@seams/wallet-server 0.5.0

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationService.d.ts

@@ -0,0 +1,369 @@
+import { type DeviceId, type TenantId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
+import type { AuthorizationService } from '../../../../authorization/service';
+import { type WalletId } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import type { RouterAbTraceContextV1 } from '../../../../../../shared-ts/src/utils/routerAbTraceContext';
+import { type RouterAbMpcMaterialActivationRefWire } from '../../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
+import { type RouterAbEd25519YaoExportAuthorizationIdentityV1 } from '../../../../../../shared-ts/src/utils/routerAbEd25519Yao';
+import type { DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
+import { type MpcMaterialActivationRef, type WalletAuthMethodId, type WalletAuthorityId } from '../../../../../../shared-ts/src/utils/domainIds';
+import { type RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
+import { type EcdsaDerivationServerBootstrapResponse } from '../../../../core/types';
+import { type RouterAbEcdsaDerivationNormalSigningStateV1, type RouterAbEcdsaDerivationActivationRefreshForwardedResponseV1, type RouterAbEcdsaDerivationActivationRefreshRequestV1, type RouterAbEcdsaPostRegistrationSessionActivationRequestV1, type RouterAbEcdsaRegistrationActivationReceiptV1, type RouterAbEcdsaRegistrationRequestFactsV1, type RouterAbEcdsaVerifiedClientActivationFactsV1 } from '../../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
+import { WalletRegistrationEcdsaActivationResponse } from '../../../../core/registrationContracts';
+import { type RouterAbEcdsaStrictRegistrationPort } from '../../../domains/ecdsa/routerAbEcdsaStrictRegistration';
+import type { TenantRootCustodyLineageResolverV1 } from '../../../domains/tenantRoot/tenantRootCustodyLineage';
+import { CloudflareD1RegistrationCeremonyIntentStore } from './d1RegistrationCeremonyStore';
+import type { InstalledLinkedDeviceEcdsaAuthorityProjectionV1, InstalledLinkedDeviceEd25519AuthorityProjectionV1 } from '../deviceLinking/d1LinkedDeviceAuthorityInstallService';
+import { type ThresholdEcdsaKeyInventoryDiagnostics, type ThresholdEcdsaKeyInventoryRecord } from '../../../../core/authService/thresholdEcdsaKeyInventory';
+import { type StoredWalletRegistrationEvmFamilyEcdsaPendingActivationBranch } from '../../../../core/RegistrationCeremonyStore';
+import type { WalletRegistrationNearProvisioningResponseV2, WalletRegistrationActivateResponseV2, WalletRegistrationRespondResponseV2, WalletRegistrationSetupResponseV2, WalletRegistrationSessionCommitReceiptV2 } from '../../../../core/threeRouteRegistrationContracts';
+import type { WalletRegistrationSetupInput, WalletRegistrationRespondInput, WalletRegistrationActivateInput, WalletRegistrationNearProvisioningInput } from '../../../domains/walletRegistration/walletRegistrationInputs';
+import type { CloudflareD1WalletCustodyCommitStore } from '../passkeyCustody/d1WalletCustodyCommitStore';
+import { CloudflareD1EmailOtpRegistrationEnrollmentFinalizer } from '../emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer';
+import { CloudflareD1WalletAuthMethodService } from '../wallet/d1WalletAuthMethodService';
+import type { D1WalletRegistrationCommitStore } from './d1WalletRegistrationCommitStore';
+import { type WalletEcdsaSignerKey, type WalletEcdsaSignerRecord } from '../../../../core/WalletStore';
+import type { D1WalletStore } from '../../../../core/d1WalletStore';
+import { type RouterAbEd25519YaoProductRegistrationRuntimeV1 } from '../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration';
+import type { RouterAbEd25519YaoBudgetRefreshRequestV1, RouterAbEd25519YaoBudgetRefreshResponseV1, RouterAbEd25519YaoVerifiedWalletUnlockRequestV1, RouterAbEd25519YaoVerifiedWalletUnlockResponseV1 } from '../../../domains/ed25519Yao/session/routerAbEd25519YaoWalletSession';
+import { type RouterAbEd25519YaoRegistrationSideEffectRecordV2, type RouterAbEd25519YaoRegistrationSideEffectStoreV2 } from '../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary';
+import type { CloudflareD1VersionedJsonRecordReadManyEntryV1 } from '../versionedJson/d1VersionedJsonRecordStore';
+type ActivateWalletRegistrationEcdsaInput = {
+    readonly registrationCeremonyId: string;
+    readonly ecdsa: {
+        readonly kind: 'router_ab_ecdsa_registration_activation_v1';
+        readonly activationCorrelationId: NonNullable<WalletRegistrationActivateInput['ecdsa']>['activationCorrelationId'];
+        readonly activationRequestDigestB64u: NonNullable<WalletRegistrationActivateInput['ecdsa']>['activationRequestDigestB64u'];
+        readonly publicFacts: NonNullable<WalletRegistrationActivateInput['ecdsa']>['clientActivation'];
+    };
+};
+export type D1LinkedDeviceEd25519AuthorityReaderV1 = {
+    readInstalledEd25519AuthorityByIdentityV1(input: {
+        readonly walletId: WalletId;
+        readonly authorityId: WalletAuthorityId;
+        readonly walletAuthMethodId: WalletAuthMethodId;
+    }): Promise<InstalledLinkedDeviceEd25519AuthorityProjectionV1 | null>;
+    readInstalledEd25519AuthorityByMaterialActivationV1(input: {
+        readonly walletId: WalletId;
+        readonly materialActivation: MpcMaterialActivationRef;
+    }): Promise<InstalledLinkedDeviceEd25519AuthorityProjectionV1 | null>;
+    readonly readInstalledEcdsaAuthorityByIdentityV1?: (input: {
+        readonly walletId: WalletId;
+        readonly authorityId: WalletAuthorityId;
+        readonly walletAuthMethodId: WalletAuthMethodId;
+    }) => Promise<InstalledLinkedDeviceEcdsaAuthorityProjectionV1 | null>;
+    readonly readInstalledEcdsaAuthorityByMaterialActivationV1?: (input: {
+        readonly walletId: WalletId;
+        readonly materialActivation: MpcMaterialActivationRef;
+    }) => Promise<InstalledLinkedDeviceEcdsaAuthorityProjectionV1 | null>;
+};
+export type D1WalletRegistrationOperationPreparedV1 = {
+    readonly kind: 'd1_wallet_registration_operation_prepared_v1';
+    readonly walletAuthorityId: WalletAuthorityId;
+    readonly deviceId: DeviceId;
+    readonly walletAuthMethodId: WalletAuthMethodId;
+};
+/** The activate operation row stores one credential-free commit receipt. */
+export type D1WalletRegistrationActivateSideEffectRecord = RouterAbEd25519YaoRegistrationSideEffectRecordV2<WalletRegistrationSessionCommitReceiptV2, D1WalletRegistrationOperationPreparedV1>;
+export type D1WalletRegistrationActivateSideEffectStore = RouterAbEd25519YaoRegistrationSideEffectStoreV2<WalletRegistrationSessionCommitReceiptV2, D1WalletRegistrationOperationPreparedV1> & {
+    listByKeyPrefix(keyStartsWith: string, options?: {
+        readonly limit?: number;
+    }): Promise<readonly CloudflareD1VersionedJsonRecordReadManyEntryV1<D1WalletRegistrationActivateSideEffectRecord>[]>;
+};
+export type D1WalletRegistrationNearProvisioningSideEffectStore = RouterAbEd25519YaoRegistrationSideEffectStoreV2<WalletRegistrationSessionCommitReceiptV2, D1WalletRegistrationOperationPreparedV1>;
+export type D1WalletRegistrationNearProvisioningSideEffectRecord = RouterAbEd25519YaoRegistrationSideEffectRecordV2<WalletRegistrationSessionCommitReceiptV2, D1WalletRegistrationOperationPreparedV1>;
+type RegistrationCeremonyStoreProvider = () => CloudflareD1RegistrationCeremonyIntentStore;
+type WalletStoreProvider = () => D1WalletStore;
+type Ed25519YaoProductRegistrationProvider = () => RouterAbEd25519YaoProductRegistrationRuntimeV1 | null;
+export type SponsoredNamedNearAccountCreationResult = {
+    readonly kind: 'created';
+    readonly accountId: string;
+    readonly transactionHash: string;
+} | {
+    readonly kind: 'rejected';
+    readonly message: string;
+} | {
+    readonly kind: 'retryable';
+    readonly message: string;
+    readonly retryAfterMs: number;
+};
+type SponsoredNamedNearAccountCreator = (input: {
+    readonly accountId: string;
+    readonly publicKey: string;
+    /**
+     * Registration-scoped key. The provisioning boundary persists the signed
+     * transaction under this key before broadcasting, so a retry replays those
+     * exact bytes instead of building a second transaction.
+     */
+    readonly idempotencyKey: string;
+}) => Promise<SponsoredNamedNearAccountCreationResult>;
+export declare function hasEcdsaKeyHandleSetMismatch(expectedKeyHandles: readonly string[], actualKeyHandles: readonly string[]): boolean;
+export declare function ecdsaStrictRegistrationAuthority(facts: RouterAbEcdsaRegistrationRequestFactsV1): {
+    readonly subjectId: string;
+    readonly sessionId: string;
+    readonly accountId: string;
+    readonly expiresAtMs: number;
+};
+export declare function exactEcdsaParticipantPair(participantIds: readonly number[]): readonly [1, 2];
+type D1PendingEcdsaFamilyActivation = {
+    readonly prepare: StoredWalletRegistrationEvmFamilyEcdsaPendingActivationBranch['prepare'];
+    readonly strictRegistration: StoredWalletRegistrationEvmFamilyEcdsaPendingActivationBranch['strictRegistration'];
+};
+export declare function buildActivatedEcdsaFamilyBootstrap(input: {
+    readonly branch: D1PendingEcdsaFamilyActivation;
+    readonly publicFacts: RouterAbEcdsaVerifiedClientActivationFactsV1;
+    readonly activation: RouterAbEcdsaRegistrationActivationReceiptV1;
+}): Promise<EcdsaDerivationServerBootstrapResponse>;
+type EcdsaPostRegistrationProofInput = {
+    readonly operation: 'refresh';
+    readonly request: RouterAbEcdsaDerivationActivationRefreshRequestV1;
+    readonly response: RouterAbEcdsaDerivationActivationRefreshForwardedResponseV1;
+};
+/**
+ * Folds the Router's own `Server-Timing` header into the Gateway's span list
+ * (Refactor 94B Phase 0), so the Router and role-worker breakdown reaches the
+ * browser on the same header as the Gateway's own boundaries.
+ *
+ * Entries without a finite non-negative `dur` are dropped, which also discards
+ * Cloudflare's descriptive metrics, and names are restricted to a token
+ * charset so a metric name can never forge extra entries downstream.
+ */
+export declare function mergeRouterServerTiming(target: Array<readonly [string, number]>, header: string): void;
+export declare class CloudflareD1WalletRegistrationService {
+    private readonly authorizationService;
+    private readonly authorizationTenantId;
+    private readonly createSponsoredNamedNearAccount;
+    private readonly emailOtpRegistrationEnrollmentFinalizer;
+    private readonly getRegistrationCeremonyIntentStore;
+    private readonly getEd25519YaoProductRegistration;
+    private readonly ecdsaStrictRegistration;
+    private readonly tenantRootCustodyLineage;
+    private readonly getWalletStore;
+    /** The single Gateway operation row for activate-with-finalize (94C). */
+    private readonly activateSideEffects;
+    /** Deferred NEAR provisioning's own operation row (94C). */
+    private readonly nearProvisioningSideEffects;
+    private readonly walletRegistrationCommitStore;
+    /** Where a ceremony's sealed custody seed and its recovery set land. */
+    private readonly walletCustodyCommitStore;
+    private readonly walletAuthMethods;
+    private readonly getLinkedDeviceEd25519AuthorityReader;
+    constructor(input: {
+        readonly authorizationService: AuthorizationService;
+        readonly authorizationTenantId: TenantId;
+        readonly createSponsoredNamedNearAccount: SponsoredNamedNearAccountCreator;
+        readonly emailOtpRegistrationEnrollmentFinalizer: CloudflareD1EmailOtpRegistrationEnrollmentFinalizer;
+        readonly getRegistrationCeremonyIntentStore: RegistrationCeremonyStoreProvider;
+        readonly getEd25519YaoProductRegistration: Ed25519YaoProductRegistrationProvider;
+        readonly ecdsaStrictRegistration: RouterAbEcdsaStrictRegistrationPort;
+        readonly tenantRootCustodyLineage: TenantRootCustodyLineageResolverV1;
+        readonly getWalletStore: WalletStoreProvider;
+        readonly activateSideEffects: D1WalletRegistrationActivateSideEffectStore;
+        readonly nearProvisioningSideEffects: D1WalletRegistrationNearProvisioningSideEffectStore;
+        readonly walletRegistrationCommitStore: D1WalletRegistrationCommitStore;
+        readonly walletCustodyCommitStore: CloudflareD1WalletCustodyCommitStore;
+        readonly walletAuthMethods: CloudflareD1WalletAuthMethodService;
+        readonly getLinkedDeviceEd25519AuthorityReader: () => D1LinkedDeviceEd25519AuthorityReaderV1 | null;
+    });
+    getWalletRegistrationRuntimePolicyScope(registrationCeremonyId: string): Promise<RuntimePolicyScope | undefined>;
+    resolveEd25519MaterialActivation(input: {
+        readonly walletId: string;
+        readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
+    }): Promise<{
+        readonly ok: true;
+        readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
+        readonly nearAccountId: string;
+        readonly signerSlot: number;
+        readonly signingWorkerId: string;
+        readonly participantIds: readonly [number, number];
+        readonly runtimePolicyScope: RuntimePolicyScope;
+        readonly exportIdentity: RouterAbEd25519YaoExportAuthorizationIdentityV1;
+    } | {
+        readonly ok: false;
+        readonly code: 'not_found' | 'internal';
+        readonly message: string;
+    }>;
+    resolveEcdsaMaterialActivation(input: {
+        readonly walletId: string;
+        readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
+    }): Promise<{
+        readonly ok: true;
+        readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
+        readonly keyHandle: string;
+        readonly relayerKeyId: string;
+        readonly participantIds: readonly [number, number];
+        readonly runtimePolicyScope: RuntimePolicyScope;
+        readonly routerAbEcdsaDerivationNormalSigning: RouterAbEcdsaDerivationNormalSigningStateV1;
+    } | {
+        readonly ok: false;
+        readonly code: 'not_found' | 'internal';
+        readonly message: string;
+    }>;
+    resolveActiveEd25519TenantRoot(input: {
+        readonly walletId: string;
+        readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
+    }): Promise<{
+        readonly ok: true;
+        readonly identityDigestB64u: string;
+        readonly custodyLineageB64u: string;
+    } | {
+        readonly ok: false;
+        readonly code: 'not_found' | 'invalid_state' | 'internal';
+        readonly message: string;
+    }>;
+    resolveActiveEcdsaTenantRoot(input: {
+        readonly walletId: string;
+        readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
+    }): Promise<{
+        readonly ok: true;
+        readonly identityDigestB64u: string;
+        readonly custodyLineageB64u: string;
+    } | {
+        readonly ok: false;
+        readonly code: 'not_found' | 'invalid_state' | 'internal';
+        readonly message: string;
+    }>;
+    listWalletEcdsaKeyFactsInventory(input: {
+        readonly walletId: string;
+        readonly rpId: string;
+        readonly keyTargets: readonly unknown[];
+    }): Promise<{
+        readonly records: ThresholdEcdsaKeyInventoryRecord[];
+        readonly diagnostics: ThresholdEcdsaKeyInventoryDiagnostics;
+    }>;
+    listWalletEcdsaCustodyContinuity(input: {
+        readonly walletId: string;
+    }): Promise<readonly WalletEcdsaSignerRecord[]>;
+    recordEcdsaPostRegistrationProof(input: EcdsaPostRegistrationProofInput): Promise<{
+        readonly ok: true;
+    } | {
+        readonly ok: false;
+        readonly code: string;
+        readonly message: string;
+    }>;
+    activateEcdsaPostRegistrationSession(input: RouterAbEcdsaPostRegistrationSessionActivationRequestV1): Promise<{
+        readonly ok: true;
+        readonly walletKey: WalletEcdsaSignerKey;
+        readonly session: {
+            readonly thresholdSessionId: string;
+            readonly expiresAtMs: number;
+            readonly remainingUses: number;
+        };
+        readonly normalSigning: RouterAbEcdsaDerivationNormalSigningStateV1;
+        /** Recorded on the signer record when registration verified this key set. */
+        readonly keyManifestDigestB64u: DigestB64u;
+    } | {
+        readonly ok: false;
+        readonly code: string;
+        readonly message: string;
+    }>;
+    refreshEd25519YaoWalletSession(request: RouterAbEd25519YaoBudgetRefreshRequestV1): Promise<RouterAbEd25519YaoBudgetRefreshResponseV1>;
+    provisionEd25519YaoWalletSession(request: RouterAbEd25519YaoVerifiedWalletUnlockRequestV1): Promise<RouterAbEd25519YaoVerifiedWalletUnlockResponseV1>;
+    /**
+     * Refactor 94C. `/wallets/register/setup` — grant, intent, and start in one
+     * request, with one D1 write.
+     *
+     * Setup runs before the client's WebAuthn create, because it issues the
+     * challenge that create signs. So the ECDSA prepare and the Ed25519
+     * admission — the two Router calls that dominated the measured cold path —
+     * overlap the authenticator prompt instead of being serialized after it.
+     * They are started before either is awaited: they share no state and neither
+     * can invalidate the other.
+     */
+    setupWalletRegistration(input: WalletRegistrationSetupInput): Promise<WalletRegistrationSetupResponseV2>;
+    respondWalletRegistration(input: WalletRegistrationRespondInput, traceContext?: RouterAbTraceContextV1): Promise<WalletRegistrationRespondResponseV2>;
+    /**
+     * The Ed25519 commit core, extracted so deferred provisioning reaches it
+     * without going through the standalone finalize wrapper. The operation row
+     * owns idempotency here, so the commit keeps no replay cache of its own.
+     */
+    private readRegistrationOwnerProofContext;
+    private registrationOwnerProof;
+    /** For callers that must read the context before finalize tombstones it. */
+    private registrationOwnerProofWithContext;
+    private readCommittedRegistrationInstallation;
+    private prepareNearProvisioningOperation;
+    private commitDeferredEd25519Signer;
+    private replayWalletRegistrationActivateCommit;
+    private replayWalletRegistrationNearProvisioningCommit;
+    /**
+     * Deferred NEAR provisioning. Verifies the signed setup, then reuses the
+     * existing deferred Ed25519 commit — the same path lazy-Yao 4+5 built — so
+     * signer installation and the implicit-account projection keep one
+     * implementation across both plans.
+     *
+     * A retryable failure leaves the pending wallet intact: the wallet must not
+     * be destroyed because its signer ceremony needs another attempt.
+     */
+    completeWalletRegistrationNearProvisioning(input: WalletRegistrationNearProvisioningInput): Promise<WalletRegistrationNearProvisioningResponseV2>;
+    /**
+     * Persists the Ed25519-only wallet in `near_pending`: wallet, profile, and
+     * authentication state, and no signer record — the signer does not exist
+     * until deferred Yao produces it.
+     *
+     * The terminal response carries no signer, resolved account, or key
+     * identity, because none of those are known yet. Reporting them would be
+     * fabricating readiness.
+     */
+    private commitEd25519PendingWallet;
+    /**
+     * Ed25519-only respond. The wallet's sole signer is Yao, and that is
+     * deliberately not a reason to block: the admission is returned as deferred
+     * work exactly as on a mixed plan, and the wallet lives in `near_pending`
+     * until the computation completes.
+     */
+    /**
+     * Respond replay stays authority-bound.
+     *
+     * `signedSetup` is client-carried, so possession of it must never recover a
+     * stored respond result. Re-verifying the proof is necessary but not
+     * sufficient: registration *mints* the credential, so a fresh passkey over
+     * the same challenge would verify. The replayed proof must therefore resolve
+     * to the same authority that admitted the stored result.
+     */
+    private verifyRespondReplayAuthority;
+    private respondEd25519OnlyRegistration;
+    /**
+     * Derives the authority-bound Yao admission now that the proof is verified.
+     * Both auth methods take this path — the scope comes from the verified
+     * authority, so Email OTP's `providerUserId` is established rather than
+     * assumed.
+     */
+    private admitRespondEd25519Branch;
+    /**
+     * Refactor 94C. `/wallets/register/activate` — activation and finalization
+     * as one irreversible step behind one Gateway operation row.
+     *
+     * Previously activation and finalization were separate requests with
+     * separate idempotency: activation claimed and CAS'd the ceremony branch,
+     * then finalize opened its own side-effect journal *and* maintained a second
+     * replay cache. Three records guarding one irreversible commit, each with
+     * its own failure window.
+     *
+     * Here the operation row is the only one. Its claim is the activation claim,
+     * and its completion record holds one credential-free session receipt plus
+     * the request fingerprint. The direct-capability first response carries one
+     * ephemeral primary credential after the receipt CAS; exact retry returns
+     * the committed projection without fabricating a credential or repeating a
+     * custody effect. A conflicting fingerprint is refused
+     * before execution; an ambiguous outcome after the custody call stays
+     * `uncertain` rather than being guessed either way.
+     */
+    activateWalletRegistration(input: WalletRegistrationActivateInput, traceContext?: RouterAbTraceContextV1): Promise<WalletRegistrationActivateResponseV2>;
+    /**
+     * Router/SigningWorker activation followed by the blocking finalize
+     * persistence, as one unit inside the operation row. The commit is told the
+     * operation row owns idempotency, so it maintains no replay cache of its own.
+     */
+    private executeWalletRegistrationActivation;
+    activateWalletRegistrationEcdsa(request: ActivateWalletRegistrationEcdsaInput, traceContext: RouterAbTraceContextV1 | undefined, 
+    /**
+     * The activate operation-row identity (idempotency key). The activation
+     * claim is owned by exactly one operation: a concurrent activate with a
+     * different key must not adopt the claim and re-run Router custody.
+     */
+    activationOwner: string): Promise<WalletRegistrationEcdsaActivationResponse>;
+    private executeWalletRegistrationFinalize;
+}
+export {};
+//# sourceMappingURL=d1WalletRegistrationService.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationSetup.d.ts

@@ -0,0 +1,106 @@
+/**
+ * Refactor 94C. `/wallets/register/setup` — one request replacing the bootstrap
+ * grant, the registration intent, and registration start.
+ *
+ * The three legs it replaces made six-plus serialized storage round trips
+ * between them, most of it bookkeeping written on every request and read on
+ * almost none: a grant record so the next leg could read back a decision the
+ * grant check had already made, a wallet reservation so a later insert would
+ * not collide, and a start journal so a duplicate start could be reconciled.
+ * Collapsing the legs removes the readers, so the writes go too.
+ *
+ * What remains is one canonical D1 write: the ceremony row. That row is the
+ * ceremony's existence — it is not insurance against a failure elsewhere.
+ *
+ * Setup necessarily runs *before* the client's WebAuthn create, because setup
+ * issues the challenge that create must sign. So it stores the ceremony with
+ * its authority awaiting proof, and respond binds the proof one leg later.
+ * The valuable consequence is that the ECDSA preparation — the Router call
+ * that dominated the measured cold path — overlaps the user's authenticator
+ * interaction instead of being serialized after it.
+ *
+ * Setup is ECDSA-only for both authentication methods. Yao admission binds the
+ * Ed25519 authority scope, which is only sound once the proof is verified, so
+ * respond derives it. Admitting at setup would have been possible for a
+ * passkey and not for Email OTP, and two setup protocols split by auth method
+ * is a worse contract than one that always defers.
+ *
+ * The wallet reservation is deliberately not carried over. It existed so a
+ * randomly generated wallet id allocated at intent time could not be taken
+ * before start inserted the ceremony — a window that no longer exists now that
+ * allocation and insertion are the same request. Genuine uniqueness is still
+ * arbitrated where it always was, by the wallet table at commit.
+ */
+import { type RegisterWalletInput, type RegistrationAuthMethodInput, type RegistrationSignerSetSelection, type WalletId } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import type { RespondEd25519DeferredWorkV2, WalletRegistrationRespondResponseV2, WalletRegistrationSetupResponseV2 } from '../../../../core/threeRouteRegistrationContracts';
+import type { StoredWalletRegistrationCeremony } from '../../../../core/RegistrationCeremonyStore';
+import { mintSignedWalletRegistrationSetup, type WalletRegistrationSetupMinter } from '../../../domains/walletRegistration/walletRegistrationSetupPayload';
+import type { WalletRegistrationSetupRequest } from '../../../domains/walletRegistration/walletRegistrationInputs';
+export declare function walletRegistrationSetupIds(): {
+    readonly registrationCeremonyId: string;
+    readonly registrationPreparationId: string;
+};
+/**
+ * Resolves the wallet id without reserving it.
+ *
+ * A provided id is taken as given; an absent or server-allocated one is
+ * generated. There is no existence pre-check: it cost a serialized read on
+ * every registration to catch a collision that the commit-time uniqueness
+ * constraint catches anyway, and for a freshly generated random id it could
+ * essentially never fire.
+ */
+export declare function resolveWalletRegistrationSetupWalletId(input: {
+    readonly wallet: RegisterWalletInput | undefined;
+    readonly parseProvided: (raw: unknown) => WalletId | null;
+    readonly createServerAllocated: () => WalletId;
+}): {
+    readonly ok: true;
+    readonly walletId: WalletId;
+} | {
+    readonly ok: false;
+    readonly code: string;
+    readonly message: string;
+};
+export declare function normalizeWalletRegistrationSetupRequest(request: WalletRegistrationSetupRequest): {
+    readonly ok: true;
+    readonly signerSelection: RegistrationSignerSetSelection;
+    readonly authMethod: RegistrationAuthMethodInput;
+} | {
+    readonly ok: false;
+    readonly code: string;
+    readonly message: string;
+};
+export declare function walletRegistrationSetupExpiresAtMs(nowMs: number): number;
+/**
+ * Mints the payload routes 2 and 3 verify, over setup's own canonical digest.
+ */
+export declare function buildWalletRegistrationSetupSignature(input: {
+    readonly signer: WalletRegistrationSetupMinter;
+    readonly ceremony: StoredWalletRegistrationCeremony;
+    readonly expectedOrigin: string;
+}): Promise<{
+    readonly signedSetup: Awaited<ReturnType<typeof mintSignedWalletRegistrationSetup>>;
+    readonly setupDigestB64u: string;
+}>;
+export declare function walletRegistrationSetupIntentDigest(intent: StoredWalletRegistrationCeremony['intent']): Promise<string>;
+/**
+ * Builds respond's discriminated result. The signer plan decides the shape:
+ * a mixed plan always carries its deferred NEAR work, an ECDSA-only plan has
+ * no arm to omit. There is no optional `ed25519` member to forget to check.
+ */
+export declare function walletRegistrationRespondResult(input: {
+    readonly ceremony: {
+        readonly registrationCeremonyId: string;
+    };
+    readonly strictResult: unknown;
+    readonly ed25519: RespondEd25519DeferredWorkV2 | null;
+}): WalletRegistrationRespondResponseV2;
+/**
+ * Recovers the deferred NEAR work from a ceremony that already advanced, so an
+ * exact respond replay returns the same shape it returned the first time.
+ */
+export declare function storedRespondEd25519DeferredWork(signerState: StoredWalletRegistrationCeremony['signerState']): RespondEd25519DeferredWorkV2 | null;
+export declare function walletRegistrationSetupError(code: string, message: string): Extract<WalletRegistrationSetupResponseV2, {
+    ok: false;
+}>;
+//# sourceMappingURL=d1WalletRegistrationSetup.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/walletRegistrationEstablishedSessionIssuer.d.ts

@@ -0,0 +1,104 @@
+import type { WalletRegistrationEd25519YaoPublicResult, WalletRegistrationFinalizeAuthMethod } from '../../../../core/registrationContracts';
+import { type VerifiedOwnerProof } from '../../../../authorization/factorEvidence';
+import type { AuthorizationService } from '../../../../authorization/service';
+import type { EcdsaDerivationServerBootstrapResponse } from '../../../../core/types';
+import type { WalletRegistrationSessionCommitReceiptV2 } from '../../../../core/threeRouteRegistrationContracts';
+import type { StoredRegistrationAuthority } from '../../../../core/RegistrationCeremonyStore';
+import { type PrincipalId, type TenantId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
+import type { ActiveWalletAuthorityV1 } from '../../../../../../shared-ts/src/authorization/walletAuthority';
+import { type WalletAuthMethodId } from '../../../../../../shared-ts/src/utils/domainIds';
+import { type WalletAuthAuthority } from '../../../../../../shared-ts/src/utils/walletAuthAuthority';
+import { type DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
+import type { RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
+import type { RegistrationEstablishedSessionProjectionTokensV2, RegistrationEstablishedSessionProjectionV2, RegistrationEstablishedSessionResultV2, RegistrationEstablishedSessionV2 } from '../../../../../../shared-ts/src/utils/registrationEstablishedSession';
+export type RegistrationEstablishedSessionIssuerAuthorizationService = Pick<AuthorizationService, 'issueDirectWalletSessionAuthorizationV2' | 'issueDirectRegistrationPromotedWalletSessionAuthorizationV2' | 'readWalletSessionAuthorizationV2ByMint' | 'readWalletSessionAuthorizationV2ByAuthorizationId' | 'refreshWalletSessionAuthorizationV2AuthorityProjection'>;
+export type RegistrationEstablishedSessionIssuerWalletAuthMethodReader = {
+    readonly readActiveRegistrationAuthority: (authority: StoredRegistrationAuthority) => Promise<{
+        readonly authority: ActiveWalletAuthorityV1;
+        readonly walletAuthMethodId: WalletAuthMethodId;
+    } | null>;
+};
+type RegistrationEstablishedSessionIssuanceDependencies = {
+    readonly authorizationService: RegistrationEstablishedSessionIssuerAuthorizationService;
+    readonly authorizationTenantId: TenantId;
+    readonly walletAuthMethods: RegistrationEstablishedSessionIssuerWalletAuthMethodReader;
+};
+export declare function walletSessionPrincipalId(authority: WalletAuthAuthority): PrincipalId;
+export declare function buildRegistrationOwnerProof(input: {
+    readonly registrationCeremonyId: string;
+    readonly authMethod: WalletRegistrationFinalizeAuthMethod;
+    readonly authority: WalletAuthAuthority;
+    readonly tenantId: TenantId;
+    readonly expectedOrigin: string;
+    readonly expiresAtMs: number;
+}): Promise<Extract<VerifiedOwnerProof, {
+    readonly purpose: 'wallet_session';
+}>>;
+export type RegistrationEstablishedSessionIssuanceResultV2 = {
+    readonly kind: 'issued';
+    readonly session: RegistrationEstablishedSessionV2;
+    readonly issuedAtMs: number;
+} | {
+    readonly kind: 'already_committed';
+    readonly session: RegistrationEstablishedSessionProjectionV2;
+    readonly next: 'unlock_exact_method';
+    readonly issuedAtMs: number;
+};
+export type Ed25519RegistrationSessionPredecessor = {
+    readonly kind: 'ed25519_only';
+} | {
+    readonly kind: 'mixed';
+    readonly ecdsa: Extract<RegistrationEstablishedSessionProjectionTokensV2, {
+        readonly kind: 'evm_family_ecdsa';
+    }>['ecdsa'];
+};
+export declare function assertDirectWalletSessionOwnerProof(input: {
+    readonly proof: Extract<VerifiedOwnerProof, {
+        readonly purpose: 'wallet_session';
+    }>;
+    readonly tenantId: TenantId;
+    readonly authority: WalletAuthAuthority;
+    readonly activeAuthority: ActiveWalletAuthorityV1;
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly nowMs: number;
+}): Promise<void>;
+export declare function issueDirectRegistrationEstablishedEcdsaSession(input: RegistrationEstablishedSessionIssuanceDependencies & {
+    readonly registrationCeremonyId: string;
+    readonly authority: WalletAuthAuthority;
+    readonly registrationAuthority: StoredRegistrationAuthority;
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly expiresAtMs: number;
+    readonly remainingUses: number;
+    readonly bootstrap: EcdsaDerivationServerBootstrapResponse;
+    readonly runtimePolicyScope: RuntimePolicyScope;
+    readonly keyManifestDigestB64u: DigestB64u;
+    readonly proof: Extract<VerifiedOwnerProof, {
+        readonly purpose: 'wallet_session';
+    }>;
+}): Promise<RegistrationEstablishedSessionIssuanceResultV2>;
+export declare function issueDirectRegistrationEstablishedEd25519Session(input: RegistrationEstablishedSessionIssuanceDependencies & {
+    readonly registrationCeremonyId: string;
+    readonly authority: WalletAuthAuthority;
+    readonly registrationAuthority: StoredRegistrationAuthority;
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly expiresAtMs: number;
+    readonly remainingUses: number;
+    readonly publicResult: WalletRegistrationEd25519YaoPublicResult;
+    readonly predecessor: Ed25519RegistrationSessionPredecessor;
+    readonly keyManifestDigestB64u: DigestB64u;
+    readonly proof: Extract<VerifiedOwnerProof, {
+        readonly purpose: 'wallet_session';
+    }>;
+}): Promise<RegistrationEstablishedSessionIssuanceResultV2>;
+export declare function replayDirectRegistrationEstablishedEcdsaSession(receipt: Extract<WalletRegistrationSessionCommitReceiptV2, {
+    readonly committed: {
+        readonly kind: 'ecdsa_ready';
+    };
+}>): RegistrationEstablishedSessionResultV2;
+export declare function replayDirectRegistrationEstablishedEd25519Session(receipt: Extract<WalletRegistrationSessionCommitReceiptV2, {
+    readonly committed: {
+        readonly kind: 'near_ready';
+    };
+}>): RegistrationEstablishedSessionResultV2;
+export {};
+//# sourceMappingURL=walletRegistrationEstablishedSessionIssuer.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/walletRegistrationSessionCommitReceipt.d.ts

@@ -0,0 +1,70 @@
+import type { WalletRegistrationFinalizeResponse, WalletRegistrationFinalizeSuccess, WalletRegistrationFinalizeAuthMethod } from '../../../../core/registrationContracts';
+import type { WalletRegistrationActivateResponseV2, WalletRegistrationCommittedInstallationProjectionV1, WalletRegistrationSessionCommitReceiptV2 } from '../../../../core/threeRouteRegistrationContracts';
+import type { RegistrationEstablishedSessionV2, RegistrationEstablishedSessionResultV2, RegistrationEstablishedSessionProjectionV2 } from '../../../../../../shared-ts/src/utils/registrationEstablishedSession';
+import { type WalletSessionMintId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
+export type WalletRegistrationNearProvisioningFinalizeResponse = WalletRegistrationFinalizeResponse | (Extract<WalletRegistrationFinalizeSuccess, {
+    readonly kind: 'near_ed25519';
+}> & {
+    readonly registrationEstablishedSession: RegistrationEstablishedSessionResultV2;
+});
+export type RegistrationCommitExecution<T> = {
+    readonly kind: 'unissued';
+    readonly response: T;
+} | {
+    readonly kind: 'replayed';
+    readonly response: T;
+} | {
+    readonly kind: 'near_pending';
+    readonly response: T;
+    readonly expectedOrigin: string;
+} | {
+    readonly kind: 'session_issued';
+    readonly response: T;
+    readonly issuedAtMs: number;
+    readonly expectedOrigin: string;
+    readonly installationProjection?: never;
+} | {
+    readonly kind: 'session_issued_with_installation_projection';
+    readonly response: T;
+    readonly issuedAtMs: number;
+    readonly expectedOrigin: string;
+    readonly installationProjection: WalletRegistrationCommittedInstallationProjectionV1;
+};
+export declare function unissuedRegistrationCommit<T>(response: T): RegistrationCommitExecution<T>;
+export declare function replayedRegistrationCommit<T>(response: T): RegistrationCommitExecution<T>;
+export declare function projectRegistrationEstablishedSessionV2(session: RegistrationEstablishedSessionV2): RegistrationEstablishedSessionProjectionV2;
+export declare function projectWalletRegistrationSessionCommitReceiptV2(input: {
+    readonly operation: 'registration_activate' | 'near_provisioning';
+    readonly operationFingerprint: string;
+    readonly registrationCeremonyId: string;
+    readonly execution: RegistrationCommitExecution<WalletRegistrationActivateResponseV2 | WalletRegistrationNearProvisioningFinalizeResponse>;
+}): WalletRegistrationSessionCommitReceiptV2;
+type WalletRegistrationIdentityCommitReceiptV2 = Exclude<WalletRegistrationSessionCommitReceiptV2, {
+    readonly committed: {
+        readonly kind: 'error';
+    };
+}>;
+export type RegistrationReplayAuthMethodFields = {
+    readonly kind: 'passkey';
+    readonly authMethod: Extract<WalletRegistrationFinalizeAuthMethod, {
+        readonly kind: 'passkey';
+    }>;
+    readonly rpId: string;
+} | {
+    readonly kind: 'email_otp';
+    readonly authMethod: Extract<WalletRegistrationFinalizeAuthMethod, {
+        readonly kind: 'email_otp';
+    }>;
+    readonly rpId?: never;
+};
+export declare function registrationReplayAuthMethodFields(receipt: WalletRegistrationIdentityCommitReceiptV2): RegistrationReplayAuthMethodFields;
+export declare function registrationEstablishedMintId(registrationCeremonyId: string): WalletSessionMintId;
+export type RegistrationCommitReceiptCommittedParser = (raw: unknown) => WalletRegistrationSessionCommitReceiptV2['committed'] | null;
+/**
+ * Parses the one durable registration receipt shape. Nested signer payloads
+ * are parsed by the caller's branch parser; this boundary owns the envelope,
+ * identity checks, exact keys, and the credential deny-list.
+ */
+export declare function parseWalletRegistrationSessionCommitReceiptV2(raw: unknown, parseCommitted: RegistrationCommitReceiptCommittedParser): WalletRegistrationSessionCommitReceiptV2 | null;
+export {};
+//# sourceMappingURL=walletRegistrationSessionCommitReceipt.d.ts.map