@seams/wallet-server 0.7.1 → 0.8.0

package/dist/esm/router/cloudflare/d1/passkeyCustody/d1WalletCustodyCommitStore.js

@@ -1,4 +1,4 @@
-import { mpcMaterialActivationRefsEqual, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { buildDelegatedWalletAuthorityV1, buildFullOwnerDelegatedWalletAuthorityV1, sameDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { sameWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
@@ -13,6 +13,7 @@ import { parseWalletRecoveryBackupAcknowledgementV1 } from "../../../../shared-t
 import "../../../../shared-ts/src/wallet-recovery/recoveryCodes.js";
 import { parseWalletRecoveryEnvelopeSetRecord } from "../../../../shared-ts/src/wallet-recovery/walletRecoveryEnvelopeSet.js";
 import { parseRecoveryCodeLocatorV1 } from "../../../../shared-ts/src/wallet-recovery/recoveryCodeLocator.js";
+import { reservePasskeyCredential } from "../../../../core/passkeyCredentialClaims.js";
 import { prepareD1WebAuthnCredentialBindingInsertStatement } from "../../../../core/WebAuthnCredentialBindingStore.js";
 import { prepareD1WebAuthnAuthenticatorInsertStatement } from "../webauthn/d1WebAuthnStore.js";
 import { D1WalletAuthorityStore, prepareD1WalletAuthorityPutStatement } from "../wallet/d1WalletAuthorityStore.js";
@@ -20,6 +21,7 @@ import { CloudflareD1VersionedJsonRecordStore } from "../versionedJson/d1Version
 import { parseEmailOtpWalletEnrollmentRow } from "../emailOtp/d1EmailOtpRecords.js";
 import "../../../../shared-ts/src/wallet-recovery/index.js";
 import "../../../../shared-ts/src/authorization/index.js";
+import { sameWalletEcdsaSignerActivationV1, sameWalletEd25519SignerActivationV1 } from "../../../../shared-ts/src/authorization/walletSignerActivationEquality.js";
 import { PASSKEY_ENVELOPE_KEY_PREFIX, passkeyCustodyEnvelopeLocatorOf, passkeyCustodyEnvelopeRecordKey } from "./d1PasskeyCustodyEnvelopeStore.js";
 import { parseWalletRecoveryGoogleEmailOtpAttemptRecord, sameWalletRecoveryGoogleEmailOtpFinalizationInputV1, walletRecoveryGoogleEmailOtpAttemptKey, walletRecoveryGoogleEmailOtpFinalizationInput } from "./d1WalletRecoveryGoogleEmailOtpRecords.js";
 import { sameWalletCustodyRecoveryReplacementEnvelopeV1 } from "../../../domains/passkeyCustody/walletRecoveryFinalization.js";
@@ -36,12 +38,6 @@ function sameWalletSignerActivationSetV1(left, right) {
 	if (leftEd25519 === void 0 !== (rightEd25519 === void 0)) return false;
 	return leftEd25519 === void 0 || rightEd25519 === void 0 || sameWalletEd25519SignerActivationV1(leftEd25519, rightEd25519);
 }
-function sameWalletEcdsaSignerActivationV1(left, right) {
-	return left.kind === right.kind && left.signer.kind === right.signer.kind && left.signer.keyFamily === right.signer.keyFamily && left.signer.walletId === right.signer.walletId && left.signer.walletKeyId === right.signer.walletKeyId && left.signer.thresholdPublicKey33B64u === right.signer.thresholdPublicKey33B64u && left.signer.evmAddress === right.signer.evmAddress && mpcMaterialActivationRefsEqual(left.materialActivation, right.materialActivation);
-}
-function sameWalletEd25519SignerActivationV1(left, right) {
-	return left.kind === right.kind && left.signer.kind === right.signer.kind && left.signer.keyFamily === right.signer.keyFamily && left.signer.walletId === right.signer.walletId && left.signer.walletKeyId === right.signer.walletKeyId && left.signer.registeredPublicKeyB64u === right.signer.registeredPublicKeyB64u && mpcMaterialActivationRefsEqual(left.materialActivation, right.materialActivation);
-}
 function hasFullOwnerPermissionsV1(permissions) {
 	return sameDelegatedWalletAuthorityV1(buildDelegatedWalletAuthorityV1({ permissions }), buildFullOwnerDelegatedWalletAuthorityV1());
 }
@@ -130,6 +126,8 @@ function isRecoveryCodeLocatorCollision(error) {
 }
 var CloudflareD1WalletCustodyCommitStore = class {
 	constructor(options) {
+		this.credentialClaims = options.credentialClaims;
+		this.recoveryRouting = options.recoveryRouting;
 		this.database = options.database;
 		this.scope = options.scope;
 		this.walletAuthMethodStore = options.walletAuthMethodStore ?? new D1WalletAuthMethodStore({
@@ -151,6 +149,27 @@ var CloudflareD1WalletCustodyCommitStore = class {
 			keyPrefix: PASSKEY_ENVELOPE_KEY_PREFIX
 		});
 	}
+	async publishRecoveryOperation(walletId, operationId) {
+		const result = await this.recoveryRouting?.publishRecovery({
+			kind: "operation",
+			walletId,
+			operationId
+		});
+		if (result && !result.ok) throw new Error("Recovery operation routing conflicts");
+	}
+	async claimRecoveryCodeRoutes(walletId, records) {
+		if (!this.recoveryRouting) return true;
+		const locators = [];
+		for (const record of records) {
+			if (record.walletId !== walletId) throw new Error("Recovery code routing wallet differs");
+			locators.push(record.locatorB64u);
+		}
+		return (await this.recoveryRouting.publishRecovery({
+			kind: "codes",
+			walletId,
+			locators
+		})).ok;
+	}
 	async readRecoveryCodeLocator(locatorB64u) {
 		const row = await this.database.prepare(`SELECT locator_b64u, wallet_id, recovery_key_id
            FROM wallet_recovery_code_locators
@@ -339,6 +358,10 @@ var CloudflareD1WalletCustodyCommitStore = class {
 			kind: "inconsistent",
 			reason: inconsistency
 		};
+		if (!await this.claimRecoveryCodeRoutes(commit.recoverySet.walletId, commit.recoveryCodeLocators)) return {
+			kind: "inconsistent",
+			reason: "recovery code locator already exists"
+		};
 		const envelopeKey = passkeyCustodyEnvelopeRecordKey(passkeyCustodyEnvelopeLocatorOf(commit.envelope));
 		const recoverySetKey = walletRecoveryEnvelopeSetRecordKey(commit.recoverySet.walletId);
 		const recoveryBackupAcknowledgementKey = walletRecoveryBackupAcknowledgementRecordKey(commit.recoverySet.walletId);
@@ -470,6 +493,7 @@ var CloudflareD1WalletCustodyCommitStore = class {
 	* the explicit acknowledge route. Both rows are guarded against races.
 	*/
 	async replaceRecoveryEnvelopeSetAndPreserveBackupAcknowledgement(input) {
+		if (!await this.claimRecoveryCodeRoutes(input.record.walletId, input.recoveryCodeLocators)) return { kind: "collision" };
 		const acknowledgementKey = walletRecoveryBackupAcknowledgementRecordKey(input.record.walletId);
 		const existingAcknowledgement = await this.records.read(acknowledgementKey);
 		const mutations = [{
@@ -556,6 +580,11 @@ var CloudflareD1WalletCustodyCommitStore = class {
 			userId: input.authenticatorCommit.userId,
 			record: input.authenticatorCommit.authenticator
 		});
+		await reservePasskeyCredential(this.credentialClaims, {
+			walletId: targetMethod.walletId,
+			rpId: targetMethod.rpId,
+			credentialIdB64u: targetMethod.credentialIdB64u
+		});
 		const bindingStatement = prepareD1WebAuthnCredentialBindingInsertStatement({
 			database: this.database,
 			scope: this.tenantScope(),

package/dist/esm/router/cloudflare/d1/passkeyCustody/d1WalletRecoveryGoogleEmailOtpRecords.js

@@ -4,6 +4,7 @@ import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimit
 import { parseEnvelopeRevision } from "../../../../shared-ts/src/passkey-custody/primitives.js";
 import { parseWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
+import { hasExactKeys } from "../../../../shared-ts/src/utils/exactKeys.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
 import { parseRecoveryCodeReservationId } from "../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
 //#region src/router/cloudflare/d1/passkeyCustody/d1WalletRecoveryGoogleEmailOtpRecords.ts
@@ -125,14 +126,14 @@ function parseWalletRecoveryGoogleEmailOtpAttemptRecord(raw) {
 		expiresAtMs
 	};
 	if (record.state === "prepared") {
-		if (!hasExactFields(record, [...expectedCommonFields])) return null;
+		if (!hasExactKeys(record, [...expectedCommonFields])) return null;
 		return {
 			...common,
 			state: "prepared"
 		};
 	}
 	if (record.state !== "otp_issued" && record.state !== "otp_verified" && record.state !== "finalized") return null;
-	if (!hasExactFields(record, [
+	if (!hasExactKeys(record, [
 		...expectedCommonFields,
 		"providerSubject",
 		"verifiedEmail",
@@ -164,7 +165,7 @@ function parseWalletRecoveryGoogleEmailOtpAttemptRecord(raw) {
 function parseContinuityAnchor(raw) {
 	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
 	const record = raw;
-	if (!hasExactFields(record, [
+	if (!hasExactKeys(record, [
 		"kind",
 		"authority",
 		"method",
@@ -207,7 +208,7 @@ function parseContinuityEnvelope(raw) {
 	const updatedAtMs = parsePositiveMs(record.updatedAtMs);
 	if (!envelopeId.ok || !walletId.ok || updatedAtMs === null || record.bindingKind !== "wallet_custody_seed_v1") return null;
 	if (record.kind === "passkey") {
-		if (!hasExactFields(record, [
+		if (!hasExactKeys(record, [
 			...commonFields,
 			"rpId",
 			"credentialIdB64u"
@@ -227,7 +228,7 @@ function parseContinuityEnvelope(raw) {
 		};
 	}
 	if (record.kind === "email_otp") {
-		if (!hasExactFields(record, [
+		if (!hasExactKeys(record, [
 			...commonFields,
 			"enrollmentId",
 			"enrollmentSealKeyVersion"
@@ -251,7 +252,7 @@ function parseContinuityEnvelope(raw) {
 function parseTarget(raw) {
 	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
 	const record = raw;
-	return hasExactFields(record, ["kind", "googleProvider"]) && record.kind === "google_email_otp" && record.googleProvider === "google" ? {
+	return hasExactKeys(record, ["kind", "googleProvider"]) && record.kind === "google_email_otp" && record.googleProvider === "google" ? {
 		kind: "google_email_otp",
 		googleProvider: "google"
 	} : null;
@@ -261,7 +262,7 @@ function parseTargetEnrollment(raw) {
 	const record = raw;
 	if (typeof record.kind !== "string") return null;
 	if (record.kind === "existing") {
-		if (!hasExactFields(record, [
+		if (!hasExactKeys(record, [
 			"kind",
 			"enrollmentId",
 			"enrollmentSealKeyVersion"
@@ -275,7 +276,7 @@ function parseTargetEnrollment(raw) {
 		} : null;
 	}
 	if (record.kind === "create") {
-		if (!hasExactFields(record, [
+		if (!hasExactKeys(record, [
 			"kind",
 			"providerSubject",
 			"verifiedEmail"
@@ -303,11 +304,6 @@ function parsePositiveMs(raw) {
 function nonEmpty(raw) {
 	return typeof raw === "string" && raw.trim() ? raw.trim() : null;
 }
-function hasExactFields(record, fields) {
-	const actual = Object.keys(record).sort();
-	const expected = [...fields].sort();
-	return actual.length === expected.length && actual.every((field, index) => field === expected[index]);
-}
 function hasFields(record, fields) {
 	return fields.every((field) => Object.hasOwn(record, field));
 }

package/dist/esm/router/cloudflare/d1/passkeyCustody/d1WalletRecoveryGoogleEmailOtpService.js

@@ -4,6 +4,7 @@ import { alphabetizeStringify, sha256BytesUtf8, sha256HexUtf8 } from "../../../.
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import "../../../../shared-ts/src/utils/encoders.js";
 import { buildWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { consumeReservedRecoveryCode } from "../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
 import { hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
@@ -129,24 +130,12 @@ var CloudflareD1WalletRecoveryGoogleEmailOtpService = class {
 			enrollment: attempt.targetEnrollment
 		};
 		const workerEphemeralPublicKey65B64u = nonEmpty(input.workerEphemeralPublicKey65B64u);
-		if (!workerEphemeralPublicKey65B64u) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Email OTP recovery factor release key is required"
-		};
+		if (!workerEphemeralPublicKey65B64u) return failure("invalid_body", "Email OTP recovery factor release key is required");
 		const enrollment = await this.enrollments.readEnrollment(String(attempt.walletId));
-		if (!enrollment || enrollment.orgId !== attempt.orgId || enrollment.providerUserId !== attempt.providerSubject || enrollment.verifiedEmail !== attempt.verifiedEmail || enrollment.enrollmentId !== attempt.targetEnrollment.enrollmentId || enrollment.enrollmentSealKeyVersion !== attempt.targetEnrollment.enrollmentSealKeyVersion) return {
-			ok: false,
-			code: "recovery_conflict",
-			message: "Email OTP recovery enrollment changed after verification"
-		};
+		if (!enrollment || enrollment.orgId !== attempt.orgId || enrollment.providerUserId !== attempt.providerSubject || enrollment.verifiedEmail !== attempt.verifiedEmail || enrollment.enrollmentId !== attempt.targetEnrollment.enrollmentId || enrollment.enrollmentSealKeyVersion !== attempt.targetEnrollment.enrollmentSealKeyVersion) return failure("recovery_conflict", "Email OTP recovery enrollment changed after verification");
 		const unsealed = await this.serverSeal.removeEmailOtpServerSeal({ wrappedCiphertext: enrollment.serverSealedFactorCiphertextB64u });
 		if (!unsealed.ok) return unsealed;
-		if (unsealed.enrollmentSealKeyVersion !== enrollment.enrollmentSealKeyVersion) return {
-			ok: false,
-			code: "recovery_conflict",
-			message: "Email OTP recovery enrollment seal changed after verification"
-		};
+		if (unsealed.enrollmentSealKeyVersion !== enrollment.enrollmentSealKeyVersion) return failure("recovery_conflict", "Email OTP recovery enrollment seal changed after verification");
 		const sealed = await sealEmailOtpFactorSecretForWorker({
 			factorSecret32B64u: unsealed.ciphertext,
 			workerEphemeralPublicKey65B64u,
@@ -464,18 +453,10 @@ async function replayGoogleEmailOtpRecovery(input) {
 	};
 }
 function parseGoogleIdentity(result) {
-	if (!result.ok || result.verified !== true) return {
-		ok: false,
-		code: result.code || "not_verified",
-		message: result.message || "Google verification failed"
-	};
+	if (!result.ok || result.verified !== true) return failure(result.code || "not_verified", result.message || "Google verification failed");
 	const providerSubject = parseProviderSubject(result.providerSubject);
 	const email = parseVerifiedGoogleEmail(result.email);
-	if (!providerSubject.ok || !email.ok || result.emailVerified !== true) return {
-		ok: false,
-		code: "provider_identity_mismatch",
-		message: "Google verification did not provide a verified identity email"
-	};
+	if (!providerSubject.ok || !email.ok || result.emailVerified !== true) return failure("provider_identity_mismatch", "Google verification did not provide a verified identity email");
 	return {
 		ok: true,
 		providerSubject: providerSubject.value,
@@ -484,27 +465,15 @@ function parseGoogleIdentity(result) {
 }
 function resolveTargetEnrollment(input) {
 	if (input.enrollment) {
-		if (input.enrollment.orgId !== input.orgId || input.enrollment.providerUserId !== input.identity.providerSubject || input.enrollment.verifiedEmail !== input.identity.verifiedEmail) return {
-			ok: false,
-			code: "provider_identity_mismatch",
-			message: "Google identity does not match the wallet Email enrollment"
-		};
-		if (input.anchor.envelope.kind === "email_otp" && (input.anchor.envelope.enrollmentId !== input.enrollment.enrollmentId || input.anchor.envelope.enrollmentSealKeyVersion !== input.enrollment.enrollmentSealKeyVersion)) return {
-			ok: false,
-			code: "recovery_conflict",
-			message: "Wallet Email custody enrollment changed after preparation"
-		};
+		if (input.enrollment.orgId !== input.orgId || input.enrollment.providerUserId !== input.identity.providerSubject || input.enrollment.verifiedEmail !== input.identity.verifiedEmail) return failure("provider_identity_mismatch", "Google identity does not match the wallet Email enrollment");
+		if (input.anchor.envelope.kind === "email_otp" && (input.anchor.envelope.enrollmentId !== input.enrollment.enrollmentId || input.anchor.envelope.enrollmentSealKeyVersion !== input.enrollment.enrollmentSealKeyVersion)) return failure("recovery_conflict", "Wallet Email custody enrollment changed after preparation");
 		return {
 			kind: "existing",
 			enrollmentId: input.enrollment.enrollmentId,
 			enrollmentSealKeyVersion: input.enrollment.enrollmentSealKeyVersion
 		};
 	}
-	if (input.anchor.envelope.kind === "email_otp") return {
-		ok: false,
-		code: "recovery_conflict",
-		message: "Wallet Email custody enrollment is missing after preparation"
-	};
+	if (input.anchor.envelope.kind === "email_otp") return failure("recovery_conflict", "Wallet Email custody enrollment is missing after preparation");
 	return {
 		kind: "create",
 		providerSubject: input.identity.providerSubject,
@@ -565,18 +534,10 @@ function nonEmpty(value) {
 	return typeof value === "string" && value.trim() ? value.trim() : null;
 }
 function recoveryAttemptUnavailable() {
-	return {
-		ok: false,
-		code: "recovery_attempt_unavailable",
-		message: "Wallet recovery operation is unavailable"
-	};
+	return failure("recovery_attempt_unavailable", "Wallet recovery operation is unavailable");
 }
 function recoveryAttemptConflict() {
-	return {
-		ok: false,
-		code: "recovery_conflict",
-		message: "Wallet recovery operation changed; retry recovery"
-	};
+	return failure("recovery_conflict", "Wallet recovery operation changed; retry recovery");
 }
 function recoveryFinalizationRefused(reason) {
 	return {

package/dist/esm/router/cloudflare/d1/registration/d1EvmFamilyEcdsaRegistrationBranch.js

@@ -3,6 +3,7 @@ import { deriveEvmFamilySigningKeySlotId } from "../../../../shared-ts/src/signi
 import { computeEcdsaDerivationRoleLocalRelayerKeyId, computeEcdsaDerivationRoleLocalThresholdKeyId, computeSdkEcdsaDerivationApplicationBindingDigestB64u, parseSdkEcdsaDerivationSigningRootId, parseSdkEcdsaDerivationSigningRootVersion, parseSdkEcdsaDerivationThresholdKeyId } from "../../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { buildRouterAbEcdsaDerivationActiveStateIdV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import "./d1RegistrationCeremonyRecords.js";
 //#region src/router/cloudflare/d1/registration/d1EvmFamilyEcdsaRegistrationBranch.ts
 const REGISTRATION_WALLET_SIGNING_SESSION_REMAINING_USES = 3;
@@ -13,28 +14,12 @@ function requireRegistrationRootShareEpoch(value) {
 	return parsed.value;
 }
 async function buildD1EvmFamilyEcdsaRegistrationPrepare(input) {
-	if (!input.chainTargets) return {
-		ok: false,
-		code: "invalid_body",
-		message: "ECDSA registration contains an invalid chain target"
-	};
-	if (input.chainTargets.length === 0) return {
-		ok: false,
-		code: "invalid_body",
-		message: "ECDSA registration requires at least one chain target"
-	};
+	if (!input.chainTargets) return failure("invalid_body", "ECDSA registration contains an invalid chain target");
+	if (input.chainTargets.length === 0) return failure("invalid_body", "ECDSA registration requires at least one chain target");
 	const firstChainTarget = input.chainTargets[0];
-	if (!firstChainTarget) return {
-		ok: false,
-		code: "invalid_body",
-		message: "ECDSA registration requires at least one chain target"
-	};
+	if (!firstChainTarget) return failure("invalid_body", "ECDSA registration requires at least one chain target");
 	const chainTargets = [firstChainTarget, ...input.chainTargets.slice(1)];
-	if (input.participantIds.length !== 2 || input.participantIds[0] !== 1 || input.participantIds[1] !== 2) return {
-		ok: false,
-		code: "invalid_body",
-		message: "ECDSA registration requires participant pair [1, 2]"
-	};
+	if (input.participantIds.length !== 2 || input.participantIds[0] !== 1 || input.participantIds[1] !== 2) return failure("invalid_body", "ECDSA registration requires participant pair [1, 2]");
 	const evmFamilySigningKeySlotId = deriveEvmFamilySigningKeySlotId({
 		walletId: input.walletId,
 		signingRootId: input.signingRootId,

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore.js

@@ -61,17 +61,25 @@ var D1RegistrationCeremonyRecordStore = class {
 		if (recordsMatch(current, prepared)) return;
 		throw conflict("Registration ceremony record conflicts with the stored value");
 	}
+	async insertOrRead(mutation) {
+		const key = this.normalizeKey(mutation.scope, mutation.id);
+		const prepared = prepareValue(mutation.value, mutation.expiresAtMs);
+		await this.insert(key, prepared);
+		const stored = await this.get(mutation.scope, mutation.id);
+		if (!stored) throw conflict("Registration setup expired during persistence");
+		return stored;
+	}
 	async updateExpected(input) {
 		const key = this.normalizeKey(input.scope, input.id);
 		const current = await this.get(input.scope, input.id);
-		if (!current || stableJson(current.value) !== stableJson(input.expected)) throw conflict("Registration ceremony record changed before update");
+		if (!current || alphabetizeStringify(current.value) !== alphabetizeStringify(input.expected)) throw conflict("Registration ceremony record changed before update");
 		const next = prepareValue(input.next, input.expiresAtMs);
 		if (changes(await this.database.prepare(UPDATE_EXPECTED_VERSION_SQL).bind(...this.bindKey(key), next.recordJson, next.expiresAtMs, Date.now(), current.version).run()) !== 1) throw conflict("Registration ceremony record changed during update");
 	}
 	async claimEcdsaRegistrationBranch(input) {
 		const key = this.normalizeKey(input.scope, input.id);
 		const strictRegistrationBindingJson = input.binding.kind === "strict_registration" ? normalizeKeyPart(input.binding.strictRegistrationBindingJson, "strictRegistrationBindingJson", 16384) : "";
-		const patchJson = stableJson(input.patch);
+		const patchJson = alphabetizeStringify(input.patch);
 		const nowMs = Date.now();
 		const row = await this.database.prepare(`WITH target(branch_index) AS (
            SELECT CAST(branch.key AS INTEGER)
@@ -117,8 +125,7 @@ var D1RegistrationCeremonyRecordStore = class {
 		const parsed = parseStoredRow(row);
 		return {
 			value: parsed.value,
-			version: parsed.version,
-			expiresAtMs: parsed.expiresAtMs
+			version: parsed.version
 		};
 	}
 	async updateExpectedVersion(input) {
@@ -235,8 +242,7 @@ function prepareValue(value, expiresAtMs) {
 	const normalizedExpiresAtMs = Math.floor(Number(expiresAtMs));
 	if (!Number.isSafeInteger(normalizedExpiresAtMs) || normalizedExpiresAtMs <= Date.now()) throw new Error("Registration ceremony record expiry must be in the future");
 	return {
-		value,
-		recordJson: stableJson(value),
+		recordJson: alphabetizeStringify(value),
 		expiresAtMs: normalizedExpiresAtMs
 	};
 }
@@ -259,10 +265,7 @@ function parseStoredRow(row) {
 	};
 }
 function recordsMatch(current, next) {
-	return current.expiresAtMs === next.expiresAtMs && stableJson(current.value) === next.recordJson;
-}
-function stableJson(value) {
-	return alphabetizeStringify(value);
+	return current.expiresAtMs === next.expiresAtMs && alphabetizeStringify(current.value) === next.recordJson;
 }
 function changes(result) {
 	if (!result.success) throw new Error("Registration ceremony D1 mutation failed");

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyRecords.js

@@ -2,8 +2,6 @@ import { parseChallengeSubjectId, parseEmailOtpChallengeId, parseOrgId, parsePro
 import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../../shared-ts/src/utils/near.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { parseWalletAddAuthMethodRegistrationOptions } from "../../../../shared-ts/src/utils/addAuthMethodRegistration.js";
 import { parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationActivationResultV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { deriveEvmFamilySigningKeySlotId } from "../../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";
@@ -16,23 +14,22 @@ import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/
 import { parseWebAuthnAuthenticatorDeviceInfo, unknownWebAuthnAuthenticatorDeviceInfo } from "../../../../shared-ts/src/utils/webauthnDeviceInfo.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { parseRouterAbEd25519NormalSigningState } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
-import { thresholdEcdsaChainTargetFromValue, thresholdEcdsaChainTargetKey } from "../../../../core/thresholdEcdsaChainTarget.js";
-import { parseEcdsaDerivationPublicIdentity, parseThresholdEd25519AuthorityScope, thresholdEd25519AuthorityScopeFromWalletAuthAuthority, thresholdEd25519AuthorityScopesMatch } from "../../../../core/ThresholdService/validation.js";
+import { thresholdEcdsaChainTargetKey } from "../../../../shared-ts/src/utils/thresholdEcdsaChainTarget.js";
+import { thresholdEcdsaChainTargetFromValue } from "../../../../core/thresholdEcdsaChainTarget.js";
 import { buildWalletEcdsaSignerRecord, parseWalletEd25519SignerRecord } from "../../../../core/d1WalletStore.js";
-import { createServerAllocatedWalletId, nearEd25519SigningKeyIdFromString, walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
+import { nearEd25519SigningKeyIdFromString, walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { registrationPreparationIdFromString } from "../../../../core/types.js";
 import "../../../../shared-ts/src/signing-lanes/index.js";
 import { parsePasskeyCustodyEnvelopeRecord } from "../../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
+import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../../shared-ts/src/utils/near.js";
 import { normalizeAddSignerSelection, normalizeRegistrationSignerPlan, registrationSignerBranchKeyFromString, registrationSignerSetSelectionFromPlan } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
 import { addAuthMethodIntentGrantFromString, addSignerIntentGrantFromString, normalizeAddAuthMethodIntentCaller } from "../../../../shared-ts/src/utils/registrationIntent.js";
+import { parseEcdsaDerivationPublicIdentity, parseThresholdEd25519AuthorityScope, thresholdEd25519AuthorityScopeFromWalletAuthAuthority, thresholdEd25519AuthorityScopesMatch } from "../../../../core/ThresholdService/validation.js";
 import { toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";
-import { parseStoredRouterAbEcdsaPendingActivationV1 } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
 import { parseStoredRegistrationSignerPlan, parseStoredWalletRegistrationPreparedContext, storedRegistrationSignerPlansMatch } from "../../../../core/RegistrationCeremonyStore.js";
+import { parseStoredRouterAbEcdsaPendingActivationV1 } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
 //#region src/router/cloudflare/d1/registration/d1RegistrationCeremonyRecords.ts
-function createD1ServerAllocatedWalletId() {
-	return createServerAllocatedWalletId();
-}
 function inferRuntimePolicyScopeFromSigningRoot(input) {
 	const signingRootId = normalizeOptionalTrimmedString(input.signingRootId);
 	const signingRootVersion = normalizeOptionalTrimmedString(input.signingRootVersion);
@@ -47,7 +44,7 @@ function inferRuntimePolicyScopeFromSigningRoot(input) {
 	};
 }
 function buildRegistrationIntent(input) {
-	const nonceB64u = secureRandomBase64Url(32);
+	const nonceB64u = input.nonceB64u;
 	const foundingWalletAuthMethodId = input.foundingWalletAuthMethodId;
 	if (input.runtimePolicyScope) return {
 		version: "registration_intent_v1",
@@ -1368,7 +1365,6 @@ function parseD1EcdsaDerivationServerBootstrapResponse(raw) {
 	const publicIdentity = parseD1EcdsaDerivationPublicIdentity(record.publicIdentity);
 	const clientShareRetryCounter = safeInteger(record.clientShareRetryCounter);
 	const relayerShareRetryCounter = safeInteger(record.relayerShareRetryCounter);
-	const publicTranscriptDigest32B64u = normalizeOptionalTrimmedString(record.publicTranscriptDigest32B64u);
 	const keyHandle = normalizeOptionalTrimmedString(record.keyHandle);
 	const signingRootId = normalizeOptionalTrimmedString(record.signingRootId);
 	const signingRootVersion = normalizeOptionalTrimmedString(record.signingRootVersion);
@@ -1383,7 +1379,7 @@ function parseD1EcdsaDerivationServerBootstrapResponse(raw) {
 	const expiresAt = normalizeOptionalTrimmedString(record.expiresAt);
 	const remainingUses = safeInteger(record.remainingUses);
 	const routerAbEcdsaDerivationNormalSigning = parseRouterAbEcdsaDerivationNormalSigningStateV1(record.routerAbEcdsaDerivationNormalSigning);
-	if (!walletId || !evmFamilySigningKeySlotId || !ecdsaThresholdKeyId || !relayerKeyId || !applicationBindingDigestB64u || !contextBinding32B64u || !publicIdentity || clientShareRetryCounter === null || relayerShareRetryCounter === null || !publicTranscriptDigest32B64u || !keyHandle || !signingRootId || !signingRootVersion || !thresholdEcdsaPublicKeyB64u || !ethereumAddress || !relayerVerifyingShareB64u || !participantIds || !thresholdSessionId || !activationEpoch || expiresAtMs === null || !expiresAt || remainingUses === null || !routerAbEcdsaDerivationNormalSigning) return null;
+	if (!walletId || !evmFamilySigningKeySlotId || !ecdsaThresholdKeyId || !relayerKeyId || !applicationBindingDigestB64u || !contextBinding32B64u || !publicIdentity || clientShareRetryCounter === null || relayerShareRetryCounter === null || !keyHandle || !signingRootId || !signingRootVersion || !thresholdEcdsaPublicKeyB64u || !ethereumAddress || !relayerVerifyingShareB64u || !participantIds || !thresholdSessionId || !activationEpoch || expiresAtMs === null || !expiresAt || remainingUses === null || !routerAbEcdsaDerivationNormalSigning) return null;
 	return {
 		formatVersion: "ecdsa-derivation-role-local",
 		walletId,
@@ -1395,7 +1391,6 @@ function parseD1EcdsaDerivationServerBootstrapResponse(raw) {
 		publicIdentity,
 		clientShareRetryCounter,
 		relayerShareRetryCounter,
-		publicTranscriptDigest32B64u,
 		keyHandle,
 		signingRootId,
 		signingRootVersion,
@@ -2033,6 +2028,6 @@ function unreachableAddAuthMethodInput(value) {
 	throw new Error(`Unhandled add-auth-method input kind: ${String(value)}`);
 }
 //#endregion
-export { buildAddAuthMethodIntent, buildAddSignerIntent, buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, buildD1WalletRecord, buildRegistrationIntent, createD1ServerAllocatedWalletId, deriveEvmFamilySigningKeySlotId, inferRuntimePolicyScopeFromSigningRoot, intentScopeMetadata, normalizeThresholdEcdsaChainTargets, parseD1AddSignerIntent, parseD1EcdsaDerivationServerBootstrapResponse, parseD1RuntimePolicyScope, parseD1StoredAddAuthMethodIntent, parseD1StoredAddSignerAuth, parseD1StoredAddSignerIntent, parseD1StoredWalletAddAuthMethodCeremony, parseD1StoredWalletAddAuthMethodFinalizeReplay, parseD1StoredWalletAddSignerCeremony, parseD1StoredWalletAddSignerFinalizeReplay, parseD1StoredWalletRegistrationCeremony, parseD1WalletAddSignerFinalizeTerminalResponse, parseD1WalletRegistrationCommittedInstallationProjection, parseD1WalletRegistrationFinalizeReplayResponse, parseWalletIdForIntent, positiveIntegerArraysEqual, runtimePolicyScopeMatches, thresholdEcdsaChainTargetsEqual };
+export { buildAddAuthMethodIntent, buildAddSignerIntent, buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, buildD1WalletRecord, buildRegistrationIntent, deriveEvmFamilySigningKeySlotId, inferRuntimePolicyScopeFromSigningRoot, intentScopeMetadata, normalizeThresholdEcdsaChainTargets, parseD1AddSignerIntent, parseD1EcdsaDerivationServerBootstrapResponse, parseD1RuntimePolicyScope, parseD1StoredAddAuthMethodIntent, parseD1StoredAddSignerAuth, parseD1StoredAddSignerIntent, parseD1StoredWalletAddAuthMethodCeremony, parseD1StoredWalletAddAuthMethodFinalizeReplay, parseD1StoredWalletAddSignerCeremony, parseD1StoredWalletAddSignerFinalizeReplay, parseD1StoredWalletRegistrationCeremony, parseD1WalletAddSignerFinalizeTerminalResponse, parseD1WalletRegistrationCommittedInstallationProjection, parseD1WalletRegistrationFinalizeReplayResponse, parseWalletIdForIntent, positiveIntegerArraysEqual, runtimePolicyScopeMatches, thresholdEcdsaChainTargetsEqual };
 
 //# sourceMappingURL=d1RegistrationCeremonyRecords.js.map

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyStore.js

@@ -7,13 +7,32 @@ var CloudflareD1RegistrationCeremonyIntentStore = class {
 	constructor(input) {
 		this.storage = new D1RegistrationCeremonyRecordStore(input);
 	}
-	async putCeremony(ceremony) {
-		await this.put({
+	async getSetupCeremony(ceremonyId) {
+		const stored = await this.storage.get("setup-ceremony", ceremonyId);
+		if (!stored) return null;
+		const ceremony = parseD1StoredWalletRegistrationCeremony(stored.value);
+		if (!ceremony) throw new Error("Registration setup snapshot is invalid");
+		return ceremony;
+	}
+	async reserveSetupCeremony(proposed) {
+		const ceremony = parseD1StoredWalletRegistrationCeremony((await this.storage.insertOrRead({
+			scope: "setup-ceremony",
+			id: proposed.registrationCeremonyId,
+			value: encodeRecord(proposed),
+			expiresAtMs: proposed.expiresAtMs
+		})).value);
+		if (!ceremony || ceremony.registrationCeremonyId !== proposed.registrationCeremonyId || ceremony.expiresAtMs !== proposed.expiresAtMs || ceremony.orgId !== proposed.orgId || ceremony.digestB64u !== proposed.digestB64u || ceremony.foundingWalletAuthorityId !== proposed.foundingWalletAuthorityId || ceremony.foundingDeviceId !== proposed.foundingDeviceId || ceremony.foundingWalletAuthMethodId !== proposed.foundingWalletAuthMethodId || ceremony.expectedOrigin !== proposed.expectedOrigin) throw new Error("Registration setup snapshot conflicts with its reservation");
+		await this.ensureSetupCeremony(ceremony);
+		return ceremony;
+	}
+	async ensureSetupCeremony(setup) {
+		const current = parseD1StoredWalletRegistrationCeremony((await this.storage.insertOrRead({
 			scope: "ceremony",
-			id: ceremony.registrationCeremonyId,
-			record: ceremony,
-			expiresAtMs: ceremony.expiresAtMs
-		});
+			id: setup.registrationCeremonyId,
+			value: encodeRecord(setup),
+			expiresAtMs: setup.expiresAtMs
+		})).value);
+		if (!current || current.registrationCeremonyId !== setup.registrationCeremonyId || current.expiresAtMs !== setup.expiresAtMs || current.orgId !== setup.orgId || current.digestB64u !== setup.digestB64u || current.foundingWalletAuthorityId !== setup.foundingWalletAuthorityId || current.foundingDeviceId !== setup.foundingDeviceId || current.foundingWalletAuthMethodId !== setup.foundingWalletAuthMethodId || current.expectedOrigin !== setup.expectedOrigin) throw new Error("Registration ceremony conflicts with its setup snapshot");
 	}
 	async getCeremony(registrationCeremonyId) {
 		return (await this.getCeremonySnapshot(registrationCeremonyId))?.ceremony ?? null;
@@ -80,13 +99,6 @@ var CloudflareD1RegistrationCeremonyIntentStore = class {
 			expiresAtMs: input.next.expiresAtMs
 		});
 	}
-	async takeCeremony(registrationCeremonyId) {
-		const id = normalizeOptionalTrimmedString(registrationCeremonyId);
-		if (!id) return null;
-		const ceremony = parseD1StoredWalletRegistrationCeremony(await this.getDel("ceremony", id));
-		if (!ceremony || ceremony.expiresAtMs <= Date.now()) return null;
-		return ceremony;
-	}
 	async deleteCeremony(registrationCeremonyId) {
 		const id = normalizeOptionalTrimmedString(registrationCeremonyId);
 		if (!id) return false;

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationIntentService.js

@@ -1,8 +1,8 @@
 import { parseWalletAuthMethodId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { normalizeAddAuthMethodInput } from "../../../../shared-ts/src/utils/registrationAuthMethodInput.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { thresholdEcdsaChainTargetFromValue } from "../../../../core/thresholdEcdsaChainTarget.js";
 import { normalizeAddSignerSelection } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
 import { addAuthMethodIntentGrantFromString, addSignerIntentGrantFromString, computeAddAuthMethodIntentDigestB64u, computeAddSignerIntentDigestB64u } from "../../../../shared-ts/src/utils/registrationIntent.js";
@@ -19,11 +19,7 @@ var CloudflareD1RegistrationIntentService = class {
 		try {
 			const store = this.getRegistrationCeremonyIntentStore();
 			const walletId = parseWalletIdForIntent(input.command.subject.walletId);
-			if (!walletId) return {
-				ok: false,
-				code: "invalid_body",
-				message: "walletId is required"
-			};
+			if (!walletId) return failure("invalid_body", "walletId is required");
 			const signerSelection = normalizeAddSignerSelection(input.command.signerSelection, { normalizeEcdsaChainTarget: thresholdEcdsaChainTargetFromValue });
 			if (!signerSelection.ok) return signerSelection;
 			const runtimePolicyScope = input.runtimePolicyScope || inferRuntimePolicyScopeFromSigningRoot(input);
@@ -52,35 +48,19 @@ var CloudflareD1RegistrationIntentService = class {
 				expiresAtMs
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				code: "internal",
-				message: errorMessage(error) || "Failed to create add-signer intent"
-			};
+			return failure("internal", errorMessage(error) || "Failed to create add-signer intent");
 		}
 	}
 	async createAddAuthMethodIntent(input) {
 		try {
 			const store = this.getRegistrationCeremonyIntentStore();
 			const walletId = parseWalletIdForIntent(input.command.subject.walletId);
-			if (!walletId) return {
-				ok: false,
-				code: "invalid_body",
-				message: "walletId is required"
-			};
+			if (!walletId) return failure("invalid_body", "walletId is required");
 			const authMethod = normalizeAddAuthMethodInput(input.command.authMethod);
-			if (!authMethod) return {
-				ok: false,
-				code: "invalid_body",
-				message: "authMethod is required"
-			};
+			if (!authMethod) return failure("invalid_body", "authMethod is required");
 			const runtimePolicyScope = input.runtimePolicyScope || inferRuntimePolicyScopeFromSigningRoot(input);
 			const targetWalletAuthMethodId = parseWalletAuthMethodId(`wallet-auth-method:${secureRandomBase64Url(32)}`);
-			if (!targetWalletAuthMethodId.ok) return {
-				ok: false,
-				code: "internal",
-				message: "Failed to allocate a target auth-method id"
-			};
+			if (!targetWalletAuthMethodId.ok) return failure("internal", "Failed to allocate a target auth-method id");
 			const intent = buildAddAuthMethodIntent({
 				walletId,
 				authMethod,
@@ -108,11 +88,7 @@ var CloudflareD1RegistrationIntentService = class {
 				expiresAtMs
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				code: "internal",
-				message: errorMessage(error) || "Failed to create add-auth-method intent"
-			};
+			return failure("internal", errorMessage(error) || "Failed to create add-auth-method intent");
 		}
 	}
 };