@seams/wallet-server 0.12.0 → 0.13.0

package/artifact-manifest.json

@@ -2,17 +2,17 @@
   "schemaVersion": "seams_wallet_server_artifact_manifest_v1",
   "package": {
     "name": "@seams/wallet-server",
-    "version": "0.12.0"
+    "version": "0.13.0"
   },
   "workers": {
     "router": {
       "entry": "cloudflare-router-ab/build/router/worker/shim.mjs",
-      "fingerprint": "2fd5f566e80be8a45b7d0c94dfcca5ab4a9b3872cad979f8d377785645b3e345",
+      "fingerprint": "babfbd46212c2259e8974a353cffc16d7e0f2b9db73c06610dfa635a80338f57",
       "files": [
         {
           "path": "cloudflare-router-ab/build/router/build-stamp.json",
           "bytes": 119,
-          "sha256": "81b88975abfe55d4d7bda8340b0e9e5563d92f0b558977b2893017d98e03a868"
+          "sha256": "ce3fadf472507ec94f6250c45c33e7f0ce9c0f828c1362d3011716e775d64222"
         },
         {
           "path": "cloudflare-router-ab/build/router/index.js",
@@ -38,12 +38,12 @@
     },
     "deriver-a": {
       "entry": "cloudflare-router-ab/build/deriver-a/worker/shim.mjs",
-      "fingerprint": "d3db01b58444514a1a227c57b75b4a1b7b72239f9fbbf5af5e941afcca99f948",
+      "fingerprint": "ba97bc63f3423a54f8e2081f9aa286edb59c1ca4ec9425d98f8c7de24c0361de",
       "files": [
         {
           "path": "cloudflare-router-ab/build/deriver-a/build-stamp.json",
           "bytes": 122,
-          "sha256": "500990fe495d3b5d6a306bc16dd114fa88d26aade0188b5df27a011a03c6b701"
+          "sha256": "6dff6e175c26fa82b373aeee65e9b351ea679a7915eb18393ecca30059e60ec7"
         },
         {
           "path": "cloudflare-router-ab/build/deriver-a/index.js",
@@ -69,12 +69,12 @@
     },
     "deriver-b": {
       "entry": "cloudflare-router-ab/build/deriver-b/worker/shim.mjs",
-      "fingerprint": "b5bf7343edfbb39e3e44a8bfc0640ed6fcaab5c934767c2c181ee0e37d60a9d5",
+      "fingerprint": "60904c901a38482999280ea007b44f9fef6f262f7790c96868e303ecd7a41c78",
       "files": [
         {
           "path": "cloudflare-router-ab/build/deriver-b/build-stamp.json",
           "bytes": 122,
-          "sha256": "c45d527106bc969c61920d0b2fd308b994571c7e0fa2eebc963a49eb1c1b95a8"
+          "sha256": "0f18ba36a3d5d93eb976003b56536b95531233c6a95409e0a6368e872ac9add9"
         },
         {
           "path": "cloudflare-router-ab/build/deriver-b/index.js",
@@ -100,12 +100,12 @@
     },
     "signing-worker": {
       "entry": "cloudflare-router-ab/build/signing-worker/worker/shim.mjs",
-      "fingerprint": "6318d7738ca6279c3bb5bea15fbabf22801c65a2bd8539b3e7ac6f15b70766fc",
+      "fingerprint": "2cfc7fd3ec7e8bb3c34d1195f8ea517088e592b485c664add1963b64ed911b69",
       "files": [
         {
           "path": "cloudflare-router-ab/build/signing-worker/build-stamp.json",
           "bytes": 127,
-          "sha256": "bd2c319cacf96f564d634e09f36a47e161ba8ae62c0a2b4ba6ec72a672cebd79"
+          "sha256": "046021cac2430c3be57374c214d59411c7e9496e4217dfec4323e0f15558c268"
         },
         {
           "path": "cloudflare-router-ab/build/signing-worker/index.js",
@@ -131,12 +131,12 @@
     },
     "tenant-root-control-plane": {
       "entry": "cloudflare-router-ab/build/tenant-root-control-plane/worker/shim.mjs",
-      "fingerprint": "64320555ffb6332ee555f5759504a59a43dc137958b7da9520ec51ba71259d1c",
+      "fingerprint": "3d1e72167e3d4641218c6a84722128684a8886990c7e5703acce36432934ea2c",
       "files": [
         {
           "path": "cloudflare-router-ab/build/tenant-root-control-plane/build-stamp.json",
           "bytes": 139,
-          "sha256": "e45ea44efe8e43b2c5512c186cacce42e23b2c8538d03bbf40c31eb3d99a7827"
+          "sha256": "a39d4a1a5e7959a1235477c9526ac05ff80eee5fd6cefeeaa9af6e755e17d1ad"
         },
         {
           "path": "cloudflare-router-ab/build/tenant-root-control-plane/index.js",
@@ -164,8 +164,8 @@
   "migrations": {
     "signer": {
       "directory": "migrations/d1-signer",
-      "head": "0080_registration_setup_rate_limits.sql",
-      "fingerprint": "e681d4d38cdeb9246774a40219aa877793bee08e9cb28079f2b992597f6ee871",
+      "head": "0081_registration_directory_publications.sql",
+      "fingerprint": "1c939bacda72ec3c83a8fd1381668810b82c2963b3d3fda3a9670e916c6ae9d0",
       "files": [
         {
           "path": "migrations/d1-signer/0001_signer_d1_initial.sql",
@@ -566,6 +566,11 @@
           "path": "migrations/d1-signer/0080_registration_setup_rate_limits.sql",
           "bytes": 465,
           "sha256": "7ed04e03b49e5399e6ae0df7d2d7f46e737f8a783b13799ad5ed1b9b65a7d22a"
+        },
+        {
+          "path": "migrations/d1-signer/0081_registration_directory_publications.sql",
+          "bytes": 1599,
+          "sha256": "d386b3949a736393f74a0f67da4b1350826813acd2f5cc975e853efc21d032f9"
         }
       ]
     },

package/cloudflare-router-ab/build/deriver-a/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":true,"features":"strict-worker-deriver-a-entrypoint","started_at_ms":1792171647892}
+{"profile":"release","wallet_objects":true,"features":"strict-worker-deriver-a-entrypoint","started_at_ms":1792219894622}

package/cloudflare-router-ab/build/deriver-b/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":true,"features":"strict-worker-deriver-b-entrypoint","started_at_ms":1792171876604}
+{"profile":"release","wallet_objects":true,"features":"strict-worker-deriver-b-entrypoint","started_at_ms":1792220130347}

package/cloudflare-router-ab/build/router/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":true,"features":"strict-worker-router-entrypoint","started_at_ms":1792172099307}
+{"profile":"release","wallet_objects":true,"features":"strict-worker-router-entrypoint","started_at_ms":1792220351067}

package/cloudflare-router-ab/build/signing-worker/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":true,"features":"strict-worker-signing-worker-entrypoint","started_at_ms":1792171336433}
+{"profile":"release","wallet_objects":true,"features":"strict-worker-signing-worker-entrypoint","started_at_ms":1792219580046}

package/cloudflare-router-ab/build/tenant-root-control-plane/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":false,"features":"strict-worker-tenant-root-control-plane-entrypoint","started_at_ms":1792172311014}
+{"profile":"release","wallet_objects":false,"features":"strict-worker-tenant-root-control-plane-entrypoint","started_at_ms":1792220566801}

package/dist/esm/cloud-host.js

@@ -73,7 +73,7 @@ import { createStaticWalletConsoleBindingV1, handleStaticWalletConsoleRequestV1,
 import { parseWebAuthnSyncChallengeRecord } from "./router/cloudflare/d1/webauthn/d1WebAuthnRecords.js";
 import { CloudflareD1WebAuthnStore, prepareD1WebAuthnAuthenticatorInsertStatement, prepareD1WebAuthnAuthenticatorPutStatement } from "./router/cloudflare/d1/webauthn/d1WebAuthnStore.js";
 import { CloudflareD1WebAuthnAuthService } from "./router/cloudflare/d1/webauthn/d1WebAuthnAuthService.js";
-import { admitD1EstablishedWalletHome } from "./router/cloudflare/d1/registration/d1WalletExecutionAuthority.js";
+import { admitD1EstablishedWalletHome, resumeRegistrationDirectoryPublicationsV1 } from "./router/cloudflare/d1/registration/d1WalletExecutionAuthority.js";
 import { parseLinkedDeviceSessionRecordV1 } from "./core/deviceLinking/linkedDeviceSessionRecord.js";
 import { D1LinkedDeviceSourceContributionPreparationPlannerV1, createD1LinkedDeviceSourceContributionPreparationPlannerV1, linkedDeviceX25519RecipientPublicKeyB64uV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceSourceContributionPreparationPlanner.js";
 import { D1LinkedDeviceAuthorityInstallServiceV1, parseInstalledEcdsaCustodySnapshotV1, readD1LinkedDeviceEcdsaSourceV1, readD1LinkedDeviceEd25519SourceV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService.js";
@@ -131,4 +131,4 @@ import { handleRouterAbEd25519YaoRecoveryRequestScopedCloudflareV1 } from "./rou
 import { RouterAbEd25519YaoRecoveryWalletSessionAuthorizationAdapter } from "./router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryWalletSessionAuthorization.js";
 import { keccak256Bytes } from "./shared-ts/src/utils/keccak.js";
 import { decodeEvmBlockHeader, decodeEvmTransactionByHash, decodeEvmTransactionCall, decodeEvmTransactionReceipt, parseRpcHexQuantity } from "./shared-ts/src/utils/evmRpcResults.js";
-export { API_CREDENTIAL_ROUTE_SCOPES, API_CREDENTIAL_TYPES, ActionType, CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, CloudflareD1AuthorizationStore, CloudflareD1GoogleEmailOtpRegistrationAttemptStore, CloudflareD1OidcJwksCache, CloudflareD1RouterAbEd25519YaoCapabilityPersistence, CloudflareD1RouterAbNormalSigningAdmissionStore, CloudflareD1VaultProxyStore, CloudflareD1VersionedJsonRecordStore, CloudflareD1VersionedJsonRecordStoreError, CloudflareD1WebAuthnAuthService, CloudflareD1WebAuthnStore, CloudflareDurableObjectVersionedJsonRecordStore, CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1, CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1, CloudflareVersionedJsonRecordStoreError, CrossSiteSessionCookieAdapter, D1IdentityStore, D1LinkedDeviceAuthorityInstallServiceV1, D1LinkedDeviceEd25519ExportRootStoreV1, D1LinkedDeviceRequestProofNonceStoreV1, D1LinkedDeviceSessionStoreV1, D1LinkedDeviceSourceContributionPreparationPlannerV1, D1LinkedDeviceTargetAuthenticatorStoreV1, D1LinkedDeviceTargetCredentialProviderV1, D1LinkedDeviceTargetPlannerV1, D1WalletAuthMethodStore, D1WalletObjectAddresses, D1WalletStore, D1_BATCH_CAS_GUARD_SQL, DEFAULT_SESSION_COOKIE_NAME, DEFAULT_WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_V1, DEFAULT_WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_V1, DEFAULT_WALLET_SESSION_REMAINING_USES, DEFAULT_WALLET_SESSION_TTL_MS, ED25519_SIGNER_ACTIVATION_ID_PATH, InMemoryRouterAbEd25519YaoExportService, InMemoryRouterAbEd25519YaoExportStateV1, InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter, InMemoryRouterAbEd25519YaoRegistrationService, InMemoryRouterAbNormalSigningAdmissionStore, LINKED_DEVICE_OWNER_AUTHORIZATION_PATH_V1, LinkedDeviceRetiredTargetRegistrationShapeErrorV1, LinkedDeviceSourceFamilyUnavailableErrorV1, LinkedDeviceWebAuthnRegistrationVerifierV1, LocalRegistrationSetupAuthority, MAX_WALLET_SESSION_REMAINING_USES, MAX_WALLET_SESSION_TTL_MS, PUBLIC_PROOF_TYPES, ROUTER_AB_ECDSA_DERIVATION_PRIVATE_SIGNING_PATHS, ROUTER_AB_ED25519_PRIVATE_SIGNING_PATHS, ROUTER_AB_ED25519_YAO_CAPABILITY_REPLACEMENT_TABLE_V1, ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_STATUS_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1, ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, ROUTER_AB_MPC_ROUTER_ORIGIN, ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, ROUTER_AB_SIGNING_WORKER_ORIGIN, ROUTER_AB_TRACE_ID_HEADER_V1, ROUTER_API_CREDENTIAL_SCOPES, ROUTE_SERVICE_KEYS, RouterAbEcdsaPresignRuntime, RouterAbEd25519YaoExportOwnerProofAuthorizationAdapter, RouterAbEd25519YaoHttpRegistrationBackend, RouterAbEd25519YaoRecoveryWalletSessionAuthorizationAdapter, SESSION_CAS_GUARD_SQL, SessionService, StaticCloudflareTenantStorageRouteResolver, UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, WALLET_AUTH_METHOD_D1_STORE, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL, WALLET_CONSOLE_API_WALLET_DETAIL_PREFIX_V1, WALLET_CONSOLE_OPS_BASE_PATH_V1, WALLET_CONSOLE_OP_PATHS_V1, WALLET_CONSOLE_SERVICE_ORIGIN_V1, WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_ID_V1, WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_ID_V1, WALLET_CONTROL_AUTH_MARKER_V1, WALLET_CONTROL_BASE_PATH_V1, WALLET_CONTROL_SERVICE_ORIGIN_V1, WALLET_RUNTIME_OPS_BASE_PATH_V1, WALLET_RUNTIME_OP_PATHS_V1, WALLET_RUNTIME_SERVICE_ORIGIN_V1, WALLET_STORE_D1_SCHEMA_SQL, WalletHomeCustodyBinding, WalletLifecycleLocator, WalletObjectAddressSnapshot, WalletPlacementRoutes, abusePrincipalKey, addSecp256k1PublicKeys33, admitD1EstablishedWalletHome, admitRouterAbEcdsaReusableWalletSessionOperation, applyRouteMetering, assertUniqueRouterApiRouteDefinitions, authenticateDeviceLinkingOwnerWalletSessionRequestV1, authenticateRouterAbEcdsaOperationStepUp, authenticateRouterAbWalletOperationStepUp, authenticateRouterAbWalletOperationStepUpIdentity, authorizeRouterAbEcdsaDerivationNormalSigningRoute, authorizeRouterAbEd25519NormalSigningRoute, base64UrlDecode, base64UrlEncode, bindWalletAuthMethodIdentity, bindWalletAuthMethodIdentityV2, buildCorsOrigins, buildRouterAbEcdsaDerivationPrivateSigningWorkerBody, buildRouterAbEcdsaOwnerOperationStepUpPreparation, buildRouterAbEd25519OwnerOperationStepUpPreparation, buildRouterAbEd25519PrivateSigningWorkerBody, buildRouterAbEd25519YaoAddSignerAdmissionRequestV1, buildRouterAbEd25519YaoProductAdmissionRequestV1, buildTenantRootIdentityFromAuthenticatedDeploymentV1, buildVerifiedLinkInputV1, buildVerifiedTargetFactorV1, buildWalletEcdsaSignerRecord, claimRouterAbEcdsaOperationStepUp, coerceLogger, coerceRouterLogger, completeRouterAbEcdsaOperation, computeEip1559TxHash, computeLinkedDeviceSessionClaimDigestV1, computeRouterAbEd25519NormalSigningAdmissionMaterial, computeVerifiedTargetFactorVerificationDigestV1, createCloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1RouterApiAuthService, createCloudflareD1VersionedJsonRecordStore, createCloudflareDurableObjectVersionedJsonRecordStore, createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1, createCloudflareRouter, createCloudflareTenantStorageRoute, createCloudflareWalletGatewayRouterV1, createD1LinkedDeviceOwnerAuthorizationMetadataSourceV1, createD1LinkedDeviceOwnerAuthorizationProviderV1, createD1LinkedDeviceOwnerSourceChildReaderV1, createD1LinkedDeviceRouteServiceV1, createD1LinkedDeviceSessionServiceV1, createD1LinkedDeviceSourceContributionPreparationPlannerV1, createD1LinkedDeviceVerifiedLinkSourceReaderV1, createDeviceLinkingOwnerRequestAuthenticatorV1, createEd25519SessionAdapter, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterApiRuntimeSnapshotConsumer, createRouterAbEcdsaEd25519CeremonyTokenIssuer, createRouterAbEcdsaStrictPostRegistrationPort, createRouterAbEcdsaStrictRegistrationPort, createRouterAbEd25519YaoCeremonyStateStoreV1, createRouterAbEd25519YaoExportModule, createRouterAbEd25519YaoHttpRegistrationBackendFromEnv, createRouterAbEd25519YaoMaterialActivationRefV1, createRouterAbEd25519YaoProductRegistrationCompositionFromPortsV1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, createRouterAbEd25519YaoProductRegistrationRequestScopedRuntimeV1, createRouterAbEd25519YaoProductRegistrationRuntimeV1, createRouterAbEd25519YaoProductRegistrationStateFromPartsV1, createRouterAbEd25519YaoProductRegistrationStateV1, createRouterAbEd25519YaoRegistrationModule, createRouterAbNormalSigningAdmissionAdapter, createRouterAbServiceBindingFetch, createRouterApiModule, createRouterApiRouteDefinitions, createSignerD1DoStorageTarget, createSigningSessionSealOptions, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, createStaticWalletConsoleBindingV1, createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1, createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, createWalletConsoleOpsClient, createWalletConsoleRelayProxyExtensionV1, createWalletControlClientBindings, createWalletRegistrationContextResolver, createWalletRuntimeOpsHandler, d1ChangedRows, d1Integer, d1Number, decideRouterAbEcdsaOwnerOperationAuthorization, decideRouterAbEd25519OwnerOperationAuthorization, decodeEvmBlockHeader, decodeEvmTransactionByHash, decodeEvmTransactionCall, decodeEvmTransactionReceipt, decodeJsonRpcEnvelope, decodeWalletConsoleTenantRootActiveLineageRequestV1, decodeWalletConsoleTenantRootActiveLineageResponseV1, defineRoute, defineRouteExtension, deriveJwtExpiresAtIso, deriveRecoveryCodeLocatorV1FromBytes, digestOpaqueValue, encodeEip1559SignedTxFromSignature65, encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1, encodeRouterAbEd25519YaoProductRegistrationStateV1, encodeSessionJsonSegment, encodeTenantRootIdentityV1, enforceDelegatePolicy, enforceRoutePolicy, ensureEvmCryptoWasm, ensureLeadingSlash, ensureWalletAuthMethodStoreD1Schema, ensureWalletStoreD1Schema, evaluateRouterAbNormalSigningAdmission, executeRouterAbEd25519YaoAdmittedRegistrationV1, executeSignedDelegateWithRelayer, extractBearerCredential, extractRouterApiEnvironmentId, findRouteDefinitionById, findRouteDefinitionForRequest, formatD1ExecStatement, getRouterApiRouteExtensionDefinitions, getRouterApiRouteExtensionRoutes, getRouterApiRouteExtensionsForTransport, handleRouterAbEcdsaDerivationNormalSigningRouteCore, handleRouterAbEd25519YaoExportRequestScopedCloudflareV1, handleRouterAbEd25519YaoRecoveryRequestScopedCloudflareV1, handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1, handleStaticWalletConsoleRequestV1, handleWalletControlRequest, headersToRecord, isD1DatabaseLike, isObject, isPlainObject, json, jsonFailure, keccak256Bytes, linkedDeviceSignerManifestsEqualV1, linkedDeviceX25519RecipientPublicKeyB64uV1, loadCloudflareSignerWasmModule, matchesRouteDefinitionRequest, mergeRouterAbEd25519YaoProductRegistrationStatePartitionV1, mintRouterAbEd25519YaoRegistrationIdentityV1, normalizeBoundedPositiveInteger, normalizeCorsOrigin, normalizeD1RouterApiAuthOptions, normalizeHashToBytes, normalizeLinkedDevicePasskeyTargetConfigurationV1, normalizeLogger, normalizeLowercaseString, normalizeSessionString, normalizeSessionTtlSeconds, normalizeSourceIp, normalizeTrimmedString, normalizeWalletAuthMethod, normalizeWalletAuthMethodV2, parseBooleanFlag, parseBooleanJwtClaim, parseCacheControlMaxAgeSec, parseCsvList, parseD1JsonArrayColumn, parseD1JsonColumn, parseD1JsonObjectColumn, parseD1LinkedDeviceSessionRowV1, parseD1LinkedDeviceSessionTranscriptRowV1, parseGoogleEmailOtpRegistrationAttemptRecord, parseGoogleEmailOtpRegistrationOfferCandidates, parseGoogleJwks, parseGoogleLoginVerifyRequest, parseInstalledEcdsaCustodySnapshotV1, parseJwtAud, parseLinkedDeviceSessionRecordV1, parseOrgId, parseRecoveryCodeLocatorV1, parseRouterAbEcdsaEd25519PrivateJwk, parseRouterAbEcdsaPresignRuntimeConfig, parseRouterAbEcdsaStrictRegistrationTopology, parseRouterAbEd25519NormalSigningScopeV2, parseRouterAbEd25519OperationStepUpScope, parseRouterAbEd25519YaoActivationKeysetFromEnvV1, parseRouterAbEd25519YaoCeremonyKeyV1, parseRouterAbEd25519YaoExportAdmissionEnvelopeV1, parseRouterAbEd25519YaoExportExecuteEnvelopeV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordJsonV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoProductRegistrationStateJsonV1, parseRouterAbEd25519YaoProductRegistrationStateV1, parseRouterAbEd25519YaoRegistrationAdmissionReadV1, parseRouterAbEd25519YaoRegistrationRouterAnswerV1, parseRouterAbEd25519YaoTenantRootWireV1, parseRouterAbOperationStepUpOperation, parseRouterAbPublicKeysetV2, parseRpcHexQuantity, parseRs256JwtForVerification, parseSessionJwt, parseSigningSessionSealRootConfig, parseStaticWalletConsoleBindingConfigV1, parseStoredRouterAbEcdsaPendingActivationV1, parseWalletEd25519SignerRecord, parseWalletId, parseWalletRecoveryOperationId, parseWalletRegistrationContextResponse, parseWalletRegistrationSetupRequest, parseWalletRegistrationSetupReservation, parseWalletRuntimeExecuteSignedDelegateRequest, parseWalletRuntimeExecuteSignedDelegateResponse, parseWalletRuntimeExecuteSignedDelegateResult, parseWalletRuntimeRelayerAccount, parseWalletRuntimeWalletIdentitiesResult, parseWalletRuntimeWalletIdentityRequest, parseWebAuthnRpId, parseWebAuthnSyncChallengeRecord, partitionRouterAbEd25519YaoProductRegistrationStateV1, postRouterAbSigningWorkerJson, prepareD1TenantStatement, prepareD1WalletAuthMethodInsertStatement, prepareD1WalletAuthMethodPutStatement, prepareD1WalletAuthMethodV2PutStatement, prepareD1WalletPutSignerStatement, prepareD1WalletPutSubjectStatement, prepareD1WebAuthnAuthenticatorInsertStatement, prepareD1WebAuthnAuthenticatorPutStatement, projectRouterAbEd25519YaoExactWalletSession, proposeWalletRegistrationSetup, publishableKeyRoutePrincipal, queryD1All, queryD1One, randomTenantRootCreationGrantBytesV1, readD1LinkedDeviceEcdsaSourceV1, readD1LinkedDeviceEd25519SourceV1, readEnvironmentCsv, readEnvironmentString, readJson, registrationPreparationIdFromString, requireD1RouterApiAuthScopeString, requireEnvironmentString, requireNormalizedSessionString, requireRuntimePolicyScope, resolveFreshRouterAbEcdsaMaterialActivation, resolvePublishableKeyApiCredentialAuth, resolveRequestOriginRateLimitKeyFromFetchHeaders, resolveRouterAbEd25519YaoCeremonyKeyFromRequestV1, resolveRuntimeTenantRootLineage, resolveSecretKeyApiCredentialAuth, resolveSourceIpFromFetchHeaders, resolveWalletRegistrationContext, routeError, routeJson, routerAbEcdsaAtomicAuthorizationConfigured, routerAbEcdsaOperationInProgressResult, routerAbEcdsaOwnerOperationFailureResult, routerAbEcdsaRecordedResponse, routerAbEcdsaReplayHttpResponse, routerAbEcdsaReplayResult, routerAbEcdsaReplayUnavailableResult, routerAbEcdsaStrictRegistrationFactsBindingJson, routerAbEcdsaStrictRegistrationRequestBindingJson, routerAbEcdsaStrictRegistrationRequestMatchesFacts, routerAbEd25519OwnerOperationFailureResult, routerAbEd25519YaoAdmittedRegistrationAuthorityV1, routerAbEd25519YaoPartitionedStateAfterStoredCommitV1, routerAbEd25519YaoPersistedCapabilityMatchesLookupV1, routerAbEd25519YaoRegistrationExecutionTimingEntriesV1, routerAbEd25519YaoRegistrationSigningRootIdV1, routerAbEd25519YaoTenantRootWireV1, runRouterAbEd25519YaoProductRegistrationRequestScopedV1, runRouterAbEd25519YaoRegistrationSideEffectV1, runRouterAbEd25519YaoRegistrationTwoPhaseV1, runRouterAbPrewarmScheduledV1, runtimePolicyScopeKey, sameRouterAbEd25519YaoSharedStateCanonicalEncodingV1, secp256k1PrivateKey32ToPublicKey33, secp256k1PublicKey33ToEthereumAddress, secureRandomBase36, secureRandomBase64Url, selectWalletEd25519Signer, sessionJwtTimeClaims, sha256Bytes, sha256BytesSync, signSecp256k1Recoverable, signTenantRootCreationGrantV1, tenantRootIdentityDigestB64uV1, tenantStorageRouteBackendFamily, tenantStorageRouteDiagnostic, toFetchRouteResponse, normalizeOptionalTrimmedString as toOptionalTrimmedString, toResponse, toSessionArrayBufferCopy, unavailableRegistrationContext, validateDelegateExpiryAndNonce, validateGoogleIdTokenClaims, validateRuntimeSnapshotExpectation, validateSecp256k1PublicKey33, verifyGoogleOidcToken, verifyRs256JwtSignature, verifySecp256k1Bip340SignatureAgainstPublicKey33, verifySecp256k1RecoverableSignatureAgainstPublicKey33, walletAuthMethodId, walletAuthMethodV2Id, walletConsoleApiWalletGetRouteDefinitionV1, walletConsoleApiWalletListRouteDefinitionV1, walletConsoleApiWalletSearchRouteDefinitionV1, walletConsoleRelayRouteDefinitionsV1, walletConsoleSignedDelegateRouteDefinitionV1, walletConsoleSponsoredEvmCallRouteDefinitionV1, walletObjectIdentity, walletRegistrationContext, walletRegistrationSetupRequestDigest, webAuthnCredentialIdB64uFromCredential, withCors };
+export { API_CREDENTIAL_ROUTE_SCOPES, API_CREDENTIAL_TYPES, ActionType, CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, CloudflareD1AuthorizationStore, CloudflareD1GoogleEmailOtpRegistrationAttemptStore, CloudflareD1OidcJwksCache, CloudflareD1RouterAbEd25519YaoCapabilityPersistence, CloudflareD1RouterAbNormalSigningAdmissionStore, CloudflareD1VaultProxyStore, CloudflareD1VersionedJsonRecordStore, CloudflareD1VersionedJsonRecordStoreError, CloudflareD1WebAuthnAuthService, CloudflareD1WebAuthnStore, CloudflareDurableObjectVersionedJsonRecordStore, CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1, CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1, CloudflareVersionedJsonRecordStoreError, CrossSiteSessionCookieAdapter, D1IdentityStore, D1LinkedDeviceAuthorityInstallServiceV1, D1LinkedDeviceEd25519ExportRootStoreV1, D1LinkedDeviceRequestProofNonceStoreV1, D1LinkedDeviceSessionStoreV1, D1LinkedDeviceSourceContributionPreparationPlannerV1, D1LinkedDeviceTargetAuthenticatorStoreV1, D1LinkedDeviceTargetCredentialProviderV1, D1LinkedDeviceTargetPlannerV1, D1WalletAuthMethodStore, D1WalletObjectAddresses, D1WalletStore, D1_BATCH_CAS_GUARD_SQL, DEFAULT_SESSION_COOKIE_NAME, DEFAULT_WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_V1, DEFAULT_WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_V1, DEFAULT_WALLET_SESSION_REMAINING_USES, DEFAULT_WALLET_SESSION_TTL_MS, ED25519_SIGNER_ACTIVATION_ID_PATH, InMemoryRouterAbEd25519YaoExportService, InMemoryRouterAbEd25519YaoExportStateV1, InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter, InMemoryRouterAbEd25519YaoRegistrationService, InMemoryRouterAbNormalSigningAdmissionStore, LINKED_DEVICE_OWNER_AUTHORIZATION_PATH_V1, LinkedDeviceRetiredTargetRegistrationShapeErrorV1, LinkedDeviceSourceFamilyUnavailableErrorV1, LinkedDeviceWebAuthnRegistrationVerifierV1, LocalRegistrationSetupAuthority, MAX_WALLET_SESSION_REMAINING_USES, MAX_WALLET_SESSION_TTL_MS, PUBLIC_PROOF_TYPES, ROUTER_AB_ECDSA_DERIVATION_PRIVATE_SIGNING_PATHS, ROUTER_AB_ED25519_PRIVATE_SIGNING_PATHS, ROUTER_AB_ED25519_YAO_CAPABILITY_REPLACEMENT_TABLE_V1, ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_STATUS_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1, ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, ROUTER_AB_MPC_ROUTER_ORIGIN, ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, ROUTER_AB_SIGNING_WORKER_ORIGIN, ROUTER_AB_TRACE_ID_HEADER_V1, ROUTER_API_CREDENTIAL_SCOPES, ROUTE_SERVICE_KEYS, RouterAbEcdsaPresignRuntime, RouterAbEd25519YaoExportOwnerProofAuthorizationAdapter, RouterAbEd25519YaoHttpRegistrationBackend, RouterAbEd25519YaoRecoveryWalletSessionAuthorizationAdapter, SESSION_CAS_GUARD_SQL, SessionService, StaticCloudflareTenantStorageRouteResolver, UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, WALLET_AUTH_METHOD_D1_STORE, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL, WALLET_CONSOLE_API_WALLET_DETAIL_PREFIX_V1, WALLET_CONSOLE_OPS_BASE_PATH_V1, WALLET_CONSOLE_OP_PATHS_V1, WALLET_CONSOLE_SERVICE_ORIGIN_V1, WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_ID_V1, WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_ID_V1, WALLET_CONTROL_AUTH_MARKER_V1, WALLET_CONTROL_BASE_PATH_V1, WALLET_CONTROL_SERVICE_ORIGIN_V1, WALLET_RUNTIME_OPS_BASE_PATH_V1, WALLET_RUNTIME_OP_PATHS_V1, WALLET_RUNTIME_SERVICE_ORIGIN_V1, WALLET_STORE_D1_SCHEMA_SQL, WalletHomeCustodyBinding, WalletLifecycleLocator, WalletObjectAddressSnapshot, WalletPlacementRoutes, abusePrincipalKey, addSecp256k1PublicKeys33, admitD1EstablishedWalletHome, admitRouterAbEcdsaReusableWalletSessionOperation, applyRouteMetering, assertUniqueRouterApiRouteDefinitions, authenticateDeviceLinkingOwnerWalletSessionRequestV1, authenticateRouterAbEcdsaOperationStepUp, authenticateRouterAbWalletOperationStepUp, authenticateRouterAbWalletOperationStepUpIdentity, authorizeRouterAbEcdsaDerivationNormalSigningRoute, authorizeRouterAbEd25519NormalSigningRoute, base64UrlDecode, base64UrlEncode, bindWalletAuthMethodIdentity, bindWalletAuthMethodIdentityV2, buildCorsOrigins, buildRouterAbEcdsaDerivationPrivateSigningWorkerBody, buildRouterAbEcdsaOwnerOperationStepUpPreparation, buildRouterAbEd25519OwnerOperationStepUpPreparation, buildRouterAbEd25519PrivateSigningWorkerBody, buildRouterAbEd25519YaoAddSignerAdmissionRequestV1, buildRouterAbEd25519YaoProductAdmissionRequestV1, buildTenantRootIdentityFromAuthenticatedDeploymentV1, buildVerifiedLinkInputV1, buildVerifiedTargetFactorV1, buildWalletEcdsaSignerRecord, claimRouterAbEcdsaOperationStepUp, coerceLogger, coerceRouterLogger, completeRouterAbEcdsaOperation, computeEip1559TxHash, computeLinkedDeviceSessionClaimDigestV1, computeRouterAbEd25519NormalSigningAdmissionMaterial, computeVerifiedTargetFactorVerificationDigestV1, createCloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1RouterApiAuthService, createCloudflareD1VersionedJsonRecordStore, createCloudflareDurableObjectVersionedJsonRecordStore, createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1, createCloudflareRouter, createCloudflareTenantStorageRoute, createCloudflareWalletGatewayRouterV1, createD1LinkedDeviceOwnerAuthorizationMetadataSourceV1, createD1LinkedDeviceOwnerAuthorizationProviderV1, createD1LinkedDeviceOwnerSourceChildReaderV1, createD1LinkedDeviceRouteServiceV1, createD1LinkedDeviceSessionServiceV1, createD1LinkedDeviceSourceContributionPreparationPlannerV1, createD1LinkedDeviceVerifiedLinkSourceReaderV1, createDeviceLinkingOwnerRequestAuthenticatorV1, createEd25519SessionAdapter, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterApiRuntimeSnapshotConsumer, createRouterAbEcdsaEd25519CeremonyTokenIssuer, createRouterAbEcdsaStrictPostRegistrationPort, createRouterAbEcdsaStrictRegistrationPort, createRouterAbEd25519YaoCeremonyStateStoreV1, createRouterAbEd25519YaoExportModule, createRouterAbEd25519YaoHttpRegistrationBackendFromEnv, createRouterAbEd25519YaoMaterialActivationRefV1, createRouterAbEd25519YaoProductRegistrationCompositionFromPortsV1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, createRouterAbEd25519YaoProductRegistrationRequestScopedRuntimeV1, createRouterAbEd25519YaoProductRegistrationRuntimeV1, createRouterAbEd25519YaoProductRegistrationStateFromPartsV1, createRouterAbEd25519YaoProductRegistrationStateV1, createRouterAbEd25519YaoRegistrationModule, createRouterAbNormalSigningAdmissionAdapter, createRouterAbServiceBindingFetch, createRouterApiModule, createRouterApiRouteDefinitions, createSignerD1DoStorageTarget, createSigningSessionSealOptions, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, createStaticWalletConsoleBindingV1, createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1, createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, createWalletConsoleOpsClient, createWalletConsoleRelayProxyExtensionV1, createWalletControlClientBindings, createWalletRegistrationContextResolver, createWalletRuntimeOpsHandler, d1ChangedRows, d1Integer, d1Number, decideRouterAbEcdsaOwnerOperationAuthorization, decideRouterAbEd25519OwnerOperationAuthorization, decodeEvmBlockHeader, decodeEvmTransactionByHash, decodeEvmTransactionCall, decodeEvmTransactionReceipt, decodeJsonRpcEnvelope, decodeWalletConsoleTenantRootActiveLineageRequestV1, decodeWalletConsoleTenantRootActiveLineageResponseV1, defineRoute, defineRouteExtension, deriveJwtExpiresAtIso, deriveRecoveryCodeLocatorV1FromBytes, digestOpaqueValue, encodeEip1559SignedTxFromSignature65, encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1, encodeRouterAbEd25519YaoProductRegistrationStateV1, encodeSessionJsonSegment, encodeTenantRootIdentityV1, enforceDelegatePolicy, enforceRoutePolicy, ensureEvmCryptoWasm, ensureLeadingSlash, ensureWalletAuthMethodStoreD1Schema, ensureWalletStoreD1Schema, evaluateRouterAbNormalSigningAdmission, executeRouterAbEd25519YaoAdmittedRegistrationV1, executeSignedDelegateWithRelayer, extractBearerCredential, extractRouterApiEnvironmentId, findRouteDefinitionById, findRouteDefinitionForRequest, formatD1ExecStatement, getRouterApiRouteExtensionDefinitions, getRouterApiRouteExtensionRoutes, getRouterApiRouteExtensionsForTransport, handleRouterAbEcdsaDerivationNormalSigningRouteCore, handleRouterAbEd25519YaoExportRequestScopedCloudflareV1, handleRouterAbEd25519YaoRecoveryRequestScopedCloudflareV1, handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1, handleStaticWalletConsoleRequestV1, handleWalletControlRequest, headersToRecord, isD1DatabaseLike, isObject, isPlainObject, json, jsonFailure, keccak256Bytes, linkedDeviceSignerManifestsEqualV1, linkedDeviceX25519RecipientPublicKeyB64uV1, loadCloudflareSignerWasmModule, matchesRouteDefinitionRequest, mergeRouterAbEd25519YaoProductRegistrationStatePartitionV1, mintRouterAbEd25519YaoRegistrationIdentityV1, normalizeBoundedPositiveInteger, normalizeCorsOrigin, normalizeD1RouterApiAuthOptions, normalizeHashToBytes, normalizeLinkedDevicePasskeyTargetConfigurationV1, normalizeLogger, normalizeLowercaseString, normalizeSessionString, normalizeSessionTtlSeconds, normalizeSourceIp, normalizeTrimmedString, normalizeWalletAuthMethod, normalizeWalletAuthMethodV2, parseBooleanFlag, parseBooleanJwtClaim, parseCacheControlMaxAgeSec, parseCsvList, parseD1JsonArrayColumn, parseD1JsonColumn, parseD1JsonObjectColumn, parseD1LinkedDeviceSessionRowV1, parseD1LinkedDeviceSessionTranscriptRowV1, parseGoogleEmailOtpRegistrationAttemptRecord, parseGoogleEmailOtpRegistrationOfferCandidates, parseGoogleJwks, parseGoogleLoginVerifyRequest, parseInstalledEcdsaCustodySnapshotV1, parseJwtAud, parseLinkedDeviceSessionRecordV1, parseOrgId, parseRecoveryCodeLocatorV1, parseRouterAbEcdsaEd25519PrivateJwk, parseRouterAbEcdsaPresignRuntimeConfig, parseRouterAbEcdsaStrictRegistrationTopology, parseRouterAbEd25519NormalSigningScopeV2, parseRouterAbEd25519OperationStepUpScope, parseRouterAbEd25519YaoActivationKeysetFromEnvV1, parseRouterAbEd25519YaoCeremonyKeyV1, parseRouterAbEd25519YaoExportAdmissionEnvelopeV1, parseRouterAbEd25519YaoExportExecuteEnvelopeV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordJsonV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoProductRegistrationStateJsonV1, parseRouterAbEd25519YaoProductRegistrationStateV1, parseRouterAbEd25519YaoRegistrationAdmissionReadV1, parseRouterAbEd25519YaoRegistrationRouterAnswerV1, parseRouterAbEd25519YaoTenantRootWireV1, parseRouterAbOperationStepUpOperation, parseRouterAbPublicKeysetV2, parseRpcHexQuantity, parseRs256JwtForVerification, parseSessionJwt, parseSigningSessionSealRootConfig, parseStaticWalletConsoleBindingConfigV1, parseStoredRouterAbEcdsaPendingActivationV1, parseWalletEd25519SignerRecord, parseWalletId, parseWalletRecoveryOperationId, parseWalletRegistrationContextResponse, parseWalletRegistrationSetupRequest, parseWalletRegistrationSetupReservation, parseWalletRuntimeExecuteSignedDelegateRequest, parseWalletRuntimeExecuteSignedDelegateResponse, parseWalletRuntimeExecuteSignedDelegateResult, parseWalletRuntimeRelayerAccount, parseWalletRuntimeWalletIdentitiesResult, parseWalletRuntimeWalletIdentityRequest, parseWebAuthnRpId, parseWebAuthnSyncChallengeRecord, partitionRouterAbEd25519YaoProductRegistrationStateV1, postRouterAbSigningWorkerJson, prepareD1TenantStatement, prepareD1WalletAuthMethodInsertStatement, prepareD1WalletAuthMethodPutStatement, prepareD1WalletAuthMethodV2PutStatement, prepareD1WalletPutSignerStatement, prepareD1WalletPutSubjectStatement, prepareD1WebAuthnAuthenticatorInsertStatement, prepareD1WebAuthnAuthenticatorPutStatement, projectRouterAbEd25519YaoExactWalletSession, proposeWalletRegistrationSetup, publishableKeyRoutePrincipal, queryD1All, queryD1One, randomTenantRootCreationGrantBytesV1, readD1LinkedDeviceEcdsaSourceV1, readD1LinkedDeviceEd25519SourceV1, readEnvironmentCsv, readEnvironmentString, readJson, registrationPreparationIdFromString, requireD1RouterApiAuthScopeString, requireEnvironmentString, requireNormalizedSessionString, requireRuntimePolicyScope, resolveFreshRouterAbEcdsaMaterialActivation, resolvePublishableKeyApiCredentialAuth, resolveRequestOriginRateLimitKeyFromFetchHeaders, resolveRouterAbEd25519YaoCeremonyKeyFromRequestV1, resolveRuntimeTenantRootLineage, resolveSecretKeyApiCredentialAuth, resolveSourceIpFromFetchHeaders, resolveWalletRegistrationContext, resumeRegistrationDirectoryPublicationsV1, routeError, routeJson, routerAbEcdsaAtomicAuthorizationConfigured, routerAbEcdsaOperationInProgressResult, routerAbEcdsaOwnerOperationFailureResult, routerAbEcdsaRecordedResponse, routerAbEcdsaReplayHttpResponse, routerAbEcdsaReplayResult, routerAbEcdsaReplayUnavailableResult, routerAbEcdsaStrictRegistrationFactsBindingJson, routerAbEcdsaStrictRegistrationRequestBindingJson, routerAbEcdsaStrictRegistrationRequestMatchesFacts, routerAbEd25519OwnerOperationFailureResult, routerAbEd25519YaoAdmittedRegistrationAuthorityV1, routerAbEd25519YaoPartitionedStateAfterStoredCommitV1, routerAbEd25519YaoPersistedCapabilityMatchesLookupV1, routerAbEd25519YaoRegistrationExecutionTimingEntriesV1, routerAbEd25519YaoRegistrationSigningRootIdV1, routerAbEd25519YaoTenantRootWireV1, runRouterAbEd25519YaoProductRegistrationRequestScopedV1, runRouterAbEd25519YaoRegistrationSideEffectV1, runRouterAbEd25519YaoRegistrationTwoPhaseV1, runRouterAbPrewarmScheduledV1, runtimePolicyScopeKey, sameRouterAbEd25519YaoSharedStateCanonicalEncodingV1, secp256k1PrivateKey32ToPublicKey33, secp256k1PublicKey33ToEthereumAddress, secureRandomBase36, secureRandomBase64Url, selectWalletEd25519Signer, sessionJwtTimeClaims, sha256Bytes, sha256BytesSync, signSecp256k1Recoverable, signTenantRootCreationGrantV1, tenantRootIdentityDigestB64uV1, tenantStorageRouteBackendFamily, tenantStorageRouteDiagnostic, toFetchRouteResponse, normalizeOptionalTrimmedString as toOptionalTrimmedString, toResponse, toSessionArrayBufferCopy, unavailableRegistrationContext, validateDelegateExpiryAndNonce, validateGoogleIdTokenClaims, validateRuntimeSnapshotExpectation, validateSecp256k1PublicKey33, verifyGoogleOidcToken, verifyRs256JwtSignature, verifySecp256k1Bip340SignatureAgainstPublicKey33, verifySecp256k1RecoverableSignatureAgainstPublicKey33, walletAuthMethodId, walletAuthMethodV2Id, walletConsoleApiWalletGetRouteDefinitionV1, walletConsoleApiWalletListRouteDefinitionV1, walletConsoleApiWalletSearchRouteDefinitionV1, walletConsoleRelayRouteDefinitionsV1, walletConsoleSignedDelegateRouteDefinitionV1, walletConsoleSponsoredEvmCallRouteDefinitionV1, walletObjectIdentity, walletRegistrationContext, walletRegistrationSetupRequestDigest, webAuthnCredentialIdB64uFromCredential, withCors };

package/dist/esm/local-hosted-wallet-gateway-worker.js

@@ -1,12 +1,14 @@
 import { runRouterAbPrewarmScheduledV1 } from "./router/cloudflare/runtime/routerAbPrewarm.js";
 import "./cloud-host.js";
-import { handleLocalHostedWalletGatewayRequestV1 } from "./localHostedWalletGatewayHandler.js";
+import { handleLocalHostedWalletGatewayRequestV1, resumeLocalRegistrationDirectoryPublicationsV1 } from "./localHostedWalletGatewayHandler.js";
 //#region src/local-hosted-wallet-gateway-worker.ts
 async function fetch(request, env, ctx) {
 	return await handleLocalHostedWalletGatewayRequestV1(request, env, ctx);
 }
 async function scheduled(event, env, _ctx) {
-	await runRouterAbPrewarmScheduledV1(event, env);
+	const [prewarm, publications] = await Promise.allSettled([runRouterAbPrewarmScheduledV1(event, env), resumeLocalRegistrationDirectoryPublicationsV1(env)]);
+	if (prewarm.status === "rejected") throw prewarm.reason;
+	if (publications.status === "rejected") throw publications.reason;
 }
 var local_hosted_wallet_gateway_worker_default = {
 	fetch,

package/dist/esm/localHostedWalletGatewayHandler.js

@@ -5,6 +5,7 @@ import { LocalRegistrationSetupAuthority } from "./localRegistrationSetupAuthori
 import { WALLET_CONSOLE_OP_PATHS_V1 } from "./router/cloudflare/runtime/walletConsoleOps.js";
 import { WalletHomeCustodyBinding } from "./router/cloudflare/runtime/routerAbServiceBindings.js";
 import { createStaticWalletConsoleBindingV1, parseStaticWalletConsoleBindingConfigV1 } from "./router/cloudflare/runtime/staticWalletConsoleBinding.js";
+import { resumeRegistrationDirectoryPublicationsV1 } from "./router/cloudflare/d1/registration/d1WalletExecutionAuthority.js";
 import { handleSplitGatewayRequest } from "./hosted-wallet-gateway.js";
 import { localPresignCancellationProbe } from "./localIntendedPresignCancellation.js";
 import { LOCAL_INTENDED_YAO_FAULT_HEADER_V1, LOCAL_INTENDED_YAO_FAULT_TOKEN_HEADER_V1, LocalIntendedYaoFaultControllerV1, parseLocalIntendedYaoFaultModeV1, parseLocalIntendedYaoFaultTokenV1, requestWithoutLocalIntendedYaoFaultHeadersV1, responseWithLocalIntendedYaoFaultOutcomeV1 } from "./localIntendedYaoFault.js";
@@ -99,6 +100,23 @@ async function handleEcdsaRespondFault(request, env, ctx, dependencies, fault, e
 	}
 	return Response.json({ code: "invalid_intended_ecdsa_fault" }, { status: 400 });
 }
+function localTenantScope(env, config) {
+	return {
+		namespace: requireCanonicalString(env.SEAMS_TENANT_STORAGE_NAMESPACE, "Local namespace"),
+		orgId: config.deployment.orgId,
+		projectId: config.deployment.projectId,
+		envId: config.deployment.environmentKey
+	};
+}
+/** Sends the due directory publications to the local registration authority. */
+async function resumeLocalRegistrationDirectoryPublicationsV1(env) {
+	const scope = localTenantScope(env, parseStaticWalletConsoleBindingConfigV1(JSON.parse(env.WALLET_LOCAL_DEPLOYMENT_JSON)));
+	await resumeRegistrationDirectoryPublicationsV1({
+		database: env.SIGNER_DB,
+		scope,
+		registrationAuthority: new LocalRegistrationSetupAuthority(env.SIGNER_DB, scope)
+	});
+}
 /**
 * The local Gateway: the hosted Gateway handler plus the intended-suite
 * transport faults, which a request arms with local-only headers. The local
@@ -106,12 +124,7 @@ async function handleEcdsaRespondFault(request, env, ctx, dependencies, fault, e
 */
 async function handleLocalHostedWalletGatewayRequestV1(request, env, ctx, dependencies) {
 	const config = parseStaticWalletConsoleBindingConfigV1(JSON.parse(env.WALLET_LOCAL_DEPLOYMENT_JSON));
-	const tenantScope = {
-		namespace: requireCanonicalString(env.SEAMS_TENANT_STORAGE_NAMESPACE, "Local namespace"),
-		orgId: config.deployment.orgId,
-		projectId: config.deployment.projectId,
-		envId: config.deployment.environmentKey
-	};
+	const tenantScope = localTenantScope(env, config);
 	dependencies = {
 		emailOtpDeliveryProvider: dependencies?.emailOtpDeliveryProvider,
 		signerWasm: dependencies?.signerWasm,
@@ -328,6 +341,6 @@ async function handleEcdsaFinalizeFault(request, env, ctx, dependencies, rawMode
 	}, ctx, dependencies), controller.consumeOutcome(), token);
 }
 //#endregion
-export { handleLocalHostedWalletGatewayRequestV1 };
+export { handleLocalHostedWalletGatewayRequestV1, resumeLocalRegistrationDirectoryPublicationsV1 };
 
 //# sourceMappingURL=localHostedWalletGatewayHandler.js.map

package/dist/esm/router/cloudflare/d1/registration/d1WalletExecutionAuthority.js

@@ -1,6 +1,9 @@
 import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
 import { prepareD1TenantStatement } from "../../../../core/d1TenantStore.js";
 //#region src/router/cloudflare/d1/registration/d1WalletExecutionAuthority.ts
+/** The finalize response normally delivers first; the scheduled resumption waits this long. */
+const DIRECTORY_PUBLICATION_FIRST_RETRY_MS = 6e4;
+const DIRECTORY_PUBLICATION_MAX_RETRY_MS = 36e5;
 var D1WalletExecutionAuthority = class {
 	constructor(database, scope, registration) {
 		this.database = database;
@@ -83,23 +86,104 @@ var D1WalletExecutionAuthority = class {
 		await this.database.batch(this.prepareState(input, "retired"));
 		return completed;
 	}
-	async publishEstablished(input) {
-		if (input.registration.state === "active") return {
-			ok: true,
-			activation: null
-		};
-		const completed = await this.registration.complete({
-			ceremonyId: input.registration.ceremonyId,
+	prepareEstablished(input) {
+		if (input.registration.state === "active") return null;
+		const publication = {
 			walletId: input.registration.walletId,
-			outcome: "established",
-			session: input.session
-		});
-		if (!completed.ok) return completed;
+			ceremonyId: input.registration.ceremonyId,
+			digest: input.session.digest,
+			expiresAtMs: input.session.expiresAtMs,
+			attempts: 0
+		};
 		return {
-			ok: true,
-			activation: { statements: this.prepareState(input.registration, "active") }
+			statements: [...this.prepareState(input.registration, "active"), prepareD1TenantStatement(this.database, this.scope, `INSERT INTO wallet_registration_directory_publications
+             (namespace, org_id, project_id, env_id, wallet_id, ceremony_id,
+              session_digest, session_expires_at_ms, next_attempt_at_ms)
+           VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9)
+           ON CONFLICT DO NOTHING`, [
+				publication.walletId,
+				publication.ceremonyId,
+				publication.digest,
+				publication.expiresAtMs,
+				Date.now() + DIRECTORY_PUBLICATION_FIRST_RETRY_MS
+			])],
+			publish: async () => {
+				try {
+					await this.deliver(publication);
+				} catch (error) {
+					console.warn("[wallet-registration] directory publication stays pending", error);
+				}
+			}
 		};
 	}
+	/** Sends the publications that are due, oldest first, one at a time. */
+	async resumeDirectoryPublications(input) {
+		const due = await prepareD1TenantStatement(this.database, this.scope, `SELECT wallet_id, ceremony_id, session_digest, session_expires_at_ms, attempts
+       FROM wallet_registration_directory_publications
+       WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+         AND state = 'pending' AND next_attempt_at_ms <= ?5
+       ORDER BY next_attempt_at_ms LIMIT ?6`, [input.nowMs, input.limit]).all();
+		if (!due.success) throw new Error("Registration directory publication read failed");
+		const delivered = {
+			acknowledged: 0,
+			deferred: 0,
+			refused: 0
+		};
+		for (const row of due.results ?? []) {
+			const outcome = await this.deliver({
+				walletId: row.wallet_id,
+				ceremonyId: row.ceremony_id,
+				digest: row.session_digest,
+				expiresAtMs: row.session_expires_at_ms,
+				attempts: row.attempts
+			});
+			delivered[outcome] += 1;
+		}
+		return delivered;
+	}
+	async deliver(publication) {
+		let completed;
+		try {
+			completed = await this.registration.complete({
+				ceremonyId: publication.ceremonyId,
+				walletId: publication.walletId,
+				outcome: "established",
+				session: {
+					kind: "credential",
+					walletId: publication.walletId,
+					digest: publication.digest,
+					expiresAtMs: publication.expiresAtMs
+				}
+			});
+		} catch (error) {
+			console.warn("[wallet-registration] directory publication deferred", error);
+			const delayMs = Math.min(DIRECTORY_PUBLICATION_FIRST_RETRY_MS * 2 ** Math.min(publication.attempts + 1, 16), DIRECTORY_PUBLICATION_MAX_RETRY_MS);
+			await this.preparePublicationUpdate(publication, `attempts = attempts + 1, next_attempt_at_ms = ?7`, [Date.now() + delayMs]).run();
+			return "deferred";
+		}
+		if (!completed.ok) {
+			console.error("[wallet-registration] directory refused an established registration", {
+				walletId: publication.walletId,
+				ceremonyId: publication.ceremonyId,
+				code: completed.code
+			});
+			await this.preparePublicationUpdate(publication, `state = 'refused'`, []).run();
+			return "refused";
+		}
+		await prepareD1TenantStatement(this.database, this.scope, `DELETE FROM wallet_registration_directory_publications
+       WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+         AND wallet_id = ?5 AND ceremony_id = ?6 AND state = 'pending'`, [publication.walletId, publication.ceremonyId]).run();
+		return "acknowledged";
+	}
+	preparePublicationUpdate(publication, assignments, values) {
+		return prepareD1TenantStatement(this.database, this.scope, `UPDATE wallet_registration_directory_publications SET ${assignments}
+       WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+         AND wallet_id = ?5 AND ceremony_id = ?6 AND state = 'pending'`, [
+			publication.walletId,
+			publication.ceremonyId,
+			...values
+		]);
+	}
 	async fixCancellation(input) {
 		await this.database.batch([prepareD1TenantStatement(this.database, this.scope, `UPDATE wallet_execution_generations
          SET registration_completion = 'cancelled', state = 'retired'
@@ -162,7 +246,18 @@ async function admitD1EstablishedWalletHome(database, scope, input) {
 		ownershipGeneration: row.generation
 	};
 }
+/**
+* Sends the due directory publications of one tenant scope. The Gateway's
+* scheduled handler runs it, so a publication that the finalize response could
+* not deliver still reaches the directory.
+*/
+function resumeRegistrationDirectoryPublicationsV1(input) {
+	return new D1WalletExecutionAuthority(input.database, input.scope, input.registrationAuthority).resumeDirectoryPublications({
+		nowMs: input.nowMs ?? Date.now(),
+		limit: input.limit ?? 20
+	});
+}
 //#endregion
-export { D1WalletExecutionAuthority, admitD1EstablishedWalletHome, prepareD1RegistrationHomeReservation };
+export { D1WalletExecutionAuthority, admitD1EstablishedWalletHome, prepareD1RegistrationHomeReservation, resumeRegistrationDirectoryPublicationsV1 };
 
 //# sourceMappingURL=d1WalletExecutionAuthority.js.map

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationService.js

@@ -68,6 +68,17 @@ async function buildRespondEd25519AdmissionRequest(input) {
 		materialActivation: mint.materialActivation
 	});
 }
+/**
+* Sends the directory publication that a completed registration operation
+* recorded as pending. The response does not wait for it when the runtime keeps
+* background work; a failed delivery stays pending for the scheduled resumption.
+*/
+async function publishCompletedRegistration(execution, waitUntil) {
+	const activation = registrationCommitActivation(execution);
+	if (!activation) return;
+	if (waitUntil) waitUntil(activation.publish());
+	else await activation.publish();
+}
 function ignoreRespondExecutionFailure() {
 	return null;
 }
@@ -2425,7 +2436,9 @@ var CloudflareD1WalletRegistrationService = class {
 			recordRegistrationServerTiming(serverTiming, "near_finalize_side_effect", sideEffectStartedAtMs);
 			switch (run.kind) {
 				case "executed":
-				case "exact_replay": break;
+				case "exact_replay":
+					await publishCompletedRegistration(run.value, waitUntil);
+					break;
 				case "request_conflict": return {
 					ok: false,
 					code: "idempotency_conflict",
@@ -2767,7 +2780,7 @@ var CloudflareD1WalletRegistrationService = class {
 	* before execution; an ambiguous outcome after the custody call stays
 	* `uncertain` rather than being guessed either way.
 	*/
-	async activateWalletRegistration(input, traceContext, serverTiming) {
+	async activateWalletRegistration(input, traceContext, serverTiming, waitUntil) {
 		try {
 			const verifiedSetup = await verifyWalletRegistrationSetupClaims(input.verifier, input.signedSetup, {
 				registrationCeremonyId: input.registrationCeremonyId,
@@ -2830,6 +2843,7 @@ var CloudflareD1WalletRegistrationService = class {
 			switch (run.kind) {
 				case "executed":
 				case "exact_replay":
+					await publishCompletedRegistration(run.value, waitUntil);
 					if (run.value.response.ok && run.value.response.kind === "evm_family_ecdsa") await cleanupFinalizedRegistrationCeremony({
 						store: this.getRegistrationCeremonyIntentStore(),
 						registrationCeremonyId: claims.registrationCeremonyId

package/dist/esm/router/cloudflare/d1/registration/walletRegistrationEstablishedSessionIssuer.js

@@ -49,9 +49,9 @@ function requireWalletSessionPrincipalId(value) {
 	if (!parsed.ok) throw new Error(`Wallet Session principal is invalid: ${parsed.error.message}`);
 	return parsed.value;
 }
-function publishCommittedRegistration(home, committed) {
-	if (!committed.registration) throw new Error("Registration publication requires a committed registration session");
-	return home.publishEstablished({
+function prepareCommittedRegistrationActivation(home, committed) {
+	if (!committed.registration) throw new Error("Registration activation requires a committed registration session");
+	return home.prepareEstablished({
 		registration: committed.registration,
 		session: committed.publication
 	});
@@ -346,13 +346,11 @@ async function issueDirectRegistrationEstablishedEcdsaSession(input) {
 		runtimePolicyScope: input.runtimePolicyScope,
 		keyHandle
 	});
-	const published = await publishCommittedRegistration(input.homeCompletion, committed);
-	if (!published.ok) throw new Error(published.message);
 	return directRegistrationResultFromIssue({
 		directIssue,
 		authorization,
 		tokens,
-		activation: published.activation
+		activation: prepareCommittedRegistrationActivation(input.homeCompletion, committed)
 	});
 }
 async function issueDirectRegistrationEstablishedEd25519Session(input) {
@@ -417,16 +415,13 @@ async function issueDirectRegistrationEstablishedEd25519Session(input) {
 		}).ed25519,
 		predecessor: input.predecessor
 	});
-	const [publication, preparation] = await Promise.allSettled([publishCommittedRegistration(input.homeCompletion, committed), input.onSessionCommitted?.(projectDirectRegistrationSession(authorization, tokens))]);
-	if (publication.status === "rejected") throw publication.reason;
-	if (preparation.status === "rejected") throw preparation.reason;
-	const published = publication.value;
-	if (!published.ok) throw new Error(published.message);
+	const activation = prepareCommittedRegistrationActivation(input.homeCompletion, committed);
+	await input.onSessionCommitted?.(projectDirectRegistrationSession(authorization, tokens));
 	return directRegistrationResultFromIssue({
 		directIssue,
 		authorization,
 		tokens,
-		activation: published.activation
+		activation
 	});
 }
 function projectCurrentNearRegistrationSession(authorization, tokens) {

package/dist/esm/router/cloudflare.js

@@ -14366,7 +14366,7 @@ async function handleRouterApiWalletRegistrationActivate(input) {
 		...body.emailOtpEnrollment ? { emailOtpEnrollment: body.emailOtpEnrollment } : {},
 		...body.walletCustodyCommit !== void 0 ? { walletCustodyCommit: body.walletCustodyCommit } : {},
 		verifier: session
-	}, traceContext.value ?? void 0, serverTiming);
+	}, traceContext.value ?? void 0, serverTiming, input.waitUntil);
 	if (!result.ok) return routeJson(400, result);
 	if (!isEmailOtpWalletRegistrationActivateSuccessV2(result) && !isPasskeyWalletRegistrationActivateSuccessV2(result)) return routeError(500, "internal", "Wallet registration activation returned an invalid authority");
 	return routeJson(200, result, { headers: registrationServerTimingHeaders(serverTiming) });

package/dist/esm/router/domains/walletRegistration/walletRegistrationRoutes.js

@@ -1891,7 +1891,7 @@ async function handleRouterApiWalletRegistrationActivate(input) {
 		...body.emailOtpEnrollment ? { emailOtpEnrollment: body.emailOtpEnrollment } : {},
 		...body.walletCustodyCommit !== void 0 ? { walletCustodyCommit: body.walletCustodyCommit } : {},
 		verifier: session
-	}, traceContext.value ?? void 0, serverTiming);
+	}, traceContext.value ?? void 0, serverTiming, input.waitUntil);
 	if (!result.ok) return routeJson(400, result);
 	if (!isEmailOtpWalletRegistrationActivateSuccessV2(result) && !isPasskeyWalletRegistrationActivateSuccessV2(result)) return routeError(500, "internal", "Wallet registration activation returned an invalid authority");
 	return routeJson(200, result, { headers: registrationServerTimingHeaders(serverTiming) });

package/dist/types/wallet-server/src/cloud-host.d.ts

@@ -119,7 +119,7 @@ export type { LinkedDeviceBootstrapStore, LinkedDeviceBootstrapResult, } from '.
 export { parseLinkedDeviceSessionRecordV1 } from './core/deviceLinking/linkedDeviceSessionRecord';
 export type { LinkedDeviceSessionRecordV1 } from './core/deviceLinking/linkedDeviceSessionRecord';
 export { computeLinkedDeviceSessionClaimDigestV1 } from '../../shared-ts/src/device-linking/digests';
-export { admitD1EstablishedWalletHome } from './router/cloudflare/d1/registration/d1WalletExecutionAuthority';
+export { admitD1EstablishedWalletHome, resumeRegistrationDirectoryPublicationsV1, type RegistrationDirectoryPublicationDelivery, } from './router/cloudflare/d1/registration/d1WalletExecutionAuthority';
 export { D1WalletObjectAddresses } from './router/cloudflare/d1/walletObjectAddresses';
 export { walletObjectIdentity, WalletObjectAddressSnapshot, type WalletObjectIdentity } from './router/cloudflare/runtime/walletObjectAddresses';
 //# sourceMappingURL=cloud-host.d.ts.map

package/dist/types/wallet-server/src/localHostedWalletGatewayHandler.d.ts

@@ -3,6 +3,8 @@ import type { CfExecutionContext } from './router/cloudflare/runtime/cloudflare.
 export type LocalHostedWalletGatewayEnv = CloudflareD1GatewayBaseEnv & {
     readonly WALLET_LOCAL_DEPLOYMENT_JSON: string;
 };
+/** Sends the due directory publications to the local registration authority. */
+export declare function resumeLocalRegistrationDirectoryPublicationsV1(env: LocalHostedWalletGatewayEnv): Promise<void>;
 /**
  * The local Gateway: the hosted Gateway handler plus the intended-suite
  * transport faults, which a request arms with local-only headers. The local

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletExecutionAuthority.d.ts

@@ -1,6 +1,6 @@
 import { type D1TenantScope } from '../../../../core/d1TenantStore';
 import type { D1DatabaseLike, D1ResultLike } from '../../../../storage/tenantRoute';
-import type { RegistrationEstablishedPublication, WalletExecutionAuthority, WalletRegistrationHomeAuthority, WalletRegistrationReservationAuthority } from '../../../domains/walletRegistration/walletRegistrationReservation';
+import type { RegistrationActivationWrite, WalletExecutionAuthority, WalletRegistrationHomeAuthority, WalletRegistrationReservationAuthority } from '../../../domains/walletRegistration/walletRegistrationReservation';
 type Authority = WalletRegistrationReservationAuthority;
 type HomeAdmission = Awaited<ReturnType<Authority['admitHome']>>;
 type OrdinaryAdmission = Awaited<ReturnType<WalletExecutionAuthority['admitEstablishedHome']>>;
@@ -10,6 +10,7 @@ type RegistrationHomeRow = {
     readonly registration_completion: string;
     readonly relocation_blocked: number;
 };
+export type RegistrationDirectoryPublicationDelivery = 'acknowledged' | 'deferred' | 'refused';
 export declare class D1WalletExecutionAuthority implements WalletRegistrationHomeAuthority, WalletExecutionAuthority {
     private readonly database;
     private readonly scope;
@@ -26,7 +27,14 @@ export declare class D1WalletExecutionAuthority implements WalletRegistrationHom
         readonly code: string;
         readonly message: string;
     }>;
-    publishEstablished(input: Parameters<WalletRegistrationHomeAuthority['publishEstablished']>[0]): Promise<RegistrationEstablishedPublication>;
+    prepareEstablished(input: Parameters<WalletRegistrationHomeAuthority['prepareEstablished']>[0]): RegistrationActivationWrite | null;
+    /** Sends the publications that are due, oldest first, one at a time. */
+    resumeDirectoryPublications(input: {
+        readonly nowMs: number;
+        readonly limit: number;
+    }): Promise<Record<RegistrationDirectoryPublicationDelivery, number>>;
+    private deliver;
+    private preparePublicationUpdate;
     private fixCancellation;
     /** The state update with its guard. The guard reads the row count of the update before it. */
     private prepareState;
@@ -37,5 +45,17 @@ export declare function prepareD1RegistrationHomeReservation(database: D1Databas
     readonly ownershipGeneration: number;
 }): import("../../../cloudflare-adaptor").D1PreparedStatementLike[];
 export declare function admitD1EstablishedWalletHome(database: D1DatabaseLike, scope: D1TenantScope, input: Parameters<WalletExecutionAuthority['admitEstablishedHome']>[0]): Promise<OrdinaryAdmission>;
+/**
+ * Sends the due directory publications of one tenant scope. The Gateway's
+ * scheduled handler runs it, so a publication that the finalize response could
+ * not deliver still reaches the directory.
+ */
+export declare function resumeRegistrationDirectoryPublicationsV1(input: {
+    readonly database: D1DatabaseLike;
+    readonly scope: D1TenantScope;
+    readonly registrationAuthority: Authority;
+    readonly nowMs?: number;
+    readonly limit?: number;
+}): Promise<Record<RegistrationDirectoryPublicationDelivery, number>>;
 export {};
 //# sourceMappingURL=d1WalletExecutionAuthority.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationService.d.ts

@@ -320,7 +320,7 @@ export declare class CloudflareD1WalletRegistrationService {
      * before execution; an ambiguous outcome after the custody call stays
      * `uncertain` rather than being guessed either way.
      */
-    activateWalletRegistration(input: WalletRegistrationActivateInput, traceContext?: RouterAbTraceContextV1, serverTiming?: Array<readonly [string, number]>): Promise<WalletRegistrationActivateResponseV2>;
+    activateWalletRegistration(input: WalletRegistrationActivateInput, traceContext?: RouterAbTraceContextV1, serverTiming?: Array<readonly [string, number]>, waitUntil?: (promise: Promise<unknown>) => void): Promise<WalletRegistrationActivateResponseV2>;
     /**
      * Router/SigningWorker activation followed by the blocking finalize
      * persistence, as one unit inside the operation row. The commit is told the

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/walletRegistrationEstablishedSessionIssuer.d.ts

@@ -18,7 +18,7 @@ type RegistrationEstablishedSessionIssuanceDependencies = {
     readonly authorizationService: RegistrationEstablishedSessionIssuerAuthorizationService;
     readonly authorizationTenantId: TenantId;
     readonly foundingAuthority: ActiveWalletAuthorityV1;
-    readonly homeCompletion: Pick<WalletRegistrationHomeAuthority, 'publishEstablished'>;
+    readonly homeCompletion: Pick<WalletRegistrationHomeAuthority, 'prepareEstablished'>;
 };
 export type RegistrationInitialSessionCommit = {
     readonly kind: 'uncommitted';

package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationReservation.d.ts

@@ -93,37 +93,32 @@ export interface WalletRegistrationReservationAuthority {
     })): Promise<ReservationOutcome>;
 }
 /**
- * The local write that makes an established registration active. It follows
- * the acknowledged directory write. It commits in the batch of the record
+ * The local write that makes an established registration active and records
+ * its directory publication as pending. It commits in the batch of the record
  * that completes the registration operation, or it does not commit.
  */
 export type RegistrationActivationWrite = {
     readonly statements: readonly D1PreparedStatementLike[];
-};
-export type RegistrationEstablishedPublication = {
-    readonly ok: true;
-    /** None when an earlier completion already activated the registration. */
-    readonly activation: RegistrationActivationWrite | null;
-    readonly code?: never;
-    readonly message?: never;
-} | {
-    readonly ok: false;
-    readonly code: string;
-    readonly message: string;
-    readonly activation?: never;
+    /**
+     * Sends the pending directory publication. Call it only after the statements
+     * commit. It never throws: a failed delivery stays pending for the next attempt.
+     */
+    readonly publish: () => Promise<void>;
 };
 /** The registration authority at the wallet's home, which owns the local activation. */
 export interface WalletRegistrationHomeAuthority extends Pick<WalletRegistrationReservationAuthority, 'reserve' | 'admitHome'> {
     /**
-     * Publishes the committed registration decision to its directory and prepares the
-     * activation. The caller commits the activation with its completion record.
+     * Prepares the activation of the committed registration decision with its
+     * pending directory publication. None when an earlier completion already
+     * activated the registration. The caller commits the activation with its
+     * completion record, then publishes.
      */
-    publishEstablished(input: {
+    prepareEstablished(input: {
         readonly registration: CommittedWalletRegistration;
         readonly session: WalletSessionLocatorPublication & {
             readonly kind: 'credential';
         };
-    }): Promise<RegistrationEstablishedPublication>;
+    }): RegistrationActivationWrite | null;
     /** Fixes a definitive cancellation, publishes it, and retires the local home. */
     cancel(input: {
         readonly ceremonyId: string;

package/dist/types/wallet-server/src/router/framework/authServicePort.d.ts

@@ -1033,7 +1033,7 @@ export interface RouterApiWalletRegistrationService {
     setupWalletRegistration(input: WalletRegistrationSetupInput): Promise<RouteResponse>;
     respondWalletRegistration(input: WalletRegistrationRespondInput, traceContext?: RouterAbTraceContextV1, serverTiming?: Array<readonly [string, number]>, waitUntil?: (promise: Promise<unknown>) => void): Promise<WalletRegistrationRespondResponseV2>;
     authorizeWalletRegistrationNearAdmission(input: WalletRegistrationNearAdmissionInput): Promise<WalletRegistrationNearAdmissionResponseV2>;
-    activateWalletRegistration(input: WalletRegistrationActivateInput, traceContext?: RouterAbTraceContextV1, serverTiming?: Array<readonly [string, number]>): Promise<WalletRegistrationActivateResponseV2>;
+    activateWalletRegistration(input: WalletRegistrationActivateInput, traceContext?: RouterAbTraceContextV1, serverTiming?: Array<readonly [string, number]>, waitUntil?: (promise: Promise<unknown>) => void): Promise<WalletRegistrationActivateResponseV2>;
     completeWalletRegistrationNearProvisioning(input: WalletRegistrationNearProvisioningInput, serverTiming?: Array<readonly [string, number]>, waitUntil?: (promise: Promise<unknown>) => void): Promise<WalletRegistrationNearProvisioningResponseV2>;
     refreshEd25519YaoWalletSession(input: RouterAbEd25519YaoBudgetRefreshRequestV1): Promise<RouterAbEd25519YaoBudgetRefreshResponseV1>;
     provisionEd25519YaoWalletSession(input: RouterAbEd25519YaoVerifiedWalletUnlockRequestV1): Promise<RouterAbEd25519YaoVerifiedWalletUnlockResponseV1>;

package/migrations/d1-signer/0081_registration_directory_publications.sql

@@ -0,0 +1,26 @@
+-- An active registration home whose directory write has no acknowledgement yet.
+-- The batch that completes the registration operation and activates the home
+-- inserts the row; the acknowledgement deletes it. A refused row stays for an operator.
+CREATE TABLE wallet_registration_directory_publications (
+  namespace TEXT NOT NULL, org_id TEXT NOT NULL, project_id TEXT NOT NULL, env_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL,
+  ceremony_id TEXT NOT NULL CHECK(length(ceremony_id) > 0),
+  session_digest TEXT NOT NULL CHECK(length(session_digest) > 0),
+  session_expires_at_ms INTEGER NOT NULL
+    CHECK(session_expires_at_ms > 0 AND session_expires_at_ms <= 9007199254740991),
+  state TEXT NOT NULL DEFAULT 'pending' CHECK(state IN ('pending', 'refused')),
+  attempts INTEGER NOT NULL DEFAULT 0 CHECK(attempts >= 0),
+  next_attempt_at_ms INTEGER NOT NULL CHECK(next_attempt_at_ms > 0),
+  PRIMARY KEY(namespace, org_id, project_id, env_id, wallet_id)
+);
+
+CREATE INDEX wallet_registration_directory_publications_due
+  ON wallet_registration_directory_publications(namespace, org_id, project_id, env_id, state, next_attempt_at_ms);
+
+CREATE TRIGGER wallet_registration_directory_publication_identity
+BEFORE UPDATE ON wallet_registration_directory_publications
+WHEN NEW.wallet_id IS NOT OLD.wallet_id OR NEW.ceremony_id IS NOT OLD.ceremony_id
+  OR NEW.session_digest IS NOT OLD.session_digest
+  OR NEW.session_expires_at_ms IS NOT OLD.session_expires_at_ms
+  OR (OLD.state = 'refused' AND NEW.state != 'refused')
+BEGIN SELECT RAISE(ABORT, 'wallet_registration_directory_publication_conflicts'); END;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seams/wallet-server",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "type": "module",
   "description": "Seams server TypeScript SDK for NEAR and EVM-family wallets",
   "main": "./dist/esm/index.js",