@seams/wallet-server 0.10.0 → 0.10.2

package/artifact-manifest.json

@@ -2,17 +2,17 @@
   "schemaVersion": "seams_wallet_server_artifact_manifest_v1",
   "package": {
     "name": "@seams/wallet-server",
-    "version": "0.10.0"
+    "version": "0.10.2"
   },
   "workers": {
     "router": {
       "entry": "cloudflare-router-ab/build/router/worker/shim.mjs",
-      "fingerprint": "30a977906ffe17f0c8154fc58cad84e5df227730bdf50dfd1bea27271c27d635",
+      "fingerprint": "989063cee259faabe08200e0bf5f76d35a71c34daf29ea1a6a6ca192ef939cd2",
       "files": [
         {
           "path": "cloudflare-router-ab/build/router/build-stamp.json",
           "bytes": 119,
-          "sha256": "36fb737144714076d0a980aedb84ef4d47f5ca98246e90fddf43c29140aced2b"
+          "sha256": "d15f86ee176768903392a2c8376d89a608822049829358d14c776a1cf4683c25"
         },
         {
           "path": "cloudflare-router-ab/build/router/index.js",
@@ -38,12 +38,12 @@
     },
     "deriver-a": {
       "entry": "cloudflare-router-ab/build/deriver-a/worker/shim.mjs",
-      "fingerprint": "60717e64cecd5d8532c510ef1f5e60c382daa41aee184b91ec0cfb65da94d1fe",
+      "fingerprint": "76bf099ffbf26c88a2751c8699976c7b3164aef3fa08051c18d1b100a6bf65f5",
       "files": [
         {
           "path": "cloudflare-router-ab/build/deriver-a/build-stamp.json",
           "bytes": 122,
-          "sha256": "ae63051a87200abb4b866eb33d9932a79d362e3112397e5a0b4fcbaf464ecfb5"
+          "sha256": "c10b587d92e396f13efeff774ec1f80089a9d6d199d269a8feca5aee6463afff"
         },
         {
           "path": "cloudflare-router-ab/build/deriver-a/index.js",
@@ -69,12 +69,12 @@
     },
     "deriver-b": {
       "entry": "cloudflare-router-ab/build/deriver-b/worker/shim.mjs",
-      "fingerprint": "b41ef1b3a57563b3ec0a0507dac488beee635693fdca299badd8a7ddaf050448",
+      "fingerprint": "b3d8248972d3b050cc01413a04295cc4547f68574a9379bfa84896e5dd9ccff6",
       "files": [
         {
           "path": "cloudflare-router-ab/build/deriver-b/build-stamp.json",
           "bytes": 122,
-          "sha256": "305fde47592fd7a9321129053c55722fdecd8025c96962052cc430b2862d7d6e"
+          "sha256": "50b14a68d07e464ebef4fb2b6fac8859923c12a2e2bbb8f354b4266c2920665f"
         },
         {
           "path": "cloudflare-router-ab/build/deriver-b/index.js",
@@ -100,12 +100,12 @@
     },
     "signing-worker": {
       "entry": "cloudflare-router-ab/build/signing-worker/worker/shim.mjs",
-      "fingerprint": "7bca2a3c2aa5208b57ba168af1c0066d5e09bf3d0b206a4b72da33b3e9f6a6a7",
+      "fingerprint": "b5630eef3471bdd71dd875f3789a5b5c33e97e12f1092e4c1ed6bf0042bf14bd",
       "files": [
         {
           "path": "cloudflare-router-ab/build/signing-worker/build-stamp.json",
           "bytes": 127,
-          "sha256": "ac4932d897470893a453e385e3aef19759a4b18e069407fb5293a900c9101c36"
+          "sha256": "edbefd37808ffbf912edb8207c8f3f8ec7da1a2bc3497fcf975df96e09de21b7"
         },
         {
           "path": "cloudflare-router-ab/build/signing-worker/index.js",
@@ -131,12 +131,12 @@
     },
     "tenant-root-control-plane": {
       "entry": "cloudflare-router-ab/build/tenant-root-control-plane/worker/shim.mjs",
-      "fingerprint": "7cfb93d1efe8ab85f51418f1cddad2604a52f607c0301e85ccf4a28f8a8de04f",
+      "fingerprint": "0a2430ee51235d20fe054f155fa263353f5b23d6bd2e085054dffe709484e6dc",
       "files": [
         {
           "path": "cloudflare-router-ab/build/tenant-root-control-plane/build-stamp.json",
           "bytes": 139,
-          "sha256": "0909a15f5d630a44d584483a7ddc062f46fb002c4ac87ad609625178a0748c2b"
+          "sha256": "3aaf79915d746c2dbfe9f4e17df8c9bafac7cfb18be3c6de2e481b78bf2eb988"
         },
         {
           "path": "cloudflare-router-ab/build/tenant-root-control-plane/index.js",

package/cloudflare-router-ab/build/deriver-a/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":true,"features":"strict-worker-deriver-a-entrypoint","started_at_ms":1791900498698}
+{"profile":"release","wallet_objects":true,"features":"strict-worker-deriver-a-entrypoint","started_at_ms":1791976433414}

package/cloudflare-router-ab/build/deriver-b/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":true,"features":"strict-worker-deriver-b-entrypoint","started_at_ms":1791900730423}
+{"profile":"release","wallet_objects":true,"features":"strict-worker-deriver-b-entrypoint","started_at_ms":1791976670146}

package/cloudflare-router-ab/build/router/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":true,"features":"strict-worker-router-entrypoint","started_at_ms":1791900949130}
+{"profile":"release","wallet_objects":true,"features":"strict-worker-router-entrypoint","started_at_ms":1791976887847}

package/cloudflare-router-ab/build/signing-worker/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":true,"features":"strict-worker-signing-worker-entrypoint","started_at_ms":1791900184666}
+{"profile":"release","wallet_objects":true,"features":"strict-worker-signing-worker-entrypoint","started_at_ms":1791976112394}

package/cloudflare-router-ab/build/tenant-root-control-plane/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":false,"features":"strict-worker-tenant-root-control-plane-entrypoint","started_at_ms":1791901158819}
+{"profile":"release","wallet_objects":false,"features":"strict-worker-tenant-root-control-plane-entrypoint","started_at_ms":1791977099544}

package/dist/esm/cloud-host.js

@@ -89,7 +89,7 @@ import { CloudflareDurableObjectVersionedJsonRecordStore, CloudflareVersionedJso
 import { CloudflareD1VersionedJsonRecordStore, CloudflareD1VersionedJsonRecordStoreError, createCloudflareD1VersionedJsonRecordStore } from "./router/cloudflare/d1/versionedJson/d1VersionedJsonRecordStore.js";
 import { createRouterAbEd25519YaoCeremonyStateStoreV1, encodeRouterAbEd25519YaoProductRegistrationStateV1, parseRouterAbEd25519YaoCeremonyKeyV1, parseRouterAbEd25519YaoProductRegistrationStateJsonV1, resolveRouterAbEd25519YaoCeremonyKeyFromRequestV1 } from "./router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPersistence.js";
 import { mergeRouterAbEd25519YaoProductRegistrationStatePartitionV1, partitionRouterAbEd25519YaoProductRegistrationStateV1 } from "./router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitioning.js";
-import { ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordJsonV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1, routerAbEd25519YaoAdmittedRegistrationAuthorityV1, routerAbEd25519YaoPartitionedStateAfterStoredCommitV1, sameRouterAbEd25519YaoSharedStateCanonicalEncodingV1 } from "./router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore.js";
+import { ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordJsonV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoRegistrationAdmissionReadV1, routerAbEd25519YaoAdmittedRegistrationAuthorityV1, routerAbEd25519YaoPartitionedStateAfterStoredCommitV1, sameRouterAbEd25519YaoSharedStateCanonicalEncodingV1 } from "./router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore.js";
 import { createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1 } from "./router/cloudflare/d1/ed25519Yao/d1Ed25519YaoProductRegistrationPartitionedStateStore.js";
 import { runRouterAbEd25519YaoProductRegistrationRequestScopedV1 } from "./router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationRequestScopedRunner.js";
 import { runRouterAbEd25519YaoRegistrationTwoPhaseV1 } from "./router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationTwoPhaseRunner.js";
@@ -131,4 +131,4 @@ import { handleRouterAbEd25519YaoRecoveryRequestScopedCloudflareV1 } from "./rou
 import { RouterAbEd25519YaoRecoveryWalletSessionAuthorizationAdapter } from "./router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryWalletSessionAuthorization.js";
 import { keccak256Bytes } from "./shared-ts/src/utils/keccak.js";
 import { decodeEvmBlockHeader, decodeEvmTransactionByHash, decodeEvmTransactionCall, decodeEvmTransactionReceipt, parseRpcHexQuantity } from "./shared-ts/src/utils/evmRpcResults.js";
-export { API_CREDENTIAL_ROUTE_SCOPES, API_CREDENTIAL_TYPES, ActionType, CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, CloudflareD1AuthorizationStore, CloudflareD1GoogleEmailOtpRegistrationAttemptStore, CloudflareD1OidcJwksCache, CloudflareD1RouterAbEd25519YaoCapabilityPersistence, CloudflareD1RouterAbNormalSigningAdmissionStore, CloudflareD1VaultProxyStore, CloudflareD1VersionedJsonRecordStore, CloudflareD1VersionedJsonRecordStoreError, CloudflareD1WebAuthnAuthService, CloudflareD1WebAuthnStore, CloudflareDurableObjectVersionedJsonRecordStore, CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1, CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1, CloudflareVersionedJsonRecordStoreError, CrossSiteSessionCookieAdapter, D1IdentityStore, D1LinkedDeviceAuthorityInstallServiceV1, D1LinkedDeviceEd25519ExportRootStoreV1, D1LinkedDeviceRequestProofNonceStoreV1, D1LinkedDeviceSessionStoreV1, D1LinkedDeviceSourceContributionPreparationPlannerV1, D1LinkedDeviceTargetAuthenticatorStoreV1, D1LinkedDeviceTargetCredentialProviderV1, D1LinkedDeviceTargetPlannerV1, D1WalletAuthMethodStore, D1WalletObjectAddresses, D1WalletStore, D1_BATCH_CAS_GUARD_SQL, DEFAULT_SESSION_COOKIE_NAME, DEFAULT_WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_V1, DEFAULT_WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_V1, DEFAULT_WALLET_SESSION_REMAINING_USES, DEFAULT_WALLET_SESSION_TTL_MS, ED25519_SIGNER_ACTIVATION_ID_PATH, InMemoryRouterAbEd25519YaoExportService, InMemoryRouterAbEd25519YaoExportStateV1, InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter, InMemoryRouterAbEd25519YaoRegistrationService, InMemoryRouterAbNormalSigningAdmissionStore, LINKED_DEVICE_OWNER_AUTHORIZATION_PATH_V1, LinkedDeviceRetiredTargetRegistrationShapeErrorV1, LinkedDeviceSourceFamilyUnavailableErrorV1, LinkedDeviceWebAuthnRegistrationVerifierV1, MAX_WALLET_SESSION_REMAINING_USES, MAX_WALLET_SESSION_TTL_MS, PUBLIC_PROOF_TYPES, ROUTER_AB_ECDSA_DERIVATION_PRIVATE_SIGNING_PATHS, ROUTER_AB_ED25519_PRIVATE_SIGNING_PATHS, ROUTER_AB_ED25519_YAO_CAPABILITY_REPLACEMENT_TABLE_V1, ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_STATUS_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1, ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, ROUTER_AB_MPC_ROUTER_ORIGIN, ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, ROUTER_AB_SIGNING_WORKER_ORIGIN, ROUTER_AB_TRACE_ID_HEADER_V1, ROUTER_API_CREDENTIAL_SCOPES, ROUTE_SERVICE_KEYS, RouterAbEcdsaPresignRuntime, RouterAbEd25519YaoExportOwnerProofAuthorizationAdapter, RouterAbEd25519YaoHttpRegistrationBackend, RouterAbEd25519YaoRecoveryWalletSessionAuthorizationAdapter, SESSION_CAS_GUARD_SQL, SessionService, StaticCloudflareTenantStorageRouteResolver, UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, WALLET_AUTH_METHOD_D1_STORE, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL, WALLET_CONSOLE_API_WALLET_DETAIL_PREFIX_V1, WALLET_CONSOLE_OPS_BASE_PATH_V1, WALLET_CONSOLE_OP_PATHS_V1, WALLET_CONSOLE_SERVICE_ORIGIN_V1, WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_ID_V1, WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_ID_V1, WALLET_CONTROL_AUTH_MARKER_V1, WALLET_CONTROL_BASE_PATH_V1, WALLET_CONTROL_SERVICE_ORIGIN_V1, WALLET_RUNTIME_OPS_BASE_PATH_V1, WALLET_RUNTIME_OP_PATHS_V1, WALLET_RUNTIME_SERVICE_ORIGIN_V1, WALLET_STORE_D1_SCHEMA_SQL, WalletHomeCustodyBinding, WalletLifecycleLocator, WalletObjectAddressSnapshot, WalletPlacementRoutes, abusePrincipalKey, addSecp256k1PublicKeys33, admitD1EstablishedWalletHome, admitRouterAbEcdsaReusableWalletSessionOperation, applyRouteMetering, assertUniqueRouterApiRouteDefinitions, authenticateDeviceLinkingOwnerWalletSessionRequestV1, authenticateRouterAbEcdsaOperationStepUp, authenticateRouterAbWalletOperationStepUp, authenticateRouterAbWalletOperationStepUpIdentity, authorizeRouterAbEcdsaDerivationNormalSigningRoute, authorizeRouterAbEd25519NormalSigningRoute, base64UrlDecode, base64UrlEncode, bindWalletAuthMethodIdentity, bindWalletAuthMethodIdentityV2, buildCorsOrigins, buildRouterAbEcdsaDerivationPrivateSigningWorkerBody, buildRouterAbEcdsaOwnerOperationStepUpPreparation, buildRouterAbEd25519OwnerOperationStepUpPreparation, buildRouterAbEd25519PrivateSigningWorkerBody, buildRouterAbEd25519YaoAddSignerAdmissionRequestV1, buildRouterAbEd25519YaoProductAdmissionRequestV1, buildTenantRootIdentityFromAuthenticatedDeploymentV1, buildVerifiedLinkInputV1, buildVerifiedTargetFactorV1, buildWalletEcdsaSignerRecord, claimRouterAbEcdsaOperationStepUp, coerceLogger, coerceRouterLogger, completeRouterAbEcdsaOperation, computeEip1559TxHash, computeLinkedDeviceSessionClaimDigestV1, computeRouterAbEd25519NormalSigningAdmissionMaterial, computeVerifiedTargetFactorVerificationDigestV1, createCloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1RouterApiAuthService, createCloudflareD1VersionedJsonRecordStore, createCloudflareDurableObjectVersionedJsonRecordStore, createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1, createCloudflareRouter, createCloudflareTenantStorageRoute, createCloudflareWalletGatewayRouterV1, createD1LinkedDeviceOwnerAuthorizationMetadataSourceV1, createD1LinkedDeviceOwnerAuthorizationProviderV1, createD1LinkedDeviceOwnerSourceChildReaderV1, createD1LinkedDeviceRouteServiceV1, createD1LinkedDeviceSessionServiceV1, createD1LinkedDeviceSourceContributionPreparationPlannerV1, createD1LinkedDeviceVerifiedLinkSourceReaderV1, createDeviceLinkingOwnerRequestAuthenticatorV1, createEd25519SessionAdapter, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterApiRuntimeSnapshotConsumer, createRouterAbEcdsaEd25519CeremonyTokenIssuer, createRouterAbEcdsaStrictPostRegistrationPort, createRouterAbEcdsaStrictRegistrationPort, createRouterAbEd25519YaoCeremonyStateStoreV1, createRouterAbEd25519YaoExportModule, createRouterAbEd25519YaoHttpRegistrationBackendFromEnv, createRouterAbEd25519YaoMaterialActivationRefV1, createRouterAbEd25519YaoProductRegistrationCompositionFromPortsV1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, createRouterAbEd25519YaoProductRegistrationRequestScopedRuntimeV1, createRouterAbEd25519YaoProductRegistrationRuntimeV1, createRouterAbEd25519YaoProductRegistrationStateFromPartsV1, createRouterAbEd25519YaoProductRegistrationStateV1, createRouterAbEd25519YaoRegistrationModule, createRouterAbNormalSigningAdmissionAdapter, createRouterAbServiceBindingFetch, createRouterApiModule, createRouterApiRouteDefinitions, createSelfHostedCloudflareSigningRouter, createSelfHostedCloudflareSigningWorker, createSignerD1DoStorageTarget, createSigningSessionSealOptions, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, createStaticWalletConsoleBindingV1, createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1, createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, createWalletConsoleOpsClient, createWalletConsoleRelayProxyExtensionV1, createWalletControlClientBindings, createWalletRegistrationContextResolver, createWalletRuntimeOpsHandler, d1ChangedRows, d1Integer, d1Number, decideRouterAbEcdsaOwnerOperationAuthorization, decideRouterAbEd25519OwnerOperationAuthorization, decodeEvmBlockHeader, decodeEvmTransactionByHash, decodeEvmTransactionCall, decodeEvmTransactionReceipt, decodeJsonRpcEnvelope, decodeWalletConsoleTenantRootActiveLineageRequestV1, decodeWalletConsoleTenantRootActiveLineageResponseV1, defineRoute, defineRouteExtension, deriveJwtExpiresAtIso, deriveRecoveryCodeLocatorV1FromBytes, digestOpaqueValue, encodeEip1559SignedTxFromSignature65, encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1, encodeRouterAbEd25519YaoProductRegistrationStateV1, encodeSessionJsonSegment, encodeTenantRootIdentityV1, enforceDelegatePolicy, enforceRoutePolicy, ensureEvmCryptoWasm, ensureLeadingSlash, ensureWalletAuthMethodStoreD1Schema, ensureWalletStoreD1Schema, evaluateRouterAbNormalSigningAdmission, executeRouterAbEd25519YaoAdmittedRegistrationV1, executeSignedDelegateWithRelayer, extractBearerCredential, extractRouterApiEnvironmentId, findRouteDefinitionById, findRouteDefinitionForRequest, formatD1ExecStatement, getRouterApiRouteExtensionDefinitions, getRouterApiRouteExtensionRoutes, getRouterApiRouteExtensionsForTransport, handleRouterAbEcdsaDerivationNormalSigningRouteCore, handleRouterAbEd25519YaoExportRequestScopedCloudflareV1, handleRouterAbEd25519YaoRecoveryRequestScopedCloudflareV1, handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1, handleStaticWalletConsoleRequestV1, handleWalletControlRequest, headersToRecord, isD1DatabaseLike, isObject, isPlainObject, json, jsonFailure, keccak256Bytes, linkedDeviceSignerManifestsEqualV1, linkedDeviceX25519RecipientPublicKeyB64uV1, loadCloudflareSignerWasmModule, matchesRouteDefinitionRequest, mergeRouterAbEd25519YaoProductRegistrationStatePartitionV1, mintRouterAbEd25519YaoRegistrationIdentityV1, normalizeBoundedPositiveInteger, normalizeCorsOrigin, normalizeD1RouterApiAuthOptions, normalizeHashToBytes, normalizeLinkedDevicePasskeyTargetConfigurationV1, normalizeLogger, normalizeLowercaseString, normalizeSessionString, normalizeSessionTtlSeconds, normalizeSourceIp, normalizeTrimmedString, normalizeWalletAuthMethod, normalizeWalletAuthMethodV2, parseBooleanFlag, parseBooleanJwtClaim, parseCacheControlMaxAgeSec, parseCsvList, parseD1JsonArrayColumn, parseD1JsonColumn, parseD1JsonObjectColumn, parseD1LinkedDeviceSessionRowV1, parseD1LinkedDeviceSessionTranscriptRowV1, parseGoogleEmailOtpRegistrationAttemptRecord, parseGoogleEmailOtpRegistrationOfferCandidates, parseGoogleJwks, parseGoogleLoginVerifyRequest, parseInstalledEcdsaCustodySnapshotV1, parseJwtAud, parseLinkedDeviceSessionRecordV1, parseOrgId, parseRecoveryCodeLocatorV1, parseRouterAbEcdsaEd25519PrivateJwk, parseRouterAbEcdsaPresignRuntimeConfig, parseRouterAbEcdsaStrictRegistrationTopology, parseRouterAbEd25519NormalSigningScopeV2, parseRouterAbEd25519OperationStepUpScope, parseRouterAbEd25519YaoActivationKeysetFromEnvV1, parseRouterAbEd25519YaoCeremonyKeyV1, parseRouterAbEd25519YaoExportAdmissionEnvelopeV1, parseRouterAbEd25519YaoExportExecuteEnvelopeV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordJsonV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoProductRegistrationStateJsonV1, parseRouterAbEd25519YaoProductRegistrationStateV1, parseRouterAbEd25519YaoRegistrationRouterAnswerV1, parseRouterAbEd25519YaoTenantRootWireV1, parseRouterAbOperationStepUpOperation, parseRouterAbPublicKeysetV2, parseRpcHexQuantity, parseRs256JwtForVerification, parseSessionJwt, parseSigningSessionSealRootConfig, parseStaticWalletConsoleBindingConfigV1, parseStoredRouterAbEcdsaPendingActivationV1, parseWalletEd25519SignerRecord, parseWalletId, parseWalletRecoveryOperationId, parseWalletRegistrationContextResponse, parseWalletRegistrationSetupRequest, parseWalletRegistrationSetupReservation, parseWalletRuntimeExecuteSignedDelegateRequest, parseWalletRuntimeExecuteSignedDelegateResponse, parseWalletRuntimeExecuteSignedDelegateResult, parseWalletRuntimeRelayerAccount, parseWalletRuntimeWalletIdentitiesResult, parseWalletRuntimeWalletIdentityRequest, parseWebAuthnRpId, parseWebAuthnSyncChallengeRecord, partitionRouterAbEd25519YaoProductRegistrationStateV1, postRouterAbSigningWorkerJson, prepareD1TenantStatement, prepareD1WalletAuthMethodInsertStatement, prepareD1WalletAuthMethodPutStatement, prepareD1WalletAuthMethodV2PutStatement, prepareD1WalletPutSignerStatement, prepareD1WalletPutSubjectStatement, prepareD1WebAuthnAuthenticatorInsertStatement, prepareD1WebAuthnAuthenticatorPutStatement, projectRouterAbEd25519YaoExactWalletSession, proposeWalletRegistrationSetup, publishableKeyRoutePrincipal, queryD1All, queryD1One, randomTenantRootCreationGrantBytesV1, readD1LinkedDeviceEcdsaSourceV1, readD1LinkedDeviceEd25519SourceV1, readEnvironmentCsv, readEnvironmentString, readJson, registrationPreparationIdFromString, requireD1RouterApiAuthScopeString, requireEnvironmentString, requireNormalizedSessionString, requireRuntimePolicyScope, resolveFreshRouterAbEcdsaMaterialActivation, resolvePublishableKeyApiCredentialAuth, resolveRequestOriginRateLimitKeyFromExpressRequest, resolveRequestOriginRateLimitKeyFromFetchHeaders, resolveRouterAbEd25519YaoCeremonyKeyFromRequestV1, resolveRuntimeTenantRootLineage, resolveSecretKeyApiCredentialAuth, resolveSourceIpFromExpressRequest, resolveSourceIpFromFetchHeaders, resolveWalletRegistrationContext, routeError, routeJson, routerAbEcdsaAtomicAuthorizationConfigured, routerAbEcdsaOperationInProgressResult, routerAbEcdsaOwnerOperationFailureResult, routerAbEcdsaRecordedResponse, routerAbEcdsaReplayHttpResponse, routerAbEcdsaReplayResult, routerAbEcdsaReplayUnavailableResult, routerAbEcdsaStrictRegistrationFactsBindingJson, routerAbEcdsaStrictRegistrationRequestBindingJson, routerAbEcdsaStrictRegistrationRequestMatchesFacts, routerAbEd25519OwnerOperationFailureResult, routerAbEd25519YaoAdmittedRegistrationAuthorityV1, routerAbEd25519YaoPartitionedStateAfterStoredCommitV1, routerAbEd25519YaoPersistedCapabilityMatchesLookupV1, routerAbEd25519YaoRegistrationExecutionTimingEntriesV1, routerAbEd25519YaoRegistrationSigningRootIdV1, routerAbEd25519YaoTenantRootWireV1, runRouterAbEd25519YaoProductRegistrationRequestScopedV1, runRouterAbEd25519YaoRegistrationSideEffectV1, runRouterAbEd25519YaoRegistrationTwoPhaseV1, runRouterAbPrewarmScheduledV1, runtimePolicyScopeKey, sameRouterAbEd25519YaoSharedStateCanonicalEncodingV1, secp256k1PrivateKey32ToPublicKey33, secp256k1PublicKey33ToEthereumAddress, secureRandomBase36, secureRandomBase64Url, selectWalletEd25519Signer, sendExpressRouteResponse, sessionJwtTimeClaims, sha256Bytes, sha256BytesSync, signSecp256k1Recoverable, signTenantRootCreationGrantV1, tenantRootIdentityDigestB64uV1, tenantStorageRouteBackendFamily, tenantStorageRouteDiagnostic, toFetchRouteResponse, normalizeOptionalTrimmedString as toOptionalTrimmedString, toResponse, toSessionArrayBufferCopy, unavailableRegistrationContext, validateDelegateExpiryAndNonce, validateGoogleIdTokenClaims, validateRuntimeSnapshotExpectation, validateSecp256k1PublicKey33, verifyGoogleOidcToken, verifyRs256JwtSignature, verifySecp256k1Bip340SignatureAgainstPublicKey33, verifySecp256k1RecoverableSignatureAgainstPublicKey33, walletAuthMethodId, walletAuthMethodV2Id, walletConsoleApiWalletGetRouteDefinitionV1, walletConsoleApiWalletListRouteDefinitionV1, walletConsoleApiWalletSearchRouteDefinitionV1, walletConsoleRelayRouteDefinitionsV1, walletConsoleSignedDelegateRouteDefinitionV1, walletConsoleSponsoredEvmCallRouteDefinitionV1, walletObjectIdentity, walletRegistrationContext, walletRegistrationSetupRequestDigest, webAuthnCredentialIdB64uFromCredential, withCors };
+export { API_CREDENTIAL_ROUTE_SCOPES, API_CREDENTIAL_TYPES, ActionType, CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, CloudflareD1AuthorizationStore, CloudflareD1GoogleEmailOtpRegistrationAttemptStore, CloudflareD1OidcJwksCache, CloudflareD1RouterAbEd25519YaoCapabilityPersistence, CloudflareD1RouterAbNormalSigningAdmissionStore, CloudflareD1VaultProxyStore, CloudflareD1VersionedJsonRecordStore, CloudflareD1VersionedJsonRecordStoreError, CloudflareD1WebAuthnAuthService, CloudflareD1WebAuthnStore, CloudflareDurableObjectVersionedJsonRecordStore, CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1, CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1, CloudflareVersionedJsonRecordStoreError, CrossSiteSessionCookieAdapter, D1IdentityStore, D1LinkedDeviceAuthorityInstallServiceV1, D1LinkedDeviceEd25519ExportRootStoreV1, D1LinkedDeviceRequestProofNonceStoreV1, D1LinkedDeviceSessionStoreV1, D1LinkedDeviceSourceContributionPreparationPlannerV1, D1LinkedDeviceTargetAuthenticatorStoreV1, D1LinkedDeviceTargetCredentialProviderV1, D1LinkedDeviceTargetPlannerV1, D1WalletAuthMethodStore, D1WalletObjectAddresses, D1WalletStore, D1_BATCH_CAS_GUARD_SQL, DEFAULT_SESSION_COOKIE_NAME, DEFAULT_WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_V1, DEFAULT_WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_V1, DEFAULT_WALLET_SESSION_REMAINING_USES, DEFAULT_WALLET_SESSION_TTL_MS, ED25519_SIGNER_ACTIVATION_ID_PATH, InMemoryRouterAbEd25519YaoExportService, InMemoryRouterAbEd25519YaoExportStateV1, InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter, InMemoryRouterAbEd25519YaoRegistrationService, InMemoryRouterAbNormalSigningAdmissionStore, LINKED_DEVICE_OWNER_AUTHORIZATION_PATH_V1, LinkedDeviceRetiredTargetRegistrationShapeErrorV1, LinkedDeviceSourceFamilyUnavailableErrorV1, LinkedDeviceWebAuthnRegistrationVerifierV1, MAX_WALLET_SESSION_REMAINING_USES, MAX_WALLET_SESSION_TTL_MS, PUBLIC_PROOF_TYPES, ROUTER_AB_ECDSA_DERIVATION_PRIVATE_SIGNING_PATHS, ROUTER_AB_ED25519_PRIVATE_SIGNING_PATHS, ROUTER_AB_ED25519_YAO_CAPABILITY_REPLACEMENT_TABLE_V1, ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_STATUS_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1, ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, ROUTER_AB_MPC_ROUTER_ORIGIN, ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, ROUTER_AB_SIGNING_WORKER_ORIGIN, ROUTER_AB_TRACE_ID_HEADER_V1, ROUTER_API_CREDENTIAL_SCOPES, ROUTE_SERVICE_KEYS, RouterAbEcdsaPresignRuntime, RouterAbEd25519YaoExportOwnerProofAuthorizationAdapter, RouterAbEd25519YaoHttpRegistrationBackend, RouterAbEd25519YaoRecoveryWalletSessionAuthorizationAdapter, SESSION_CAS_GUARD_SQL, SessionService, StaticCloudflareTenantStorageRouteResolver, UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, WALLET_AUTH_METHOD_D1_STORE, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL, WALLET_CONSOLE_API_WALLET_DETAIL_PREFIX_V1, WALLET_CONSOLE_OPS_BASE_PATH_V1, WALLET_CONSOLE_OP_PATHS_V1, WALLET_CONSOLE_SERVICE_ORIGIN_V1, WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_ID_V1, WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_ID_V1, WALLET_CONTROL_AUTH_MARKER_V1, WALLET_CONTROL_BASE_PATH_V1, WALLET_CONTROL_SERVICE_ORIGIN_V1, WALLET_RUNTIME_OPS_BASE_PATH_V1, WALLET_RUNTIME_OP_PATHS_V1, WALLET_RUNTIME_SERVICE_ORIGIN_V1, WALLET_STORE_D1_SCHEMA_SQL, WalletHomeCustodyBinding, WalletLifecycleLocator, WalletObjectAddressSnapshot, WalletPlacementRoutes, abusePrincipalKey, addSecp256k1PublicKeys33, admitD1EstablishedWalletHome, admitRouterAbEcdsaReusableWalletSessionOperation, applyRouteMetering, assertUniqueRouterApiRouteDefinitions, authenticateDeviceLinkingOwnerWalletSessionRequestV1, authenticateRouterAbEcdsaOperationStepUp, authenticateRouterAbWalletOperationStepUp, authenticateRouterAbWalletOperationStepUpIdentity, authorizeRouterAbEcdsaDerivationNormalSigningRoute, authorizeRouterAbEd25519NormalSigningRoute, base64UrlDecode, base64UrlEncode, bindWalletAuthMethodIdentity, bindWalletAuthMethodIdentityV2, buildCorsOrigins, buildRouterAbEcdsaDerivationPrivateSigningWorkerBody, buildRouterAbEcdsaOwnerOperationStepUpPreparation, buildRouterAbEd25519OwnerOperationStepUpPreparation, buildRouterAbEd25519PrivateSigningWorkerBody, buildRouterAbEd25519YaoAddSignerAdmissionRequestV1, buildRouterAbEd25519YaoProductAdmissionRequestV1, buildTenantRootIdentityFromAuthenticatedDeploymentV1, buildVerifiedLinkInputV1, buildVerifiedTargetFactorV1, buildWalletEcdsaSignerRecord, claimRouterAbEcdsaOperationStepUp, coerceLogger, coerceRouterLogger, completeRouterAbEcdsaOperation, computeEip1559TxHash, computeLinkedDeviceSessionClaimDigestV1, computeRouterAbEd25519NormalSigningAdmissionMaterial, computeVerifiedTargetFactorVerificationDigestV1, createCloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1RouterApiAuthService, createCloudflareD1VersionedJsonRecordStore, createCloudflareDurableObjectVersionedJsonRecordStore, createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1, createCloudflareRouter, createCloudflareTenantStorageRoute, createCloudflareWalletGatewayRouterV1, createD1LinkedDeviceOwnerAuthorizationMetadataSourceV1, createD1LinkedDeviceOwnerAuthorizationProviderV1, createD1LinkedDeviceOwnerSourceChildReaderV1, createD1LinkedDeviceRouteServiceV1, createD1LinkedDeviceSessionServiceV1, createD1LinkedDeviceSourceContributionPreparationPlannerV1, createD1LinkedDeviceVerifiedLinkSourceReaderV1, createDeviceLinkingOwnerRequestAuthenticatorV1, createEd25519SessionAdapter, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterApiRuntimeSnapshotConsumer, createRouterAbEcdsaEd25519CeremonyTokenIssuer, createRouterAbEcdsaStrictPostRegistrationPort, createRouterAbEcdsaStrictRegistrationPort, createRouterAbEd25519YaoCeremonyStateStoreV1, createRouterAbEd25519YaoExportModule, createRouterAbEd25519YaoHttpRegistrationBackendFromEnv, createRouterAbEd25519YaoMaterialActivationRefV1, createRouterAbEd25519YaoProductRegistrationCompositionFromPortsV1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, createRouterAbEd25519YaoProductRegistrationRequestScopedRuntimeV1, createRouterAbEd25519YaoProductRegistrationRuntimeV1, createRouterAbEd25519YaoProductRegistrationStateFromPartsV1, createRouterAbEd25519YaoProductRegistrationStateV1, createRouterAbEd25519YaoRegistrationModule, createRouterAbNormalSigningAdmissionAdapter, createRouterAbServiceBindingFetch, createRouterApiModule, createRouterApiRouteDefinitions, createSelfHostedCloudflareSigningRouter, createSelfHostedCloudflareSigningWorker, createSignerD1DoStorageTarget, createSigningSessionSealOptions, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, createStaticWalletConsoleBindingV1, createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1, createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, createWalletConsoleOpsClient, createWalletConsoleRelayProxyExtensionV1, createWalletControlClientBindings, createWalletRegistrationContextResolver, createWalletRuntimeOpsHandler, d1ChangedRows, d1Integer, d1Number, decideRouterAbEcdsaOwnerOperationAuthorization, decideRouterAbEd25519OwnerOperationAuthorization, decodeEvmBlockHeader, decodeEvmTransactionByHash, decodeEvmTransactionCall, decodeEvmTransactionReceipt, decodeJsonRpcEnvelope, decodeWalletConsoleTenantRootActiveLineageRequestV1, decodeWalletConsoleTenantRootActiveLineageResponseV1, defineRoute, defineRouteExtension, deriveJwtExpiresAtIso, deriveRecoveryCodeLocatorV1FromBytes, digestOpaqueValue, encodeEip1559SignedTxFromSignature65, encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1, encodeRouterAbEd25519YaoProductRegistrationStateV1, encodeSessionJsonSegment, encodeTenantRootIdentityV1, enforceDelegatePolicy, enforceRoutePolicy, ensureEvmCryptoWasm, ensureLeadingSlash, ensureWalletAuthMethodStoreD1Schema, ensureWalletStoreD1Schema, evaluateRouterAbNormalSigningAdmission, executeRouterAbEd25519YaoAdmittedRegistrationV1, executeSignedDelegateWithRelayer, extractBearerCredential, extractRouterApiEnvironmentId, findRouteDefinitionById, findRouteDefinitionForRequest, formatD1ExecStatement, getRouterApiRouteExtensionDefinitions, getRouterApiRouteExtensionRoutes, getRouterApiRouteExtensionsForTransport, handleRouterAbEcdsaDerivationNormalSigningRouteCore, handleRouterAbEd25519YaoExportRequestScopedCloudflareV1, handleRouterAbEd25519YaoRecoveryRequestScopedCloudflareV1, handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1, handleStaticWalletConsoleRequestV1, handleWalletControlRequest, headersToRecord, isD1DatabaseLike, isObject, isPlainObject, json, jsonFailure, keccak256Bytes, linkedDeviceSignerManifestsEqualV1, linkedDeviceX25519RecipientPublicKeyB64uV1, loadCloudflareSignerWasmModule, matchesRouteDefinitionRequest, mergeRouterAbEd25519YaoProductRegistrationStatePartitionV1, mintRouterAbEd25519YaoRegistrationIdentityV1, normalizeBoundedPositiveInteger, normalizeCorsOrigin, normalizeD1RouterApiAuthOptions, normalizeHashToBytes, normalizeLinkedDevicePasskeyTargetConfigurationV1, normalizeLogger, normalizeLowercaseString, normalizeSessionString, normalizeSessionTtlSeconds, normalizeSourceIp, normalizeTrimmedString, normalizeWalletAuthMethod, normalizeWalletAuthMethodV2, parseBooleanFlag, parseBooleanJwtClaim, parseCacheControlMaxAgeSec, parseCsvList, parseD1JsonArrayColumn, parseD1JsonColumn, parseD1JsonObjectColumn, parseD1LinkedDeviceSessionRowV1, parseD1LinkedDeviceSessionTranscriptRowV1, parseGoogleEmailOtpRegistrationAttemptRecord, parseGoogleEmailOtpRegistrationOfferCandidates, parseGoogleJwks, parseGoogleLoginVerifyRequest, parseInstalledEcdsaCustodySnapshotV1, parseJwtAud, parseLinkedDeviceSessionRecordV1, parseOrgId, parseRecoveryCodeLocatorV1, parseRouterAbEcdsaEd25519PrivateJwk, parseRouterAbEcdsaPresignRuntimeConfig, parseRouterAbEcdsaStrictRegistrationTopology, parseRouterAbEd25519NormalSigningScopeV2, parseRouterAbEd25519OperationStepUpScope, parseRouterAbEd25519YaoActivationKeysetFromEnvV1, parseRouterAbEd25519YaoCeremonyKeyV1, parseRouterAbEd25519YaoExportAdmissionEnvelopeV1, parseRouterAbEd25519YaoExportExecuteEnvelopeV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordJsonV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoProductRegistrationStateJsonV1, parseRouterAbEd25519YaoProductRegistrationStateV1, parseRouterAbEd25519YaoRegistrationAdmissionReadV1, parseRouterAbEd25519YaoRegistrationRouterAnswerV1, parseRouterAbEd25519YaoTenantRootWireV1, parseRouterAbOperationStepUpOperation, parseRouterAbPublicKeysetV2, parseRpcHexQuantity, parseRs256JwtForVerification, parseSessionJwt, parseSigningSessionSealRootConfig, parseStaticWalletConsoleBindingConfigV1, parseStoredRouterAbEcdsaPendingActivationV1, parseWalletEd25519SignerRecord, parseWalletId, parseWalletRecoveryOperationId, parseWalletRegistrationContextResponse, parseWalletRegistrationSetupRequest, parseWalletRegistrationSetupReservation, parseWalletRuntimeExecuteSignedDelegateRequest, parseWalletRuntimeExecuteSignedDelegateResponse, parseWalletRuntimeExecuteSignedDelegateResult, parseWalletRuntimeRelayerAccount, parseWalletRuntimeWalletIdentitiesResult, parseWalletRuntimeWalletIdentityRequest, parseWebAuthnRpId, parseWebAuthnSyncChallengeRecord, partitionRouterAbEd25519YaoProductRegistrationStateV1, postRouterAbSigningWorkerJson, prepareD1TenantStatement, prepareD1WalletAuthMethodInsertStatement, prepareD1WalletAuthMethodPutStatement, prepareD1WalletAuthMethodV2PutStatement, prepareD1WalletPutSignerStatement, prepareD1WalletPutSubjectStatement, prepareD1WebAuthnAuthenticatorInsertStatement, prepareD1WebAuthnAuthenticatorPutStatement, projectRouterAbEd25519YaoExactWalletSession, proposeWalletRegistrationSetup, publishableKeyRoutePrincipal, queryD1All, queryD1One, randomTenantRootCreationGrantBytesV1, readD1LinkedDeviceEcdsaSourceV1, readD1LinkedDeviceEd25519SourceV1, readEnvironmentCsv, readEnvironmentString, readJson, registrationPreparationIdFromString, requireD1RouterApiAuthScopeString, requireEnvironmentString, requireNormalizedSessionString, requireRuntimePolicyScope, resolveFreshRouterAbEcdsaMaterialActivation, resolvePublishableKeyApiCredentialAuth, resolveRequestOriginRateLimitKeyFromExpressRequest, resolveRequestOriginRateLimitKeyFromFetchHeaders, resolveRouterAbEd25519YaoCeremonyKeyFromRequestV1, resolveRuntimeTenantRootLineage, resolveSecretKeyApiCredentialAuth, resolveSourceIpFromExpressRequest, resolveSourceIpFromFetchHeaders, resolveWalletRegistrationContext, routeError, routeJson, routerAbEcdsaAtomicAuthorizationConfigured, routerAbEcdsaOperationInProgressResult, routerAbEcdsaOwnerOperationFailureResult, routerAbEcdsaRecordedResponse, routerAbEcdsaReplayHttpResponse, routerAbEcdsaReplayResult, routerAbEcdsaReplayUnavailableResult, routerAbEcdsaStrictRegistrationFactsBindingJson, routerAbEcdsaStrictRegistrationRequestBindingJson, routerAbEcdsaStrictRegistrationRequestMatchesFacts, routerAbEd25519OwnerOperationFailureResult, routerAbEd25519YaoAdmittedRegistrationAuthorityV1, routerAbEd25519YaoPartitionedStateAfterStoredCommitV1, routerAbEd25519YaoPersistedCapabilityMatchesLookupV1, routerAbEd25519YaoRegistrationExecutionTimingEntriesV1, routerAbEd25519YaoRegistrationSigningRootIdV1, routerAbEd25519YaoTenantRootWireV1, runRouterAbEd25519YaoProductRegistrationRequestScopedV1, runRouterAbEd25519YaoRegistrationSideEffectV1, runRouterAbEd25519YaoRegistrationTwoPhaseV1, runRouterAbPrewarmScheduledV1, runtimePolicyScopeKey, sameRouterAbEd25519YaoSharedStateCanonicalEncodingV1, secp256k1PrivateKey32ToPublicKey33, secp256k1PublicKey33ToEthereumAddress, secureRandomBase36, secureRandomBase64Url, selectWalletEd25519Signer, sendExpressRouteResponse, sessionJwtTimeClaims, sha256Bytes, sha256BytesSync, signSecp256k1Recoverable, signTenantRootCreationGrantV1, tenantRootIdentityDigestB64uV1, tenantStorageRouteBackendFamily, tenantStorageRouteDiagnostic, toFetchRouteResponse, normalizeOptionalTrimmedString as toOptionalTrimmedString, toResponse, toSessionArrayBufferCopy, unavailableRegistrationContext, validateDelegateExpiryAndNonce, validateGoogleIdTokenClaims, validateRuntimeSnapshotExpectation, validateSecp256k1PublicKey33, verifyGoogleOidcToken, verifyRs256JwtSignature, verifySecp256k1Bip340SignatureAgainstPublicKey33, verifySecp256k1RecoverableSignatureAgainstPublicKey33, walletAuthMethodId, walletAuthMethodV2Id, walletConsoleApiWalletGetRouteDefinitionV1, walletConsoleApiWalletListRouteDefinitionV1, walletConsoleApiWalletSearchRouteDefinitionV1, walletConsoleRelayRouteDefinitionsV1, walletConsoleSignedDelegateRouteDefinitionV1, walletConsoleSponsoredEvmCallRouteDefinitionV1, walletObjectIdentity, walletRegistrationContext, walletRegistrationSetupRequestDigest, webAuthnCredentialIdB64uFromCredential, withCors };

package/dist/esm/hosted-wallet-gateway.js

@@ -30,6 +30,7 @@ import { handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1 } from ".
 import { createRouterAbEd25519YaoProductRegistrationRequestScopedRuntimeV1 } from "./router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationRequestScopedRuntime.js";
 import { createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1 } from "./router/cloudflare/signingLanes/cloudflareOrdinaryInactiveSignerMaterialReservation.js";
 import { CloudflareD1RouterAbEd25519YaoCapabilityPersistence } from "./router/cloudflare/d1/ed25519Yao/d1Ed25519YaoCapabilityPersistence.js";
+import { warmSigningSessionSealRuntime } from "./threshold/session/signingSessionSeal/crypto/shamir3PassWasm.js";
 import { createSigningSessionSealOptions } from "./threshold/session/signingSessionSeal/options.js";
 import { createRouterAbEcdsaEd25519CeremonyTokenIssuer, createRouterAbEcdsaStrictPostRegistrationPort, createRouterAbEcdsaStrictRegistrationPort, parseRouterAbEcdsaEd25519PrivateJwk, parseRouterAbEcdsaStrictRegistrationTopology } from "./router/domains/ecdsa/routerAbEcdsaStrictRegistration.js";
 import { D1LinkedDeviceTargetCredentialProviderV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetCredentialProvider.js";
@@ -512,9 +513,25 @@ async function handleSplitGatewayRequest(request, env, ctx, dependencies = {}) {
 	if (operation !== null) {
 		const response = await handlePartitionedD1Operation(env, request, operation, createStagingTenantRootCustodyLineage(createWalletConsoleOpsClient(env.WALLET_CONSOLE)), dependencies);
 		withCors(response.headers, { corsOrigins: readEnvironmentCsv(env.RELAY_CORS_ORIGINS) }, request);
+		warmSigningSessionSealAfterReply(env, ctx);
 		return response;
 	}
-	return await (await createSplitGatewayRouterHandler(env, dependencies, ctx))(request, env, ctx);
+	const response = await (await createSplitGatewayRouterHandler(env, dependencies, ctx))(request, env, ctx);
+	warmSigningSessionSealAfterReply(env, ctx);
+	return response;
+}
+let signingSessionSealWarmUp = null;
+/**
+* Once per isolate, after its first reply. A finalization seldom reaches the
+* isolate that served an earlier request of the same registration, so the
+* warm-up runs after whichever request reaches an isolate first.
+*/
+function warmSigningSessionSealAfterReply(env, ctx) {
+	if (signingSessionSealWarmUp || !stagingSigningSessionSealOptions(env)) return;
+	signingSessionSealWarmUp = warmSigningSessionSealRuntime().catch((error) => {
+		console.warn("[signing-session-seal] warm-up failed", error);
+	});
+	ctx.waitUntil(signingSessionSealWarmUp);
 }
 function requireStagingRouterAbPublicKeyset(env) {
 	const parsed = parseJsonValue(requireEnvironmentString(env, "ROUTER_AB_PUBLIC_KEYSET_JSON"));

package/dist/esm/router/cloudflare/d1/auth/d1RouterApiAuthService.js

@@ -15,6 +15,7 @@ import { sha256BytesPortable, toRecordValue } from "./d1RouterApiAuthBoundary.js
 import { verifyD1LinkedDeviceFreshRevokeProofV1 } from "../wallet/d1WalletAuthMethodBoundary.js";
 import { D1LinkedDeviceAuthorityInstallServiceV1 } from "../deviceLinking/d1LinkedDeviceAuthorityInstallService.js";
 import { D1WalletAuthorityStore } from "../wallet/d1WalletAuthorityStore.js";
+import { createD1Ed25519YaoLifecycleRecords } from "../ed25519Yao/d1Ed25519YaoProductRegistrationPartitionedStateStore.js";
 import { parseRouterAbEd25519YaoRegistrationSideEffectRecordV2 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
 import { createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1 } from "../../signingLanes/cloudflareOrdinaryInactiveSignerMaterialReservation.js";
 import { normalizeD1RouterApiAuthOptions } from "./d1RouterApiAuthConfig.js";
@@ -846,7 +847,15 @@ function createCloudflareD1RouterApiAuthAssembly(input) {
 		tenantRootCustodyLineage: options.tenantRootCustodyLineage,
 		getWalletStore,
 		activateSideEffects: walletRegistrationActivateSideEffectStore(options),
-		registrationRead: new D1WalletRegistrationRead(options.database, options.registrationAuthority ?? null, walletRegistrationNearProvisioningSideEffectStore(options), getRegistrationCeremonyIntentStore, yaoLifecycleDecisions, walletRegistrationCommitStore),
+		registrationRead: new D1WalletRegistrationRead(options.database, options.registrationAuthority ?? null, walletRegistrationNearProvisioningSideEffectStore(options), getRegistrationCeremonyIntentStore, yaoLifecycleDecisions, createD1Ed25519YaoLifecycleRecords({
+			database: options.database,
+			scope: {
+				namespace: options.namespace,
+				orgId: options.orgId,
+				projectId: options.projectId,
+				envId: options.envId
+			}
+		}), walletRegistrationCommitStore),
 		walletRegistrationCommitStore,
 		walletCustodyCommitStore,
 		walletAuthMethods,

package/dist/esm/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoProductRegistrationPartitionedStateStore.js

@@ -4,7 +4,7 @@ import { D1WalletCeremonyActivity, ceremonySettled } from "./d1WalletCeremonyAct
 import { collectChangedStateWallets, lifecycleWriteFenceStatements } from "./d1Ed25519YaoStateWriteFence.js";
 //#region src/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoProductRegistrationPartitionedStateStore.ts
 function createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1(options) {
-	return createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1(new D1LifecycleRecords(options, createLifecycleRecords(options)));
+	return createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1(new D1LifecycleRecords(options, createD1Ed25519YaoLifecycleRecords(options)));
 }
 var D1LifecycleRecords = class {
 	constructor(options, records) {
@@ -64,7 +64,7 @@ function readPartition(value) {
 	return record;
 }
 async function evictWalletEd25519CapabilityCache(options, walletId) {
-	const records = createLifecycleRecords(options);
+	const records = createD1Ed25519YaoLifecycleRecords(options);
 	const key = ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1;
 	const current = await records.read(key);
 	if (current.kind !== "present") return;
@@ -98,7 +98,7 @@ async function evictWalletEd25519CapabilityCache(options, walletId) {
 		expectedVersion: current.version
 	}])).kind !== "stored") throw new Error("Capability cache changed during cleanup");
 }
-function createLifecycleRecords(options) {
+function createD1Ed25519YaoLifecycleRecords(options) {
 	return createCloudflareD1VersionedJsonRecordStore({
 		...options,
 		encode: identityVersionedJsonObject,
@@ -106,6 +106,6 @@ function createLifecycleRecords(options) {
 	});
 }
 //#endregion
-export { createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1, evictWalletEd25519CapabilityCache };
+export { createD1Ed25519YaoLifecycleRecords, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1, evictWalletEd25519CapabilityCache };
 
 //# sourceMappingURL=d1Ed25519YaoProductRegistrationPartitionedStateStore.js.map

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationCommitStore.js

@@ -123,32 +123,41 @@ function canExtendFoundingAuthorityWithEd25519(existing, next) {
 	const nextEcdsa = next.signerActivations.ecdsa;
 	return existing.signerActivations.keyFamilies.length === 1 && existing.signerActivations.keyFamilies[0] === "ecdsa_secp256k1" && next.signerActivations.keyFamilies.length === 2 && next.signerActivations.keyFamilies[0] === "ed25519" && next.signerActivations.keyFamilies[1] === "ecdsa_secp256k1" && existingEcdsa !== void 0 && nextEcdsa !== void 0 && sameWalletEcdsaSignerActivationV1(existingEcdsa, nextEcdsa) && foundingAuthorityIdentityMatches(existing, next) && next.updatedAtMs >= existing.updatedAtMs;
 }
-async function prepareFoundingStatements(input) {
-	if (!input.foundingAuthority) return [];
-	const foundingAuthMethod = requireFoundingAuthMethod(input.foundingAuthMethod);
-	const authorityRead = input.database.prepare(`SELECT record_json
+async function readStoredFoundingRecords(database, scope, ids) {
+	const authorityRead = database.prepare(`SELECT record_json
          FROM wallet_authorities
         WHERE namespace = ?
           AND org_id = ?
           AND project_id = ?
           AND env_id = ?
           AND authority_id = ?
-        LIMIT 1`).bind(input.scope.namespace, input.scope.orgId, input.scope.projectId, input.scope.envId, String(input.foundingAuthority.authorityId));
-	const authMethodRead = input.database.prepare(`SELECT record_json
+        LIMIT 1`).bind(scope.namespace, scope.orgId, scope.projectId, scope.envId, String(ids.walletAuthorityId));
+	const authMethodRead = database.prepare(`SELECT record_json
          FROM wallet_auth_methods
         WHERE namespace = ?
           AND org_id = ?
           AND project_id = ?
           AND env_id = ?
           AND wallet_auth_method_id = ?
-        LIMIT 1`).bind(input.scope.namespace, input.scope.orgId, input.scope.projectId, input.scope.envId, String(foundingAuthMethod.walletAuthMethodId));
-	const results = await input.database.batch([authorityRead, authMethodRead]);
+        LIMIT 1`).bind(scope.namespace, scope.orgId, scope.projectId, scope.envId, String(ids.walletAuthMethodId));
+	const results = await database.batch([authorityRead, authMethodRead]);
 	assertBatchSucceeded({
 		expectedStatementCount: 2,
 		results
 	});
-	const authorityRow = results[0]?.results?.[0] ?? null;
-	const authMethodRow = results[1]?.results?.[0] ?? null;
+	return {
+		walletAuthorityId: ids.walletAuthorityId,
+		walletAuthMethodId: ids.walletAuthMethodId,
+		authorityRow: results[0]?.results?.[0] ?? null,
+		authMethodRow: results[1]?.results?.[0] ?? null
+	};
+}
+function prepareFoundingStatements(input) {
+	if (!input.foundingAuthority) return [];
+	const foundingAuthMethod = requireFoundingAuthMethod(input.foundingAuthMethod);
+	const { stored } = input;
+	if (!stored || String(stored.walletAuthorityId) !== String(input.foundingAuthority.authorityId) || String(stored.walletAuthMethodId) !== String(foundingAuthMethod.walletAuthMethodId)) throw new Error("A founding commit requires the records that its reservation read");
+	const { authorityRow, authMethodRow } = stored;
 	let persistedAuthority = null;
 	if (authorityRow) {
 		const parsedAuthority = parseWalletAuthorityV1(parseD1JsonColumn(authorityRow.record_json));
@@ -210,13 +219,13 @@ var CloudflareD1WalletRegistrationCommitStore = class {
 		this.database = input.database;
 		this.scope = normalizeScope(input);
 	}
-	async reserveAuthority(authority, held = null) {
-		if (authority.kind === "passkey" && !heldClaimCovers(held, authority)) await reservePasskeyCredential(this.credentialClaims, {
+	async reserveAuthority(authority, held, founding) {
+		const [, stored] = await Promise.all([authority.kind === "passkey" && !heldClaimCovers(held, authority) ? reservePasskeyCredential(this.credentialClaims, {
 			walletId: authority.walletId,
 			rpId: authority.rpId,
 			credentialIdB64u: authority.credentialIdB64u
-		});
-		return this.commit.bind(this, authority);
+		}) : void 0, founding ? readStoredFoundingRecords(this.database, this.scope, founding) : null]);
+		return this.commit.bind(this, authority, stored);
 	}
 	async claimPasskeyAhead(input) {
 		const { authority } = input;
@@ -259,7 +268,7 @@ var CloudflareD1WalletRegistrationCommitStore = class {
             AND env_id = ?4
             AND registration_ceremony_id = ?5`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, registrationCeremonyId).run();
 	}
-	async commit(authority, input, executeBatch) {
+	async commit(authority, stored, input, executeBatch) {
 		assertCommitWalletIdentity(input, authority);
 		const fenced = [];
 		const ed25519Signer = input.walletSigners.find(isEd25519Signer);
@@ -283,7 +292,7 @@ var CloudflareD1WalletRegistrationCommitStore = class {
 				scope: this.scope
 			}, new Set([capabilityWallet.value, input.wallet.walletId])));
 		}
-		const prepared = await prepareWalletWrite(this.database, this.scope, authority, input);
+		const prepared = prepareWalletWrite(this.database, this.scope, authority, input, stored);
 		const statements = [...fenced, ...prepared.statements];
 		const results = executeBatch ? await executeBatch(statements) : await this.database.batch(statements);
 		assertBatchSucceeded({
@@ -292,12 +301,13 @@ var CloudflareD1WalletRegistrationCommitStore = class {
 		});
 	}
 };
-async function prepareWalletWrite(database, scope, authority, input) {
-	const foundingStatements = await prepareFoundingStatements({
+function prepareWalletWrite(database, scope, authority, input, stored) {
+	const foundingStatements = prepareFoundingStatements({
 		database,
 		scope,
 		foundingAuthority: input.foundingAuthority,
 		foundingAuthMethod: input.foundingAuthMethod,
+		stored,
 		now: input.now
 	});
 	const statements = [prepareD1WalletPutSubjectStatement({

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationRead.js

@@ -1,12 +1,14 @@
+import { parseRouterAbEd25519YaoRegistrationAdmissionReadV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore.js";
 //#region src/router/cloudflare/d1/registration/d1WalletRegistrationRead.ts
 /** Read admission and immutable finalization state from one D1 snapshot. */
 var D1WalletRegistrationRead = class {
-	constructor(database, authority, operations, getCeremonies, decisions, passkeyClaims) {
+	constructor(database, authority, operations, getCeremonies, decisions, yaoRecords, passkeyClaims) {
 		this.database = database;
 		this.authority = authority;
 		this.operations = operations;
 		this.getCeremonies = getCeremonies;
 		this.decisions = decisions;
+		this.yaoRecords = yaoRecords;
 		this.passkeyClaims = passkeyClaims;
 	}
 	async readRespond(home) {
@@ -39,10 +41,11 @@ var D1WalletRegistrationRead = class {
 			this.operations.prepareRead(operationKey),
 			ceremonies.prepareCeremonyRead(home.ceremonyId),
 			this.decisions.prepareRead(home.ceremonyId),
-			this.passkeyClaims.prepareHeldPasskeyClaimRead(home.ceremonyId)
+			this.passkeyClaims.prepareHeldPasskeyClaimRead(home.ceremonyId),
+			this.yaoRecords.prepareRead(home.ceremonyId)
 		]);
-		const [homeRead, operationRead, ceremonyRead, decisionRead, passkeyClaimRead] = results;
-		if (results.length !== 5 || !homeRead || !operationRead || !ceremonyRead || !decisionRead || !passkeyClaimRead) throw new Error("Registration finalization D1 batch returned incomplete results");
+		const [homeRead, operationRead, ceremonyRead, decisionRead, passkeyClaimRead, yaoRead] = results;
+		if (results.length !== 6 || !homeRead || !operationRead || !ceremonyRead || !decisionRead || !passkeyClaimRead || !yaoRead) throw new Error("Registration finalization D1 batch returned incomplete results");
 		const admission = await this.authority.admitHomeRead(home, homeRead);
 		if (!admission.ok) return admission;
 		if (!ceremonyRead.success) throw new Error("Registration ceremony D1 read failed");
@@ -51,9 +54,13 @@ var D1WalletRegistrationRead = class {
 			operation: this.operations.parseReadResult(operationRead),
 			decision: this.decisions.parseRead(home.ceremonyId, decisionRead),
 			heldPasskeyClaim: this.passkeyClaims.parseHeldPasskeyClaimRead(passkeyClaimRead),
-			readCeremony: ceremonies.parseCeremonyRead.bind(ceremonies, home.ceremonyId, ceremonyRead)
+			readCeremony: ceremonies.parseCeremonyRead.bind(ceremonies, home.ceremonyId, ceremonyRead),
+			readYaoAdmission: this.parseYaoAdmission.bind(this, home.ceremonyId, yaoRead)
 		};
 	}
+	parseYaoAdmission(ceremonyId, result) {
+		return parseRouterAbEd25519YaoRegistrationAdmissionReadV1(ceremonyId, this.yaoRecords.parseReadResult(result));
+	}
 };
 //#endregion
 export { D1WalletRegistrationRead };

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationService.js

@@ -39,6 +39,7 @@ import { buildStoredWalletRegistrationEvmFamilyEcdsaFinalizedBranch, buildStored
 import { routerAbEcdsaStrictRegistrationRequestBindingJson } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
 import { buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, buildD1WalletRecord, parseWalletIdForIntent, thresholdEcdsaChainTargetsEqual } from "./d1RegistrationCeremonyRecords.js";
 import { deriveThresholdEcdsaKeyHandle } from "../../../../shared-ts/src/utils/thresholdEcdsaKeyHandle.js";
+import { isTransientD1Error, retryTransientD1 } from "../../../../storage/d1Retry.js";
 import { admitRegistrationReservationHome, cancelRegistrationHome } from "../../../domains/walletRegistration/walletRegistrationReservation.js";
 import { listThresholdEcdsaKeyIdentityTargetsForUser } from "../../../../core/authService/thresholdEcdsaKeyInventory.js";
 import { routerAbEd25519YaoLifecycleDecisionLookupV1, routerAbEd25519YaoLifecycleDecisionV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoLifecycleDecision.js";
@@ -1646,7 +1647,24 @@ var CloudflareD1WalletRegistrationService = class {
 			};
 		}
 	}
+	/**
+	* Respond replays exactly, so a transient D1 fault runs it again, as a client
+	* retry would. A fault that outlasts the retries reports `storage_unavailable`
+	* without the driver's text.
+	*/
 	async respondWalletRegistration(input, traceContext, timingSink, waitUntil) {
+		try {
+			return await retryTransientD1(() => this.respondWalletRegistrationAttempt(input, traceContext, timingSink, waitUntil));
+		} catch (error) {
+			if (!isTransientD1Error(error)) throw error;
+			return {
+				ok: false,
+				code: "storage_unavailable",
+				message: "Wallet registration storage is unavailable"
+			};
+		}
+	}
+	async respondWalletRegistrationAttempt(input, traceContext, timingSink, waitUntil) {
 		const serverTiming = timingSink ?? [];
 		const totalStartedAtMs = Date.now();
 		const mark = (name, startedAtMs) => {
@@ -1948,6 +1966,7 @@ var CloudflareD1WalletRegistrationService = class {
 				ed25519: ed25519Admission.deferred
 			});
 		} catch (error) {
+			if (isTransientD1Error(error)) throw error;
 			return {
 				ok: false,
 				code: "internal",
@@ -2132,7 +2151,10 @@ var CloudflareD1WalletRegistrationService = class {
 			ed25519: args.input.ed25519,
 			emailOtpEnrollment: args.input.emailOtpEnrollment,
 			walletCustodyCommit: args.input.walletCustodyCommit
-		}, effectivePrepared, source, args.serverTiming, initialSessionPlan, args.lifecycleDecision, args.heldPasskeyClaim);
+		}, effectivePrepared, source, args.serverTiming, initialSessionPlan, args.lifecycleDecision, args.heldPasskeyClaim, {
+			kind: "snapshot",
+			authority: args.readYaoAdmission()
+		});
 		if (!execution.ok) return unissuedRegistrationCommit(throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1(execution));
 		const finalized = execution.finalized;
 		if (finalized.kind !== "near_ed25519") {
@@ -2380,7 +2402,8 @@ var CloudflareD1WalletRegistrationService = class {
 					authoritySource: verified.source,
 					preparedCeremony: () => preparedCeremony,
 					lifecycleDecision: initial.decision,
-					heldPasskeyClaim: initial.heldPasskeyClaim
+					heldPasskeyClaim: initial.heldPasskeyClaim,
+					readYaoAdmission: initial.readYaoAdmission
 				}),
 				projectReceipt: (execution) => projectWalletRegistrationSessionCommitReceiptV2({
 					operation: "near_provisioning",
@@ -2613,10 +2636,18 @@ var CloudflareD1WalletRegistrationService = class {
 			code: admitted.code,
 			message: admitted.message
 		};
-		if (!stored && admitted.companionWrite === "not_committed") await ceremonyStore.commitEcdsaClaim({
-			expected: input.snapshot,
-			next: authorizedCeremony(admitted.admissionRequest)
-		});
+		if (!stored && admitted.companionWrite === "not_committed") {
+			const next = authorizedCeremony(admitted.admissionRequest);
+			try {
+				await ceremonyStore.commitEcdsaClaim({
+					expected: input.snapshot,
+					next
+				});
+			} catch (error) {
+				const committed = await ceremonyStore.getCeremony(ceremony.registrationCeremonyId);
+				if (!committed || alphabetizeStringify(committed) !== alphabetizeStringify(next)) throw error;
+			}
+		}
 		if (!stored && input.waitUntil && verifiedAuthority.kind === "passkey") input.waitUntil(this.walletRegistrationCommitStore.claimPasskeyAhead({
 			registrationCeremonyId: ceremony.registrationCeremonyId,
 			authority: verifiedAuthority,
@@ -2870,7 +2901,7 @@ var CloudflareD1WalletRegistrationService = class {
 		}, prepared, {
 			kind: "stored_ceremony",
 			ceremony: activatedCeremony
-		}, [], { kind: "separate" }, null);
+		}, [], { kind: "separate" }, null, null, { kind: "stored" });
 		if (!execution.ok) return unissuedRegistrationCommit(throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1(execution));
 		const commit = execution.finalized;
 		if (commit.kind !== "evm_family_ecdsa") {
@@ -3206,7 +3237,7 @@ var CloudflareD1WalletRegistrationService = class {
 			};
 		}
 	}
-	async executeWalletRegistrationFinalize(request, prepared, source, serverTiming, initialSessionPlan, lifecycleDecision, heldPasskeyClaim = null) {
+	async executeWalletRegistrationFinalize(request, prepared, source, serverTiming, initialSessionPlan, lifecycleDecision, heldPasskeyClaim, yaoAdmission) {
 		const finalizeTiming = createD1RegistrationRouteTimingRecorder("wallets_register_finalize");
 		const totalTiming = startD1RegistrationRouteTiming("registerFinalizeTotalMs");
 		let startedCustody = null;
@@ -3440,12 +3471,12 @@ var CloudflareD1WalletRegistrationService = class {
 							sessionId: activationReference.session_id
 						},
 						consumerBinding: requestFingerprint
-					})
+					}, yaoAdmission)
 				}), recordRegistrationPromiseTiming({
 					sink: serverTiming,
 					name: "near_finalize_authority_reserve",
 					startedAtMs: Date.now(),
-					promise: this.walletRegistrationCommitStore.reserveAuthority(ceremonyAuthority, heldPasskeyClaim)
+					promise: this.walletRegistrationCommitStore.reserveAuthority(ceremonyAuthority, heldPasskeyClaim, prepared)
 				})]);
 				if (activationConsumption.status === "rejected") throw activationConsumption.reason;
 				if (authorityReservation.status === "rejected") throw authorityReservation.reason;
@@ -3574,7 +3605,7 @@ var CloudflareD1WalletRegistrationService = class {
 			} else {
 				custodyReservation = reserveCustody();
 				startedCustody = custodyReservation;
-				commitWallet = await this.walletRegistrationCommitStore.reserveAuthority(ceremonyAuthority);
+				commitWallet = await this.walletRegistrationCommitStore.reserveAuthority(ceremonyAuthority, null, prepared);
 			}
 			if (yaoDecisionFound?.kind === "decided_otherwise") return {
 				ok: false,

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationSetupExecution.js

@@ -176,25 +176,41 @@ async function describeSetupEd25519Admission(ed25519Yao, ceremony, branch) {
 	const signingRootId = normalizeOptionalTrimmedString(ceremony.signingRootId);
 	const signingRootVersion = normalizeOptionalTrimmedString(ceremony.signingRootVersion);
 	if (authMethod.kind !== "passkey" || !ed25519Yao || !mint || !signingRootId || !signingRootVersion) return { status: "after_proof" };
-	const admissionRequest = await buildRouterAbEd25519YaoProductAdmissionRequestV1({
-		registrationCeremonyId: ceremony.registrationCeremonyId,
-		walletId: ceremony.intent.walletId,
+	return await describedEd25519Admission({
+		ed25519Yao,
+		ceremony,
+		branch,
+		rpId: authMethod.rpId,
+		mint,
 		signingRootId,
-		signingRootVersion,
+		signingRootVersion
+	}).catch(withholdEd25519AdmissionDescription) ?? { status: "after_proof" };
+}
+/**
+* Every step that can fail is inside this one promise, so the caller's single
+* catch covers the request as well as the receipt. A wallet id that cannot
+* hold the branch's signing key fails here, and respond reports it as before.
+*/
+async function describedEd25519Admission(input) {
+	const admissionRequest = await buildRouterAbEd25519YaoProductAdmissionRequestV1({
+		registrationCeremonyId: input.ceremony.registrationCeremonyId,
+		walletId: input.ceremony.intent.walletId,
+		signingRootId: input.signingRootId,
+		signingRootVersion: input.signingRootVersion,
 		authorityScope: {
 			kind: "passkey",
-			rpId: authMethod.rpId
+			rpId: input.rpId
 		},
-		branch,
-		signingWorkerId: ed25519Yao.signingWorkerId,
-		materialActivation: mint.materialActivation
+		branch: input.branch,
+		signingWorkerId: input.ed25519Yao.signingWorkerId,
+		materialActivation: input.mint.materialActivation
 	});
-	const described = await ed25519Yao.describeRegistrationAdmission(admissionRequest, mint.sessionId).catch(withholdEd25519AdmissionDescription);
-	return described?.ok ? {
+	const described = await input.ed25519Yao.describeRegistrationAdmission(admissionRequest, input.mint.sessionId);
+	return described.ok ? {
 		status: "described",
 		admissionRequest,
 		admissionReceipt: described.value
-	} : { status: "after_proof" };
+	} : null;
 }
 function withholdEd25519AdmissionDescription() {
 	return null;

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAddSignerService.js

@@ -1255,7 +1255,7 @@ var CloudflareD1WalletAddSignerService = class {
 				const consumed = await yaoRuntime.consumeActivated({
 					reference: requestedActivationReference,
 					consumerBinding: input.consumerBinding
-				});
+				}, { kind: "stored" });
 				if (!consumed.ok) return consumed;
 				if (!sameRouterAbEd25519YaoRegistrationAdmissionRequestV1(consumed.activation.admissionRequest, currentState.admissionRequest)) return {
 					ok: false,

package/dist/esm/router/cloudflare.js

@@ -14013,7 +14013,7 @@ async function handleRouterApiWalletRegistrationRespond(input) {
 		verifier: session,
 		...registrationUserAgentFromHeaders(input.headers) ? { userAgent: registrationUserAgentFromHeaders(input.headers) } : {}
 	}, traceContext.value ?? void 0, serverTiming, input.waitUntil);
-	return routeJson(result.ok ? 200 : 400, result, { headers: ecdsaGatewayServerTimingHeaders(serverTiming) });
+	return routeJson(result.ok ? 200 : result.code === "storage_unavailable" ? 503 : 400, result, { headers: ecdsaGatewayServerTimingHeaders(serverTiming) });
 }
 async function handleRouterApiWalletRegistrationNearAdmission(input) {
 	const traceContext = parseRegistrationTraceContext(input.headers);
@@ -41109,7 +41109,7 @@ function lifecycleWriteFenceStatements(options, wallets) {
 //#endregion
 //#region src/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoProductRegistrationPartitionedStateStore.ts
 function createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1(options) {
-	return createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1(new D1LifecycleRecords(options, createLifecycleRecords(options)));
+	return createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1(new D1LifecycleRecords(options, createD1Ed25519YaoLifecycleRecords(options)));
 }
 var D1LifecycleRecords = class {
 	constructor(options, records) {
@@ -41168,7 +41168,7 @@ function readPartition(value) {
 	if (!record) throw new Error("Lifecycle mutation contains an invalid partition record");
 	return record;
 }
-function createLifecycleRecords(options) {
+function createD1Ed25519YaoLifecycleRecords(options) {
 	return createCloudflareD1VersionedJsonRecordStore({
 		...options,
 		encode: identityVersionedJsonObject,
@@ -41811,10 +41811,19 @@ var RouterAbEd25519YaoProductRegistrationRequestScopedRuntime = class {
 	* Gateway's ceremony record, and the result is derived from the Router's
 	* recorded answer: no active-root lookup is needed.
 	*/
-	async consumeActivated(input) {
+	async consumeActivated(input, admission) {
 		const lifecycleId = input.reference.lifecycleId;
-		const authority = routerAbEd25519YaoAdmittedRegistrationAuthorityV1((await this.input.store.loadRegistration(lifecycleId)).state, lifecycleId);
-		if (!authority) return {
+		let authority;
+		switch (admission.kind) {
+			case "stored":
+				authority = routerAbEd25519YaoAdmittedRegistrationAuthorityV1((await this.input.store.loadRegistration(lifecycleId)).state, lifecycleId);
+				break;
+			case "snapshot":
+				authority = admission.authority;
+				break;
+			default: return assertNeverConsumptionAdmission(admission);
+		}
+		if (!authority || authority.admissionRequest.scope.lifecycle_id !== lifecycleId) return {
 			ok: false,
 			code: "unknown_registration",
 			message: "registration lifecycle was not found"
@@ -41963,6 +41972,9 @@ async function bindAndAdmitVerifiedRegistration(input) {
 	};
 }
 function ignoreUnobservedDispatchRoot() {}
+function assertNeverConsumptionAdmission(admission) {
+	throw new Error(`Unknown registration admission source: ${String(admission)}`);
+}
 //#endregion
 //#region src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.ts
 const SIDE_EFFECT_CLAIM_FIELDS = [

package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore.js

@@ -38,6 +38,10 @@ function routerAbEd25519YaoAdmittedRegistrationAuthorityV1(state, lifecycleId) {
 		dispatchRoot: state.registration.dispatchRoots.get(lifecycleId)
 	});
 }
+/** Parse an exact ceremony read for consumption; the Router owns its mutable claim. */
+function parseRouterAbEd25519YaoRegistrationAdmissionReadV1(lifecycleId, result) {
+	return routerAbEd25519YaoAdmittedRegistrationAuthorityV1(readCeremonyRecord(decodePartitionReadResult(result), requireLifecycleId(lifecycleId)).value, lifecycleId);
+}
 function encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1(record) {
 	const lifecycleId = record.kind === SHARED_RECORD_KIND ? "shared" : record.lifecycleId;
 	const state = createRouterAbEd25519YaoProductRegistrationStateV1();
@@ -344,6 +348,6 @@ function isVersionedJsonValue(input) {
 	return isVersionedJsonObject(input);
 }
 //#endregion
-export { ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordJsonV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1, routerAbEd25519YaoAdmittedRegistrationAuthorityV1, routerAbEd25519YaoPartitionedStateAfterStoredCommitV1, sameRouterAbEd25519YaoSharedStateCanonicalEncodingV1 };
+export { ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordJsonV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoRegistrationAdmissionReadV1, routerAbEd25519YaoAdmittedRegistrationAuthorityV1, routerAbEd25519YaoPartitionedStateAfterStoredCommitV1, sameRouterAbEd25519YaoSharedStateCanonicalEncodingV1 };
 
 //# sourceMappingURL=routerAbEd25519YaoProductRegistrationPartitionedStateStore.js.map

package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationRequestScopedRuntime.js

@@ -78,10 +78,19 @@ var RouterAbEd25519YaoProductRegistrationRequestScopedRuntime = class {
 	* Gateway's ceremony record, and the result is derived from the Router's
 	* recorded answer: no active-root lookup is needed.
 	*/
-	async consumeActivated(input) {
+	async consumeActivated(input, admission) {
 		const lifecycleId = input.reference.lifecycleId;
-		const authority = routerAbEd25519YaoAdmittedRegistrationAuthorityV1((await this.input.store.loadRegistration(lifecycleId)).state, lifecycleId);
-		if (!authority) return {
+		let authority;
+		switch (admission.kind) {
+			case "stored":
+				authority = routerAbEd25519YaoAdmittedRegistrationAuthorityV1((await this.input.store.loadRegistration(lifecycleId)).state, lifecycleId);
+				break;
+			case "snapshot":
+				authority = admission.authority;
+				break;
+			default: return assertNeverConsumptionAdmission(admission);
+		}
+		if (!authority || authority.admissionRequest.scope.lifecycle_id !== lifecycleId) return {
 			ok: false,
 			code: "unknown_registration",
 			message: "registration lifecycle was not found"
@@ -230,6 +239,9 @@ async function bindAndAdmitVerifiedRegistration(input) {
 	};
 }
 function ignoreUnobservedDispatchRoot() {}
+function assertNeverConsumptionAdmission(admission) {
+	throw new Error(`Unknown registration admission source: ${String(admission)}`);
+}
 //#endregion
 export { createRouterAbEd25519YaoProductRegistrationRequestScopedRuntimeV1 };
 

package/dist/esm/router/domains/walletRegistration/walletRegistrationRoutes.js

@@ -1659,7 +1659,7 @@ async function handleRouterApiWalletRegistrationRespond(input) {
 		verifier: session,
 		...registrationUserAgentFromHeaders(input.headers) ? { userAgent: registrationUserAgentFromHeaders(input.headers) } : {}
 	}, traceContext.value ?? void 0, serverTiming, input.waitUntil);
-	return routeJson(result.ok ? 200 : 400, result, { headers: ecdsaGatewayServerTimingHeaders(serverTiming) });
+	return routeJson(result.ok ? 200 : result.code === "storage_unavailable" ? 503 : 400, result, { headers: ecdsaGatewayServerTimingHeaders(serverTiming) });
 }
 async function handleRouterApiWalletRegistrationNearAdmission(input) {
 	const traceContext = parseRegistrationTraceContext(input.headers);

package/dist/esm/router/express.js

@@ -9331,7 +9331,7 @@ async function handleRouterApiWalletRegistrationRespond(input) {
 		verifier: session,
 		...registrationUserAgentFromHeaders(input.headers) ? { userAgent: registrationUserAgentFromHeaders(input.headers) } : {}
 	}, traceContext.value ?? void 0, serverTiming, input.waitUntil);
-	return routeJson(result.ok ? 200 : 400, result, { headers: ecdsaGatewayServerTimingHeaders(serverTiming) });
+	return routeJson(result.ok ? 200 : result.code === "storage_unavailable" ? 503 : 400, result, { headers: ecdsaGatewayServerTimingHeaders(serverTiming) });
 }
 async function handleRouterApiWalletRegistrationNearAdmission(input) {
 	const traceContext = parseRegistrationTraceContext(input.headers);

package/dist/esm/threshold/session/signingSessionSeal/crypto/shamir3PassWasm.js

@@ -1,3 +1,4 @@
+import { SIGNING_SESSION_SEAL_GROUP_ID } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
 import { __wbg_init, init_shamir3pass_runtime, shamir3pass_add_lock, shamir3pass_derive_lock_key_handle, shamir3pass_destroy_lock_key_handle, shamir3pass_remove_lock } from "../../../../wasm/shamir3pass_runtime/pkg/shamir3pass_runtime.js";
 //#region src/threshold/session/signingSessionSeal/crypto/shamir3PassWasm.ts
 const SHAMIR3PASS_WASM_PATH_CANDIDATES = [
@@ -59,6 +60,23 @@ async function ensureSigningSessionSealShamir3PassWasm() {
 	if (!initialization) initialization = isNodeEnvironment() ? initializeNodeRuntime() : initializeWorkerRuntime();
 	await initialization;
 }
+/** The group element 2, the smallest value the lock operations accept. */
+const WARM_UP_ELEMENT_B64U = "Ag";
+const WARM_UP_CONTEXT = new TextEncoder().encode("seams/signing-session-seal/warm-up/v1");
+/**
+* Starts the module and runs one lock round under a key derived from zero
+* bytes, so the first seal in this isolate runs warm code. It uses no secret,
+* and its result is discarded.
+*/
+async function warmSigningSessionSealRuntime() {
+	await ensureSigningSessionSealShamir3PassWasm();
+	const handle = shamir3pass_derive_lock_key_handle(SIGNING_SESSION_SEAL_GROUP_ID, new Uint8Array(32), WARM_UP_CONTEXT.slice());
+	try {
+		shamir3pass_remove_lock(handle, shamir3pass_add_lock(handle, WARM_UP_ELEMENT_B64U));
+	} finally {
+		shamir3pass_destroy_lock_key_handle(handle);
+	}
+}
 async function deriveSigningSessionSealLockKeyHandle(input) {
 	await ensureSigningSessionSealShamir3PassWasm();
 	const rootSecret32 = input.rootSecret32.slice();
@@ -82,6 +100,6 @@ function destroySigningSessionSealLockKeyHandle(handle) {
 	return shamir3pass_destroy_lock_key_handle(handle);
 }
 //#endregion
-export { addSigningSessionSealLock, deriveSigningSessionSealLockKeyHandle, destroySigningSessionSealLockKeyHandle, removeSigningSessionSealLock };
+export { addSigningSessionSealLock, deriveSigningSessionSealLockKeyHandle, destroySigningSessionSealLockKeyHandle, removeSigningSessionSealLock, warmSigningSessionSealRuntime };
 
 //# sourceMappingURL=shamir3PassWasm.js.map

package/dist/types/wallet-server/src/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoProductRegistrationPartitionedStateStore.d.ts

@@ -1,7 +1,8 @@
-import { type CloudflareD1VersionedJsonRecordStoreOptions } from '../versionedJson/d1VersionedJsonRecordStore';
+import { type CloudflareD1VersionedJsonRecordStore, type CloudflareD1VersionedJsonRecordStoreOptions } from '../versionedJson/d1VersionedJsonRecordStore';
 import type { VersionedJsonObject } from '../../../framework/versionedJsonRecordStore';
 import { type RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1 } from '../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore';
 export type RouterAbEd25519YaoProductRegistrationPartitionedStateD1OptionsV1 = Omit<CloudflareD1VersionedJsonRecordStoreOptions<VersionedJsonObject>, 'encode' | 'parse'>;
 export declare function createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1(options: RouterAbEd25519YaoProductRegistrationPartitionedStateD1OptionsV1): RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1;
 export declare function evictWalletEd25519CapabilityCache(options: RouterAbEd25519YaoProductRegistrationPartitionedStateD1OptionsV1, walletId: string): Promise<void>;
+export declare function createD1Ed25519YaoLifecycleRecords(options: RouterAbEd25519YaoProductRegistrationPartitionedStateD1OptionsV1): CloudflareD1VersionedJsonRecordStore<VersionedJsonObject>;
 //# sourceMappingURL=d1Ed25519YaoProductRegistrationPartitionedStateStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationCommitStore.d.ts

@@ -5,6 +5,7 @@ import { type RegistrationAuthority } from '../../../../../../shared-ts/src/util
 import type { WalletRecord, WalletSignerRecord } from '../../../../core/WalletStore';
 import type { D1DatabaseLike, D1PreparedStatementLike, D1ResultLike } from '../../../../storage/tenantRoute';
 import type { D1EmailOtpRegistrationCommitPlan } from '../emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer';
+import type { D1WalletRegistrationOperationPreparedV1 } from './d1WalletRegistrationPreparation';
 export type D1RegistrationCommitBatch = (statements: readonly D1PreparedStatementLike[]) => Promise<readonly D1ResultLike[]>;
 type ReservedWalletRegistrationCommit = (input: D1WalletRegistrationCommitInput, executeBatch?: D1RegistrationCommitBatch) => Promise<void>;
 type D1WalletRegistrationCommitBase = {
@@ -40,9 +41,11 @@ export type HeldRegistrationPasskeyClaim = {
 export interface D1WalletRegistrationCommitStore {
     /**
      * Claims the authority's passkey through shared authority, unless `held`
-     * records that the same claim was already granted for this ceremony.
+     * records that the same claim was already granted for this ceremony. With
+     * `founding`, it also reads that authority and auth method as stored, beside
+     * the claim, so the commit writes them without a read of its own.
      */
-    reserveAuthority(authority: RegistrationAuthority, held?: HeldRegistrationPasskeyClaim | null): Promise<ReservedWalletRegistrationCommit>;
+    reserveAuthority(authority: RegistrationAuthority, held: HeldRegistrationPasskeyClaim | null, founding: FoundingRecordIds | null): Promise<ReservedWalletRegistrationCommit>;
     /**
      * Claims a verified passkey before finalization and records a granted
      * claim. A refusal records nothing, so finalization claims again and
@@ -58,6 +61,7 @@ export interface D1WalletRegistrationCommitStore {
     /** Removes the record of a finalized ceremony. Shared authority keeps the claim. */
     deleteHeldPasskeyClaim(registrationCeremonyId: string): Promise<void>;
 }
+type FoundingRecordIds = Pick<D1WalletRegistrationOperationPreparedV1, 'walletAuthorityId' | 'walletAuthMethodId'>;
 export declare class CloudflareD1WalletRegistrationCommitStore implements D1WalletRegistrationCommitStore {
     private readonly database;
     private readonly scope;
@@ -70,7 +74,7 @@ export declare class CloudflareD1WalletRegistrationCommitStore implements D1Wall
         readonly projectId: string;
         readonly envId: string;
     });
-    reserveAuthority(authority: RegistrationAuthority, held?: HeldRegistrationPasskeyClaim | null): Promise<ReservedWalletRegistrationCommit>;
+    reserveAuthority(authority: RegistrationAuthority, held: HeldRegistrationPasskeyClaim | null, founding: FoundingRecordIds | null): Promise<ReservedWalletRegistrationCommit>;
     claimPasskeyAhead(input: {
         readonly registrationCeremonyId: string;
         readonly authority: RegistrationAuthority;

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationRead.d.ts

@@ -1,3 +1,4 @@
+import type { createD1Ed25519YaoLifecycleRecords } from '../ed25519Yao/d1Ed25519YaoProductRegistrationPartitionedStateStore';
 import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
 import type { WalletRegistrationHomeAuthority } from '../../../domains/walletRegistration/walletRegistrationReservation';
 import type { CloudflareD1RegistrationCeremonyIntentStore } from './d1RegistrationCeremonyStore';
@@ -13,8 +14,9 @@ export declare class D1WalletRegistrationRead {
     readonly operations: D1WalletOperationStore<D1WalletRegistrationNearProvisioningSideEffectRecord>;
     private readonly getCeremonies;
     private readonly decisions;
+    private readonly yaoRecords;
     private readonly passkeyClaims;
-    constructor(database: D1DatabaseLike, authority: D1WalletExecutionAuthority | null, operations: D1WalletOperationStore<D1WalletRegistrationNearProvisioningSideEffectRecord>, getCeremonies: () => CloudflareD1RegistrationCeremonyIntentStore, decisions: CloudflareD1Ed25519YaoLifecycleDecisionStoreV1, passkeyClaims: Pick<D1WalletRegistrationCommitStore, 'prepareHeldPasskeyClaimRead' | 'parseHeldPasskeyClaimRead'>);
+    constructor(database: D1DatabaseLike, authority: D1WalletExecutionAuthority | null, operations: D1WalletOperationStore<D1WalletRegistrationNearProvisioningSideEffectRecord>, getCeremonies: () => CloudflareD1RegistrationCeremonyIntentStore, decisions: CloudflareD1Ed25519YaoLifecycleDecisionStoreV1, yaoRecords: ReturnType<typeof createD1Ed25519YaoLifecycleRecords>, passkeyClaims: Pick<D1WalletRegistrationCommitStore, 'prepareHeldPasskeyClaimRead' | 'parseHeldPasskeyClaimRead'>);
     readRespond(home: Parameters<WalletRegistrationHomeAuthority['admitHome']>[0]): Promise<{
         readonly ok: false;
         readonly code: string;
@@ -41,6 +43,8 @@ export declare class D1WalletRegistrationRead {
         decision: import("../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoLifecycleDecision").RouterAbEd25519YaoLifecycleDecisionV1 | null;
         heldPasskeyClaim: import("./d1WalletRegistrationCommitStore").HeldRegistrationPasskeyClaim | null;
         readCeremony: () => Promise<import("../../../../core/RegistrationCeremonyStore").StoredWalletRegistrationCeremony | null>;
+        readYaoAdmission: () => import("../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationExecutionRecord").RouterAbEd25519YaoRegistrationExecutionAuthorityV1 | null;
     }>;
+    private parseYaoAdmission;
 }
 //# sourceMappingURL=d1WalletRegistrationRead.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationService.d.ts

@@ -260,7 +260,13 @@ export declare class CloudflareD1WalletRegistrationService {
     provisionEd25519YaoWalletSession(request: RouterAbEd25519YaoVerifiedWalletUnlockRequestV1): Promise<RouterAbEd25519YaoVerifiedWalletUnlockResponseV1>;
     setupWalletRegistration(input: WalletRegistrationSetupInput): Promise<WalletRegistrationSetupResponseV2>;
     authorizeWalletRegistrationNearAdmission(input: WalletRegistrationNearAdmissionInput): Promise<WalletRegistrationNearAdmissionResponseV2>;
+    /**
+     * Respond replays exactly, so a transient D1 fault runs it again, as a client
+     * retry would. A fault that outlasts the retries reports `storage_unavailable`
+     * without the driver's text.
+     */
     respondWalletRegistration(input: WalletRegistrationRespondInput, traceContext?: RouterAbTraceContextV1, timingSink?: Array<readonly [string, number]>, waitUntil?: (promise: Promise<unknown>) => void): Promise<WalletRegistrationRespondResponseV2>;
+    private respondWalletRegistrationAttempt;
     /** For callers that must read the context before finalize tombstones it. */
     private registrationOwnerProofWithContext;
     authorizeNearRegistrationContinuation(input: {

package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.d.ts

@@ -1,3 +1,4 @@
+import type { RouterAbEd25519YaoRegistrationExecutionAuthorityV1 } from '../registration/routerAbEd25519YaoRegistrationExecutionRecord';
 import { type AddSignerIntentV1, type WalletId } from '../../../../../../shared-ts/src/utils/registrationIntent';
 import { type RegistrationEd25519AuthorityScope } from '../../../../../../shared-ts/src/utils/registrationIds';
 import { type RegistrationNearEd25519SignerPlan } from '../../../../../../shared-ts/src/utils/registrationSignerPlan';
@@ -58,6 +59,14 @@ export type RouterAbEd25519YaoWalletSessionMintInputV1 = (RouterAbEd25519YaoWall
     readonly expiresAtMs: number;
     readonly remainingUses: number;
 });
+/** Admission is immutable. A finalization batch may supply it before consumption. */
+export type RouterAbEd25519YaoConsumptionAdmissionV1 = {
+    readonly kind: 'stored';
+    readonly authority?: never;
+} | {
+    readonly kind: 'snapshot';
+    readonly authority: RouterAbEd25519YaoRegistrationExecutionAuthorityV1 | null;
+};
 export type RouterAbEd25519YaoProductRegistrationRuntimeV1 = RouterAbEd25519YaoPersistedActiveCapabilityInstallerV1 & RouterAbEd25519YaoActiveCapabilityResolverV1 & RouterAbEd25519YaoActiveCapabilityRehydratorV1 & {
     readonly kind: 'router_ab_ed25519_yao_product_registration_runtime_v1';
     readonly signingWorkerId: string;
@@ -87,7 +96,7 @@ export type RouterAbEd25519YaoProductRegistrationRuntimeV1 = RouterAbEd25519YaoP
         readonly trace: RouterAbTraceContextV1;
     }): Promise<RouterAbEd25519YaoTimedRegistrationExecutionResultV1>;
     bindVerifiedIntent(input: RouterAbEd25519YaoVerifiedActivationIntentV1): Promise<RouterAbEd25519YaoRegistrationIntentBindingResult>;
-    consumeActivated(request: RouterAbEd25519YaoActivationConsumptionRequestV1): Promise<RouterAbEd25519YaoActivationConsumptionResultV1>;
+    consumeActivated(request: RouterAbEd25519YaoActivationConsumptionRequestV1, admission: RouterAbEd25519YaoConsumptionAdmissionV1): Promise<RouterAbEd25519YaoActivationConsumptionResultV1>;
 };
 /** A tenant-root read in flight, with the signing root ID that it was started for. */
 export type RouterAbEd25519YaoStartedDispatchRootV1 = {

package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore.d.ts

@@ -118,7 +118,9 @@ export declare function createRouterAbEd25519YaoProductRegistrationPartitionedSt
  * The admitted authority a registration execute is checked against, from a
  * loaded ceremony state, or `null` when the lifecycle is not admitted.
  */
-export declare function routerAbEd25519YaoAdmittedRegistrationAuthorityV1(state: RouterAbEd25519YaoRegistrationCeremonySnapshotV1['state'], lifecycleId: string): RouterAbEd25519YaoRegistrationExecutionAuthorityV1 | null;
+export declare function routerAbEd25519YaoAdmittedRegistrationAuthorityV1(state: Pick<RouterAbEd25519YaoProductRegistrationCeremonyStateV1, 'registration' | 'authorization'>, lifecycleId: string): RouterAbEd25519YaoRegistrationExecutionAuthorityV1 | null;
+/** Parse an exact ceremony read for consumption; the Router owns its mutable claim. */
+export declare function parseRouterAbEd25519YaoRegistrationAdmissionReadV1(lifecycleId: string, result: VersionedJsonRecordReadResult<VersionedJsonObject>): RouterAbEd25519YaoRegistrationExecutionAuthorityV1 | null;
 export declare function encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1(record: RouterAbEd25519YaoProductRegistrationPartitionRecordV1): VersionedJsonObject;
 export declare function sameRouterAbEd25519YaoSharedStateCanonicalEncodingV1(left: RouterAbEd25519YaoSharedStateCanonicalEncodingV1, right: RouterAbEd25519YaoSharedStateCanonicalEncodingV1): boolean;
 export declare function parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1(input: unknown): RouterAbEd25519YaoProductRegistrationPartitionRecordV1 | null;

package/dist/types/wallet-server/src/threshold/session/signingSessionSeal/crypto/shamir3PassWasm.d.ts

@@ -1,3 +1,9 @@
+/**
+ * Starts the module and runs one lock round under a key derived from zero
+ * bytes, so the first seal in this isolate runs warm code. It uses no secret,
+ * and its result is discarded.
+ */
+export declare function warmSigningSessionSealRuntime(): Promise<void>;
 export declare function deriveSigningSessionSealLockKeyHandle(input: {
     readonly groupId: string;
     readonly rootSecret32: Uint8Array;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seams/wallet-server",
-  "version": "0.10.0",
+  "version": "0.10.2",
   "type": "module",
   "description": "Seams server TypeScript SDK for NEAR and EVM-family wallets",
   "main": "./dist/esm/index.js",