@seams/wallet-server 0.7.1 → 0.8.0

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationSetupExecution.js

@@ -0,0 +1,155 @@
+import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
+import { deriveSigningRootId } from "../../../../shared-ts/src/threshold/signingRootScope.js";
+import { registrationPreparationIdFromString } from "../../../../core/types.js";
+import { buildStoredWalletRegistrationEvmFamilyEcdsaPreparedBranch, findStoredWalletRegistrationEvmFamilyEcdsaBranch } from "../../../../core/RegistrationCeremonyStore.js";
+import { routerAbEcdsaStrictRegistrationFactsBindingJson } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
+import { buildRegistrationIntent, inferRuntimePolicyScopeFromSigningRoot } from "./d1RegistrationCeremonyRecords.js";
+import { errorMessage, registrationIntentSignerBranches, registrationPreparedContextEcdsaChainTargets, resolveRegistrationPreparedContextFromPlan } from "./d1RegistrationSetupSupport.js";
+import { buildWalletRegistrationSetupSignature, normalizeWalletRegistrationSetupRequest, walletRegistrationSetupError, walletRegistrationSetupExpiresAtMs, walletRegistrationSetupIntentDigest } from "./d1WalletRegistrationSetup.js";
+import { buildD1EvmFamilyEcdsaRegistrationPrepare } from "./d1EvmFamilyEcdsaRegistrationBranch.js";
+//#region src/router/cloudflare/d1/registration/d1WalletRegistrationSetupExecution.ts
+async function executeD1WalletRegistrationSetup(input, dependencies) {
+	try {
+		const normalized = normalizeWalletRegistrationSetupRequest(input.request);
+		if (!normalized.ok) return walletRegistrationSetupError(normalized.code, normalized.message);
+		if (!dependencies.reservation) return walletRegistrationSetupError("registration_authority_unavailable", "Registration reservation authority is required");
+		const admitted = await dependencies.reservation.reserve(input);
+		if (!admitted.ok) return admitted;
+		const reservation = admitted.reservation;
+		const wallet = { walletId: reservation.walletId };
+		if (input.request.wallet?.kind === "provided" && input.request.wallet.walletId !== wallet.walletId) return walletRegistrationSetupError("reservation_conflict", "Registration reservation changed the requested wallet");
+		const expiresAtMs = walletRegistrationSetupExpiresAtMs(reservation.reservedAtMs);
+		if (Date.now() >= expiresAtMs) return walletRegistrationSetupError("registration_expired", "Registration setup has expired");
+		const registrationCeremonyId = reservation.ceremonyId;
+		const registrationPreparationId = reservation.preparationId;
+		const runtimePolicyScope = input.runtimePolicyScope || inferRuntimePolicyScopeFromSigningRoot({
+			orgId: input.orgId,
+			signingRootId: input.signingRootId,
+			signingRootVersion: input.signingRootVersion
+		});
+		const signingRootId = normalizeOptionalTrimmedString(input.signingRootId) || (runtimePolicyScope ? deriveSigningRootId(runtimePolicyScope) : "");
+		const signingRootVersion = normalizeOptionalTrimmedString(input.signingRootVersion) || runtimePolicyScope?.signingRootVersion || "default";
+		if (!signingRootId) return walletRegistrationSetupError("invalid_body", "registration requires a signing root");
+		const registrationOperation = reservation;
+		const intent = buildRegistrationIntent({
+			nonceB64u: registrationCeremonyId.slice(4),
+			walletId: wallet.walletId,
+			authMethod: normalized.authMethod,
+			signerSelection: normalized.signerSelection,
+			foundingWalletAuthMethodId: registrationOperation.walletAuthMethodId,
+			...runtimePolicyScope ? { runtimePolicyScope } : {}
+		});
+		const digestB64u = await walletRegistrationSetupIntentDigest(intent);
+		const existing = await dependencies.store.getSetupCeremony(registrationCeremonyId);
+		if (existing) {
+			if (existing.digestB64u !== digestB64u || existing.expectedOrigin !== input.expectedOrigin || existing.foundingWalletAuthorityId !== reservation.walletAuthorityId || existing.foundingDeviceId !== reservation.deviceId || existing.foundingWalletAuthMethodId !== reservation.walletAuthMethodId || existing.expiresAtMs !== expiresAtMs) return walletRegistrationSetupError("reservation_conflict", "Registration setup conflicts with its reservation");
+			if (admitted.lifecycle === "reserved") await dependencies.store.ensureSetupCeremony(existing);
+			return await setupResponseFromCeremony(input, existing);
+		}
+		if (admitted.lifecycle === "established") return walletRegistrationSetupError("registration_closed", "Completed registration setup snapshot is unavailable");
+		const branches = registrationIntentSignerBranches(intent);
+		if (!branches.ok) return walletRegistrationSetupError(branches.code, branches.message);
+		const ecdsaBranch = branches.value.evmFamilyEcdsa;
+		const nearEd25519Branch = branches.value.nearEd25519;
+		if (!ecdsaBranch && !nearEd25519Branch) return walletRegistrationSetupError("invalid_body", "registration signer branch is required");
+		const preparedContext = resolveRegistrationPreparedContextFromPlan({
+			signerPlan: branches.value.plan,
+			runtimePolicyScope,
+			signingRootId,
+			signingRootVersion
+		});
+		if (!preparedContext.ok) return walletRegistrationSetupError(preparedContext.code, preparedContext.message);
+		if (ecdsaBranch && !runtimePolicyScope) return walletRegistrationSetupError("invalid_body", "ECDSA registration requires an exact runtime policy scope");
+		const chainTargets = ecdsaBranch ? registrationPreparedContextEcdsaChainTargets(preparedContext.preparedContext) : null;
+		if (ecdsaBranch && !chainTargets) return walletRegistrationSetupError("invalid_body", "ECDSA chain targets are required");
+		const ecdsaPrepared = ecdsaBranch && chainTargets && runtimePolicyScope ? await buildD1EvmFamilyEcdsaRegistrationPrepare({
+			registrationPurpose: "wallet_registration",
+			registrationCeremonyId,
+			registrationPreparationId: registrationPreparationIdFromString(registrationPreparationId),
+			walletId: wallet.walletId,
+			signingRootId,
+			signingRootVersion,
+			chainTargets,
+			participantIds: [...ecdsaBranch.participantIds],
+			strictRegistration: dependencies.ecdsaStrictRegistration,
+			runtimePolicyScope
+		}) : null;
+		if (ecdsaPrepared && !ecdsaPrepared.ok) return walletRegistrationSetupError(ecdsaPrepared.code, ecdsaPrepared.message);
+		const storedBranches = [];
+		if (ecdsaPrepared?.ok && ecdsaBranch) storedBranches.push(buildStoredWalletRegistrationEvmFamilyEcdsaPreparedBranch({
+			branchKey: ecdsaBranch.branchKey,
+			ecdsa: {
+				kind: ecdsaPrepared.ecdsa.kind,
+				chainTargets: ecdsaPrepared.ecdsa.chainTargets,
+				prepare: ecdsaPrepared.ecdsa.prepare,
+				strictRegistration: ecdsaPrepared.ecdsa.strictRegistration,
+				strictRegistrationBindingJson: routerAbEcdsaStrictRegistrationFactsBindingJson(ecdsaPrepared.ecdsa.strictRegistration)
+			}
+		}));
+		const ceremony = {
+			registrationCeremonyId,
+			foundingWalletAuthorityId: registrationOperation.walletAuthorityId,
+			foundingDeviceId: registrationOperation.deviceId,
+			foundingWalletAuthMethodId: registrationOperation.walletAuthMethodId,
+			intent,
+			digestB64u,
+			signerPlan: branches.value.plan,
+			preparedContext: preparedContext.preparedContext,
+			orgId: normalizeOptionalTrimmedString(input.orgId) || "",
+			signingRootId,
+			signingRootVersion,
+			...input.expectedOrigin ? { expectedOrigin: input.expectedOrigin } : {},
+			expiresAtMs,
+			authorityState: {
+				kind: "awaiting_proof",
+				authMethod: normalized.authMethod
+			},
+			signerState: {
+				kind: "signer_set_registration",
+				branches: storedBranches
+			}
+		};
+		return await setupResponseFromCeremony(input, await dependencies.store.reserveSetupCeremony(ceremony));
+	} catch (error) {
+		return walletRegistrationSetupError("internal", errorMessage(error) || "Failed to set up wallet registration");
+	}
+}
+async function setupResponseFromCeremony(input, ceremony) {
+	const { signedSetup } = await buildWalletRegistrationSetupSignature({
+		signer: input.signer,
+		ceremony,
+		expectedOrigin: input.expectedOrigin
+	});
+	const branches = registrationIntentSignerBranches(ceremony.intent);
+	if (!branches.ok) return branches;
+	const success = {
+		ok: true,
+		registrationCeremonyId: ceremony.registrationCeremonyId,
+		walletId: String(ceremony.intent.walletId),
+		walletAuthMethodId: ceremony.foundingWalletAuthMethodId,
+		registrationIntentDigestB64u: ceremony.digestB64u,
+		intent: ceremony.intent,
+		signedSetup
+	};
+	if (!branches.value.evmFamilyEcdsa) return {
+		...success,
+		kind: "near_ed25519"
+	};
+	if (ceremony.signerState.kind !== "signer_set_registration") return walletRegistrationSetupError("invalid_state", "Registration setup signer state is invalid");
+	const ecdsa = findStoredWalletRegistrationEvmFamilyEcdsaBranch(ceremony.signerState);
+	if (!ecdsa || ecdsa.kind !== "evm_family_ecdsa_prepared") return walletRegistrationSetupError("invalid_state", "Registration setup snapshot is not prepared");
+	return {
+		...success,
+		kind: branches.value.nearEd25519 ? "near_ed25519_and_evm_family_ecdsa" : "evm_family_ecdsa",
+		ecdsa: {
+			kind: ecdsa.derivationKind,
+			chainTargets: ecdsa.chainTargets,
+			prepare: ecdsa.prepare,
+			strictRegistration: ecdsa.strictRegistration
+		}
+	};
+}
+//#endregion
+export { executeD1WalletRegistrationSetup };
+
+//# sourceMappingURL=d1WalletRegistrationSetupExecution.js.map

package/dist/esm/router/cloudflare/d1/registration/walletRegistrationEstablishedSessionIssuer.js

@@ -4,12 +4,12 @@ import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import "../../../../shared-ts/src/utils/encoders.js";
-import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../../shared-ts/src/utils/near.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { isEmailOtpWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseSessionOrigin, parseVerifiedOwnerProofId } from "../../../../authorization/domain.js";
 import { buildVerifiedOwnerProof, buildVerifiedWalletSessionEmailOtpFactorResult, buildVerifiedWalletSessionPasskeyFactorResult } from "../../../../authorization/factorEvidence.js";
 import { nearEd25519SigningKeyIdFromString, walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
+import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../../shared-ts/src/utils/near.js";
 import { DEFAULT_WALLET_SESSION_TTL_MS } from "../../../../shared-ts/src/threshold/sessionPolicy.js";
 import { deriveThresholdEcdsaKeyHandle } from "../../../../shared-ts/src/utils/thresholdEcdsaKeyHandle.js";
 import { registrationEstablishedMintId } from "./walletRegistrationSessionCommitReceipt.js";
@@ -288,7 +288,6 @@ async function issueDirectRegistrationEstablishedEcdsaSession(input) {
 				authorizationService: input.authorizationService,
 				authorizationTenantId: input.authorizationTenantId,
 				authority: input.authority,
-				registrationCeremonyId: input.registrationCeremonyId,
 				committed: directIssue
 			});
 			break;
@@ -372,7 +371,6 @@ async function issueDirectRegistrationEstablishedEd25519Session(input) {
 				authorizationService: input.authorizationService,
 				authorizationTenantId: input.authorizationTenantId,
 				authority: input.authority,
-				registrationCeremonyId: input.registrationCeremonyId,
 				committed: directIssue
 			});
 			authorization = await input.authorizationService.refreshWalletSessionAuthorizationV2AuthorityProjection({

package/dist/esm/router/cloudflare/d1/registration/walletRegistrationSessionCommitReceipt.js

@@ -5,6 +5,7 @@ import { parseWalletAuthAuthority } from "../../../../shared-ts/src/utils/wallet
 import { parseWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { parseSessionOrigin } from "../../../../authorization/domain.js";
+import { hasExactKeys } from "../../../../shared-ts/src/utils/exactKeys.js";
 import { parseWalletCustodyRegistrationOutcome } from "../../../../shared-ts/src/passkey-custody/ceremonyCommitPayload.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
 //#region src/router/cloudflare/d1/registration/walletRegistrationSessionCommitReceipt.ts
@@ -466,10 +467,6 @@ function parsePositiveSafeInteger(value) {
 function parseNonNegativeSafeInteger(value) {
 	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : null;
 }
-function hasExactKeys(record, expected) {
-	const actual = Object.keys(record);
-	return actual.length === expected.length && expected.every((key) => actual.includes(key));
-}
 function containsPersistedRegistrationCredential(value) {
 	if (Array.isArray(value)) return value.some(containsPersistedRegistrationCredential);
 	if (value === null || typeof value !== "object") return false;

package/dist/esm/router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.js

@@ -1,5 +1,6 @@
-import { requireNonEmptyString } from "../../../../shared-ts/src/utils/validation.js";
-import { isD1DatabaseLike } from "../../../../storage/d1Sql.js";
+import { isPlainObject, requireNonEmptyString } from "../../../../shared-ts/src/utils/validation.js";
+import { normalizeRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
+import { isD1DatabaseLike, parseD1JsonColumn } from "../../../../storage/d1Sql.js";
 import { abusePrincipalKey, runtimePolicyScopeKey } from "../../../domains/signingOperations/routerAbNormalSigningAdmissionCore.js";
 //#region src/router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.ts
 const ROUTER_AB_NORMAL_SIGNING_ADMISSION_TABLE = "router_ab_normal_signing_admission_records";
@@ -11,8 +12,12 @@ var CloudflareD1RouterAbNormalSigningAdmissionStore = class {
 		this.now = options.now || Date.now;
 	}
 	async evaluatePolicy(input) {
+		if (input.curve === "ecdsa" && input.policyReadSource.kind === "credential_snapshot") {
+			const decision = input.policyReadSource.policyRead.resolve(this.database, this.storageNamespace, input);
+			if (decision) return decision;
+		}
 		const scope = input.runtimePolicyScope;
-		const row = await this.database.prepare(`WITH scope(namespace, org_id, project_id, env_id, signing_root_version,
+		return parsePolicyRow(await this.database.prepare(`WITH scope(namespace, org_id, project_id, env_id, signing_root_version,
                   project_key, abuse_key) AS (VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7))
        SELECT project.record_key AS project_key, project.decision AS project_decision,
               project.retry_after_ms AS project_retry_after_ms,
@@ -28,53 +33,39 @@ var CloudflareD1RouterAbNormalSigningAdmissionStore = class {
            ON abuse.namespace = scope.namespace AND abuse.org_id = scope.org_id
           AND abuse.project_id = scope.project_id AND abuse.env_id = scope.env_id
           AND abuse.signing_root_version = scope.signing_root_version
-          AND abuse.record_kind = 'abuse' AND abuse.record_key = scope.abuse_key`).bind(this.storageNamespace, scope.orgId, scope.projectId, scope.envId, scope.signingRootVersion, runtimePolicyScopeKey(scope), abusePrincipalKey(input)).first();
-		if (!row) throw new Error("Router A/B admission policy snapshot is missing");
-		if (row.project_key !== null) {
-			const project = parseProjectPolicyDecision({
-				decision: row.project_decision,
-				retry_after_ms: row.project_retry_after_ms
-			});
-			if (project.kind === "rejected") return {
-				kind: "project_policy_rejected",
-				retryAfterMs: project.retryAfterMs
-			};
-		}
-		if (row.abuse_key === null) return { kind: "allowed" };
-		const abuse = parseAbuseDecision({
-			decision: row.abuse_decision,
-			retry_after_ms: row.abuse_retry_after_ms
-		});
-		return abuse.kind === "rejected" ? {
-			kind: "abuse_rejected",
-			retryAfterMs: abuse.retryAfterMs
-		} : abuse;
+          AND abuse.record_kind = 'abuse' AND abuse.record_key = scope.abuse_key`).bind(this.storageNamespace, scope.orgId, scope.projectId, scope.envId, scope.signingRootVersion, runtimePolicyScopeKey(scope), abusePrincipalKey(input)).first());
 	}
 	async setProjectPolicy(scope, decision) {
 		const normalized = normalizeProjectPolicyDecision(decision);
-		await this.putDecision(scope, "project_policy", runtimePolicyScopeKey(scope), normalized.kind, normalized.kind === "rejected" ? normalized.retryAfterMs : null);
+		await this.putDecision(scope, {
+			kind: "project_policy",
+			walletId: null
+		}, runtimePolicyScopeKey(scope), normalized.kind, normalized.kind === "rejected" ? normalized.retryAfterMs : null);
 	}
 	async clearProjectPolicy(scope) {
 		await this.deleteRecord(scope, "project_policy", runtimePolicyScopeKey(scope));
 	}
 	async setAbuseDecision(input, decision) {
 		const normalized = normalizeAbuseDecision(decision);
-		await this.putDecision(input.runtimePolicyScope, "abuse", abusePrincipalKey(input), normalized.kind, normalized.kind === "allowed" ? null : normalized.retryAfterMs);
+		await this.putDecision(input.runtimePolicyScope, {
+			kind: "abuse",
+			walletId: input.walletId
+		}, abusePrincipalKey(input), normalized.kind, normalized.kind === "allowed" ? null : normalized.retryAfterMs);
 	}
 	async clearAbuseDecision(input) {
 		await this.deleteRecord(input.runtimePolicyScope, "abuse", abusePrincipalKey(input));
 	}
-	async putDecision(scope, kind, key, decision, retryAfterMs) {
+	async putDecision(scope, owner, key, decision, retryAfterMs) {
 		await requireSuccessfulD1Write(this.database.prepare(`INSERT INTO ${ROUTER_AB_NORMAL_SIGNING_ADMISSION_TABLE} (
              namespace, org_id, project_id, env_id, signing_root_version,
-             record_kind, record_key, decision, retry_after_ms, updated_at_ms
-           ) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10)
+             record_kind, record_key, decision, retry_after_ms, updated_at_ms, wallet_id
+           ) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11)
            ON CONFLICT (
              namespace, org_id, project_id, env_id, signing_root_version, record_kind, record_key
            ) DO UPDATE SET
              decision = excluded.decision,
              retry_after_ms = excluded.retry_after_ms,
-             updated_at_ms = excluded.updated_at_ms`).bind(this.storageNamespace, scope.orgId, scope.projectId, scope.envId, scope.signingRootVersion, kind, key, decision, retryAfterMs, this.now()));
+             updated_at_ms = excluded.updated_at_ms`).bind(this.storageNamespace, scope.orgId, scope.projectId, scope.envId, scope.signingRootVersion, owner.kind, key, decision, retryAfterMs, this.now(), owner.walletId));
 	}
 	async deleteRecord(scope, kind, key) {
 		await requireSuccessfulD1Write(this.database.prepare(`DELETE FROM ${ROUTER_AB_NORMAL_SIGNING_ADMISSION_TABLE}
@@ -158,7 +149,116 @@ function requirePositiveInteger(label, value) {
 function assertNever(value) {
 	throw new Error(`Unexpected Router A/B normal-signing admission branch: ${String(value)}`);
 }
+function parsePolicyRow(row) {
+	if (!row) throw new Error("Router A/B admission policy snapshot is missing");
+	if (row.project_key !== null) {
+		const project = parseProjectPolicyDecision({
+			decision: row.project_decision,
+			retry_after_ms: row.project_retry_after_ms
+		});
+		if (project.kind === "rejected") return {
+			kind: "project_policy_rejected",
+			retryAfterMs: project.retryAfterMs
+		};
+	}
+	if (row.abuse_key === null) return { kind: "allowed" };
+	const abuse = parseAbuseDecision({
+		decision: row.abuse_decision,
+		retry_after_ms: row.abuse_retry_after_ms
+	});
+	return abuse.kind === "rejected" ? {
+		kind: "abuse_rejected",
+		retryAfterMs: abuse.retryAfterMs
+	} : abuse;
+}
+var D1EcdsaAdmissionPolicyRead = class D1EcdsaAdmissionPolicyRead {
+	#decisions;
+	constructor(database, namespace, walletId, activationId, decisions) {
+		this.database = database;
+		this.namespace = namespace;
+		this.walletId = walletId;
+		this.activationId = activationId;
+		this.#decisions = decisions;
+	}
+	static fromRows(database, namespace, walletId, activationId, rows) {
+		if (!Array.isArray(rows)) throw new Error("ECDSA policy candidates are invalid");
+		const decisions = /* @__PURE__ */ new Map();
+		for (const row of rows) {
+			if (!isPlainObject(row)) throw new Error("ECDSA policy candidate is invalid");
+			const key = runtimePolicyScopeKey(normalizeRuntimePolicyScope(parseD1JsonColumn(row.scope_json)));
+			if (decisions.has(key)) throw new Error("ECDSA policy scope is ambiguous");
+			try {
+				const decision = parsePolicyRow({
+					project_key: row.project_key,
+					project_decision: row.project_decision,
+					project_retry_after_ms: row.project_retry_after_ms,
+					abuse_key: row.abuse_key,
+					abuse_decision: row.abuse_decision,
+					abuse_retry_after_ms: row.abuse_retry_after_ms
+				});
+				decisions.set(key, {
+					ok: true,
+					decision
+				});
+			} catch (error) {
+				decisions.set(key, {
+					ok: false,
+					message: error instanceof Error ? error.message : "ECDSA policy read failed"
+				});
+			}
+		}
+		return new D1EcdsaAdmissionPolicyRead(database, namespace, walletId, activationId, decisions);
+	}
+	resolve(database, namespace, input) {
+		if (database !== this.database || namespace !== this.namespace) return null;
+		if (input.walletId !== this.walletId || input.materialActivationId !== this.activationId) throw new Error("ECDSA policy credential scope does not match");
+		const result = this.#decisions.get(runtimePolicyScopeKey(input.runtimePolicyScope));
+		if (!result) throw new Error("Verified ECDSA material policy scope is missing");
+		if (!result.ok) throw new Error(result.message);
+		return result.decision;
+	}
+};
+const ECDSA_CREDENTIAL_POLICY_PROJECTION = `
+  (WITH candidates AS (
+     SELECT DISTINCT json_extract(signer.record_json, '$.runtimePolicyScope') AS scope_json
+       FROM wallet_signers AS signer
+      WHERE signer.namespace = session.namespace AND signer.org_id = session.org_id
+        AND signer.project_id = session.project_id AND signer.env_id = session.env_id
+        AND signer.wallet_id = session.wallet_id AND signer.signer_family = 'ecdsa'
+        AND json_valid(signer.record_json)
+   ), scopes AS (
+     SELECT scope_json,
+            json_extract(scope_json, '$.orgId') AS org_id,
+            json_extract(scope_json, '$.projectId') AS project_id,
+            json_extract(scope_json, '$.envId') AS env_id,
+            json_extract(scope_json, '$.signingRootVersion') AS signing_root_version,
+            json_extract(scope_json, '$.orgId') || char(31) ||
+            json_extract(scope_json, '$.projectId') || char(31) ||
+            json_extract(scope_json, '$.envId') || char(31) ||
+            json_extract(scope_json, '$.signingRootVersion') AS project_key
+       FROM candidates
+   )
+   SELECT json_group_array(json_object(
+     'scope_json', scopes.scope_json,
+     'project_key', project.record_key, 'project_decision', project.decision,
+     'project_retry_after_ms', project.retry_after_ms,
+     'abuse_key', abuse.record_key, 'abuse_decision', abuse.decision,
+     'abuse_retry_after_ms', abuse.retry_after_ms))
+     FROM scopes
+     LEFT JOIN router_ab_normal_signing_admission_records AS project
+       ON project.namespace = session.namespace AND project.org_id = scopes.org_id
+      AND project.project_id = scopes.project_id AND project.env_id = scopes.env_id
+      AND project.signing_root_version = scopes.signing_root_version
+      AND project.record_kind = 'project_policy' AND project.record_key = scopes.project_key
+     LEFT JOIN router_ab_normal_signing_admission_records AS abuse
+       ON abuse.namespace = session.namespace AND abuse.org_id = scopes.org_id
+      AND abuse.project_id = scopes.project_id AND abuse.env_id = scopes.env_id
+      AND abuse.signing_root_version = scopes.signing_root_version
+      AND abuse.record_kind = 'abuse'
+      AND abuse.record_key = scopes.project_key || char(31) || session.wallet_id || char(31) ||
+          'material_activation:' || ? || char(31) || 'ecdsa'
+  ) AS ecdsa_policy_records_json,`;
 //#endregion
-export { CloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1RouterAbNormalSigningAdmissionStore };
+export { CloudflareD1RouterAbNormalSigningAdmissionStore, D1EcdsaAdmissionPolicyRead, ECDSA_CREDENTIAL_POLICY_PROJECTION, createCloudflareD1RouterAbNormalSigningAdmissionStore };
 
 //# sourceMappingURL=d1RouterAbNormalSigningAdmissionStore.js.map

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAddSignerFinalizeRecord.js

@@ -0,0 +1,68 @@
+import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
+import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import "../../../../shared-ts/src/utils/encoders.js";
+import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
+import { parseRouterAbEd25519YaoRegistrationSideEffectRecordV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
+import { parseD1WalletAddSignerFinalizeTerminalResponse, parseWalletIdForIntent } from "../registration/d1RegistrationCeremonyRecords.js";
+//#region src/router/cloudflare/d1/wallet/d1WalletAddSignerFinalizeRecord.ts
+function parseWalletAddSignerFinalizePrepared(raw) {
+	if (!isPlainObject(raw)) return null;
+	const record = raw;
+	const walletId = parseWalletIdForIntent(record.walletId);
+	if (!walletId) return null;
+	if (record.kind === "d1_wallet_add_signer_finalize_ed25519_prepared_v1") {
+		const finalizingAtMs = record.finalizingAtMs;
+		if (typeof finalizingAtMs !== "number" || !Number.isSafeInteger(finalizingAtMs) || finalizingAtMs <= 0) return null;
+		return {
+			kind: "d1_wallet_add_signer_finalize_ed25519_prepared_v1",
+			walletId,
+			finalizingAtMs
+		};
+	}
+	if (record.kind !== "d1_wallet_add_signer_finalize_ecdsa_prepared_v1") return null;
+	const signerWriteAtMs = record.signerWriteAtMs;
+	return typeof signerWriteAtMs === "number" && Number.isSafeInteger(signerWriteAtMs) && signerWriteAtMs > 0 ? {
+		kind: "d1_wallet_add_signer_finalize_ecdsa_prepared_v1",
+		walletId,
+		signerWriteAtMs
+	} : null;
+}
+function parseD1WalletAddSignerFinalizeSideEffectRecord(raw) {
+	const record = parseRouterAbEd25519YaoRegistrationSideEffectRecordV1(raw, {
+		operation: "add_signer_finalize",
+		parsePrepared: parseWalletAddSignerFinalizePrepared,
+		parseResponse: parseD1WalletAddSignerFinalizeTerminalResponse
+	});
+	if (record?.kind === "router_ab_ed25519_yao_registration_side_effect_completion_v1" && record.response.ok && record.response.walletId !== record.prepared.walletId) return null;
+	return record;
+}
+async function fingerprintD1WalletAddSignerFinalizePrepared(prepared) {
+	return base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(prepared)));
+}
+async function returnD1WalletAddSignerFinalizePrepared(prepared) {
+	return prepared;
+}
+async function rejectUnexpectedWalletAddSignerFinalizePreparation() {
+	throw new Error("persisted add-signer finalize claim disappeared during reconciliation");
+}
+function buildD1WalletAddSignerFinalizePrepared(input) {
+	if (input.request.kind === "evm_family_ecdsa") return {
+		walletId: input.ceremony.intent.walletId,
+		kind: "d1_wallet_add_signer_finalize_ecdsa_prepared_v1",
+		signerWriteAtMs: input.nowMs
+	};
+	if (input.ceremony.signerState.kind === "near_ed25519_yao_add_signer_finalizing") return {
+		walletId: input.ceremony.intent.walletId,
+		kind: "d1_wallet_add_signer_finalize_ed25519_prepared_v1",
+		finalizingAtMs: input.ceremony.signerState.finalizingAtMs
+	};
+	return {
+		walletId: input.ceremony.intent.walletId,
+		kind: "d1_wallet_add_signer_finalize_ed25519_prepared_v1",
+		finalizingAtMs: input.nowMs
+	};
+}
+//#endregion
+export { buildD1WalletAddSignerFinalizePrepared, fingerprintD1WalletAddSignerFinalizePrepared, parseD1WalletAddSignerFinalizeSideEffectRecord, rejectUnexpectedWalletAddSignerFinalizePreparation, returnD1WalletAddSignerFinalizePrepared };
+
+//# sourceMappingURL=d1WalletAddSignerFinalizeRecord.js.map

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAddSignerService.js

@@ -20,9 +20,10 @@ import { buildRouterAbEd25519YaoAddSignerAdmissionRequestV1, createRouterAbEd255
 import { parseRouterAbEd25519YaoRegistrationSideEffectRecordV1, runRouterAbEd25519YaoRegistrationSideEffectV1, throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
 import { buildYaoEd25519WalletSignerRecord, ed25519NearPublicKeyFromBytes, implicitNearAccountIdFromEd25519PublicKeyBytes } from "../ed25519Yao/d1Ed25519YaoWalletSigner.js";
 import { routerAbEcdsaStrictRegistrationRequestMatchesFacts } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
-import { buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, normalizeThresholdEcdsaChainTargets, parseD1AddSignerIntent, parseD1RuntimePolicyScope, parseD1StoredAddSignerAuth, parseD1StoredAddSignerIntent, parseD1StoredWalletAddSignerCeremony, parseD1WalletAddSignerFinalizeTerminalResponse, parseWalletIdForIntent, positiveIntegerArraysEqual, runtimePolicyScopeMatches, thresholdEcdsaChainTargetsEqual } from "../registration/d1RegistrationCeremonyRecords.js";
-import { buildD1EvmFamilyEcdsaRegistrationPrepare } from "../registration/d1EvmFamilyEcdsaRegistrationBranch.js";
+import { buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, normalizeThresholdEcdsaChainTargets, parseD1AddSignerIntent, parseD1RuntimePolicyScope, parseD1StoredAddSignerAuth, parseD1StoredAddSignerIntent, parseD1StoredWalletAddSignerCeremony, parseWalletIdForIntent, positiveIntegerArraysEqual, runtimePolicyScopeMatches, thresholdEcdsaChainTargetsEqual } from "../registration/d1RegistrationCeremonyRecords.js";
+import { buildD1WalletAddSignerFinalizePrepared, fingerprintD1WalletAddSignerFinalizePrepared, rejectUnexpectedWalletAddSignerFinalizePreparation, returnD1WalletAddSignerFinalizePrepared } from "./d1WalletAddSignerFinalizeRecord.js";
 import { routerAbEd25519YaoLifecycleDecisionLookupV1, routerAbEd25519YaoLifecycleDecisionV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoLifecycleDecision.js";
+import { buildD1EvmFamilyEcdsaRegistrationPrepare } from "../registration/d1EvmFamilyEcdsaRegistrationBranch.js";
 import { buildActivatedEcdsaFamilyBootstrap, ecdsaStrictRegistrationAuthority, exactEcdsaParticipantPair } from "../registration/d1WalletRegistrationService.js";
 import { computeWalletAddSignerEcdsaActivationRequestDigestB64u } from "../../../../shared-ts/src/utils/walletAddSignerActivation.js";
 //#region src/router/cloudflare/d1/wallet/d1WalletAddSignerService.ts
@@ -49,7 +50,7 @@ function sameEcdsaDerivationPublicIdentityV1(left, right) {
 	return left.derivationClientSharePublicKey33B64u === right.derivationClientSharePublicKey33B64u && left.relayerPublicKey33B64u === right.relayerPublicKey33B64u && left.groupPublicKey33B64u === right.groupPublicKey33B64u && left.ethereumAddress === right.ethereumAddress;
 }
 function sameEcdsaDerivationServerBootstrapV1(left, right) {
-	return left.formatVersion === right.formatVersion && left.walletId === right.walletId && left.evmFamilySigningKeySlotId === right.evmFamilySigningKeySlotId && left.ecdsaThresholdKeyId === right.ecdsaThresholdKeyId && left.relayerKeyId === right.relayerKeyId && left.applicationBindingDigestB64u === right.applicationBindingDigestB64u && left.contextBinding32B64u === right.contextBinding32B64u && sameEcdsaDerivationPublicIdentityV1(left.publicIdentity, right.publicIdentity) && left.clientShareRetryCounter === right.clientShareRetryCounter && left.relayerShareRetryCounter === right.relayerShareRetryCounter && left.publicTranscriptDigest32B64u === right.publicTranscriptDigest32B64u && left.keyHandle === right.keyHandle && left.signingRootId === right.signingRootId && left.signingRootVersion === right.signingRootVersion && left.thresholdEcdsaPublicKeyB64u === right.thresholdEcdsaPublicKeyB64u && left.ethereumAddress === right.ethereumAddress && left.relayerVerifyingShareB64u === right.relayerVerifyingShareB64u && positiveIntegerArraysEqual(left.participantIds, right.participantIds) && left.thresholdSessionId === right.thresholdSessionId && left.activationEpoch === right.activationEpoch && left.expiresAtMs === right.expiresAtMs && left.expiresAt === right.expiresAt && left.remainingUses === right.remainingUses && sameRouterAbEcdsaDerivationNormalSigningStateV1(left.routerAbEcdsaDerivationNormalSigning, right.routerAbEcdsaDerivationNormalSigning);
+	return left.formatVersion === right.formatVersion && left.walletId === right.walletId && left.evmFamilySigningKeySlotId === right.evmFamilySigningKeySlotId && left.ecdsaThresholdKeyId === right.ecdsaThresholdKeyId && left.relayerKeyId === right.relayerKeyId && left.applicationBindingDigestB64u === right.applicationBindingDigestB64u && left.contextBinding32B64u === right.contextBinding32B64u && sameEcdsaDerivationPublicIdentityV1(left.publicIdentity, right.publicIdentity) && left.clientShareRetryCounter === right.clientShareRetryCounter && left.relayerShareRetryCounter === right.relayerShareRetryCounter && left.keyHandle === right.keyHandle && left.signingRootId === right.signingRootId && left.signingRootVersion === right.signingRootVersion && left.thresholdEcdsaPublicKeyB64u === right.thresholdEcdsaPublicKeyB64u && left.ethereumAddress === right.ethereumAddress && left.relayerVerifyingShareB64u === right.relayerVerifyingShareB64u && positiveIntegerArraysEqual(left.participantIds, right.participantIds) && left.thresholdSessionId === right.thresholdSessionId && left.activationEpoch === right.activationEpoch && left.expiresAtMs === right.expiresAtMs && left.expiresAt === right.expiresAt && left.remainingUses === right.remainingUses && sameRouterAbEcdsaDerivationNormalSigningStateV1(left.routerAbEcdsaDerivationNormalSigning, right.routerAbEcdsaDerivationNormalSigning);
 }
 function walletAddSignerStartResponseFromCeremony(ceremony) {
 	const base = {
@@ -242,54 +243,6 @@ async function rejectUnexpectedWalletAddSignerStartPreparation() {
 async function fingerprintD1WalletAddSignerStartPrepared(prepared) {
 	return base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(prepared)));
 }
-function parseWalletAddSignerFinalizePrepared(raw) {
-	const record = addSignerRecordValue(raw);
-	if (!record) return null;
-	if (record.kind === "d1_wallet_add_signer_finalize_ed25519_prepared_v1") {
-		const finalizingAtMs = record.finalizingAtMs;
-		if (typeof finalizingAtMs !== "number" || !Number.isSafeInteger(finalizingAtMs) || finalizingAtMs <= 0) return null;
-		return {
-			kind: "d1_wallet_add_signer_finalize_ed25519_prepared_v1",
-			finalizingAtMs
-		};
-	}
-	if (record.kind !== "d1_wallet_add_signer_finalize_ecdsa_prepared_v1") return null;
-	const signerWriteAtMs = record.signerWriteAtMs;
-	return typeof signerWriteAtMs === "number" && Number.isSafeInteger(signerWriteAtMs) && signerWriteAtMs > 0 ? {
-		kind: "d1_wallet_add_signer_finalize_ecdsa_prepared_v1",
-		signerWriteAtMs
-	} : null;
-}
-function parseD1WalletAddSignerFinalizeSideEffectRecord(raw) {
-	return parseRouterAbEd25519YaoRegistrationSideEffectRecordV1(raw, {
-		operation: "add_signer_finalize",
-		parsePrepared: parseWalletAddSignerFinalizePrepared,
-		parseResponse: parseD1WalletAddSignerFinalizeTerminalResponse
-	});
-}
-async function fingerprintD1WalletAddSignerFinalizePrepared(prepared) {
-	return base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(prepared)));
-}
-async function returnD1WalletAddSignerFinalizePrepared(prepared) {
-	return prepared;
-}
-async function rejectUnexpectedWalletAddSignerFinalizePreparation() {
-	throw new Error("persisted add-signer finalize claim disappeared during reconciliation");
-}
-function buildD1WalletAddSignerFinalizePrepared(input) {
-	if (input.request.kind === "evm_family_ecdsa") return {
-		kind: "d1_wallet_add_signer_finalize_ecdsa_prepared_v1",
-		signerWriteAtMs: input.nowMs
-	};
-	if (input.ceremony.signerState.kind === "near_ed25519_yao_add_signer_finalizing") return {
-		kind: "d1_wallet_add_signer_finalize_ed25519_prepared_v1",
-		finalizingAtMs: input.ceremony.signerState.finalizingAtMs
-	};
-	return {
-		kind: "d1_wallet_add_signer_finalize_ed25519_prepared_v1",
-		finalizingAtMs: input.nowMs
-	};
-}
 function rejectedWalletAddSignerStartTerminal(code, message) {
 	return {
 		kind: "d1_wallet_add_signer_start_rejected_v1",
@@ -400,7 +353,6 @@ function storedEcdsaAddSignerBootstrap(bootstrap) {
 		publicIdentity: bootstrap.publicIdentity,
 		clientShareRetryCounter: bootstrap.clientShareRetryCounter,
 		relayerShareRetryCounter: bootstrap.relayerShareRetryCounter,
-		publicTranscriptDigest32B64u: bootstrap.publicTranscriptDigest32B64u,
 		keyHandle: bootstrap.keyHandle,
 		signingRootId: bootstrap.signingRootId,
 		signingRootVersion: bootstrap.signingRootVersion,
@@ -1230,7 +1182,7 @@ var CloudflareD1WalletAddSignerService = class {
 			idempotencyKey
 		}) || await store.getAddSignerFinalizeReplayForCeremony(finalizeRequest.addSignerCeremonyId);
 		if (replay) {
-			if (!sameWalletAddSignerFinalizeRequestV1(replay.request, finalizeRequest)) return {
+			if (replay.response.walletId !== prepared.walletId || !sameWalletAddSignerFinalizeRequestV1(replay.request, finalizeRequest)) return {
 				ok: false,
 				code: "idempotency_conflict",
 				message: "idempotencyKey is already bound to another add-signer finalize request"
@@ -1243,6 +1195,7 @@ var CloudflareD1WalletAddSignerService = class {
 			code: "not_found",
 			message: "add-signer ceremony not found"
 		};
+		if (ceremony.intent.walletId !== prepared.walletId) throw new Error("Add-signer finalize claim belongs to another wallet");
 		if (finalizeRequest.kind === "near_ed25519") {
 			if (prepared.kind !== "d1_wallet_add_signer_finalize_ed25519_prepared_v1") throw new Error("Ed25519 add-signer finalize claim changed branch");
 			if (ceremony.intent.signerSelection.mode !== "ed25519" || ceremony.auth.kind !== "webauthn_assertion") return {
@@ -1530,6 +1483,6 @@ var CloudflareD1WalletAddSignerService = class {
 	}
 };
 //#endregion
-export { CloudflareD1WalletAddSignerService, parseD1WalletAddSignerFinalizeSideEffectRecord, parseD1WalletAddSignerStartSideEffectRecord };
+export { CloudflareD1WalletAddSignerService, parseD1WalletAddSignerStartSideEffectRecord };
 
 //# sourceMappingURL=d1WalletAddSignerService.js.map