@seams/wallet-server 0.8.0 → 0.9.0

package/dist/esm/router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.js

@@ -1,6 +1,7 @@
 import { isPlainObject, requireNonEmptyString } from "../../../../shared-ts/src/utils/validation.js";
 import { normalizeRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { isD1DatabaseLike, parseD1JsonColumn } from "../../../../storage/d1Sql.js";
+import { ED25519_SIGNER_ACTIVATION_ID_PATH } from "../../../../core/d1WalletStore.js";
 import { abusePrincipalKey, runtimePolicyScopeKey } from "../../../domains/signingOperations/routerAbNormalSigningAdmissionCore.js";
 //#region src/router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.ts
 const ROUTER_AB_NORMAL_SIGNING_ADMISSION_TABLE = "router_ab_normal_signing_admission_records";
@@ -12,10 +13,8 @@ var CloudflareD1RouterAbNormalSigningAdmissionStore = class {
 		this.now = options.now || Date.now;
 	}
 	async evaluatePolicy(input) {
-		if (input.curve === "ecdsa" && input.policyReadSource.kind === "credential_snapshot") {
-			const decision = input.policyReadSource.policyRead.resolve(this.database, this.storageNamespace, input);
-			if (decision) return decision;
-		}
+		const snapshot = credentialPolicyDecision(input, this.database, this.storageNamespace);
+		if (snapshot) return snapshot;
 		const scope = input.runtimePolicyScope;
 		return parsePolicyRow(await this.database.prepare(`WITH scope(namespace, org_id, project_id, env_id, signing_root_version,
                   project_key, abuse_key) AS (VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7))
@@ -181,33 +180,7 @@ var D1EcdsaAdmissionPolicyRead = class D1EcdsaAdmissionPolicyRead {
 		this.#decisions = decisions;
 	}
 	static fromRows(database, namespace, walletId, activationId, rows) {
-		if (!Array.isArray(rows)) throw new Error("ECDSA policy candidates are invalid");
-		const decisions = /* @__PURE__ */ new Map();
-		for (const row of rows) {
-			if (!isPlainObject(row)) throw new Error("ECDSA policy candidate is invalid");
-			const key = runtimePolicyScopeKey(normalizeRuntimePolicyScope(parseD1JsonColumn(row.scope_json)));
-			if (decisions.has(key)) throw new Error("ECDSA policy scope is ambiguous");
-			try {
-				const decision = parsePolicyRow({
-					project_key: row.project_key,
-					project_decision: row.project_decision,
-					project_retry_after_ms: row.project_retry_after_ms,
-					abuse_key: row.abuse_key,
-					abuse_decision: row.abuse_decision,
-					abuse_retry_after_ms: row.abuse_retry_after_ms
-				});
-				decisions.set(key, {
-					ok: true,
-					decision
-				});
-			} catch (error) {
-				decisions.set(key, {
-					ok: false,
-					message: error instanceof Error ? error.message : "ECDSA policy read failed"
-				});
-			}
-		}
-		return new D1EcdsaAdmissionPolicyRead(database, namespace, walletId, activationId, decisions);
+		return new D1EcdsaAdmissionPolicyRead(database, namespace, walletId, activationId, parsePolicyCandidates(rows, "ECDSA"));
 	}
 	resolve(database, namespace, input) {
 		if (database !== this.database || namespace !== this.namespace) return null;
@@ -218,13 +191,79 @@ var D1EcdsaAdmissionPolicyRead = class D1EcdsaAdmissionPolicyRead {
 		return result.decision;
 	}
 };
-const ECDSA_CREDENTIAL_POLICY_PROJECTION = `
+/** Policy rows read with an Ed25519 Wallet Session, for the scopes of its signer. */
+var D1Ed25519AdmissionPolicyRead = class D1Ed25519AdmissionPolicyRead {
+	#decisions;
+	constructor(database, namespace, walletId, authorityId, decisions) {
+		this.database = database;
+		this.namespace = namespace;
+		this.walletId = walletId;
+		this.authorityId = authorityId;
+		this.#decisions = decisions;
+	}
+	static fromRows(database, namespace, walletId, authorityId, rows) {
+		return new D1Ed25519AdmissionPolicyRead(database, namespace, walletId, authorityId, parsePolicyCandidates(rows, "Ed25519"));
+	}
+	/**
+	* Null sends the caller to the database: another store, or a scope this read
+	* did not select. Linked-device material has no signer row to select from.
+	*/
+	resolve(database, namespace, input) {
+		if (database !== this.database || namespace !== this.namespace) return null;
+		if (input.walletId !== this.walletId || input.authorityId !== this.authorityId) throw new Error("Ed25519 policy credential scope does not match");
+		const result = this.#decisions.get(runtimePolicyScopeKey(input.runtimePolicyScope));
+		if (!result) return null;
+		if (!result.ok) throw new Error(result.message);
+		return result.decision;
+	}
+};
+/** The decision a credential read already holds for this store, when the request carries one. */
+function credentialPolicyDecision(input, database, namespace) {
+	if (input.curve === "ecdsa") return input.policyReadSource.kind === "credential_snapshot" ? input.policyReadSource.policyRead.resolve(database, namespace, input) : null;
+	if (input.authorityKind !== "wallet_authority_v1" || input.policyReadSource.kind !== "credential_snapshot") return null;
+	return input.policyReadSource.policyRead.resolve(database, namespace, input);
+}
+function parsePolicyCandidates(rows, curve) {
+	if (!Array.isArray(rows)) throw new Error(`${curve} policy candidates are invalid`);
+	const decisions = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		if (!isPlainObject(row)) throw new Error(`${curve} policy candidate is invalid`);
+		const key = runtimePolicyScopeKey(normalizeRuntimePolicyScope(parseD1JsonColumn(row.scope_json)));
+		if (decisions.has(key)) throw new Error(`${curve} policy scope is ambiguous`);
+		try {
+			const decision = parsePolicyRow({
+				project_key: row.project_key,
+				project_decision: row.project_decision,
+				project_retry_after_ms: row.project_retry_after_ms,
+				abuse_key: row.abuse_key,
+				abuse_decision: row.abuse_decision,
+				abuse_retry_after_ms: row.abuse_retry_after_ms
+			});
+			decisions.set(key, {
+				ok: true,
+				decision
+			});
+		} catch (error) {
+			decisions.set(key, {
+				ok: false,
+				message: error instanceof Error ? error.message : `${curve} policy read failed`
+			});
+		}
+	}
+	return decisions;
+}
+/**
+* Policy rows for the runtime scopes of the session wallet's signers, read in
+* the session's own statement. `signers` selects the signer rows, `scopePath`
+* is where a row holds its scope, and `principal` names the abuse principal.
+*/
+function credentialPolicyProjection(input) {
+	return `
   (WITH candidates AS (
-     SELECT DISTINCT json_extract(signer.record_json, '$.runtimePolicyScope') AS scope_json
+     SELECT DISTINCT json_extract(signer.record_json, '${input.scopePath}') AS scope_json
        FROM wallet_signers AS signer
-      WHERE signer.namespace = session.namespace AND signer.org_id = session.org_id
-        AND signer.project_id = session.project_id AND signer.env_id = session.env_id
-        AND signer.wallet_id = session.wallet_id AND signer.signer_family = 'ecdsa'
+      WHERE ${input.signers}
+        AND signer.wallet_id = session.wallet_id AND signer.signer_family = '${input.family}'
         AND json_valid(signer.record_json)
    ), scopes AS (
      SELECT scope_json,
@@ -256,9 +295,29 @@ const ECDSA_CREDENTIAL_POLICY_PROJECTION = `
       AND abuse.signing_root_version = scopes.signing_root_version
       AND abuse.record_kind = 'abuse'
       AND abuse.record_key = scopes.project_key || char(31) || session.wallet_id || char(31) ||
-          'material_activation:' || ? || char(31) || 'ecdsa'
-  ) AS ecdsa_policy_records_json,`;
+          ${input.principal} || char(31) || '${input.family}'
+  ) AS ${input.family}_policy_records_json,`;
+}
+/** Binds the material activation id. */
+const ECDSA_CREDENTIAL_POLICY_PROJECTION = credentialPolicyProjection({
+	family: "ecdsa",
+	signers: `signer.namespace = session.namespace AND signer.org_id = session.org_id
+        AND signer.project_id = session.project_id AND signer.env_id = session.env_id`,
+	scopePath: "$.runtimePolicyScope",
+	principal: `'material_activation:' || ?`
+});
+/** Binds the signer scope (namespace, organization, project, environment) and the activation id. */
+const ED25519_CREDENTIAL_POLICY_PROJECTION = credentialPolicyProjection({
+	family: "ed25519",
+	signers: `signer.namespace = ? AND signer.org_id = ?
+        AND signer.project_id = ? AND signer.env_id = ?
+        AND CASE WHEN json_valid(signer.record_json) THEN
+          json_extract(signer.record_json, '${ED25519_SIGNER_ACTIVATION_ID_PATH}') = ?
+          ELSE 0 END`,
+	scopePath: "$.activeYaoCapability.runtimePolicyScope",
+	principal: `'wallet_authority:' || session.authority_id`
+});
 //#endregion
-export { CloudflareD1RouterAbNormalSigningAdmissionStore, D1EcdsaAdmissionPolicyRead, ECDSA_CREDENTIAL_POLICY_PROJECTION, createCloudflareD1RouterAbNormalSigningAdmissionStore };
+export { CloudflareD1RouterAbNormalSigningAdmissionStore, D1EcdsaAdmissionPolicyRead, D1Ed25519AdmissionPolicyRead, ECDSA_CREDENTIAL_POLICY_PROJECTION, ED25519_CREDENTIAL_POLICY_PROJECTION, createCloudflareD1RouterAbNormalSigningAdmissionStore };
 
 //# sourceMappingURL=d1RouterAbNormalSigningAdmissionStore.js.map

package/dist/esm/router/cloudflare/d1/versionedJson/d1VersionedJsonRecordStore.js

@@ -75,13 +75,7 @@ var CloudflareD1VersionedJsonRecordStore = class {
 	}
 	async readMany(keys) {
 		const preparedKeys = prepareReadKeys(keys, this.keyPrefix);
-		const statements = preparedKeys.map(({ storageKey }) => this.database.prepare(`SELECT version, record_json
-           FROM ${TABLE_NAME}
-          WHERE namespace = ?1
-            AND org_id = ?2
-            AND project_id = ?3
-            AND env_id = ?4
-            AND record_key = ?5`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, storageKey));
+		const statements = preparedKeys.map(({ key }) => this.prepareRead(key));
 		let results;
 		try {
 			results = await this.database.batch(statements);
@@ -98,6 +92,15 @@ var CloudflareD1VersionedJsonRecordStore = class {
 			result: this.parseReadResult(results[index])
 		}));
 	}
+	prepareRead(key) {
+		return this.database.prepare(`SELECT version, record_json
+           FROM ${TABLE_NAME}
+          WHERE namespace = ?1
+            AND org_id = ?2
+            AND project_id = ?3
+            AND env_id = ?4
+            AND record_key = ?5`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, this.storageKey(key));
+	}
 	parseReadResult(result) {
 		const row = firstResult(result);
 		if (row === null) return { kind: "missing" };
@@ -136,7 +139,7 @@ var CloudflareD1VersionedJsonRecordStore = class {
 	* commit spans this JSON store and a normalized table (for example, a
 	* recovery envelope plus its WebAuthn authenticator and binding).
 	*/
-	async putManyWithAdditionalStatements(mutations, additionalStatements) {
+	async putManyWithAdditionalStatements(mutations, additionalStatements, executeBatch) {
 		const prepared = this.prepareBatchMutations(mutations);
 		const statements = [];
 		for (const mutation of prepared) {
@@ -145,7 +148,7 @@ var CloudflareD1VersionedJsonRecordStore = class {
 		}
 		statements.push(...additionalStatements);
 		try {
-			assertBatchSucceeded(await this.database.batch(statements), statements.length);
+			assertBatchSucceeded(executeBatch ? await executeBatch(statements) : await this.database.batch(statements), statements.length);
 			return {
 				kind: "stored",
 				versions: prepared.map((mutation) => ({

package/dist/esm/router/cloudflare/d1/wallet/authorizationSnapshotLayout.js

@@ -0,0 +1,168 @@
+import { requireArray, requireRecord } from "../../../../shared-ts/src/utils/validation.js";
+//#region src/router/cloudflare/d1/wallet/authorizationSnapshotLayout.ts
+const TABLES = [
+	"wallet_email_otp_rate_limits",
+	"email_otp_wallet_enrollments",
+	"email_otp_auth_states",
+	"wallets",
+	"wallet_signers",
+	"wallet_recovery_code_locators",
+	"wallet_authorities",
+	"wallet_auth_methods",
+	"wallet_relocation_approvals",
+	"webauthn_credential_bindings",
+	"webauthn_authenticators",
+	"router_ab_yao_versioned_json_records",
+	"authorization_wallet_session_quotas",
+	"wallet_session_authorizations_v2",
+	"wallet_session_hosted_credentials_v2",
+	"wallet_session_hosted_exchange_codes_v2",
+	"verified_wallet_operation_evidence_sets",
+	"authorized_operations",
+	"authorized_operation_audit_events",
+	"linked_device_sessions",
+	"linked_device_authority_allocations",
+	"linked_device_authority_installations",
+	"linked_device_target_credentials",
+	"linked_device_target_commit_reservations",
+	"linked_device_session_transcripts",
+	"linked_device_ed25519_export_root_transfers",
+	"linked_device_email_otp_grants",
+	"linked_device_request_proof_nonces",
+	"linked_device_bootstrap_imports",
+	"linked_device_wallet_session_credential_deliveries_v1"
+];
+var AuthorizationSnapshotLayout = class AuthorizationSnapshotLayout {
+	#validated = true;
+	constructor(table, columns, keyColumns) {
+		this.table = table;
+		this.columns = columns;
+		this.keyColumns = keyColumns;
+		Object.freeze(this);
+	}
+	static async read(database) {
+		const layout = [];
+		const statements = [];
+		for (const table of TABLES) statements.push(database.prepare(`PRAGMA table_info(${table})`));
+		const results = await database.batch(statements);
+		for (const [index, table] of TABLES.entries()) {
+			const result = results[index];
+			if (!result) throw new Error("Authorization snapshot schema is incomplete");
+			const columns = [];
+			const keys = [];
+			for (const field of result.results ?? []) {
+				if (!Number.isSafeInteger(field.pk) || field.pk < 0) throw new Error("Authorization snapshot primary key is invalid");
+				if (field.type !== "TEXT" && field.type !== "INTEGER") throw new Error("Authorization snapshot column type is unsupported");
+				columns.push(field.name);
+				if (field.pk > 0) keys.push(field.name);
+			}
+			columns.sort();
+			keys.sort();
+			layout.push({
+				table,
+				columns,
+				keyColumns: keys
+			});
+		}
+		return AuthorizationSnapshotLayout.parse(layout);
+	}
+	static parse(raw) {
+		const entries = requireArray(raw, "authorization snapshot layout");
+		if (entries.length !== TABLES.length) throw new Error("Authorization snapshot table set conflicts");
+		const result = [];
+		for (const [index, table] of TABLES.entries()) {
+			const entry = requireRecord(entries[index], "authorization snapshot table");
+			if (Object.keys(entry).length !== 3 || entry.table !== table) throw new Error("Authorization snapshot table order conflicts");
+			const columns = columnNames(entry.columns);
+			const keyColumns = columnNames(entry.keyColumns);
+			for (const key of keyColumns) if (!columns.includes(key)) throw new Error("Authorization snapshot key column is absent");
+			result.push(new AuthorizationSnapshotLayout(table, columns, keyColumns));
+		}
+		return Object.freeze(result);
+	}
+	expressions() {
+		if (!this.#validated) throw new Error("Authorization snapshot layout is unvalidated");
+		const fields = [];
+		for (const column of this.columns) fields.push(`'${column}', target.${column}`);
+		const keys = [];
+		for (const column of this.keyColumns) keys.push(`target.${column}`);
+		return {
+			key: `json_array(${keys.join(", ")})`,
+			record: `json_object(${fields.join(", ")})`,
+			ownership: AuthorizationSnapshotLayout.ownership(this.table)
+		};
+	}
+	snapshotSelection() {
+		const ownership = AuthorizationSnapshotLayout.ownership(this.table);
+		if (this.table !== "wallet_email_otp_rate_limits") return ownership;
+		return `${ownership} AND target.reset_at_ms > (
+      SELECT frozen_at_ms FROM wallet_relocation_authorization_fences
+      WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4 AND wallet_id = ?5)`;
+	}
+	static ownership(table) {
+		switch (table) {
+			case "linked_device_sessions": return `target.namespace = ?1 AND target.org_id = ?2 AND target.project_id = ?3
+          AND target.env_id = ?4 AND json_extract(target.record_json, '$.claimTranscript.value.walletId') = ?5`;
+			case "linked_device_target_commit_reservations":
+			case "linked_device_session_transcripts":
+			case "linked_device_request_proof_nonces":
+			case "linked_device_bootstrap_imports": return `target.namespace = ?1 AND target.org_id = ?2 AND target.project_id = ?3
+          AND target.env_id = ?4 AND EXISTS (SELECT 1 FROM linked_device_sessions AS parent
+            WHERE parent.namespace = target.namespace AND parent.org_id = target.org_id
+              AND parent.project_id = target.project_id AND parent.env_id = target.env_id
+              AND parent.link_session_id = target.link_session_id
+              AND json_extract(parent.record_json, '$.claimTranscript.value.walletId') = ?5)`;
+			case "router_ab_yao_versioned_json_records": return `target.namespace = ?1 AND target.org_id = ?2 AND target.project_id = ?3
+          AND target.env_id = ?4 AND json_extract(target.record_json, '$.walletId') = ?5
+          AND CASE
+            WHEN substr(target.record_key, 1, 17) = 'passkey-envelope:' AND json_valid(substr(target.record_key, 18))
+              THEN json_extract(substr(target.record_key, 18), '$[0]') = ?5
+            WHEN substr(target.record_key, 1, 28) = 'passkey-credential-activity:' AND json_valid(substr(target.record_key, 29))
+              THEN json_extract(substr(target.record_key, 29), '$[0]') = ?5
+            ELSE target.record_key IN ('passkey-envelope:recovery-set:' || ?5,
+              'passkey-envelope:wallet-recovery-backup-ack/' || ?5)
+          END`;
+			case "webauthn_credential_bindings":
+			case "webauthn_authenticators": return `target.namespace = ?1 AND target.org_id = ?2 AND target.project_id = ?3
+          AND target.env_id = ?4 AND target.user_id = ?5
+          AND EXISTS (SELECT 1 FROM wallet_auth_methods AS method
+            WHERE method.namespace = target.namespace AND method.org_id = target.org_id
+              AND method.project_id = target.project_id AND method.env_id = target.env_id
+              AND method.wallet_id = ?5 AND method.kind = 'passkey'
+              AND method.credential_id_b64u = target.credential_id_b64u
+              AND ${table === "webauthn_credential_bindings" ? "method.rp_id = target.rp_id" : "method.credential_public_key_b64u = target.credential_public_key_b64u"})`;
+			case "authorization_wallet_session_quotas": return `EXISTS (SELECT 1 FROM wallet_session_authorizations_v2 AS session
+          WHERE session.namespace = ?1 AND session.org_id = ?2 AND session.project_id = ?3 AND session.env_id = ?4
+            AND session.wallet_id = ?5 AND session.namespace = target.namespace AND session.tenant_id = target.tenant_id
+            AND session.quota_id = target.quota_id AND session.wallet_session_id = target.wallet_session_id)`;
+			case "authorized_operations": return `EXISTS (SELECT 1 FROM wallet_operation_authorizations AS owner
+          WHERE owner.namespace = ?1 AND owner.org_id = ?2 AND owner.project_id = ?3 AND owner.env_id = ?4
+            AND owner.wallet_id = ?5 AND owner.namespace = target.namespace AND owner.tenant_id = target.tenant_id
+            AND owner.source_kind = target.authorization_source_kind
+            AND owner.source_id = CASE target.authorization_source_kind
+              WHEN 'authorization_grant' THEN target.authorization_id ELSE target.evidence_set_digest END
+            AND (target.authorization_source_kind = 'verified_step_up' OR
+              (target.authorization_grant_kind = 'wallet_session_authorization'
+                AND owner.org_id = target.owner_scope_org_id AND owner.project_id = target.owner_scope_project_id
+                AND owner.env_id = target.owner_scope_env_id)))`;
+			case "authorized_operation_audit_events": return `EXISTS (SELECT 1 FROM wallet_operation_owners AS owner
+          WHERE owner.namespace = ?1 AND owner.org_id = ?2 AND owner.project_id = ?3 AND owner.env_id = ?4
+            AND owner.wallet_id = ?5 AND owner.namespace = target.namespace AND owner.tenant_id = target.tenant_id
+            AND owner.authorized_operation_id = target.authorized_operation_id)`;
+			default: return "target.namespace = ?1 AND target.org_id = ?2 AND target.project_id = ?3 AND target.env_id = ?4 AND target.wallet_id = ?5";
+		}
+	}
+};
+function columnNames(raw) {
+	const names = [];
+	for (const name of requireArray(raw, "authorization snapshot columns")) {
+		if (typeof name !== "string" || !/^[a-z][a-z0-9_]*$/u.test(name) || names.includes(name)) throw new Error("Authorization snapshot column is invalid");
+		names.push(name);
+	}
+	if (names.length === 0) throw new Error("Authorization snapshot columns are empty");
+	return Object.freeze(names);
+}
+//#endregion
+export { AuthorizationSnapshotLayout };
+
+//# sourceMappingURL=authorizationSnapshotLayout.js.map

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAddSignerFinalizeRecord.js

@@ -1,7 +1,7 @@
+import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import "../../../../shared-ts/src/utils/encoders.js";
-import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
 import { parseRouterAbEd25519YaoRegistrationSideEffectRecordV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
 import { parseD1WalletAddSignerFinalizeTerminalResponse, parseWalletIdForIntent } from "../registration/d1RegistrationCeremonyRecords.js";
 //#region src/router/cloudflare/d1/wallet/d1WalletAddSignerFinalizeRecord.ts

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAddSignerService.js

@@ -1,10 +1,10 @@
 import { mpcMaterialActivationRefsEqual, parseWalletKeyId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
-import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
-import "../../../../shared-ts/src/utils/encoders.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
+import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
+import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseSecp256k1CompressedPublicKeyB64u } from "../../../../shared-ts/src/passkey-custody/primitives.js";
+import "../../../../shared-ts/src/utils/encoders.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseRouterAbEd25519YaoRegistrationAdmissionRequestV1, sameRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { ecdsaClientRootPublicKey33B64uFromString } from "../../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
@@ -12,11 +12,11 @@ import { deriveSigningRootId } from "../../../../shared-ts/src/threshold/signing
 import { buildRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaRegistrationRequestFactsV1, sameRouterAbEcdsaDerivationNormalSigningStateV1, sameRouterAbEcdsaRegistrationActivationReceiptV1, sameRouterAbEcdsaRegistrationRequestFactsV1, sameRouterAbEcdsaVerifiedClientActivationFactsV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { buildWalletEcdsaSignerActivationV1, extendEd25519WalletAuthorityWithEcdsa, isActiveEd25519WalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { registrationPreparationIdFromString } from "../../../../core/types.js";
-import { buildTenantRootIdentityFromAuthenticatedDeploymentV1 } from "../../../../shared-ts/src/tenant-root/tenantRootIdentity.js";
 import { addSignerIntentGrantFromString, computeAddSignerIntentDigestB64u, sameAddSignerIntentV1 } from "../../../../shared-ts/src/utils/registrationIntent.js";
-import { WalletAuthorityCommitConflictError } from "./d1WalletAuthorityStore.js";
+import { buildTenantRootIdentityFromAuthenticatedDeploymentV1 } from "../../../../shared-ts/src/tenant-root/tenantRootIdentity.js";
 import { buildRouterAbEd25519YaoRegistrationCapabilityRecordV1 } from "../../../domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery.js";
 import { buildRouterAbEd25519YaoAddSignerAdmissionRequestV1, createRouterAbEd25519YaoMaterialActivationRefV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js";
+import { WalletAuthorityCommitConflictError } from "./d1WalletAuthorityStore.js";
 import { parseRouterAbEd25519YaoRegistrationSideEffectRecordV1, runRouterAbEd25519YaoRegistrationSideEffectV1, throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
 import { buildYaoEd25519WalletSignerRecord, ed25519NearPublicKeyFromBytes, implicitNearAccountIdFromEd25519PublicKeyBytes } from "../ed25519Yao/d1Ed25519YaoWalletSigner.js";
 import { routerAbEcdsaStrictRegistrationRequestMatchesFacts } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
@@ -373,6 +373,7 @@ function sameEcdsaSignerActivation(left, right) {
 }
 var CloudflareD1WalletAddSignerService = class {
 	constructor(input) {
+		this.executionAuthority = input.executionAuthority;
 		this.getRegistrationCeremonyIntentStore = input.getRegistrationCeremonyIntentStore;
 		this.getEd25519YaoProductRegistration = input.getEd25519YaoProductRegistration;
 		this.ecdsaStrictRegistration = input.ecdsaStrictRegistration;
@@ -682,8 +683,11 @@ var CloudflareD1WalletAddSignerService = class {
 					signingWorkerId: yaoRuntime.signingWorkerId
 				})
 			});
+			const homeAdmission = await this.executionAuthority.admitEstablishedHome({ walletId: input.walletId });
+			if (!homeAdmission.ok) return rejectedWalletAddSignerStartTerminal(homeAdmission.code, homeAdmission.message);
 			const bound = await yaoRuntime.bindVerifiedIntent({
 				kind: "verified_add_signer_intent",
+				ownershipGeneration: homeAdmission.ownershipGeneration,
 				addSignerIntentGrant: storedIntent.grant,
 				intent: ed25519Intent,
 				admissionRequest,
@@ -811,9 +815,14 @@ var CloudflareD1WalletAddSignerService = class {
 				code: "invalid_state",
 				message: "ECDSA add-signer tenant root is not active"
 			};
+			const home = await this.executionAuthority.admitEstablishedHome({ walletId: ceremony.intent.walletId });
+			if (!home.ok) return home;
 			const registered = await this.ecdsaStrictRegistration.registerWithTenantRoot({
 				request: request.ecdsa.strictRegistration,
-				tenantRoot,
+				tenantRoot: {
+					...tenantRoot,
+					ownershipGeneration: home.ownershipGeneration
+				},
 				requestPolicy: {
 					policyVersion: WALLET_ADD_SIGNER_ROUTER_POLICY_VERSION,
 					requestDigestB64u: request.ecdsa.requestDigestB64u

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthMethodService.js

@@ -1,9 +1,9 @@
 import { parseChallengeSubjectId, parseEmailOtpChallengeId, parseOrgId, parseProviderSubject, parseWalletAuthMethodId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
+import { buildDelegatedWalletAuthorityV1, buildFullOwnerPermissionsV1, sameDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
 import "../../../../shared-ts/src/utils/encoders.js";
-import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import { buildDelegatedWalletAuthorityV1, buildFullOwnerPermissionsV1, sameDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { parseWalletAddAuthMethodRegistrationOptions } from "../../../../shared-ts/src/utils/addAuthMethodRegistration.js";
 import { normalizeRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { buildEmailOtpWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
@@ -1458,44 +1458,7 @@ var CloudflareD1WalletAuthMethodService = class {
 	* Ed25519 leg arrives, so that leg must address the same rows.
 	*/
 	async readActiveRegistrationIdentity(authority) {
-		let record;
-		switch (authority.kind) {
-			case "passkey":
-				record = await this.getWalletAuthMethodStore().getPasskeyV2({
-					rpId: authority.rpId,
-					credentialIdB64u: authority.credentialIdB64u
-				});
-				break;
-			case "email_otp":
-				record = await this.getWalletAuthMethodStore().getEmailOtpV2({
-					walletId: String(authority.walletId),
-					emailHashHex: authority.emailHashHex
-				});
-				break;
-			default: return unreachableRegistrationStartAuthority(authority);
-		}
-		if (!record || record.status !== "active" || record.walletId !== authority.walletId) return null;
-		if (authority.kind === "passkey") {
-			if (record.kind !== "passkey" || record.rpId !== authority.rpId || record.credentialIdB64u !== authority.credentialIdB64u || record.credentialPublicKeyB64u !== authority.credentialPublicKeyB64u) return null;
-		} else if (record.kind !== "email_otp" || record.emailHashHex !== authority.emailHashHex || record.registrationAuthorityId !== authority.registrationAuthorityId) return null;
-		const walletAuthority = await this.walletAuthorityStore.readById(record.walletAuthorityId);
-		if (!walletAuthority || walletAuthority.state !== "active" || walletAuthority.walletId !== record.walletId) return null;
-		return {
-			walletAuthorityId: record.walletAuthorityId,
-			walletAuthMethodId: record.walletAuthMethodId,
-			authority: walletAuthority,
-			authMethod: record
-		};
-	}
-	async readActiveRegistrationAuthority(authority) {
-		const identity = await this.readActiveRegistrationIdentity(authority);
-		if (!identity) return null;
-		const walletAuthority = await this.walletAuthorityStore.readById(identity.walletAuthorityId);
-		if (!walletAuthority || walletAuthority.state !== "active" || walletAuthority.walletId !== authority.walletId || walletAuthority.authorityId !== identity.walletAuthorityId) return null;
-		return {
-			authority: walletAuthority,
-			walletAuthMethodId: identity.walletAuthMethodId
-		};
+		return await this.walletAuthorityStore.readActiveRegistrationIdentity(authority);
 	}
 	/**
 	* Verifies a revocation's source proof: bound to this operation, and from a

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthorityStore.js

@@ -1,7 +1,7 @@
 import { mpcMaterialActivationRefsEqual, parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseWalletAuthorityId, parseWalletId, parseWalletRecoveryOperationId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
-import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { parseDelegatedWalletPermissionSetV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { parseWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { buildRevokedWalletAuthorityV1, computeWalletAuthorityDigestB64u, parseWalletAuthorityV1, parseWalletSignerActivationSetV1, walletAuthorityDigestsMatchV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { buildWalletSessionCapabilitySubjectsV1 } from "../../../../authorization/domain.js";
@@ -10,6 +10,29 @@ import { prepareD1WalletPutSignerStatement } from "../../../../core/d1WalletStor
 import { prepareD1WalletAuthMethodV2PutStatement } from "../../../../core/d1WalletAuthMethodStore.js";
 import { prepareD1WalletSessionAuthorityProjectionStatements } from "../authorization/walletSessionAuthorityProjection.js";
 //#region src/router/cloudflare/d1/wallet/d1WalletAuthorityStore.ts
+function registrationMethodSelector(authority) {
+	switch (authority.kind) {
+		case "passkey": return {
+			predicate: "kind = 'passkey' AND rp_id = ? AND credential_id_b64u = ?",
+			values: [authority.rpId, authority.credentialIdB64u]
+		};
+		case "email_otp": return {
+			predicate: "kind = 'email_otp' AND wallet_id = ? AND email_hash_hex = ?",
+			values: [authority.walletId, authority.emailHashHex]
+		};
+		default: return assertNeverRegistrationAuthority(authority);
+	}
+}
+function registrationMethodMatches(expected, method) {
+	switch (expected.kind) {
+		case "passkey": return method.kind === "passkey" && method.rpId === expected.rpId && method.credentialIdB64u === expected.credentialIdB64u && method.credentialPublicKeyB64u === expected.credentialPublicKeyB64u;
+		case "email_otp": return method.kind === "email_otp" && method.emailHashHex === expected.emailHashHex && method.registrationAuthorityId === expected.registrationAuthorityId;
+		default: return assertNeverRegistrationAuthority(expected);
+	}
+}
+function assertNeverRegistrationAuthority(value) {
+	throw new Error(`Unsupported registration authority: ${String(value)}`);
+}
 function normalizeScope(input) {
 	return {
 		namespace: requireScopeString(input.namespace, "namespace"),
@@ -321,6 +344,36 @@ var D1WalletAuthorityStore = class {
 		if (!row) return null;
 		return await parseD1WalletAuthorityRow(row);
 	}
+	/** Reads the method and its authority from one database snapshot. */
+	async readActiveRegistrationIdentity(expected) {
+		const selector = registrationMethodSelector(expected);
+		const row = await this.database.prepare(`SELECT authority.*, method.record_json AS auth_method_record_json,
+                method.wallet_auth_method_id, method.status AS auth_method_status
+           FROM (
+             SELECT * FROM wallet_auth_methods
+              WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
+                AND ${selector.predicate}
+              ORDER BY created_at_ms ASC LIMIT 1
+           ) AS method
+           JOIN wallet_authorities AS authority
+             ON authority.namespace = method.namespace
+            AND authority.org_id = method.org_id
+            AND authority.project_id = method.project_id
+            AND authority.env_id = method.env_id
+            AND authority.authority_id = method.wallet_authority_id
+            AND authority.wallet_id = method.wallet_id`).bind(...scopeValues(this.scope), ...selector.values).first();
+		if (!row) return null;
+		const method = parseWalletAuthMethodRecordV2(parseD1JsonColumn(row.auth_method_record_json));
+		if (!method || method.status !== "active" || method.status !== row.auth_method_status || method.walletAuthMethodId !== row.wallet_auth_method_id || method.walletId !== expected.walletId || !registrationMethodMatches(expected, method)) return null;
+		const authority = await parseD1WalletAuthorityRow(row);
+		if (authority.state !== "active" || authority.walletId !== method.walletId || authority.authorityId !== method.walletAuthorityId) return null;
+		return {
+			walletAuthorityId: authority.authorityId,
+			walletAuthMethodId: method.walletAuthMethodId,
+			authority,
+			authMethod: method
+		};
+	}
 	async readByWalletAndDevice(input) {
 		const row = await this.database.prepare(`SELECT *
            FROM wallet_authorities