony", registrationCeremonyId);
 	}
+	prepareFoundingRecordsRead(registrationCeremonyId) {
+		return this.storage.prepareFoundingRecordsRead(registrationCeremonyId);
+	}
 	async parseCeremonyRead(registrationCeremonyId, result) {
 		return (await this.parseCeremonySnapshotRead(registrationCeremonyId, result))?.ceremony ?? null;
 	}

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationSetupSupport.js

@@ -71,6 +71,12 @@ function registrationSignerBranchesFromPlan(plan) {
 function recordRegistrationServerTiming(sink, name, startedAtMs) {
 	sink.push([name, Math.max(0, Date.now() - startedAtMs)]);
 }
+/** The `Server-Timing` header of a registration route's recorded waits. */
+function registrationServerTimingHeaders(serverTiming) {
+	if (serverTiming.length === 0) return void 0;
+	const header = serverTiming.map(([name, durationMs]) => `${name};dur=${Math.max(0, durationMs).toFixed(1)}`).join(", ");
+	return { "Server-Timing": header };
+}
 async function recordRegistrationPromiseTiming(args) {
 	try {
 		return await args.promise;
@@ -79,6 +85,6 @@ async function recordRegistrationPromiseTiming(args) {
 	}
 }
 //#endregion
-export { createD1RegistrationRouteTimingRecorder, errorMessage, finishD1RegistrationRouteTiming, recordRegistrationPromiseTiming, recordRegistrationServerTiming, registrationIntentSignerBranches, registrationPreparedContextEcdsaChainTargets, registrationSignerBranchesFromPlan, resolveRegistrationPreparedContextFromPlan, startD1RegistrationRouteTiming };
+export { createD1RegistrationRouteTimingRecorder, errorMessage, finishD1RegistrationRouteTiming, recordRegistrationPromiseTiming, recordRegistrationServerTiming, registrationIntentSignerBranches, registrationPreparedContextEcdsaChainTargets, registrationServerTimingHeaders, registrationSignerBranchesFromPlan, resolveRegistrationPreparedContextFromPlan, startD1RegistrationRouteTiming };
 
 //# sourceMappingURL=d1RegistrationSetupSupport.js.map

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationCommitStore.js

@@ -1,4 +1,4 @@
-import { mpcMaterialActivationRefsEqual, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { mpcMaterialActivationRefsEqual, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { parseWalletAuthMethodRecordV2, sameWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
@@ -123,32 +123,65 @@ function canExtendFoundingAuthorityWithEd25519(existing, next) {
 	const nextEcdsa = next.signerActivations.ecdsa;
 	return existing.signerActivations.keyFamilies.length === 1 && existing.signerActivations.keyFamilies[0] === "ecdsa_secp256k1" && next.signerActivations.keyFamilies.length === 2 && next.signerActivations.keyFamilies[0] === "ed25519" && next.signerActivations.keyFamilies[1] === "ecdsa_secp256k1" && existingEcdsa !== void 0 && nextEcdsa !== void 0 && sameWalletEcdsaSignerActivationV1(existingEcdsa, nextEcdsa) && foundingAuthorityIdentityMatches(existing, next) && next.updatedAtMs >= existing.updatedAtMs;
 }
-async function prepareFoundingStatements(input) {
-	if (!input.foundingAuthority) return [];
-	const foundingAuthMethod = requireFoundingAuthMethod(input.foundingAuthMethod);
-	const authorityRead = input.database.prepare(`SELECT record_json
+function parseRegistrationFoundingRead(result) {
+	if (!result.success) throw new Error("Registration founding records read failed");
+	const row = result.results?.[0];
+	if (!row) return null;
+	const authorityId = parseWalletAuthorityId(row.authority_id);
+	const authMethodId = parseWalletAuthMethodId(row.auth_method_id);
+	if (!authorityId.ok || !authMethodId.ok) throw new Error("Registration founding identity is invalid");
+	return {
+		kind: "snapshot",
+		records: {
+			walletAuthorityId: authorityId.value,
+			walletAuthMethodId: authMethodId.value,
+			authorityRow: row.authority_json === null ? null : { record_json: row.authority_json },
+			authMethodRow: row.auth_method_json === null ? null : { record_json: row.auth_method_json }
+		}
+	};
+}
+function readFoundingRecords(database, scope, founding) {
+	if (founding === null) return Promise.resolve(null);
+	switch (founding.kind) {
+		case "read": return readStoredFoundingRecords(database, scope, founding.ids);
+		case "snapshot": return Promise.resolve(founding.records);
+	}
+}
+async function readStoredFoundingRecords(database, scope, ids) {
+	const authorityRead = database.prepare(`SELECT record_json
          FROM wallet_authorities
         WHERE namespace = ?
           AND org_id = ?
           AND project_id = ?
           AND env_id = ?
           AND authority_id = ?
-        LIMIT 1`).bind(input.scope.namespace, input.scope.orgId, input.scope.projectId, input.scope.envId, String(input.foundingAuthority.authorityId));
-	const authMethodRead = input.database.prepare(`SELECT record_json
+        LIMIT 1`).bind(scope.namespace, scope.orgId, scope.projectId, scope.envId, String(ids.walletAuthorityId));
+	const authMethodRead = database.prepare(`SELECT record_json
          FROM wallet_auth_methods
         WHERE namespace = ?
           AND org_id = ?
           AND project_id = ?
           AND env_id = ?
           AND wallet_auth_method_id = ?
-        LIMIT 1`).bind(input.scope.namespace, input.scope.orgId, input.scope.projectId, input.scope.envId, String(foundingAuthMethod.walletAuthMethodId));
-	const results = await input.database.batch([authorityRead, authMethodRead]);
+        LIMIT 1`).bind(scope.namespace, scope.orgId, scope.projectId, scope.envId, String(ids.walletAuthMethodId));
+	const results = await database.batch([authorityRead, authMethodRead]);
 	assertBatchSucceeded({
 		expectedStatementCount: 2,
 		results
 	});
-	const authorityRow = results[0]?.results?.[0] ?? null;
-	const authMethodRow = results[1]?.results?.[0] ?? null;
+	return {
+		walletAuthorityId: ids.walletAuthorityId,
+		walletAuthMethodId: ids.walletAuthMethodId,
+		authorityRow: results[0]?.results?.[0] ?? null,
+		authMethodRow: results[1]?.results?.[0] ?? null
+	};
+}
+function prepareFoundingStatements(input) {
+	if (!input.foundingAuthority) return [];
+	const foundingAuthMethod = requireFoundingAuthMethod(input.foundingAuthMethod);
+	const { stored } = input;
+	if (!stored || String(stored.walletAuthorityId) !== String(input.foundingAuthority.authorityId) || String(stored.walletAuthMethodId) !== String(foundingAuthMethod.walletAuthMethodId)) throw new Error("A founding commit requires the records that its reservation read");
+	const { authorityRow, authMethodRow } = stored;
 	let persistedAuthority = null;
 	if (authorityRow) {
 		const parsedAuthority = parseWalletAuthorityV1(parseD1JsonColumn(authorityRow.record_json));
@@ -187,7 +220,8 @@ async function prepareFoundingStatements(input) {
 	if (!authMethodRow) statements.push(prepareD1WalletAuthMethodV2PutStatement({
 		database: input.database,
 		scope: input.scope,
-		record: foundingAuthMethod
+		record: foundingAuthMethod,
+		insertOnly: true
 	}));
 	return statements;
 }
@@ -210,13 +244,13 @@ var CloudflareD1WalletRegistrationCommitStore = class {
 		this.database = input.database;
 		this.scope = normalizeScope(input);
 	}
-	async reserveAuthority(authority, held = null) {
-		if (authority.kind === "passkey" && !heldClaimCovers(held, authority)) await reservePasskeyCredential(this.credentialClaims, {
+	async reserveAuthority(authority, held, founding) {
+		const [, stored] = await Promise.all([authority.kind === "passkey" && !heldClaimCovers(held, authority) ? reservePasskeyCredential(this.credentialClaims, {
 			walletId: authority.walletId,
 			rpId: authority.rpId,
 			credentialIdB64u: authority.credentialIdB64u
-		});
-		return this.commit.bind(this, authority);
+		}) : void 0, readFoundingRecords(this.database, this.scope, founding)]);
+		return this.commit.bind(this, authority, stored);
 	}
 	async claimPasskeyAhead(input) {
 		const { authority } = input;
@@ -259,7 +293,7 @@ var CloudflareD1WalletRegistrationCommitStore = class {
             AND env_id = ?4
             AND registration_ceremony_id = ?5`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, registrationCeremonyId).run();
 	}
-	async commit(authority, input, executeBatch) {
+	async commit(authority, stored, input, executeBatch) {
 		assertCommitWalletIdentity(input, authority);
 		const fenced = [];
 		const ed25519Signer = input.walletSigners.find(isEd25519Signer);
@@ -283,7 +317,7 @@ var CloudflareD1WalletRegistrationCommitStore = class {
 				scope: this.scope
 			}, new Set([capabilityWallet.value, input.wallet.walletId])));
 		}
-		const prepared = await prepareWalletWrite(this.database, this.scope, authority, input);
+		const prepared = prepareWalletWrite(this.database, this.scope, authority, input, stored);
 		const statements = [...fenced, ...prepared.statements];
 		const results = executeBatch ? await executeBatch(statements) : await this.database.batch(statements);
 		assertBatchSucceeded({
@@ -292,12 +326,13 @@ var CloudflareD1WalletRegistrationCommitStore = class {
 		});
 	}
 };
-async function prepareWalletWrite(database, scope, authority, input) {
-	const foundingStatements = await prepareFoundingStatements({
+function prepareWalletWrite(database, scope, authority, input, stored) {
+	const foundingStatements = prepareFoundingStatements({
 		database,
 		scope,
 		foundingAuthority: input.foundingAuthority,
 		foundingAuthMethod: input.foundingAuthMethod,
+		stored,
 		now: input.now
 	});
 	const statements = [prepareD1WalletPutSubjectStatement({
@@ -326,6 +361,6 @@ function isEd25519Signer(signer) {
 	return signer.version === "wallet_signer_ed25519_v1";
 }
 //#endregion
-export { CloudflareD1WalletRegistrationCommitStore };
+export { CloudflareD1WalletRegistrationCommitStore, parseRegistrationFoundingRead };
 
 //# sourceMappingURL=d1WalletRegistrationCommitStore.js.map

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationRead.js

@@ -1,12 +1,15 @@
+import { parseRouterAbEd25519YaoRegistrationAdmissionReadV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore.js";
+import { parseRegistrationFoundingRead } from "./d1WalletRegistrationCommitStore.js";
 //#region src/router/cloudflare/d1/registration/d1WalletRegistrationRead.ts
 /** Read admission and immutable finalization state from one D1 snapshot. */
 var D1WalletRegistrationRead = class {
-	constructor(database, authority, operations, getCeremonies, decisions, passkeyClaims) {
+	constructor(database, authority, operations, getCeremonies, decisions, yaoRecords, passkeyClaims) {
 		this.database = database;
 		this.authority = authority;
 		this.operations = operations;
 		this.getCeremonies = getCeremonies;
 		this.decisions = decisions;
+		this.yaoRecords = yaoRecords;
 		this.passkeyClaims = passkeyClaims;
 	}
 	async readRespond(home) {
@@ -39,21 +42,28 @@ var D1WalletRegistrationRead = class {
 			this.operations.prepareRead(operationKey),
 			ceremonies.prepareCeremonyRead(home.ceremonyId),
 			this.decisions.prepareRead(home.ceremonyId),
-			this.passkeyClaims.prepareHeldPasskeyClaimRead(home.ceremonyId)
+			this.passkeyClaims.prepareHeldPasskeyClaimRead(home.ceremonyId),
+			this.yaoRecords.prepareRead(home.ceremonyId),
+			ceremonies.prepareFoundingRecordsRead(home.ceremonyId)
 		]);
-		const [homeRead, operationRead, ceremonyRead, decisionRead, passkeyClaimRead] = results;
-		if (results.length !== 5 || !homeRead || !operationRead || !ceremonyRead || !decisionRead || !passkeyClaimRead) throw new Error("Registration finalization D1 batch returned incomplete results");
+		const [homeRead, operationRead, ceremonyRead, decisionRead, passkeyClaimRead, yaoRead, foundingRead] = results;
+		if (results.length !== 7 || !homeRead || !operationRead || !ceremonyRead || !decisionRead || !passkeyClaimRead || !yaoRead || !foundingRead) throw new Error("Registration finalization D1 batch returned incomplete results");
 		const admission = await this.authority.admitHomeRead(home, homeRead);
 		if (!admission.ok) return admission;
 		if (!ceremonyRead.success) throw new Error("Registration ceremony D1 read failed");
 		return {
 			ok: true,
 			operation: this.operations.parseReadResult(operationRead),
+			readFounding: parseRegistrationFoundingRead.bind(void 0, foundingRead),
 			decision: this.decisions.parseRead(home.ceremonyId, decisionRead),
 			heldPasskeyClaim: this.passkeyClaims.parseHeldPasskeyClaimRead(passkeyClaimRead),
-			readCeremony: ceremonies.parseCeremonyRead.bind(ceremonies, home.ceremonyId, ceremonyRead)
+			readCeremony: ceremonies.parseCeremonyRead.bind(ceremonies, home.ceremonyId, ceremonyRead),
+			readYaoAdmission: this.parseYaoAdmission.bind(this, home.ceremonyId, yaoRead)
 		};
 	}
+	parseYaoAdmission(ceremonyId, result) {
+		return parseRouterAbEd25519YaoRegistrationAdmissionReadV1(ceremonyId, this.yaoRecords.parseReadResult(result));
+	}
 };
 //#endregion
 export { D1WalletRegistrationRead };