@seams/wallet-server 0.27.0 → 0.29.0

package/dist/esm/router/cloudflare/d1/oidc/d1OidcBoundary.js

@@ -1,7 +1,7 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
-import "../../../../shared-ts/src/utils/encoders.js";
 import { failedVerification } from "../../../../shared-ts/src/utils/failure.js";
+import "../../../../shared-ts/src/utils/encoders.js";
 import { toArrayBufferCopy } from "../../../../core/authService/portableCrypto.js";
 import { toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";
 //#region src/router/cloudflare/d1/oidc/d1OidcBoundary.ts
@@ -134,6 +134,7 @@ function validateGoogleIdTokenClaims(input) {
 	const aud = parseJwtAud(payload.aud);
 	if (aud.length === 0) return failedVerification("invalid_claims", "Missing Google id_token aud");
 	if (!aud.includes(input.clientId)) return failedVerification("invalid_audience", "Google id_token audience mismatch");
+	const authorizedParty = normalizeOptionalTrimmedString(payload.azp);
 	const sub = normalizeOptionalTrimmedString(payload.sub);
 	if (!sub) return failedVerification("invalid_claims", "Missing Google id_token sub");
 	const email = normalizeOptionalTrimmedString(payload.email);
@@ -146,6 +147,11 @@ function validateGoogleIdTokenClaims(input) {
 	return {
 		ok: true,
 		sub,
+		issuer: "https://accounts.google.com",
+		audience: input.clientId,
+		expiresAtMs: exp * 1e3,
+		authorizedParty: authorizedParty || null,
+		audienceCount: aud.length,
 		...email ? { email } : {},
 		...name ? { name } : {},
 		...givenName ? { givenName } : {},

package/dist/esm/router/cloudflare/d1/oidc/d1OidcVerificationService.js

@@ -1,7 +1,7 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { failedVerification } from "../../../../shared-ts/src/utils/failure.js";
-import { githubOAuthPublicConfig, verifyGithubOAuthCodeWithIdentityStore } from "../../../../core/authService/githubOAuth.js";
 import { verifyGoogleOidcToken } from "./googleOidcToken.js";
+import { githubOAuthPublicConfig, verifyGithubOAuthCodeWithIdentityStore } from "../../../../core/authService/githubOAuth.js";
 //#region src/router/cloudflare/d1/oidc/d1OidcVerificationService.ts
 function errorMessage(error) {
 	return error instanceof Error ? error.message : String(error || "");

package/dist/esm/router/cloudflare/d1/passkeyCustody/d1PasskeyCustodyRouteService.js

@@ -1,15 +1,15 @@
 import { parseEmailOtpProviderUserId, parsePasskeyEnvelopeId, parseWalletAuthMethodId, parseWalletAuthorityBindingDigest, parseWalletAuthorityId, parseWalletId, parseWalletRecoveryOperationId, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import "../../../../shared-ts/src/utils/encoders.js";
+import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { isActiveRecoveredWalletAuthorityV1, walletAuthorityDigestsMatchV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { PASSKEY_PRF_FIRST_SALT_V1, PASSKEY_PRF_SECOND_SALT_V1 } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
-import { failure } from "../../../../shared-ts/src/utils/failure.js";
-import { isHostWithinRpId, originHostnameOrEmpty } from "../../../../core/authService/webauthnOidcHelpers.js";
+import { deriveRecoveryCodeLocatorV1FromBytes } from "../../../../shared-ts/src/wallet-recovery/recoveryCodeLocator.js";
 import { buildWalletRecoveryBackupAcknowledgementV1, walletRecoveryBackupIsOutstanding } from "../../../../shared-ts/src/wallet-recovery/backupAcknowledgement.js";
 import "../../../../shared-ts/src/wallet-recovery/recoveryCodes.js";
-import { deriveRecoveryCodeLocatorV1FromBytes } from "../../../../shared-ts/src/wallet-recovery/recoveryCodeLocator.js";
+import { isHostWithinRpId, originHostnameOrEmpty } from "../../../../core/authService/webauthnOidcHelpers.js";
 import { buildWebAuthnRecoveryContinuityAnchorRecord } from "../webauthn/d1WebAuthnRecords.js";
 import { buildWalletRecoveryCommittedProjectionV1 } from "../../../../shared-ts/src/wallet-recovery/walletRecoveryCommittedProjection.js";
 import { envelopeFactorRef } from "./d1PasskeyCustodyEnvelopeStore.js";

package/dist/esm/router/cloudflare/d1/passkeyCustody/d1WalletCustodyCommitStore.js

@@ -1,18 +1,18 @@
 import { parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { buildDelegatedWalletAuthorityV1, buildFullOwnerDelegatedWalletAuthorityV1, sameDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
+import { buildDelegatedWalletAuthorityV1, buildFullOwnerDelegatedWalletAuthorityV1, sameDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { sameWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { sameVerifiedActiveWalletAuthorityV1, walletAuthorityDigestsMatchV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
-import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
+import { WALLET_EMAIL_OTP_ACTIONS, emailOtpDeviceEnrollmentId } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { D1WalletAuthMethodStore } from "../../../../core/d1WalletAuthMethodStore.js";
 import { parsePasskeyCustodyEnvelopeRecord } from "../../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
-import { WALLET_EMAIL_OTP_ACTIONS, emailOtpDeviceEnrollmentId } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
+import { parseRecoveryCodeLocatorV1 } from "../../../../shared-ts/src/wallet-recovery/recoveryCodeLocator.js";
 import { parseDerivedWalletRecoveryKeyId } from "../../../../shared-ts/src/wallet-recovery/recoveryKeyId.js";
 import { parseWalletRecoveryBackupAcknowledgementV1 } from "../../../../shared-ts/src/wallet-recovery/backupAcknowledgement.js";
 import "../../../../shared-ts/src/wallet-recovery/recoveryCodes.js";
 import { parseWalletRecoveryEnvelopeSetRecord } from "../../../../shared-ts/src/wallet-recovery/walletRecoveryEnvelopeSet.js";
-import { parseRecoveryCodeLocatorV1 } from "../../../../shared-ts/src/wallet-recovery/recoveryCodeLocator.js";
 import { reservePasskeyCredential } from "../../../../core/passkeyCredentialClaims.js";
 import { prepareD1WebAuthnCredentialBindingInsertStatement } from "../../../../core/WebAuthnCredentialBindingStore.js";
 import { prepareD1WebAuthnAuthenticatorInsertStatement } from "../webauthn/d1WebAuthnStore.js";

package/dist/esm/router/cloudflare/d1/passkeyCustody/d1WalletRecoveryGoogleEmailOtpRecords.js

@@ -1,7 +1,7 @@
 import { parsePasskeyEnvelopeId, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWalletRecoveryOperationId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { parseEnvelopeRevision } from "../../../../shared-ts/src/passkey-custody/primitives.js";
+import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { parseWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { hasExactKeys } from "../../../../shared-ts/src/utils/exactKeys.js";

package/dist/esm/router/cloudflare/d1/passkeyCustody/d1WalletRecoveryGoogleEmailOtpService.js

@@ -2,12 +2,12 @@ import { parseProviderSubject, parseVerifiedGoogleEmail } from "../../../../shar
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8, sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import "../../../../shared-ts/src/utils/encoders.js";
 import { buildWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
-import { failure } from "../../../../shared-ts/src/utils/failure.js";
-import { consumeReservedRecoveryCode } from "../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
-import { hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
+import { hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
+import { consumeReservedRecoveryCode } from "../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
 import { sealEmailOtpFactorSecretForWorker } from "../../../domains/emailOtp/emailOtpRouteHandlers.js";
 import { markWalletRecoveryGoogleEmailOtpAttemptIssued, markWalletRecoveryGoogleEmailOtpAttemptVerified, sameWalletRecoveryGoogleEmailOtpFinalizationInputV1, walletRecoveryGoogleEmailOtpFinalizationInput } from "./d1WalletRecoveryGoogleEmailOtpRecords.js";
 import { buildWalletRecoveryEcdsaPossessionChallengesV1, resolveWalletRecoveryKeyManifestV1, verifyWalletRecoveryKeyActivationsV1 } from "../../../domains/passkeyCustody/walletRecoveryKeyManifest.js";

package/dist/esm/router/cloudflare/d1/registration/d1EvmFamilyEcdsaRegistrationBranch.js

@@ -1,9 +1,9 @@
 import { parseRootShareEpoch } from "../../../../shared-ts/src/utils/domainIds.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { deriveEvmFamilySigningKeySlotId } from "../../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";
 import { computeEcdsaDerivationRoleLocalRelayerKeyId, computeEcdsaDerivationRoleLocalThresholdKeyId, computeSdkEcdsaDerivationApplicationBindingDigestB64u, parseSdkEcdsaDerivationSigningRootId, parseSdkEcdsaDerivationSigningRootVersion, parseSdkEcdsaDerivationThresholdKeyId } from "../../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { buildRouterAbEcdsaDerivationActiveStateIdV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
-import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import "./d1RegistrationCeremonyRecords.js";
 //#region src/router/cloudflare/d1/registration/d1EvmFamilyEcdsaRegistrationBranch.ts
 const REGISTRATION_WALLET_SIGNING_SESSION_REMAINING_USES = 3;

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyRecords.js

@@ -1,7 +1,8 @@
 import { parseChallengeSubjectId, parseEmailOtpChallengeId, parseOrgId, parseProviderSubject, parseRootShareEpoch, parseWalletAuthMethodId, parseWalletAuthorityId, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";
+import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { parseWalletAddAuthMethodRegistrationOptions } from "../../../../shared-ts/src/utils/addAuthMethodRegistration.js";
 import { parseRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationActivationResultV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
@@ -27,7 +28,6 @@ import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../..
 import { findRegistrationSignerPlanNearEd25519Branch, normalizeAddSignerSelection, normalizeRegistrationSignerPlan, registrationSignerBranchKeyFromString, registrationSignerSetSelectionFromPlan } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
 import { addAuthMethodIntentGrantFromString, addSignerIntentGrantFromString, normalizeAddAuthMethodIntentCaller } from "../../../../shared-ts/src/utils/registrationIntent.js";
 import { parseEcdsaDerivationPublicIdentity, parseThresholdEd25519AuthorityScope, thresholdEd25519AuthorityScopeFromWalletAuthAuthority, thresholdEd25519AuthorityScopesMatch } from "../../../../core/ThresholdService/validation.js";
-import { toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";
 import { parseStoredRegistrationSignerPlan, parseStoredWalletRegistrationPreparedContext, storedRegistrationSignerPlansMatch } from "../../../../core/RegistrationCeremonyStore.js";
 import { parseStoredRouterAbEcdsaPendingActivationV1 } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
 //#region src/router/cloudflare/d1/registration/d1RegistrationCeremonyRecords.ts
@@ -49,6 +49,7 @@ function buildRegistrationIntent(input) {
 	const foundingWalletAuthMethodId = input.foundingWalletAuthMethodId;
 	if (input.runtimePolicyScope) return {
 		version: "registration_intent_v1",
+		completion: input.completion,
 		walletId: input.walletId,
 		authMethod: input.authMethod,
 		signerSelection: input.signerSelection,
@@ -58,6 +59,7 @@ function buildRegistrationIntent(input) {
 	};
 	return {
 		version: "registration_intent_v1",
+		completion: input.completion,
 		walletId: input.walletId,
 		authMethod: input.authMethod,
 		signerSelection: input.signerSelection,
@@ -139,6 +141,7 @@ function parseD1RegistrationIntent(raw) {
 	if (record.runtimePolicyScope !== void 0 && !runtimePolicyScope) return null;
 	if (runtimePolicyScope) return {
 		version: "registration_intent_v1",
+		completion: parsePersistedRegistrationCompletion(record.completion),
 		walletId,
 		authMethod,
 		signerSelection: signerSelection.value,
@@ -148,6 +151,7 @@ function parseD1RegistrationIntent(raw) {
 	};
 	return {
 		version: "registration_intent_v1",
+		completion: parsePersistedRegistrationCompletion(record.completion),
 		walletId,
 		authMethod,
 		signerSelection: signerSelection.value,
@@ -2046,6 +2050,11 @@ function safeInteger(raw) {
 function unreachableAddAuthMethodInput(value) {
 	throw new Error(`Unhandled add-auth-method input kind: ${String(value)}`);
 }
+function parsePersistedRegistrationCompletion(raw) {
+	if (raw === void 0 || raw === "wallet_session") return "wallet_session";
+	if (raw === "owner_operations") return "owner_operations";
+	throw new Error("Stored registration completion is invalid");
+}
 //#endregion
 export { buildAddAuthMethodIntent, buildAddSignerIntent, buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, buildD1WalletRecord, buildRegistrationIntent, deriveEvmFamilySigningKeySlotId, inferRuntimePolicyScopeFromSigningRoot, intentScopeMetadata, normalizeThresholdEcdsaChainTargets, parseD1AddSignerIntent, parseD1EcdsaDerivationServerBootstrapResponse, parseD1RuntimePolicyScope, parseD1StoredAddAuthMethodIntent, parseD1StoredAddSignerAuth, parseD1StoredAddSignerIntent, parseD1StoredWalletAddAuthMethodCeremony, parseD1StoredWalletAddAuthMethodFinalizeReplay, parseD1StoredWalletAddSignerCeremony, parseD1StoredWalletAddSignerFinalizeReplay, parseD1StoredWalletRegistrationCeremony, parseD1WalletAddSignerFinalizeTerminalResponse, parseD1WalletRegistrationCommittedInstallationProjection, parseD1WalletRegistrationFinalizeReplayResponse, parseWalletIdForIntent, positiveIntegerArraysEqual, runtimePolicyScopeMatches, thresholdEcdsaChainTargetsEqual };
 

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationIntentService.js

@@ -1,8 +1,8 @@
 import { parseWalletAuthMethodId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { normalizeAddAuthMethodInput } from "../../../../shared-ts/src/utils/registrationAuthMethodInput.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
-import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { thresholdEcdsaChainTargetFromValue } from "../../../../core/thresholdEcdsaChainTarget.js";
 import { normalizeAddSignerSelection } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
 import { addAuthMethodIntentGrantFromString, addSignerIntentGrantFromString, computeAddAuthMethodIntentDigestB64u, computeAddSignerIntentDigestB64u } from "../../../../shared-ts/src/utils/registrationIntent.js";

package/dist/esm/router/cloudflare/d1/registration/d1WalletExecutionAuthority.js

@@ -1,5 +1,6 @@
 import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
 import { prepareD1TenantStatement } from "../../../../core/d1TenantStore.js";
+import { parseRegistrationSessionPublication } from "../../../domains/walletRegistration/walletRegistrationReservation.js";
 //#region src/router/cloudflare/d1/registration/d1WalletExecutionAuthority.ts
 /** The finalize response normally delivers first; the scheduled resumption waits this long. */
 const DIRECTORY_PUBLICATION_FIRST_RETRY_MS = 6e4;
@@ -91,20 +92,18 @@ var D1WalletExecutionAuthority = class {
 		const publication = {
 			walletId: input.registration.walletId,
 			ceremonyId: input.registration.ceremonyId,
-			digest: input.session.digest,
-			expiresAtMs: input.session.expiresAtMs,
+			session: input.session,
 			attempts: 0
 		};
 		return {
 			statements: [...this.prepareState(input.registration, "active"), prepareD1TenantStatement(this.database, this.scope, `INSERT INTO wallet_registration_directory_publications
              (namespace, org_id, project_id, env_id, wallet_id, ceremony_id,
-              session_digest, session_expires_at_ms, next_attempt_at_ms)
-           VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9)
+              session_json, next_attempt_at_ms)
+           VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8)
            ON CONFLICT DO NOTHING`, [
 				publication.walletId,
 				publication.ceremonyId,
-				publication.digest,
-				publication.expiresAtMs,
+				JSON.stringify(publication.session),
 				Date.now() + DIRECTORY_PUBLICATION_FIRST_RETRY_MS
 			])],
 			publish: async () => {
@@ -118,7 +117,7 @@ var D1WalletExecutionAuthority = class {
 	}
 	/** Sends the publications that are due, oldest first, one at a time. */
 	async resumeDirectoryPublications(input) {
-		const due = await prepareD1TenantStatement(this.database, this.scope, `SELECT wallet_id, ceremony_id, session_digest, session_expires_at_ms, attempts
+		const due = await prepareD1TenantStatement(this.database, this.scope, `SELECT wallet_id, ceremony_id, session_json, attempts
        FROM wallet_registration_directory_publications
        WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
          AND state = 'pending' AND next_attempt_at_ms <= ?5
@@ -133,8 +132,7 @@ var D1WalletExecutionAuthority = class {
 			const outcome = await this.deliver({
 				walletId: row.wallet_id,
 				ceremonyId: row.ceremony_id,
-				digest: row.session_digest,
-				expiresAtMs: row.session_expires_at_ms,
+				session: parseRegistrationSessionPublication(JSON.parse(row.session_json), row.wallet_id),
 				attempts: row.attempts
 			});
 			delivered[outcome] += 1;
@@ -148,12 +146,7 @@ var D1WalletExecutionAuthority = class {
 				ceremonyId: publication.ceremonyId,
 				walletId: publication.walletId,
 				outcome: "established",
-				session: {
-					kind: "credential",
-					walletId: publication.walletId,
-					digest: publication.digest,
-					expiresAtMs: publication.expiresAtMs
-				}
+				session: publication.session
 			});
 		} catch (error) {
 			console.warn("[wallet-registration] directory publication deferred", error);
@@ -194,7 +187,7 @@ var D1WalletExecutionAuthority = class {
 	}
 	/** The state update with its guard. The guard reads the row count of the update before it. */
 	prepareState(input, state) {
-		return [prepareD1TenantStatement(this.database, this.scope, `UPDATE wallet_execution_generations SET state = ?7
+		return [prepareD1TenantStatement(this.database, this.scope, `UPDATE wallet_execution_generations SET state = ?7, registration_completion = CASE WHEN ?7 = 'active' THEN 'established' ELSE registration_completion END
          WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
            AND wallet_id = ?5 AND origin = 'registration' AND origin_id = ?6
            AND state IN ('registering', ?7)`, [

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationCommitStore.js

@@ -1,9 +1,9 @@
 import { mpcMaterialActivationRefsEqual, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
+import { parseD1JsonColumn } from "../../../../storage/d1Sql.js";
 import { parseWalletAuthMethodRecordV2, sameWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { buildWalletSessionCapabilitySubjectsV1 } from "../../../../authorization/domain.js";
-import { parseD1JsonColumn } from "../../../../storage/d1Sql.js";
 import { prepareD1WalletPutSignerStatement, prepareD1WalletPutSubjectStatement } from "../../../../core/d1WalletStore.js";
 import { prepareD1WalletAuthMethodV2PutStatement } from "../../../../core/d1WalletAuthMethodStore.js";
 import { reservePasskeyCredential } from "../../../../core/passkeyCredentialClaims.js";

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationService.js

@@ -1,12 +1,12 @@
 import { mpcMaterialActivationRefsEqual, parseThresholdEd25519SessionId, parseWalletKeyId, parseWebAuthnCredentialIdB64u } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import { buildFullOwnerPermissionsV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, bytesToUnprefixedHex, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { parseEd25519PublicKeyB64u, parseSecp256k1CompressedPublicKeyB64u } from "../../../../shared-ts/src/passkey-custody/primitives.js";
 import "../../../../shared-ts/src/utils/encoders.js";
+import { parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { buildFullOwnerPermissionsV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { buildExactAdministeredSignerManifestV1 } from "../../../../shared-ts/src/device-linking/delegatedActivationPlan.js";
 import { routerAbMpcMaterialActivationRefFromWire, routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { deriveRouterAbEd25519YaoRuntimePolicyBindingV1 } from "../../../../shared-ts/src/utils/routerAbEd25519YaoDigests.js";
@@ -17,6 +17,7 @@ import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority, walletAuth
 import { ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1, buildRouterAbEcdsaDerivationActiveStateIdV1, buildRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaDerivationNormalSigningStateV1, sameRouterAbEcdsaDerivationNormalSigningStateV1, sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaRegistrationActivationReceiptV1, sameRouterAbEcdsaVerifiedClientActivationFactsV1, sameRouterAbPublicDigest32V1Wire } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { buildWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { buildActiveWalletAuthorityV1, buildWalletSignerActivationSetV1, computeWalletAuthorityDigestB64u, computeWalletSignerActivationSetDigestB64u, extendEcdsaWalletAuthorityWithEd25519, isActiveEcdsaWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
+import { createRouterAbTraceContextV1 } from "../../../../shared-ts/src/utils/routerAbTraceContext.js";
 import { ROUTER_AB_ED25519_NORMAL_SIGNING_STATE_KIND } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
 import { normalizeThresholdEd25519ParticipantIds } from "../../../../shared-ts/src/threshold/participants.js";
 import { nearEd25519SigningKeyIdFromString, registrationEd25519AuthorityScopeFromAuthority, walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
@@ -27,7 +28,6 @@ import "../../../../shared-ts/src/passkey-custody/index.js";
 import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../../shared-ts/src/utils/near.js";
 import { registrationNearEd25519BranchKey } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
 import { registrationIntentGrantFromString } from "../../../../shared-ts/src/utils/registrationIntent.js";
-import { createRouterAbTraceContextV1 } from "../../../../shared-ts/src/utils/routerAbTraceContext.js";
 import { buildTenantRootIdentityFromAuthenticatedDeploymentV1 } from "../../../../shared-ts/src/tenant-root/tenantRootIdentity.js";
 import { DEFAULT_WALLET_SESSION_TTL_MS } from "../../../../shared-ts/src/threshold/sessionPolicy.js";
 import { parseEcdsaDerivationPublicIdentity, thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
@@ -2167,7 +2167,13 @@ var CloudflareD1WalletRegistrationService = class {
 			expectedOrigin: ownerProofContext.expectedOrigin,
 			expiresAtMs: args.input.authorization.kind === "wallet_session" ? args.setupClaims.expiresAtMs : ownerProofContext.expiresAtMs
 		});
-		const initialSessionPlan = sessionPredecessor.kind === "ed25519_only" && !registrationSignerBranchesFromPlan(source.ceremony.signerPlan).evmFamilyEcdsa ? {
+		const completion = source.kind === "stored_ceremony" ? source.ceremony.intent.completion : "wallet_session";
+		if (completion === "owner_operations" && args.input.onSessionCommitted) return unissuedRegistrationCommit({
+			ok: false,
+			code: "invalid_body",
+			message: "Owner-operation registration cannot seal a Wallet Session"
+		});
+		const initialSessionPlan = completion === "wallet_session" && sessionPredecessor.kind === "ed25519_only" && !registrationSignerBranchesFromPlan(source.ceremony.signerPlan).evmFamilyEcdsa ? {
 			kind: "initial_near",
 			store: this.registrationSessionStore,
 			request: {
@@ -2202,6 +2208,31 @@ var CloudflareD1WalletRegistrationService = class {
 				message: "NEAR provisioning committed a non-NEAR branch"
 			});
 		}
+		if (completion === "owner_operations") {
+			if (!this.registrationAuthority) throw new Error("Registration home completion is unavailable");
+			const custody = await execution.custody;
+			return {
+				kind: "owner_registered",
+				expectedOrigin: ownerProofContext.expectedOrigin,
+				response: {
+					...finalized,
+					walletCustody: custody.outcome,
+					registrationEstablishedSession: {
+						kind: "owner_operations",
+						walletId: finalized.walletId
+					}
+				},
+				custodyWrite: custody.kind === "prepared" ? custody.write : null,
+				activation: this.registrationAuthority.prepareEstablished({
+					registration: {
+						ceremonyId: args.input.registrationCeremonyId,
+						walletId: finalized.walletId,
+						state: "registering"
+					},
+					session: { kind: "none" }
+				})
+			};
+		}
 		if (!this.registrationAuthority) throw new Error("Registration home completion is unavailable");
 		const [issuance, custody] = await Promise.allSettled([recordRegistrationPromiseTiming({
 			sink: args.serverTiming,
@@ -2306,6 +2337,16 @@ var CloudflareD1WalletRegistrationService = class {
 	async replayWalletRegistrationNearProvisioningCommit(receipt) {
 		if (receipt.operation !== "near_provisioning") throw new Error("Registration NEAR provisioning receipt operation is invalid");
 		if (receipt.committed.kind === "error") return replayedRegistrationCommit(receipt.committed.error);
+		if (receipt.committed.kind === "near_owner_ready") {
+			const response = receipt.committed.response;
+			return replayedRegistrationCommit({
+				...response,
+				registrationEstablishedSession: {
+					kind: "owner_operations",
+					walletId: response.walletId
+				}
+			});
+		}
 		if (receipt.committed.kind !== "near_ready") throw new Error("Registration NEAR provisioning receipt branch is invalid");
 		if (!isRegistrationNearReadyReceipt(receipt)) throw new Error("Registration NEAR provisioning receipt branch is invalid");
 		const authMethod = registrationReplayAuthMethodFields(receipt);
@@ -2530,6 +2571,7 @@ var CloudflareD1WalletRegistrationService = class {
 						nowMs: Date.now()
 					})
 				}), waitUntil ? void 0 : cleanup]);
+				if (committed.registrationEstablishedSession.kind === "owner_operations") throw new Error("A Wallet Session continuation cannot complete owner-only registration");
 				const tokens = committed.registrationEstablishedSession.session.tokens;
 				if (!current || tokens.kind !== "near_ed25519_and_evm_family_ecdsa") throw new Error("NEAR continuation Wallet Session is no longer active");
 				recordRegistrationServerTiming(serverTiming, "near_finalize_total", totalStartedAtMs);

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationSetup.js

@@ -51,8 +51,20 @@ function normalizeWalletRegistrationSetupRequest(request) {
 		code: "invalid_body",
 		message: "authMethod is required"
 	};
+	const completion = request.completion;
+	if (completion !== "wallet_session" && completion !== "owner_operations") return {
+		ok: false,
+		code: "invalid_body",
+		message: "Registration completion is required"
+	};
+	if (completion === "owner_operations" && (signerSelection.value.signers.length !== 1 || signerSelection.value.signers[0]?.kind !== "near_ed25519" || authMethod.kind !== "passkey")) return {
+		ok: false,
+		code: "invalid_body",
+		message: "Owner-operation onboarding requires a NEAR-only wallet and a wallet-origin passkey"
+	};
 	return {
 		ok: true,
+		completion,
 		signerSelection: signerSelection.value,
 		authMethod
 	};

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationSetupExecution.js

@@ -97,6 +97,7 @@ async function completeReservedRegistrationSetup(input, dependencies, admitted,
 	if (!signingRootId) return walletRegistrationSetupError("invalid_body", "registration requires a signing root");
 	const registrationOperation = reservation;
 	const intent = buildRegistrationIntent({
+		completion: normalized.completion,
 		nonceB64u: registrationCeremonyId.slice(4),
 		walletId: wallet.walletId,
 		authMethod: normalized.authMethod,

package/dist/esm/router/cloudflare/d1/registration/registrationCompletionWrite.js

@@ -4,6 +4,7 @@ function registrationCommitCompletionWrite(execution) {
 	switch (execution.kind) {
 		case "unissued":
 		case "replayed": return null;
+		case "owner_registered":
 		case "session_issued":
 		case "session_issued_with_installation_projection":
 			if (!execution.custodyWrite) return execution.activation;

package/dist/esm/router/cloudflare/d1/registration/walletRegistrationEstablishedSessionIssuer.js

@@ -1,9 +1,9 @@
 import { mpcMaterialActivationRefsEqual, parseEmailOtpChallengeId, parseThresholdEcdsaSessionId, parseThresholdEd25519SessionId, parseWebAuthnCredentialIdB64u } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseAuthFactorId, parsePrincipalId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import "../../../../shared-ts/src/utils/encoders.js";
+import { parseAuthFactorId, parsePrincipalId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { isEmailOtpWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseSessionOrigin, parseVerifiedOwnerProofId } from "../../../../authorization/domain.js";

package/dist/esm/router/cloudflare/d1/registration/walletRegistrationSessionCommitReceipt.js

@@ -1,6 +1,6 @@
 import { parseWalletAuthMethodId, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { parseWalletAuthAuthority } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
@@ -12,6 +12,7 @@ import "../../../../shared-ts/src/passkey-custody/index.js";
 /** The home activation that a commit left for the record that completes its operation. */
 function registrationCommitActivation(execution) {
 	switch (execution.kind) {
+		case "owner_registered":
 		case "session_issued":
 		case "session_issued_with_installation_projection": return execution.activation;
 		case "unissued":
@@ -45,6 +46,7 @@ function projectRegistrationEstablishedSessionV2(session) {
 }
 function projectRegistrationEstablishedSessionResultV2(result) {
 	switch (result.kind) {
+		case "owner_operations": throw new Error("Owner registration has no session projection");
 		case "issued": return projectRegistrationEstablishedSessionV2(result.session);
 		case "already_committed": return result.session;
 		default: return assertNeverRegistrationSessionResult(result);
@@ -55,6 +57,21 @@ function assertNeverRegistrationSessionResult(value) {
 }
 function projectWalletRegistrationSessionCommitReceiptV2(input) {
 	const response = input.execution.response;
+	if (input.execution.kind === "owner_registered") {
+		if (input.operation !== "near_provisioning" || !response.ok || response.kind !== "near_ed25519" || !("registrationEstablishedSession" in response) || response.registrationEstablishedSession.kind !== "owner_operations") throw new Error("Invalid owner registration receipt");
+		const { registrationEstablishedSession, ...finalized } = response;
+		return {
+			kind: "wallet_registration_session_commit_receipt_v2",
+			operation: "near_provisioning",
+			operationFingerprint: input.operationFingerprint,
+			registrationCeremonyId: input.registrationCeremonyId,
+			committed: {
+				kind: "near_owner_ready",
+				expectedOrigin: input.execution.expectedOrigin,
+				response: finalized
+			}
+		};
+	}
 	if (!response.ok) {
 		if (input.execution.kind !== "unissued") throw new Error("Registration error receipt has an issued-session marker");
 		return {
@@ -208,6 +225,24 @@ function parseWalletRegistrationSessionCommitReceiptV2(raw, parseCommitted) {
 			}
 		};
 	}
+	if (committedRecord.kind === "near_owner_ready") {
+		if (operation !== "near_provisioning" || !hasExactKeys(record, [
+			"kind",
+			"operation",
+			"operationFingerprint",
+			"registrationCeremonyId",
+			"committed"
+		])) return null;
+		const committed = parseCommitted(record.committed);
+		if (!committed || committed.kind !== "near_owner_ready") return null;
+		return {
+			kind: "wallet_registration_session_commit_receipt_v2",
+			operation,
+			operationFingerprint,
+			registrationCeremonyId,
+			committed
+		};
+	}
 	const walletId = parseWalletId(record.walletId);
 	const walletAuthMethodId = parseWalletAuthMethodId(record.walletAuthMethodId);
 	const authority = parseWalletAuthAuthority(record.authority);

package/dist/esm/router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.js

@@ -1,6 +1,6 @@
 import { isPlainObject, requireNonEmptyString } from "../../../../shared-ts/src/utils/validation.js";
-import { normalizeRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { isD1DatabaseLike, parseD1JsonColumn } from "../../../../storage/d1Sql.js";
+import { normalizeRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { ED25519_SIGNER_ACTIVATION_ID_PATH } from "../../../../core/d1WalletStore.js";
 import { abusePrincipalKey, runtimePolicyScopeKey } from "../../../domains/signingOperations/routerAbNormalSigningAdmissionCore.js";
 //#region src/router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.ts

package/dist/esm/router/cloudflare/d1/wallet/authorizationSnapshotLayout.js

@@ -9,6 +9,7 @@ const TABLES = [
 	"wallet_recovery_code_locators",
 	"wallet_authorities",
 	"wallet_auth_methods",
+	"external_auth_associations",
 	"wallet_relocation_approvals",
 	"webauthn_credential_bindings",
 	"webauthn_authenticators",

package/dist/esm/router/cloudflare/d1/wallet/d1VoiceIdWalletSessionChallenges.js

@@ -1,9 +1,9 @@
-import { parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { d1ChangedRows, parseD1JsonColumn } from "../../../../storage/d1Sql.js";
+import { parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { buildVoiceIdWalletSessionChallenge, parseVoiceIdWalletSessionChallenge } from "../../../../shared-ts/src/authorization/voiceIdDeviceAssertion.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
-import { d1ChangedRows, parseD1JsonColumn } from "../../../../storage/d1Sql.js";
 //#region src/router/cloudflare/d1/wallet/d1VoiceIdWalletSessionChallenges.ts
 const CHALLENGE_LIFETIME_MS = 6e4;
 const EXPIRY_CLEANUP_LIMIT = 64;

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthMethodBoundary.js

@@ -1,8 +1,8 @@
 import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { buildEmailOtpWalletAuthAuthority, buildPasskeyWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { webAuthnCredentialIdB64uFromCredential } from "../../../auth/webAuthnCredentialCodecs.js";
 import { hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
-import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 //#region src/router/cloudflare/d1/wallet/d1WalletAuthMethodBoundary.ts
 function walletRegistrationFinalizeAuthMethodFromAuthority(authority) {
 	switch (authority.kind) {

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthMethodRevocationReplayStore.js

@@ -1,8 +1,8 @@
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import "../../../../shared-ts/src/utils/encoders.js";
-import { parseLinkedDeviceRevokeResultV1 } from "../../../../shared-ts/src/device-linking/deviceManagement.js";
 import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
+import { parseLinkedDeviceRevokeResultV1 } from "../../../../shared-ts/src/device-linking/deviceManagement.js";
 //#region src/router/cloudflare/d1/wallet/d1WalletAuthMethodRevocationReplayStore.ts
 const REVOCATION_PROOF_DIGEST_DOMAIN_V1 = "seams/wallet-auth-method-revocation-proof/v1";
 /**