@seams/wallet-server 0.8.0 → 0.9.0

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeVerifier.js

@@ -1,7 +1,7 @@
+import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import "../../../../shared-ts/src/utils/encoders.js";
-import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_REGISTRATION_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { emailOtpChallengeBindingMismatchCode, emailOtpChallengeInvalidOrExpired, emailOtpRegistrationChallengeBindingMismatchCode } from "./d1EmailOtpRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeVerifier.ts
@@ -121,6 +121,7 @@ var CloudflareD1EmailOtpChallengeVerifier = class {
 				message: "Missing ownerProofBindingDigest"
 			};
 			const rateLimit = await this.emailOtpRateLimits.consume({
+				kind: "wallet",
 				scope: "verify",
 				action,
 				userId,
@@ -305,6 +306,7 @@ var CloudflareD1EmailOtpChallengeVerifier = class {
 				}
 			}
 			const rateLimit = await this.emailOtpRateLimits.consume({
+				kind: "wallet",
 				scope: "verify",
 				action: recoveryBootstrap ? WALLET_EMAIL_OTP_ACTIONS.recoveryBootstrap : WALLET_EMAIL_OTP_ACTIONS.registration,
 				userId: providerSubject || walletId,

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRateLimitStore.js

@@ -2,81 +2,101 @@ import { emailOtpRateLimitExceeded, emailOtpRateLimitKeys } from "./d1EmailOtpRe
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpRateLimitStore.ts
 var CloudflareD1EmailOtpRateLimitStore = class {
 	constructor(input) {
-		this.rateLimits = input.rateLimits;
-		this.counter = input.counter ?? new D1EmailOtpRateLimitCounter(input.prepare);
+		this.input = input;
 	}
 	async consume(input) {
-		const policy = this.rateLimits[input.scope];
-		const keys = emailOtpRateLimitKeys({
-			...input,
-			policy
-		});
-		for (const key of keys) {
-			const consumed = await this.counter.consume({
-				key,
-				limit: policy.limit,
-				windowMs: policy.windowMs
-			});
-			if (!consumed.ok) return consumed;
+		const policy = this.input.rateLimits[input.scope];
+		const keys = emailOtpRateLimitKeys(input, policy);
+		if (keys.length === 0) return { ok: true };
+		const nowMs = Date.now();
+		const statements = [];
+		for (const [index, counter] of keys.entries()) statements.push(this.prepareConsume(counter, policy, nowMs, index === 0));
+		const results = await this.input.batch(statements);
+		if (results.length !== keys.length) throw new Error("OTP counter batch omitted results");
+		for (const [index, result] of results.entries()) {
+			if (!result.success) throw new Error("OTP counter batch failed");
+			if (result.results?.length) continue;
+			return emailOtpRateLimitExceeded(await this.readCounter(keys[index]));
 		}
 		return { ok: true };
 	}
-};
-var D1EmailOtpRateLimitCounter = class {
-	constructor(prepare) {
-		this.prepare = prepare;
-	}
-	async consume(input) {
-		const nowMs = Date.now();
-		const resetAtMs = nowMs + input.windowMs;
-		if (await this.prepare(`INSERT INTO email_otp_rate_limits (
+	prepareConsume(counter, policy, nowMs, first) {
+		const resetAtMs = nowMs + policy.windowMs;
+		let walletId;
+		switch (counter.kind) {
+			case "wallet":
+				walletId = counter.walletId;
+				break;
+			case "regional":
+				walletId = null;
+				break;
+			default: return assertNever(counter);
+		}
+		const table = walletId === null ? "email_otp_rate_limits" : "wallet_email_otp_rate_limits";
+		const ownerColumn = walletId === null ? "" : "wallet_id,";
+		const ownerPlaceholder = walletId === null ? "" : "?,";
+		const ownerValues = walletId === null ? [] : [walletId];
+		return this.input.prepare(`INSERT INTO ${table} (
         namespace,
         org_id,
         project_id,
         env_id,
+        ${ownerColumn}
         rate_key,
         consumed_count,
         reset_at_ms,
         updated_at_ms
       )
-      VALUES (?, ?, ?, ?, ?, 1, ?, ?)
-      ON CONFLICT (namespace, org_id, project_id, env_id, rate_key)
+      SELECT ?, ?, ?, ?, ${ownerPlaceholder} ?, 1, ?, ?
+      WHERE ? OR changes() > 0
+      ON CONFLICT (namespace, org_id, project_id, env_id, ${ownerColumn} rate_key)
       DO UPDATE SET
         consumed_count = CASE
-          WHEN email_otp_rate_limits.reset_at_ms <= ?
+          WHEN ${table}.reset_at_ms <= ?
             THEN 1
-          ELSE email_otp_rate_limits.consumed_count + 1
+          ELSE ${table}.consumed_count + 1
         END,
         reset_at_ms = CASE
-          WHEN email_otp_rate_limits.reset_at_ms <= ?
+          WHEN ${table}.reset_at_ms <= ?
             THEN ?
-          ELSE email_otp_rate_limits.reset_at_ms
+          ELSE ${table}.reset_at_ms
         END,
         updated_at_ms = ?
-      WHERE email_otp_rate_limits.reset_at_ms <= ?
-         OR email_otp_rate_limits.consumed_count < ?
+      WHERE ${table}.reset_at_ms <= ?
+         OR ${table}.consumed_count < ?
       RETURNING consumed_count, reset_at_ms`, [
-			input.key,
+			...ownerValues,
+			counter.key,
 			resetAtMs,
 			nowMs,
+			first ? 1 : 0,
 			nowMs,
 			nowMs,
 			resetAtMs,
 			nowMs,
 			nowMs,
-			input.limit
-		]).first()) return { ok: true };
-		return emailOtpRateLimitExceeded(await this.prepare(`SELECT consumed_count, reset_at_ms
-         FROM email_otp_rate_limits
+			policy.limit
+		]);
+	}
+	async readCounter(counter) {
+		const walletId = counter.kind === "wallet" ? counter.walletId : null;
+		const table = walletId === null ? "email_otp_rate_limits" : "wallet_email_otp_rate_limits";
+		const ownerValues = walletId === null ? [] : [walletId];
+		return this.input.prepare(`SELECT consumed_count, reset_at_ms
+         FROM ${table}
         WHERE namespace = ?
           AND org_id = ?
           AND project_id = ?
           AND env_id = ?
+          ${walletId === null ? "" : "AND wallet_id = ?"}
           AND rate_key = ?
-        LIMIT 1`, [input.key]).first());
+        LIMIT 1`, [...ownerValues, counter.key]).first();
 	}
 };
+function assertNever(value) {
+	throw new Error(`Unexpected OTP counter ownership: ${String(value)}`);
+}
 //#endregion
-export { CloudflareD1EmailOtpRateLimitStore, D1EmailOtpRateLimitCounter };
+export { CloudflareD1EmailOtpRateLimitStore };
 
 //# sourceMappingURL=d1EmailOtpRateLimitStore.js.map

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRecords.js

@@ -1,11 +1,11 @@
+import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
 import "../../../../shared-ts/src/utils/encoders.js";
-import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { hasExactKeys } from "../../../../shared-ts/src/utils/exactKeys.js";
 import { failure } from "../../../../shared-ts/src/utils/failure.js";
-import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION, isWalletEmailOtpLoginOperation } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
+import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_UNLOCK_OPERATION, isWalletEmailOtpLoginOperation } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { isB64uString, nonNegativeSafeInteger, parseJsonObject, positiveSafeInteger } from "../auth/d1RouterApiAuthBoundary.js";
-import { parseCurrentEmailOtpChallengeRow, parseCurrentEmailOtpGrantRow, parseCurrentEmailOtpUnlockChallengeRow } from "../../../../core/EmailOtpRecords.js";
+import { parseCurrentEmailOtpChallengeRow, parseCurrentEmailOtpGrantRow, parseCurrentEmailOtpUnlockChallengeRow, parseEmailOtpChallengePurpose } from "../../../../core/EmailOtpRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpRecords.ts
 function maskEmail(email) {
 	const trimmed = email.trim().toLowerCase();
@@ -44,20 +44,30 @@ function bytesEqual(left, right) {
 	for (let index = 0; index < left.length; index += 1) difference |= (left[index] || 0) ^ (right[index] || 0);
 	return difference === 0;
 }
-function emailOtpRateLimitKeys(input) {
+function emailOtpRateLimitKeys(input, policy) {
 	const keySuffix = [
 		`scope=${input.scope}`,
 		`action=${input.action || "default"}`,
-		`limit=${input.policy.limit}`,
-		`windowMs=${input.policy.windowMs}`
+		`limit=${policy.limit}`,
+		`windowMs=${policy.windowMs}`
 	].join(":");
-	return [
+	const counters = [];
+	if (input.kind === "wallet") counters.push({
+		kind: "wallet",
+		walletId: input.walletId,
+		key: keySuffix
+	});
+	const regionalKeys = [
 		input.clientIp ? `${keySuffix}:ip:${input.clientIp}` : "",
 		input.userId ? `${keySuffix}:user:${input.userId}` : "",
-		input.walletId ? `${keySuffix}:wallet:${input.walletId}` : "",
 		input.providerSubject ? `${keySuffix}:provider:${input.providerSubject}` : "",
 		input.orgId ? `${keySuffix}:org:${input.orgId}` : ""
-	].filter(Boolean);
+	];
+	for (const key of regionalKeys) if (key) counters.push({
+		kind: "regional",
+		key
+	});
+	return counters;
 }
 function emailOtpRateLimitExceeded(row) {
 	const resetAtMs = positiveSafeInteger(row?.reset_at_ms);
@@ -158,7 +168,7 @@ function parseEmailOtpChallengeRow(row) {
 		recordJson: row?.record_json,
 		expiresAtMs: row?.expires_at_ms
 	});
-	if (!record || record.expiresAtMs <= record.createdAtMs || !emailOtpChallengePurposeIsValid(record)) return null;
+	if (!record || record.expiresAtMs <= record.createdAtMs) return null;
 	return {
 		...record,
 		email: record.email.toLowerCase()
@@ -226,6 +236,8 @@ function emailOtpChallengeContextValues(input) {
 	];
 }
 function emailOtpChallengeRecord(input) {
+	const purpose = parseEmailOtpChallengePurpose(input.action, input.operation);
+	if (!purpose) throw new Error("Invalid Email OTP challenge purpose");
 	return {
 		version: "email_otp_challenge_v1",
 		challengeId: input.challengeId,
@@ -236,8 +248,7 @@ function emailOtpChallengeRecord(input) {
 		email: input.email,
 		otpCode: input.otpCode,
 		ownerProofBindingDigest: input.ownerProofBindingDigest,
-		action: input.action,
-		operation: input.operation,
+		...purpose,
 		createdAtMs: input.createdAtMs,
 		expiresAtMs: input.expiresAtMs,
 		attemptCount: 0,
@@ -245,6 +256,8 @@ function emailOtpChallengeRecord(input) {
 	};
 }
 function emailOtpChallengeWithAttemptCount(record, attemptCount) {
+	const purpose = parseEmailOtpChallengePurpose(record.action, record.operation);
+	if (!purpose) throw new Error("Invalid Email OTP challenge purpose");
 	return {
 		version: "email_otp_challenge_v1",
 		challengeId: record.challengeId,
@@ -255,8 +268,7 @@ function emailOtpChallengeWithAttemptCount(record, attemptCount) {
 		email: record.email,
 		otpCode: record.otpCode,
 		ownerProofBindingDigest: record.ownerProofBindingDigest,
-		action: record.action,
-		operation: record.operation,
+		...purpose,
 		createdAtMs: record.createdAtMs,
 		expiresAtMs: record.expiresAtMs,
 		attemptCount,
@@ -372,12 +384,7 @@ function emailOtpAuthStateRecord(input) {
 	};
 }
 function emailOtpChallengePurposeIsValid(input) {
-	switch (input.action) {
-		case WALLET_EMAIL_OTP_ACTIONS.login: return isWalletEmailOtpLoginOperation(input.operation);
-		case WALLET_EMAIL_OTP_ACTIONS.registration: return input.operation === WALLET_EMAIL_OTP_REGISTRATION_OPERATION;
-		case WALLET_EMAIL_OTP_ACTIONS.recoveryBootstrap: return input.operation === WALLET_EMAIL_OTP_UNLOCK_OPERATION;
-		case WALLET_EMAIL_OTP_ACTIONS.deviceLink: return input.operation === WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION;
-	}
+	return parseEmailOtpChallengePurpose(input.action, input.operation) !== null;
 }
 function optionalPositiveSafeIntegerField(record, field) {
 	if (!hasRecordField(record, field) || record[field] == null) return void 0;

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRecoveryService.js

@@ -229,6 +229,7 @@ var CloudflareD1EmailOtpRecoveryService = class {
 			const parsed = normalizeGrantConsumptionInput(input);
 			if (!parsed.ok) return parsed.result;
 			const rateLimit = await this.emailOtpRateLimits.consume({
+				kind: "wallet",
 				scope: "grant",
 				userId: parsed.value.userId,
 				walletId: parsed.value.walletId,

package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpSessionResolver.js

@@ -121,6 +121,7 @@ var CloudflareD1GoogleEmailOtpSessionResolver = class {
 		if (!orgId.ok) return failure("invalid_body", orgId.error.message);
 		const restartOffer = isTrueFlag(input.restartRegistrationOffer);
 		return await this.emailOtpRateLimits.consume({
+			kind: "regional",
 			scope: "googleRegistrationAttempt",
 			action: restartOffer ? "google_email_otp_registration_offer_restart" : "google_email_otp_registration_create",
 			userId: normalizeOptionalTrimmedString(input.providerUserId),

package/dist/esm/router/cloudflare/d1/oidc/d1OidcBoundary.js

@@ -1,6 +1,6 @@
+import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
 import "../../../../shared-ts/src/utils/encoders.js";
-import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { failedVerification } from "../../../../shared-ts/src/utils/failure.js";
 import { toArrayBufferCopy } from "../../../../core/authService/portableCrypto.js";
 import { toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";

package/dist/esm/router/cloudflare/d1/passkeyCustody/d1WalletCustodyCommitStore.js

@@ -1,6 +1,6 @@
 import { parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { buildDelegatedWalletAuthorityV1, buildFullOwnerDelegatedWalletAuthorityV1, sameDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
+import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { sameWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { sameVerifiedActiveWalletAuthorityV1, walletAuthorityDigestsMatchV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
@@ -346,13 +346,11 @@ var CloudflareD1WalletCustodyCommitStore = class {
           LIMIT 1`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, challengeId).first() !== null;
 	}
 	/**
-	* Writes the envelope and the recovery set in one transaction.
-	*
-	* Both are inserts, never updates: `expectedVersion: null` fails if either
-	* key already holds a row, so a repeated registration cannot silently replace
-	* an established wallet's custody.
+	* Checks the commit and claims its recovery-code routes. The claim is an
+	* exact-retryable directory write that needs no local record, so a caller
+	* may run it beside its other remote effects and write afterwards.
 	*/
-	async commitRegistration(commit) {
+	async reserveRegistration(commit) {
 		const inconsistency = commitInconsistency(commit);
 		if (inconsistency !== null) return {
 			kind: "inconsistent",
@@ -362,6 +360,19 @@ var CloudflareD1WalletCustodyCommitStore = class {
 			kind: "inconsistent",
 			reason: "recovery code locator already exists"
 		};
+		return {
+			kind: "reserved",
+			commit: () => this.commitReservedRegistration(commit)
+		};
+	}
+	/**
+	* Writes the envelope and the recovery set in one transaction.
+	*
+	* Both are inserts, never updates: `expectedVersion: null` fails if either
+	* key already holds a row, so a repeated registration cannot silently replace
+	* an established wallet's custody.
+	*/
+	async commitReservedRegistration(commit) {
 		const envelopeKey = passkeyCustodyEnvelopeRecordKey(passkeyCustodyEnvelopeLocatorOf(commit.envelope));
 		const recoverySetKey = walletRecoveryEnvelopeSetRecordKey(commit.recoverySet.walletId);
 		const recoveryBackupAcknowledgementKey = walletRecoveryBackupAcknowledgementRecordKey(commit.recoverySet.walletId);

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore.js

@@ -1,6 +1,6 @@
-import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
+import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
 import { isD1DatabaseLike } from "../../../../storage/d1Sql.js";
 //#region src/router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore.ts
 const TABLE_NAME = "registration_ceremony_records";
@@ -34,19 +34,17 @@ var D1RegistrationCeremonyRecordStore = class {
 		this.keyPrefix = normalizeKeyPart(options.keyPrefix, "keyPrefix", 128);
 	}
 	async get(scope, id) {
-		const key = this.normalizeKey(scope, id);
-		const row = await this.database.prepare(`SELECT version, record_json, expires_at_ms
-           FROM ${TABLE_NAME}
-          WHERE namespace = ?1
-            AND org_id = ?2
-            AND project_id = ?3
-            AND env_id = ?4
-            AND record_scope = ?5
-            AND record_id = ?6`).bind(...this.bindKey(key)).first();
+		const row = await this.prepareGet(scope, id).first();
+		return this.parseGet(scope, id, row);
+	}
+	prepareGet(scope, id) {
+		return this.prepareRead(this.normalizeKey(scope, id));
+	}
+	async parseGet(scope, id, row) {
 		if (!row) return null;
 		const parsed = parseStoredRow(row);
 		if (parsed.expiresAtMs > Date.now()) return parsed;
-		await this.deleteVersion(key, parsed.version);
+		await this.deleteVersion(this.normalizeKey(scope, id), parsed.version);
 		return null;
 	}
 	async putExact(mutation) {
@@ -64,11 +62,53 @@ var D1RegistrationCeremonyRecordStore = class {
 	async insertOrRead(mutation) {
 		const key = this.normalizeKey(mutation.scope, mutation.id);
 		const prepared = prepareValue(mutation.value, mutation.expiresAtMs);
-		await this.insert(key, prepared);
+		if (await this.insert(key, prepared) && prepared.expiresAtMs > Date.now()) return parseStoredRow({
+			version: 1,
+			record_json: prepared.recordJson,
+			expires_at_ms: prepared.expiresAtMs
+		});
 		const stored = await this.get(mutation.scope, mutation.id);
 		if (!stored) throw conflict("Registration setup expired during persistence");
 		return stored;
 	}
+	/**
+	* Stores `mutation` and opens `copyScope` with the value that `mutation`'s
+	* key then holds, in one batch. A competing insert leaves its winner in both
+	* records, as two `insertOrRead` calls in series would.
+	*/
+	async insertOrReadWithCopy(mutation, copyScope, companion) {
+		const key = this.normalizeKey(mutation.scope, mutation.id);
+		const copyKey = this.normalizeKey(copyScope, mutation.id);
+		const nowMs = Date.now();
+		const results = await this.database.batch([
+			this.prepareInsert(key, prepareValue(mutation.value, mutation.expiresAtMs)),
+			this.database.prepare(`INSERT OR IGNORE INTO ${TABLE_NAME}
+            (namespace, org_id, project_id, env_id, record_scope, record_id,
+             version, record_json, expires_at_ms, updated_at_ms)
+           SELECT namespace, org_id, project_id, env_id, ?7, record_id,
+                  1, record_json, expires_at_ms, ?8
+             FROM ${TABLE_NAME}
+            WHERE namespace = ?1
+              AND org_id = ?2
+              AND project_id = ?3
+              AND env_id = ?4
+              AND record_scope = ?5
+              AND record_id = ?6
+              AND expires_at_ms > ?8`).bind(...this.bindKey(key), copyKey.scope, nowMs),
+			this.prepareRead(key),
+			this.prepareRead(copyKey),
+			...companion
+		]);
+		const record = results[2]?.results?.[0];
+		const copy = results[3]?.results?.[0];
+		if (!record || !copy) throw conflict("Registration setup expired during persistence");
+		const stored = {
+			record: parseStoredRow(record),
+			copy: parseStoredRow(copy)
+		};
+		if (stored.record.expiresAtMs <= nowMs || stored.copy.expiresAtMs <= nowMs) throw conflict("Registration setup expired during persistence");
+		return stored;
+	}
 	async updateExpected(input) {
 		const key = this.normalizeKey(input.scope, input.id);
 		const current = await this.get(input.scope, input.id);
@@ -129,11 +169,22 @@ var D1RegistrationCeremonyRecordStore = class {
 		};
 	}
 	async updateExpectedVersion(input) {
+		if (changes(await this.prepareVersionedUpdate(input).run()) !== 1) throw conflict("Registration ceremony record changed during versioned update");
+		return input.expectedVersion + 1;
+	}
+	/**
+	* The update of `updateExpectedVersion` with its guard, for a batch that
+	* another store owns on this database. The guard fails that batch when the
+	* record is no longer at the expected version.
+	*/
+	prepareExpectedVersionUpdate(input) {
+		return [this.prepareVersionedUpdate(input), this.database.prepare(CAS_GUARD_SQL)];
+	}
+	prepareVersionedUpdate(input) {
 		const key = this.normalizeKey(input.scope, input.id);
 		if (!Number.isSafeInteger(input.expectedVersion) || input.expectedVersion < 1) throw new Error("Registration ceremony expected version is invalid");
 		const next = prepareValue(input.next, input.expiresAtMs);
-		if (changes(await this.database.prepare(UPDATE_EXPECTED_VERSION_SQL).bind(...this.bindKey(key), next.recordJson, next.expiresAtMs, Date.now(), input.expectedVersion).run()) !== 1) throw conflict("Registration ceremony record changed during versioned update");
-		return input.expectedVersion + 1;
+		return this.database.prepare(UPDATE_EXPECTED_VERSION_SQL).bind(...this.bindKey(key), next.recordJson, next.expiresAtMs, Date.now(), input.expectedVersion);
 	}
 	async take(scope, id) {
 		const key = this.normalizeKey(scope, id);
@@ -198,6 +249,16 @@ var D1RegistrationCeremonyRecordStore = class {
 		}
 		return true;
 	}
+	prepareRead(key) {
+		return this.database.prepare(`SELECT version, record_json, expires_at_ms
+           FROM ${TABLE_NAME}
+          WHERE namespace = ?1
+            AND org_id = ?2
+            AND project_id = ?3
+            AND env_id = ?4
+            AND record_scope = ?5
+            AND record_id = ?6`).bind(...this.bindKey(key));
+	}
 	async insert(key, value) {
 		return changes(await this.prepareInsert(key, value).run()) === 1;
 	}

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyRecords.js

@@ -1,7 +1,7 @@
 import { parseChallengeSubjectId, parseEmailOtpChallengeId, parseOrgId, parseProviderSubject, parseRootShareEpoch, parseWalletAuthMethodId, parseWalletAuthorityId, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
-import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { parseWalletAddAuthMethodRegistrationOptions } from "../../../../shared-ts/src/utils/addAuthMethodRegistration.js";
 import { parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationActivationResultV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { deriveEvmFamilySigningKeySlotId } from "../../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyStore.js

@@ -1,10 +1,12 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
+import { prepareD1RegistrationHomeReservation } from "./d1WalletExecutionAuthority.js";
 import { parseD1StoredAddAuthMethodIntent, parseD1StoredAddSignerIntent, parseD1StoredWalletAddAuthMethodCeremony, parseD1StoredWalletAddAuthMethodFinalizeReplay, parseD1StoredWalletAddSignerCeremony, parseD1StoredWalletAddSignerFinalizeReplay, parseD1StoredWalletRegistrationCeremony } from "./d1RegistrationCeremonyRecords.js";
 import { D1RegistrationCeremonyRecordStore } from "./d1RegistrationCeremonyRecordStore.js";
 //#region src/router/cloudflare/d1/registration/d1RegistrationCeremonyStore.ts
 var CloudflareD1RegistrationCeremonyIntentStore = class {
 	constructor(input) {
+		this.input = input;
 		this.storage = new D1RegistrationCeremonyRecordStore(input);
 	}
 	async getSetupCeremony(ceremonyId) {
@@ -14,40 +16,47 @@ var CloudflareD1RegistrationCeremonyIntentStore = class {
 		if (!ceremony) throw new Error("Registration setup snapshot is invalid");
 		return ceremony;
 	}
-	async reserveSetupCeremony(proposed) {
-		const ceremony = parseD1StoredWalletRegistrationCeremony((await this.storage.insertOrRead({
+	/** One batch stores the setup snapshot, ceremony, and authenticated execution identity. */
+	async reserveSetupCeremony(proposed, ownershipGeneration) {
+		const stored = await this.storage.insertOrReadWithCopy({
 			scope: "setup-ceremony",
 			id: proposed.registrationCeremonyId,
 			value: encodeRecord(proposed),
 			expiresAtMs: proposed.expiresAtMs
-		})).value);
-		if (!ceremony || ceremony.registrationCeremonyId !== proposed.registrationCeremonyId || ceremony.expiresAtMs !== proposed.expiresAtMs || ceremony.orgId !== proposed.orgId || ceremony.digestB64u !== proposed.digestB64u || ceremony.foundingWalletAuthorityId !== proposed.foundingWalletAuthorityId || ceremony.foundingDeviceId !== proposed.foundingDeviceId || ceremony.foundingWalletAuthMethodId !== proposed.foundingWalletAuthMethodId || ceremony.expectedOrigin !== proposed.expectedOrigin) throw new Error("Registration setup snapshot conflicts with its reservation");
-		await this.ensureSetupCeremony(ceremony);
+		}, "ceremony", prepareD1RegistrationHomeReservation(this.input.database, this.input.scope, {
+			walletId: proposed.intent.walletId,
+			ceremonyId: proposed.registrationCeremonyId,
+			ownershipGeneration
+		}));
+		const ceremony = parseD1StoredWalletRegistrationCeremony(stored.record.value);
+		if (!ceremony || !sameSetupReservation(ceremony, proposed)) throw new Error("Registration setup snapshot conflicts with its reservation");
+		const current = parseD1StoredWalletRegistrationCeremony(stored.copy.value);
+		if (!current || !sameSetupReservation(current, ceremony)) throw new Error("Registration ceremony conflicts with its setup snapshot");
 		return ceremony;
 	}
-	async ensureSetupCeremony(setup) {
-		const current = parseD1StoredWalletRegistrationCeremony((await this.storage.insertOrRead({
-			scope: "ceremony",
-			id: setup.registrationCeremonyId,
-			value: encodeRecord(setup),
-			expiresAtMs: setup.expiresAtMs
-		})).value);
-		if (!current || current.registrationCeremonyId !== setup.registrationCeremonyId || current.expiresAtMs !== setup.expiresAtMs || current.orgId !== setup.orgId || current.digestB64u !== setup.digestB64u || current.foundingWalletAuthorityId !== setup.foundingWalletAuthorityId || current.foundingDeviceId !== setup.foundingDeviceId || current.foundingWalletAuthMethodId !== setup.foundingWalletAuthMethodId || current.expectedOrigin !== setup.expectedOrigin) throw new Error("Registration ceremony conflicts with its setup snapshot");
-	}
 	async getCeremony(registrationCeremonyId) {
 		return (await this.getCeremonySnapshot(registrationCeremonyId))?.ceremony ?? null;
 	}
-	async getCeremonySnapshot(registrationCeremonyId) {
-		const id = normalizeOptionalTrimmedString(registrationCeremonyId);
-		if (!id) return null;
-		const stored = await this.storage.get("ceremony", id);
+	prepareCeremonyRead(registrationCeremonyId) {
+		return this.storage.prepareGet("ceremony", registrationCeremonyId);
+	}
+	async parseCeremonyRead(registrationCeremonyId, result) {
+		return (await this.parseCeremonySnapshotRead(registrationCeremonyId, result))?.ceremony ?? null;
+	}
+	async parseCeremonySnapshotRead(registrationCeremonyId, result) {
+		if (!result.success) throw new Error("Registration ceremony D1 read failed");
+		const stored = await this.storage.parseGet("ceremony", registrationCeremonyId, result.results?.[0] ?? null);
 		if (!stored) return null;
 		const ceremony = parseD1StoredWalletRegistrationCeremony(stored.value);
-		if (!ceremony || ceremony.expiresAtMs <= Date.now()) return null;
-		return {
+		return ceremony && ceremony.expiresAtMs > Date.now() ? {
 			ceremony,
 			version: stored.version
-		};
+		} : null;
+	}
+	async getCeremonySnapshot(registrationCeremonyId) {
+		const id = normalizeOptionalTrimmedString(registrationCeremonyId);
+		if (!id) return null;
+		return this.parseCeremonySnapshotRead(id, await this.prepareCeremonyRead(id).all());
 	}
 	async updateCeremony(input) {
 		if (input.expected.registrationCeremonyId !== input.next.registrationCeremonyId) throw new Error("Registration ceremony update cannot change its identity");
@@ -90,14 +99,11 @@ var CloudflareD1RegistrationCeremonyIntentStore = class {
 		});
 	}
 	async commitEcdsaClaim(input) {
-		if (input.expected.ceremony.registrationCeremonyId !== input.next.registrationCeremonyId) throw new Error("ECDSA registration claim commit cannot change its ceremony identity");
-		await this.storage.updateExpectedVersion({
-			scope: "ceremony",
-			id: input.next.registrationCeremonyId,
-			expectedVersion: input.expected.version,
-			next: encodeRecord(input.next),
-			expiresAtMs: input.next.expiresAtMs
-		});
+		await this.storage.updateExpectedVersion(ceremonyCommitUpdate(input));
+	}
+	/** `commitEcdsaClaim` as statements for a batch that another store owns on this database. */
+	prepareEcdsaClaimCommit(input) {
+		return { statements: this.storage.prepareExpectedVersionUpdate(ceremonyCommitUpdate(input)) };
 	}
 	async deleteCeremony(registrationCeremonyId) {
 		const id = normalizeOptionalTrimmedString(registrationCeremonyId);
@@ -318,6 +324,20 @@ function encodeRecord(value) {
 	if (!isPlainObject(value)) throw new Error("Registration ceremony record must be an object");
 	return value;
 }
+function ceremonyCommitUpdate(input) {
+	if (input.expected.ceremony.registrationCeremonyId !== input.next.registrationCeremonyId) throw new Error("ECDSA registration claim commit cannot change its ceremony identity");
+	return {
+		scope: "ceremony",
+		id: input.next.registrationCeremonyId,
+		expectedVersion: input.expected.version,
+		next: encodeRecord(input.next),
+		expiresAtMs: input.next.expiresAtMs
+	};
+}
+/** The facts a reservation fixes for its setup snapshot and its ceremony. */
+function sameSetupReservation(stored, expected) {
+	return stored.registrationCeremonyId === expected.registrationCeremonyId && stored.expiresAtMs === expected.expiresAtMs && stored.orgId === expected.orgId && stored.digestB64u === expected.digestB64u && stored.foundingWalletAuthorityId === expected.foundingWalletAuthorityId && stored.foundingDeviceId === expected.foundingDeviceId && stored.foundingWalletAuthMethodId === expected.foundingWalletAuthMethodId && stored.expectedOrigin === expected.expectedOrigin;
+}
 //#endregion
 export { CloudflareD1RegistrationCeremonyIntentStore };
 

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationSessionTransaction.js

@@ -0,0 +1,28 @@
+//#region src/router/cloudflare/d1/registration/d1RegistrationSessionTransaction.ts
+/** The wallet's version checks and the session's winner read share one batch. */
+var D1RegistrationSessionTransaction = class {
+	constructor(database, commitWallet) {
+		this.database = database;
+		this.commitWallet = commitWallet;
+		this.sessionResults = null;
+	}
+	async execute(sessionStatements) {
+		await this.commitWallet(this.commit.bind(this, sessionStatements));
+		if (this.sessionResults === null) throw new Error("Registration wallet commit did not execute its session transaction");
+		return this.sessionResults;
+	}
+	async commit(sessionStatements, walletStatements) {
+		this.sessionResults = null;
+		const results = await this.database.batch([...walletStatements, ...sessionStatements]);
+		if (results.length !== walletStatements.length + sessionStatements.length || results.some(batchStatementFailed)) throw new Error("Registration wallet/session transaction returned incomplete results");
+		this.sessionResults = results.slice(walletStatements.length);
+		return results.slice(0, walletStatements.length);
+	}
+};
+function batchStatementFailed(result) {
+	return !result.success;
+}
+//#endregion
+export { D1RegistrationSessionTransaction };
+
+//# sourceMappingURL=d1RegistrationSessionTransaction.js.map