@seams/wallet-server 0.7.3 → 0.9.0

package/dist/esm/router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.js

@@ -1,6 +1,7 @@
 import { isPlainObject, requireNonEmptyString } from "../../../../shared-ts/src/utils/validation.js";
 import { normalizeRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { isD1DatabaseLike, parseD1JsonColumn } from "../../../../storage/d1Sql.js";
+import { ED25519_SIGNER_ACTIVATION_ID_PATH } from "../../../../core/d1WalletStore.js";
 import { abusePrincipalKey, runtimePolicyScopeKey } from "../../../domains/signingOperations/routerAbNormalSigningAdmissionCore.js";
 //#region src/router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.ts
 const ROUTER_AB_NORMAL_SIGNING_ADMISSION_TABLE = "router_ab_normal_signing_admission_records";
@@ -12,10 +13,8 @@ var CloudflareD1RouterAbNormalSigningAdmissionStore = class {
 		this.now = options.now || Date.now;
 	}
 	async evaluatePolicy(input) {
-		if (input.curve === "ecdsa" && input.policyReadSource.kind === "credential_snapshot") {
-			const decision = input.policyReadSource.policyRead.resolve(this.database, this.storageNamespace, input);
-			if (decision) return decision;
-		}
+		const snapshot = credentialPolicyDecision(input, this.database, this.storageNamespace);
+		if (snapshot) return snapshot;
 		const scope = input.runtimePolicyScope;
 		return parsePolicyRow(await this.database.prepare(`WITH scope(namespace, org_id, project_id, env_id, signing_root_version,
                   project_key, abuse_key) AS (VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7))
@@ -37,29 +36,35 @@ var CloudflareD1RouterAbNormalSigningAdmissionStore = class {
 	}
 	async setProjectPolicy(scope, decision) {
 		const normalized = normalizeProjectPolicyDecision(decision);
-		await this.putDecision(scope, "project_policy", runtimePolicyScopeKey(scope), normalized.kind, normalized.kind === "rejected" ? normalized.retryAfterMs : null);
+		await this.putDecision(scope, {
+			kind: "project_policy",
+			walletId: null
+		}, runtimePolicyScopeKey(scope), normalized.kind, normalized.kind === "rejected" ? normalized.retryAfterMs : null);
 	}
 	async clearProjectPolicy(scope) {
 		await this.deleteRecord(scope, "project_policy", runtimePolicyScopeKey(scope));
 	}
 	async setAbuseDecision(input, decision) {
 		const normalized = normalizeAbuseDecision(decision);
-		await this.putDecision(input.runtimePolicyScope, "abuse", abusePrincipalKey(input), normalized.kind, normalized.kind === "allowed" ? null : normalized.retryAfterMs);
+		await this.putDecision(input.runtimePolicyScope, {
+			kind: "abuse",
+			walletId: input.walletId
+		}, abusePrincipalKey(input), normalized.kind, normalized.kind === "allowed" ? null : normalized.retryAfterMs);
 	}
 	async clearAbuseDecision(input) {
 		await this.deleteRecord(input.runtimePolicyScope, "abuse", abusePrincipalKey(input));
 	}
-	async putDecision(scope, kind, key, decision, retryAfterMs) {
+	async putDecision(scope, owner, key, decision, retryAfterMs) {
 		await requireSuccessfulD1Write(this.database.prepare(`INSERT INTO ${ROUTER_AB_NORMAL_SIGNING_ADMISSION_TABLE} (
              namespace, org_id, project_id, env_id, signing_root_version,
-             record_kind, record_key, decision, retry_after_ms, updated_at_ms
-           ) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10)
+             record_kind, record_key, decision, retry_after_ms, updated_at_ms, wallet_id
+           ) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11)
            ON CONFLICT (
              namespace, org_id, project_id, env_id, signing_root_version, record_kind, record_key
            ) DO UPDATE SET
              decision = excluded.decision,
              retry_after_ms = excluded.retry_after_ms,
-             updated_at_ms = excluded.updated_at_ms`).bind(this.storageNamespace, scope.orgId, scope.projectId, scope.envId, scope.signingRootVersion, kind, key, decision, retryAfterMs, this.now()));
+             updated_at_ms = excluded.updated_at_ms`).bind(this.storageNamespace, scope.orgId, scope.projectId, scope.envId, scope.signingRootVersion, owner.kind, key, decision, retryAfterMs, this.now(), owner.walletId));
 	}
 	async deleteRecord(scope, kind, key) {
 		await requireSuccessfulD1Write(this.database.prepare(`DELETE FROM ${ROUTER_AB_NORMAL_SIGNING_ADMISSION_TABLE}
@@ -175,33 +180,7 @@ var D1EcdsaAdmissionPolicyRead = class D1EcdsaAdmissionPolicyRead {
 		this.#decisions = decisions;
 	}
 	static fromRows(database, namespace, walletId, activationId, rows) {
-		if (!Array.isArray(rows)) throw new Error("ECDSA policy candidates are invalid");
-		const decisions = /* @__PURE__ */ new Map();
-		for (const row of rows) {
-			if (!isPlainObject(row)) throw new Error("ECDSA policy candidate is invalid");
-			const key = runtimePolicyScopeKey(normalizeRuntimePolicyScope(parseD1JsonColumn(row.scope_json)));
-			if (decisions.has(key)) throw new Error("ECDSA policy scope is ambiguous");
-			try {
-				const decision = parsePolicyRow({
-					project_key: row.project_key,
-					project_decision: row.project_decision,
-					project_retry_after_ms: row.project_retry_after_ms,
-					abuse_key: row.abuse_key,
-					abuse_decision: row.abuse_decision,
-					abuse_retry_after_ms: row.abuse_retry_after_ms
-				});
-				decisions.set(key, {
-					ok: true,
-					decision
-				});
-			} catch (error) {
-				decisions.set(key, {
-					ok: false,
-					message: error instanceof Error ? error.message : "ECDSA policy read failed"
-				});
-			}
-		}
-		return new D1EcdsaAdmissionPolicyRead(database, namespace, walletId, activationId, decisions);
+		return new D1EcdsaAdmissionPolicyRead(database, namespace, walletId, activationId, parsePolicyCandidates(rows, "ECDSA"));
 	}
 	resolve(database, namespace, input) {
 		if (database !== this.database || namespace !== this.namespace) return null;
@@ -212,13 +191,79 @@ var D1EcdsaAdmissionPolicyRead = class D1EcdsaAdmissionPolicyRead {
 		return result.decision;
 	}
 };
-const ECDSA_CREDENTIAL_POLICY_PROJECTION = `
+/** Policy rows read with an Ed25519 Wallet Session, for the scopes of its signer. */
+var D1Ed25519AdmissionPolicyRead = class D1Ed25519AdmissionPolicyRead {
+	#decisions;
+	constructor(database, namespace, walletId, authorityId, decisions) {
+		this.database = database;
+		this.namespace = namespace;
+		this.walletId = walletId;
+		this.authorityId = authorityId;
+		this.#decisions = decisions;
+	}
+	static fromRows(database, namespace, walletId, authorityId, rows) {
+		return new D1Ed25519AdmissionPolicyRead(database, namespace, walletId, authorityId, parsePolicyCandidates(rows, "Ed25519"));
+	}
+	/**
+	* Null sends the caller to the database: another store, or a scope this read
+	* did not select. Linked-device material has no signer row to select from.
+	*/
+	resolve(database, namespace, input) {
+		if (database !== this.database || namespace !== this.namespace) return null;
+		if (input.walletId !== this.walletId || input.authorityId !== this.authorityId) throw new Error("Ed25519 policy credential scope does not match");
+		const result = this.#decisions.get(runtimePolicyScopeKey(input.runtimePolicyScope));
+		if (!result) return null;
+		if (!result.ok) throw new Error(result.message);
+		return result.decision;
+	}
+};
+/** The decision a credential read already holds for this store, when the request carries one. */
+function credentialPolicyDecision(input, database, namespace) {
+	if (input.curve === "ecdsa") return input.policyReadSource.kind === "credential_snapshot" ? input.policyReadSource.policyRead.resolve(database, namespace, input) : null;
+	if (input.authorityKind !== "wallet_authority_v1" || input.policyReadSource.kind !== "credential_snapshot") return null;
+	return input.policyReadSource.policyRead.resolve(database, namespace, input);
+}
+function parsePolicyCandidates(rows, curve) {
+	if (!Array.isArray(rows)) throw new Error(`${curve} policy candidates are invalid`);
+	const decisions = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		if (!isPlainObject(row)) throw new Error(`${curve} policy candidate is invalid`);
+		const key = runtimePolicyScopeKey(normalizeRuntimePolicyScope(parseD1JsonColumn(row.scope_json)));
+		if (decisions.has(key)) throw new Error(`${curve} policy scope is ambiguous`);
+		try {
+			const decision = parsePolicyRow({
+				project_key: row.project_key,
+				project_decision: row.project_decision,
+				project_retry_after_ms: row.project_retry_after_ms,
+				abuse_key: row.abuse_key,
+				abuse_decision: row.abuse_decision,
+				abuse_retry_after_ms: row.abuse_retry_after_ms
+			});
+			decisions.set(key, {
+				ok: true,
+				decision
+			});
+		} catch (error) {
+			decisions.set(key, {
+				ok: false,
+				message: error instanceof Error ? error.message : `${curve} policy read failed`
+			});
+		}
+	}
+	return decisions;
+}
+/**
+* Policy rows for the runtime scopes of the session wallet's signers, read in
+* the session's own statement. `signers` selects the signer rows, `scopePath`
+* is where a row holds its scope, and `principal` names the abuse principal.
+*/
+function credentialPolicyProjection(input) {
+	return `
   (WITH candidates AS (
-     SELECT DISTINCT json_extract(signer.record_json, '$.runtimePolicyScope') AS scope_json
+     SELECT DISTINCT json_extract(signer.record_json, '${input.scopePath}') AS scope_json
        FROM wallet_signers AS signer
-      WHERE signer.namespace = session.namespace AND signer.org_id = session.org_id
-        AND signer.project_id = session.project_id AND signer.env_id = session.env_id
-        AND signer.wallet_id = session.wallet_id AND signer.signer_family = 'ecdsa'
+      WHERE ${input.signers}
+        AND signer.wallet_id = session.wallet_id AND signer.signer_family = '${input.family}'
         AND json_valid(signer.record_json)
    ), scopes AS (
      SELECT scope_json,
@@ -250,9 +295,29 @@ const ECDSA_CREDENTIAL_POLICY_PROJECTION = `
       AND abuse.signing_root_version = scopes.signing_root_version
       AND abuse.record_kind = 'abuse'
       AND abuse.record_key = scopes.project_key || char(31) || session.wallet_id || char(31) ||
-          'material_activation:' || ? || char(31) || 'ecdsa'
-  ) AS ecdsa_policy_records_json,`;
+          ${input.principal} || char(31) || '${input.family}'
+  ) AS ${input.family}_policy_records_json,`;
+}
+/** Binds the material activation id. */
+const ECDSA_CREDENTIAL_POLICY_PROJECTION = credentialPolicyProjection({
+	family: "ecdsa",
+	signers: `signer.namespace = session.namespace AND signer.org_id = session.org_id
+        AND signer.project_id = session.project_id AND signer.env_id = session.env_id`,
+	scopePath: "$.runtimePolicyScope",
+	principal: `'material_activation:' || ?`
+});
+/** Binds the signer scope (namespace, organization, project, environment) and the activation id. */
+const ED25519_CREDENTIAL_POLICY_PROJECTION = credentialPolicyProjection({
+	family: "ed25519",
+	signers: `signer.namespace = ? AND signer.org_id = ?
+        AND signer.project_id = ? AND signer.env_id = ?
+        AND CASE WHEN json_valid(signer.record_json) THEN
+          json_extract(signer.record_json, '${ED25519_SIGNER_ACTIVATION_ID_PATH}') = ?
+          ELSE 0 END`,
+	scopePath: "$.activeYaoCapability.runtimePolicyScope",
+	principal: `'wallet_authority:' || session.authority_id`
+});
 //#endregion
-export { CloudflareD1RouterAbNormalSigningAdmissionStore, D1EcdsaAdmissionPolicyRead, ECDSA_CREDENTIAL_POLICY_PROJECTION, createCloudflareD1RouterAbNormalSigningAdmissionStore };
+export { CloudflareD1RouterAbNormalSigningAdmissionStore, D1EcdsaAdmissionPolicyRead, D1Ed25519AdmissionPolicyRead, ECDSA_CREDENTIAL_POLICY_PROJECTION, ED25519_CREDENTIAL_POLICY_PROJECTION, createCloudflareD1RouterAbNormalSigningAdmissionStore };
 
 //# sourceMappingURL=d1RouterAbNormalSigningAdmissionStore.js.map

package/dist/esm/router/cloudflare/d1/versionedJson/d1VersionedJsonRecordStore.js

@@ -75,13 +75,7 @@ var CloudflareD1VersionedJsonRecordStore = class {
 	}
 	async readMany(keys) {
 		const preparedKeys = prepareReadKeys(keys, this.keyPrefix);
-		const statements = preparedKeys.map(({ storageKey }) => this.database.prepare(`SELECT version, record_json
-           FROM ${TABLE_NAME}
-          WHERE namespace = ?1
-            AND org_id = ?2
-            AND project_id = ?3
-            AND env_id = ?4
-            AND record_key = ?5`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, storageKey));
+		const statements = preparedKeys.map(({ key }) => this.prepareRead(key));
 		let results;
 		try {
 			results = await this.database.batch(statements);
@@ -98,6 +92,15 @@ var CloudflareD1VersionedJsonRecordStore = class {
 			result: this.parseReadResult(results[index])
 		}));
 	}
+	prepareRead(key) {
+		return this.database.prepare(`SELECT version, record_json
+           FROM ${TABLE_NAME}
+          WHERE namespace = ?1
+            AND org_id = ?2
+            AND project_id = ?3
+            AND env_id = ?4
+            AND record_key = ?5`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, this.storageKey(key));
+	}
 	parseReadResult(result) {
 		const row = firstResult(result);
 		if (row === null) return { kind: "missing" };
@@ -136,7 +139,7 @@ var CloudflareD1VersionedJsonRecordStore = class {
 	* commit spans this JSON store and a normalized table (for example, a
 	* recovery envelope plus its WebAuthn authenticator and binding).
 	*/
-	async putManyWithAdditionalStatements(mutations, additionalStatements) {
+	async putManyWithAdditionalStatements(mutations, additionalStatements, executeBatch) {
 		const prepared = this.prepareBatchMutations(mutations);
 		const statements = [];
 		for (const mutation of prepared) {
@@ -145,7 +148,7 @@ var CloudflareD1VersionedJsonRecordStore = class {
 		}
 		statements.push(...additionalStatements);
 		try {
-			assertBatchSucceeded(await this.database.batch(statements), statements.length);
+			assertBatchSucceeded(executeBatch ? await executeBatch(statements) : await this.database.batch(statements), statements.length);
 			return {
 				kind: "stored",
 				versions: prepared.map((mutation) => ({

package/dist/esm/router/cloudflare/d1/wallet/authorizationSnapshotLayout.js

@@ -0,0 +1,168 @@
+import { requireArray, requireRecord } from "../../../../shared-ts/src/utils/validation.js";
+//#region src/router/cloudflare/d1/wallet/authorizationSnapshotLayout.ts
+const TABLES = [
+	"wallet_email_otp_rate_limits",
+	"email_otp_wallet_enrollments",
+	"email_otp_auth_states",
+	"wallets",
+	"wallet_signers",
+	"wallet_recovery_code_locators",
+	"wallet_authorities",
+	"wallet_auth_methods",
+	"wallet_relocation_approvals",
+	"webauthn_credential_bindings",
+	"webauthn_authenticators",
+	"router_ab_yao_versioned_json_records",
+	"authorization_wallet_session_quotas",
+	"wallet_session_authorizations_v2",
+	"wallet_session_hosted_credentials_v2",
+	"wallet_session_hosted_exchange_codes_v2",
+	"verified_wallet_operation_evidence_sets",
+	"authorized_operations",
+	"authorized_operation_audit_events",
+	"linked_device_sessions",
+	"linked_device_authority_allocations",
+	"linked_device_authority_installations",
+	"linked_device_target_credentials",
+	"linked_device_target_commit_reservations",
+	"linked_device_session_transcripts",
+	"linked_device_ed25519_export_root_transfers",
+	"linked_device_email_otp_grants",
+	"linked_device_request_proof_nonces",
+	"linked_device_bootstrap_imports",
+	"linked_device_wallet_session_credential_deliveries_v1"
+];
+var AuthorizationSnapshotLayout = class AuthorizationSnapshotLayout {
+	#validated = true;
+	constructor(table, columns, keyColumns) {
+		this.table = table;
+		this.columns = columns;
+		this.keyColumns = keyColumns;
+		Object.freeze(this);
+	}
+	static async read(database) {
+		const layout = [];
+		const statements = [];
+		for (const table of TABLES) statements.push(database.prepare(`PRAGMA table_info(${table})`));
+		const results = await database.batch(statements);
+		for (const [index, table] of TABLES.entries()) {
+			const result = results[index];
+			if (!result) throw new Error("Authorization snapshot schema is incomplete");
+			const columns = [];
+			const keys = [];
+			for (const field of result.results ?? []) {
+				if (!Number.isSafeInteger(field.pk) || field.pk < 0) throw new Error("Authorization snapshot primary key is invalid");
+				if (field.type !== "TEXT" && field.type !== "INTEGER") throw new Error("Authorization snapshot column type is unsupported");
+				columns.push(field.name);
+				if (field.pk > 0) keys.push(field.name);
+			}
+			columns.sort();
+			keys.sort();
+			layout.push({
+				table,
+				columns,
+				keyColumns: keys
+			});
+		}
+		return AuthorizationSnapshotLayout.parse(layout);
+	}
+	static parse(raw) {
+		const entries = requireArray(raw, "authorization snapshot layout");
+		if (entries.length !== TABLES.length) throw new Error("Authorization snapshot table set conflicts");
+		const result = [];
+		for (const [index, table] of TABLES.entries()) {
+			const entry = requireRecord(entries[index], "authorization snapshot table");
+			if (Object.keys(entry).length !== 3 || entry.table !== table) throw new Error("Authorization snapshot table order conflicts");
+			const columns = columnNames(entry.columns);
+			const keyColumns = columnNames(entry.keyColumns);
+			for (const key of keyColumns) if (!columns.includes(key)) throw new Error("Authorization snapshot key column is absent");
+			result.push(new AuthorizationSnapshotLayout(table, columns, keyColumns));
+		}
+		return Object.freeze(result);
+	}
+	expressions() {
+		if (!this.#validated) throw new Error("Authorization snapshot layout is unvalidated");
+		const fields = [];
+		for (const column of this.columns) fields.push(`'${column}', target.${column}`);
+		const keys = [];
+		for (const column of this.keyColumns) keys.push(`target.${column}`);
+		return {
+			key: `json_array(${keys.join(", ")})`,
+			record: `json_object(${fields.join(", ")})`,
+			ownership: AuthorizationSnapshotLayout.ownership(this.table)
+		};
+	}
+	snapshotSelection() {
+		const ownership = AuthorizationSnapshotLayout.ownership(this.table);
+		if (this.table !== "wallet_email_otp_rate_limits") return ownership;
+		return `${ownership} AND target.reset_at_ms > (
+      SELECT frozen_at_ms FROM wallet_relocation_authorization_fences
+      WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4 AND wallet_id = ?5)`;
+	}
+	static ownership(table) {
+		switch (table) {
+			case "linked_device_sessions": return `target.namespace = ?1 AND target.org_id = ?2 AND target.project_id = ?3
+          AND target.env_id = ?4 AND json_extract(target.record_json, '$.claimTranscript.value.walletId') = ?5`;
+			case "linked_device_target_commit_reservations":
+			case "linked_device_session_transcripts":
+			case "linked_device_request_proof_nonces":
+			case "linked_device_bootstrap_imports": return `target.namespace = ?1 AND target.org_id = ?2 AND target.project_id = ?3
+          AND target.env_id = ?4 AND EXISTS (SELECT 1 FROM linked_device_sessions AS parent
+            WHERE parent.namespace = target.namespace AND parent.org_id = target.org_id
+              AND parent.project_id = target.project_id AND parent.env_id = target.env_id
+              AND parent.link_session_id = target.link_session_id
+              AND json_extract(parent.record_json, '$.claimTranscript.value.walletId') = ?5)`;
+			case "router_ab_yao_versioned_json_records": return `target.namespace = ?1 AND target.org_id = ?2 AND target.project_id = ?3
+          AND target.env_id = ?4 AND json_extract(target.record_json, '$.walletId') = ?5
+          AND CASE
+            WHEN substr(target.record_key, 1, 17) = 'passkey-envelope:' AND json_valid(substr(target.record_key, 18))
+              THEN json_extract(substr(target.record_key, 18), '$[0]') = ?5
+            WHEN substr(target.record_key, 1, 28) = 'passkey-credential-activity:' AND json_valid(substr(target.record_key, 29))
+              THEN json_extract(substr(target.record_key, 29), '$[0]') = ?5
+            ELSE target.record_key IN ('passkey-envelope:recovery-set:' || ?5,
+              'passkey-envelope:wallet-recovery-backup-ack/' || ?5)
+          END`;
+			case "webauthn_credential_bindings":
+			case "webauthn_authenticators": return `target.namespace = ?1 AND target.org_id = ?2 AND target.project_id = ?3
+          AND target.env_id = ?4 AND target.user_id = ?5
+          AND EXISTS (SELECT 1 FROM wallet_auth_methods AS method
+            WHERE method.namespace = target.namespace AND method.org_id = target.org_id
+              AND method.project_id = target.project_id AND method.env_id = target.env_id
+              AND method.wallet_id = ?5 AND method.kind = 'passkey'
+              AND method.credential_id_b64u = target.credential_id_b64u
+              AND ${table === "webauthn_credential_bindings" ? "method.rp_id = target.rp_id" : "method.credential_public_key_b64u = target.credential_public_key_b64u"})`;
+			case "authorization_wallet_session_quotas": return `EXISTS (SELECT 1 FROM wallet_session_authorizations_v2 AS session
+          WHERE session.namespace = ?1 AND session.org_id = ?2 AND session.project_id = ?3 AND session.env_id = ?4
+            AND session.wallet_id = ?5 AND session.namespace = target.namespace AND session.tenant_id = target.tenant_id
+            AND session.quota_id = target.quota_id AND session.wallet_session_id = target.wallet_session_id)`;
+			case "authorized_operations": return `EXISTS (SELECT 1 FROM wallet_operation_authorizations AS owner
+          WHERE owner.namespace = ?1 AND owner.org_id = ?2 AND owner.project_id = ?3 AND owner.env_id = ?4
+            AND owner.wallet_id = ?5 AND owner.namespace = target.namespace AND owner.tenant_id = target.tenant_id
+            AND owner.source_kind = target.authorization_source_kind
+            AND owner.source_id = CASE target.authorization_source_kind
+              WHEN 'authorization_grant' THEN target.authorization_id ELSE target.evidence_set_digest END
+            AND (target.authorization_source_kind = 'verified_step_up' OR
+              (target.authorization_grant_kind = 'wallet_session_authorization'
+                AND owner.org_id = target.owner_scope_org_id AND owner.project_id = target.owner_scope_project_id
+                AND owner.env_id = target.owner_scope_env_id)))`;
+			case "authorized_operation_audit_events": return `EXISTS (SELECT 1 FROM wallet_operation_owners AS owner
+          WHERE owner.namespace = ?1 AND owner.org_id = ?2 AND owner.project_id = ?3 AND owner.env_id = ?4
+            AND owner.wallet_id = ?5 AND owner.namespace = target.namespace AND owner.tenant_id = target.tenant_id
+            AND owner.authorized_operation_id = target.authorized_operation_id)`;
+			default: return "target.namespace = ?1 AND target.org_id = ?2 AND target.project_id = ?3 AND target.env_id = ?4 AND target.wallet_id = ?5";
+		}
+	}
+};
+function columnNames(raw) {
+	const names = [];
+	for (const name of requireArray(raw, "authorization snapshot columns")) {
+		if (typeof name !== "string" || !/^[a-z][a-z0-9_]*$/u.test(name) || names.includes(name)) throw new Error("Authorization snapshot column is invalid");
+		names.push(name);
+	}
+	if (names.length === 0) throw new Error("Authorization snapshot columns are empty");
+	return Object.freeze(names);
+}
+//#endregion
+export { AuthorizationSnapshotLayout };
+
+//# sourceMappingURL=authorizationSnapshotLayout.js.map

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAddSignerFinalizeRecord.js

@@ -0,0 +1,68 @@
+import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
+import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
+import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import "../../../../shared-ts/src/utils/encoders.js";
+import { parseRouterAbEd25519YaoRegistrationSideEffectRecordV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
+import { parseD1WalletAddSignerFinalizeTerminalResponse, parseWalletIdForIntent } from "../registration/d1RegistrationCeremonyRecords.js";
+//#region src/router/cloudflare/d1/wallet/d1WalletAddSignerFinalizeRecord.ts
+function parseWalletAddSignerFinalizePrepared(raw) {
+	if (!isPlainObject(raw)) return null;
+	const record = raw;
+	const walletId = parseWalletIdForIntent(record.walletId);
+	if (!walletId) return null;
+	if (record.kind === "d1_wallet_add_signer_finalize_ed25519_prepared_v1") {
+		const finalizingAtMs = record.finalizingAtMs;
+		if (typeof finalizingAtMs !== "number" || !Number.isSafeInteger(finalizingAtMs) || finalizingAtMs <= 0) return null;
+		return {
+			kind: "d1_wallet_add_signer_finalize_ed25519_prepared_v1",
+			walletId,
+			finalizingAtMs
+		};
+	}
+	if (record.kind !== "d1_wallet_add_signer_finalize_ecdsa_prepared_v1") return null;
+	const signerWriteAtMs = record.signerWriteAtMs;
+	return typeof signerWriteAtMs === "number" && Number.isSafeInteger(signerWriteAtMs) && signerWriteAtMs > 0 ? {
+		kind: "d1_wallet_add_signer_finalize_ecdsa_prepared_v1",
+		walletId,
+		signerWriteAtMs
+	} : null;
+}
+function parseD1WalletAddSignerFinalizeSideEffectRecord(raw) {
+	const record = parseRouterAbEd25519YaoRegistrationSideEffectRecordV1(raw, {
+		operation: "add_signer_finalize",
+		parsePrepared: parseWalletAddSignerFinalizePrepared,
+		parseResponse: parseD1WalletAddSignerFinalizeTerminalResponse
+	});
+	if (record?.kind === "router_ab_ed25519_yao_registration_side_effect_completion_v1" && record.response.ok && record.response.walletId !== record.prepared.walletId) return null;
+	return record;
+}
+async function fingerprintD1WalletAddSignerFinalizePrepared(prepared) {
+	return base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(prepared)));
+}
+async function returnD1WalletAddSignerFinalizePrepared(prepared) {
+	return prepared;
+}
+async function rejectUnexpectedWalletAddSignerFinalizePreparation() {
+	throw new Error("persisted add-signer finalize claim disappeared during reconciliation");
+}
+function buildD1WalletAddSignerFinalizePrepared(input) {
+	if (input.request.kind === "evm_family_ecdsa") return {
+		walletId: input.ceremony.intent.walletId,
+		kind: "d1_wallet_add_signer_finalize_ecdsa_prepared_v1",
+		signerWriteAtMs: input.nowMs
+	};
+	if (input.ceremony.signerState.kind === "near_ed25519_yao_add_signer_finalizing") return {
+		walletId: input.ceremony.intent.walletId,
+		kind: "d1_wallet_add_signer_finalize_ed25519_prepared_v1",
+		finalizingAtMs: input.ceremony.signerState.finalizingAtMs
+	};
+	return {
+		walletId: input.ceremony.intent.walletId,
+		kind: "d1_wallet_add_signer_finalize_ed25519_prepared_v1",
+		finalizingAtMs: input.nowMs
+	};
+}
+//#endregion
+export { buildD1WalletAddSignerFinalizePrepared, fingerprintD1WalletAddSignerFinalizePrepared, parseD1WalletAddSignerFinalizeSideEffectRecord, rejectUnexpectedWalletAddSignerFinalizePreparation, returnD1WalletAddSignerFinalizePrepared };
+
+//# sourceMappingURL=d1WalletAddSignerFinalizeRecord.js.map