@seams/wallet-server 0.7.3 → 0.9.0

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore.js

@@ -1,6 +1,6 @@
-import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
+import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
 import { isD1DatabaseLike } from "../../../../storage/d1Sql.js";
 //#region src/router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore.ts
 const TABLE_NAME = "registration_ceremony_records";
@@ -34,19 +34,17 @@ var D1RegistrationCeremonyRecordStore = class {
 		this.keyPrefix = normalizeKeyPart(options.keyPrefix, "keyPrefix", 128);
 	}
 	async get(scope, id) {
-		const key = this.normalizeKey(scope, id);
-		const row = await this.database.prepare(`SELECT version, record_json, expires_at_ms
-           FROM ${TABLE_NAME}
-          WHERE namespace = ?1
-            AND org_id = ?2
-            AND project_id = ?3
-            AND env_id = ?4
-            AND record_scope = ?5
-            AND record_id = ?6`).bind(...this.bindKey(key)).first();
+		const row = await this.prepareGet(scope, id).first();
+		return this.parseGet(scope, id, row);
+	}
+	prepareGet(scope, id) {
+		return this.prepareRead(this.normalizeKey(scope, id));
+	}
+	async parseGet(scope, id, row) {
 		if (!row) return null;
 		const parsed = parseStoredRow(row);
 		if (parsed.expiresAtMs > Date.now()) return parsed;
-		await this.deleteVersion(key, parsed.version);
+		await this.deleteVersion(this.normalizeKey(scope, id), parsed.version);
 		return null;
 	}
 	async putExact(mutation) {
@@ -61,6 +59,56 @@ var D1RegistrationCeremonyRecordStore = class {
 		if (recordsMatch(current, prepared)) return;
 		throw conflict("Registration ceremony record conflicts with the stored value");
 	}
+	async insertOrRead(mutation) {
+		const key = this.normalizeKey(mutation.scope, mutation.id);
+		const prepared = prepareValue(mutation.value, mutation.expiresAtMs);
+		if (await this.insert(key, prepared) && prepared.expiresAtMs > Date.now()) return parseStoredRow({
+			version: 1,
+			record_json: prepared.recordJson,
+			expires_at_ms: prepared.expiresAtMs
+		});
+		const stored = await this.get(mutation.scope, mutation.id);
+		if (!stored) throw conflict("Registration setup expired during persistence");
+		return stored;
+	}
+	/**
+	* Stores `mutation` and opens `copyScope` with the value that `mutation`'s
+	* key then holds, in one batch. A competing insert leaves its winner in both
+	* records, as two `insertOrRead` calls in series would.
+	*/
+	async insertOrReadWithCopy(mutation, copyScope, companion) {
+		const key = this.normalizeKey(mutation.scope, mutation.id);
+		const copyKey = this.normalizeKey(copyScope, mutation.id);
+		const nowMs = Date.now();
+		const results = await this.database.batch([
+			this.prepareInsert(key, prepareValue(mutation.value, mutation.expiresAtMs)),
+			this.database.prepare(`INSERT OR IGNORE INTO ${TABLE_NAME}
+            (namespace, org_id, project_id, env_id, record_scope, record_id,
+             version, record_json, expires_at_ms, updated_at_ms)
+           SELECT namespace, org_id, project_id, env_id, ?7, record_id,
+                  1, record_json, expires_at_ms, ?8
+             FROM ${TABLE_NAME}
+            WHERE namespace = ?1
+              AND org_id = ?2
+              AND project_id = ?3
+              AND env_id = ?4
+              AND record_scope = ?5
+              AND record_id = ?6
+              AND expires_at_ms > ?8`).bind(...this.bindKey(key), copyKey.scope, nowMs),
+			this.prepareRead(key),
+			this.prepareRead(copyKey),
+			...companion
+		]);
+		const record = results[2]?.results?.[0];
+		const copy = results[3]?.results?.[0];
+		if (!record || !copy) throw conflict("Registration setup expired during persistence");
+		const stored = {
+			record: parseStoredRow(record),
+			copy: parseStoredRow(copy)
+		};
+		if (stored.record.expiresAtMs <= nowMs || stored.copy.expiresAtMs <= nowMs) throw conflict("Registration setup expired during persistence");
+		return stored;
+	}
 	async updateExpected(input) {
 		const key = this.normalizeKey(input.scope, input.id);
 		const current = await this.get(input.scope, input.id);
@@ -117,16 +165,26 @@ var D1RegistrationCeremonyRecordStore = class {
 		const parsed = parseStoredRow(row);
 		return {
 			value: parsed.value,
-			version: parsed.version,
-			expiresAtMs: parsed.expiresAtMs
+			version: parsed.version
 		};
 	}
 	async updateExpectedVersion(input) {
+		if (changes(await this.prepareVersionedUpdate(input).run()) !== 1) throw conflict("Registration ceremony record changed during versioned update");
+		return input.expectedVersion + 1;
+	}
+	/**
+	* The update of `updateExpectedVersion` with its guard, for a batch that
+	* another store owns on this database. The guard fails that batch when the
+	* record is no longer at the expected version.
+	*/
+	prepareExpectedVersionUpdate(input) {
+		return [this.prepareVersionedUpdate(input), this.database.prepare(CAS_GUARD_SQL)];
+	}
+	prepareVersionedUpdate(input) {
 		const key = this.normalizeKey(input.scope, input.id);
 		if (!Number.isSafeInteger(input.expectedVersion) || input.expectedVersion < 1) throw new Error("Registration ceremony expected version is invalid");
 		const next = prepareValue(input.next, input.expiresAtMs);
-		if (changes(await this.database.prepare(UPDATE_EXPECTED_VERSION_SQL).bind(...this.bindKey(key), next.recordJson, next.expiresAtMs, Date.now(), input.expectedVersion).run()) !== 1) throw conflict("Registration ceremony record changed during versioned update");
-		return input.expectedVersion + 1;
+		return this.database.prepare(UPDATE_EXPECTED_VERSION_SQL).bind(...this.bindKey(key), next.recordJson, next.expiresAtMs, Date.now(), input.expectedVersion);
 	}
 	async take(scope, id) {
 		const key = this.normalizeKey(scope, id);
@@ -191,6 +249,16 @@ var D1RegistrationCeremonyRecordStore = class {
 		}
 		return true;
 	}
+	prepareRead(key) {
+		return this.database.prepare(`SELECT version, record_json, expires_at_ms
+           FROM ${TABLE_NAME}
+          WHERE namespace = ?1
+            AND org_id = ?2
+            AND project_id = ?3
+            AND env_id = ?4
+            AND record_scope = ?5
+            AND record_id = ?6`).bind(...this.bindKey(key));
+	}
 	async insert(key, value) {
 		return changes(await this.prepareInsert(key, value).run()) === 1;
 	}
@@ -235,7 +303,6 @@ function prepareValue(value, expiresAtMs) {
 	const normalizedExpiresAtMs = Math.floor(Number(expiresAtMs));
 	if (!Number.isSafeInteger(normalizedExpiresAtMs) || normalizedExpiresAtMs <= Date.now()) throw new Error("Registration ceremony record expiry must be in the future");
 	return {
-		value,
 		recordJson: alphabetizeStringify(value),
 		expiresAtMs: normalizedExpiresAtMs
 	};

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyRecords.js

@@ -1,9 +1,7 @@
 import { parseChallengeSubjectId, parseEmailOtpChallengeId, parseOrgId, parseProviderSubject, parseRootShareEpoch, parseWalletAuthMethodId, parseWalletAuthorityId, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
-import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../../shared-ts/src/utils/near.js";
-import "../../../../shared-ts/src/utils/validation.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { parseWalletAddAuthMethodRegistrationOptions } from "../../../../shared-ts/src/utils/addAuthMethodRegistration.js";
 import { parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationActivationResultV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { deriveEvmFamilySigningKeySlotId } from "../../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";
@@ -16,24 +14,22 @@ import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/
 import { parseWebAuthnAuthenticatorDeviceInfo, unknownWebAuthnAuthenticatorDeviceInfo } from "../../../../shared-ts/src/utils/webauthnDeviceInfo.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { parseRouterAbEd25519NormalSigningState } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
-import { parseEcdsaDerivationPublicIdentity, parseThresholdEd25519AuthorityScope, thresholdEd25519AuthorityScopeFromWalletAuthAuthority, thresholdEd25519AuthorityScopesMatch } from "../../../../core/ThresholdService/validation.js";
 import { thresholdEcdsaChainTargetKey } from "../../../../shared-ts/src/utils/thresholdEcdsaChainTarget.js";
 import { thresholdEcdsaChainTargetFromValue } from "../../../../core/thresholdEcdsaChainTarget.js";
 import { buildWalletEcdsaSignerRecord, parseWalletEd25519SignerRecord } from "../../../../core/d1WalletStore.js";
-import { createServerAllocatedWalletId, nearEd25519SigningKeyIdFromString, walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
+import { nearEd25519SigningKeyIdFromString, walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { registrationPreparationIdFromString } from "../../../../core/types.js";
 import "../../../../shared-ts/src/signing-lanes/index.js";
 import { parsePasskeyCustodyEnvelopeRecord } from "../../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
+import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../../shared-ts/src/utils/near.js";
 import { normalizeAddSignerSelection, normalizeRegistrationSignerPlan, registrationSignerBranchKeyFromString, registrationSignerSetSelectionFromPlan } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
 import { addAuthMethodIntentGrantFromString, addSignerIntentGrantFromString, normalizeAddAuthMethodIntentCaller } from "../../../../shared-ts/src/utils/registrationIntent.js";
+import { parseEcdsaDerivationPublicIdentity, parseThresholdEd25519AuthorityScope, thresholdEd25519AuthorityScopeFromWalletAuthAuthority, thresholdEd25519AuthorityScopesMatch } from "../../../../core/ThresholdService/validation.js";
 import { toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";
-import { parseStoredRouterAbEcdsaPendingActivationV1 } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
 import { parseStoredRegistrationSignerPlan, parseStoredWalletRegistrationPreparedContext, storedRegistrationSignerPlansMatch } from "../../../../core/RegistrationCeremonyStore.js";
+import { parseStoredRouterAbEcdsaPendingActivationV1 } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
 //#region src/router/cloudflare/d1/registration/d1RegistrationCeremonyRecords.ts
-function createD1ServerAllocatedWalletId() {
-	return createServerAllocatedWalletId();
-}
 function inferRuntimePolicyScopeFromSigningRoot(input) {
 	const signingRootId = normalizeOptionalTrimmedString(input.signingRootId);
 	const signingRootVersion = normalizeOptionalTrimmedString(input.signingRootVersion);
@@ -48,7 +44,7 @@ function inferRuntimePolicyScopeFromSigningRoot(input) {
 	};
 }
 function buildRegistrationIntent(input) {
-	const nonceB64u = secureRandomBase64Url(32);
+	const nonceB64u = input.nonceB64u;
 	const foundingWalletAuthMethodId = input.foundingWalletAuthMethodId;
 	if (input.runtimePolicyScope) return {
 		version: "registration_intent_v1",
@@ -1369,7 +1365,6 @@ function parseD1EcdsaDerivationServerBootstrapResponse(raw) {
 	const publicIdentity = parseD1EcdsaDerivationPublicIdentity(record.publicIdentity);
 	const clientShareRetryCounter = safeInteger(record.clientShareRetryCounter);
 	const relayerShareRetryCounter = safeInteger(record.relayerShareRetryCounter);
-	const publicTranscriptDigest32B64u = normalizeOptionalTrimmedString(record.publicTranscriptDigest32B64u);
 	const keyHandle = normalizeOptionalTrimmedString(record.keyHandle);
 	const signingRootId = normalizeOptionalTrimmedString(record.signingRootId);
 	const signingRootVersion = normalizeOptionalTrimmedString(record.signingRootVersion);
@@ -1384,7 +1379,7 @@ function parseD1EcdsaDerivationServerBootstrapResponse(raw) {
 	const expiresAt = normalizeOptionalTrimmedString(record.expiresAt);
 	const remainingUses = safeInteger(record.remainingUses);
 	const routerAbEcdsaDerivationNormalSigning = parseRouterAbEcdsaDerivationNormalSigningStateV1(record.routerAbEcdsaDerivationNormalSigning);
-	if (!walletId || !evmFamilySigningKeySlotId || !ecdsaThresholdKeyId || !relayerKeyId || !applicationBindingDigestB64u || !contextBinding32B64u || !publicIdentity || clientShareRetryCounter === null || relayerShareRetryCounter === null || !publicTranscriptDigest32B64u || !keyHandle || !signingRootId || !signingRootVersion || !thresholdEcdsaPublicKeyB64u || !ethereumAddress || !relayerVerifyingShareB64u || !participantIds || !thresholdSessionId || !activationEpoch || expiresAtMs === null || !expiresAt || remainingUses === null || !routerAbEcdsaDerivationNormalSigning) return null;
+	if (!walletId || !evmFamilySigningKeySlotId || !ecdsaThresholdKeyId || !relayerKeyId || !applicationBindingDigestB64u || !contextBinding32B64u || !publicIdentity || clientShareRetryCounter === null || relayerShareRetryCounter === null || !keyHandle || !signingRootId || !signingRootVersion || !thresholdEcdsaPublicKeyB64u || !ethereumAddress || !relayerVerifyingShareB64u || !participantIds || !thresholdSessionId || !activationEpoch || expiresAtMs === null || !expiresAt || remainingUses === null || !routerAbEcdsaDerivationNormalSigning) return null;
 	return {
 		formatVersion: "ecdsa-derivation-role-local",
 		walletId,
@@ -1396,7 +1391,6 @@ function parseD1EcdsaDerivationServerBootstrapResponse(raw) {
 		publicIdentity,
 		clientShareRetryCounter,
 		relayerShareRetryCounter,
-		publicTranscriptDigest32B64u,
 		keyHandle,
 		signingRootId,
 		signingRootVersion,
@@ -2034,6 +2028,6 @@ function unreachableAddAuthMethodInput(value) {
 	throw new Error(`Unhandled add-auth-method input kind: ${String(value)}`);
 }
 //#endregion
-export { buildAddAuthMethodIntent, buildAddSignerIntent, buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, buildD1WalletRecord, buildRegistrationIntent, createD1ServerAllocatedWalletId, deriveEvmFamilySigningKeySlotId, inferRuntimePolicyScopeFromSigningRoot, intentScopeMetadata, normalizeThresholdEcdsaChainTargets, parseD1AddSignerIntent, parseD1EcdsaDerivationServerBootstrapResponse, parseD1RuntimePolicyScope, parseD1StoredAddAuthMethodIntent, parseD1StoredAddSignerAuth, parseD1StoredAddSignerIntent, parseD1StoredWalletAddAuthMethodCeremony, parseD1StoredWalletAddAuthMethodFinalizeReplay, parseD1StoredWalletAddSignerCeremony, parseD1StoredWalletAddSignerFinalizeReplay, parseD1StoredWalletRegistrationCeremony, parseD1WalletAddSignerFinalizeTerminalResponse, parseD1WalletRegistrationCommittedInstallationProjection, parseD1WalletRegistrationFinalizeReplayResponse, parseWalletIdForIntent, positiveIntegerArraysEqual, runtimePolicyScopeMatches, thresholdEcdsaChainTargetsEqual };
+export { buildAddAuthMethodIntent, buildAddSignerIntent, buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, buildD1WalletRecord, buildRegistrationIntent, deriveEvmFamilySigningKeySlotId, inferRuntimePolicyScopeFromSigningRoot, intentScopeMetadata, normalizeThresholdEcdsaChainTargets, parseD1AddSignerIntent, parseD1EcdsaDerivationServerBootstrapResponse, parseD1RuntimePolicyScope, parseD1StoredAddAuthMethodIntent, parseD1StoredAddSignerAuth, parseD1StoredAddSignerIntent, parseD1StoredWalletAddAuthMethodCeremony, parseD1StoredWalletAddAuthMethodFinalizeReplay, parseD1StoredWalletAddSignerCeremony, parseD1StoredWalletAddSignerFinalizeReplay, parseD1StoredWalletRegistrationCeremony, parseD1WalletAddSignerFinalizeTerminalResponse, parseD1WalletRegistrationCommittedInstallationProjection, parseD1WalletRegistrationFinalizeReplayResponse, parseWalletIdForIntent, positiveIntegerArraysEqual, runtimePolicyScopeMatches, thresholdEcdsaChainTargetsEqual };
 
 //# sourceMappingURL=d1RegistrationCeremonyRecords.js.map

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyStore.js

@@ -1,34 +1,62 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
+import { prepareD1RegistrationHomeReservation } from "./d1WalletExecutionAuthority.js";
 import { parseD1StoredAddAuthMethodIntent, parseD1StoredAddSignerIntent, parseD1StoredWalletAddAuthMethodCeremony, parseD1StoredWalletAddAuthMethodFinalizeReplay, parseD1StoredWalletAddSignerCeremony, parseD1StoredWalletAddSignerFinalizeReplay, parseD1StoredWalletRegistrationCeremony } from "./d1RegistrationCeremonyRecords.js";
 import { D1RegistrationCeremonyRecordStore } from "./d1RegistrationCeremonyRecordStore.js";
 //#region src/router/cloudflare/d1/registration/d1RegistrationCeremonyStore.ts
 var CloudflareD1RegistrationCeremonyIntentStore = class {
 	constructor(input) {
+		this.input = input;
 		this.storage = new D1RegistrationCeremonyRecordStore(input);
 	}
-	async putCeremony(ceremony) {
-		await this.put({
-			scope: "ceremony",
-			id: ceremony.registrationCeremonyId,
-			record: ceremony,
-			expiresAtMs: ceremony.expiresAtMs
-		});
+	async getSetupCeremony(ceremonyId) {
+		const stored = await this.storage.get("setup-ceremony", ceremonyId);
+		if (!stored) return null;
+		const ceremony = parseD1StoredWalletRegistrationCeremony(stored.value);
+		if (!ceremony) throw new Error("Registration setup snapshot is invalid");
+		return ceremony;
+	}
+	/** One batch stores the setup snapshot, ceremony, and authenticated execution identity. */
+	async reserveSetupCeremony(proposed, ownershipGeneration) {
+		const stored = await this.storage.insertOrReadWithCopy({
+			scope: "setup-ceremony",
+			id: proposed.registrationCeremonyId,
+			value: encodeRecord(proposed),
+			expiresAtMs: proposed.expiresAtMs
+		}, "ceremony", prepareD1RegistrationHomeReservation(this.input.database, this.input.scope, {
+			walletId: proposed.intent.walletId,
+			ceremonyId: proposed.registrationCeremonyId,
+			ownershipGeneration
+		}));
+		const ceremony = parseD1StoredWalletRegistrationCeremony(stored.record.value);
+		if (!ceremony || !sameSetupReservation(ceremony, proposed)) throw new Error("Registration setup snapshot conflicts with its reservation");
+		const current = parseD1StoredWalletRegistrationCeremony(stored.copy.value);
+		if (!current || !sameSetupReservation(current, ceremony)) throw new Error("Registration ceremony conflicts with its setup snapshot");
+		return ceremony;
 	}
 	async getCeremony(registrationCeremonyId) {
 		return (await this.getCeremonySnapshot(registrationCeremonyId))?.ceremony ?? null;
 	}
-	async getCeremonySnapshot(registrationCeremonyId) {
-		const id = normalizeOptionalTrimmedString(registrationCeremonyId);
-		if (!id) return null;
-		const stored = await this.storage.get("ceremony", id);
+	prepareCeremonyRead(registrationCeremonyId) {
+		return this.storage.prepareGet("ceremony", registrationCeremonyId);
+	}
+	async parseCeremonyRead(registrationCeremonyId, result) {
+		return (await this.parseCeremonySnapshotRead(registrationCeremonyId, result))?.ceremony ?? null;
+	}
+	async parseCeremonySnapshotRead(registrationCeremonyId, result) {
+		if (!result.success) throw new Error("Registration ceremony D1 read failed");
+		const stored = await this.storage.parseGet("ceremony", registrationCeremonyId, result.results?.[0] ?? null);
 		if (!stored) return null;
 		const ceremony = parseD1StoredWalletRegistrationCeremony(stored.value);
-		if (!ceremony || ceremony.expiresAtMs <= Date.now()) return null;
-		return {
+		return ceremony && ceremony.expiresAtMs > Date.now() ? {
 			ceremony,
 			version: stored.version
-		};
+		} : null;
+	}
+	async getCeremonySnapshot(registrationCeremonyId) {
+		const id = normalizeOptionalTrimmedString(registrationCeremonyId);
+		if (!id) return null;
+		return this.parseCeremonySnapshotRead(id, await this.prepareCeremonyRead(id).all());
 	}
 	async updateCeremony(input) {
 		if (input.expected.registrationCeremonyId !== input.next.registrationCeremonyId) throw new Error("Registration ceremony update cannot change its identity");
@@ -71,21 +99,11 @@ var CloudflareD1RegistrationCeremonyIntentStore = class {
 		});
 	}
 	async commitEcdsaClaim(input) {
-		if (input.expected.ceremony.registrationCeremonyId !== input.next.registrationCeremonyId) throw new Error("ECDSA registration claim commit cannot change its ceremony identity");
-		await this.storage.updateExpectedVersion({
-			scope: "ceremony",
-			id: input.next.registrationCeremonyId,
-			expectedVersion: input.expected.version,
-			next: encodeRecord(input.next),
-			expiresAtMs: input.next.expiresAtMs
-		});
+		await this.storage.updateExpectedVersion(ceremonyCommitUpdate(input));
 	}
-	async takeCeremony(registrationCeremonyId) {
-		const id = normalizeOptionalTrimmedString(registrationCeremonyId);
-		if (!id) return null;
-		const ceremony = parseD1StoredWalletRegistrationCeremony(await this.getDel("ceremony", id));
-		if (!ceremony || ceremony.expiresAtMs <= Date.now()) return null;
-		return ceremony;
+	/** `commitEcdsaClaim` as statements for a batch that another store owns on this database. */
+	prepareEcdsaClaimCommit(input) {
+		return { statements: this.storage.prepareExpectedVersionUpdate(ceremonyCommitUpdate(input)) };
 	}
 	async deleteCeremony(registrationCeremonyId) {
 		const id = normalizeOptionalTrimmedString(registrationCeremonyId);
@@ -306,6 +324,20 @@ function encodeRecord(value) {
 	if (!isPlainObject(value)) throw new Error("Registration ceremony record must be an object");
 	return value;
 }
+function ceremonyCommitUpdate(input) {
+	if (input.expected.ceremony.registrationCeremonyId !== input.next.registrationCeremonyId) throw new Error("ECDSA registration claim commit cannot change its ceremony identity");
+	return {
+		scope: "ceremony",
+		id: input.next.registrationCeremonyId,
+		expectedVersion: input.expected.version,
+		next: encodeRecord(input.next),
+		expiresAtMs: input.next.expiresAtMs
+	};
+}
+/** The facts a reservation fixes for its setup snapshot and its ceremony. */
+function sameSetupReservation(stored, expected) {
+	return stored.registrationCeremonyId === expected.registrationCeremonyId && stored.expiresAtMs === expected.expiresAtMs && stored.orgId === expected.orgId && stored.digestB64u === expected.digestB64u && stored.foundingWalletAuthorityId === expected.foundingWalletAuthorityId && stored.foundingDeviceId === expected.foundingDeviceId && stored.foundingWalletAuthMethodId === expected.foundingWalletAuthMethodId && stored.expectedOrigin === expected.expectedOrigin;
+}
 //#endregion
 export { CloudflareD1RegistrationCeremonyIntentStore };
 

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationIntentService.js

@@ -1,6 +1,5 @@
 import { parseWalletAuthMethodId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { normalizeAddAuthMethodInput } from "../../../../shared-ts/src/utils/registrationAuthMethodInput.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { failure } from "../../../../shared-ts/src/utils/failure.js";

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationSessionTransaction.js

@@ -0,0 +1,28 @@
+//#region src/router/cloudflare/d1/registration/d1RegistrationSessionTransaction.ts
+/** The wallet's version checks and the session's winner read share one batch. */
+var D1RegistrationSessionTransaction = class {
+	constructor(database, commitWallet) {
+		this.database = database;
+		this.commitWallet = commitWallet;
+		this.sessionResults = null;
+	}
+	async execute(sessionStatements) {
+		await this.commitWallet(this.commit.bind(this, sessionStatements));
+		if (this.sessionResults === null) throw new Error("Registration wallet commit did not execute its session transaction");
+		return this.sessionResults;
+	}
+	async commit(sessionStatements, walletStatements) {
+		this.sessionResults = null;
+		const results = await this.database.batch([...walletStatements, ...sessionStatements]);
+		if (results.length !== walletStatements.length + sessionStatements.length || results.some(batchStatementFailed)) throw new Error("Registration wallet/session transaction returned incomplete results");
+		this.sessionResults = results.slice(walletStatements.length);
+		return results.slice(0, walletStatements.length);
+	}
+};
+function batchStatementFailed(result) {
+	return !result.success;
+}
+//#endregion
+export { D1RegistrationSessionTransaction };
+
+//# sourceMappingURL=d1RegistrationSessionTransaction.js.map

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationSetupSupport.js

@@ -0,0 +1,84 @@
+import { findRegistrationSignerPlanEvmFamilyEcdsaBranch, findRegistrationSignerPlanNearEd25519Branch, registrationSignerPlanFromSelection } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
+import { buildStoredWalletRegistrationPreparedContext } from "../../../../core/RegistrationCeremonyStore.js";
+import { normalizeThresholdEcdsaChainTargets } from "./d1RegistrationCeremonyRecords.js";
+//#region src/router/cloudflare/d1/registration/d1RegistrationSetupSupport.ts
+function errorMessage(error) {
+	return error instanceof Error ? error.message : String(error || "");
+}
+function startD1RegistrationRouteTiming(name) {
+	return {
+		name,
+		startedAtMs: Date.now()
+	};
+}
+function finishD1RegistrationRouteTiming(recorder, mark) {
+	recorder.entries.push({
+		name: mark.name,
+		durationMs: Math.max(0, Date.now() - mark.startedAtMs)
+	});
+}
+function createD1RegistrationRouteTimingRecorder(route) {
+	return {
+		route,
+		entries: []
+	};
+}
+function registrationIntentSignerBranches(intent) {
+	const plan = registrationSignerPlanFromSelection(intent.signerSelection);
+	if (!plan.ok) return plan;
+	return {
+		ok: true,
+		value: registrationSignerBranchesFromPlan(plan.value)
+	};
+}
+function resolveRegistrationPreparedContextFromPlan(input) {
+	const branches = registrationSignerBranchesFromPlan(input.signerPlan);
+	const ecdsaChainTargets = branches.evmFamilyEcdsa ? normalizeThresholdEcdsaChainTargets(branches.evmFamilyEcdsa.chainTargets) : null;
+	if (branches.evmFamilyEcdsa && !ecdsaChainTargets) return {
+		ok: false,
+		code: "invalid_body",
+		message: "ECDSA registration contains an invalid chain target"
+	};
+	try {
+		return {
+			ok: true,
+			preparedContext: buildStoredWalletRegistrationPreparedContext({
+				signingRootId: input.signingRootId,
+				signingRootVersion: input.signingRootVersion,
+				runtimePolicyScope: input.runtimePolicyScope || null,
+				ecdsaChainTargets
+			}),
+			ecdsaChainTargets
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			code: "invalid_body",
+			message: errorMessage(error) || "registration prepared context is invalid"
+		};
+	}
+}
+function registrationPreparedContextEcdsaChainTargets(preparedContext) {
+	return preparedContext.ecdsa.kind === "evm_family_ecdsa_requested" ? preparedContext.ecdsa.chainTargets : null;
+}
+function registrationSignerBranchesFromPlan(plan) {
+	return {
+		plan,
+		nearEd25519: findRegistrationSignerPlanNearEd25519Branch(plan),
+		evmFamilyEcdsa: findRegistrationSignerPlanEvmFamilyEcdsaBranch(plan)
+	};
+}
+function recordRegistrationServerTiming(sink, name, startedAtMs) {
+	sink.push([name, Math.max(0, Date.now() - startedAtMs)]);
+}
+async function recordRegistrationPromiseTiming(args) {
+	try {
+		return await args.promise;
+	} finally {
+		recordRegistrationServerTiming(args.sink, args.name, args.startedAtMs);
+	}
+}
+//#endregion
+export { createD1RegistrationRouteTimingRecorder, errorMessage, finishD1RegistrationRouteTiming, recordRegistrationPromiseTiming, recordRegistrationServerTiming, registrationIntentSignerBranches, registrationPreparedContextEcdsaChainTargets, registrationSignerBranchesFromPlan, resolveRegistrationPreparedContextFromPlan, startD1RegistrationRouteTiming };
+
+//# sourceMappingURL=d1RegistrationSetupSupport.js.map

package/dist/esm/router/cloudflare/d1/registration/d1WalletExecutionAuthority.js

@@ -0,0 +1,168 @@
+import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
+import { prepareD1TenantStatement } from "../../../../core/d1TenantStore.js";
+//#region src/router/cloudflare/d1/registration/d1WalletExecutionAuthority.ts
+var D1WalletExecutionAuthority = class {
+	constructor(database, scope, registration) {
+		this.database = database;
+		this.scope = scope;
+		this.registration = registration;
+	}
+	reserve(input) {
+		return this.registration.reserve(input);
+	}
+	async admitHome(input) {
+		const result = await this.prepareHomeRead(input).all();
+		return this.admitHomeRead(input, result);
+	}
+	prepareHomeRead(input) {
+		return prepareD1TenantStatement(this.database, this.scope, `SELECT generation, state, registration_completion,
+         EXISTS (SELECT 1 FROM wallet_relocation_write_blocks block
+           WHERE block.namespace = ?1 AND block.org_id = ?2 AND block.project_id = ?3
+             AND block.env_id = ?4 AND block.wallet_id = ?5 AND block.source_generation = generation
+             AND block.state IN ('draining', 'checked')) AS relocation_blocked
+       FROM wallet_execution_generations
+       WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+         AND wallet_id = ?5 AND origin = 'registration' AND origin_id = ?6`, [input.walletId, input.ceremonyId]);
+	}
+	async admitHomeRead(input, result) {
+		if (!result.success) throw new Error("Registration home D1 read failed");
+		const local = result.results?.[0];
+		if (local) {
+			if (typeof local.generation !== "number" || !Number.isSafeInteger(local.generation) || local.generation < 1 || local.relocation_blocked !== 0 && local.relocation_blocked !== 1) throw new Error("Registration execution identity is invalid");
+			switch (local.state) {
+				case "active":
+					if (local.relocation_blocked === 1) return {
+						ok: false,
+						code: "wallet_home_unavailable",
+						message: "Wallet execution is not active at this home"
+					};
+					return {
+						ok: true,
+						purpose: "ordinary",
+						ownershipGeneration: local.generation
+					};
+				case "registering":
+					if (local.registration_completion === "pending") return {
+						ok: true,
+						purpose: "registration",
+						ownershipGeneration: local.generation
+					};
+					if (local.registration_completion !== "established") throw new Error("Registration completion state is invalid");
+					return {
+						ok: true,
+						purpose: "registration",
+						ownershipGeneration: local.generation
+					};
+				case "retired":
+					if (local.registration_completion === "cancelled") {
+						const published = await this.cancel(input);
+						if (!published.ok) return published;
+					}
+					return {
+						ok: false,
+						code: "wallet_home_unavailable",
+						message: "Registration execution is retired at this home"
+					};
+				default: throw new Error("Registration execution state is invalid");
+			}
+		}
+		return {
+			ok: false,
+			code: "wallet_home_unavailable",
+			message: "Registration setup has no local execution identity"
+		};
+	}
+	async cancel(input) {
+		const completion = {
+			...input,
+			outcome: "cancelled"
+		};
+		await this.fixCancellation(input);
+		const completed = await this.registration.complete(completion);
+		if (!completed.ok) return completed;
+		await this.database.batch(this.prepareState(input, "retired"));
+		return completed;
+	}
+	async publishEstablished(input) {
+		if (input.registration.state === "active") return {
+			ok: true,
+			activation: null
+		};
+		const completed = await this.registration.complete({
+			ceremonyId: input.registration.ceremonyId,
+			walletId: input.registration.walletId,
+			outcome: "established",
+			session: input.session
+		});
+		if (!completed.ok) return completed;
+		return {
+			ok: true,
+			activation: { statements: this.prepareState(input.registration, "active") }
+		};
+	}
+	async fixCancellation(input) {
+		await this.database.batch([prepareD1TenantStatement(this.database, this.scope, `UPDATE wallet_execution_generations
+         SET registration_completion = 'cancelled', state = 'retired'
+         WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+           AND wallet_id = ?5 AND origin = 'registration' AND origin_id = ?6
+           AND registration_completion IN ('pending', 'cancelled')
+           AND state IN ('registering', 'retired')`, [input.walletId, input.ceremonyId]), this.database.prepare(D1_BATCH_CAS_GUARD_SQL)]);
+	}
+	/** The state update with its guard. The guard reads the row count of the update before it. */
+	prepareState(input, state) {
+		return [prepareD1TenantStatement(this.database, this.scope, `UPDATE wallet_execution_generations SET state = ?7
+         WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+           AND wallet_id = ?5 AND origin = 'registration' AND origin_id = ?6
+           AND state IN ('registering', ?7)`, [
+			input.walletId,
+			input.ceremonyId,
+			state
+		]), this.database.prepare(D1_BATCH_CAS_GUARD_SQL)];
+	}
+	async admitEstablishedHome(input) {
+		return admitD1EstablishedWalletHome(this.database, this.scope, input);
+	}
+};
+/** Records the authenticated reservation beside setup without reopening a retired home. */
+function prepareD1RegistrationHomeReservation(database, scope, input) {
+	if (!Number.isSafeInteger(input.ownershipGeneration) || input.ownershipGeneration < 1) throw new Error("Registration execution generation is invalid");
+	const identity = [
+		input.walletId,
+		input.ownershipGeneration,
+		input.ceremonyId
+	];
+	return [
+		prepareD1TenantStatement(database, scope, `INSERT INTO wallet_execution_generations
+        (namespace, org_id, project_id, env_id, wallet_id, generation, origin, origin_id, state)
+       VALUES (?1, ?2, ?3, ?4, ?5, ?6, 'registration', ?7, 'registering')
+       ON CONFLICT DO NOTHING`, identity),
+		prepareD1TenantStatement(database, scope, `UPDATE wallet_execution_generations SET state = state
+       WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+         AND wallet_id = ?5 AND generation = ?6 AND origin = 'registration'
+         AND origin_id = ?7 AND state IN ('registering', 'active')`, identity),
+		database.prepare(D1_BATCH_CAS_GUARD_SQL)
+	];
+}
+async function admitD1EstablishedWalletHome(database, scope, input) {
+	const row = await prepareD1TenantStatement(database, scope, `SELECT generation FROM wallet_execution_generations
+     WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+       AND wallet_id = ?5 AND state = 'active'
+       AND NOT EXISTS (SELECT 1 FROM wallet_relocation_write_blocks block
+         WHERE block.namespace = ?1 AND block.org_id = ?2 AND block.project_id = ?3
+           AND block.env_id = ?4 AND block.wallet_id = ?5 AND block.source_generation = generation
+           AND block.state IN ('draining', 'checked'))`, [input.walletId]).first();
+	if (!row) return {
+		ok: false,
+		code: "wallet_home_unavailable",
+		message: "Wallet execution is not active at this home"
+	};
+	return {
+		ok: true,
+		purpose: "ordinary",
+		ownershipGeneration: row.generation
+	};
+}
+//#endregion
+export { D1WalletExecutionAuthority, admitD1EstablishedWalletHome, prepareD1RegistrationHomeReservation };
+
+//# sourceMappingURL=d1WalletExecutionAuthority.js.map