@seams/wallet-server 0.8.0 → 0.9.1

package/dist/esm/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryWalletSessionAuthorization.js

@@ -1,3 +1,4 @@
+import { parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { NEAR_ED25519_MPC_OPERATION_KINDS } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
@@ -344,6 +345,32 @@ async function authorizeRecoveryContinuation(input) {
 		}
 	};
 }
+async function authorizeRecoveryCredential(input, services) {
+	switch (input.kind) {
+		case "bootstrap": return await authorizeV2WarmBootstrap({
+			request: input,
+			services
+		});
+		case "admit":
+			if (String(input.request.headers.get("x-seams-wallet-recovery-challenge-id") || "").trim()) return await authorizePreparedRecovery({
+				request: input,
+				services
+			});
+			if (extractBearerCredential(input.request.headers)) return await authorizeV2RecoveryAdmission({
+				request: input,
+				services
+			});
+			return await authorizePreparedRecovery({
+				request: input,
+				services
+			});
+		case "execute":
+		case "activate": return await authorizeRecoveryContinuation({
+			request: input,
+			services
+		});
+	}
+}
 var RouterAbEd25519YaoRecoveryWalletSessionAuthorizationAdapter = class {
 	constructor(resolveServices) {
 		this.resolveServices = resolveServices;
@@ -359,30 +386,52 @@ var RouterAbEd25519YaoRecoveryWalletSessionAuthorizationAdapter = class {
 				message: "wallet recovery admission is unavailable"
 			});
 		}
-		switch (input.kind) {
-			case "bootstrap": return await authorizeV2WarmBootstrap({
-				request: input,
-				services
-			});
-			case "admit":
-				if (String(input.request.headers.get("x-seams-wallet-recovery-challenge-id") || "").trim()) return await authorizePreparedRecovery({
-					request: input,
-					services
-				});
-				if (extractBearerCredential(input.request.headers)) return await authorizeV2RecoveryAdmission({
-					request: input,
-					services
-				});
-				return await authorizePreparedRecovery({
-					request: input,
-					services
-				});
-			case "execute":
-			case "activate": return await authorizeRecoveryContinuation({
-				request: input,
-				services
+		const credential = await authorizeRecoveryCredential(input, services);
+		if (!credential.ok) return credential;
+		const authorization = credential.authorization;
+		if (input.kind === "execute" || input.kind === "activate") return {
+			ok: true,
+			ownershipGeneration: input.ownershipGeneration,
+			authorization
+		};
+		let walletIdentity;
+		switch (authorization.kind) {
+			case "wallet_recovery":
+				walletIdentity = authorization.walletId;
+				break;
+			case "wallet_session_v2":
+				walletIdentity = authorization.context.authorization.session.walletId;
+				break;
+			case "wallet_session_v2_exhausted_candidate":
+				walletIdentity = authorization.context.status.session.walletId;
+				break;
+		}
+		const walletId = parseWalletId(walletIdentity);
+		if (!walletId.ok) return authorizationFailure({
+			status: 403,
+			code: "wallet_recovery_scope_mismatch",
+			message: "Recovery wallet identity is invalid"
+		});
+		let home;
+		try {
+			home = await services.admitEstablishedHome({ walletId: walletId.value });
+		} catch {
+			return authorizationFailure({
+				status: 503,
+				code: "wallet_home_unavailable",
+				message: "Recovery wallet home is unavailable"
 			});
 		}
+		if (!home.ok) return authorizationFailure({
+			status: 409,
+			code: home.code,
+			message: home.message
+		});
+		return {
+			ok: true,
+			ownershipGeneration: home.ownershipGeneration,
+			authorization
+		};
 	}
 };
 //#endregion

package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoHttpRegistrationBackend.js

@@ -1,8 +1,9 @@
 import { requireRecord } from "../../../../shared-ts/src/utils/validation.js";
 import { deriveRouterAbEd25519YaoStableContextBindingV1 } from "../../../../shared-ts/src/utils/routerAbEd25519YaoDigests.js";
 import { parseRouterAbEd25519YaoActivationKeysetV1, parseRouterAbEd25519YaoActivationResultV1, parseRouterAbEd25519YaoExportResultV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
+import { walletObjectIdentity, walletObjectIdentityHeaders } from "../../../cloudflare/runtime/walletObjectAddresses.js";
 import { createRouterAbTraceContextV1 } from "../../../../shared-ts/src/utils/routerAbTraceContext.js";
-import { routerAbEd25519YaoTenantRootWireV1 } from "../routerAbEd25519YaoGatewayEnvelope.js";
+import { routerAbEd25519YaoRegistrationSigningRootIdV1, routerAbEd25519YaoTenantRootWireV1 } from "../routerAbEd25519YaoGatewayEnvelope.js";
 //#region src/router/domains/ed25519Yao/registration/routerAbEd25519YaoHttpRegistrationBackend.ts
 const INTERNAL_AUTH_HEADER = "x-router-ab-internal-service-auth";
 const TRACE_ID_HEADER = "x-seams-trace-id";
@@ -216,6 +217,7 @@ function registrationRouterExecuteRequest(input, tenantRoot) {
 		participant_ids: input.admissionRequest.participant_ids,
 		target: {
 			operation: "registration",
+			ownership_generation: input.ownershipGeneration,
 			binding: input.request.binding,
 			deriver_a_input: input.request.deriver_a_input,
 			deriver_b_input: input.request.deriver_b_input
@@ -229,6 +231,7 @@ function recoveryRouterExecuteRequest(input, tenantRoot, attempt) {
 		participant_ids: input.admissionRequest.participant_ids,
 		target: {
 			operation: "recovery",
+			ownership_generation: input.ownershipGeneration,
 			binding: input.request.binding,
 			attempt,
 			deriver_a_input: input.request.deriver_a_input,
@@ -241,7 +244,7 @@ async function routerExecuteRequest(input, resolveTenantRoot) {
 	switch (input.operation) {
 		case "registration": return registrationRouterExecuteRequest(input, await routerAbEd25519YaoTenantRootWireV1(await resolveTenantRoot({
 			operation: "registration",
-			admissionRequest: input.admissionRequest
+			...routerAbEd25519YaoRegistrationSigningRootIdV1(input.admissionRequest)
 		})));
 		case "export": return {
 			tenant_root: await routerAbEd25519YaoTenantRootWireV1(await resolveTenantRoot({
@@ -252,6 +255,7 @@ async function routerExecuteRequest(input, resolveTenantRoot) {
 			participant_ids: input.admissionRequest.participant_ids,
 			target: {
 				operation: "export",
+				ownership_generation: input.ownershipGeneration,
 				binding: input.request.binding,
 				deriver_a_input: input.request.deriver_a_input,
 				deriver_b_input: input.request.deriver_b_input
@@ -458,11 +462,12 @@ var RouterAbEd25519YaoHttpRegistrationBackend = class {
 			}
 		};
 	}
-	async executeExport(request, admissionRequest, traceContext) {
+	async executeExport(request, claim, traceContext) {
 		return await this.executeRouterRequest({
 			operation: "export",
 			request,
-			admissionRequest
+			admissionRequest: claim.admissionRequest,
+			ownershipGeneration: claim.ownershipGeneration
 		}, false, traceContext);
 	}
 	keyset() {
@@ -529,34 +534,37 @@ var RouterAbEd25519YaoHttpRegistrationBackend = class {
 			};
 		}
 	}
-	async execute(request, admissionRequest, traceContext) {
+	async execute(request, admissionRequest, ownershipGeneration, traceContext) {
 		return await this.executeRouterRequest({
 			operation: "registration",
 			request,
-			admissionRequest
+			admissionRequest,
+			ownershipGeneration
 		}, false, traceContext);
 	}
-	async resolveRegistrationDispatchRoot(admissionRequest) {
+	async resolveRegistrationDispatchRoot(signingRootId) {
 		return await routerAbEd25519YaoTenantRootWireV1(await this.config.resolveTenantRoot({
 			operation: "registration",
-			admissionRequest
+			...signingRootId
 		}));
 	}
-	async executePinnedRegistration(request, admissionRequest, dispatchRoot, traceContext) {
+	async executePinnedRegistration(request, authority, traceContext) {
 		const routerInput = {
 			operation: "registration",
 			request,
-			admissionRequest
+			admissionRequest: authority.admissionRequest,
+			ownershipGeneration: authority.ownershipGeneration
 		};
-		return await this.sendRouterRequest(routerInput, registrationRouterExecuteRequest(routerInput, dispatchRoot), traceContext.value, "exact", false);
+		return await this.sendRouterRequest(routerInput, registrationRouterExecuteRequest(routerInput, authority.dispatchRoot), traceContext.value, "exact", false);
 	}
 	async consumeRegistration(input) {
 		let response;
 		try {
-			response = await this.post(ROUTER_REGISTRATION_CONSUME_PATH, {
-				tenant_root: input.tenantRoot,
-				wallet_id: input.walletId,
-				lifecycle_id: input.lifecycleId,
+			response = await this.post(ROUTER_REGISTRATION_CONSUME_PATH, walletObjectIdentity(input.authority.admissionReceipt.binding.lifecycle.account_id, input.authority.ownershipGeneration, input.authority.dispatchRoot.identity), {
+				tenant_root: input.authority.dispatchRoot,
+				ownership_generation: input.authority.ownershipGeneration,
+				wallet_id: input.authority.admissionReceipt.binding.lifecycle.account_id,
+				lifecycle_id: input.authority.lifecycleId,
 				session_id: Array.from(input.sessionId),
 				consumer_binding: input.consumerBinding
 			}, createRouterAbTraceContextV1().value, "exact");
@@ -578,13 +586,14 @@ var RouterAbEd25519YaoHttpRegistrationBackend = class {
 			admissionRequest
 		}));
 	}
-	async executeRecovery(request, admissionRequest, dispatchRoot, attempt, replay, traceContext) {
+	async executeRecovery(request, claim, traceContext) {
 		const routerInput = {
 			operation: "recovery",
 			request,
-			admissionRequest
+			admissionRequest: claim.admissionRequest,
+			ownershipGeneration: claim.ownershipGeneration
 		};
-		return await this.sendRouterRequest(routerInput, recoveryRouterExecuteRequest(routerInput, dispatchRoot, attempt), (traceContext ?? createRouterAbTraceContextV1()).value, "replay", replay);
+		return await this.sendRouterRequest(routerInput, recoveryRouterExecuteRequest(routerInput, claim.dispatchRoot, claim.attempt), (traceContext ?? createRouterAbTraceContextV1()).value, "replay", claim.replay);
 	}
 	async executeRouterRequest(request, replay, traceContext) {
 		const traceId = (traceContext ?? createRouterAbTraceContextV1()).value;
@@ -604,7 +613,7 @@ var RouterAbEd25519YaoHttpRegistrationBackend = class {
 		const operation = request.operation;
 		const executeStartedAt = performance.now();
 		try {
-			const response = await this.post(ROUTER_EXECUTE_PATH, routerRequest, traceId, retryAfterTransportFailure, replay);
+			const response = await this.post(ROUTER_EXECUTE_PATH, walletObjectIdentity(request.admissionRequest.application_binding.wallet_id, request.ownershipGeneration, routerRequest.tenant_root.identity), routerRequest, traceId, retryAfterTransportFailure, replay);
 			this.lastRouterServerTiming = response.ok ? response.serverTiming : null;
 			const result = response.ok ? parseRouterExecuteResult(response.body, request.request) : response;
 			emitGatewaySpan(this.config.onSpan, "gateway.yao_execute", operation, traceId, executeStartedAt, result.ok ? "success" : "failure");
@@ -614,10 +623,11 @@ var RouterAbEd25519YaoHttpRegistrationBackend = class {
 			return unavailableFailure(error);
 		}
 	}
-	async activateRecovery(request, dispatchRoot, traceContext) {
-		const promoted = await this.post(ROUTER_RECOVERY_PROMOTE_PATH, {
+	async activateRecovery(request, dispatchRoot, ownershipGeneration, traceContext) {
+		const promoted = await this.post(ROUTER_RECOVERY_PROMOTE_PATH, walletObjectIdentity(request.binding.lifecycle.account_id, ownershipGeneration, dispatchRoot.identity), {
 			...request,
-			tenant_root: dispatchRoot
+			tenant_root: dispatchRoot,
+			ownership_generation: ownershipGeneration
 		}, (traceContext ?? createRouterAbTraceContextV1()).value);
 		if (!promoted.ok) return promoted;
 		if (!activeReceiptMatchesRecoveryActivation(parseActiveSigningWorkerReceipt(promoted.body, request.binding.session_id, request.public_receipt.transcript), request)) return internalFailure("recovery_promotion_mismatch", "Router promotion receipt does not match the verified recovery result");
@@ -626,10 +636,13 @@ var RouterAbEd25519YaoHttpRegistrationBackend = class {
 			body: request
 		};
 	}
-	async post(path, body, traceId, retryAfterTransportFailure = "none", replay = false) {
+	async post(path, identity, body, traceId, retryAfterTransportFailure = "none", replay = false) {
 		const init = {
 			method: "POST",
-			headers: this.headers(traceId),
+			headers: {
+				...this.headers(traceId),
+				...walletObjectIdentityHeaders(identity)
+			},
 			body: JSON.stringify(body)
 		};
 		return await this.request(this.config.routerUrl, path, replay ? requestInitWithReplayHeader(init) : init, retryAfterTransportFailure);
@@ -669,7 +682,6 @@ function parseRouterServerTiming(value) {
 	const metrics = value.split(",").map((metric) => metric.trim());
 	const allowedNames = new Set([
 		"yao_router_prepare_pair",
-		"yao_router_verify_readiness",
 		"yao_router_role_execution",
 		"yao_router_signing_worker_delivery"
 	]);

package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistration.js

@@ -187,7 +187,7 @@ var RouterAbEd25519YaoRegistrationRouteExtension = class {
 			body: parsed.value
 		});
 		if (!authorization.ok) return routeFailureResponse(authorization);
-		const result = await this.service.execute(parsed.value, traceContext.value);
+		const result = await this.service.execute(parsed.value, authorization.ownershipGeneration, traceContext.value);
 		if (!result.ok) return routeFailureResponse(result);
 		return json(result.value, { status: result.status });
 	}
@@ -324,7 +324,7 @@ var InMemoryRouterAbEd25519YaoRegistrationService = class {
 			value: parsed.value
 		};
 	}
-	async execute(request, traceContext) {
+	async execute(request, ownershipGeneration, traceContext) {
 		const preparation = this.prepareExecute(request);
 		switch (preparation.kind) {
 			case "completed": return {
@@ -338,7 +338,7 @@ var InMemoryRouterAbEd25519YaoRegistrationService = class {
 				try {
 					outcome = {
 						kind: "backend_response",
-						result: await this.backend.execute(request, preparation.claim.admissionRequest, traceContext)
+						result: await this.backend.execute(request, preparation.claim.admissionRequest, ownershipGeneration, traceContext)
 					};
 				} catch (error) {
 					outcome = {

package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationExecutionRecord.js

@@ -9,8 +9,9 @@ import { routerAbEd25519YaoCredentialDigestHexV1 } from "./routerAbEd25519YaoReg
 */
 function buildRouterAbEd25519YaoRegistrationExecutionAuthorityV1(input) {
 	const { lifecycleId, registration, authority, dispatchRoot } = input;
-	if (dispatchRoot === void 0 || dispatchRoot.identity.signingRootId !== registration.admissionRequest.application_binding.signing_root_id || dispatchRoot.identity.signingRootVersion !== registration.admissionRequest.scope.root_share_epoch || registration.admissionRequest.scope.lifecycle_id !== lifecycleId || registration.admissionReceipt.binding.lifecycle.lifecycle_id !== lifecycleId || authority.admissionRequest.scope.lifecycle_id !== lifecycleId || authority.admissionFingerprint !== encodeRouterAbEd25519YaoRegistrationAdmissionFingerprintV1(authority.admissionRequest) || authority.admissionFingerprint !== encodeRouterAbEd25519YaoRegistrationAdmissionFingerprintV1(registration.admissionRequest) || !Number.isSafeInteger(authority.expiresAtMs) || authority.expiresAtMs <= 0) return null;
+	if (!Number.isSafeInteger(authority.ownershipGeneration) || authority.ownershipGeneration < 1 || dispatchRoot === void 0 || dispatchRoot.identity.signingRootId !== registration.admissionRequest.application_binding.signing_root_id || dispatchRoot.identity.signingRootVersion !== registration.admissionRequest.scope.root_share_epoch || registration.admissionRequest.scope.lifecycle_id !== lifecycleId || registration.admissionReceipt.binding.lifecycle.lifecycle_id !== lifecycleId || authority.admissionRequest.scope.lifecycle_id !== lifecycleId || authority.admissionFingerprint !== encodeRouterAbEd25519YaoRegistrationAdmissionFingerprintV1(authority.admissionRequest) || authority.admissionFingerprint !== encodeRouterAbEd25519YaoRegistrationAdmissionFingerprintV1(registration.admissionRequest) || !Number.isSafeInteger(authority.expiresAtMs) || authority.expiresAtMs <= 0) return null;
 	return {
+		ownershipGeneration: authority.ownershipGeneration,
 		lifecycleId,
 		admissionRequest: registration.admissionRequest,
 		admissionReceipt: registration.admissionReceipt,

package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationIntentAuthorization.js

@@ -180,6 +180,7 @@ function admittedAuthority(authority) {
 	return {
 		kind: "admitted",
 		purpose: authority.purpose,
+		ownershipGeneration: authority.ownershipGeneration,
 		credentialDigestSha256: authority.credentialDigestSha256,
 		admissionRequest: authority.admissionRequest,
 		admissionFingerprint: authority.admissionFingerprint,
@@ -217,6 +218,7 @@ var InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter = class {
 		this.authorities = state.authorities;
 	}
 	async bindVerifiedIntent(verified) {
+		if (!Number.isSafeInteger(verified.ownershipGeneration) || verified.ownershipGeneration < 1) return failure("invalid_registration_intent", "Wallet ownership generation is invalid");
 		const credential = activationIntentCredential(verified);
 		if (!VERIFIED_INTENT_CREDENTIAL.test(credential)) return failure("invalid_registration_intent", "registration intent grant is not a canonical Bearer credential");
 		if (!Number.isSafeInteger(verified.expiresAtMs) || verified.expiresAtMs <= Date.now()) return failure("invalid_registration_intent", "registration intent authority is expired");
@@ -229,7 +231,7 @@ var InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter = class {
 		const existingLifecycle = findAuthorityByLifecycleId(this.authorities, verified.admissionRequest.scope.lifecycle_id);
 		if (existingCredential || existingLifecycle) {
 			const existing = existingCredential?.authority ?? existingLifecycle?.authority;
-			const exactRetry = existing !== void 0 && existing.purpose === purpose && credentialDigestsEqual(existing.credentialDigestSha256, credentialDigest) && (existing.admissionFingerprint === admissionFingerprint || purpose === "wallet_registration" && sameAdmissionSubject(existing.admissionRequest, copiedAdmissionRequest)) && existing.expiresAtMs === verified.expiresAtMs;
+			const exactRetry = existing !== void 0 && existing.purpose === purpose && existing.ownershipGeneration === verified.ownershipGeneration && credentialDigestsEqual(existing.credentialDigestSha256, credentialDigest) && (existing.admissionFingerprint === admissionFingerprint || purpose === "wallet_registration" && sameAdmissionSubject(existing.admissionRequest, copiedAdmissionRequest)) && existing.expiresAtMs === verified.expiresAtMs;
 			credentialDigest.fill(0);
 			return exactRetry ? {
 				ok: true,
@@ -238,6 +240,7 @@ var InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter = class {
 		}
 		this.authorities.push({
 			kind: "available",
+			ownershipGeneration: verified.ownershipGeneration,
 			purpose,
 			credentialDigestSha256: credentialDigest,
 			admissionRequest: copiedAdmissionRequest,
@@ -255,6 +258,7 @@ var InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter = class {
 		this.authorities[existing.index] = {
 			kind: existing.authority.kind,
 			purpose: existing.authority.purpose,
+			ownershipGeneration: existing.authority.ownershipGeneration,
 			admissionRequest: existing.authority.admissionRequest,
 			admissionFingerprint: existing.authority.admissionFingerprint,
 			credentialDigestSha256: await credentialDigestSha256(verified.credential),
@@ -265,6 +269,17 @@ var InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter = class {
 			admissionRequest: copyAdmissionRequest(existing.authority.admissionRequest)
 		};
 	}
+	async bindAndAuthorizeAdmission(input) {
+		const bound = await this.bindVerifiedIntent(input);
+		if (!bound.ok) return bound;
+		const digest = await credentialDigestSha256(input.kind === "verified_registration_intent" ? input.registrationIntentGrant : input.addSignerIntentGrant);
+		try {
+			const authorized = this.authorizeAdmission(bound.admissionRequest, digest);
+			return authorized.ok ? bound : authorized;
+		} finally {
+			digest.fill(0);
+		}
+	}
 	async authorize(input) {
 		const bearer = extractStrictBearerCredential(input.request);
 		if (!bearer.ok) return bearer.result;
@@ -296,7 +311,10 @@ var InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter = class {
 			message: "registration intent credential does not authorize this admission subject"
 		});
 		if (matched.authority.kind === "available") this.authorities[matched.index] = admittedAuthority(matched.authority);
-		return { ok: true };
+		return {
+			ok: true,
+			ownershipGeneration: matched.authority.ownershipGeneration
+		};
 	}
 	async authorizeExecution(binding, credentialDigest) {
 		const matched = findAuthorityByLifecycleId(this.authorities, binding.lifecycle.lifecycle_id);
@@ -331,7 +349,10 @@ var InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter = class {
 			code: "registration_intent_binding_mismatch",
 			message: "registration execution context does not match its admitted application"
 		});
-		return { ok: true };
+		return {
+			ok: true,
+			ownershipGeneration: matched.authority.ownershipGeneration
+		};
 	}
 };
 //#endregion

package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationRequestScopedCloudflare.js

@@ -4,6 +4,7 @@ import { json, readJson } from "../../../framework/http.js";
 import { InMemoryRouterAbEd25519YaoRegistrationService, routerAbEd25519YaoExecutionMatchesAdmissionV1 } from "./routerAbEd25519YaoRegistration.js";
 import { InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter, routerAbEd25519YaoBearerCredentialDigestV1 } from "./routerAbEd25519YaoRegistrationIntentAuthorization.js";
 import { pinRouterAbEd25519YaoRegistrationDispatchRootV1, routerAbEd25519YaoRegistrationResultFromRouterAnswerV1 } from "./routerAbEd25519YaoRegistrationExecutionRecord.js";
+import { routerAbEd25519YaoRegistrationSigningRootIdV1 } from "../routerAbEd25519YaoGatewayEnvelope.js";
 import { routerAbEd25519YaoAdmittedRegistrationAuthorityV1 } from "../capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore.js";
 import { runRouterAbEd25519YaoRegistrationTwoPhaseV1 } from "./routerAbEd25519YaoRegistrationTwoPhaseRunner.js";
 //#region src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationRequestScopedCloudflare.ts
@@ -109,7 +110,7 @@ async function runAdmissionRequest(input, request, trace) {
 				};
 				case "claimed":
 					try {
-						dispatchRoot = await input.backend.resolveRegistrationDispatchRoot(request);
+						dispatchRoot = await input.backend.resolveRegistrationDispatchRoot(routerAbEd25519YaoRegistrationSigningRootIdV1(request));
 					} catch (error) {
 						return {
 							kind: "rejected",
@@ -183,7 +184,7 @@ async function runExecutionRequest(input, request, trace) {
 	};
 	if (!credential.ok) return timedExecutionResult(credential.result, timing);
 	const admissionStartedAt = performance.now();
-	const authority = routerAbEd25519YaoAdmittedRegistrationAuthorityV1((await input.store.load(lifecycleId)).state, lifecycleId);
+	const authority = routerAbEd25519YaoAdmittedRegistrationAuthorityV1((await input.store.loadRegistration(lifecycleId)).state, lifecycleId);
 	const timingBeforeRouter = {
 		...timing,
 		d1AdmissionReadMs: elapsedMs(admissionStartedAt)
@@ -195,7 +196,7 @@ async function runExecutionRequest(input, request, trace) {
 	let backend;
 	const routerExecutionStartedAt = performance.now();
 	try {
-		backend = await input.backend.executePinnedRegistration(request, authority.admissionRequest, authority.dispatchRoot, trace);
+		backend = await input.backend.executePinnedRegistration(request, authority, trace);
 	} catch (error) {
 		return timedExecutionResult({
 			ok: false,

package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js

@@ -104,13 +104,16 @@ function parseRouterAbEd25519YaoRegistrationSideEffectClaimFields(record, parseP
 * or allowing a network effect.
 */
 async function runRouterAbEd25519YaoRegistrationSideEffectV1(store, input) {
+	return runRegistrationSideEffect(store, input, store.read.bind(store));
+}
+async function runRegistrationSideEffect(store, input, readInitial) {
 	const key = requireOpaqueKey(input.key);
 	const requestFingerprint = requireRequestFingerprint(input.requestFingerprint);
 	const resumeAfterMs = requirePositiveDuration(input.resumeAfterMs, "resumeAfterMs");
 	let existing;
 	let disposition;
 	try {
-		existing = await store.read(key);
+		existing = await readInitial(key);
 		disposition = await existingDisposition(existing, requestFingerprint, input.derivePreparedArtifactFingerprint);
 	} catch (error) {
 		return uncertainResult("claim", error);
@@ -233,7 +236,8 @@ async function runRouterAbEd25519YaoRegistrationSideEffectV1(store, input) {
 * from its digest, so replay never reconstructs one.
 */
 async function runRouterAbEd25519YaoRegistrationSideEffectV2(store, input) {
-	const result = await runRouterAbEd25519YaoRegistrationSideEffectV1(new RegistrationV2StoreAdapter(store, input.projectReceipt), {
+	const adaptedStore = new RegistrationV2StoreAdapter(store, input.initialRecord, input.projectReceipt, input.completionWrite);
+	const result = await runRegistrationSideEffect(adaptedStore, {
 		kind: input.kind,
 		operation: input.operation,
 		key: input.key,
@@ -246,7 +250,7 @@ async function runRouterAbEd25519YaoRegistrationSideEffectV2(store, input) {
 			kind: "executed_response",
 			response: await input.execute(prepared, attempt)
 		})
-	});
+	}, adaptedStore.readInitial.bind(adaptedStore));
 	switch (result.kind) {
 		case "executed":
 			if (result.value.kind !== "executed_response") return {
@@ -280,12 +284,19 @@ async function resolveRegistrationV2AdapterReplay(value, input) {
 	}
 }
 var RegistrationV2StoreAdapter = class {
-	constructor(store, projectReceipt) {
+	constructor(store, initialRecord, projectReceipt, completionWrite) {
 		this.store = store;
+		this.initialRecord = initialRecord;
 		this.projectReceipt = projectReceipt;
+		this.completionWrite = completionWrite;
+	}
+	async readInitial() {
+		return this.adaptRead(this.initialRecord);
 	}
 	async read(key) {
-		const result = await this.store.read(key);
+		return this.adaptRead(await this.store.read(key));
+	}
+	adaptRead(result) {
 		if (result.kind === "missing") return { kind: "missing" };
 		switch (result.value.kind) {
 			case "router_ab_ed25519_yao_registration_side_effect_claim_v1": return {
@@ -319,7 +330,7 @@ var RegistrationV2StoreAdapter = class {
 			case "router_ab_ed25519_yao_registration_side_effect_completion_v1": {
 				if (value.response.kind !== "executed_response") throw new Error("registration side-effect cannot persist a replay response");
 				const receipt = requireReceipt(await this.projectReceipt(value.response.response));
-				return await this.store.put(key, {
+				const completion = {
 					kind: "router_ab_ed25519_yao_registration_side_effect_completion_v2",
 					operation: value.operation,
 					requestFingerprint: value.requestFingerprint,
@@ -328,7 +339,9 @@ var RegistrationV2StoreAdapter = class {
 					completedAtMs: value.completedAtMs,
 					prepared: value.prepared,
 					receipt
-				}, expectedVersion);
+				};
+				const companionWrite = this.completionWrite(value.response.response);
+				return companionWrite ? await this.store.putWithCompanion(key, completion, expectedVersion, companionWrite) : await this.store.put(key, completion, expectedVersion);
 			}
 			default: return assertNever(value);
 		}

package/dist/esm/router/domains/ed25519Yao/routerAbEd25519YaoGatewayEnvelope.js

@@ -39,7 +39,13 @@ async function routerAbEd25519YaoTenantRootWireV1(root) {
 		custody_lineage_b64u: root.custodyLineageB64u
 	};
 }
+function routerAbEd25519YaoRegistrationSigningRootIdV1(admissionRequest) {
+	return {
+		signing_root_id: admissionRequest.application_binding.signing_root_id,
+		root_share_epoch: admissionRequest.scope.root_share_epoch
+	};
+}
 //#endregion
-export { parseRouterAbEd25519YaoTenantRootWireV1, routerAbEd25519YaoTenantRootWireV1 };
+export { parseRouterAbEd25519YaoTenantRootWireV1, routerAbEd25519YaoRegistrationSigningRootIdV1, routerAbEd25519YaoTenantRootWireV1 };
 
 //# sourceMappingURL=routerAbEd25519YaoGatewayEnvelope.js.map

package/dist/esm/router/domains/emailOtp/emailOtpRouteHandlers.js

@@ -1,7 +1,7 @@
-import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
-import "../../../shared-ts/src/utils/encoders.js";
 import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
 import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
+import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
+import "../../../shared-ts/src/utils/encoders.js";
 import { failure } from "../../../shared-ts/src/utils/failure.js";
 import { emailOtpStatusCode } from "./emailOtpSessionRouteHelpers.js";
 import { EMAIL_OTP_FACTOR_RELEASE_AAD_DOMAIN_V1 } from "../../../shared-ts/src/utils/emailOtpDomain.js";

package/dist/esm/router/domains/passkeyCustody/passkeyCustodyEnvelopeRetrieval.js

@@ -1,5 +1,5 @@
-import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
+import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { decodeBase64UrlOrBase64 } from "../../../core/authService/webauthnOidcHelpers.js";
 import { verifyWebAuthnAuthenticationLiteWithStore } from "../../../core/authService/webauthn.js";
 //#region src/router/domains/passkeyCustody/passkeyCustodyEnvelopeRetrieval.ts

package/dist/esm/router/domains/passkeyCustody/registrationCustodyOutcome.js

@@ -1,31 +1,47 @@
 import { admitWalletCustodyRegistrationCommit } from "./walletCustodyRegistrationAdmission.js";
 import { verifiedCustodyFactorFromAuthority } from "./verifiedCustodyFactor.js";
 //#region src/router/domains/passkeyCustody/registrationCustodyOutcome.ts
-async function commitRegistrationCustody(input) {
-	if (!input.payload) return { status: "not_requested" };
-	const factor = verifiedCustodyFactorFromAuthority({
-		authority: input.verifiedAuthority,
-		...input.verifiedEmailOtpEnrollment ? { emailOtpEnrollment: input.verifiedEmailOtpEnrollment } : {}
-	});
-	if (!factor.ok) return {
-		status: "rejected",
-		reason: factor.reason
-	};
+/** Admits the custody payload and claims its routes. It never throws either. */
+async function reserveRegistrationCustody(input) {
+	const payload = input.payload;
+	if (!payload) return settled({ status: "not_requested" });
 	try {
-		return toOutcome(await admitWalletCustodyRegistrationCommit({
-			payload: input.payload,
+		const factor = verifiedCustodyFactorFromAuthority({
+			authority: input.verifiedAuthority,
+			...input.verifiedEmailOtpEnrollment ? { emailOtpEnrollment: input.verifiedEmailOtpEnrollment } : {}
+		});
+		if (!factor.ok) return settled({
+			status: "rejected",
+			reason: factor.reason
+		});
+		const admitted = await admitWalletCustodyRegistrationCommit({
+			payload,
 			verifiedWalletId: input.verifiedWalletId,
 			verifiedFactor: factor.factor,
 			nowMs: input.nowMs,
 			store: input.store
-		}));
-	} catch (error) {
-		return {
-			status: "rejected",
-			reason: error instanceof Error ? error.message : "wallet custody commit failed"
+		});
+		if (admitted.kind !== "reserved") return settled(toOutcome(admitted));
+		return async () => {
+			try {
+				return toOutcome(await admitted.commit());
+			} catch (error) {
+				return storeFailure(error);
+			}
 		};
+	} catch (error) {
+		return settled(storeFailure(error));
 	}
 }
+function settled(outcome) {
+	return () => Promise.resolve(outcome);
+}
+function storeFailure(error) {
+	return {
+		status: "rejected",
+		reason: error instanceof Error ? error.message : "wallet custody commit failed"
+	};
+}
 function toOutcome(admitted) {
 	switch (admitted.kind) {
 		case "committed": return { status: "committed" };
@@ -42,6 +58,6 @@ function toOutcome(admitted) {
 	}
 }
 //#endregion
-export { commitRegistrationCustody };
+export { reserveRegistrationCustody };
 
 //# sourceMappingURL=registrationCustodyOutcome.js.map

package/dist/esm/router/domains/passkeyCustody/walletCustodyRegistrationAdmission.js

@@ -1,4 +1,4 @@
-import { commitWalletCustodyRegistration } from "./walletCustodyRegistrationCommit.js";
+import { reserveWalletCustodyRegistration } from "./walletCustodyRegistrationCommit.js";
 //#region src/router/domains/passkeyCustody/walletCustodyRegistrationAdmission.ts
 async function admitWalletCustodyRegistrationCommit(input) {
 	const payloadWalletId = String(input.payload.walletId ?? "").trim();
@@ -19,7 +19,7 @@ async function admitWalletCustodyRegistrationCommit(input) {
 		kind: "no_custody_records",
 		keyManifestDigestB64u: digest
 	};
-	return await commitWalletCustodyRegistration({
+	return await reserveWalletCustodyRegistration({
 		payload: input.payload,
 		factor: input.verifiedFactor,
 		nowMs: input.nowMs,