@seams/wallet-server 0.14.0 → 0.15.1

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationService.js

@@ -21,33 +21,35 @@ import { ROUTER_AB_ED25519_NORMAL_SIGNING_STATE_KIND } from "../../../../shared-
 import { normalizeThresholdEd25519ParticipantIds } from "../../../../shared-ts/src/threshold/participants.js";
 import { nearEd25519SigningKeyIdFromString, registrationEd25519AuthorityScopeFromAuthority, walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { admitRegistrationReservationHome, cancelRegistrationHome } from "../../../domains/walletRegistration/walletRegistrationReservation.js";
+import { recordRegistrationPromiseTiming, recordRegistrationServerTiming } from "../../../framework/registrationTiming.js";
+import { walletCustodyCeremonyCommitPayloadFromWire } from "../../../../shared-ts/src/passkey-custody/ceremonyCommitPayload.js";
+import "../../../../shared-ts/src/passkey-custody/index.js";
 import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../../shared-ts/src/utils/near.js";
 import { registrationNearEd25519BranchKey } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
-import { buildStoredWalletRegistrationEvmFamilyEcdsaFinalizedBranch, buildStoredWalletRegistrationNearEd25519YaoAuthorizedBranch, findStoredWalletRegistrationEvmFamilyEcdsaBranch, findStoredWalletRegistrationNearEd25519YaoBranch, replaceStoredWalletRegistrationSignerBranch, storedRegistrationAuthoritiesMatch, verifiedRegistrationCeremonyAuthority } from "../../../../core/RegistrationCeremonyStore.js";
 import { registrationIntentGrantFromString } from "../../../../shared-ts/src/utils/registrationIntent.js";
-import { walletCustodyCeremonyCommitPayloadFromWire } from "../../../../shared-ts/src/passkey-custody/ceremonyCommitPayload.js";
-import "../../../../shared-ts/src/passkey-custody/index.js";
-import { parseEcdsaDerivationPublicIdentity, thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
 import { createRouterAbTraceContextV1 } from "../../../../shared-ts/src/utils/routerAbTraceContext.js";
-import { routerAbEcdsaStrictRegistrationRequestBindingJson } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
-import { buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, buildD1WalletRecord, parseWalletIdForIntent, thresholdEcdsaChainTargetsEqual } from "./d1RegistrationCeremonyRecords.js";
-import { createD1RegistrationRouteTimingRecorder, errorMessage, finishD1RegistrationRouteTiming, recordRegistrationPromiseTiming, recordRegistrationServerTiming, registrationSignerBranchesFromPlan, startD1RegistrationRouteTiming } from "./d1RegistrationSetupSupport.js";
 import { buildTenantRootIdentityFromAuthenticatedDeploymentV1 } from "../../../../shared-ts/src/tenant-root/tenantRootIdentity.js";
 import { DEFAULT_WALLET_SESSION_TTL_MS } from "../../../../shared-ts/src/threshold/sessionPolicy.js";
+import { parseEcdsaDerivationPublicIdentity, thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
 import { walletAuthAuthorityFromRegistrationAuthority, walletRegistrationFinalizeAuthMethodFromAuthority } from "../wallet/d1WalletAuthMethodBoundary.js";
 import { buildRouterAbEd25519YaoRegistrationCapabilityRecordV1 } from "../../../domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery.js";
 import { buildRouterAbEd25519YaoProductAdmissionRequestV1, projectRouterAbEd25519YaoExactWalletSession } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js";
 import { routerAbEd25519YaoRegistrationExecutionTimingEntriesV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationRequestScopedCloudflare.js";
 import { runRouterAbEd25519YaoRegistrationSideEffectV2, throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
 import { buildYaoEd25519WalletSignerRecord, ed25519NearPublicKeyFromBytes, implicitNearAccountIdFromEd25519PublicKeyBytes } from "../ed25519Yao/d1Ed25519YaoWalletSigner.js";
+import { buildStoredWalletRegistrationEvmFamilyEcdsaFinalizedBranch, buildStoredWalletRegistrationNearEd25519YaoAuthorizedBranch, findStoredWalletRegistrationEvmFamilyEcdsaBranch, findStoredWalletRegistrationNearEd25519YaoBranch, replaceStoredWalletRegistrationSignerBranch, storedRegistrationAuthoritiesMatch, verifiedRegistrationCeremonyAuthority } from "../../../../core/RegistrationCeremonyStore.js";
+import { routerAbEcdsaStrictRegistrationRequestBindingJson } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
+import { buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, buildD1WalletRecord, parseWalletIdForIntent, thresholdEcdsaChainTargetsEqual } from "./d1RegistrationCeremonyRecords.js";
 import { deriveThresholdEcdsaKeyHandle } from "../../../../shared-ts/src/utils/thresholdEcdsaKeyHandle.js";
 import { isTransientD1Error, retryTransientD1 } from "../../../../storage/d1Retry.js";
+import { registrationCommitCompletionWrite } from "./registrationCompletionWrite.js";
 import { listThresholdEcdsaKeyIdentityTargetsForUser } from "../../../../core/authService/thresholdEcdsaKeyInventory.js";
 import { routerAbEd25519YaoLifecycleDecisionLookupV1, routerAbEd25519YaoLifecycleDecisionV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoLifecycleDecision.js";
 import { reserveRegistrationCustody } from "../../../domains/passkeyCustody/registrationCustodyOutcome.js";
 import { resolveTenantRootIdentityV1 } from "../../../domains/tenantRoot/tenantRootIdentityResolution.js";
 import { walletRegistrationOperationPreparedFromCeremony } from "./d1WalletRegistrationPreparation.js";
 import { computeWalletRegistrationSetupDigestB64u, parseWalletRegistrationSetupClaims, verifySignedWalletRegistrationSetup, verifyWalletRegistrationSetupClaims } from "../../../domains/walletRegistration/walletRegistrationSetupPayload.js";
+import { createD1RegistrationRouteTimingRecorder, errorMessage, finishD1RegistrationRouteTiming, registrationSignerBranchesFromPlan, startD1RegistrationRouteTiming } from "./d1RegistrationSetupSupport.js";
 import { projectWalletRegistrationSessionCommitReceiptV2, registrationCommitActivation, registrationReplayAuthMethodFields, replayedRegistrationCommit, unissuedRegistrationCommit } from "./walletRegistrationSessionCommitReceipt.js";
 import { assertDirectWalletSessionOwnerProof, buildRegistrationOwnerProof, issueDirectRegistrationEstablishedEcdsaSession, issueDirectRegistrationEstablishedEd25519Session, projectCurrentNearRegistrationSession, replayDirectRegistrationEstablishedEcdsaSession, replayDirectRegistrationEstablishedEd25519Session, walletSessionPrincipalId } from "./walletRegistrationEstablishedSessionIssuer.js";
 import { commitWalletRegistration } from "./d1WalletRegistrationInitialSession.js";
@@ -2202,7 +2204,7 @@ var CloudflareD1WalletRegistrationService = class {
 		if (issuance.status === "rejected") throw issuance.reason;
 		if (custody.status === "rejected") throw custody.reason;
 		const issuedRegistrationSession = issuance.value;
-		const custodyField = custody.value.status === "not_requested" ? {} : { walletCustody: custody.value };
+		const custodyField = custody.value.outcome.status === "not_requested" ? {} : { walletCustody: custody.value.outcome };
 		switch (issuedRegistrationSession.kind) {
 			case "issued": return {
 				kind: "session_issued",
@@ -2216,7 +2218,8 @@ var CloudflareD1WalletRegistrationService = class {
 				},
 				issuedAtMs: issuedRegistrationSession.issuedAtMs,
 				expectedOrigin: ownerProofContext.expectedOrigin,
-				activation: issuedRegistrationSession.activation
+				activation: issuedRegistrationSession.activation,
+				custodyWrite: custody.value.kind === "prepared" ? custody.value.write : null
 			};
 			case "already_committed": return {
 				kind: "session_issued",
@@ -2231,7 +2234,8 @@ var CloudflareD1WalletRegistrationService = class {
 				},
 				issuedAtMs: issuedRegistrationSession.issuedAtMs,
 				expectedOrigin: ownerProofContext.expectedOrigin,
-				activation: issuedRegistrationSession.activation
+				activation: issuedRegistrationSession.activation,
+				custodyWrite: custody.value.kind === "prepared" ? custody.value.write : null
 			};
 			default: return assertNeverD1RegistrationSessionIssuance(issuedRegistrationSession);
 		}
@@ -2430,7 +2434,7 @@ var CloudflareD1WalletRegistrationService = class {
 					registrationCeremonyId: input.registrationCeremonyId,
 					execution
 				}),
-				completionWrite: registrationCommitActivation,
+				completionWrite: registrationCommitCompletionWrite,
 				replay: this.replayWalletRegistrationNearProvisioningCommit.bind(this)
 			});
 			recordRegistrationServerTiming(serverTiming, "near_finalize_side_effect", sideEffectStartedAtMs);
@@ -2656,7 +2660,7 @@ var CloudflareD1WalletRegistrationService = class {
 		}, stored ? null : (bound) => ceremonyStore.prepareEcdsaClaimCommit({
 			expected: input.snapshot,
 			next: authorizedCeremony(bound)
-		}), input.startedDispatchRoot, requireRegistrationEd25519YaoMint(ceremony).sessionId);
+		}), input.startedDispatchRoot, requireRegistrationEd25519YaoMint(ceremony).sessionId, input.serverTiming);
 		recordRegistrationServerTiming(input.serverTiming, "yao_admission_bind", bindStartedAtMs);
 		if (!admitted.ok) return {
 			ok: false,
@@ -2692,6 +2696,7 @@ var CloudflareD1WalletRegistrationService = class {
 			admissionReceipt: admitted.value
 		};
 		const execution = input.ed25519Execution ? await runtime.executeAdmittedRegistration({
+			admission: admitted.executionAdmission,
 			request: input.ed25519Execution,
 			credential: input.registrationBearerToken,
 			trace: input.traceContext ?? createRouterAbTraceContextV1()
@@ -2712,8 +2717,7 @@ var CloudflareD1WalletRegistrationService = class {
 			}
 		};
 	}
-	/**
-	* Derives the authority-bound Yao admission now that the proof is verified.
+	/** Derives the authority-bound Yao admission after proof verification.
 	* Both auth methods take this path — the scope comes from the verified
 	* authority, so Email OTP's `providerUserId` is established rather than
 	* assumed.
@@ -2837,17 +2841,21 @@ var CloudflareD1WalletRegistrationService = class {
 					registrationCeremonyId: claims.registrationCeremonyId,
 					execution
 				}),
-				completionWrite: registrationCommitActivation,
+				completionWrite: registrationCommitCompletionWrite,
 				replay: this.replayWalletRegistrationActivateCommit.bind(this)
 			});
 			switch (run.kind) {
 				case "executed":
 				case "exact_replay":
 					await publishCompletedRegistration(run.value, waitUntil);
-					if (run.value.response.ok && run.value.response.kind === "evm_family_ecdsa") await cleanupFinalizedRegistrationCeremony({
-						store: this.getRegistrationCeremonyIntentStore(),
-						registrationCeremonyId: claims.registrationCeremonyId
-					});
+					if (run.value.response.ok && run.value.response.kind === "evm_family_ecdsa") {
+						const cleanup = cleanupFinalizedRegistrationCeremony({
+							store: this.getRegistrationCeremonyIntentStore(),
+							registrationCeremonyId: claims.registrationCeremonyId
+						});
+						if (waitUntil) waitUntil(cleanup);
+						else await cleanup;
+					}
 					return run.value.response;
 				case "request_conflict": return {
 					ok: false,
@@ -2983,7 +2991,7 @@ var CloudflareD1WalletRegistrationService = class {
 			foundingAuthority: commit.foundingAuthority,
 			foundingAuthMethod: commit.foundingAuthMethod,
 			...commit.registrationDiagnostics ? { registrationDiagnostics: commit.registrationDiagnostics } : {},
-			...custody.value.status === "not_requested" ? {} : { walletCustody: custody.value },
+			...custody.value.outcome.status === "not_requested" ? {} : { walletCustody: custody.value.outcome },
 			custodyKeyManifestDigestB64u: commit.custodyKeyManifestDigestB64u,
 			ecdsa: {
 				...commit.ecdsa,
@@ -2996,7 +3004,8 @@ var CloudflareD1WalletRegistrationService = class {
 		const issuedContext = {
 			issuedAtMs: registrationEstablishedSession.issuedAtMs,
 			expectedOrigin: ownerProofContext.expectedOrigin,
-			activation: registrationEstablishedSession.activation
+			activation: registrationEstablishedSession.activation,
+			custodyWrite: custody.value.kind === "prepared" ? custody.value.write : null
 		};
 		if (commit.authMethod.kind === "passkey") {
 			if (!commit.rpId) throw new Error("Passkey registration activation is missing its RP ID");
@@ -3847,19 +3856,7 @@ var CloudflareD1WalletRegistrationService = class {
 			};
 			const foundingAuthority = persistedFoundingRecords.authority;
 			const foundingAuthMethod = persistedFoundingRecords.authMethod;
-			const custody = custodyReservation.then(async (commitCustody) => {
-				const walletCustody = await recordRegistrationPromiseTiming({
-					sink: serverTiming,
-					name: "near_finalize_custody_commit",
-					startedAtMs: Date.now(),
-					promise: commitCustody()
-				});
-				if (walletCustody.status === "rejected") console.warn("[wallet-registration] custody commit rejected", {
-					registrationCeremonyId: ceremony.registrationCeremonyId,
-					reason: walletCustody.reason
-				});
-				return walletCustody;
-			});
+			const custody = custodyReservation;
 			startedCustody = custody;
 			const authMethod = walletRegistrationFinalizeAuthMethodFromAuthority(ceremonyAuthority);
 			let response;

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationSetupExecution.js

@@ -1,12 +1,13 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { deriveSigningRootId } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { registrationPreparationIdFromString } from "../../../../core/types.js";
+import { recordRegistrationPromiseTiming, recordRegistrationServerTiming } from "../../../framework/registrationTiming.js";
+import { buildRouterAbEd25519YaoProductAdmissionRequestV1, mintRouterAbEd25519YaoRegistrationIdentityV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js";
 import { buildStoredWalletRegistrationEvmFamilyEcdsaPreparedBranch, findStoredWalletRegistrationEvmFamilyEcdsaBranch } from "../../../../core/RegistrationCeremonyStore.js";
 import { routerAbEcdsaStrictRegistrationFactsBindingJson } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
 import { buildRegistrationIntent, inferRuntimePolicyScopeFromSigningRoot } from "./d1RegistrationCeremonyRecords.js";
-import { errorMessage, recordRegistrationPromiseTiming, recordRegistrationServerTiming, registrationIntentSignerBranches, registrationPreparedContextEcdsaChainTargets, registrationSignerBranchesFromPlan, resolveRegistrationPreparedContextFromPlan } from "./d1RegistrationSetupSupport.js";
-import { buildRouterAbEd25519YaoProductAdmissionRequestV1, mintRouterAbEd25519YaoRegistrationIdentityV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js";
 import { isTransientD1Error } from "../../../../storage/d1Retry.js";
+import { errorMessage, registrationIntentSignerBranches, registrationPreparedContextEcdsaChainTargets, registrationSignerBranchesFromPlan, resolveRegistrationPreparedContextFromPlan } from "./d1RegistrationSetupSupport.js";
 import { buildWalletRegistrationSetupSignature, normalizeWalletRegistrationSetupRequest, walletRegistrationSetupError, walletRegistrationSetupExpiresAtMs, walletRegistrationSetupIntentDigest } from "./d1WalletRegistrationSetup.js";
 import { buildD1EvmFamilyEcdsaRegistrationPrepare } from "./d1EvmFamilyEcdsaRegistrationBranch.js";
 //#region src/router/cloudflare/d1/registration/d1WalletRegistrationSetupExecution.ts

package/dist/esm/router/cloudflare/d1/registration/registrationCompletionWrite.js

@@ -0,0 +1,20 @@
+//#region src/router/cloudflare/d1/registration/registrationCompletionWrite.ts
+/** Custody, home activation and the replay receipt share one durable transaction. */
+function registrationCommitCompletionWrite(execution) {
+	switch (execution.kind) {
+		case "unissued":
+		case "replayed": return null;
+		case "session_issued":
+		case "session_issued_with_installation_projection":
+			if (!execution.custodyWrite) return execution.activation;
+			return { statements: [...execution.custodyWrite.statements, ...execution.activation?.statements ?? []] };
+		default: return assertNever(execution);
+	}
+}
+function assertNever(value) {
+	throw new Error(`Unknown registration completion state: ${String(value)}`);
+}
+//#endregion
+export { registrationCommitCompletionWrite };
+
+//# sourceMappingURL=registrationCompletionWrite.js.map

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAddSignerFinalizeRecord.js

@@ -2,8 +2,8 @@ import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import "../../../../shared-ts/src/utils/encoders.js";
-import { parseD1WalletAddSignerFinalizeTerminalResponse, parseWalletIdForIntent } from "../registration/d1RegistrationCeremonyRecords.js";
 import { parseRouterAbEd25519YaoRegistrationSideEffectRecordV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
+import { parseD1WalletAddSignerFinalizeTerminalResponse, parseWalletIdForIntent } from "../registration/d1RegistrationCeremonyRecords.js";
 //#region src/router/cloudflare/d1/wallet/d1WalletAddSignerFinalizeRecord.ts
 function parseWalletAddSignerFinalizePrepared(raw) {
 	if (!isPlainObject(raw)) return null;

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAddSignerService.js

@@ -13,14 +13,14 @@ import { buildRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaRegis
 import { buildWalletEcdsaSignerActivationV1, extendEd25519WalletAuthorityWithEcdsa, isActiveEd25519WalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { registrationPreparationIdFromString } from "../../../../core/types.js";
 import { addSignerIntentGrantFromString, computeAddSignerIntentDigestB64u, sameAddSignerIntentV1 } from "../../../../shared-ts/src/utils/registrationIntent.js";
-import { routerAbEcdsaStrictRegistrationRequestMatchesFacts } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
-import { buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, normalizeThresholdEcdsaChainTargets, parseD1AddSignerIntent, parseD1RuntimePolicyScope, parseD1StoredAddSignerAuth, parseD1StoredAddSignerIntent, parseD1StoredWalletAddSignerCeremony, parseWalletIdForIntent, positiveIntegerArraysEqual, runtimePolicyScopeMatches, thresholdEcdsaChainTargetsEqual } from "../registration/d1RegistrationCeremonyRecords.js";
 import { buildTenantRootIdentityFromAuthenticatedDeploymentV1 } from "../../../../shared-ts/src/tenant-root/tenantRootIdentity.js";
 import { WalletAuthorityCommitConflictError } from "./d1WalletAuthorityStore.js";
 import { buildRouterAbEd25519YaoRegistrationCapabilityRecordV1 } from "../../../domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery.js";
 import { buildRouterAbEd25519YaoAddSignerAdmissionRequestV1, createRouterAbEd25519YaoMaterialActivationRefV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js";
 import { parseRouterAbEd25519YaoRegistrationSideEffectRecordV1, runRouterAbEd25519YaoRegistrationSideEffectV1, throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
 import { buildYaoEd25519WalletSignerRecord, ed25519NearPublicKeyFromBytes, implicitNearAccountIdFromEd25519PublicKeyBytes } from "../ed25519Yao/d1Ed25519YaoWalletSigner.js";
+import { routerAbEcdsaStrictRegistrationRequestMatchesFacts } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
+import { buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, normalizeThresholdEcdsaChainTargets, parseD1AddSignerIntent, parseD1RuntimePolicyScope, parseD1StoredAddSignerAuth, parseD1StoredAddSignerIntent, parseD1StoredWalletAddSignerCeremony, parseWalletIdForIntent, positiveIntegerArraysEqual, runtimePolicyScopeMatches, thresholdEcdsaChainTargetsEqual } from "../registration/d1RegistrationCeremonyRecords.js";
 import { buildD1WalletAddSignerFinalizePrepared, fingerprintD1WalletAddSignerFinalizePrepared, rejectUnexpectedWalletAddSignerFinalizePreparation, returnD1WalletAddSignerFinalizePrepared } from "./d1WalletAddSignerFinalizeRecord.js";
 import { routerAbEd25519YaoLifecycleDecisionLookupV1, routerAbEd25519YaoLifecycleDecisionV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoLifecycleDecision.js";
 import { buildD1EvmFamilyEcdsaRegistrationPrepare } from "../registration/d1EvmFamilyEcdsaRegistrationBranch.js";

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthMethodService.js

@@ -13,15 +13,15 @@ import { deriveWebAuthnAuthenticatorDeviceInfo } from "../../../../shared-ts/src
 import { parseSessionOrigin } from "../../../../authorization/domain.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { PASSKEY_PRF_FIRST_SALT_V1, PASSKEY_PRF_SECOND_SALT_V1 } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
-import { addAuthMethodIntentGrantFromString, computeAddAuthMethodIntentDigestB64u } from "../../../../shared-ts/src/utils/registrationIntent.js";
 import { parsePasskeyCustodyEnvelopeRecord } from "../../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
-import { toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";
-import { parseWalletIdForIntent } from "../registration/d1RegistrationCeremonyRecords.js";
+import { addAuthMethodIntentGrantFromString, computeAddAuthMethodIntentDigestB64u } from "../../../../shared-ts/src/utils/registrationIntent.js";
 import { parseWebAuthnClientDataJsonBase64url, webAuthnOriginHostnameOrEmpty } from "../../../auth/webAuthnCredentialCodecs.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { resolveWalletAuthMethodIdForAuthority } from "../../../../core/signingLanes/WalletExecutionLaneProjection.js";
+import { toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";
 import { d1HostIsWithinWebAuthnRpId, resolveD1AddAuthMethodExistingAuth, resolveD1AddSignerExistingAuth, verifyD1LinkedDeviceFreshRevokeProofV1, walletAuthAuthorityFromRegistrationAuthority } from "./d1WalletAuthMethodBoundary.js";
+import { parseWalletIdForIntent } from "../registration/d1RegistrationCeremonyRecords.js";
 import { runtimePolicyScopeKey } from "../../../../core/EmailOtpRecords.js";
 import { expiredGoogleEmailOtpRegistrationAttemptRecord } from "../emailOtp/d1GoogleEmailOtpRegistrationRecords.js";
 import { admitAddWalletAuthMethod } from "../../../../shared-ts/src/utils/addWalletAuthMethod.js";

package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnAuthService.js

@@ -4,8 +4,8 @@ import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimit
 import { WalletLifecycleLocator } from "../../../../authorization/lifecycleRouting.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { failedVerification, failure } from "../../../../shared-ts/src/utils/failure.js";
-import { nonNegativeSafeInteger, optionalNonNegativeInteger, parseD1BoundaryWalletId, parseD1BoundaryWalletIdResult, parseJsonObject } from "../auth/d1RouterApiAuthBoundary.js";
 import { decodeWebAuthnBase64UrlOrBase64, parseWebAuthnAuthenticationCredential, parseWebAuthnClientDataJsonBase64url, webAuthnCredentialIdB64uFromCredential, webAuthnOriginHostnameOrEmpty } from "../../../auth/webAuthnCredentialCodecs.js";
+import { nonNegativeSafeInteger, optionalNonNegativeInteger, parseD1BoundaryWalletId, parseD1BoundaryWalletIdResult, parseJsonObject } from "../auth/d1RouterApiAuthBoundary.js";
 import { parseWebAuthnAuthenticatorRowDeviceInfo, webAuthnSyncWalletBindingFromCredentialBinding } from "./d1WebAuthnRecords.js";
 import { d1HostIsWithinWebAuthnRpId } from "../wallet/d1WalletAuthMethodBoundary.js";
 import { webAuthnAuthenticationFailure, webAuthnLoginEd25519, webAuthnSyncCredentialBinding } from "../../../../core/authService/webauthnVerificationOutcomes.js";

package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnRecords.js

@@ -8,8 +8,8 @@ import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/
 import { parseWebAuthnAuthenticatorDeviceInfoJson } from "../../../../shared-ts/src/utils/webauthnDeviceInfo.js";
 import { hasExactKeys } from "../../../../shared-ts/src/utils/exactKeys.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
-import { nonNegativeSafeInteger, optionalNonNegativeInteger, positiveInteger } from "../auth/d1RouterApiAuthBoundary.js";
 import { parseRecoveryCodeReservationId } from "../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
+import { nonNegativeSafeInteger, optionalNonNegativeInteger, positiveInteger } from "../auth/d1RouterApiAuthBoundary.js";
 //#region src/router/cloudflare/d1/webauthn/d1WebAuthnRecords.ts
 function parseWebAuthnAuthenticatorRowDeviceInfo(raw) {
 	return parseWebAuthnAuthenticatorDeviceInfoJson(raw);

package/dist/esm/router/cloudflare/runtime/walletControlOps.js

@@ -6,6 +6,7 @@ const WALLET_CONTROL_BASE_PATH_V1 = "/internal/wallet-runtime/v1/tenant-root-con
 const WALLET_CONTROL_AUTH_MARKER_V1 = "wallet-control-private-binding-v1";
 const OPERATIONS = [
 	operation("create", "mpc-router", "https://mpc-router.router-ab.internal", "/router-ab/internal/tenant-root/creation/v1/create"),
+	operation("renew-creation-authorization", "mpc-router", "https://mpc-router.router-ab.internal", "/router-ab/internal/tenant-root/creation/v1/renewal-fence"),
 	operation("refresh", "mpc-router", "https://mpc-router.router-ab.internal", "/router-ab/internal/tenant-root/refresh/v1/execute"),
 	operation("status", "mpc-router", "https://mpc-router.router-ab.internal", "/router-ab/internal/tenant-root/status/v1/read"),
 	operation("destination-bootstrap", "mpc-router", "https://mpc-router.router-ab.internal", "/router-ab/internal/tenant-root/destination-bootstrap/v1/read-auth"),