@seams/wallet-server 0.10.2 → 0.12.0

package/dist/esm/localIntendedYaoSigningFault.js

@@ -1,10 +1,12 @@
-import { isLocalIntendedYaoFaultTokenV1 } from "./localIntendedYaoFault.js";
+import { assertString, requireRecord } from "./shared-ts/src/utils/validation.js";
+import { isLocalIntendedYaoFaultTokenV1, parseLocalIntendedKeptRouterRequestV1 } from "./localIntendedYaoFault.js";
 //#region src/localIntendedYaoSigningFault.ts
 const LOCAL_INTENDED_YAO_SIGNING_FAULT_HEADER_V1 = "x-seams-intended-yao-signing-fault-v1";
 const LOCAL_INTENDED_YAO_SIGNING_FAULT_TOKEN_HEADER_V1 = "x-seams-intended-yao-signing-fault-token-v1";
 const LOCAL_INTENDED_YAO_FAULT_PROOF_HEADER_V1 = "x-seams-intended-yao-fault-proof-v1";
 const ROUTER_AB_ED25519_SIGNING_FINALIZE_PATH_V1 = "/router-ab/ed25519/sign";
-const keptFinalizes = /* @__PURE__ */ new Map();
+const KEPT_FINALIZE_SCOPE = "signing-finalize";
+const KEPT_FINALIZE_TTL_MS = 600 * 1e3;
 function parseLocalIntendedYaoSigningFaultModeV1(value) {
 	switch (value) {
 		case "capture_signing_finalize":
@@ -18,10 +20,11 @@ function parseLocalIntendedYaoSigningFaultTokenV1(value) {
 }
 /** The Gateway's Router binding, keeping the first NEAR finalize it carries. */
 var LocalIntendedYaoSigningFaultControllerV1 = class {
-	constructor(baseFetch, mode, token) {
+	constructor(baseFetch, mode, token, storage) {
 		this.baseFetch = baseFetch;
 		this.mode = mode;
 		this.token = token;
+		this.storage = storage;
 		this.kept = false;
 	}
 	async fetch(input, init) {
@@ -33,7 +36,7 @@ var LocalIntendedYaoSigningFaultControllerV1 = class {
 			body: await request.clone().text()
 		};
 		if (this.mode === "withhold_signing_finalize") {
-			this.keep({
+			await this.keep({
 				request: kept,
 				original: null
 			});
@@ -44,7 +47,7 @@ var LocalIntendedYaoSigningFaultControllerV1 = class {
 			}, { status: 409 });
 		}
 		const response = await this.baseFetch.call(globalThis, request);
-		this.keep({
+		await this.keep({
 			request: kept,
 			original: {
 				status: response.status,
@@ -53,9 +56,14 @@ var LocalIntendedYaoSigningFaultControllerV1 = class {
 		});
 		return response;
 	}
-	keep(finalize) {
+	async keep(finalize) {
+		await this.storage.insertOrRead({
+			scope: KEPT_FINALIZE_SCOPE,
+			id: this.token,
+			value: finalize,
+			expiresAtMs: Date.now() + KEPT_FINALIZE_TTL_MS
+		});
 		this.kept = true;
-		if (!keptFinalizes.has(this.token)) keptFinalizes.set(this.token, finalize);
 	}
 	outcome() {
 		if (!this.kept) return `${this.token}:violated:signing_finalize_not_observed`;
@@ -63,21 +71,28 @@ var LocalIntendedYaoSigningFaultControllerV1 = class {
 	}
 };
 /** Sends the finalize kept under `token` to the Router again, exactly. */
-async function releaseLocalIntendedYaoSigningFinalizeV1(router, token) {
-	const kept = keptFinalizes.get(token);
+async function releaseLocalIntendedYaoSigningFinalizeV1(router, token, storage) {
+	const kept = await storage.take(KEPT_FINALIZE_SCOPE, token);
 	if (!kept) return Response.json({ code: "intended_signing_finalize_missing" }, { status: 404 });
-	keptFinalizes.delete(token);
-	const reply = await router.fetch(new Request(kept.request.url, {
-		method: "POST",
-		headers: kept.request.headers.map(([name, value]) => [name, value]),
-		body: kept.request.body
-	}));
+	const request = parseLocalIntendedKeptRouterRequestV1(kept.request);
+	const original = parseKeptOriginalReply(kept.original);
+	const reply = await router.fetch(request);
 	return Response.json({
 		status: reply.status,
 		body: await reply.text(),
-		original: kept.original
+		original
 	});
 }
+function parseKeptOriginalReply(value) {
+	if (value === null) return null;
+	const record = requireRecord(value, "Kept original reply");
+	const status = record.status;
+	if (typeof status !== "number" || !Number.isInteger(status) || status < 100 || status > 599) throw new Error("Kept original reply status is invalid");
+	return {
+		status,
+		body: assertString(record.body, "Kept original reply body")
+	};
+}
 function requestWithoutLocalIntendedYaoSigningFaultHeadersV1(request) {
 	const headers = new Headers(request.headers);
 	headers.delete(LOCAL_INTENDED_YAO_SIGNING_FAULT_HEADER_V1);

package/dist/esm/router/auth/routerApiKeyAuth.js

@@ -32,24 +32,12 @@ function extractRouterApiEnvironmentId(headers) {
 	if (fallback) return fallback;
 	return null;
 }
-function resolveSourceIpFromExpressRequest(input) {
-	const forwarded = readHeader(input.headers, "x-forwarded-for");
-	const realIp = readHeader(input.headers, "x-real-ip");
-	return normalizeSourceIp(forwarded || realIp || String(input.ip || ""));
-}
 function resolveSourceIpFromFetchHeaders(headers) {
 	const cfConnecting = readHeader(headers, "cf-connecting-ip");
 	const forwarded = readHeader(headers, "x-forwarded-for");
 	const realIp = readHeader(headers, "x-real-ip");
 	return normalizeSourceIp(cfConnecting || forwarded || realIp);
 }
-function resolveRequestOriginRateLimitKeyFromExpressRequest(input) {
-	const sourceIp = resolveSourceIpFromExpressRequest(input);
-	if (sourceIp) return `ip:${sourceIp}`;
-	const origin = readHeader(input.headers, "origin");
-	if (origin) return `origin:${origin}`;
-	return "origin:unknown-express";
-}
 function resolveRequestOriginRateLimitKeyFromFetchHeaders(headers) {
 	const sourceIp = resolveSourceIpFromFetchHeaders(headers);
 	if (sourceIp) return `ip:${sourceIp}`;
@@ -58,6 +46,6 @@ function resolveRequestOriginRateLimitKeyFromFetchHeaders(headers) {
 	return "origin:unknown-fetch";
 }
 //#endregion
-export { extractBearerCredential, extractRouterApiEnvironmentId, normalizeSourceIp, resolveRequestOriginRateLimitKeyFromExpressRequest, resolveRequestOriginRateLimitKeyFromFetchHeaders, resolveSourceIpFromExpressRequest, resolveSourceIpFromFetchHeaders };
+export { extractBearerCredential, extractRouterApiEnvironmentId, normalizeSourceIp, resolveRequestOriginRateLimitKeyFromFetchHeaders, resolveSourceIpFromFetchHeaders };
 
 //# sourceMappingURL=routerApiKeyAuth.js.map

package/dist/esm/router/cloudflare/d1/auth/d1RouterApiAuthService.js

@@ -6,12 +6,13 @@ import { D1WalletStore } from "../../../../core/d1WalletStore.js";
 import { D1WalletAuthMethodStore } from "../../../../core/d1WalletAuthMethodStore.js";
 import { normalizeLogger } from "../../../../core/logger.js";
 import { executeSignedDelegateWithRelayer } from "../../../../delegateAction/index.js";
+import { sha256BytesPortable, toRecordValue } from "./d1RouterApiAuthBoundary.js";
+import { parseD1EcdsaDerivationServerBootstrapResponse, parseD1WalletRegistrationCommittedInstallationProjection, parseD1WalletRegistrationFinalizeReplayResponse } from "../registration/d1RegistrationCeremonyRecords.js";
 import { parseWalletUnlockIssuanceRejectionCode } from "../../../framework/authServicePort.js";
 import { parseWebAuthnAuthenticationCredential } from "../../../auth/webAuthnCredentialCodecs.js";
 import { resolveActiveOwnerWalletExecutionLane, resolveWalletAuthMethodIdForAuthority } from "../../../../core/signingLanes/WalletExecutionLaneProjection.js";
 import { DEFAULT_WALLET_SESSION_TTL_MS } from "../../../../shared-ts/src/threshold/sessionPolicy.js";
 import { createDeviceLinkingOwnerRequestAuthenticatorV1 } from "../../../transport/fetch/routes/deviceLinkingOwnerAuthorization.js";
-import { sha256BytesPortable, toRecordValue } from "./d1RouterApiAuthBoundary.js";
 import { verifyD1LinkedDeviceFreshRevokeProofV1 } from "../wallet/d1WalletAuthMethodBoundary.js";
 import { D1LinkedDeviceAuthorityInstallServiceV1 } from "../deviceLinking/d1LinkedDeviceAuthorityInstallService.js";
 import { D1WalletAuthorityStore } from "../wallet/d1WalletAuthorityStore.js";
@@ -25,7 +26,6 @@ import { toPublicKeyStringFromSecretKey } from "../../../../core/nearKeys.js";
 import { MinimalNearClient } from "../../../../core/rpcClients/near/NearClient.js";
 import { fundImplicitNearAccountWithRelayer } from "../../../../core/nearRelayerAccountProvisioning.js";
 import { createSponsoredNamedNearAccountForOptions } from "../near/d1SponsoredNearAccount.js";
-import { parseD1EcdsaDerivationServerBootstrapResponse, parseD1WalletRegistrationCommittedInstallationProjection, parseD1WalletRegistrationFinalizeReplayResponse } from "../registration/d1RegistrationCeremonyRecords.js";
 import { parseD1WalletAddSignerFinalizeSideEffectRecord } from "../wallet/d1WalletAddSignerFinalizeRecord.js";
 import { dispatchWalletRegistrationSetup } from "../../../framework/registrationSetupDispatch.js";
 import { readActiveWalletSessionCredential, readEd25519WalletSessionSigningRead, readExhaustedWalletSessionCredential, readWalletSessionSigningCandidate } from "./walletSessionCredentialReaders.js";
@@ -53,8 +53,8 @@ import { D1WalletAuthMethodRevocationReplayStoreV1 } from "../wallet/d1WalletAut
 import { CloudflareD1WalletAuthMethodService } from "../wallet/d1WalletAuthMethodService.js";
 import { parseWalletRegistrationSessionCommitReceiptV2 } from "../registration/walletRegistrationSessionCommitReceipt.js";
 import { CloudflareD1WalletRegistrationService } from "../registration/d1WalletRegistrationService.js";
-import { D1WalletRegistrationRead } from "../registration/d1WalletRegistrationRead.js";
 import { CloudflareD1WalletRegistrationCommitStore } from "../registration/d1WalletRegistrationCommitStore.js";
+import { D1WalletRegistrationRead } from "../registration/d1WalletRegistrationRead.js";
 import { CloudflareD1Ed25519YaoLifecycleDecisionStoreV1 } from "../ed25519Yao/d1Ed25519YaoLifecycleDecisionStore.js";
 import { createD1PasskeyCustodyRouteService } from "../passkeyCustody/d1PasskeyCustodyRouteService.js";
 import { CloudflareD1WalletRecoveryGoogleEmailOtpAttemptStore } from "../passkeyCustody/d1WalletRecoveryGoogleEmailOtpAttemptStore.js";

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceOwnerAuthorizationProvider.js

@@ -11,9 +11,9 @@ import { buildEmailOtpWalletAuthAuthority, buildPasskeyWalletAuthAuthority, wall
 import { walletAuthorityDigestsMatchV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { buildWalletSessionLinkedDeviceOwnerAuthorizationV1, parseQrLinkedDeviceSessionPayloadV5 } from "../../../../shared-ts/src/device-linking/parsers.js";
 import { computeLinkedDevicePublicKeyDigestV1 } from "../../../../shared-ts/src/device-linking/requestProof.js";
+import { thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
 import { resolveActiveOwnerWalletExecutionLane, resolveWalletAuthMethodIdForAuthority } from "../../../../core/signingLanes/WalletExecutionLaneProjection.js";
 import "../../../../core/deviceLinking/requestProof.js";
-import { thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
 import { sourceKeyManifestDigestForFamilyV1 } from "../../../../core/deviceLinking/linkedDeviceSessionRecord.js";
 import { LinkedDeviceSourceFamilyUnavailableErrorV1 } from "./d1LinkedDeviceVerifiedLinkSourceReader.js";
 import { linkedDeviceSignerManifestsEqualV1 } from "./d1LinkedDeviceVerifiedLinkBuilder.js";

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRecords.js

@@ -3,8 +3,8 @@ import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
 import "../../../../shared-ts/src/utils/encoders.js";
 import { hasExactKeys } from "../../../../shared-ts/src/utils/exactKeys.js";
 import { failure } from "../../../../shared-ts/src/utils/failure.js";
-import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_UNLOCK_OPERATION, isWalletEmailOtpLoginOperation } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { isB64uString, nonNegativeSafeInteger, parseJsonObject, positiveSafeInteger } from "../auth/d1RouterApiAuthBoundary.js";
+import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_UNLOCK_OPERATION, isWalletEmailOtpLoginOperation } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { parseCurrentEmailOtpChallengeRow, parseCurrentEmailOtpGrantRow, parseCurrentEmailOtpUnlockChallengeRow, parseEmailOtpChallengePurpose } from "../../../../core/EmailOtpRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpRecords.ts
 function maskEmail(email) {

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRecoveryService.js

@@ -2,8 +2,8 @@ import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { failedVerification, failure } from "../../../../shared-ts/src/utils/failure.js";
 import { validateSecp256k1PublicKey33, verifySecp256k1RecoverableSignatureAgainstPublicKey33 } from "../../../../core/ThresholdService/evmCryptoWasm.js";
-import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { parseD1BoundaryWalletIdResult } from "../auth/d1RouterApiAuthBoundary.js";
+import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { bytesEqual, clampedEmailOtpUnlockTtlMs, decodeFixedBase64Url, emailOtpUnlockChallengeRecord } from "./d1EmailOtpRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpRecoveryService.ts
 function errorMessage(error) {

package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpSessionResolver.js

@@ -3,8 +3,8 @@ import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { createServerAllocatedWalletId } from "../../../../shared-ts/src/utils/registrationIds.js";
-import { hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
 import { parseD1BoundaryWalletId, parseD1BoundaryWalletIdResult } from "../auth/d1RouterApiAuthBoundary.js";
+import { hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
 import { abandonedGoogleEmailOtpRegistrationAttemptRecord, expiredGoogleEmailOtpRegistrationAttemptRecord, googleEmailOtpRegistrationOfferForResponse, requireRuntimePolicyScope } from "./d1GoogleEmailOtpRegistrationRecords.js";
 import { googleEmailOtpStaleIdentityMapping, hasDifferentWalletIdentitySubject } from "../identity/d1IdentityRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpSessionResolver.ts

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore.js

@@ -40,6 +40,25 @@ var D1RegistrationCeremonyRecordStore = class {
 	prepareGet(scope, id) {
 		return this.prepareRead(this.normalizeKey(scope, id));
 	}
+	/** Load the ceremony's immutable founding identities and their current records together. */
+	prepareFoundingRecordsRead(id) {
+		const key = this.normalizeKey("ceremony", id);
+		return this.database.prepare(`
+      SELECT json_extract(ceremony.record_json, '$.foundingWalletAuthorityId') AS authority_id,
+             json_extract(ceremony.record_json, '$.foundingWalletAuthMethodId') AS auth_method_id,
+             (SELECT record_json FROM wallet_authorities
+               WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+                 AND authority_id = json_extract(ceremony.record_json, '$.foundingWalletAuthorityId'))
+               AS authority_json,
+             (SELECT record_json FROM wallet_auth_methods
+               WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+                 AND wallet_auth_method_id = json_extract(ceremony.record_json, '$.foundingWalletAuthMethodId'))
+               AS auth_method_json
+        FROM registration_ceremony_records AS ceremony
+       WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+         AND record_scope = ?5 AND record_id = ?6
+    `).bind(...this.bindKey(key));
+	}
 	async parseGet(scope, id, row) {
 		if (!row) return null;
 		const parsed = parseStoredRow(row);

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyRecords.js

@@ -20,16 +20,16 @@ import { thresholdEcdsaChainTargetFromValue } from "../../../../core/thresholdEc
 import { buildWalletEcdsaSignerRecord, parseWalletEd25519SignerRecord } from "../../../../core/d1WalletStore.js";
 import { nearEd25519SigningKeyIdFromString, walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { registrationPreparationIdFromString } from "../../../../core/types.js";
-import "../../../../shared-ts/src/signing-lanes/index.js";
-import { parsePasskeyCustodyEnvelopeRecord } from "../../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
-import "../../../../shared-ts/src/passkey-custody/index.js";
 import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../../shared-ts/src/utils/near.js";
 import { findRegistrationSignerPlanNearEd25519Branch, normalizeAddSignerSelection, normalizeRegistrationSignerPlan, registrationSignerBranchKeyFromString, registrationSignerSetSelectionFromPlan } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
+import { parseStoredRegistrationSignerPlan, parseStoredWalletRegistrationPreparedContext, storedRegistrationSignerPlansMatch } from "../../../../core/RegistrationCeremonyStore.js";
+import "../../../../shared-ts/src/signing-lanes/index.js";
 import { addAuthMethodIntentGrantFromString, addSignerIntentGrantFromString, normalizeAddAuthMethodIntentCaller } from "../../../../shared-ts/src/utils/registrationIntent.js";
+import { parsePasskeyCustodyEnvelopeRecord } from "../../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
+import "../../../../shared-ts/src/passkey-custody/index.js";
 import { parseEcdsaDerivationPublicIdentity, parseThresholdEd25519AuthorityScope, thresholdEd25519AuthorityScopeFromWalletAuthAuthority, thresholdEd25519AuthorityScopesMatch } from "../../../../core/ThresholdService/validation.js";
-import { toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";
-import { parseStoredRegistrationSignerPlan, parseStoredWalletRegistrationPreparedContext, storedRegistrationSignerPlansMatch } from "../../../../core/RegistrationCeremonyStore.js";
 import { parseStoredRouterAbEcdsaPendingActivationV1 } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
+import { toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";
 //#region src/router/cloudflare/d1/registration/d1RegistrationCeremonyRecords.ts
 function inferRuntimePolicyScopeFromSigningRoot(input) {
 	const signingRootId = normalizeOptionalTrimmedString(input.signingRootId);

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyStore.js

@@ -1,9 +1,9 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
-import { prepareD1RegistrationHomeReservation } from "./d1WalletExecutionAuthority.js";
+import { D1RegistrationCeremonyRecordStore } from "./d1RegistrationCeremonyRecordStore.js";
 import { parseD1StoredAddAuthMethodIntent, parseD1StoredAddSignerIntent, parseD1StoredWalletAddAuthMethodCeremony, parseD1StoredWalletAddAuthMethodFinalizeReplay, parseD1StoredWalletAddSignerCeremony, parseD1StoredWalletAddSignerFinalizeReplay, parseD1StoredWalletRegistrationCeremony } from "./d1RegistrationCeremonyRecords.js";
+import { prepareD1RegistrationHomeReservation } from "./d1WalletExecutionAuthority.js";
 import { retryTransientD1 } from "../../../../storage/d1Retry.js";
-import { D1RegistrationCeremonyRecordStore } from "./d1RegistrationCeremonyRecordStore.js";
 //#region src/router/cloudflare/d1/registration/d1RegistrationCeremonyStore.ts
 var CloudflareD1RegistrationCeremonyIntentStore = class {
 	constructor(input) {
@@ -47,6 +47,9 @@ var CloudflareD1RegistrationCeremonyIntentStore = class {
 	prepareCeremonyRead(registrationCeremonyId) {
 		return this.storage.prepareGet("ceremony", registrationCeremonyId);
 	}
+	prepareFoundingRecordsRead(registrationCeremonyId) {
+		return this.storage.prepareFoundingRecordsRead(registrationCeremonyId);
+	}
 	async parseCeremonyRead(registrationCeremonyId, result) {
 		return (await this.parseCeremonySnapshotRead(registrationCeremonyId, result))?.ceremony ?? null;
 	}

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationSetupSupport.js

@@ -71,6 +71,12 @@ function registrationSignerBranchesFromPlan(plan) {
 function recordRegistrationServerTiming(sink, name, startedAtMs) {
 	sink.push([name, Math.max(0, Date.now() - startedAtMs)]);
 }
+/** The `Server-Timing` header of a registration route's recorded waits. */
+function registrationServerTimingHeaders(serverTiming) {
+	if (serverTiming.length === 0) return void 0;
+	const header = serverTiming.map(([name, durationMs]) => `${name};dur=${Math.max(0, durationMs).toFixed(1)}`).join(", ");
+	return { "Server-Timing": header };
+}
 async function recordRegistrationPromiseTiming(args) {
 	try {
 		return await args.promise;
@@ -79,6 +85,6 @@ async function recordRegistrationPromiseTiming(args) {
 	}
 }
 //#endregion
-export { createD1RegistrationRouteTimingRecorder, errorMessage, finishD1RegistrationRouteTiming, recordRegistrationPromiseTiming, recordRegistrationServerTiming, registrationIntentSignerBranches, registrationPreparedContextEcdsaChainTargets, registrationSignerBranchesFromPlan, resolveRegistrationPreparedContextFromPlan, startD1RegistrationRouteTiming };
+export { createD1RegistrationRouteTimingRecorder, errorMessage, finishD1RegistrationRouteTiming, recordRegistrationPromiseTiming, recordRegistrationServerTiming, registrationIntentSignerBranches, registrationPreparedContextEcdsaChainTargets, registrationServerTimingHeaders, registrationSignerBranchesFromPlan, resolveRegistrationPreparedContextFromPlan, startD1RegistrationRouteTiming };
 
 //# sourceMappingURL=d1RegistrationSetupSupport.js.map

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationCommitStore.js

@@ -1,4 +1,4 @@
-import { mpcMaterialActivationRefsEqual, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { mpcMaterialActivationRefsEqual, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { parseWalletAuthMethodRecordV2, sameWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
@@ -123,6 +123,30 @@ function canExtendFoundingAuthorityWithEd25519(existing, next) {
 	const nextEcdsa = next.signerActivations.ecdsa;
 	return existing.signerActivations.keyFamilies.length === 1 && existing.signerActivations.keyFamilies[0] === "ecdsa_secp256k1" && next.signerActivations.keyFamilies.length === 2 && next.signerActivations.keyFamilies[0] === "ed25519" && next.signerActivations.keyFamilies[1] === "ecdsa_secp256k1" && existingEcdsa !== void 0 && nextEcdsa !== void 0 && sameWalletEcdsaSignerActivationV1(existingEcdsa, nextEcdsa) && foundingAuthorityIdentityMatches(existing, next) && next.updatedAtMs >= existing.updatedAtMs;
 }
+function parseRegistrationFoundingRead(result) {
+	if (!result.success) throw new Error("Registration founding records read failed");
+	const row = result.results?.[0];
+	if (!row) return null;
+	const authorityId = parseWalletAuthorityId(row.authority_id);
+	const authMethodId = parseWalletAuthMethodId(row.auth_method_id);
+	if (!authorityId.ok || !authMethodId.ok) throw new Error("Registration founding identity is invalid");
+	return {
+		kind: "snapshot",
+		records: {
+			walletAuthorityId: authorityId.value,
+			walletAuthMethodId: authMethodId.value,
+			authorityRow: row.authority_json === null ? null : { record_json: row.authority_json },
+			authMethodRow: row.auth_method_json === null ? null : { record_json: row.auth_method_json }
+		}
+	};
+}
+function readFoundingRecords(database, scope, founding) {
+	if (founding === null) return Promise.resolve(null);
+	switch (founding.kind) {
+		case "read": return readStoredFoundingRecords(database, scope, founding.ids);
+		case "snapshot": return Promise.resolve(founding.records);
+	}
+}
 async function readStoredFoundingRecords(database, scope, ids) {
 	const authorityRead = database.prepare(`SELECT record_json
          FROM wallet_authorities
@@ -196,7 +220,8 @@ function prepareFoundingStatements(input) {
 	if (!authMethodRow) statements.push(prepareD1WalletAuthMethodV2PutStatement({
 		database: input.database,
 		scope: input.scope,
-		record: foundingAuthMethod
+		record: foundingAuthMethod,
+		insertOnly: true
 	}));
 	return statements;
 }
@@ -224,7 +249,7 @@ var CloudflareD1WalletRegistrationCommitStore = class {
 			walletId: authority.walletId,
 			rpId: authority.rpId,
 			credentialIdB64u: authority.credentialIdB64u
-		}) : void 0, founding ? readStoredFoundingRecords(this.database, this.scope, founding) : null]);
+		}) : void 0, readFoundingRecords(this.database, this.scope, founding)]);
 		return this.commit.bind(this, authority, stored);
 	}
 	async claimPasskeyAhead(input) {
@@ -336,6 +361,6 @@ function isEd25519Signer(signer) {
 	return signer.version === "wallet_signer_ed25519_v1";
 }
 //#endregion
-export { CloudflareD1WalletRegistrationCommitStore };
+export { CloudflareD1WalletRegistrationCommitStore, parseRegistrationFoundingRead };
 
 //# sourceMappingURL=d1WalletRegistrationCommitStore.js.map

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationRead.js

@@ -1,4 +1,5 @@
 import { parseRouterAbEd25519YaoRegistrationAdmissionReadV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore.js";
+import { parseRegistrationFoundingRead } from "./d1WalletRegistrationCommitStore.js";
 //#region src/router/cloudflare/d1/registration/d1WalletRegistrationRead.ts
 /** Read admission and immutable finalization state from one D1 snapshot. */
 var D1WalletRegistrationRead = class {
@@ -42,16 +43,18 @@ var D1WalletRegistrationRead = class {
 			ceremonies.prepareCeremonyRead(home.ceremonyId),
 			this.decisions.prepareRead(home.ceremonyId),
 			this.passkeyClaims.prepareHeldPasskeyClaimRead(home.ceremonyId),
-			this.yaoRecords.prepareRead(home.ceremonyId)
+			this.yaoRecords.prepareRead(home.ceremonyId),
+			ceremonies.prepareFoundingRecordsRead(home.ceremonyId)
 		]);
-		const [homeRead, operationRead, ceremonyRead, decisionRead, passkeyClaimRead, yaoRead] = results;
-		if (results.length !== 6 || !homeRead || !operationRead || !ceremonyRead || !decisionRead || !passkeyClaimRead || !yaoRead) throw new Error("Registration finalization D1 batch returned incomplete results");
+		const [homeRead, operationRead, ceremonyRead, decisionRead, passkeyClaimRead, yaoRead, foundingRead] = results;
+		if (results.length !== 7 || !homeRead || !operationRead || !ceremonyRead || !decisionRead || !passkeyClaimRead || !yaoRead || !foundingRead) throw new Error("Registration finalization D1 batch returned incomplete results");
 		const admission = await this.authority.admitHomeRead(home, homeRead);
 		if (!admission.ok) return admission;
 		if (!ceremonyRead.success) throw new Error("Registration ceremony D1 read failed");
 		return {
 			ok: true,
 			operation: this.operations.parseReadResult(operationRead),
+			readFounding: parseRegistrationFoundingRead.bind(void 0, foundingRead),
 			decision: this.decisions.parseRead(home.ceremonyId, decisionRead),
 			heldPasskeyClaim: this.passkeyClaims.parseHeldPasskeyClaimRead(passkeyClaimRead),
 			readCeremony: ceremonies.parseCeremonyRead.bind(ceremonies, home.ceremonyId, ceremonyRead),

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationService.js

@@ -20,34 +20,34 @@ import { buildActiveWalletAuthorityV1, buildWalletSignerActivationSetV1, compute
 import { ROUTER_AB_ED25519_NORMAL_SIGNING_STATE_KIND } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
 import { normalizeThresholdEd25519ParticipantIds } from "../../../../shared-ts/src/threshold/participants.js";
 import { nearEd25519SigningKeyIdFromString, registrationEd25519AuthorityScopeFromAuthority, walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
-import { walletCustodyCeremonyCommitPayloadFromWire } from "../../../../shared-ts/src/passkey-custody/ceremonyCommitPayload.js";
-import "../../../../shared-ts/src/passkey-custody/index.js";
+import { admitRegistrationReservationHome, cancelRegistrationHome } from "../../../domains/walletRegistration/walletRegistrationReservation.js";
 import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../../shared-ts/src/utils/near.js";
 import { registrationNearEd25519BranchKey } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
+import { buildStoredWalletRegistrationEvmFamilyEcdsaFinalizedBranch, buildStoredWalletRegistrationNearEd25519YaoAuthorizedBranch, findStoredWalletRegistrationEvmFamilyEcdsaBranch, findStoredWalletRegistrationNearEd25519YaoBranch, replaceStoredWalletRegistrationSignerBranch, storedRegistrationAuthoritiesMatch, verifiedRegistrationCeremonyAuthority } from "../../../../core/RegistrationCeremonyStore.js";
 import { registrationIntentGrantFromString } from "../../../../shared-ts/src/utils/registrationIntent.js";
+import { walletCustodyCeremonyCommitPayloadFromWire } from "../../../../shared-ts/src/passkey-custody/ceremonyCommitPayload.js";
+import "../../../../shared-ts/src/passkey-custody/index.js";
+import { parseEcdsaDerivationPublicIdentity, thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
 import { createRouterAbTraceContextV1 } from "../../../../shared-ts/src/utils/routerAbTraceContext.js";
+import { routerAbEcdsaStrictRegistrationRequestBindingJson } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
+import { buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, buildD1WalletRecord, parseWalletIdForIntent, thresholdEcdsaChainTargetsEqual } from "./d1RegistrationCeremonyRecords.js";
+import { createD1RegistrationRouteTimingRecorder, errorMessage, finishD1RegistrationRouteTiming, recordRegistrationPromiseTiming, recordRegistrationServerTiming, registrationSignerBranchesFromPlan, startD1RegistrationRouteTiming } from "./d1RegistrationSetupSupport.js";
 import { buildTenantRootIdentityFromAuthenticatedDeploymentV1 } from "../../../../shared-ts/src/tenant-root/tenantRootIdentity.js";
 import { DEFAULT_WALLET_SESSION_TTL_MS } from "../../../../shared-ts/src/threshold/sessionPolicy.js";
-import { parseEcdsaDerivationPublicIdentity, thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
 import { walletAuthAuthorityFromRegistrationAuthority, walletRegistrationFinalizeAuthMethodFromAuthority } from "../wallet/d1WalletAuthMethodBoundary.js";
 import { buildRouterAbEd25519YaoRegistrationCapabilityRecordV1 } from "../../../domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery.js";
 import { buildRouterAbEd25519YaoProductAdmissionRequestV1, projectRouterAbEd25519YaoExactWalletSession } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js";
 import { routerAbEd25519YaoRegistrationExecutionTimingEntriesV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationRequestScopedCloudflare.js";
 import { runRouterAbEd25519YaoRegistrationSideEffectV2, throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
 import { buildYaoEd25519WalletSignerRecord, ed25519NearPublicKeyFromBytes, implicitNearAccountIdFromEd25519PublicKeyBytes } from "../ed25519Yao/d1Ed25519YaoWalletSigner.js";
-import { buildStoredWalletRegistrationEvmFamilyEcdsaFinalizedBranch, buildStoredWalletRegistrationNearEd25519YaoAuthorizedBranch, findStoredWalletRegistrationEvmFamilyEcdsaBranch, findStoredWalletRegistrationNearEd25519YaoBranch, replaceStoredWalletRegistrationSignerBranch, storedRegistrationAuthoritiesMatch, verifiedRegistrationCeremonyAuthority } from "../../../../core/RegistrationCeremonyStore.js";
-import { routerAbEcdsaStrictRegistrationRequestBindingJson } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
-import { buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, buildD1WalletRecord, parseWalletIdForIntent, thresholdEcdsaChainTargetsEqual } from "./d1RegistrationCeremonyRecords.js";
 import { deriveThresholdEcdsaKeyHandle } from "../../../../shared-ts/src/utils/thresholdEcdsaKeyHandle.js";
 import { isTransientD1Error, retryTransientD1 } from "../../../../storage/d1Retry.js";
-import { admitRegistrationReservationHome, cancelRegistrationHome } from "../../../domains/walletRegistration/walletRegistrationReservation.js";
 import { listThresholdEcdsaKeyIdentityTargetsForUser } from "../../../../core/authService/thresholdEcdsaKeyInventory.js";
 import { routerAbEd25519YaoLifecycleDecisionLookupV1, routerAbEd25519YaoLifecycleDecisionV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoLifecycleDecision.js";
 import { reserveRegistrationCustody } from "../../../domains/passkeyCustody/registrationCustodyOutcome.js";
 import { resolveTenantRootIdentityV1 } from "../../../domains/tenantRoot/tenantRootIdentityResolution.js";
 import { walletRegistrationOperationPreparedFromCeremony } from "./d1WalletRegistrationPreparation.js";
 import { computeWalletRegistrationSetupDigestB64u, parseWalletRegistrationSetupClaims, verifySignedWalletRegistrationSetup, verifyWalletRegistrationSetupClaims } from "../../../domains/walletRegistration/walletRegistrationSetupPayload.js";
-import { createD1RegistrationRouteTimingRecorder, errorMessage, finishD1RegistrationRouteTiming, recordRegistrationPromiseTiming, recordRegistrationServerTiming, registrationSignerBranchesFromPlan, startD1RegistrationRouteTiming } from "./d1RegistrationSetupSupport.js";
 import { projectWalletRegistrationSessionCommitReceiptV2, registrationCommitActivation, registrationReplayAuthMethodFields, replayedRegistrationCommit, unissuedRegistrationCommit } from "./walletRegistrationSessionCommitReceipt.js";
 import { assertDirectWalletSessionOwnerProof, buildRegistrationOwnerProof, issueDirectRegistrationEstablishedEcdsaSession, issueDirectRegistrationEstablishedEd25519Session, projectCurrentNearRegistrationSession, replayDirectRegistrationEstablishedEcdsaSession, replayDirectRegistrationEstablishedEd25519Session, walletSessionPrincipalId } from "./walletRegistrationEstablishedSessionIssuer.js";
 import { commitWalletRegistration } from "./d1WalletRegistrationInitialSession.js";
@@ -2154,7 +2154,7 @@ var CloudflareD1WalletRegistrationService = class {
 		}, effectivePrepared, source, args.serverTiming, initialSessionPlan, args.lifecycleDecision, args.heldPasskeyClaim, {
 			kind: "snapshot",
 			authority: args.readYaoAdmission()
-		});
+		}, args.readFounding());
 		if (!execution.ok) return unissuedRegistrationCommit(throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1(execution));
 		const finalized = execution.finalized;
 		if (finalized.kind !== "near_ed25519") {
@@ -2357,22 +2357,29 @@ var CloudflareD1WalletRegistrationService = class {
 			};
 			const admissionStartedAtMs = Date.now();
 			const operationKey = `near-provisioning:${input.registrationCeremonyId}:${input.idempotencyKey}`;
-			const initial = await this.registrationRead.readFinalization({
-				ceremonyId: verified.claims.registrationCeremonyId,
-				walletId: walletIdFromString(verified.claims.walletId)
-			}, operationKey);
-			recordRegistrationServerTiming(serverTiming, "near_finalize_initial_read", admissionStartedAtMs);
+			const [initial, requestFingerprintBytes] = await Promise.all([recordRegistrationPromiseTiming({
+				sink: serverTiming,
+				name: "near_finalize_initial_read",
+				startedAtMs: admissionStartedAtMs,
+				promise: this.registrationRead.readFinalization({
+					ceremonyId: verified.claims.registrationCeremonyId,
+					walletId: walletIdFromString(verified.claims.walletId)
+				}, operationKey)
+			}), recordRegistrationPromiseTiming({
+				sink: serverTiming,
+				name: "near_finalize_fingerprint",
+				startedAtMs: Date.now(),
+				promise: sha256BytesUtf8(alphabetizeStringify({
+					version: "wallet_registration_near_provisioning_digest_v1",
+					registrationCeremonyId: input.registrationCeremonyId,
+					setupDigestB64u: verified.claims.setupDigestB64u,
+					idempotencyKey: input.idempotencyKey,
+					ed25519: input.ed25519,
+					emailOtpEnrollment: input.emailOtpEnrollment
+				}))
+			})]);
 			if (!initial.ok) return initial;
-			const fingerprintStartedAtMs = Date.now();
-			const requestFingerprint = base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
-				version: "wallet_registration_near_provisioning_digest_v1",
-				registrationCeremonyId: input.registrationCeremonyId,
-				setupDigestB64u: verified.claims.setupDigestB64u,
-				idempotencyKey: input.idempotencyKey,
-				ed25519: input.ed25519,
-				emailOtpEnrollment: input.emailOtpEnrollment
-			})));
-			recordRegistrationServerTiming(serverTiming, "near_finalize_fingerprint", fingerprintStartedAtMs);
+			const requestFingerprint = base64UrlEncode(requestFingerprintBytes);
 			const sideEffectStartedAtMs = Date.now();
 			let preparedCeremony = null;
 			const run = await runRouterAbEd25519YaoRegistrationSideEffectV2(this.registrationRead.operations, {
@@ -2403,7 +2410,8 @@ var CloudflareD1WalletRegistrationService = class {
 					preparedCeremony: () => preparedCeremony,
 					lifecycleDecision: initial.decision,
 					heldPasskeyClaim: initial.heldPasskeyClaim,
-					readYaoAdmission: initial.readYaoAdmission
+					readYaoAdmission: initial.readYaoAdmission,
+					readFounding: initial.readFounding
 				}),
 				projectReceipt: (execution) => projectWalletRegistrationSessionCommitReceiptV2({
 					operation: "near_provisioning",
@@ -2553,6 +2561,7 @@ var CloudflareD1WalletRegistrationService = class {
 		const ceremony = input.ceremony;
 		const stored = storedRespondEd25519DeferredWork(ceremony.signerState);
 		let authority;
+		const authorityStartedAtMs = Date.now();
 		if (stored) {
 			const replayAuthority = await this.verifyRespondReplayAuthority({
 				ceremony,
@@ -2586,6 +2595,7 @@ var CloudflareD1WalletRegistrationService = class {
 			};
 			authority = verified.authority;
 		}
+		recordRegistrationServerTiming(input.serverTiming, "respond_authority_verify", authorityStartedAtMs);
 		if (authority.walletId !== ceremony.intent.walletId) return {
 			ok: false,
 			code: "scope_mismatch",
@@ -2597,12 +2607,14 @@ var CloudflareD1WalletRegistrationService = class {
 			code: "not_configured",
 			message: "Ed25519 Yao registration is unavailable"
 		};
+		const requestStartedAtMs = Date.now();
 		const admissionRequest = stored ? stored.admissionRequest : await buildRespondEd25519AdmissionRequest({
 			ceremony,
 			branch: input.branch,
 			authority,
 			signingWorkerId: runtime.signingWorkerId
 		});
+		recordRegistrationServerTiming(input.serverTiming, "yao_admission_request", requestStartedAtMs);
 		const verifiedAuthority = authority;
 		const branchKey = input.branch.branchKey;
 		const ceremonyStore = this.getRegistrationCeremonyIntentStore();
@@ -2620,6 +2632,7 @@ var CloudflareD1WalletRegistrationService = class {
 				})]
 			}
 		});
+		const bindStartedAtMs = Date.now();
 		const admitted = await runtime.bindAndAdmitVerifiedRegistration({
 			kind: "verified_registration_intent",
 			ownershipGeneration: input.ownershipGeneration,
@@ -2631,6 +2644,7 @@ var CloudflareD1WalletRegistrationService = class {
 			expected: input.snapshot,
 			next: authorizedCeremony(bound)
 		}), input.startedDispatchRoot, requireRegistrationEd25519YaoMint(ceremony).sessionId);
+		recordRegistrationServerTiming(input.serverTiming, "yao_admission_bind", bindStartedAtMs);
 		if (!admitted.ok) return {
 			ok: false,
 			code: admitted.code,
@@ -2638,6 +2652,7 @@ var CloudflareD1WalletRegistrationService = class {
 		};
 		if (!stored && admitted.companionWrite === "not_committed") {
 			const next = authorizedCeremony(admitted.admissionRequest);
+			const commitStartedAtMs = Date.now();
 			try {
 				await ceremonyStore.commitEcdsaClaim({
 					expected: input.snapshot,
@@ -2647,6 +2662,7 @@ var CloudflareD1WalletRegistrationService = class {
 				const committed = await ceremonyStore.getCeremony(ceremony.registrationCeremonyId);
 				if (!committed || alphabetizeStringify(committed) !== alphabetizeStringify(next)) throw error;
 			}
+			recordRegistrationServerTiming(input.serverTiming, "respond_ceremony_commit", commitStartedAtMs);
 		}
 		if (!stored && input.waitUntil && verifiedAuthority.kind === "passkey") input.waitUntil(this.walletRegistrationCommitStore.claimPasskeyAhead({
 			registrationCeremonyId: ceremony.registrationCeremonyId,
@@ -2901,7 +2917,7 @@ var CloudflareD1WalletRegistrationService = class {
 		}, prepared, {
 			kind: "stored_ceremony",
 			ceremony: activatedCeremony
-		}, [], { kind: "separate" }, null, null, { kind: "stored" });
+		}, [], { kind: "separate" }, null, null, { kind: "stored" }, null);
 		if (!execution.ok) return unissuedRegistrationCommit(throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1(execution));
 		const commit = execution.finalized;
 		if (commit.kind !== "evm_family_ecdsa") {
@@ -3237,7 +3253,7 @@ var CloudflareD1WalletRegistrationService = class {
 			};
 		}
 	}
-	async executeWalletRegistrationFinalize(request, prepared, source, serverTiming, initialSessionPlan, lifecycleDecision, heldPasskeyClaim, yaoAdmission) {
+	async executeWalletRegistrationFinalize(request, prepared, source, serverTiming, initialSessionPlan, lifecycleDecision, heldPasskeyClaim, yaoAdmission, founding) {
 		const finalizeTiming = createD1RegistrationRouteTimingRecorder("wallets_register_finalize");
 		const totalTiming = startD1RegistrationRouteTiming("registerFinalizeTotalMs");
 		let startedCustody = null;
@@ -3476,7 +3492,10 @@ var CloudflareD1WalletRegistrationService = class {
 					sink: serverTiming,
 					name: "near_finalize_authority_reserve",
 					startedAtMs: Date.now(),
-					promise: this.walletRegistrationCommitStore.reserveAuthority(ceremonyAuthority, heldPasskeyClaim, prepared)
+					promise: this.walletRegistrationCommitStore.reserveAuthority(ceremonyAuthority, heldPasskeyClaim, founding ?? {
+						kind: "read",
+						ids: prepared
+					})
 				})]);
 				if (activationConsumption.status === "rejected") throw activationConsumption.reason;
 				if (authorityReservation.status === "rejected") throw authorityReservation.reason;
@@ -3605,7 +3624,10 @@ var CloudflareD1WalletRegistrationService = class {
 			} else {
 				custodyReservation = reserveCustody();
 				startedCustody = custodyReservation;
-				commitWallet = await this.walletRegistrationCommitStore.reserveAuthority(ceremonyAuthority, null, prepared);
+				commitWallet = await this.walletRegistrationCommitStore.reserveAuthority(ceremonyAuthority, null, {
+					kind: "read",
+					ids: prepared
+				});
 			}
 			if (yaoDecisionFound?.kind === "decided_otherwise") return {
 				ok: false,