@seams/wallet-server 0.7.1 → 0.8.0

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationRecords.d.ts

@@ -1,5 +1,5 @@
 import type { RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
-import type { GoogleEmailOtpRegistrationAttemptRecord, GoogleEmailOtpRegistrationOfferCandidateRecord, PendingGoogleEmailOtpRegistrationAttemptRecord } from '../../../../core/EmailOtpStores';
+import type { GoogleEmailOtpRegistrationAttemptRecord, NonEmptyGoogleEmailOtpRegistrationOfferCandidates, PendingGoogleEmailOtpRegistrationAttemptRecord } from '../../../../core/EmailOtpStores';
 export type D1EmailOtpRegistrationAttemptRow = {
     readonly attempt_id?: unknown;
     readonly record_json?: unknown;
@@ -21,31 +21,18 @@ type GoogleEmailOtpRegistrationOfferForResponse = {
     ];
 };
 export declare function requireRuntimePolicyScope(input: unknown): RuntimePolicyScope;
-export declare function activeGoogleEmailOtpRegistrationAttemptRecord(input: {
-    readonly record: PendingGoogleEmailOtpRegistrationAttemptRecord;
-    readonly updatedAtMs: number;
-}): GoogleEmailOtpRegistrationAttemptRecord;
 export declare function expiredGoogleEmailOtpRegistrationAttemptRecord(input: {
     readonly record: GoogleEmailOtpRegistrationAttemptRecord;
     readonly updatedAtMs: number;
 }): GoogleEmailOtpRegistrationAttemptRecord;
-export declare function failedGoogleEmailOtpRegistrationAttemptWithCode(input: {
-    readonly record: PendingGoogleEmailOtpRegistrationAttemptRecord;
-    readonly failureCode: string;
-    readonly updatedAtMs: number;
-}): GoogleEmailOtpRegistrationAttemptRecord;
+export declare function parseGoogleEmailOtpRegistrationAttemptRecord(input: unknown): GoogleEmailOtpRegistrationAttemptRecord | null;
 export declare function parseGoogleEmailOtpRegistrationAttemptRow(row: D1EmailOtpRegistrationAttemptRow | null): GoogleEmailOtpRegistrationAttemptRecord | null;
 export declare function googleEmailOtpRegistrationOfferForResponse(input: Pick<PendingGoogleEmailOtpRegistrationAttemptRecord, 'offerId' | 'offerCandidates' | 'selectedCandidateId'>): GoogleEmailOtpRegistrationOfferForResponse;
-export declare function pendingGoogleEmailOtpRegistrationAttemptWithUpdatedAt(record: PendingGoogleEmailOtpRegistrationAttemptRecord, updatedAtMs: number): PendingGoogleEmailOtpRegistrationAttemptRecord;
-export declare function pendingGoogleEmailOtpRegistrationAttemptWithSelectedCandidate(input: {
-    readonly record: PendingGoogleEmailOtpRegistrationAttemptRecord;
-    readonly candidate: GoogleEmailOtpRegistrationOfferCandidateRecord;
-    readonly updatedAtMs: number;
-}): PendingGoogleEmailOtpRegistrationAttemptRecord;
 export declare function abandonedGoogleEmailOtpRegistrationAttemptRecord(input: {
     readonly record: PendingGoogleEmailOtpRegistrationAttemptRecord;
     readonly failureCode: 'owner_proof_binding_replaced' | 'offer_restarted_by_user';
     readonly updatedAtMs: number;
 }): GoogleEmailOtpRegistrationAttemptRecord;
+export declare function parseGoogleEmailOtpRegistrationOfferCandidates(input: unknown): NonEmptyGoogleEmailOtpRegistrationOfferCandidates | null;
 export {};
 //# sourceMappingURL=d1GoogleEmailOtpRegistrationRecords.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpSessionResolver.d.ts

@@ -2,7 +2,7 @@ import type { IdentityStore, LinkIdentityResult } from '../../../../core/Identit
 import type { RouterApiEmailOtpRouteService, RouterApiIdentityService } from '../../../framework/authServicePort';
 import type { CloudflareD1EmailOtpEnrollmentStore } from './d1EmailOtpEnrollmentStore';
 import type { CloudflareD1EmailOtpRateLimitStore } from './d1EmailOtpRateLimitStore';
-import type { CloudflareD1GoogleEmailOtpRegistrationAttemptStore } from './d1GoogleEmailOtpRegistrationAttemptStore';
+import type { GoogleEmailOtpRegistrationAttemptStore } from './d1GoogleEmailOtpRegistrationAttemptStore';
 type ResolveGoogleEmailOtpSessionInput = Parameters<RouterApiIdentityService['resolveGoogleEmailOtpSession']>[0];
 type ResolveGoogleEmailOtpSessionResult = Awaited<ReturnType<RouterApiIdentityService['resolveGoogleEmailOtpSession']>>;
 type CleanupGoogleEmailOtpDevRegistrationStateInput = Parameters<RouterApiEmailOtpRouteService['cleanupGoogleEmailOtpDevRegistrationState']>[0];
@@ -36,11 +36,16 @@ export declare class CloudflareD1GoogleEmailOtpSessionResolver {
         readonly identityStore: IdentityStore;
         readonly linkIdentity: GoogleEmailOtpIdentityLinker;
         readonly production: boolean;
-        readonly registrationAttempts: CloudflareD1GoogleEmailOtpRegistrationAttemptStore;
+        readonly registrationAttempts: GoogleEmailOtpRegistrationAttemptStore;
     });
     resolve(input: ResolveGoogleEmailOtpSessionInput): Promise<ResolveGoogleEmailOtpSessionResult>;
     cleanupDevRegistrationState(input: CleanupGoogleEmailOtpDevRegistrationStateInput): Promise<CleanupGoogleEmailOtpDevRegistrationStateResult>;
     consumeRegistrationAttemptRateLimit(input: ConsumeGoogleEmailOtpRegistrationAttemptRateLimitInput): Promise<ConsumeGoogleEmailOtpRegistrationAttemptRateLimitResult>;
+    completeCommittedRegistrationAttempt(input: {
+        readonly registrationAttemptId: string;
+        readonly walletId: string;
+        readonly intentDigest: string;
+    }): Promise<import("./d1GoogleRegistrationCompletion").GoogleRegistrationCompletionResult>;
     completeRegistrationAttempt(input: {
         readonly registrationAttemptId?: unknown;
         readonly walletId?: unknown;

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1GoogleRegistrationCompletion.d.ts

@@ -0,0 +1,23 @@
+import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
+import type { ScopedD1Prepare } from '../../../../core/emailOtpD1Statements';
+export type GoogleRegistrationCompletionResult = {
+    readonly ok: true;
+    readonly code?: never;
+    readonly message?: never;
+} | {
+    readonly ok: false;
+    readonly code: 'registration_incomplete';
+    readonly message: string;
+};
+export declare function completeGoogleRegistration(prepare: ScopedD1Prepare, batch: D1DatabaseLike['batch'], input: {
+    readonly kind: 'live_offer';
+    readonly attemptId: string;
+    readonly walletId: string;
+    readonly intentDigest?: never;
+} | {
+    readonly kind: 'committed_wallet';
+    readonly attemptId: string;
+    readonly walletId: string;
+    readonly intentDigest: string;
+}): Promise<GoogleRegistrationCompletionResult>;
+//# sourceMappingURL=d1GoogleRegistrationCompletion.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/identity/d1IdentityService.d.ts

@@ -6,26 +6,14 @@ type LinkIdentityInput = Parameters<RouterApiIdentityService['linkIdentity']>[0]
 type LinkIdentityResult = Awaited<ReturnType<RouterApiIdentityService['linkIdentity']>>;
 type UnlinkIdentityInput = Parameters<RouterApiIdentityService['unlinkIdentity']>[0];
 type UnlinkIdentityResult = Awaited<ReturnType<RouterApiIdentityService['unlinkIdentity']>>;
-type ResolveOidcWalletIdInput = Parameters<RouterApiIdentityService['resolveOidcWalletId']>[0];
-type ResolveOidcWalletIdResult = Awaited<ReturnType<RouterApiIdentityService['resolveOidcWalletId']>>;
-type ResolveGoogleEmailOtpSessionInput = Parameters<RouterApiIdentityService['resolveGoogleEmailOtpSession']>[0];
-type ResolveGoogleEmailOtpSessionResult = Awaited<ReturnType<RouterApiIdentityService['resolveGoogleEmailOtpSession']>>;
-type ResolveGoogleEmailOtpSession = (input: ResolveGoogleEmailOtpSessionInput) => Promise<ResolveGoogleEmailOtpSessionResult>;
 export declare class CloudflareD1IdentityService {
-    private readonly accountIdDerivationSecret;
     private readonly identityStore;
-    private readonly relayerAccount;
-    private readonly resolveGoogleEmailOtpSession;
     constructor(input: {
-        readonly accountIdDerivationSecret: unknown;
         readonly identityStore: IdentityStore;
-        readonly relayerAccount: unknown;
-        readonly resolveGoogleEmailOtpSession: ResolveGoogleEmailOtpSession;
     });
     listIdentities(input: ListIdentitiesInput): Promise<ListIdentitiesResult>;
     linkIdentity(input: LinkIdentityInput): Promise<LinkIdentityResult>;
     unlinkIdentity(input: UnlinkIdentityInput): Promise<UnlinkIdentityResult>;
-    resolveOidcWalletId(input: ResolveOidcWalletIdInput): Promise<ResolveOidcWalletIdResult>;
 }
 export {};
 //# sourceMappingURL=d1IdentityService.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/near/d1SponsoredNearAccount.d.ts

@@ -0,0 +1,24 @@
+import { type WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
+import type { SponsoredNamedNearAccountCreationResult } from '../registration/d1WalletRegistrationService';
+import type { NormalizedCloudflareD1RouterApiAuthServiceOptions } from '../auth/d1RouterApiAuthConfig';
+type SponsoredAccountOptions = Pick<NormalizedCloudflareD1RouterApiAuthServiceOptions, 'database' | 'namespace' | 'orgId' | 'projectId' | 'envId' | 'relayerAccount' | 'relayerPrivateKey' | 'relayerPublicKey' | 'nearRpcUrl' | 'accountInitialBalance'>;
+export type SponsoredNamedNearAccountInput = {
+    readonly walletId: WalletId;
+    readonly accountId: string;
+    readonly publicKey: string;
+    /**
+     * Registration-scoped key for the durable claim. Two attempts at the same
+     * registration share a key so the second replays the first's transaction.
+     */
+    readonly idempotencyKey: string;
+};
+/**
+ * Creates the sponsored account through a durable claim. The signed transaction
+ * and its hash are persisted before the broadcast, so a lost response replays
+ * those exact bytes instead of building a second transaction under a fresh
+ * nonce. Rebroadcasting an identical signed transaction reuses its hash, so the
+ * network treats the retry as the same transaction.
+ */
+export declare function createSponsoredNamedNearAccountForOptions(options: SponsoredAccountOptions, input: SponsoredNamedNearAccountInput): Promise<SponsoredNamedNearAccountCreationResult>;
+export {};
+//# sourceMappingURL=d1SponsoredNearAccount.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/near/d1SponsoredNearAccount.typecheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=d1SponsoredNearAccount.typecheck.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/oidc/d1OidcVerificationService.d.ts

@@ -15,7 +15,6 @@ export declare class CloudflareD1OidcVerificationService {
     private readonly githubOAuth;
     private readonly identityStore;
     private readonly linkIdentity;
-    private readonly oidcJwksCache;
     constructor(input: {
         readonly googleOidcClientId: string | undefined;
         readonly githubOAuth: GithubOAuthConfig | undefined;

package/dist/types/wallet-server/src/router/cloudflare/d1/oidc/googleOidcToken.d.ts

@@ -0,0 +1,4 @@
+import { type GoogleIdTokenClaimValidationResult } from './d1OidcBoundary';
+/** Verifies provider proof without reading or mutating wallet identity state. */
+export declare function verifyGoogleOidcToken(configuredClientId: string | undefined, rawToken: unknown): Promise<GoogleIdTokenClaimValidationResult>;
+//# sourceMappingURL=googleOidcToken.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/passkeyCustody/d1PasskeyCustodyRouteService.d.ts

@@ -335,6 +335,11 @@ type WalletRecoveryRoutePreparationResult = (Extract<WalletRecoveryPreparationRe
 }) | Exclude<WalletRecoveryPreparationResult, {
     readonly kind: 'prepared';
 }> | {
+    readonly kind: 'routing_unavailable';
+    readonly walletId?: never;
+    readonly recoveryOperationId?: never;
+    readonly registration?: never;
+} | {
     readonly kind: 'manifest_unavailable';
     readonly reason: string;
 } | {

package/dist/types/wallet-server/src/router/cloudflare/d1/passkeyCustody/d1WalletCustodyCommitStore.d.ts

@@ -1,3 +1,6 @@
+import { type PasskeyCredentialClaims } from '../../../../core/passkeyCredentialClaims';
+import type { WalletRecoveryRoutingPublisher } from '../../../../authorization/recoveryRouting';
+import type { WalletRecoveryOperationId } from '../../../../../../shared-ts/src/utils/domainIds';
 import { type WalletRecoveryBackupAcknowledgementV1 } from '../../../../../../shared-ts/src/wallet-recovery/recoveryCodes';
 import { type WalletRecoveryEnvelopeSetRecord } from '../../../../../../shared-ts/src/wallet-recovery';
 import { type PasskeyCustodyEnvelopeRecord } from '../../../../../../shared-ts/src/passkey-custody';
@@ -16,6 +19,8 @@ import { D1WalletAuthorityStore } from '../wallet/d1WalletAuthorityStore';
 import type { EmailOtpWalletEnrollmentRecord } from '../../../../core/EmailOtpStores';
 import { type WalletRecoveryGoogleEmailOtpFinalizationInput } from './d1WalletRecoveryGoogleEmailOtpRecords';
 type CloudflareD1WalletCustodyCommitStoreOptions = {
+    readonly credentialClaims?: PasskeyCredentialClaims;
+    readonly recoveryRouting?: WalletRecoveryRoutingPublisher;
     readonly database: D1DatabaseLike;
     readonly scope: CloudflareD1VersionedJsonRecordScopeV1;
     readonly walletAuthMethodStore?: D1WalletAuthMethodStore;
@@ -104,12 +109,16 @@ export type WalletRecoveryAuthenticatorCommit = {
     readonly challengeDeleteStatement: D1PreparedStatementLike;
 };
 export declare class CloudflareD1WalletCustodyCommitStore {
+    private readonly recoveryRouting;
+    private readonly credentialClaims;
     private readonly database;
     private readonly scope;
     private readonly records;
     private readonly walletAuthMethodStore;
     private readonly walletAuthorityStore;
     constructor(options: CloudflareD1WalletCustodyCommitStoreOptions);
+    publishRecoveryOperation(walletId: WalletId, operationId: WalletRecoveryOperationId): Promise<void>;
+    private claimRecoveryCodeRoutes;
     readRecoveryCodeLocator(locatorB64u: RecoveryCodeLocatorV1): Promise<WalletRecoveryCodeLocatorRecord | null>;
     /** Reads locator metadata without ever materializing a recovery code. */
     readRecoveryCodeLocatorByRecoveryKey(input: {

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore.d.ts

@@ -1,10 +1,6 @@
 import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
-export type D1RegistrationCeremonyRecordScope = {
-    readonly namespace: string;
-    readonly orgId: string;
-    readonly projectId: string;
-    readonly envId: string;
-};
+import type { D1TenantScope } from '../../../../core/d1TenantStore';
+export type D1RegistrationCeremonyRecordScope = D1TenantScope;
 type D1RegistrationCeremonyRecordStoreOptions = {
     readonly database: D1DatabaseLike;
     readonly scope: D1RegistrationCeremonyRecordScope;
@@ -24,7 +20,6 @@ type D1RegistrationCeremonyRecordMutation = {
 type D1RegistrationCeremonyAtomicBranchClaim = {
     readonly value: Record<string, unknown>;
     readonly version: number;
-    readonly expiresAtMs: number;
 };
 export declare class D1RegistrationCeremonyRecordStore {
     private readonly database;
@@ -33,6 +28,7 @@ export declare class D1RegistrationCeremonyRecordStore {
     constructor(options: D1RegistrationCeremonyRecordStoreOptions);
     get(scope: string, id: string): Promise<D1RegistrationCeremonyStoredRecord | null>;
     putExact(mutation: D1RegistrationCeremonyRecordMutation): Promise<void>;
+    insertOrRead(mutation: D1RegistrationCeremonyRecordMutation): Promise<D1RegistrationCeremonyStoredRecord>;
     updateExpected(input: {
         readonly scope: string;
         readonly id: string;

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationCeremonyRecords.d.ts

@@ -1,27 +1,26 @@
-import type { WalletRegistrationFinalizeSuccess } from '../../../../core/registrationContracts';
+import { deriveEvmFamilySigningKeySlotId } from '../../../../../../shared-ts/src/signing-lanes';
 import { type EcdsaClientRootPublicKey33B64u } from '../../../../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap';
+import type { RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
+import { type WalletAuthMethodId } from '../../../../../../shared-ts/src/utils/domainIds';
+import { type AddAuthMethodInput, type RegistrationAuthMethodInput } from '../../../../../../shared-ts/src/utils/registrationAuthMethodInput';
 import { type AddAuthMethodIntentCallerV1, type AddAuthMethodIntentV1, type AddSignerIntentV1, type RegistrationIntentV1, type RuntimePolicyScopeLike, type WalletId } from '../../../../../../shared-ts/src/utils/registrationIntent';
-import { type ServerAllocatedWalletId } from '../../../../../../shared-ts/src/utils/registrationIds';
 import { type AddSignerSelection, type RegistrationSignerSetSelection } from '../../../../../../shared-ts/src/utils/registrationSignerPlan';
-import { type AddAuthMethodInput, type RegistrationAuthMethodInput } from '../../../../../../shared-ts/src/utils/registrationAuthMethodInput';
-import { type WalletAuthMethodId } from '../../../../../../shared-ts/src/utils/domainIds';
-import type { RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
-import { deriveEvmFamilySigningKeySlotId } from '../../../../../../shared-ts/src/signing-lanes';
+import type { WalletRegistrationFinalizeSuccess } from '../../../../core/registrationContracts';
 import { type RouterAbEcdsaDerivationPublicCapabilityV1, type RouterAbEcdsaRegistrationActivationReceiptV1 } from '../../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
-import type { EcdsaDerivationServerBootstrapResponse } from '../../../../core/types';
+import { type WalletEcdsaSignerRecord, type WalletRecord } from '../../../../core/d1WalletStore';
+import { StoredAddAuthMethodIntent, StoredAddSignerIntent, StoredWalletAddAuthMethodCeremony, StoredWalletAddAuthMethodFinalizeReplay, StoredWalletAddSignerCeremony, StoredWalletAddSignerFinalizeReplay, StoredWalletRegistrationCeremony } from '../../../../core/RegistrationCeremonyStore';
+import type { WalletAddSignerFinalizeResponse, WalletRegistrationEcdsaWalletKey } from '../../../../core/registrationContracts';
 import type { WalletRegistrationCommittedInstallationProjectionV1 } from '../../../../core/threeRouteRegistrationContracts';
-import type { WalletRegistrationEcdsaWalletKey, WalletAddSignerFinalizeResponse } from '../../../../core/registrationContracts';
-import { StoredAddAuthMethodIntent, StoredAddSignerIntent, StoredWalletAddAuthMethodCeremony, StoredWalletAddSignerCeremony, StoredWalletAddSignerFinalizeReplay, StoredWalletAddAuthMethodFinalizeReplay, StoredWalletRegistrationCeremony } from '../../../../core/RegistrationCeremonyStore';
 import { type ThresholdEcdsaChainTarget } from '../../../../core/thresholdEcdsaChainTarget';
-import { type WalletEcdsaSignerRecord, type WalletRecord } from '../../../../core/d1WalletStore';
+import type { EcdsaDerivationServerBootstrapResponse } from '../../../../core/types';
 type D1WalletRegistrationFinalizeReplaySuccess = WalletRegistrationFinalizeSuccess;
-export declare function createD1ServerAllocatedWalletId(): ServerAllocatedWalletId;
 export declare function inferRuntimePolicyScopeFromSigningRoot(input: {
     readonly orgId: string;
     readonly signingRootId?: string;
     readonly signingRootVersion?: string;
 }): RuntimePolicyScope | undefined;
 export declare function buildRegistrationIntent(input: {
+    readonly nonceB64u: string;
     readonly walletId: WalletId;
     readonly authMethod: RegistrationAuthMethodInput;
     readonly signerSelection: RegistrationSignerSetSelection;

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationCeremonyStore.d.ts

@@ -16,7 +16,9 @@ type D1WalletRegistrationEcdsaCeremonyClaimV1 = {
 export declare class CloudflareD1RegistrationCeremonyIntentStore {
     private readonly storage;
     constructor(input: RegistrationCeremonyIntentStoreConfig);
-    putCeremony(ceremony: StoredWalletRegistrationCeremony): Promise<void>;
+    getSetupCeremony(ceremonyId: string): Promise<StoredWalletRegistrationCeremony | null>;
+    reserveSetupCeremony(proposed: StoredWalletRegistrationCeremony): Promise<StoredWalletRegistrationCeremony>;
+    ensureSetupCeremony(setup: StoredWalletRegistrationCeremony): Promise<void>;
     getCeremony(registrationCeremonyId: string): Promise<StoredWalletRegistrationCeremony | null>;
     getCeremonySnapshot(registrationCeremonyId: string): Promise<D1WalletRegistrationEcdsaCeremonyClaimV1 | null>;
     updateCeremony(input: {
@@ -41,7 +43,6 @@ export declare class CloudflareD1RegistrationCeremonyIntentStore {
         readonly expected: D1WalletRegistrationEcdsaCeremonyClaimV1;
         readonly next: StoredWalletRegistrationCeremony;
     }): Promise<void>;
-    takeCeremony(registrationCeremonyId: string): Promise<StoredWalletRegistrationCeremony | null>;
     deleteCeremony(registrationCeremonyId: string): Promise<boolean>;
     cancelTerminalCeremony(input: {
         readonly registrationCeremonyId: string;

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationSetupSupport.d.ts

@@ -0,0 +1,51 @@
+import { type RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
+import { type RegistrationIntentV1 } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import { type RegistrationEvmFamilyEcdsaSignerPlan, type RegistrationNearEd25519SignerPlan, type RegistrationSignerPlan } from '../../../../../../shared-ts/src/utils/registrationSignerPlan';
+import { type StoredWalletRegistrationPreparedContext } from '../../../../core/RegistrationCeremonyStore';
+import { type WalletRegistrationRouteDiagnostics, type WalletRegistrationRouteTimingName } from '../../../../core/registrationContracts';
+import { type ThresholdEcdsaChainTarget } from '../../../../core/thresholdEcdsaChainTarget';
+export declare function errorMessage(error: unknown): string;
+export declare function startD1RegistrationRouteTiming(name: WalletRegistrationRouteTimingName): D1RegistrationRouteTimingMark;
+export declare function finishD1RegistrationRouteTiming(recorder: D1RegistrationRouteTimingRecorder, mark: D1RegistrationRouteTimingMark): void;
+export declare function createD1RegistrationRouteTimingRecorder(route: WalletRegistrationRouteDiagnostics['route']): D1RegistrationRouteTimingRecorder;
+export declare function registrationIntentSignerBranches(intent: RegistrationIntentV1): RegistrationIntentSignerBranchesResult;
+export declare function resolveRegistrationPreparedContextFromPlan(input: {
+    readonly signerPlan: RegistrationSignerPlan;
+    readonly runtimePolicyScope: RuntimePolicyScope | undefined;
+    readonly signingRootId: string;
+    readonly signingRootVersion: string;
+}): RegistrationPreparedContextResolution;
+export declare function registrationPreparedContextEcdsaChainTargets(preparedContext: StoredWalletRegistrationPreparedContext): readonly ThresholdEcdsaChainTarget[] | null;
+type D1RegistrationRouteTimingMark = {
+    readonly name: WalletRegistrationRouteTimingName;
+    readonly startedAtMs: number;
+};
+export type D1RegistrationRouteTimingRecorder = {
+    readonly route: WalletRegistrationRouteDiagnostics['route'];
+    readonly entries: WalletRegistrationRouteDiagnostics['entries'];
+};
+type RegistrationIntentSignerBranchesResult = {
+    ok: true;
+    value: RegistrationIntentSignerBranches;
+} | {
+    ok: false;
+    code: string;
+    message: string;
+};
+export declare function registrationSignerBranchesFromPlan(plan: RegistrationSignerPlan): RegistrationIntentSignerBranches;
+type RegistrationPreparedContextResolution = {
+    ok: true;
+    preparedContext: StoredWalletRegistrationPreparedContext;
+    ecdsaChainTargets: readonly ThresholdEcdsaChainTarget[] | null;
+} | {
+    ok: false;
+    code: 'invalid_body';
+    message: string;
+};
+type RegistrationIntentSignerBranches = {
+    readonly plan: RegistrationSignerPlan;
+    readonly nearEd25519: RegistrationNearEd25519SignerPlan | null;
+    readonly evmFamilyEcdsa: RegistrationEvmFamilyEcdsaSignerPlan | null;
+};
+export {};
+//# sourceMappingURL=d1RegistrationSetupSupport.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationCommitStore.d.ts

@@ -1,3 +1,4 @@
+import { type PasskeyCredentialClaims } from '../../../../core/passkeyCredentialClaims';
 import type { ActiveWalletAuthorityV1 } from '../../../../../../shared-ts/src/authorization/walletAuthority';
 import { type ActiveWalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
 import { type RegistrationAuthority } from '../../../../../../shared-ts/src/utils/registrationAuthMethodInput';
@@ -40,7 +41,9 @@ export interface D1WalletRegistrationCommitStore {
 export declare class CloudflareD1WalletRegistrationCommitStore implements D1WalletRegistrationCommitStore {
     private readonly database;
     private readonly scope;
+    private readonly credentialClaims;
     constructor(input: {
+        readonly credentialClaims?: PasskeyCredentialClaims;
         readonly database: D1DatabaseLike;
         readonly namespace: string;
         readonly orgId: string;

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationService.d.ts

@@ -1,36 +1,40 @@
-import type { VerifiedNearRegistrationContinuationV1 } from '../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationIntentAuthorization';
+import type { SponsoredNamedNearAccountInput } from '../near/d1SponsoredNearAccount';
 import { type DeviceId, type TenantId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
-import type { AuthorizationService } from '../../../../authorization/service';
-import { type WalletId } from '../../../../../../shared-ts/src/utils/registrationIntent';
-import type { RouterAbTraceContextV1 } from '../../../../../../shared-ts/src/utils/routerAbTraceContext';
-import { type RouterAbMpcMaterialActivationRefWire } from '../../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
-import { type RouterAbEd25519YaoExportAuthorizationIdentityV1 } from '../../../../../../shared-ts/src/utils/routerAbEd25519Yao';
+import { type RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
 import type { DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
 import { type MpcMaterialActivationRef, type WalletAuthMethodId, type WalletAuthorityId } from '../../../../../../shared-ts/src/utils/domainIds';
-import { type RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
-import { type EcdsaDerivationServerBootstrapResponse } from '../../../../core/types';
-import { type RouterAbEcdsaDerivationNormalSigningStateV1, type RouterAbEcdsaDerivationActivationRefreshForwardedResponseV1, type RouterAbEcdsaDerivationActivationRefreshRequestV1, type RouterAbEcdsaPostRegistrationSessionActivationRequestV1, type RouterAbEcdsaRegistrationActivationReceiptV1, type RouterAbEcdsaRegistrationRequestFactsV1, type RouterAbEcdsaVerifiedClientActivationFactsV1 } from '../../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
+import { type WalletId } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import { type RouterAbEcdsaDerivationActivationRefreshForwardedResponseV1, type RouterAbEcdsaDerivationActivationRefreshRequestV1, type RouterAbEcdsaDerivationNormalSigningStateV1, type RouterAbEcdsaPostRegistrationSessionActivationRequestV1, type RouterAbEcdsaRegistrationActivationReceiptV1, type RouterAbEcdsaRegistrationRequestFactsV1, type RouterAbEcdsaVerifiedClientActivationFactsV1 } from '../../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
+import { type RouterAbEd25519YaoExportAuthorizationIdentityV1 } from '../../../../../../shared-ts/src/utils/routerAbEd25519Yao';
+import { type RouterAbMpcMaterialActivationRefWire } from '../../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
+import type { RouterAbTraceContextV1 } from '../../../../../../shared-ts/src/utils/routerAbTraceContext';
+import type { AuthorizationService } from '../../../../authorization/service';
+import { type ThresholdEcdsaKeyInventoryDiagnostics, type ThresholdEcdsaKeyInventoryRecord } from '../../../../core/authService/thresholdEcdsaKeyInventory';
+import type { EcdsaMaterialActivationReadInput } from '../../../../core/d1EcdsaSignerRead';
+import type { D1WalletStore } from '../../../../core/d1WalletStore';
+import type { EcdsaMaterialReadSnapshot } from '../../../../core/ecdsaMaterialReadSnapshot';
+import { type StoredWalletRegistrationEvmFamilyEcdsaPendingActivationBranch } from '../../../../core/RegistrationCeremonyStore';
 import { WalletRegistrationEcdsaActivationResponse } from '../../../../core/registrationContracts';
+import type { WalletRegistrationActivateResponseV2, WalletRegistrationNearAdmissionResponseV2, WalletRegistrationNearProvisioningResponseV2, WalletRegistrationRespondResponseV2, WalletRegistrationSessionCommitReceiptV2, WalletRegistrationSetupResponseV2 } from '../../../../core/threeRouteRegistrationContracts';
+import { type EcdsaDerivationServerBootstrapResponse } from '../../../../core/types';
+import { type WalletEcdsaSignerKey, type WalletEcdsaSignerRecord } from '../../../../core/WalletStore';
 import { type RouterAbEcdsaStrictRegistrationPort } from '../../../domains/ecdsa/routerAbEcdsaStrictRegistration';
+import { type RouterAbEd25519YaoProductRegistrationRuntimeV1 } from '../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration';
+import type { VerifiedNearRegistrationContinuationV1 } from '../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationIntentAuthorization';
+import { type RouterAbEd25519YaoRegistrationSideEffectRecordV2, type RouterAbEd25519YaoRegistrationSideEffectStoreV2 } from '../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary';
+import type { RouterAbEd25519YaoBudgetRefreshRequestV1, RouterAbEd25519YaoBudgetRefreshResponseV1, RouterAbEd25519YaoVerifiedWalletUnlockRequestV1, RouterAbEd25519YaoVerifiedWalletUnlockResponseV1 } from '../../../domains/ed25519Yao/session/routerAbEd25519YaoWalletSession';
 import type { TenantRootCustodyLineageResolverV1 } from '../../../domains/tenantRoot/tenantRootCustodyLineage';
 import { type TenantRootIdentityV1 } from '../../../domains/tenantRoot/tenantRootIdentityResolution';
-import { CloudflareD1RegistrationCeremonyIntentStore } from './d1RegistrationCeremonyStore';
-import type { InstalledLinkedDeviceEcdsaAuthorityProjectionV1, InstalledLinkedDeviceEd25519AuthorityProjectionV1 } from '../deviceLinking/d1LinkedDeviceAuthorityInstallService';
-import { type ThresholdEcdsaKeyInventoryDiagnostics, type ThresholdEcdsaKeyInventoryRecord } from '../../../../core/authService/thresholdEcdsaKeyInventory';
-import { type StoredWalletRegistrationEvmFamilyEcdsaPendingActivationBranch } from '../../../../core/RegistrationCeremonyStore';
-import type { WalletRegistrationNearProvisioningResponseV2, WalletRegistrationNearAdmissionResponseV2, WalletRegistrationActivateResponseV2, WalletRegistrationRespondResponseV2, WalletRegistrationSetupResponseV2, WalletRegistrationSessionCommitReceiptV2 } from '../../../../core/threeRouteRegistrationContracts';
-import type { WalletRegistrationSetupInput, WalletRegistrationRespondInput, WalletRegistrationActivateInput, WalletRegistrationNearProvisioningInput, WalletRegistrationNearAdmissionInput } from '../../../domains/walletRegistration/walletRegistrationInputs';
-import type { CloudflareD1WalletCustodyCommitStore } from '../passkeyCustody/d1WalletCustodyCommitStore';
+import type { WalletRegistrationActivateInput, WalletRegistrationNearAdmissionInput, WalletRegistrationNearProvisioningInput, WalletRegistrationRespondInput, WalletRegistrationSetupInput } from '../../../domains/walletRegistration/walletRegistrationInputs';
+import type { WalletRegistrationReservationAuthority } from '../../../domains/walletRegistration/walletRegistrationReservation';
+import type { InstalledEcdsaCustodySnapshotV1, InstalledLinkedDeviceEcdsaAuthorityProjectionV1, InstalledLinkedDeviceEd25519AuthorityProjectionV1 } from '../deviceLinking/d1LinkedDeviceAuthorityInstallService';
+import type { CloudflareD1Ed25519YaoLifecycleDecisionStoreV1 } from '../ed25519Yao/d1Ed25519YaoLifecycleDecisionStore';
 import { CloudflareD1EmailOtpRegistrationEnrollmentFinalizer } from '../emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer';
+import type { CloudflareD1WalletCustodyCommitStore } from '../passkeyCustody/d1WalletCustodyCommitStore';
+import type { CloudflareD1VersionedJsonRecordReadManyEntryV1 } from '../versionedJson/d1VersionedJsonRecordStore';
 import { CloudflareD1WalletAuthMethodService } from '../wallet/d1WalletAuthMethodService';
+import { CloudflareD1RegistrationCeremonyIntentStore } from './d1RegistrationCeremonyStore';
 import type { D1WalletRegistrationCommitStore } from './d1WalletRegistrationCommitStore';
-import type { CloudflareD1Ed25519YaoLifecycleDecisionStoreV1 } from '../ed25519Yao/d1Ed25519YaoLifecycleDecisionStore';
-import { type WalletEcdsaSignerKey, type WalletEcdsaSignerRecord } from '../../../../core/WalletStore';
-import type { D1WalletStore } from '../../../../core/d1WalletStore';
-import { type RouterAbEd25519YaoProductRegistrationRuntimeV1 } from '../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration';
-import type { RouterAbEd25519YaoBudgetRefreshRequestV1, RouterAbEd25519YaoBudgetRefreshResponseV1, RouterAbEd25519YaoVerifiedWalletUnlockRequestV1, RouterAbEd25519YaoVerifiedWalletUnlockResponseV1 } from '../../../domains/ed25519Yao/session/routerAbEd25519YaoWalletSession';
-import { type RouterAbEd25519YaoRegistrationSideEffectRecordV2, type RouterAbEd25519YaoRegistrationSideEffectStoreV2 } from '../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary';
-import type { CloudflareD1VersionedJsonRecordReadManyEntryV1 } from '../versionedJson/d1VersionedJsonRecordStore';
 type ActivateWalletRegistrationEcdsaInput = {
     readonly registrationCeremonyId: string;
     readonly ecdsa: {
@@ -55,10 +59,11 @@ type D1LinkedDeviceEd25519AuthorityReaderV1 = {
         readonly authorityId: WalletAuthorityId;
         readonly walletAuthMethodId: WalletAuthMethodId;
     }) => Promise<InstalledLinkedDeviceEcdsaAuthorityProjectionV1 | null>;
-    readInstalledEcdsaAuthorityChainByMaterialActivationV1(input: {
+    readInstalledEcdsaCustodySnapshotV1(input: {
+        readonly source: EcdsaMaterialActivationReadInput['source'];
         readonly walletId: WalletId;
         readonly materialActivation: MpcMaterialActivationRef;
-    }): Promise<readonly InstalledLinkedDeviceEcdsaAuthorityProjectionV1[]>;
+    }): Promise<InstalledEcdsaCustodySnapshotV1 | null>;
 };
 export type D1WalletRegistrationOperationPreparedV1 = {
     readonly kind: 'd1_wallet_registration_operation_prepared_v1';
@@ -90,16 +95,7 @@ export type SponsoredNamedNearAccountCreationResult = {
     readonly message: string;
     readonly retryAfterMs: number;
 };
-type SponsoredNamedNearAccountCreator = (input: {
-    readonly accountId: string;
-    readonly publicKey: string;
-    /**
-     * Registration-scoped key. The provisioning boundary persists the signed
-     * transaction under this key before broadcasting, so a retry replays those
-     * exact bytes instead of building a second transaction.
-     */
-    readonly idempotencyKey: string;
-}) => Promise<SponsoredNamedNearAccountCreationResult>;
+type SponsoredNamedNearAccountCreator = (input: SponsoredNamedNearAccountInput) => Promise<SponsoredNamedNearAccountCreationResult>;
 export declare function ecdsaStrictRegistrationAuthority(facts: RouterAbEcdsaRegistrationRequestFactsV1): {
     readonly subjectId: string;
     readonly sessionId: string;
@@ -122,6 +118,7 @@ type EcdsaPostRegistrationProofInput = {
     readonly response: RouterAbEcdsaDerivationActivationRefreshForwardedResponseV1;
 };
 export declare class CloudflareD1WalletRegistrationService {
+    private readonly registrationAuthority;
     private readonly authorizationService;
     private readonly authorizationTenantId;
     private readonly createSponsoredNamedNearAccount;
@@ -142,6 +139,7 @@ export declare class CloudflareD1WalletRegistrationService {
     private readonly getLinkedDeviceEd25519AuthorityReader;
     private readonly yaoLifecycleDecisions;
     constructor(input: {
+        readonly registrationAuthority: WalletRegistrationReservationAuthority | null;
         readonly authorizationService: AuthorizationService;
         readonly authorizationTenantId: TenantId;
         readonly createSponsoredNamedNearAccount: SponsoredNamedNearAccountCreator;
@@ -176,11 +174,9 @@ export declare class CloudflareD1WalletRegistrationService {
         readonly code: 'not_found' | 'internal';
         readonly message: string;
     }>;
-    resolveEcdsaMaterialActivation(input: {
-        readonly walletId: string;
-        readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
-    }): Promise<{
+    resolveEcdsaMaterialActivation(input: EcdsaMaterialActivationReadInput): Promise<{
         readonly ok: true;
+        readonly readSnapshot: EcdsaMaterialReadSnapshot;
         readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
         readonly keyHandle: string;
         readonly relayerKeyId: string;
@@ -254,17 +250,6 @@ export declare class CloudflareD1WalletRegistrationService {
     }>;
     refreshEd25519YaoWalletSession(request: RouterAbEd25519YaoBudgetRefreshRequestV1): Promise<RouterAbEd25519YaoBudgetRefreshResponseV1>;
     provisionEd25519YaoWalletSession(request: RouterAbEd25519YaoVerifiedWalletUnlockRequestV1): Promise<RouterAbEd25519YaoVerifiedWalletUnlockResponseV1>;
-    /**
-     * `/wallets/register/setup` — grant, intent, and start in one request, with
-     * one D1 write.
-     *
-     * Setup runs before the client's WebAuthn create, because it issues the
-     * challenge that create signs. So the ECDSA prepare and the Ed25519
-     * admission — the two Router calls that dominated the measured cold path —
-     * overlap the authenticator prompt instead of being serialized after it.
-     * They are started before either is awaited: they share no state and neither
-     * can invalidate the other.
-     */
     setupWalletRegistration(input: WalletRegistrationSetupInput): Promise<WalletRegistrationSetupResponseV2>;
     authorizeWalletRegistrationNearAdmission(input: WalletRegistrationNearAdmissionInput): Promise<WalletRegistrationNearAdmissionResponseV2>;
     respondWalletRegistration(input: WalletRegistrationRespondInput, traceContext?: RouterAbTraceContextV1, timingSink?: Array<readonly [string, number]>): Promise<WalletRegistrationRespondResponseV2>;

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationSetup.d.ts

@@ -31,38 +31,12 @@
  * allocation and insertion are the same request. Genuine uniqueness is still
  * arbitrated where it always was, by the wallet table at commit.
  */
-import { type WalletId } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import { type RegistrationAuthMethodInput } from '../../../../../../shared-ts/src/utils/registrationAuthMethodInput';
 import { type RegistrationSignerSetSelection } from '../../../../../../shared-ts/src/utils/registrationSignerPlan';
-import { type RegisterWalletInput, type RegistrationAuthMethodInput } from '../../../../../../shared-ts/src/utils/registrationAuthMethodInput';
-import type { RespondEd25519DeferredWorkV2, WalletRegistrationRespondResponseV2, WalletRegistrationSetupResponseV2 } from '../../../../core/threeRouteRegistrationContracts';
 import type { StoredWalletRegistrationCeremony } from '../../../../core/RegistrationCeremonyStore';
-import { mintSignedWalletRegistrationSetup, type WalletRegistrationSetupMinter } from '../../../domains/walletRegistration/walletRegistrationSetupPayload';
+import type { RespondEd25519DeferredWorkV2, WalletRegistrationRespondResponseV2, WalletRegistrationSetupResponseV2 } from '../../../../core/threeRouteRegistrationContracts';
 import type { WalletRegistrationSetupRequest } from '../../../domains/walletRegistration/walletRegistrationInputs';
-export declare function walletRegistrationSetupIds(): {
-    readonly registrationCeremonyId: string;
-    readonly registrationPreparationId: string;
-};
-/**
- * Resolves the wallet id without reserving it.
- *
- * A provided id is taken as given; an absent or server-allocated one is
- * generated. There is no existence pre-check: it cost a serialized read on
- * every registration to catch a collision that the commit-time uniqueness
- * constraint catches anyway, and for a freshly generated random id it could
- * essentially never fire.
- */
-export declare function resolveWalletRegistrationSetupWalletId(input: {
-    readonly wallet: RegisterWalletInput | undefined;
-    readonly parseProvided: (raw: unknown) => WalletId | null;
-    readonly createServerAllocated: () => WalletId;
-}): {
-    readonly ok: true;
-    readonly walletId: WalletId;
-} | {
-    readonly ok: false;
-    readonly code: string;
-    readonly message: string;
-};
+import { mintSignedWalletRegistrationSetup, type WalletRegistrationSetupMinter } from '../../../domains/walletRegistration/walletRegistrationSetupPayload';
 export declare function normalizeWalletRegistrationSetupRequest(request: WalletRegistrationSetupRequest): {
     readonly ok: true;
     readonly signerSelection: RegistrationSignerSetSelection;
@@ -82,7 +56,6 @@ export declare function buildWalletRegistrationSetupSignature(input: {
     readonly expectedOrigin: string;
 }): Promise<{
     readonly signedSetup: Awaited<ReturnType<typeof mintSignedWalletRegistrationSetup>>;
-    readonly setupDigestB64u: string;
 }>;
 export declare function walletRegistrationSetupIntentDigest(intent: StoredWalletRegistrationCeremony['intent']): Promise<string>;
 /**

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationSetupExecution.d.ts

@@ -0,0 +1,11 @@
+import type { WalletRegistrationSetupResponseV2 } from '../../../../core/threeRouteRegistrationContracts';
+import { type RouterAbEcdsaStrictRegistrationPort } from '../../../domains/ecdsa/routerAbEcdsaStrictRegistration';
+import type { WalletRegistrationSetupInput } from '../../../domains/walletRegistration/walletRegistrationInputs';
+import type { WalletRegistrationReservationAuthority } from '../../../domains/walletRegistration/walletRegistrationReservation';
+import { CloudflareD1RegistrationCeremonyIntentStore } from './d1RegistrationCeremonyStore';
+export declare function executeD1WalletRegistrationSetup(input: WalletRegistrationSetupInput, dependencies: {
+    readonly reservation: WalletRegistrationReservationAuthority | null;
+    readonly store: CloudflareD1RegistrationCeremonyIntentStore;
+    readonly ecdsaStrictRegistration: RouterAbEcdsaStrictRegistrationPort;
+}): Promise<WalletRegistrationSetupResponseV2>;
+//# sourceMappingURL=d1WalletRegistrationSetupExecution.d.ts.map