@seams/wallet-server 0.7.1 → 0.8.0

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationService.js

@@ -1,12 +1,10 @@
-import { mpcMaterialActivationRefsEqual, parseThresholdEd25519SessionId, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletKeyId, parseWebAuthnCredentialIdB64u } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseDeviceId, parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { mpcMaterialActivationRefsEqual, parseThresholdEd25519SessionId, parseWalletKeyId, parseWebAuthnCredentialIdB64u } from "../../../../shared-ts/src/utils/domainIds.js";
+import { parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, bytesToUnprefixedHex, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import "../../../../shared-ts/src/utils/encoders.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../../shared-ts/src/utils/near.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { buildFullOwnerPermissionsV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { parseEd25519PublicKeyB64u, parseSecp256k1CompressedPublicKeyB64u } from "../../../../shared-ts/src/passkey-custody/primitives.js";
 import { buildExactAdministeredSignerManifestV1 } from "../../../../shared-ts/src/device-linking/delegatedActivationPlan.js";
@@ -14,39 +12,40 @@ import { routerAbMpcMaterialActivationRefFromWire, routerAbMpcMaterialActivation
 import { deriveRouterAbEd25519YaoRuntimePolicyBindingV1 } from "../../../../shared-ts/src/utils/routerAbEd25519YaoDigests.js";
 import { sameRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { ecdsaClientRootPublicKey33B64uFromString } from "../../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
-import { deriveSigningRootId, signingRootScopeFromRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
+import { signingRootScopeFromRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority, walletAuthAuthoritiesMatch } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1, buildRouterAbEcdsaDerivationActiveStateIdV1, buildRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaDerivationNormalSigningStateV1, sameRouterAbEcdsaDerivationNormalSigningStateV1, sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaRegistrationActivationReceiptV1, sameRouterAbEcdsaVerifiedClientActivationFactsV1, sameRouterAbPublicDigest32V1Wire } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { buildWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { buildActiveWalletAuthorityV1, buildWalletSignerActivationSetV1, computeWalletAuthorityDigestB64u, computeWalletSignerActivationSetDigestB64u, extendEcdsaWalletAuthorityWithEd25519, isActiveEcdsaWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
-import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { ROUTER_AB_ED25519_NORMAL_SIGNING_STATE_KIND } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
 import { normalizeThresholdEd25519ParticipantIds } from "../../../../shared-ts/src/threshold/participants.js";
-import { parseEcdsaDerivationPublicIdentity, thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
 import { nearEd25519SigningKeyIdFromString, registrationEd25519AuthorityScopeFromAuthority, walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
-import { registrationPreparationIdFromString } from "../../../../core/types.js";
 import { buildTenantRootIdentityFromAuthenticatedDeploymentV1 } from "../../../../shared-ts/src/tenant-root/tenantRootIdentity.js";
 import { walletCustodyCeremonyCommitPayloadFromWire } from "../../../../shared-ts/src/passkey-custody/ceremonyCommitPayload.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
 import { computeWalletRegistrationSetupDigestB64u, parseWalletRegistrationSetupClaims, verifySignedWalletRegistrationSetup, verifyWalletRegistrationSetupClaims } from "../../../domains/walletRegistration/walletRegistrationSetupPayload.js";
-import { findRegistrationSignerPlanEvmFamilyEcdsaBranch, findRegistrationSignerPlanNearEd25519Branch, registrationNearEd25519BranchKey, registrationSignerPlanFromSelection } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
+import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../../shared-ts/src/utils/near.js";
+import { registrationNearEd25519BranchKey } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
 import { registrationIntentGrantFromString } from "../../../../shared-ts/src/utils/registrationIntent.js";
 import { DEFAULT_WALLET_SESSION_TTL_MS } from "../../../../shared-ts/src/threshold/sessionPolicy.js";
+import { parseEcdsaDerivationPublicIdentity, thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
 import { walletAuthAuthorityFromRegistrationAuthority, walletRegistrationFinalizeAuthMethodFromAuthority } from "../wallet/d1WalletAuthMethodBoundary.js";
 import { buildRouterAbEd25519YaoRegistrationCapabilityRecordV1 } from "../../../domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery.js";
 import { buildRouterAbEd25519YaoProductAdmissionRequestV1, createRouterAbEd25519YaoMaterialActivationRefV1, projectRouterAbEd25519YaoExactWalletSession } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js";
 import { runRouterAbEd25519YaoRegistrationSideEffectV2, throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
 import { buildYaoEd25519WalletSignerRecord, ed25519NearPublicKeyFromBytes, implicitNearAccountIdFromEd25519PublicKeyBytes } from "../ed25519Yao/d1Ed25519YaoWalletSigner.js";
+import { buildStoredWalletRegistrationEvmFamilyEcdsaFinalizedBranch, buildStoredWalletRegistrationNearEd25519YaoAuthorizedBranch, findStoredWalletRegistrationEvmFamilyEcdsaBranch, findStoredWalletRegistrationNearEd25519YaoBranch, replaceStoredWalletRegistrationSignerBranch, storedRegistrationAuthoritiesMatch, verifiedRegistrationCeremonyAuthority } from "../../../../core/RegistrationCeremonyStore.js";
+import { routerAbEcdsaStrictRegistrationRequestBindingJson } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
+import { buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, buildD1WalletRecord, parseWalletIdForIntent, thresholdEcdsaChainTargetsEqual } from "./d1RegistrationCeremonyRecords.js";
 import { deriveThresholdEcdsaKeyHandle } from "../../../../shared-ts/src/utils/thresholdEcdsaKeyHandle.js";
-import { routerAbEcdsaStrictRegistrationFactsBindingJson, routerAbEcdsaStrictRegistrationRequestBindingJson } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
-import { buildStoredWalletRegistrationEvmFamilyEcdsaFinalizedBranch, buildStoredWalletRegistrationEvmFamilyEcdsaPreparedBranch, buildStoredWalletRegistrationNearEd25519YaoAuthorizedBranch, buildStoredWalletRegistrationPreparedContext, findStoredWalletRegistrationEvmFamilyEcdsaBranch, findStoredWalletRegistrationNearEd25519YaoBranch, replaceStoredWalletRegistrationSignerBranch, storedRegistrationAuthoritiesMatch, verifiedRegistrationCeremonyAuthority } from "../../../../core/RegistrationCeremonyStore.js";
-import { buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, buildD1WalletRecord, buildRegistrationIntent, createD1ServerAllocatedWalletId, inferRuntimePolicyScopeFromSigningRoot, normalizeThresholdEcdsaChainTargets, parseWalletIdForIntent, thresholdEcdsaChainTargetsEqual } from "./d1RegistrationCeremonyRecords.js";
-import { resolveTenantRootIdentityV1 } from "../../../domains/tenantRoot/tenantRootIdentityResolution.js";
+import { admitRegistrationReservationHome, completeRegistrationReservation } from "../../../domains/walletRegistration/walletRegistrationReservation.js";
 import { listThresholdEcdsaKeyIdentityTargetsForUser } from "../../../../core/authService/thresholdEcdsaKeyInventory.js";
-import { buildWalletRegistrationSetupSignature, normalizeWalletRegistrationSetupRequest, resolveWalletRegistrationSetupWalletId, storedRespondEd25519DeferredWork, walletRegistrationRespondResult, walletRegistrationSetupError, walletRegistrationSetupExpiresAtMs, walletRegistrationSetupIds, walletRegistrationSetupIntentDigest } from "./d1WalletRegistrationSetup.js";
-import { commitRegistrationCustody } from "../../../domains/passkeyCustody/registrationCustodyOutcome.js";
-import { buildD1EvmFamilyEcdsaRegistrationPrepare } from "./d1EvmFamilyEcdsaRegistrationBranch.js";
 import { routerAbEd25519YaoLifecycleDecisionLookupV1, routerAbEd25519YaoLifecycleDecisionV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoLifecycleDecision.js";
+import { commitRegistrationCustody } from "../../../domains/passkeyCustody/registrationCustodyOutcome.js";
+import { resolveTenantRootIdentityV1 } from "../../../domains/tenantRoot/tenantRootIdentityResolution.js";
+import { createD1RegistrationRouteTimingRecorder, errorMessage, finishD1RegistrationRouteTiming, registrationSignerBranchesFromPlan, startD1RegistrationRouteTiming } from "./d1RegistrationSetupSupport.js";
+import { storedRespondEd25519DeferredWork, walletRegistrationRespondResult } from "./d1WalletRegistrationSetup.js";
+import { executeD1WalletRegistrationSetup } from "./d1WalletRegistrationSetupExecution.js";
 import { projectWalletRegistrationSessionCommitReceiptV2, registrationReplayAuthMethodFields, replayedRegistrationCommit, unissuedRegistrationCommit } from "./walletRegistrationSessionCommitReceipt.js";
 import { assertDirectWalletSessionOwnerProof, buildRegistrationOwnerProof, issueDirectRegistrationEstablishedEcdsaSession, issueDirectRegistrationEstablishedEd25519Session, projectCurrentNearRegistrationSession, replayDirectRegistrationEstablishedEcdsaSession, replayDirectRegistrationEstablishedEd25519Session, walletSessionPrincipalId } from "./walletRegistrationEstablishedSessionIssuer.js";
 //#region src/router/cloudflare/d1/registration/d1WalletRegistrationService.ts
@@ -92,7 +91,7 @@ function sameRouterAbEcdsaRegistrationRequest(left, right) {
 	return routerAbEcdsaStrictRegistrationRequestBindingJson(left) === routerAbEcdsaStrictRegistrationRequestBindingJson(right) && left.client_ephemeral_public_key === right.client_ephemeral_public_key && sameRouterAbEcdsaRegistrationEnvelope(left.deriver_a_envelope, right.deriver_a_envelope) && sameRouterAbEcdsaRegistrationEnvelope(left.deriver_b_envelope, right.deriver_b_envelope);
 }
 function sameEcdsaDerivationServerBootstrap(left, right) {
-	return left.formatVersion === right.formatVersion && left.walletId === right.walletId && left.evmFamilySigningKeySlotId === right.evmFamilySigningKeySlotId && left.ecdsaThresholdKeyId === right.ecdsaThresholdKeyId && left.relayerKeyId === right.relayerKeyId && left.applicationBindingDigestB64u === right.applicationBindingDigestB64u && left.contextBinding32B64u === right.contextBinding32B64u && sameEcdsaDerivationPublicIdentity(left.publicIdentity, right.publicIdentity) && left.clientShareRetryCounter === right.clientShareRetryCounter && left.relayerShareRetryCounter === right.relayerShareRetryCounter && left.publicTranscriptDigest32B64u === right.publicTranscriptDigest32B64u && left.keyHandle === right.keyHandle && left.signingRootId === right.signingRootId && left.signingRootVersion === right.signingRootVersion && left.thresholdEcdsaPublicKeyB64u === right.thresholdEcdsaPublicKeyB64u && left.ethereumAddress === right.ethereumAddress && left.relayerVerifyingShareB64u === right.relayerVerifyingShareB64u && sameEcdsaParticipantIds(left.participantIds, right.participantIds) && left.thresholdSessionId === right.thresholdSessionId && left.activationEpoch === right.activationEpoch && left.expiresAtMs === right.expiresAtMs && left.expiresAt === right.expiresAt && left.remainingUses === right.remainingUses && sameRouterAbEcdsaDerivationNormalSigningStateV1(left.routerAbEcdsaDerivationNormalSigning, right.routerAbEcdsaDerivationNormalSigning);
+	return left.formatVersion === right.formatVersion && left.walletId === right.walletId && left.evmFamilySigningKeySlotId === right.evmFamilySigningKeySlotId && left.ecdsaThresholdKeyId === right.ecdsaThresholdKeyId && left.relayerKeyId === right.relayerKeyId && left.applicationBindingDigestB64u === right.applicationBindingDigestB64u && left.contextBinding32B64u === right.contextBinding32B64u && sameEcdsaDerivationPublicIdentity(left.publicIdentity, right.publicIdentity) && left.clientShareRetryCounter === right.clientShareRetryCounter && left.relayerShareRetryCounter === right.relayerShareRetryCounter && left.keyHandle === right.keyHandle && left.signingRootId === right.signingRootId && left.signingRootVersion === right.signingRootVersion && left.thresholdEcdsaPublicKeyB64u === right.thresholdEcdsaPublicKeyB64u && left.ethereumAddress === right.ethereumAddress && left.relayerVerifyingShareB64u === right.relayerVerifyingShareB64u && sameEcdsaParticipantIds(left.participantIds, right.participantIds) && left.thresholdSessionId === right.thresholdSessionId && left.activationEpoch === right.activationEpoch && left.expiresAtMs === right.expiresAtMs && left.expiresAt === right.expiresAt && left.remainingUses === right.remainingUses && sameRouterAbEcdsaDerivationNormalSigningStateV1(left.routerAbEcdsaDerivationNormalSigning, right.routerAbEcdsaDerivationNormalSigning);
 }
 function linkedEd25519ProjectionMaterialActivationWire(projection) {
 	return routerAbMpcMaterialActivationRefToWire(projection.materialActivation);
@@ -203,14 +202,6 @@ function requirePreparedRegistrationId(result, label) {
 	if (!result.ok) throw new Error(`${label} is invalid: ${result.error.message}`);
 	return result.value;
 }
-function allocateWalletRegistrationOperationPrepared() {
-	return {
-		kind: "d1_wallet_registration_operation_prepared_v1",
-		walletAuthorityId: requirePreparedRegistrationId(parseWalletAuthorityId(`wallet-authority:${secureRandomBase64Url(32)}`), "walletAuthorityId"),
-		deviceId: requirePreparedRegistrationId(parseDeviceId(`device:${secureRandomBase64Url(32)}`), "deviceId"),
-		walletAuthMethodId: requirePreparedRegistrationId(parseWalletAuthMethodId(`wallet-auth-method:${secureRandomBase64Url(32)}`), "walletAuthMethodId")
-	};
-}
 function walletRegistrationOperationPreparedFromCeremony(ceremony) {
 	if (String(ceremony.foundingWalletAuthMethodId) !== String(ceremony.intent.foundingWalletAuthMethodId)) throw new Error("registration ceremony and intent name different founding auth methods");
 	return {
@@ -528,9 +519,6 @@ function ed25519AlreadyCommittedWalletSessionResponse(committed) {
 function registrationWalletAuthAuthority(input) {
 	return walletAuthAuthorityFromRegistrationAuthority(input);
 }
-function errorMessage(error) {
-	return error instanceof Error ? error.message : String(error || "");
-}
 function assertNeverSponsoredNamedNearAccountCreationResult(value) {
 	throw new Error(`Unexpected sponsored NEAR account creation result: ${String(value)}`);
 }
@@ -551,24 +539,6 @@ async function cleanupFinalizedRegistrationCeremony(input) {
 		await input.store.deleteCeremony(input.registrationCeremonyId);
 	} catch {}
 }
-function createD1RegistrationRouteTimingRecorder(route) {
-	return {
-		route,
-		entries: []
-	};
-}
-function startD1RegistrationRouteTiming(name) {
-	return {
-		name,
-		startedAtMs: Date.now()
-	};
-}
-function finishD1RegistrationRouteTiming(recorder, mark) {
-	recorder.entries.push({
-		name: mark.name,
-		durationMs: Math.max(0, Date.now() - mark.startedAtMs)
-	});
-}
 function d1RegistrationRouteDiagnostics(recorder) {
 	return {
 		kind: "wallet_registration_route_diagnostics_v1",
@@ -602,48 +572,6 @@ function hasEcdsaKeyHandleSetMismatch(expectedKeyHandles, actualKeyHandles) {
 	for (const keyHandle of expected) if (!actual.has(keyHandle)) return true;
 	return false;
 }
-function registrationIntentSignerBranches(intent) {
-	const plan = registrationSignerPlanFromSelection(intent.signerSelection);
-	if (!plan.ok) return plan;
-	return {
-		ok: true,
-		value: registrationSignerBranchesFromPlan(plan.value)
-	};
-}
-function registrationSignerBranchesFromPlan(plan) {
-	return {
-		plan,
-		nearEd25519: findRegistrationSignerPlanNearEd25519Branch(plan),
-		evmFamilyEcdsa: findRegistrationSignerPlanEvmFamilyEcdsaBranch(plan)
-	};
-}
-function resolveRegistrationPreparedContextFromPlan(input) {
-	const branches = registrationSignerBranchesFromPlan(input.signerPlan);
-	const ecdsaChainTargets = branches.evmFamilyEcdsa ? normalizeThresholdEcdsaChainTargets(branches.evmFamilyEcdsa.chainTargets) : null;
-	if (branches.evmFamilyEcdsa && !ecdsaChainTargets) return {
-		ok: false,
-		code: "invalid_body",
-		message: "ECDSA registration contains an invalid chain target"
-	};
-	try {
-		return {
-			ok: true,
-			preparedContext: buildStoredWalletRegistrationPreparedContext({
-				signingRootId: input.signingRootId,
-				signingRootVersion: input.signingRootVersion,
-				runtimePolicyScope: input.runtimePolicyScope || null,
-				ecdsaChainTargets
-			}),
-			ecdsaChainTargets
-		};
-	} catch (error) {
-		return {
-			ok: false,
-			code: "invalid_body",
-			message: errorMessage(error) || "registration prepared context is invalid"
-		};
-	}
-}
 function registrationPreparedContextRuntimePolicyScope(preparedContext) {
 	return preparedContext.runtimePolicy.kind === "runtime_policy_scope" ? preparedContext.runtimePolicy.scope : void 0;
 }
@@ -659,9 +587,6 @@ function registrationTenantRootIdentity(preparedContext) {
 	});
 	return identity.ok ? identity.value : null;
 }
-function registrationPreparedContextEcdsaChainTargets(preparedContext) {
-	return preparedContext.ecdsa.kind === "evm_family_ecdsa_requested" ? preparedContext.ecdsa.chainTargets : null;
-}
 /**
 * A verified authority must name the same wallet the intent does. A ceremony
 * still awaiting its proof has no authority to disagree with, so it matches
@@ -837,7 +762,6 @@ async function buildActivatedEcdsaFamilyBootstrap(input) {
 		publicIdentity,
 		clientShareRetryCounter: input.publicFacts.clientShareRetryCounter,
 		relayerShareRetryCounter: identity.server_share_retry_counter,
-		publicTranscriptDigest32B64u: input.publicFacts.proofTranscriptDigestB64u,
 		keyHandle,
 		signingRootId: prepare.signingRootId,
 		signingRootVersion: prepare.signingRootVersion,
@@ -948,6 +872,7 @@ async function recordRegistrationPromiseTiming(args) {
 }
 var CloudflareD1WalletRegistrationService = class {
 	constructor(input) {
+		this.registrationAuthority = input.registrationAuthority;
 		this.authorizationService = input.authorizationService;
 		this.authorizationTenantId = input.authorizationTenantId;
 		this.createSponsoredNamedNearAccount = input.createSponsoredNamedNearAccount;
@@ -1078,38 +1003,43 @@ var CloudflareD1WalletRegistrationService = class {
 	async resolveEcdsaMaterialActivation(input) {
 		try {
 			const walletId = walletIdFromString(input.walletId);
-			const store = this.getWalletStore();
-			const signer = await store.getEcdsaSignerByMaterialActivation({
+			const canonical = await this.getWalletStore().readEcdsaSignerMaterialSnapshot({
+				source: input.source,
 				walletId,
 				materialActivation: input.materialActivation
 			});
-			if (signer) return {
-				ok: true,
-				materialActivation: signer.walletKey.publicCapability.material_activation,
-				keyHandle: signer.walletKey.keyHandle,
-				relayerKeyId: signer.walletKey.relayerKeyId,
-				participantIds: signer.walletKey.participantIds,
-				runtimePolicyScope: signer.runtimePolicyScope,
-				routerAbEcdsaDerivationNormalSigning: buildPostRegistrationEcdsaNormalSigningState({
-					walletKey: signer.walletKey,
-					publicCapability: signer.walletKey.publicCapability
-				})
-			};
+			if (canonical) {
+				const { signer, readSnapshot } = canonical;
+				return {
+					readSnapshot,
+					ok: true,
+					materialActivation: signer.walletKey.publicCapability.material_activation,
+					keyHandle: signer.walletKey.keyHandle,
+					relayerKeyId: signer.walletKey.relayerKeyId,
+					participantIds: signer.walletKey.participantIds,
+					runtimePolicyScope: signer.runtimePolicyScope,
+					routerAbEcdsaDerivationNormalSigning: buildPostRegistrationEcdsaNormalSigningState({
+						walletKey: signer.walletKey,
+						publicCapability: signer.walletKey.publicCapability
+					})
+				};
+			}
 			const linkedDeviceReader = this.getLinkedDeviceEd25519AuthorityReader();
-			const custodyChain = linkedDeviceReader ? await linkedDeviceReader.readInstalledEcdsaAuthorityChainByMaterialActivationV1({
+			const custodySnapshot = linkedDeviceReader ? await linkedDeviceReader.readInstalledEcdsaCustodySnapshotV1({
+				source: input.source,
 				walletId,
 				materialActivation: routerAbMpcMaterialActivationRefFromWire(input.materialActivation)
-			}) : [];
-			const projection = custodyChain[0];
-			if (!projection) return {
+			}) : null;
+			const projection = custodySnapshot?.chain[0];
+			if (!custodySnapshot || !projection) return {
 				ok: false,
 				code: "not_found",
 				message: "ECDSA material activation is not active for this wallet"
 			};
-			const walletSigners = await store.listEcdsaSignersForWallet({ walletId });
+			const { chain, signers } = custodySnapshot;
 			let matchingSourceSigners = [];
-			for (const custodySource of custodyChain) {
-				matchingSourceSigners = walletSigners.filter(linkedEcdsaProjectionMatchesSigner.bind(null, custodySource));
+			for (const custodySource of chain) {
+				matchingSourceSigners = signers.filter(linkedEcdsaProjectionMatchesSigner.bind(null, custodySource));
 				if (matchingSourceSigners.length > 0) break;
 			}
 			const canonicalSigner = matchingSourceSigners[0];
@@ -1125,6 +1055,7 @@ var CloudflareD1WalletRegistrationService = class {
 			};
 			return {
 				ok: true,
+				readSnapshot: custodySnapshot.readSnapshot,
 				materialActivation: routerAbMpcMaterialActivationRefToWire(projection.materialActivation),
 				keyHandle: canonicalSigner.walletKey.keyHandle,
 				relayerKeyId: canonicalSigner.walletKey.relayerKeyId,
@@ -1174,7 +1105,11 @@ var CloudflareD1WalletRegistrationService = class {
 		}
 	}
 	async resolveActiveEcdsaTenantRoot(input) {
-		const activeMaterial = await this.resolveEcdsaMaterialActivation(input);
+		const activeMaterial = await this.resolveEcdsaMaterialActivation({
+			walletId: input.walletId,
+			materialActivation: input.materialActivation,
+			source: { kind: "database" }
+		});
 		if (!activeMaterial.ok) return activeMaterial;
 		const identity = resolveTenantRootIdentityV1({
 			kind: "ecdsa_b5_active_material",
@@ -1654,148 +1589,12 @@ var CloudflareD1WalletRegistrationService = class {
 			};
 		}
 	}
-	/**
-	* `/wallets/register/setup` — grant, intent, and start in one request, with
-	* one D1 write.
-	*
-	* Setup runs before the client's WebAuthn create, because it issues the
-	* challenge that create signs. So the ECDSA prepare and the Ed25519
-	* admission — the two Router calls that dominated the measured cold path —
-	* overlap the authenticator prompt instead of being serialized after it.
-	* They are started before either is awaited: they share no state and neither
-	* can invalidate the other.
-	*/
 	async setupWalletRegistration(input) {
-		const timing = createD1RegistrationRouteTimingRecorder("wallets_register_setup");
-		const total = startD1RegistrationRouteTiming("registerSetupTotalMs");
-		try {
-			const normalized = normalizeWalletRegistrationSetupRequest(input.request);
-			if (!normalized.ok) return walletRegistrationSetupError(normalized.code, normalized.message);
-			const wallet = resolveWalletRegistrationSetupWalletId({
-				wallet: input.request?.wallet,
-				parseProvided: parseWalletIdForIntent,
-				createServerAllocated: createD1ServerAllocatedWalletId
-			});
-			if (!wallet.ok) return walletRegistrationSetupError(wallet.code, wallet.message);
-			const runtimePolicyScope = input.runtimePolicyScope || inferRuntimePolicyScopeFromSigningRoot({
-				orgId: input.orgId,
-				signingRootId: input.signingRootId,
-				signingRootVersion: input.signingRootVersion
-			});
-			const signingRootId = normalizeOptionalTrimmedString(input.signingRootId) || (runtimePolicyScope ? deriveSigningRootId(runtimePolicyScope) : "");
-			const signingRootVersion = normalizeOptionalTrimmedString(input.signingRootVersion) || runtimePolicyScope?.signingRootVersion || "default";
-			if (!signingRootId) return walletRegistrationSetupError("invalid_body", "registration requires a signing root");
-			const registrationOperation = allocateWalletRegistrationOperationPrepared();
-			const intent = buildRegistrationIntent({
-				walletId: wallet.walletId,
-				authMethod: normalized.authMethod,
-				signerSelection: normalized.signerSelection,
-				foundingWalletAuthMethodId: registrationOperation.walletAuthMethodId,
-				...runtimePolicyScope ? { runtimePolicyScope } : {}
-			});
-			const digestB64u = await walletRegistrationSetupIntentDigest(intent);
-			const branches = registrationIntentSignerBranches(intent);
-			if (!branches.ok) return walletRegistrationSetupError(branches.code, branches.message);
-			const ecdsaBranch = branches.value.evmFamilyEcdsa;
-			const nearEd25519Branch = branches.value.nearEd25519;
-			if (!ecdsaBranch && !nearEd25519Branch) return walletRegistrationSetupError("invalid_body", "registration signer branch is required");
-			const preparedContext = resolveRegistrationPreparedContextFromPlan({
-				signerPlan: branches.value.plan,
-				runtimePolicyScope,
-				signingRootId,
-				signingRootVersion
-			});
-			if (!preparedContext.ok) return walletRegistrationSetupError(preparedContext.code, preparedContext.message);
-			if (ecdsaBranch && !runtimePolicyScope) return walletRegistrationSetupError("invalid_body", "ECDSA registration requires an exact runtime policy scope");
-			const chainTargets = ecdsaBranch ? registrationPreparedContextEcdsaChainTargets(preparedContext.preparedContext) : null;
-			if (ecdsaBranch && !chainTargets) return walletRegistrationSetupError("invalid_body", "ECDSA chain targets are required");
-			const expiresAtMs = walletRegistrationSetupExpiresAtMs(Date.now());
-			const { registrationCeremonyId, registrationPreparationId } = walletRegistrationSetupIds();
-			const ecdsaPrepared = ecdsaBranch && chainTargets && runtimePolicyScope ? await buildD1EvmFamilyEcdsaRegistrationPrepare({
-				registrationPurpose: "wallet_registration",
-				registrationCeremonyId,
-				registrationPreparationId: registrationPreparationIdFromString(registrationPreparationId),
-				walletId: wallet.walletId,
-				signingRootId,
-				signingRootVersion,
-				chainTargets,
-				participantIds: [...ecdsaBranch.participantIds],
-				strictRegistration: this.ecdsaStrictRegistration,
-				runtimePolicyScope
-			}) : null;
-			if (ecdsaPrepared && !ecdsaPrepared.ok) return walletRegistrationSetupError(ecdsaPrepared.code, ecdsaPrepared.message);
-			const storedBranches = [];
-			if (ecdsaPrepared?.ok && ecdsaBranch) storedBranches.push(buildStoredWalletRegistrationEvmFamilyEcdsaPreparedBranch({
-				branchKey: ecdsaBranch.branchKey,
-				ecdsa: {
-					kind: ecdsaPrepared.ecdsa.kind,
-					chainTargets: ecdsaPrepared.ecdsa.chainTargets,
-					prepare: ecdsaPrepared.ecdsa.prepare,
-					strictRegistration: ecdsaPrepared.ecdsa.strictRegistration,
-					strictRegistrationBindingJson: routerAbEcdsaStrictRegistrationFactsBindingJson(ecdsaPrepared.ecdsa.strictRegistration)
-				}
-			}));
-			const ceremony = {
-				registrationCeremonyId,
-				foundingWalletAuthorityId: registrationOperation.walletAuthorityId,
-				foundingDeviceId: registrationOperation.deviceId,
-				foundingWalletAuthMethodId: registrationOperation.walletAuthMethodId,
-				intent,
-				digestB64u,
-				signerPlan: branches.value.plan,
-				preparedContext: preparedContext.preparedContext,
-				orgId: normalizeOptionalTrimmedString(input.orgId) || "",
-				signingRootId,
-				signingRootVersion,
-				...input.expectedOrigin ? { expectedOrigin: input.expectedOrigin } : {},
-				expiresAtMs,
-				authorityState: {
-					kind: "awaiting_proof",
-					authMethod: normalized.authMethod
-				},
-				signerState: {
-					kind: "signer_set_registration",
-					branches: storedBranches
-				}
-			};
-			const ceremonyWriteTiming = startD1RegistrationRouteTiming("registrationCeremonyInsertMs");
-			try {
-				await this.getRegistrationCeremonyIntentStore().putCeremony(ceremony);
-			} finally {
-				finishD1RegistrationRouteTiming(timing, ceremonyWriteTiming);
-			}
-			const { signedSetup } = await buildWalletRegistrationSetupSignature({
-				signer: input.signer,
-				ceremony,
-				expectedOrigin: input.expectedOrigin
-			});
-			finishD1RegistrationRouteTiming(timing, total);
-			const success = {
-				ok: true,
-				registrationCeremonyId,
-				walletId: String(wallet.walletId),
-				walletAuthMethodId: registrationOperation.walletAuthMethodId,
-				registrationIntentDigestB64u: digestB64u,
-				intent,
-				signedSetup
-			};
-			if (!ecdsaPrepared?.ok || !ecdsaBranch) return {
-				...success,
-				kind: "near_ed25519"
-			};
-			return {
-				...success,
-				kind: nearEd25519Branch ? "near_ed25519_and_evm_family_ecdsa" : "evm_family_ecdsa",
-				ecdsa: {
-					kind: ecdsaPrepared.ecdsa.kind,
-					chainTargets: ecdsaPrepared.ecdsa.chainTargets,
-					prepare: ecdsaPrepared.ecdsa.prepare,
-					strictRegistration: ecdsaPrepared.ecdsa.strictRegistration
-				}
-			};
-		} catch (error) {
-			return walletRegistrationSetupError("internal", errorMessage(error) || "Failed to set up wallet registration");
-		}
+		return executeD1WalletRegistrationSetup(input, {
+			reservation: this.registrationAuthority,
+			store: this.getRegistrationCeremonyIntentStore(),
+			ecdsaStrictRegistration: this.ecdsaStrictRegistration
+		});
 	}
 	async authorizeWalletRegistrationNearAdmission(input) {
 		try {
@@ -1837,6 +1636,11 @@ var CloudflareD1WalletRegistrationService = class {
 				code: verifiedSetup.code,
 				message: verifiedSetup.message
 			};
+			const homeAdmission = await admitRegistrationReservationHome(this.registrationAuthority, {
+				ceremonyId: ceremony.registrationCeremonyId,
+				walletId: ceremony.intent.walletId
+			});
+			if (!homeAdmission.ok) return homeAdmission;
 			const registrationBearerToken = normalizeOptionalTrimmedString(input.signedSetup);
 			if (!registrationBearerToken) return {
 				ok: false,
@@ -1930,6 +1734,11 @@ var CloudflareD1WalletRegistrationService = class {
 				code: verifiedSetup.code,
 				message: verifiedSetup.message
 			};
+			const homeAdmission = await admitRegistrationReservationHome(this.registrationAuthority, {
+				ceremonyId: ceremony.registrationCeremonyId,
+				walletId: ceremony.intent.walletId
+			});
+			if (!homeAdmission.ok) return homeAdmission;
 			const registrationBearerToken = normalizeOptionalTrimmedString(input.signedSetup);
 			if (!registrationBearerToken) return {
 				ok: false,
@@ -2093,10 +1902,18 @@ var CloudflareD1WalletRegistrationService = class {
 			})]);
 			mark("ecdsa_respond_router", routerStartedAtMs);
 			if (!strictResult.ok) {
-				if (!strictResult.retryable) await store.cancelTerminalCeremony({
-					registrationCeremonyId: ceremony.registrationCeremonyId,
-					walletId: ceremony.intent.walletId
-				});
+				if (!strictResult.retryable) {
+					const completedHome = await completeRegistrationReservation(this.registrationAuthority, {
+						ceremonyId: ceremony.registrationCeremonyId,
+						walletId: ceremony.intent.walletId,
+						outcome: "cancelled"
+					});
+					if (!completedHome.ok) return completedHome;
+					await store.cancelTerminalCeremony({
+						registrationCeremonyId: ceremony.registrationCeremonyId,
+						walletId: ceremony.intent.walletId
+					});
+				}
 				return {
 					ok: false,
 					code: strictResult.code,
@@ -2555,6 +2372,11 @@ var CloudflareD1WalletRegistrationService = class {
 				code: verified.code,
 				message: verified.message
 			};
+			const homeAdmission = await admitRegistrationReservationHome(this.registrationAuthority, {
+				ceremonyId: verified.claims.registrationCeremonyId,
+				walletId: walletIdFromString(verified.claims.walletId)
+			});
+			if (!homeAdmission.ok) return homeAdmission;
 			const fingerprintStartedAtMs = Date.now();
 			const requestFingerprint = base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
 				version: "wallet_registration_near_provisioning_digest_v1",
@@ -2632,6 +2454,12 @@ var CloudflareD1WalletRegistrationService = class {
 				message: "NEAR provisioning did not establish a Wallet Session",
 				nearProvisioning: { status: "near_failed_retryable" }
 			};
+			const completedHome = await completeRegistrationReservation(this.registrationAuthority, {
+				ceremonyId: input.registrationCeremonyId,
+				walletId: walletIdFromString(committed.walletId),
+				outcome: "established"
+			});
+			if (!completedHome.ok) return completedHome;
 			const cleanup = recordRegistrationPromiseTiming({
 				sink: serverTiming,
 				name: "near_finalize_cleanup",
@@ -2980,6 +2808,11 @@ var CloudflareD1WalletRegistrationService = class {
 				code: verifiedSetup.code,
 				message: verifiedSetup.message
 			};
+			const homeAdmission = await admitRegistrationReservationHome(this.registrationAuthority, {
+				ceremonyId: verifiedSetup.claims.registrationCeremonyId,
+				walletId: walletIdFromString(verifiedSetup.claims.walletId)
+			});
+			if (!homeAdmission.ok) return homeAdmission;
 			const claims = verifiedSetup.claims;
 			const idempotencyKey = normalizeOptionalTrimmedString(input.idempotencyKey);
 			if (!idempotencyKey) return {
@@ -3022,6 +2855,14 @@ var CloudflareD1WalletRegistrationService = class {
 			switch (run.kind) {
 				case "executed":
 				case "exact_replay":
+					if (run.value.response.ok && run.value.response.kind !== "near_ed25519") {
+						const completedHome = await completeRegistrationReservation(this.registrationAuthority, {
+							ceremonyId: claims.registrationCeremonyId,
+							walletId: walletIdFromString(run.value.response.walletId),
+							outcome: "established"
+						});
+						if (!completedHome.ok) return completedHome;
+					}
 					if (run.value.response.ok && run.value.response.kind === "evm_family_ecdsa") await cleanupFinalizedRegistrationCeremony({
 						store: this.getRegistrationCeremonyIntentStore(),
 						registrationCeremonyId: claims.registrationCeremonyId
@@ -3379,7 +3220,6 @@ var CloudflareD1WalletRegistrationService = class {
 						publicIdentity: bootstrap.publicIdentity,
 						clientShareRetryCounter: bootstrap.clientShareRetryCounter,
 						relayerShareRetryCounter: bootstrap.relayerShareRetryCounter,
-						publicTranscriptDigest32B64u: bootstrap.publicTranscriptDigest32B64u,
 						keyHandle: bootstrap.keyHandle,
 						signingRootId: bootstrap.signingRootId,
 						signingRootVersion: bootstrap.signingRootVersion,
@@ -3703,6 +3543,7 @@ var CloudflareD1WalletRegistrationService = class {
 				const sponsoredAccountId = sponsoredNamedRegistrationAccountId(finalizeNearEd25519.accountProvisioning);
 				if (sponsoredAccountId) {
 					const created = await this.createSponsoredNamedNearAccount({
+						walletId: ceremony.intent.walletId,
 						accountId: sponsoredAccountId,
 						publicKey,
 						idempotencyKey: bytesToUnprefixedHex(Uint8Array.from(consumed.activation.result.binding.session_id))

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationSetup.js

@@ -1,7 +1,5 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { normalizeRegistrationAuthMethodInput } from "../../../../shared-ts/src/utils/registrationAuthMethodInput.js";
-import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { thresholdEcdsaChainTargetFromValue } from "../../../../core/thresholdEcdsaChainTarget.js";
 import { computeWalletRegistrationSetupDigestB64u, mintSignedWalletRegistrationSetup } from "../../../domains/walletRegistration/walletRegistrationSetupPayload.js";
 import { normalizeRegistrationSignerPlan, registrationSignerSetSelectionFromPlan } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
@@ -42,45 +40,6 @@ import { computeRegistrationIntentDigestB64u } from "../../../../shared-ts/src/u
 */
 /** Setup's ceremony lives only as long as an authenticator prompt plausibly takes. */
 const WALLET_REGISTRATION_SETUP_TTL_MS = 10 * 6e4;
-function walletRegistrationSetupIds() {
-	return {
-		registrationCeremonyId: `wrc_${secureRandomBase64Url(32)}`,
-		registrationPreparationId: `regprep_${secureRandomBase64Url(32)}`
-	};
-}
-/**
-* Resolves the wallet id without reserving it.
-*
-* A provided id is taken as given; an absent or server-allocated one is
-* generated. There is no existence pre-check: it cost a serialized read on
-* every registration to catch a collision that the commit-time uniqueness
-* constraint catches anyway, and for a freshly generated random id it could
-* essentially never fire.
-*/
-function resolveWalletRegistrationSetupWalletId(input) {
-	const wallet = input.wallet;
-	if (!wallet || wallet.kind === "server_allocated") return {
-		ok: true,
-		walletId: input.createServerAllocated()
-	};
-	if (wallet.kind === "provided") {
-		const walletId = input.parseProvided(wallet.walletId);
-		if (!walletId) return {
-			ok: false,
-			code: "invalid_body",
-			message: "walletId is required"
-		};
-		return {
-			ok: true,
-			walletId
-		};
-	}
-	return {
-		ok: false,
-		code: "invalid_body",
-		message: "wallet.kind is unsupported"
-	};
-}
 function normalizeWalletRegistrationSetupRequest(request) {
 	const signerPlan = normalizeRegistrationSignerPlan(request?.signerSelection);
 	if (!signerPlan.ok) return signerPlan;
@@ -116,20 +75,17 @@ async function buildWalletRegistrationSetupSignature(input) {
 		signingRootVersion,
 		expectedOrigin: input.expectedOrigin
 	});
-	return {
-		signedSetup: await mintSignedWalletRegistrationSetup(input.signer, {
-			kind: "wallet_registration_setup_v1",
-			registrationCeremonyId: input.ceremony.registrationCeremonyId,
-			walletId: String(input.ceremony.intent.walletId),
-			orgId: input.ceremony.orgId,
-			signingRootId,
-			signingRootVersion,
-			policy: input.ceremony.preparedContext.runtimePolicy,
-			setupDigestB64u,
-			expiresAtMs: input.ceremony.expiresAtMs
-		}),
-		setupDigestB64u
-	};
+	return { signedSetup: await mintSignedWalletRegistrationSetup(input.signer, {
+		kind: "wallet_registration_setup_v1",
+		registrationCeremonyId: input.ceremony.registrationCeremonyId,
+		walletId: String(input.ceremony.intent.walletId),
+		orgId: input.ceremony.orgId,
+		signingRootId,
+		signingRootVersion,
+		policy: input.ceremony.preparedContext.runtimePolicy,
+		setupDigestB64u,
+		expiresAtMs: input.ceremony.expiresAtMs
+	}) };
 }
 async function walletRegistrationSetupIntentDigest(intent) {
 	return await computeRegistrationIntentDigestB64u(intent);
@@ -178,6 +134,6 @@ function walletRegistrationSetupError(code, message) {
 	};
 }
 //#endregion
-export { buildWalletRegistrationSetupSignature, normalizeWalletRegistrationSetupRequest, resolveWalletRegistrationSetupWalletId, storedRespondEd25519DeferredWork, walletRegistrationRespondResult, walletRegistrationSetupError, walletRegistrationSetupExpiresAtMs, walletRegistrationSetupIds, walletRegistrationSetupIntentDigest };
+export { buildWalletRegistrationSetupSignature, normalizeWalletRegistrationSetupRequest, storedRespondEd25519DeferredWork, walletRegistrationRespondResult, walletRegistrationSetupError, walletRegistrationSetupExpiresAtMs, walletRegistrationSetupIntentDigest };
 
 //# sourceMappingURL=d1WalletRegistrationSetup.js.map