@seams/wallet-server 0.5.0

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationSetup.js

@@ -0,0 +1,182 @@
+import { computeRegistrationIntentDigestB64u, normalizeRegistrationAuthMethodInput, normalizeRegistrationSignerPlan, registrationSignerSetSelectionFromPlan } from "../../../../shared-ts/src/utils/registrationIntent.js";
+import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
+import "../../../../shared-ts/src/utils/validation.js";
+import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
+import { thresholdEcdsaChainTargetFromValue } from "../../../../core/thresholdEcdsaChainTarget.js";
+import { computeWalletRegistrationSetupDigestB64u, mintSignedWalletRegistrationSetup } from "../../../domains/walletRegistration/walletRegistrationSetupPayload.js";
+//#region src/router/cloudflare/d1/registration/d1WalletRegistrationSetup.ts
+/**
+* Refactor 94C. `/wallets/register/setup` — one request replacing the bootstrap
+* grant, the registration intent, and registration start.
+*
+* The three legs it replaces made six-plus serialized storage round trips
+* between them, most of it bookkeeping written on every request and read on
+* almost none: a grant record so the next leg could read back a decision the
+* grant check had already made, a wallet reservation so a later insert would
+* not collide, and a start journal so a duplicate start could be reconciled.
+* Collapsing the legs removes the readers, so the writes go too.
+*
+* What remains is one canonical D1 write: the ceremony row. That row is the
+* ceremony's existence — it is not insurance against a failure elsewhere.
+*
+* Setup necessarily runs *before* the client's WebAuthn create, because setup
+* issues the challenge that create must sign. So it stores the ceremony with
+* its authority awaiting proof, and respond binds the proof one leg later.
+* The valuable consequence is that the ECDSA preparation — the Router call
+* that dominated the measured cold path — overlaps the user's authenticator
+* interaction instead of being serialized after it.
+*
+* Setup is ECDSA-only for both authentication methods. Yao admission binds the
+* Ed25519 authority scope, which is only sound once the proof is verified, so
+* respond derives it. Admitting at setup would have been possible for a
+* passkey and not for Email OTP, and two setup protocols split by auth method
+* is a worse contract than one that always defers.
+*
+* The wallet reservation is deliberately not carried over. It existed so a
+* randomly generated wallet id allocated at intent time could not be taken
+* before start inserted the ceremony — a window that no longer exists now that
+* allocation and insertion are the same request. Genuine uniqueness is still
+* arbitrated where it always was, by the wallet table at commit.
+*/
+/** Setup's ceremony lives only as long as an authenticator prompt plausibly takes. */
+const WALLET_REGISTRATION_SETUP_TTL_MS = 10 * 6e4;
+function walletRegistrationSetupIds() {
+	return {
+		registrationCeremonyId: `wrc_${secureRandomBase64Url(32)}`,
+		registrationPreparationId: `regprep_${secureRandomBase64Url(32)}`
+	};
+}
+/**
+* Resolves the wallet id without reserving it.
+*
+* A provided id is taken as given; an absent or server-allocated one is
+* generated. There is no existence pre-check: it cost a serialized read on
+* every registration to catch a collision that the commit-time uniqueness
+* constraint catches anyway, and for a freshly generated random id it could
+* essentially never fire.
+*/
+function resolveWalletRegistrationSetupWalletId(input) {
+	const wallet = input.wallet;
+	if (!wallet || wallet.kind === "server_allocated") return {
+		ok: true,
+		walletId: input.createServerAllocated()
+	};
+	if (wallet.kind === "provided") {
+		const walletId = input.parseProvided(wallet.walletId);
+		if (!walletId) return {
+			ok: false,
+			code: "invalid_body",
+			message: "walletId is required"
+		};
+		return {
+			ok: true,
+			walletId
+		};
+	}
+	return {
+		ok: false,
+		code: "invalid_body",
+		message: "wallet.kind is unsupported"
+	};
+}
+function normalizeWalletRegistrationSetupRequest(request) {
+	const signerPlan = normalizeRegistrationSignerPlan(request?.signerSelection);
+	if (!signerPlan.ok) return signerPlan;
+	const signerSelection = registrationSignerSetSelectionFromPlan(signerPlan.value, { normalizeEcdsaChainTarget: thresholdEcdsaChainTargetFromValue });
+	if (!signerSelection.ok) return signerSelection;
+	const authMethod = normalizeRegistrationAuthMethodInput(request?.authMethod);
+	if (!authMethod) return {
+		ok: false,
+		code: "invalid_body",
+		message: "authMethod is required"
+	};
+	return {
+		ok: true,
+		signerSelection: signerSelection.value,
+		authMethod
+	};
+}
+function walletRegistrationSetupExpiresAtMs(nowMs) {
+	return nowMs + WALLET_REGISTRATION_SETUP_TTL_MS;
+}
+/**
+* Mints the payload routes 2 and 3 verify, over setup's own canonical digest.
+*/
+async function buildWalletRegistrationSetupSignature(input) {
+	const signingRootId = normalizeOptionalTrimmedString(input.ceremony.signingRootId) || "";
+	const signingRootVersion = normalizeOptionalTrimmedString(input.ceremony.signingRootVersion) || "";
+	const setupDigestB64u = await computeWalletRegistrationSetupDigestB64u({
+		registrationCeremonyId: input.ceremony.registrationCeremonyId,
+		intent: input.ceremony.intent,
+		intentDigestB64u: input.ceremony.digestB64u,
+		orgId: input.ceremony.orgId,
+		signingRootId,
+		signingRootVersion,
+		expectedOrigin: input.expectedOrigin
+	});
+	return {
+		signedSetup: await mintSignedWalletRegistrationSetup(input.signer, {
+			kind: "wallet_registration_setup_v1",
+			registrationCeremonyId: input.ceremony.registrationCeremonyId,
+			walletId: String(input.ceremony.intent.walletId),
+			orgId: input.ceremony.orgId,
+			signingRootId,
+			signingRootVersion,
+			policy: input.ceremony.preparedContext.runtimePolicy,
+			setupDigestB64u,
+			expiresAtMs: input.ceremony.expiresAtMs
+		}),
+		setupDigestB64u
+	};
+}
+async function walletRegistrationSetupIntentDigest(intent) {
+	return await computeRegistrationIntentDigestB64u(intent);
+}
+/**
+* Builds respond's discriminated result. The signer plan decides the shape:
+* a mixed plan always carries its deferred NEAR work, an ECDSA-only plan has
+* no arm to omit. There is no optional `ed25519` member to forget to check.
+*/
+function walletRegistrationRespondResult(input) {
+	const base = {
+		ok: true,
+		registrationCeremonyId: input.ceremony.registrationCeremonyId,
+		ecdsa: {
+			kind: "router_ab_ecdsa_registration_forwarded_v1",
+			strictResult: input.strictResult
+		}
+	};
+	return input.ed25519 ? {
+		...base,
+		kind: "near_ed25519_and_evm_family_ecdsa",
+		ed25519: input.ed25519
+	} : {
+		...base,
+		kind: "evm_family_ecdsa"
+	};
+}
+/**
+* Recovers the deferred NEAR work from a ceremony that already advanced, so an
+* exact respond replay returns the same shape it returned the first time.
+*/
+function storedRespondEd25519DeferredWork(signerState) {
+	if (signerState.kind !== "signer_set_registration") return null;
+	const branch = signerState.branches.find((candidate) => candidate.kind === "near_ed25519_yao_authorized");
+	if (!branch || branch.kind !== "near_ed25519_yao_authorized") return null;
+	return {
+		status: "deferred",
+		admissionRequest: branch.admissionRequest,
+		admissionReceipt: branch.admissionReceipt
+	};
+}
+function walletRegistrationSetupError(code, message) {
+	return {
+		ok: false,
+		code,
+		message
+	};
+}
+//#endregion
+export { buildWalletRegistrationSetupSignature, normalizeWalletRegistrationSetupRequest, resolveWalletRegistrationSetupWalletId, storedRespondEd25519DeferredWork, walletRegistrationRespondResult, walletRegistrationSetupError, walletRegistrationSetupExpiresAtMs, walletRegistrationSetupIds, walletRegistrationSetupIntentDigest };
+
+//# sourceMappingURL=d1WalletRegistrationSetup.js.map

package/dist/esm/router/cloudflare/d1/registration/walletRegistrationEstablishedSessionIssuer.js

@@ -0,0 +1,399 @@
+import { mpcMaterialActivationRefsEqual, parseEmailOtpChallengeId, parseThresholdEcdsaSessionId, parseThresholdEd25519SessionId, parseWebAuthnCredentialIdB64u } from "../../../../shared-ts/src/utils/domainIds.js";
+import { parseAuthFactorId, parsePrincipalId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import "../../../../shared-ts/src/utils/encoders.js";
+import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../../shared-ts/src/utils/near.js";
+import { nearEd25519SigningKeyIdFromString, walletIdFromString } from "../../../../shared-ts/src/utils/registrationIntent.js";
+import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { isEmailOtpWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { parseSessionOrigin, parseVerifiedOwnerProofId } from "../../../../authorization/domain.js";
+import { buildVerifiedOwnerProof, buildVerifiedWalletSessionEmailOtpFactorResult, buildVerifiedWalletSessionPasskeyFactorResult } from "../../../../authorization/factorEvidence.js";
+import { DEFAULT_WALLET_SESSION_TTL_MS } from "../../../../shared-ts/src/threshold/sessionPolicy.js";
+import { deriveThresholdEcdsaKeyHandle } from "../../../../shared-ts/src/utils/thresholdEcdsaKeyHandle.js";
+import { registrationEstablishedMintId } from "./walletRegistrationSessionCommitReceipt.js";
+//#region src/router/cloudflare/d1/registration/walletRegistrationEstablishedSessionIssuer.ts
+function requireWalletSessionPrincipalId(value) {
+	const parsed = parsePrincipalId(value);
+	if (!parsed.ok) throw new Error(`Wallet Session principal is invalid: ${parsed.error.message}`);
+	return parsed.value;
+}
+function walletSessionPrincipalId(authority) {
+	return requireWalletSessionPrincipalId(isEmailOtpWalletAuthAuthority(authority) ? String(authority.factor.providerUserId) : String(authority.walletId));
+}
+async function buildRegistrationOwnerProof(input) {
+	const factorId = parseAuthFactorId(`registration:${input.registrationCeremonyId}`);
+	if (!factorId.ok) throw new Error(factorId.error.message);
+	const authorityRef = await walletAuthAuthorityRef({ authority: input.authority });
+	const principalId = walletSessionPrincipalId(input.authority);
+	const origin = parseSessionOrigin(input.expectedOrigin);
+	const verifiedAtMs = Date.now();
+	const evidenceDigest = parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
+		kind: "wallet_registration_owner_proof_v1",
+		registrationCeremonyId: input.registrationCeremonyId,
+		authMethod: input.authMethod,
+		authority: authorityRef
+	}))));
+	const common = {
+		tenantId: input.tenantId,
+		principalId,
+		walletId: input.authority.walletId,
+		authorityRef,
+		requestOrigin: origin,
+		audience: origin,
+		factorId: factorId.value,
+		verifiedAtMs,
+		expiresAtMs: input.expiresAtMs
+	};
+	if (input.authMethod.kind === "passkey") {
+		const credentialId = parseWebAuthnCredentialIdB64u(input.authMethod.credentialIdB64u);
+		if (!credentialId.ok) throw new Error(credentialId.error.message);
+		return await buildVerifiedOwnerProof({
+			purpose: "wallet_session",
+			proofId: parseVerifiedOwnerProofId(`registration:${input.registrationCeremonyId}`),
+			factor: buildVerifiedWalletSessionPasskeyFactorResult({
+				...common,
+				credentialIdB64u: credentialId.value,
+				assertionDigest: evidenceDigest
+			})
+		});
+	}
+	return await buildVerifiedOwnerProof({
+		purpose: "wallet_session",
+		proofId: parseVerifiedOwnerProofId(`registration:${input.registrationCeremonyId}`),
+		factor: buildVerifiedWalletSessionEmailOtpFactorResult({
+			...common,
+			challengeId: requireEmailOtpChallengeId(input.authMethod.registrationAuthorityId),
+			verificationReceiptDigest: evidenceDigest
+		})
+	});
+}
+function requireEmailOtpChallengeId(value) {
+	const parsed = parseEmailOtpChallengeId(value);
+	if (!parsed.ok) throw new Error(parsed.error.message);
+	return parsed.value;
+}
+async function readDirectRegistrationAuthorization(input) {
+	const mintRead = await input.authorizationService.readWalletSessionAuthorizationV2ByMint({
+		tenantId: input.authorizationTenantId,
+		principalId: walletSessionPrincipalId(input.authority),
+		walletId: walletIdFromString(String(input.authority.walletId)),
+		authorityId: input.committed.authorityId,
+		walletAuthMethodId: input.committed.walletAuthMethodId,
+		mintId: input.committed.mintId
+	});
+	if (!mintRead) throw new Error("Direct registration Wallet Session commit is unavailable");
+	if (mintRead.session.authorizationId !== input.committed.authorizationId || mintRead.session.walletSessionId !== input.committed.walletSessionId || mintRead.session.quotaId !== input.committed.quotaId) throw new Error("Direct registration Wallet Session commit identity changed");
+	const persisted = await input.authorizationService.readWalletSessionAuthorizationV2ByAuthorizationId({
+		expected: mintRead.session,
+		nowMs: Date.now()
+	});
+	if (!persisted) throw new Error("Direct registration Wallet Session quota is unavailable");
+	return persisted;
+}
+function walletSessionSubjectForClient(subject) {
+	switch (subject.kind) {
+		case "sign":
+		case "export_keys": return {
+			kind: subject.kind,
+			keyFamily: subject.keyFamily,
+			materialActivation: subject.materialActivation
+		};
+		case "link_devices":
+		case "revoke_devices": return { kind: subject.kind };
+		default: return assertNeverRegistrationCapabilitySubject(subject);
+	}
+}
+function assertNeverRegistrationCapabilitySubject(value) {
+	throw new Error(`Unsupported registration Wallet Session capability subject: ${String(value)}`);
+}
+function activeWalletSessionFromAuthorization(issued) {
+	const authorization = issued.session;
+	const [first, ...remaining] = authorization.capabilitySubjects.map(walletSessionSubjectForClient);
+	if (!first) throw new Error("Direct registration Wallet Session has no capability subjects");
+	return {
+		kind: "active_wallet_session_v1",
+		walletId: authorization.walletId,
+		authorityId: authorization.authorityId,
+		authMethodId: authorization.walletAuthMethodId,
+		authorizationId: authorization.authorizationId,
+		quotaId: issued.quota.quotaId,
+		authorityDigestB64u: authorization.authorityDigestB64u,
+		authorityRevocationEpoch: authorization.authorityRevocationEpoch,
+		capabilitySubjects: [first, ...remaining],
+		issuedAtMs: authorization.createdAtMs,
+		expiresAtMs: authorization.expiresAtMs
+	};
+}
+function registrationSignMaterialActivation(authorization, keyFamily) {
+	const subject = authorization.capabilitySubjects.find((candidate) => candidate.kind === "sign" && candidate.keyFamily === keyFamily);
+	if (!subject || subject.kind !== "sign") throw new Error(`Direct registration Wallet Session is missing ${keyFamily} signing capability`);
+	return subject.materialActivation;
+}
+function registrationSessionPolicy(input) {
+	if (!Number.isSafeInteger(input.remainingUses) || input.remainingUses <= 0) throw new Error("Registration-established session remaining uses is invalid");
+	if (!Number.isSafeInteger(input.expiresAtMs) || input.expiresAtMs <= input.issuedAtMs) throw new Error("Registration-established session expiry is invalid");
+	return {
+		expiresAtMs: Math.min(input.expiresAtMs, input.issuedAtMs + DEFAULT_WALLET_SESSION_TTL_MS),
+		remainingUses: Math.min(3, input.remainingUses)
+	};
+}
+function directRegistrationSession(authorization, tokens, operationCredential) {
+	const walletSession = activeWalletSessionFromAuthorization(authorization);
+	if (operationCredential.walletSessionId !== authorization.session.walletSessionId) throw new Error("Direct registration operation credential identity does not match the session");
+	return {
+		kind: "registration_established_wallet_session_v2",
+		walletId: walletSession.walletId,
+		authorizationId: walletSession.authorizationId,
+		walletSessionId: authorization.session.walletSessionId,
+		quotaId: authorization.quota.quotaId,
+		expiresAtMs: authorization.session.expiresAtMs,
+		remainingUses: authorization.quota.remainingUses,
+		walletSession,
+		operationCredential,
+		tokens
+	};
+}
+function projectDirectRegistrationSession(authorization, tokens) {
+	const walletSession = activeWalletSessionFromAuthorization(authorization);
+	return {
+		kind: "registration_established_wallet_session_projection_v2",
+		walletId: walletSession.walletId,
+		authorizationId: walletSession.authorizationId,
+		walletSessionId: authorization.session.walletSessionId,
+		quotaId: walletSession.quotaId,
+		expiresAtMs: walletSession.expiresAtMs,
+		remainingUses: authorization.quota.remainingUses,
+		walletSession,
+		tokens
+	};
+}
+function ecdsaRegistrationSessionTokens(input) {
+	const thresholdSessionId = parseThresholdEcdsaSessionId(input.bootstrap.thresholdSessionId);
+	if (!thresholdSessionId.ok) throw new Error(thresholdSessionId.error.message);
+	const materialActivation = registrationSignMaterialActivation(input.authorization, "ecdsa_secp256k1");
+	if (!mpcMaterialActivationRefsEqual(materialActivation, routerAbMpcMaterialActivationRefFromWire(input.bootstrap.routerAbEcdsaDerivationNormalSigning.scope.material_activation))) throw new Error("Registration ECDSA bootstrap material activation is inconsistent");
+	return {
+		kind: "evm_family_ecdsa",
+		ecdsa: {
+			sessionKind: "credential_free_projection_v2",
+			thresholdSessionId: thresholdSessionId.value,
+			keyHandle: input.keyHandle,
+			runtimePolicyScope: input.runtimePolicyScope,
+			materialActivation,
+			routerAbEcdsaDerivationNormalSigning: input.bootstrap.routerAbEcdsaDerivationNormalSigning
+		}
+	};
+}
+function ed25519RegistrationSessionTokens(input) {
+	const thresholdSessionId = parseThresholdEd25519SessionId(input.publicResult.thresholdSessionId);
+	if (!thresholdSessionId.ok) throw new Error(thresholdSessionId.error.message);
+	const nearAccount = parseImplicitNearAccountId(input.publicResult.nearAccountId);
+	const namedNearAccount = parseNamedNearAccountId(input.publicResult.nearAccountId);
+	const nearAccountId = nearAccount.ok ? nearAccount.value : namedNearAccount.ok ? namedNearAccount.value : null;
+	if (!nearAccountId) throw new Error("Registration Ed25519 near account identity is invalid");
+	return {
+		kind: "near_ed25519",
+		ed25519: {
+			sessionKind: "credential_free_projection_v2",
+			thresholdSessionId: thresholdSessionId.value,
+			nearAccountId,
+			nearEd25519SigningKeyId: nearEd25519SigningKeyIdFromString(input.publicResult.nearEd25519SigningKeyId),
+			runtimePolicyScope: input.publicResult.runtimePolicyScope,
+			materialActivation: registrationSignMaterialActivation(input.authorization, "ed25519"),
+			routerAbNormalSigning: input.publicResult.routerAbNormalSigning
+		}
+	};
+}
+function completeEd25519RegistrationSessionTokens(input) {
+	switch (input.predecessor.kind) {
+		case "ed25519_only": return {
+			kind: "near_ed25519",
+			ed25519: input.ed25519
+		};
+		case "mixed": return {
+			kind: "near_ed25519_and_evm_family_ecdsa",
+			ecdsa: input.predecessor.ecdsa,
+			ed25519: input.ed25519
+		};
+		default: return assertNeverEd25519RegistrationSessionPredecessor(input.predecessor);
+	}
+}
+function assertNeverEd25519RegistrationSessionPredecessor(value) {
+	throw new Error(`Unsupported Ed25519 registration predecessor: ${String(value)}`);
+}
+function directRegistrationResultFromIssue(input) {
+	switch (input.directIssue.kind) {
+		case "issued": return {
+			kind: "issued",
+			session: directRegistrationSession(input.authorization, input.tokens, input.directIssue.operationCredential),
+			issuedAtMs: input.authorization.session.createdAtMs
+		};
+		case "already_committed": return {
+			kind: "already_committed",
+			session: projectDirectRegistrationSession(input.authorization, input.tokens),
+			next: input.directIssue.next,
+			issuedAtMs: input.authorization.session.createdAtMs
+		};
+		default: return assertNeverDirectRegistrationIssue(input.directIssue);
+	}
+}
+function assertNeverDirectRegistrationIssue(value) {
+	throw new Error(`Unsupported direct registration Wallet Session result: ${String(value)}`);
+}
+async function assertDirectWalletSessionOwnerProof(input) {
+	const authorityRef = await walletAuthAuthorityRef({ authority: input.authority });
+	if (input.proof.tenantId !== input.tenantId || input.proof.walletId !== input.authority.walletId || input.proof.principalId !== walletSessionPrincipalId(input.authority) || input.proof.authority.walletId !== authorityRef.walletId || input.proof.authority.authorityDigest !== authorityRef.authorityDigest || input.proof.authority.walletAuthMethodId !== authorityRef.walletAuthMethodId || input.activeAuthority.walletId !== input.authority.walletId || input.activeAuthority.state !== "active" || input.walletAuthMethodId !== authorityRef.walletAuthMethodId || input.proof.verifiedAtMs > input.nowMs || input.proof.expiresAtMs <= input.nowMs) throw new Error("Owner proof does not authorize direct Wallet Session issuance");
+}
+async function issueDirectRegistrationEstablishedEcdsaSession(input) {
+	const activeRegistration = await input.walletAuthMethods.readActiveRegistrationAuthority(input.registrationAuthority);
+	if (!activeRegistration || activeRegistration.authority.walletId !== input.authority.walletId || activeRegistration.walletAuthMethodId !== input.walletAuthMethodId) throw new Error("Registration founding authority is unavailable after commit");
+	const issuedAtMs = Date.now();
+	await assertDirectWalletSessionOwnerProof({
+		proof: input.proof,
+		tenantId: input.authorizationTenantId,
+		authority: input.authority,
+		activeAuthority: activeRegistration.authority,
+		walletAuthMethodId: activeRegistration.walletAuthMethodId,
+		nowMs: issuedAtMs
+	});
+	const policy = registrationSessionPolicy({
+		issuedAtMs,
+		expiresAtMs: input.expiresAtMs,
+		remainingUses: input.remainingUses
+	});
+	const directIssue = await input.authorizationService.issueDirectWalletSessionAuthorizationV2({
+		tenantId: input.authorizationTenantId,
+		principalId: walletSessionPrincipalId(input.authority),
+		walletId: walletIdFromString(String(input.authority.walletId)),
+		authority: activeRegistration.authority,
+		walletAuthMethodId: activeRegistration.walletAuthMethodId,
+		mintId: registrationEstablishedMintId(input.registrationCeremonyId),
+		remainingUses: policy.remainingUses,
+		issuedAtMs,
+		expiresAtMs: policy.expiresAtMs
+	});
+	let authorization;
+	switch (directIssue.kind) {
+		case "issued":
+			authorization = {
+				session: directIssue.session,
+				quota: directIssue.quota
+			};
+			break;
+		case "already_committed":
+			authorization = await readDirectRegistrationAuthorization({
+				authorizationService: input.authorizationService,
+				authorizationTenantId: input.authorizationTenantId,
+				authority: input.authority,
+				registrationCeremonyId: input.registrationCeremonyId,
+				committed: directIssue
+			});
+			break;
+		default: return assertNeverDirectRegistrationIssue(directIssue);
+	}
+	const keyHandle = await deriveThresholdEcdsaKeyHandle({
+		ecdsaThresholdKeyId: input.bootstrap.ecdsaThresholdKeyId,
+		signingRootId: input.bootstrap.signingRootId,
+		signingRootVersion: input.bootstrap.signingRootVersion
+	});
+	if (keyHandle !== input.bootstrap.keyHandle) throw new Error("Registration ECDSA bootstrap key handle is inconsistent");
+	const tokens = ecdsaRegistrationSessionTokens({
+		authorization: authorization.session,
+		bootstrap: input.bootstrap,
+		runtimePolicyScope: input.runtimePolicyScope,
+		keyHandle
+	});
+	return directRegistrationResultFromIssue({
+		directIssue,
+		authorization,
+		tokens
+	});
+}
+async function issueDirectRegistrationEstablishedEd25519Session(input) {
+	const activeRegistration = await input.walletAuthMethods.readActiveRegistrationAuthority(input.registrationAuthority);
+	if (!activeRegistration || activeRegistration.authority.walletId !== input.authority.walletId || activeRegistration.walletAuthMethodId !== input.walletAuthMethodId) throw new Error("Registration founding authority is unavailable after commit");
+	const issuedAtMs = Date.now();
+	await assertDirectWalletSessionOwnerProof({
+		proof: input.proof,
+		tenantId: input.authorizationTenantId,
+		authority: input.authority,
+		activeAuthority: activeRegistration.authority,
+		walletAuthMethodId: activeRegistration.walletAuthMethodId,
+		nowMs: issuedAtMs
+	});
+	const policy = registrationSessionPolicy({
+		issuedAtMs,
+		expiresAtMs: input.expiresAtMs,
+		remainingUses: input.remainingUses
+	});
+	const directIssue = await input.authorizationService.issueDirectRegistrationPromotedWalletSessionAuthorizationV2({
+		tenantId: input.authorizationTenantId,
+		principalId: walletSessionPrincipalId(input.authority),
+		walletId: walletIdFromString(String(input.authority.walletId)),
+		authority: activeRegistration.authority,
+		walletAuthMethodId: activeRegistration.walletAuthMethodId,
+		mintId: registrationEstablishedMintId(input.registrationCeremonyId),
+		remainingUses: policy.remainingUses,
+		issuedAtMs,
+		expiresAtMs: policy.expiresAtMs
+	});
+	let authorization;
+	switch (directIssue.kind) {
+		case "issued":
+			authorization = {
+				session: directIssue.session,
+				quota: directIssue.quota
+			};
+			break;
+		case "already_committed": {
+			const existing = await readDirectRegistrationAuthorization({
+				authorizationService: input.authorizationService,
+				authorizationTenantId: input.authorizationTenantId,
+				authority: input.authority,
+				registrationCeremonyId: input.registrationCeremonyId,
+				committed: directIssue
+			});
+			authorization = await input.authorizationService.refreshWalletSessionAuthorizationV2AuthorityProjection({
+				existing,
+				authority: activeRegistration.authority,
+				walletAuthMethodId: activeRegistration.walletAuthMethodId
+			});
+			break;
+		}
+		default: return assertNeverDirectRegistrationIssue(directIssue);
+	}
+	const tokens = completeEd25519RegistrationSessionTokens({
+		ed25519: ed25519RegistrationSessionTokens({
+			authorization: authorization.session,
+			publicResult: input.publicResult
+		}).ed25519,
+		predecessor: input.predecessor
+	});
+	return directRegistrationResultFromIssue({
+		directIssue,
+		authorization,
+		tokens
+	});
+}
+function replayDirectRegistrationEstablishedEcdsaSession(receipt) {
+	if (receipt.committed.session.tokens.kind !== "evm_family_ecdsa") throw new Error("Registration ECDSA receipt contains a different session branch");
+	return {
+		kind: "already_committed",
+		session: receipt.committed.session,
+		next: "unlock_exact_method"
+	};
+}
+function replayDirectRegistrationEstablishedEd25519Session(receipt) {
+	if (receipt.committed.session.tokens.kind !== "near_ed25519" && receipt.committed.session.tokens.kind !== "near_ed25519_and_evm_family_ecdsa") throw new Error("Registration NEAR receipt contains a different session branch");
+	return {
+		kind: "already_committed",
+		session: receipt.committed.session,
+		next: "unlock_exact_method"
+	};
+}
+//#endregion
+export { assertDirectWalletSessionOwnerProof, buildRegistrationOwnerProof, issueDirectRegistrationEstablishedEcdsaSession, issueDirectRegistrationEstablishedEd25519Session, replayDirectRegistrationEstablishedEcdsaSession, replayDirectRegistrationEstablishedEd25519Session, walletSessionPrincipalId };
+
+//# sourceMappingURL=walletRegistrationEstablishedSessionIssuer.js.map