@seams/wallet-server 0.6.0 → 0.6.1

package/artifact-manifest.json

@@ -2,7 +2,7 @@
   "schemaVersion": "seams_wallet_server_artifact_manifest_v1",
   "package": {
     "name": "@seams/wallet-server",
-    "version": "0.6.0"
+    "version": "0.6.1"
   },
   "workers": {
     "router": {

package/cloudflare-router-ab/scripts/initialize-local-wallet.mjs

@@ -12,6 +12,14 @@ if (!existsSync(binary)) {
 }
 // Package managers can normalize executable bits on bundled native assets.
 if ((statSync(binary).mode & 0o111) === 0) chmodSync(binary, 0o755);
-const result = spawnSync(binary, process.argv.slice(2), { stdio: 'inherit' });
+const result = spawnSync(binary, process.argv.slice(2), {
+  stdio: ['inherit', 'pipe', 'inherit'],
+  encoding: 'utf8',
+});
 if (result.error) throw result.error;
+if (result.status === 0 && process.stdout.isTTY) {
+  console.log('Local role identity ready.');
+} else if (result.stdout) {
+  process.stdout.write(result.stdout);
+}
 process.exitCode = result.status ?? 1;

package/cloudflare-router-ab/scripts/start-local-role-workers.mjs

@@ -22,6 +22,7 @@ const workersReadyPath = path.join(localRoot, '.runtime', 'role-workers.ready');
 // Separate local stacks reuse Worker names, so each needs its own discovery registry.
 const workerEnv = {
   ...process.env,
+  WRANGLER_LOG: process.env.WRANGLER_LOG || 'warn',
   WRANGLER_REGISTRY_PATH: path.join(localRoot, '.local', 'worker-registry'),
 };
 const children = [];
@@ -46,14 +47,18 @@ async function main() {
   startWorkers(runtime);
   await waitForWorkers(runtime);
   writeFileSync(workersReadyPath, 'ready\n');
-  console.log(
-    JSON.stringify({
-      kind: 'wallet_role_workers_ready_v1',
-      mpcRouterUrl: runtime.mpcRouterUrl,
-      ceremonyPrivateJwkPath,
-      workers: runtime.configs.map(describeWorker),
-    }),
-  );
+  if (process.stdout.isTTY) {
+    console.log('Local Wallet role Workers ready.');
+  } else {
+    console.log(
+      JSON.stringify({
+        kind: 'wallet_role_workers_ready_v1',
+        mpcRouterUrl: runtime.mpcRouterUrl,
+        ceremonyPrivateJwkPath,
+        workers: runtime.configs.map(describeWorker),
+      }),
+    );
+  }
   await waitUntilStopped();
 }
 
@@ -181,8 +186,9 @@ function applyPrivateD1Migrations(runtime) {
         config.configPath,
       ],
       repoRoot,
-      { ...process.env, CI: 'true' },
+      { ...workerEnv, CI: 'true' },
     );
+    console.log(`Local database ready: ${config.role}`);
   }
 }
 

package/cloudflare-router-ab/scripts/start-local-wallet-system.mjs

@@ -9,13 +9,26 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 import { prepareLocalHostedWalletGatewayConfig } from './prepare-local-runtime-config.mjs';
+import { printLocalServiceTable } from '../../../scripts/print-local-service-table.mjs';
 
 const repoRoot = process.cwd();
 const gatewayUrl = process.env.SEAMS_INTENDED_ROUTER_URL || 'http://127.0.0.1:4100';
-const routerUrl = `http://127.0.0.1:${4102 + Number(process.env.SEAMS_LOCAL_PORT_OFFSET || 0)}`;
+const localPortOffset = Number(process.env.SEAMS_LOCAL_PORT_OFFSET || 0);
+const routerUrl = `http://127.0.0.1:${4102 + localPortOffset}`;
+const roleServices = [
+  { name: 'mpc-router', port: 4102 },
+  { name: 'deriver-a', port: 4103 },
+  { name: 'deriver-b', port: 4104 },
+  { name: 'signing-worker', port: 4105 },
+  { name: 'tenant-root-control-plane', port: 4106 },
+];
 const options = parseArguments(process.argv.slice(2));
 const localRoot = path.resolve(
-  options.root || path.join(tmpdir(), `${path.basename(repoRoot)}-wallet-system`),
+  options.root ||
+    path.join(
+      tmpdir(),
+      `${path.basename(repoRoot)}-wallet-system-${randomBytes(8).toString('hex')}`,
+    ),
 );
 const gatewayStateRoot = path.join(localRoot, '.local', 'cloudflare-state', 'wallet-gateway');
 const ceremonyPrivateJwkPath = path.join(
@@ -36,6 +49,7 @@ const identity = Object.freeze({
 // Separate local stacks reuse Worker names, so each needs its own discovery registry.
 const workerEnv = {
   ...process.env,
+  WRANGLER_LOG: process.env.WRANGLER_LOG || 'warn',
   WRANGLER_REGISTRY_PATH: path.join(localRoot, '.local', 'worker-registry'),
 };
 const children = [];
@@ -51,10 +65,12 @@ async function main() {
   installSignalHandlers();
   mkdirSync(localRoot, { recursive: true });
   rmSync(workersReadyPath, { force: true });
+  console.log('Starting local Wallet role Workers...');
   startRoleWorkers();
   await waitForHttp(`${routerUrl}/.well-known/router-ab/keyset`, 120_000, true);
   await waitForFile(workersReadyPath, 120_000);
   await waitForFile(ceremonyPrivateJwkPath, 10_000);
+  console.log('Provisioning local tenant root...');
   const tenantRoot = bootstrapTenantRoot();
   const deployment = localDeployment(tenantRoot);
   const runtime = prepareLocalHostedWalletGatewayConfig({
@@ -67,23 +83,35 @@ async function main() {
     deployment,
   });
   applySignerMigrations(runtime);
+  console.log('Starting local Wallet Gateway...');
   startGateway(runtime);
   await waitForHttp(`${runtime.gatewayUrl}/readyz`, 120_000, true);
-  console.log(
-    JSON.stringify({
-      kind: 'wallet_local_system_ready_v1',
-      gatewayUrl: runtime.gatewayUrl,
-      appOrigin: options.appOrigin,
-      walletOrigin: options.walletOrigin,
-      projectEnvironmentId: identity.environmentId,
-      publishableKey: deployment.credential.publishableKey,
-      signingWorkerId: 'local-signing-worker',
-      root: localRoot,
-    }),
-  );
+  const ready = {
+    kind: 'wallet_local_system_ready_v1',
+    gatewayUrl: runtime.gatewayUrl,
+    appOrigin: options.appOrigin,
+    walletOrigin: options.walletOrigin,
+    projectEnvironmentId: identity.environmentId,
+    publishableKey: deployment.credential.publishableKey,
+    signingWorkerId: 'local-signing-worker',
+    root: localRoot,
+  };
+  if (process.stdout.isTTY) printServiceTable(ready);
+  else console.log(JSON.stringify(ready));
   await waitUntilStopped();
 }
 
+function printServiceTable(ready) {
+  const services = [];
+  for (const role of roleServices) {
+    services.push({ name: role.name, url: `http://127.0.0.1:${role.port + localPortOffset}` });
+  }
+  services.push({ name: 'wallet-gateway', url: ready.gatewayUrl });
+  printLocalServiceTable('Local Wallet services ready', services);
+  console.log(`Site: ${ready.appOrigin} (start pnpm site in another terminal)`);
+  console.log(`Runtime state: ${ready.root}`);
+}
+
 function parseArguments(args) {
   const parsed = {
     help: false,
@@ -254,8 +282,9 @@ function applySignerMigrations(runtime) {
       '--config',
       runtime.configPath,
     ],
-    { ...process.env, CI: 'true' },
+    { ...workerEnv, CI: 'true' },
   );
+  console.log('Local database ready: wallet-gateway');
 }
 
 function startGateway(runtime) {

package/dist/esm/router/cloudflare/d1/auth/d1RouterApiAuthService.js

@@ -1233,6 +1233,7 @@ function createD1WalletRegistrationRouteService(assembly) {
 		readActiveEmailOtpEnrollment: assembly.emailOtpRecoveryService.readActiveEmailOtpEnrollment.bind(assembly.emailOtpRecoveryService),
 		setupWalletRegistration: assembly.walletRegistrations.setupWalletRegistration.bind(assembly.walletRegistrations),
 		respondWalletRegistration: assembly.walletRegistrations.respondWalletRegistration.bind(assembly.walletRegistrations),
+		authorizeWalletRegistrationNearAdmission: assembly.walletRegistrations.authorizeWalletRegistrationNearAdmission.bind(assembly.walletRegistrations),
 		activateWalletRegistration: assembly.walletRegistrations.activateWalletRegistration.bind(assembly.walletRegistrations),
 		completeWalletRegistrationNearProvisioning: assembly.walletRegistrations.completeWalletRegistrationNearProvisioning.bind(assembly.walletRegistrations),
 		refreshEd25519YaoWalletSession: assembly.walletRegistrations.refreshEd25519YaoWalletSession.bind(assembly.walletRegistrations),

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationService.js

@@ -933,6 +933,16 @@ function mergeRouterServerTiming(target, header) {
 		}
 	}
 }
+function recordRegistrationServerTiming(sink, name, startedAtMs) {
+	sink.push([name, Math.max(0, Date.now() - startedAtMs)]);
+}
+async function recordRegistrationPromiseTiming(args) {
+	try {
+		return await args.promise;
+	} finally {
+		recordRegistrationServerTiming(args.sink, args.name, args.startedAtMs);
+	}
+}
 var CloudflareD1WalletRegistrationService = class {
 	constructor(input) {
 		this.authorizationService = input.authorizationService;
@@ -1783,8 +1793,99 @@ var CloudflareD1WalletRegistrationService = class {
 			return walletRegistrationSetupError("internal", errorMessage(error) || "Failed to set up wallet registration");
 		}
 	}
-	async respondWalletRegistration(input, traceContext) {
-		const serverTiming = [];
+	async authorizeWalletRegistrationNearAdmission(input) {
+		try {
+			const snapshot = await this.getRegistrationCeremonyIntentStore().getCeremonySnapshot(input.registrationCeremonyId);
+			if (!snapshot) return {
+				ok: false,
+				code: "not_found",
+				message: "registration ceremony not found"
+			};
+			const ceremony = snapshot.ceremony;
+			if (ceremony.signerState.kind !== "signer_set_registration") return {
+				ok: false,
+				code: "invalid_state",
+				message: "signer-set registration state is required"
+			};
+			const branches = registrationSignerBranchesFromPlan(ceremony.signerPlan);
+			if (!findStoredWalletRegistrationEvmFamilyEcdsaBranch(ceremony.signerState) || !branches.nearEd25519) return {
+				ok: false,
+				code: "invalid_state",
+				message: "mixed registration state is required"
+			};
+			const expectedOrigin = normalizeOptionalTrimmedString(ceremony.expectedOrigin) || "";
+			const setupDigestB64u = await computeWalletRegistrationSetupDigestB64u({
+				registrationCeremonyId: ceremony.registrationCeremonyId,
+				intent: ceremony.intent,
+				intentDigestB64u: ceremony.digestB64u,
+				orgId: ceremony.orgId,
+				signingRootId: normalizeOptionalTrimmedString(ceremony.signingRootId) || "",
+				signingRootVersion: normalizeOptionalTrimmedString(ceremony.signingRootVersion) || "",
+				expectedOrigin
+			});
+			const verifiedSetup = await verifySignedWalletRegistrationSetup(input.verifier, input.signedSetup, {
+				registrationCeremonyId: ceremony.registrationCeremonyId,
+				setupDigestB64u,
+				nowMs: Date.now()
+			});
+			if (!verifiedSetup.ok) return {
+				ok: false,
+				code: verifiedSetup.code,
+				message: verifiedSetup.message
+			};
+			const registrationBearerToken = normalizeOptionalTrimmedString(input.signedSetup);
+			if (!registrationBearerToken) return {
+				ok: false,
+				code: "invalid_body",
+				message: "signedSetup is required"
+			};
+			const verifiedAuthority = await this.walletAuthMethods.verifyRegistrationAuthorityForIntent({
+				orgId: ceremony.orgId,
+				authority: input.authority,
+				expectedDigestB64u: ceremony.digestB64u,
+				expectedOrigin,
+				intent: ceremony.intent,
+				verificationOperationId: ceremony.registrationCeremonyId,
+				verificationReceiptExpiresAtMs: ceremony.expiresAtMs,
+				...input.userAgent ? { userAgent: input.userAgent } : {}
+			});
+			if (!verifiedAuthority.ok) return {
+				ok: false,
+				code: verifiedAuthority.code,
+				message: verifiedAuthority.message
+			};
+			if (verifiedAuthority.authority.walletId !== ceremony.intent.walletId) return {
+				ok: false,
+				code: "scope_mismatch",
+				message: "registration authority walletId does not match the ceremony"
+			};
+			const admitted = await this.authorizeRespondEd25519Branch({
+				ceremony,
+				branch: branches.nearEd25519,
+				authority: verifiedAuthority.authority,
+				registrationBearerToken
+			});
+			if (!admitted.ok) return admitted;
+			if (!admitted.deferred) return {
+				ok: false,
+				code: "internal",
+				message: "NEAR admission produced no work"
+			};
+			return {
+				ok: true,
+				registrationCeremonyId: ceremony.registrationCeremonyId,
+				ed25519: admitted.deferred
+			};
+		} catch (error) {
+			return {
+				ok: false,
+				code: "internal",
+				message: errorMessage(error) || "Failed to authorize NEAR registration admission"
+			};
+		}
+	}
+	async respondWalletRegistration(input, traceContext, timingSink) {
+		const serverTiming = timingSink ?? [];
 		const totalStartedAtMs = Date.now();
 		const mark = (name, startedAtMs) => {
 			serverTiming.push([name, Math.max(0, Date.now() - startedAtMs)]);
@@ -1793,7 +1894,7 @@ var CloudflareD1WalletRegistrationService = class {
 			const store = this.getRegistrationCeremonyIntentStore();
 			const loadStartedAtMs = Date.now();
 			const snapshot = await store.getCeremonySnapshot(input.registrationCeremonyId);
-			mark("respond_d1_load", loadStartedAtMs);
+			mark("ecdsa_respond_d1_load", loadStartedAtMs);
 			if (!snapshot) return {
 				ok: false,
 				code: "not_found",
@@ -1952,7 +2053,7 @@ var CloudflareD1WalletRegistrationService = class {
 				authority,
 				registrationBearerToken
 			})]);
-			mark("respond_router", routerStartedAtMs);
+			mark("ecdsa_respond_router", routerStartedAtMs);
 			if (!strictResult.ok) {
 				if (!strictResult.retryable) await store.cancelTerminalCeremony({
 					registrationCeremonyId: ceremony.registrationCeremonyId,
@@ -2006,16 +2107,16 @@ var CloudflareD1WalletRegistrationService = class {
 				const reconciled = await store.getCeremony(input.registrationCeremonyId);
 				const reconciledBranch = reconciled?.signerState.kind === "signer_set_registration" ? findStoredWalletRegistrationEvmFamilyEcdsaBranch(reconciled.signerState) : null;
 				if (!reconciled || reconciledBranch?.kind !== "evm_family_ecdsa_pending_activation" || !sameRouterAbEcdsaRegistrationRequest(reconciledBranch.registrationRequest, strictRegistration)) throw error;
-				mark("respond_d1_commit", commitStartedAtMs);
-				mark("respond_total", totalStartedAtMs);
+				mark("ecdsa_respond_d1_commit", commitStartedAtMs);
+				mark("ecdsa_respond_total", totalStartedAtMs);
 				return walletRegistrationRespondResult({
 					ceremony: reconciled,
 					strictResult: reconciledBranch.publicResponse,
 					ed25519: storedRespondEd25519DeferredWork(reconciled.signerState)
 				});
 			}
-			mark("respond_d1_commit", commitStartedAtMs);
-			mark("respond_total", totalStartedAtMs);
+			mark("ecdsa_respond_d1_commit", commitStartedAtMs);
+			mark("ecdsa_respond_total", totalStartedAtMs);
 			return walletRegistrationRespondResult({
 				ceremony: next,
 				strictResult: strictResult.value.publicResponse,
@@ -2072,7 +2173,10 @@ var CloudflareD1WalletRegistrationService = class {
 		});
 	}
 	async authorizeNearRegistrationContinuation(input) {
-		const installation = await this.readCommittedRegistrationInstallation(input.lifecycleId);
+		return (await this.readNearRegistrationContinuationContext(input))?.verified ?? null;
+	}
+	async readNearRegistrationContinuationContext(input, installed) {
+		const installation = installed ?? await this.readCommittedRegistrationInstallation(input.lifecycleId);
 		if (!installation || !isRegistrationEcdsaReadyReceipt(installation.receipt)) return null;
 		const nowMs = Date.now();
 		const issued = await this.authorizationService.readLiveWalletSessionAuthorizationProjectionByCredential({
@@ -2086,9 +2190,13 @@ var CloudflareD1WalletRegistrationService = class {
 		const originalSubjects = installation.receipt.committed.session.walletSession.capabilitySubjects;
 		for (const subject of originalSubjects) if (!issued.session.capabilitySubjects.some(sameRegistrationContinuationSubject.bind(void 0, subject))) return null;
 		return {
-			credential: input.credential,
-			admissionRequest: installation.projection.nearEd25519.admissionRequest,
-			expiresAtMs: Math.min(issued.session.expiresAtMs, nowMs + 6e4)
+			verified: {
+				credential: input.credential,
+				admissionRequest: installation.projection.nearEd25519.admissionRequest,
+				expiresAtMs: Math.min(issued.session.expiresAtMs, nowMs + 6e4)
+			},
+			installation,
+			authorization: issued
 		};
 	}
 	async readCommittedRegistrationInstallation(registrationCeremonyId) {
@@ -2125,10 +2233,10 @@ var CloudflareD1WalletRegistrationService = class {
 			prepared: record.prepared
 		};
 	}
-	async prepareNearProvisioningOperation(registrationCeremonyId, allocated) {
-		const ceremony = await this.getRegistrationCeremonyIntentStore().getCeremony(registrationCeremonyId);
+	async prepareNearProvisioningOperation(registrationCeremonyId, allocated, installed) {
+		const ceremony = installed ? null : await this.getRegistrationCeremonyIntentStore().getCeremony(registrationCeremonyId);
 		if (!ceremony) {
-			const committed = await this.readCommittedRegistrationInstallation(registrationCeremonyId);
+			const committed = installed ?? await this.readCommittedRegistrationInstallation(registrationCeremonyId);
 			if (!committed) throw new Error("Registration ceremony is unavailable for identity preparation");
 			if (allocated && (allocated.walletAuthorityId !== committed.prepared.walletAuthorityId || allocated.deviceId !== committed.prepared.deviceId || allocated.walletAuthMethodId !== committed.prepared.walletAuthMethodId)) throw new Error("registration operation identity does not match its committed installation");
 			return committed.prepared;
@@ -2146,9 +2254,16 @@ var CloudflareD1WalletRegistrationService = class {
 		};
 	}
 	async commitDeferredEd25519Signer(args, prepared) {
-		const ownerProofContext = await this.readRegistrationOwnerProofContext(args.input.registrationCeremonyId);
+		const committedInstallation = args.authoritySource.kind === "committed_mixed" ? args.authoritySource.installation : null;
+		if (committedInstallation && !isRegistrationEcdsaReadyReceipt(committedInstallation.receipt)) throw new Error("Committed mixed registration receipt is not ECDSA-ready");
+		const ownerProofContext = committedInstallation ? {
+			expectedOrigin: committedInstallation.receipt.expectedOrigin,
+			runtimePolicyScope: registrationPreparedContextRuntimePolicyScope(committedInstallation.projection.preparedContext),
+			expiresAtMs: committedInstallation.receipt.expiresAtMs
+		} : await this.readRegistrationOwnerProofContext(args.input.registrationCeremonyId);
 		if (!ownerProofContext) throw new Error("Registration owner proof context is unavailable");
-		const ceremony = await this.getRegistrationCeremonyIntentStore().getCeremony(args.input.registrationCeremonyId);
+		if (!ownerProofContext.runtimePolicyScope) throw new Error("Committed registration is missing its runtime policy scope");
+		const ceremony = committedInstallation ? null : await this.getRegistrationCeremonyIntentStore().getCeremony(args.input.registrationCeremonyId);
 		let recovery = null;
 		let registrationAuthority;
 		let sessionPredecessor;
@@ -2158,7 +2273,7 @@ var CloudflareD1WalletRegistrationService = class {
 			registrationAuthority = authority;
 			sessionPredecessor = { kind: "ed25519_only" };
 		} else {
-			const committed = await this.readCommittedRegistrationInstallation(args.input.registrationCeremonyId);
+			const committed = committedInstallation ?? await this.readCommittedRegistrationInstallation(args.input.registrationCeremonyId);
 			if (!committed) throw new Error("Committed registration installation is unavailable");
 			recovery = registrationFinalizeRecoveryFromCommittedInstallation({
 				setupClaims: args.setupClaims,
@@ -2171,14 +2286,7 @@ var CloudflareD1WalletRegistrationService = class {
 			if (!isRegistrationEcdsaReadyReceipt(activationReceipt)) throw new Error("Committed mixed registration receipt is not ECDSA-ready");
 			if (activationReceipt.committed.session.tokens.kind !== "evm_family_ecdsa") throw new Error("Committed mixed registration is missing its ECDSA session projection");
 			if (args.input.authorization.kind === "wallet_session") {
-				const authorization = await this.authorizeNearRegistrationContinuation({
-					lifecycleId: args.input.registrationCeremonyId,
-					credential: args.input.authorization.credential
-				}) ? await this.authorizationService.readLiveWalletSessionAuthorizationProjectionByCredential({
-					tenantId: this.authorizationTenantId,
-					token: args.input.authorization.credential,
-					nowMs: Date.now()
-				}) : null;
+				const authorization = args.authoritySource.kind === "committed_mixed" ? args.authoritySource.authorization : null;
 				if (!authorization) throw new Error("NEAR continuation Wallet Session is no longer active");
 				sessionPredecessor = {
 					kind: "resumed_mixed",
@@ -2190,7 +2298,7 @@ var CloudflareD1WalletRegistrationService = class {
 				ecdsa: activationReceipt.committed.session.tokens.ecdsa
 			};
 		}
-		const effectivePrepared = await this.prepareNearProvisioningOperation(args.input.registrationCeremonyId, prepared);
+		const effectivePrepared = await this.prepareNearProvisioningOperation(args.input.registrationCeremonyId, prepared, committedInstallation ?? void 0);
 		const committed = await this.executeWalletRegistrationFinalize({
 			kind: "near_ed25519",
 			registrationCeremonyId: args.input.registrationCeremonyId,
@@ -2358,16 +2466,22 @@ var CloudflareD1WalletRegistrationService = class {
 	* be destroyed because its signer ceremony needs another attempt.
 	*/
 	async verifyNearProvisioningAuthority(input) {
-		if (input.authorization.kind === "registration_grant") return await verifyWalletRegistrationSetupClaims(input.verifier, input.signedSetup, {
-			registrationCeremonyId: input.registrationCeremonyId,
-			nowMs: Date.now()
-		});
-		const authorized = await this.authorizeNearRegistrationContinuation({
+		if (input.authorization.kind === "registration_grant") {
+			const verified = await verifyWalletRegistrationSetupClaims(input.verifier, input.signedSetup, {
+				registrationCeremonyId: input.registrationCeremonyId,
+				nowMs: Date.now()
+			});
+			return verified.ok ? {
+				...verified,
+				source: { kind: "registration_grant" }
+			} : verified;
+		}
+		const installation = await this.readCommittedRegistrationInstallation(input.registrationCeremonyId);
+		const continuation = installation ? await this.readNearRegistrationContinuationContext({
 			lifecycleId: input.registrationCeremonyId,
 			credential: input.authorization.credential
-		});
-		const installation = await this.readCommittedRegistrationInstallation(input.registrationCeremonyId);
-		if (!authorized || !installation || typeof input.signedSetup !== "string") return {
+		}, installation) : null;
+		if (!continuation || typeof input.signedSetup !== "string") return {
 			ok: false,
 			code: "invalid_grant",
 			message: "NEAR continuation authority is unavailable"
@@ -2381,24 +2495,34 @@ var CloudflareD1WalletRegistrationService = class {
 		};
 		registrationFinalizeRecoveryFromCommittedInstallation({
 			setupClaims: claims,
-			projection: installation.projection
+			projection: continuation.installation.projection
 		});
 		return {
 			ok: true,
 			claims: {
 				...claims,
-				expiresAtMs: authorized.expiresAtMs
+				expiresAtMs: continuation.verified.expiresAtMs
+			},
+			source: {
+				kind: "committed_mixed",
+				installation: continuation.installation,
+				authorization: continuation.authorization
 			}
 		};
 	}
-	async completeWalletRegistrationNearProvisioning(input) {
+	async completeWalletRegistrationNearProvisioning(input, timingSink) {
+		const serverTiming = timingSink ?? [];
+		const totalStartedAtMs = Date.now();
 		try {
+			const authorityStartedAtMs = Date.now();
 			const verified = await this.verifyNearProvisioningAuthority(input);
+			recordRegistrationServerTiming(serverTiming, "near_finalize_authority", authorityStartedAtMs);
 			if (!verified.ok) return {
 				ok: false,
 				code: verified.code,
 				message: verified.message
 			};
+			const fingerprintStartedAtMs = Date.now();
 			const requestFingerprint = base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
 				version: "wallet_registration_near_provisioning_digest_v1",
 				registrationCeremonyId: input.registrationCeremonyId,
@@ -2407,6 +2531,8 @@ var CloudflareD1WalletRegistrationService = class {
 				ed25519: input.ed25519,
 				emailOtpEnrollment: input.emailOtpEnrollment
 			})));
+			recordRegistrationServerTiming(serverTiming, "near_finalize_fingerprint", fingerprintStartedAtMs);
+			const sideEffectStartedAtMs = Date.now();
 			const run = await runRouterAbEd25519YaoRegistrationSideEffectV2(this.nearProvisioningSideEffects, {
 				kind: "prepared_resumable",
 				operation: "near_provisioning",
@@ -2414,11 +2540,12 @@ var CloudflareD1WalletRegistrationService = class {
 				requestFingerprint,
 				resumeAfterMs: D1_WALLET_REGISTRATION_OPERATION_RESUME_AFTER_MS,
 				nowMs: Date.now,
-				prepare: async () => await this.prepareNearProvisioningOperation(input.registrationCeremonyId),
+				prepare: async () => await this.prepareNearProvisioningOperation(input.registrationCeremonyId, void 0, verified.source.kind === "committed_mixed" ? verified.source.installation : void 0),
 				derivePreparedArtifactFingerprint: async (prepared) => base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(prepared))),
 				execute: this.commitDeferredEd25519Signer.bind(this, {
 					input,
-					setupClaims: verified.claims
+					setupClaims: verified.claims,
+					authoritySource: verified.source
 				}),
 				projectReceipt: (execution) => projectWalletRegistrationSessionCommitReceiptV2({
 					operation: "near_provisioning",
@@ -2428,6 +2555,7 @@ var CloudflareD1WalletRegistrationService = class {
 				}),
 				replay: this.replayWalletRegistrationNearProvisioningCommit.bind(this)
 			});
+			recordRegistrationServerTiming(serverTiming, "near_finalize_side_effect", sideEffectStartedAtMs);
 			switch (run.kind) {
 				case "executed":
 				case "exact_replay": break;
@@ -2471,18 +2599,30 @@ var CloudflareD1WalletRegistrationService = class {
 				message: "NEAR provisioning did not establish a Wallet Session",
 				nearProvisioning: { status: "near_failed_retryable" }
 			};
-			await cleanupFinalizedRegistrationCeremony({
-				store: this.getRegistrationCeremonyIntentStore(),
-				registrationCeremonyId: input.registrationCeremonyId
+			const cleanup = recordRegistrationPromiseTiming({
+				sink: serverTiming,
+				name: "near_finalize_cleanup",
+				startedAtMs: Date.now(),
+				promise: cleanupFinalizedRegistrationCeremony({
+					store: this.getRegistrationCeremonyIntentStore(),
+					registrationCeremonyId: input.registrationCeremonyId
+				})
 			});
 			if (input.authorization.kind === "wallet_session") {
-				const current = await this.authorizationService.readLiveWalletSessionAuthorizationProjectionByCredential({
-					tenantId: this.authorizationTenantId,
-					token: input.authorization.credential,
-					nowMs: Date.now()
-				});
+				const projectionStartedAtMs = Date.now();
+				const [current] = await Promise.all([recordRegistrationPromiseTiming({
+					sink: serverTiming,
+					name: "near_finalize_session_projection",
+					startedAtMs: projectionStartedAtMs,
+					promise: this.authorizationService.readLiveWalletSessionAuthorizationProjectionByCredential({
+						tenantId: this.authorizationTenantId,
+						token: input.authorization.credential,
+						nowMs: Date.now()
+					})
+				}), cleanup]);
 				const tokens = committed.registrationEstablishedSession.session.tokens;
 				if (!current || tokens.kind !== "near_ed25519_and_evm_family_ecdsa") throw new Error("NEAR continuation Wallet Session is no longer active");
+				recordRegistrationServerTiming(serverTiming, "near_finalize_total", totalStartedAtMs);
 				return {
 					...committed,
 					registrationEstablishedSession: {
@@ -2493,11 +2633,14 @@ var CloudflareD1WalletRegistrationService = class {
 					nearProvisioning: { status: "near_ready" }
 				};
 			}
+			await cleanup;
+			recordRegistrationServerTiming(serverTiming, "near_finalize_total", totalStartedAtMs);
 			return {
 				...committed,
 				nearProvisioning: { status: "near_ready" }
 			};
 		} catch (error) {
+			recordRegistrationServerTiming(serverTiming, "near_finalize_total", totalStartedAtMs);
 			return {
 				ok: false,
 				code: "internal",
@@ -2791,7 +2934,7 @@ var CloudflareD1WalletRegistrationService = class {
 	* before execution; an ambiguous outcome after the custody call stays
 	* `uncertain` rather than being guessed either way.
 	*/
-	async activateWalletRegistration(input, traceContext) {
+	async activateWalletRegistration(input, traceContext, serverTiming) {
 		try {
 			const verifiedSetup = await verifyWalletRegistrationSetupClaims(input.verifier, input.signedSetup, {
 				registrationCeremonyId: input.registrationCeremonyId,
@@ -2830,7 +2973,8 @@ var CloudflareD1WalletRegistrationService = class {
 					registrationCeremonyId: claims.registrationCeremonyId,
 					idempotencyKey,
 					input,
-					traceContext
+					traceContext,
+					serverTiming
 				}),
 				projectReceipt: (execution) => projectWalletRegistrationSessionCommitReceiptV2({
 					operation: "registration_activate",
@@ -2930,6 +3074,7 @@ var CloudflareD1WalletRegistrationService = class {
 				publicFacts: ecdsa.clientActivation
 			}
 		}, context.traceContext, context.idempotencyKey);
+		if (activated.ok && activated.gatewayServerTiming) context.serverTiming?.push(...activated.gatewayServerTiming);
 		if (!activated.ok) return unissuedRegistrationCommit(throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1(activated));
 		const keyHandle = activated.ecdsa.bootstrap?.keyHandle;
 		if (!keyHandle) return unissuedRegistrationCommit({