@seams/wallet-server 0.7.3 → 0.8.0

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationSetup.js

@@ -1,7 +1,5 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { normalizeRegistrationAuthMethodInput } from "../../../../shared-ts/src/utils/registrationAuthMethodInput.js";
-import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { thresholdEcdsaChainTargetFromValue } from "../../../../core/thresholdEcdsaChainTarget.js";
 import { computeWalletRegistrationSetupDigestB64u, mintSignedWalletRegistrationSetup } from "../../../domains/walletRegistration/walletRegistrationSetupPayload.js";
 import { normalizeRegistrationSignerPlan, registrationSignerSetSelectionFromPlan } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
@@ -42,45 +40,6 @@ import { computeRegistrationIntentDigestB64u } from "../../../../shared-ts/src/u
 */
 /** Setup's ceremony lives only as long as an authenticator prompt plausibly takes. */
 const WALLET_REGISTRATION_SETUP_TTL_MS = 10 * 6e4;
-function walletRegistrationSetupIds() {
-	return {
-		registrationCeremonyId: `wrc_${secureRandomBase64Url(32)}`,
-		registrationPreparationId: `regprep_${secureRandomBase64Url(32)}`
-	};
-}
-/**
-* Resolves the wallet id without reserving it.
-*
-* A provided id is taken as given; an absent or server-allocated one is
-* generated. There is no existence pre-check: it cost a serialized read on
-* every registration to catch a collision that the commit-time uniqueness
-* constraint catches anyway, and for a freshly generated random id it could
-* essentially never fire.
-*/
-function resolveWalletRegistrationSetupWalletId(input) {
-	const wallet = input.wallet;
-	if (!wallet || wallet.kind === "server_allocated") return {
-		ok: true,
-		walletId: input.createServerAllocated()
-	};
-	if (wallet.kind === "provided") {
-		const walletId = input.parseProvided(wallet.walletId);
-		if (!walletId) return {
-			ok: false,
-			code: "invalid_body",
-			message: "walletId is required"
-		};
-		return {
-			ok: true,
-			walletId
-		};
-	}
-	return {
-		ok: false,
-		code: "invalid_body",
-		message: "wallet.kind is unsupported"
-	};
-}
 function normalizeWalletRegistrationSetupRequest(request) {
 	const signerPlan = normalizeRegistrationSignerPlan(request?.signerSelection);
 	if (!signerPlan.ok) return signerPlan;
@@ -116,20 +75,17 @@ async function buildWalletRegistrationSetupSignature(input) {
 		signingRootVersion,
 		expectedOrigin: input.expectedOrigin
 	});
-	return {
-		signedSetup: await mintSignedWalletRegistrationSetup(input.signer, {
-			kind: "wallet_registration_setup_v1",
-			registrationCeremonyId: input.ceremony.registrationCeremonyId,
-			walletId: String(input.ceremony.intent.walletId),
-			orgId: input.ceremony.orgId,
-			signingRootId,
-			signingRootVersion,
-			policy: input.ceremony.preparedContext.runtimePolicy,
-			setupDigestB64u,
-			expiresAtMs: input.ceremony.expiresAtMs
-		}),
-		setupDigestB64u
-	};
+	return { signedSetup: await mintSignedWalletRegistrationSetup(input.signer, {
+		kind: "wallet_registration_setup_v1",
+		registrationCeremonyId: input.ceremony.registrationCeremonyId,
+		walletId: String(input.ceremony.intent.walletId),
+		orgId: input.ceremony.orgId,
+		signingRootId,
+		signingRootVersion,
+		policy: input.ceremony.preparedContext.runtimePolicy,
+		setupDigestB64u,
+		expiresAtMs: input.ceremony.expiresAtMs
+	}) };
 }
 async function walletRegistrationSetupIntentDigest(intent) {
 	return await computeRegistrationIntentDigestB64u(intent);
@@ -178,6 +134,6 @@ function walletRegistrationSetupError(code, message) {
 	};
 }
 //#endregion
-export { buildWalletRegistrationSetupSignature, normalizeWalletRegistrationSetupRequest, resolveWalletRegistrationSetupWalletId, storedRespondEd25519DeferredWork, walletRegistrationRespondResult, walletRegistrationSetupError, walletRegistrationSetupExpiresAtMs, walletRegistrationSetupIds, walletRegistrationSetupIntentDigest };
+export { buildWalletRegistrationSetupSignature, normalizeWalletRegistrationSetupRequest, storedRespondEd25519DeferredWork, walletRegistrationRespondResult, walletRegistrationSetupError, walletRegistrationSetupExpiresAtMs, walletRegistrationSetupIntentDigest };
 
 //# sourceMappingURL=d1WalletRegistrationSetup.js.map

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationSetupExecution.js

@@ -0,0 +1,155 @@
+import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
+import { deriveSigningRootId } from "../../../../shared-ts/src/threshold/signingRootScope.js";
+import { registrationPreparationIdFromString } from "../../../../core/types.js";
+import { buildStoredWalletRegistrationEvmFamilyEcdsaPreparedBranch, findStoredWalletRegistrationEvmFamilyEcdsaBranch } from "../../../../core/RegistrationCeremonyStore.js";
+import { routerAbEcdsaStrictRegistrationFactsBindingJson } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
+import { buildRegistrationIntent, inferRuntimePolicyScopeFromSigningRoot } from "./d1RegistrationCeremonyRecords.js";
+import { errorMessage, registrationIntentSignerBranches, registrationPreparedContextEcdsaChainTargets, resolveRegistrationPreparedContextFromPlan } from "./d1RegistrationSetupSupport.js";
+import { buildWalletRegistrationSetupSignature, normalizeWalletRegistrationSetupRequest, walletRegistrationSetupError, walletRegistrationSetupExpiresAtMs, walletRegistrationSetupIntentDigest } from "./d1WalletRegistrationSetup.js";
+import { buildD1EvmFamilyEcdsaRegistrationPrepare } from "./d1EvmFamilyEcdsaRegistrationBranch.js";
+//#region src/router/cloudflare/d1/registration/d1WalletRegistrationSetupExecution.ts
+async function executeD1WalletRegistrationSetup(input, dependencies) {
+	try {
+		const normalized = normalizeWalletRegistrationSetupRequest(input.request);
+		if (!normalized.ok) return walletRegistrationSetupError(normalized.code, normalized.message);
+		if (!dependencies.reservation) return walletRegistrationSetupError("registration_authority_unavailable", "Registration reservation authority is required");
+		const admitted = await dependencies.reservation.reserve(input);
+		if (!admitted.ok) return admitted;
+		const reservation = admitted.reservation;
+		const wallet = { walletId: reservation.walletId };
+		if (input.request.wallet?.kind === "provided" && input.request.wallet.walletId !== wallet.walletId) return walletRegistrationSetupError("reservation_conflict", "Registration reservation changed the requested wallet");
+		const expiresAtMs = walletRegistrationSetupExpiresAtMs(reservation.reservedAtMs);
+		if (Date.now() >= expiresAtMs) return walletRegistrationSetupError("registration_expired", "Registration setup has expired");
+		const registrationCeremonyId = reservation.ceremonyId;
+		const registrationPreparationId = reservation.preparationId;
+		const runtimePolicyScope = input.runtimePolicyScope || inferRuntimePolicyScopeFromSigningRoot({
+			orgId: input.orgId,
+			signingRootId: input.signingRootId,
+			signingRootVersion: input.signingRootVersion
+		});
+		const signingRootId = normalizeOptionalTrimmedString(input.signingRootId) || (runtimePolicyScope ? deriveSigningRootId(runtimePolicyScope) : "");
+		const signingRootVersion = normalizeOptionalTrimmedString(input.signingRootVersion) || runtimePolicyScope?.signingRootVersion || "default";
+		if (!signingRootId) return walletRegistrationSetupError("invalid_body", "registration requires a signing root");
+		const registrationOperation = reservation;
+		const intent = buildRegistrationIntent({
+			nonceB64u: registrationCeremonyId.slice(4),
+			walletId: wallet.walletId,
+			authMethod: normalized.authMethod,
+			signerSelection: normalized.signerSelection,
+			foundingWalletAuthMethodId: registrationOperation.walletAuthMethodId,
+			...runtimePolicyScope ? { runtimePolicyScope } : {}
+		});
+		const digestB64u = await walletRegistrationSetupIntentDigest(intent);
+		const existing = await dependencies.store.getSetupCeremony(registrationCeremonyId);
+		if (existing) {
+			if (existing.digestB64u !== digestB64u || existing.expectedOrigin !== input.expectedOrigin || existing.foundingWalletAuthorityId !== reservation.walletAuthorityId || existing.foundingDeviceId !== reservation.deviceId || existing.foundingWalletAuthMethodId !== reservation.walletAuthMethodId || existing.expiresAtMs !== expiresAtMs) return walletRegistrationSetupError("reservation_conflict", "Registration setup conflicts with its reservation");
+			if (admitted.lifecycle === "reserved") await dependencies.store.ensureSetupCeremony(existing);
+			return await setupResponseFromCeremony(input, existing);
+		}
+		if (admitted.lifecycle === "established") return walletRegistrationSetupError("registration_closed", "Completed registration setup snapshot is unavailable");
+		const branches = registrationIntentSignerBranches(intent);
+		if (!branches.ok) return walletRegistrationSetupError(branches.code, branches.message);
+		const ecdsaBranch = branches.value.evmFamilyEcdsa;
+		const nearEd25519Branch = branches.value.nearEd25519;
+		if (!ecdsaBranch && !nearEd25519Branch) return walletRegistrationSetupError("invalid_body", "registration signer branch is required");
+		const preparedContext = resolveRegistrationPreparedContextFromPlan({
+			signerPlan: branches.value.plan,
+			runtimePolicyScope,
+			signingRootId,
+			signingRootVersion
+		});
+		if (!preparedContext.ok) return walletRegistrationSetupError(preparedContext.code, preparedContext.message);
+		if (ecdsaBranch && !runtimePolicyScope) return walletRegistrationSetupError("invalid_body", "ECDSA registration requires an exact runtime policy scope");
+		const chainTargets = ecdsaBranch ? registrationPreparedContextEcdsaChainTargets(preparedContext.preparedContext) : null;
+		if (ecdsaBranch && !chainTargets) return walletRegistrationSetupError("invalid_body", "ECDSA chain targets are required");
+		const ecdsaPrepared = ecdsaBranch && chainTargets && runtimePolicyScope ? await buildD1EvmFamilyEcdsaRegistrationPrepare({
+			registrationPurpose: "wallet_registration",
+			registrationCeremonyId,
+			registrationPreparationId: registrationPreparationIdFromString(registrationPreparationId),
+			walletId: wallet.walletId,
+			signingRootId,
+			signingRootVersion,
+			chainTargets,
+			participantIds: [...ecdsaBranch.participantIds],
+			strictRegistration: dependencies.ecdsaStrictRegistration,
+			runtimePolicyScope
+		}) : null;
+		if (ecdsaPrepared && !ecdsaPrepared.ok) return walletRegistrationSetupError(ecdsaPrepared.code, ecdsaPrepared.message);
+		const storedBranches = [];
+		if (ecdsaPrepared?.ok && ecdsaBranch) storedBranches.push(buildStoredWalletRegistrationEvmFamilyEcdsaPreparedBranch({
+			branchKey: ecdsaBranch.branchKey,
+			ecdsa: {
+				kind: ecdsaPrepared.ecdsa.kind,
+				chainTargets: ecdsaPrepared.ecdsa.chainTargets,
+				prepare: ecdsaPrepared.ecdsa.prepare,
+				strictRegistration: ecdsaPrepared.ecdsa.strictRegistration,
+				strictRegistrationBindingJson: routerAbEcdsaStrictRegistrationFactsBindingJson(ecdsaPrepared.ecdsa.strictRegistration)
+			}
+		}));
+		const ceremony = {
+			registrationCeremonyId,
+			foundingWalletAuthorityId: registrationOperation.walletAuthorityId,
+			foundingDeviceId: registrationOperation.deviceId,
+			foundingWalletAuthMethodId: registrationOperation.walletAuthMethodId,
+			intent,
+			digestB64u,
+			signerPlan: branches.value.plan,
+			preparedContext: preparedContext.preparedContext,
+			orgId: normalizeOptionalTrimmedString(input.orgId) || "",
+			signingRootId,
+			signingRootVersion,
+			...input.expectedOrigin ? { expectedOrigin: input.expectedOrigin } : {},
+			expiresAtMs,
+			authorityState: {
+				kind: "awaiting_proof",
+				authMethod: normalized.authMethod
+			},
+			signerState: {
+				kind: "signer_set_registration",
+				branches: storedBranches
+			}
+		};
+		return await setupResponseFromCeremony(input, await dependencies.store.reserveSetupCeremony(ceremony));
+	} catch (error) {
+		return walletRegistrationSetupError("internal", errorMessage(error) || "Failed to set up wallet registration");
+	}
+}
+async function setupResponseFromCeremony(input, ceremony) {
+	const { signedSetup } = await buildWalletRegistrationSetupSignature({
+		signer: input.signer,
+		ceremony,
+		expectedOrigin: input.expectedOrigin
+	});
+	const branches = registrationIntentSignerBranches(ceremony.intent);
+	if (!branches.ok) return branches;
+	const success = {
+		ok: true,
+		registrationCeremonyId: ceremony.registrationCeremonyId,
+		walletId: String(ceremony.intent.walletId),
+		walletAuthMethodId: ceremony.foundingWalletAuthMethodId,
+		registrationIntentDigestB64u: ceremony.digestB64u,
+		intent: ceremony.intent,
+		signedSetup
+	};
+	if (!branches.value.evmFamilyEcdsa) return {
+		...success,
+		kind: "near_ed25519"
+	};
+	if (ceremony.signerState.kind !== "signer_set_registration") return walletRegistrationSetupError("invalid_state", "Registration setup signer state is invalid");
+	const ecdsa = findStoredWalletRegistrationEvmFamilyEcdsaBranch(ceremony.signerState);
+	if (!ecdsa || ecdsa.kind !== "evm_family_ecdsa_prepared") return walletRegistrationSetupError("invalid_state", "Registration setup snapshot is not prepared");
+	return {
+		...success,
+		kind: branches.value.nearEd25519 ? "near_ed25519_and_evm_family_ecdsa" : "evm_family_ecdsa",
+		ecdsa: {
+			kind: ecdsa.derivationKind,
+			chainTargets: ecdsa.chainTargets,
+			prepare: ecdsa.prepare,
+			strictRegistration: ecdsa.strictRegistration
+		}
+	};
+}
+//#endregion
+export { executeD1WalletRegistrationSetup };
+
+//# sourceMappingURL=d1WalletRegistrationSetupExecution.js.map

package/dist/esm/router/cloudflare/d1/registration/walletRegistrationEstablishedSessionIssuer.js

@@ -4,12 +4,12 @@ import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import "../../../../shared-ts/src/utils/encoders.js";
-import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../../shared-ts/src/utils/near.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { isEmailOtpWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseSessionOrigin, parseVerifiedOwnerProofId } from "../../../../authorization/domain.js";
 import { buildVerifiedOwnerProof, buildVerifiedWalletSessionEmailOtpFactorResult, buildVerifiedWalletSessionPasskeyFactorResult } from "../../../../authorization/factorEvidence.js";
 import { nearEd25519SigningKeyIdFromString, walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
+import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../../shared-ts/src/utils/near.js";
 import { DEFAULT_WALLET_SESSION_TTL_MS } from "../../../../shared-ts/src/threshold/sessionPolicy.js";
 import { deriveThresholdEcdsaKeyHandle } from "../../../../shared-ts/src/utils/thresholdEcdsaKeyHandle.js";
 import { registrationEstablishedMintId } from "./walletRegistrationSessionCommitReceipt.js";
@@ -288,7 +288,6 @@ async function issueDirectRegistrationEstablishedEcdsaSession(input) {
 				authorizationService: input.authorizationService,
 				authorizationTenantId: input.authorizationTenantId,
 				authority: input.authority,
-				registrationCeremonyId: input.registrationCeremonyId,
 				committed: directIssue
 			});
 			break;
@@ -372,7 +371,6 @@ async function issueDirectRegistrationEstablishedEd25519Session(input) {
 				authorizationService: input.authorizationService,
 				authorizationTenantId: input.authorizationTenantId,
 				authority: input.authority,
-				registrationCeremonyId: input.registrationCeremonyId,
 				committed: directIssue
 			});
 			authorization = await input.authorizationService.refreshWalletSessionAuthorizationV2AuthorityProjection({

package/dist/esm/router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.js

@@ -37,29 +37,35 @@ var CloudflareD1RouterAbNormalSigningAdmissionStore = class {
 	}
 	async setProjectPolicy(scope, decision) {
 		const normalized = normalizeProjectPolicyDecision(decision);
-		await this.putDecision(scope, "project_policy", runtimePolicyScopeKey(scope), normalized.kind, normalized.kind === "rejected" ? normalized.retryAfterMs : null);
+		await this.putDecision(scope, {
+			kind: "project_policy",
+			walletId: null
+		}, runtimePolicyScopeKey(scope), normalized.kind, normalized.kind === "rejected" ? normalized.retryAfterMs : null);
 	}
 	async clearProjectPolicy(scope) {
 		await this.deleteRecord(scope, "project_policy", runtimePolicyScopeKey(scope));
 	}
 	async setAbuseDecision(input, decision) {
 		const normalized = normalizeAbuseDecision(decision);
-		await this.putDecision(input.runtimePolicyScope, "abuse", abusePrincipalKey(input), normalized.kind, normalized.kind === "allowed" ? null : normalized.retryAfterMs);
+		await this.putDecision(input.runtimePolicyScope, {
+			kind: "abuse",
+			walletId: input.walletId
+		}, abusePrincipalKey(input), normalized.kind, normalized.kind === "allowed" ? null : normalized.retryAfterMs);
 	}
 	async clearAbuseDecision(input) {
 		await this.deleteRecord(input.runtimePolicyScope, "abuse", abusePrincipalKey(input));
 	}
-	async putDecision(scope, kind, key, decision, retryAfterMs) {
+	async putDecision(scope, owner, key, decision, retryAfterMs) {
 		await requireSuccessfulD1Write(this.database.prepare(`INSERT INTO ${ROUTER_AB_NORMAL_SIGNING_ADMISSION_TABLE} (
              namespace, org_id, project_id, env_id, signing_root_version,
-             record_kind, record_key, decision, retry_after_ms, updated_at_ms
-           ) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10)
+             record_kind, record_key, decision, retry_after_ms, updated_at_ms, wallet_id
+           ) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11)
            ON CONFLICT (
              namespace, org_id, project_id, env_id, signing_root_version, record_kind, record_key
            ) DO UPDATE SET
              decision = excluded.decision,
              retry_after_ms = excluded.retry_after_ms,
-             updated_at_ms = excluded.updated_at_ms`).bind(this.storageNamespace, scope.orgId, scope.projectId, scope.envId, scope.signingRootVersion, kind, key, decision, retryAfterMs, this.now()));
+             updated_at_ms = excluded.updated_at_ms`).bind(this.storageNamespace, scope.orgId, scope.projectId, scope.envId, scope.signingRootVersion, owner.kind, key, decision, retryAfterMs, this.now(), owner.walletId));
 	}
 	async deleteRecord(scope, kind, key) {
 		await requireSuccessfulD1Write(this.database.prepare(`DELETE FROM ${ROUTER_AB_NORMAL_SIGNING_ADMISSION_TABLE}

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAddSignerFinalizeRecord.js

@@ -0,0 +1,68 @@
+import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
+import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import "../../../../shared-ts/src/utils/encoders.js";
+import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
+import { parseRouterAbEd25519YaoRegistrationSideEffectRecordV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
+import { parseD1WalletAddSignerFinalizeTerminalResponse, parseWalletIdForIntent } from "../registration/d1RegistrationCeremonyRecords.js";
+//#region src/router/cloudflare/d1/wallet/d1WalletAddSignerFinalizeRecord.ts
+function parseWalletAddSignerFinalizePrepared(raw) {
+	if (!isPlainObject(raw)) return null;
+	const record = raw;
+	const walletId = parseWalletIdForIntent(record.walletId);
+	if (!walletId) return null;
+	if (record.kind === "d1_wallet_add_signer_finalize_ed25519_prepared_v1") {
+		const finalizingAtMs = record.finalizingAtMs;
+		if (typeof finalizingAtMs !== "number" || !Number.isSafeInteger(finalizingAtMs) || finalizingAtMs <= 0) return null;
+		return {
+			kind: "d1_wallet_add_signer_finalize_ed25519_prepared_v1",
+			walletId,
+			finalizingAtMs
+		};
+	}
+	if (record.kind !== "d1_wallet_add_signer_finalize_ecdsa_prepared_v1") return null;
+	const signerWriteAtMs = record.signerWriteAtMs;
+	return typeof signerWriteAtMs === "number" && Number.isSafeInteger(signerWriteAtMs) && signerWriteAtMs > 0 ? {
+		kind: "d1_wallet_add_signer_finalize_ecdsa_prepared_v1",
+		walletId,
+		signerWriteAtMs
+	} : null;
+}
+function parseD1WalletAddSignerFinalizeSideEffectRecord(raw) {
+	const record = parseRouterAbEd25519YaoRegistrationSideEffectRecordV1(raw, {
+		operation: "add_signer_finalize",
+		parsePrepared: parseWalletAddSignerFinalizePrepared,
+		parseResponse: parseD1WalletAddSignerFinalizeTerminalResponse
+	});
+	if (record?.kind === "router_ab_ed25519_yao_registration_side_effect_completion_v1" && record.response.ok && record.response.walletId !== record.prepared.walletId) return null;
+	return record;
+}
+async function fingerprintD1WalletAddSignerFinalizePrepared(prepared) {
+	return base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(prepared)));
+}
+async function returnD1WalletAddSignerFinalizePrepared(prepared) {
+	return prepared;
+}
+async function rejectUnexpectedWalletAddSignerFinalizePreparation() {
+	throw new Error("persisted add-signer finalize claim disappeared during reconciliation");
+}
+function buildD1WalletAddSignerFinalizePrepared(input) {
+	if (input.request.kind === "evm_family_ecdsa") return {
+		walletId: input.ceremony.intent.walletId,
+		kind: "d1_wallet_add_signer_finalize_ecdsa_prepared_v1",
+		signerWriteAtMs: input.nowMs
+	};
+	if (input.ceremony.signerState.kind === "near_ed25519_yao_add_signer_finalizing") return {
+		walletId: input.ceremony.intent.walletId,
+		kind: "d1_wallet_add_signer_finalize_ed25519_prepared_v1",
+		finalizingAtMs: input.ceremony.signerState.finalizingAtMs
+	};
+	return {
+		walletId: input.ceremony.intent.walletId,
+		kind: "d1_wallet_add_signer_finalize_ed25519_prepared_v1",
+		finalizingAtMs: input.nowMs
+	};
+}
+//#endregion
+export { buildD1WalletAddSignerFinalizePrepared, fingerprintD1WalletAddSignerFinalizePrepared, parseD1WalletAddSignerFinalizeSideEffectRecord, rejectUnexpectedWalletAddSignerFinalizePreparation, returnD1WalletAddSignerFinalizePrepared };
+
+//# sourceMappingURL=d1WalletAddSignerFinalizeRecord.js.map

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAddSignerService.js

@@ -20,9 +20,10 @@ import { buildRouterAbEd25519YaoAddSignerAdmissionRequestV1, createRouterAbEd255
 import { parseRouterAbEd25519YaoRegistrationSideEffectRecordV1, runRouterAbEd25519YaoRegistrationSideEffectV1, throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
 import { buildYaoEd25519WalletSignerRecord, ed25519NearPublicKeyFromBytes, implicitNearAccountIdFromEd25519PublicKeyBytes } from "../ed25519Yao/d1Ed25519YaoWalletSigner.js";
 import { routerAbEcdsaStrictRegistrationRequestMatchesFacts } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
-import { buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, normalizeThresholdEcdsaChainTargets, parseD1AddSignerIntent, parseD1RuntimePolicyScope, parseD1StoredAddSignerAuth, parseD1StoredAddSignerIntent, parseD1StoredWalletAddSignerCeremony, parseD1WalletAddSignerFinalizeTerminalResponse, parseWalletIdForIntent, positiveIntegerArraysEqual, runtimePolicyScopeMatches, thresholdEcdsaChainTargetsEqual } from "../registration/d1RegistrationCeremonyRecords.js";
-import { buildD1EvmFamilyEcdsaRegistrationPrepare } from "../registration/d1EvmFamilyEcdsaRegistrationBranch.js";
+import { buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, normalizeThresholdEcdsaChainTargets, parseD1AddSignerIntent, parseD1RuntimePolicyScope, parseD1StoredAddSignerAuth, parseD1StoredAddSignerIntent, parseD1StoredWalletAddSignerCeremony, parseWalletIdForIntent, positiveIntegerArraysEqual, runtimePolicyScopeMatches, thresholdEcdsaChainTargetsEqual } from "../registration/d1RegistrationCeremonyRecords.js";
+import { buildD1WalletAddSignerFinalizePrepared, fingerprintD1WalletAddSignerFinalizePrepared, rejectUnexpectedWalletAddSignerFinalizePreparation, returnD1WalletAddSignerFinalizePrepared } from "./d1WalletAddSignerFinalizeRecord.js";
 import { routerAbEd25519YaoLifecycleDecisionLookupV1, routerAbEd25519YaoLifecycleDecisionV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoLifecycleDecision.js";
+import { buildD1EvmFamilyEcdsaRegistrationPrepare } from "../registration/d1EvmFamilyEcdsaRegistrationBranch.js";
 import { buildActivatedEcdsaFamilyBootstrap, ecdsaStrictRegistrationAuthority, exactEcdsaParticipantPair } from "../registration/d1WalletRegistrationService.js";
 import { computeWalletAddSignerEcdsaActivationRequestDigestB64u } from "../../../../shared-ts/src/utils/walletAddSignerActivation.js";
 //#region src/router/cloudflare/d1/wallet/d1WalletAddSignerService.ts
@@ -49,7 +50,7 @@ function sameEcdsaDerivationPublicIdentityV1(left, right) {
 	return left.derivationClientSharePublicKey33B64u === right.derivationClientSharePublicKey33B64u && left.relayerPublicKey33B64u === right.relayerPublicKey33B64u && left.groupPublicKey33B64u === right.groupPublicKey33B64u && left.ethereumAddress === right.ethereumAddress;
 }
 function sameEcdsaDerivationServerBootstrapV1(left, right) {
-	return left.formatVersion === right.formatVersion && left.walletId === right.walletId && left.evmFamilySigningKeySlotId === right.evmFamilySigningKeySlotId && left.ecdsaThresholdKeyId === right.ecdsaThresholdKeyId && left.relayerKeyId === right.relayerKeyId && left.applicationBindingDigestB64u === right.applicationBindingDigestB64u && left.contextBinding32B64u === right.contextBinding32B64u && sameEcdsaDerivationPublicIdentityV1(left.publicIdentity, right.publicIdentity) && left.clientShareRetryCounter === right.clientShareRetryCounter && left.relayerShareRetryCounter === right.relayerShareRetryCounter && left.publicTranscriptDigest32B64u === right.publicTranscriptDigest32B64u && left.keyHandle === right.keyHandle && left.signingRootId === right.signingRootId && left.signingRootVersion === right.signingRootVersion && left.thresholdEcdsaPublicKeyB64u === right.thresholdEcdsaPublicKeyB64u && left.ethereumAddress === right.ethereumAddress && left.relayerVerifyingShareB64u === right.relayerVerifyingShareB64u && positiveIntegerArraysEqual(left.participantIds, right.participantIds) && left.thresholdSessionId === right.thresholdSessionId && left.activationEpoch === right.activationEpoch && left.expiresAtMs === right.expiresAtMs && left.expiresAt === right.expiresAt && left.remainingUses === right.remainingUses && sameRouterAbEcdsaDerivationNormalSigningStateV1(left.routerAbEcdsaDerivationNormalSigning, right.routerAbEcdsaDerivationNormalSigning);
+	return left.formatVersion === right.formatVersion && left.walletId === right.walletId && left.evmFamilySigningKeySlotId === right.evmFamilySigningKeySlotId && left.ecdsaThresholdKeyId === right.ecdsaThresholdKeyId && left.relayerKeyId === right.relayerKeyId && left.applicationBindingDigestB64u === right.applicationBindingDigestB64u && left.contextBinding32B64u === right.contextBinding32B64u && sameEcdsaDerivationPublicIdentityV1(left.publicIdentity, right.publicIdentity) && left.clientShareRetryCounter === right.clientShareRetryCounter && left.relayerShareRetryCounter === right.relayerShareRetryCounter && left.keyHandle === right.keyHandle && left.signingRootId === right.signingRootId && left.signingRootVersion === right.signingRootVersion && left.thresholdEcdsaPublicKeyB64u === right.thresholdEcdsaPublicKeyB64u && left.ethereumAddress === right.ethereumAddress && left.relayerVerifyingShareB64u === right.relayerVerifyingShareB64u && positiveIntegerArraysEqual(left.participantIds, right.participantIds) && left.thresholdSessionId === right.thresholdSessionId && left.activationEpoch === right.activationEpoch && left.expiresAtMs === right.expiresAtMs && left.expiresAt === right.expiresAt && left.remainingUses === right.remainingUses && sameRouterAbEcdsaDerivationNormalSigningStateV1(left.routerAbEcdsaDerivationNormalSigning, right.routerAbEcdsaDerivationNormalSigning);
 }
 function walletAddSignerStartResponseFromCeremony(ceremony) {
 	const base = {
@@ -242,54 +243,6 @@ async function rejectUnexpectedWalletAddSignerStartPreparation() {
 async function fingerprintD1WalletAddSignerStartPrepared(prepared) {
 	return base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(prepared)));
 }
-function parseWalletAddSignerFinalizePrepared(raw) {
-	const record = addSignerRecordValue(raw);
-	if (!record) return null;
-	if (record.kind === "d1_wallet_add_signer_finalize_ed25519_prepared_v1") {
-		const finalizingAtMs = record.finalizingAtMs;
-		if (typeof finalizingAtMs !== "number" || !Number.isSafeInteger(finalizingAtMs) || finalizingAtMs <= 0) return null;
-		return {
-			kind: "d1_wallet_add_signer_finalize_ed25519_prepared_v1",
-			finalizingAtMs
-		};
-	}
-	if (record.kind !== "d1_wallet_add_signer_finalize_ecdsa_prepared_v1") return null;
-	const signerWriteAtMs = record.signerWriteAtMs;
-	return typeof signerWriteAtMs === "number" && Number.isSafeInteger(signerWriteAtMs) && signerWriteAtMs > 0 ? {
-		kind: "d1_wallet_add_signer_finalize_ecdsa_prepared_v1",
-		signerWriteAtMs
-	} : null;
-}
-function parseD1WalletAddSignerFinalizeSideEffectRecord(raw) {
-	return parseRouterAbEd25519YaoRegistrationSideEffectRecordV1(raw, {
-		operation: "add_signer_finalize",
-		parsePrepared: parseWalletAddSignerFinalizePrepared,
-		parseResponse: parseD1WalletAddSignerFinalizeTerminalResponse
-	});
-}
-async function fingerprintD1WalletAddSignerFinalizePrepared(prepared) {
-	return base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(prepared)));
-}
-async function returnD1WalletAddSignerFinalizePrepared(prepared) {
-	return prepared;
-}
-async function rejectUnexpectedWalletAddSignerFinalizePreparation() {
-	throw new Error("persisted add-signer finalize claim disappeared during reconciliation");
-}
-function buildD1WalletAddSignerFinalizePrepared(input) {
-	if (input.request.kind === "evm_family_ecdsa") return {
-		kind: "d1_wallet_add_signer_finalize_ecdsa_prepared_v1",
-		signerWriteAtMs: input.nowMs
-	};
-	if (input.ceremony.signerState.kind === "near_ed25519_yao_add_signer_finalizing") return {
-		kind: "d1_wallet_add_signer_finalize_ed25519_prepared_v1",
-		finalizingAtMs: input.ceremony.signerState.finalizingAtMs
-	};
-	return {
-		kind: "d1_wallet_add_signer_finalize_ed25519_prepared_v1",
-		finalizingAtMs: input.nowMs
-	};
-}
 function rejectedWalletAddSignerStartTerminal(code, message) {
 	return {
 		kind: "d1_wallet_add_signer_start_rejected_v1",
@@ -400,7 +353,6 @@ function storedEcdsaAddSignerBootstrap(bootstrap) {
 		publicIdentity: bootstrap.publicIdentity,
 		clientShareRetryCounter: bootstrap.clientShareRetryCounter,
 		relayerShareRetryCounter: bootstrap.relayerShareRetryCounter,
-		publicTranscriptDigest32B64u: bootstrap.publicTranscriptDigest32B64u,
 		keyHandle: bootstrap.keyHandle,
 		signingRootId: bootstrap.signingRootId,
 		signingRootVersion: bootstrap.signingRootVersion,
@@ -1230,7 +1182,7 @@ var CloudflareD1WalletAddSignerService = class {
 			idempotencyKey
 		}) || await store.getAddSignerFinalizeReplayForCeremony(finalizeRequest.addSignerCeremonyId);
 		if (replay) {
-			if (!sameWalletAddSignerFinalizeRequestV1(replay.request, finalizeRequest)) return {
+			if (replay.response.walletId !== prepared.walletId || !sameWalletAddSignerFinalizeRequestV1(replay.request, finalizeRequest)) return {
 				ok: false,
 				code: "idempotency_conflict",
 				message: "idempotencyKey is already bound to another add-signer finalize request"
@@ -1243,6 +1195,7 @@ var CloudflareD1WalletAddSignerService = class {
 			code: "not_found",
 			message: "add-signer ceremony not found"
 		};
+		if (ceremony.intent.walletId !== prepared.walletId) throw new Error("Add-signer finalize claim belongs to another wallet");
 		if (finalizeRequest.kind === "near_ed25519") {
 			if (prepared.kind !== "d1_wallet_add_signer_finalize_ed25519_prepared_v1") throw new Error("Ed25519 add-signer finalize claim changed branch");
 			if (ceremony.intent.signerSelection.mode !== "ed25519" || ceremony.auth.kind !== "webauthn_assertion") return {
@@ -1530,6 +1483,6 @@ var CloudflareD1WalletAddSignerService = class {
 	}
 };
 //#endregion
-export { CloudflareD1WalletAddSignerService, parseD1WalletAddSignerFinalizeSideEffectRecord, parseD1WalletAddSignerStartSideEffectRecord };
+export { CloudflareD1WalletAddSignerService, parseD1WalletAddSignerStartSideEffectRecord };
 
 //# sourceMappingURL=d1WalletAddSignerService.js.map

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthMethodService.js

@@ -3,7 +3,6 @@ import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/util
 import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
 import "../../../../shared-ts/src/utils/encoders.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { buildDelegatedWalletAuthorityV1, buildFullOwnerPermissionsV1, sameDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { parseWalletAddAuthMethodRegistrationOptions } from "../../../../shared-ts/src/utils/addAuthMethodRegistration.js";
 import { normalizeRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
@@ -24,7 +23,7 @@ import { toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";
 import { d1HostIsWithinWebAuthnRpId, resolveD1AddAuthMethodExistingAuth, resolveD1AddSignerExistingAuth, verifyD1LinkedDeviceFreshRevokeProofV1, walletAuthAuthorityFromRegistrationAuthority } from "./d1WalletAuthMethodBoundary.js";
 import { parseWalletIdForIntent } from "../registration/d1RegistrationCeremonyRecords.js";
 import { runtimePolicyScopeKey } from "../../../../core/EmailOtpRecords.js";
-import { expiredGoogleEmailOtpRegistrationAttemptRecord, pendingGoogleEmailOtpRegistrationAttemptWithSelectedCandidate } from "../emailOtp/d1GoogleEmailOtpRegistrationRecords.js";
+import { expiredGoogleEmailOtpRegistrationAttemptRecord } from "../emailOtp/d1GoogleEmailOtpRegistrationRecords.js";
 import { admitAddWalletAuthMethod } from "../../../../shared-ts/src/utils/addWalletAuthMethod.js";
 import { computeWalletAuthMethodRevocationProofDigestV1 } from "./d1WalletAuthMethodRevocationReplayStore.js";
 //#region src/router/cloudflare/d1/wallet/d1WalletAuthMethodService.ts
@@ -864,7 +863,7 @@ var CloudflareD1WalletAuthMethodService = class {
 							deviceInfo: credential.device
 						}
 					}),
-					this.webAuthnStore.prepareCredentialBindingInsertStatement(binding),
+					await this.webAuthnStore.prepareCredentialBindingInsertStatement(binding),
 					...this.getWalletAuthMethodStore().prepareV2InsertStatements(authMethod),
 					...replayStatements,
 					...atomicCompanionStatements
@@ -1932,11 +1931,6 @@ var CloudflareD1WalletAuthMethodService = class {
 				code: "registration_candidate_mismatch",
 				message: "Google Email OTP registration candidate does not match walletId"
 			};
-			if (attempt.walletId !== selectedOfferCandidate.walletId || attempt.selectedCandidateId !== selectedOfferCandidate.candidateId || attempt.collisionCounter !== selectedOfferCandidate.collisionCounter) await this.googleEmailOtpRegistrationAttempts.put(pendingGoogleEmailOtpRegistrationAttemptWithSelectedCandidate({
-				record: attempt,
-				candidate: selectedOfferCandidate,
-				updatedAtMs: Date.now()
-			}));
 			if (runtimePolicyScopeKey(attempt.runtimePolicyScope) !== runtimePolicyScopeKeyForRegistrationIntent(input.intent.runtimePolicyScope)) return {
 				ok: false,
 				code: "runtime_policy_scope_mismatch",
@@ -1961,6 +1955,13 @@ var CloudflareD1WalletAuthMethodService = class {
 				code: "duplicate_auth_method",
 				message: "Email OTP auth method is already registered"
 			};
+			const claimed = await this.googleEmailOtpRegistrationAttempts.claimCandidate({
+				attemptId: attempt.attemptId,
+				candidateId: selectedOfferCandidate.candidateId,
+				walletId: finalWalletId,
+				intentDigest: input.expectedDigestB64u
+			});
+			if (!claimed.ok) return claimed;
 			return {
 				ok: true,
 				authority: {