@seams/wallet-server 0.7.3 → 0.8.0

package/dist/esm/router/cloudflare/d1/near/d1SponsoredNearAccount.js

@@ -0,0 +1,242 @@
+import { parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
+import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import "../../../../shared-ts/src/utils/encoders.js";
+import { createCloudflareD1VersionedJsonRecordStore } from "../versionedJson/d1VersionedJsonRecordStore.js";
+import { runRouterAbEd25519YaoRegistrationSideEffectV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
+import { broadcastPreparedSponsoredNearAccountCreation, prepareSponsoredNearAccountCreationWithRelayer, preparedSponsoredNearAccountCreationArtifactFingerprint } from "../../../../core/nearRelayerAccountProvisioning.js";
+//#region src/router/cloudflare/d1/near/d1SponsoredNearAccount.ts
+/**
+* Validates a persisted claim before it is trusted to skip a broadcast or to be
+* replayed. An invalid record makes the D1 read fail, which leaves the effect
+* uncertain and prevents any network action on unvalidated bytes.
+*/
+function parseSponsoredNearAccountSideEffectRecord(raw) {
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
+	if (Reflect.get(raw, "operation") !== "finalize") return null;
+	const requestFingerprint = parseSideEffectFingerprint(Reflect.get(raw, "requestFingerprint"));
+	const preparedArtifactFingerprint = parseSideEffectFingerprint(Reflect.get(raw, "preparedArtifactFingerprint"));
+	if (requestFingerprint === null || preparedArtifactFingerprint === null) return null;
+	const claimedAtMs = Reflect.get(raw, "claimedAtMs");
+	if (!isNonNegativeSafeInteger(claimedAtMs)) return null;
+	const prepared = parseWalletSponsoredTransaction(Reflect.get(raw, "prepared"));
+	if (prepared === null) return null;
+	const kind = Reflect.get(raw, "kind");
+	if (kind === "router_ab_ed25519_yao_registration_side_effect_claim_v1") return {
+		kind: "router_ab_ed25519_yao_registration_side_effect_claim_v1",
+		operation: "finalize",
+		requestFingerprint,
+		preparedArtifactFingerprint,
+		claimedAtMs,
+		prepared
+	};
+	if (kind === "router_ab_ed25519_yao_registration_side_effect_completion_v1") {
+		const completedAtMs = Reflect.get(raw, "completedAtMs");
+		if (!isNonNegativeSafeInteger(completedAtMs)) return null;
+		const response = parseAccountCreationResult(Reflect.get(raw, "response"));
+		if (response === null) return null;
+		return {
+			kind: "router_ab_ed25519_yao_registration_side_effect_completion_v1",
+			operation: "finalize",
+			requestFingerprint,
+			preparedArtifactFingerprint,
+			claimedAtMs,
+			completedAtMs,
+			prepared,
+			response
+		};
+	}
+	return null;
+}
+function parsePreparedSponsoredNearAccountCreation(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+	if (Reflect.get(value, "kind") !== "prepared_sponsored_near_account_creation_v1") return null;
+	const accountId = parseNonEmptyString(Reflect.get(value, "accountId"));
+	const publicKey = parseNonEmptyString(Reflect.get(value, "publicKey"));
+	const relayerAccountId = parseNonEmptyString(Reflect.get(value, "relayerAccountId"));
+	const relayerPublicKey = parseNonEmptyString(Reflect.get(value, "relayerPublicKey"));
+	const initialBalanceYocto = parseNonEmptyString(Reflect.get(value, "initialBalanceYocto"));
+	const transactionHash = parseNonEmptyString(Reflect.get(value, "transactionHash"));
+	const nextNonce = parseNonEmptyString(Reflect.get(value, "nextNonce"));
+	const blockHash = parseNonEmptyString(Reflect.get(value, "blockHash"));
+	const signedTransactionBorshB64u = parseBoundedBase64Url(Reflect.get(value, "signedTransactionBorshB64u"));
+	if (accountId === null || publicKey === null || relayerAccountId === null || relayerPublicKey === null || initialBalanceYocto === null || transactionHash === null || nextNonce === null || blockHash === null || signedTransactionBorshB64u === null) return null;
+	return {
+		kind: "prepared_sponsored_near_account_creation_v1",
+		accountId,
+		publicKey,
+		relayerAccountId,
+		relayerPublicKey,
+		initialBalanceYocto,
+		transactionHash,
+		nextNonce,
+		blockHash,
+		signedTransactionBorshB64u
+	};
+}
+function parseAccountCreationResult(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+	const success = Reflect.get(value, "success");
+	if (typeof success !== "boolean") return null;
+	const accountId = parseOptionalString(Reflect.get(value, "accountId"));
+	const transactionHash = parseOptionalString(Reflect.get(value, "transactionHash"));
+	const error = parseOptionalString(Reflect.get(value, "error"));
+	const message = parseOptionalString(Reflect.get(value, "message"));
+	if ("accountId" in value && accountId === null || "transactionHash" in value && transactionHash === null || "error" in value && error === null || "message" in value && message === null) return null;
+	if (success && (accountId === void 0 || transactionHash === void 0)) return null;
+	const normalizedAccountId = accountId ?? void 0;
+	const normalizedTransactionHash = transactionHash ?? void 0;
+	const normalizedError = error ?? void 0;
+	const normalizedMessage = message ?? void 0;
+	return {
+		success,
+		...normalizedAccountId === void 0 ? {} : { accountId: normalizedAccountId },
+		...normalizedTransactionHash === void 0 ? {} : { transactionHash: normalizedTransactionHash },
+		...normalizedError === void 0 ? {} : { error: normalizedError },
+		...normalizedMessage === void 0 ? {} : { message: normalizedMessage }
+	};
+}
+function parseNonEmptyString(value) {
+	return typeof value === "string" && value.trim() ? value : null;
+}
+function parseSideEffectFingerprint(value) {
+	return typeof value === "string" && /^[a-zA-Z0-9:_-]{32,192}$/u.test(value) ? value : null;
+}
+function parseBoundedBase64Url(value) {
+	return typeof value === "string" && value.length > 0 && value.length <= 8192 && /^[\w-]+$/u.test(value) ? value : null;
+}
+function parseOptionalString(value) {
+	return value === void 0 ? void 0 : parseNonEmptyString(value);
+}
+function isNonNegativeSafeInteger(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+function sponsoredNearAccountSideEffectStore(options) {
+	return createCloudflareD1VersionedJsonRecordStore({
+		database: options.database,
+		scope: {
+			namespace: options.namespace,
+			orgId: options.orgId,
+			projectId: options.projectId,
+			envId: options.envId
+		},
+		keyPrefix: "router-ab-yao-sponsored-account:",
+		encode: encodeSponsoredRecord,
+		parse: parseSponsoredNearAccountSideEffectRecord
+	});
+}
+/**
+* Creates the sponsored account through a durable claim. The signed transaction
+* and its hash are persisted before the broadcast, so a lost response replays
+* those exact bytes instead of building a second transaction under a fresh
+* nonce. Rebroadcasting an identical signed transaction reuses its hash, so the
+* network treats the retry as the same transaction.
+*/
+async function createSponsoredNamedNearAccountForOptions(options, input) {
+	const relayerAccount = options.relayerAccount;
+	const relayerPrivateKey = options.relayerPrivateKey;
+	const nearRpcUrl = options.nearRpcUrl;
+	const initialBalanceYocto = options.accountInitialBalance;
+	if (!relayerAccount || !relayerPrivateKey || !nearRpcUrl || !initialBalanceYocto) return {
+		kind: "rejected",
+		message: "Sponsored NEAR account creation is not configured on this server"
+	};
+	const relayerInput = {
+		accountId: input.accountId,
+		publicKey: input.publicKey,
+		relayerAccount,
+		relayerPrivateKey,
+		relayerPublicKey: options.relayerPublicKey,
+		nearRpcUrl,
+		initialBalanceYocto
+	};
+	const requestFingerprint = base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
+		kind: "sponsored_near_account_creation_v1",
+		walletId: input.walletId,
+		accountId: input.accountId,
+		publicKey: input.publicKey,
+		relayerAccountId: relayerAccount,
+		initialBalanceYocto
+	})));
+	const outcome = await runRouterAbEd25519YaoRegistrationSideEffectV1(sponsoredNearAccountSideEffectStore(options), {
+		kind: "prepared_resumable",
+		resumeAfterMs: 3e4,
+		operation: "finalize",
+		key: `sponsored-account:${input.idempotencyKey}`,
+		requestFingerprint,
+		nowMs: () => Date.now(),
+		prepare: prepareWalletSponsoredTransaction.bind(null, input.walletId, relayerInput),
+		derivePreparedArtifactFingerprint: fingerprintWalletSponsoredTransaction,
+		execute: executeWalletSponsoredTransaction.bind(null, {
+			walletId: input.walletId,
+			nearRpcUrl,
+			relayerAccountId: relayerAccount
+		})
+	});
+	switch (outcome.kind) {
+		case "executed":
+		case "exact_replay":
+			if (outcome.value.success && outcome.value.accountId && outcome.value.transactionHash) return {
+				kind: "created",
+				accountId: outcome.value.accountId,
+				transactionHash: outcome.value.transactionHash
+			};
+			return {
+				kind: "rejected",
+				message: outcome.value.message || outcome.value.error || "Sponsored NEAR account creation was rejected"
+			};
+		case "in_progress":
+		case "uncertain": return {
+			kind: "retryable",
+			message: outcome.kind === "uncertain" ? outcome.message : "Sponsored NEAR account creation is already in progress for this registration",
+			retryAfterMs: 3e4
+		};
+		case "request_conflict": return {
+			kind: "rejected",
+			message: "Sponsored NEAR account creation idempotency key conflicts with another request"
+		};
+	}
+}
+function parseWalletSponsoredTransaction(raw) {
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
+	const walletId = parseWalletId(Reflect.get(raw, "walletId"));
+	const transaction = parsePreparedSponsoredNearAccountCreation(Reflect.get(raw, "transaction"));
+	if (!walletId.ok || !transaction) return null;
+	return {
+		walletId: walletId.value,
+		transaction
+	};
+}
+async function fingerprintWalletSponsoredTransaction(prepared) {
+	const transactionFingerprint = await preparedSponsoredNearAccountCreationArtifactFingerprint(prepared.transaction);
+	return base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
+		walletId: prepared.walletId,
+		transactionFingerprint
+	})));
+}
+function encodeSponsoredRecord(record) {
+	return record;
+}
+async function prepareWalletSponsoredTransaction(walletId, input) {
+	const prepared = await prepareSponsoredNearAccountCreationWithRelayer(input);
+	if (!prepared.ok) throw new Error(prepared.message);
+	return {
+		walletId,
+		transaction: prepared.prepared
+	};
+}
+async function executeWalletSponsoredTransaction(context, prepared, attempt) {
+	if (prepared.walletId !== context.walletId) throw new Error("Sponsored NEAR account claim belongs to another wallet");
+	const broadcast = await broadcastPreparedSponsoredNearAccountCreation({
+		prepared: prepared.transaction,
+		nearRpcUrl: context.nearRpcUrl,
+		relayerAccountId: context.relayerAccountId,
+		reconcileFirst: attempt === "resumed"
+	});
+	if (broadcast.kind === "uncertain") throw new Error(broadcast.message);
+	return broadcast.result;
+}
+//#endregion
+export { createSponsoredNamedNearAccountForOptions };
+
+//# sourceMappingURL=d1SponsoredNearAccount.js.map

package/dist/esm/router/cloudflare/d1/oidc/d1OidcBoundary.js

@@ -1,7 +1,6 @@
 import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
 import "../../../../shared-ts/src/utils/encoders.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { failedVerification } from "../../../../shared-ts/src/utils/failure.js";
 import { toArrayBufferCopy } from "../../../../core/authService/portableCrypto.js";
 import { toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";

package/dist/esm/router/cloudflare/d1/oidc/d1OidcVerificationService.js

@@ -1,15 +1,13 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { failedVerification } from "../../../../shared-ts/src/utils/failure.js";
-import { CloudflareD1OidcJwksCache, parseRs256JwtForVerification, validateGoogleIdTokenClaims, verifyRs256JwtSignature } from "./d1OidcBoundary.js";
 import { githubOAuthPublicConfig, verifyGithubOAuthCodeWithIdentityStore } from "../../../../core/authService/githubOAuth.js";
+import { verifyGoogleOidcToken } from "./googleOidcToken.js";
 //#region src/router/cloudflare/d1/oidc/d1OidcVerificationService.ts
 function errorMessage(error) {
 	return error instanceof Error ? error.message : String(error || "");
 }
 var CloudflareD1OidcVerificationService = class {
 	constructor(input) {
-		this.oidcJwksCache = new CloudflareD1OidcJwksCache();
 		this.googleOidcClientId = input.googleOidcClientId;
 		this.githubOAuth = input.githubOAuth;
 		this.identityStore = input.identityStore;
@@ -45,32 +43,7 @@ var CloudflareD1OidcVerificationService = class {
 	}
 	async verifyGoogleIdToken(input, linkIdentity) {
 		try {
-			const clientId = normalizeOptionalTrimmedString(this.googleOidcClientId);
-			if (!clientId) return failedVerification("not_configured", "Google OIDC is not configured on this Worker");
-			const idToken = normalizeOptionalTrimmedString(input.idToken ?? input.id_token);
-			if (!idToken) return failedVerification("invalid_body", "id_token is required");
-			const subtle = globalThis.crypto?.subtle;
-			if (!subtle) return failedVerification("unsupported", "WebCrypto (crypto.subtle) is unavailable in this runtime");
-			const parsed = parseRs256JwtForVerification({
-				token: idToken,
-				tokenLabel: "id_token"
-			});
-			if (!parsed.ok) return parsed;
-			const jwt = parsed.jwt;
-			const jwk = (await this.oidcJwksCache.getGoogleJwks()).keysByKid.get(jwt.kid);
-			if (!jwk) return failedVerification("unknown_kid", "Unknown Google key id (kid)");
-			const signature = await verifyRs256JwtSignature({
-				subtle,
-				jwt,
-				jwk,
-				tokenLabel: "id_token",
-				invalidSignatureMessage: "Invalid Google id_token signature"
-			});
-			if (!signature.ok) return signature;
-			const claims = validateGoogleIdTokenClaims({
-				payload: jwt.payload,
-				clientId
-			});
+			const claims = await verifyGoogleOidcToken(this.googleOidcClientId, input.idToken ?? input.id_token);
 			if (!claims.ok) return claims;
 			const providerSubject = `google:${claims.sub}`;
 			return {

package/dist/esm/router/cloudflare/d1/oidc/googleOidcToken.js

@@ -0,0 +1,41 @@
+import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
+import { failedVerification } from "../../../../shared-ts/src/utils/failure.js";
+import { CloudflareD1OidcJwksCache, parseRs256JwtForVerification, validateGoogleIdTokenClaims, verifyRs256JwtSignature } from "./d1OidcBoundary.js";
+//#region src/router/cloudflare/d1/oidc/googleOidcToken.ts
+const googleJwks = new CloudflareD1OidcJwksCache();
+/** Verifies provider proof without reading or mutating wallet identity state. */
+async function verifyGoogleOidcToken(configuredClientId, rawToken) {
+	const clientId = normalizeOptionalTrimmedString(configuredClientId);
+	if (!clientId) return failedVerification("not_configured", "Google OIDC is not configured on this Worker");
+	const token = normalizeOptionalTrimmedString(rawToken);
+	if (!token) return failedVerification("invalid_body", "id_token is required");
+	const subtle = globalThis.crypto?.subtle;
+	if (!subtle) return failedVerification("unsupported", "WebCrypto (crypto.subtle) is unavailable in this runtime");
+	const parsed = parseRs256JwtForVerification({
+		token,
+		tokenLabel: "id_token"
+	});
+	if (!parsed.ok) return parsed;
+	try {
+		const jwk = (await googleJwks.getGoogleJwks()).keysByKid.get(parsed.jwt.kid);
+		if (!jwk) return failedVerification("unknown_kid", "Unknown Google key id (kid)");
+		const signature = await verifyRs256JwtSignature({
+			subtle,
+			jwt: parsed.jwt,
+			jwk,
+			tokenLabel: "id_token",
+			invalidSignatureMessage: "Invalid Google id_token signature"
+		});
+		if (!signature.ok) return signature;
+		return validateGoogleIdTokenClaims({
+			payload: parsed.jwt.payload,
+			clientId
+		});
+	} catch {
+		return failedVerification("internal", "Google OIDC verification unavailable");
+	}
+}
+//#endregion
+export { verifyGoogleOidcToken };
+
+//# sourceMappingURL=googleOidcToken.js.map

package/dist/esm/router/cloudflare/d1/passkeyCustody/d1PasskeyCustodyRouteService.js

@@ -451,6 +451,11 @@ async function prepareRecoveryForRoute(assembly, request) {
 		reservationTtlMs: RECOVERY_RESERVATION_TTL_MS
 	});
 	if (prepared.kind !== "prepared") return prepared;
+	try {
+		await assembly.walletCustodyCommits.publishRecoveryOperation(walletId, targetIdentity.recoveryOperationId);
+	} catch {
+		return { kind: "routing_unavailable" };
+	}
 	try {
 		const manifest = await resolveWalletRecoveryKeyManifestV1({
 			registry: assembly.walletStore,

package/dist/esm/router/cloudflare/d1/passkeyCustody/d1WalletCustodyCommitStore.js

@@ -13,6 +13,7 @@ import { parseWalletRecoveryBackupAcknowledgementV1 } from "../../../../shared-t
 import "../../../../shared-ts/src/wallet-recovery/recoveryCodes.js";
 import { parseWalletRecoveryEnvelopeSetRecord } from "../../../../shared-ts/src/wallet-recovery/walletRecoveryEnvelopeSet.js";
 import { parseRecoveryCodeLocatorV1 } from "../../../../shared-ts/src/wallet-recovery/recoveryCodeLocator.js";
+import { reservePasskeyCredential } from "../../../../core/passkeyCredentialClaims.js";
 import { prepareD1WebAuthnCredentialBindingInsertStatement } from "../../../../core/WebAuthnCredentialBindingStore.js";
 import { prepareD1WebAuthnAuthenticatorInsertStatement } from "../webauthn/d1WebAuthnStore.js";
 import { D1WalletAuthorityStore, prepareD1WalletAuthorityPutStatement } from "../wallet/d1WalletAuthorityStore.js";
@@ -125,6 +126,8 @@ function isRecoveryCodeLocatorCollision(error) {
 }
 var CloudflareD1WalletCustodyCommitStore = class {
 	constructor(options) {
+		this.credentialClaims = options.credentialClaims;
+		this.recoveryRouting = options.recoveryRouting;
 		this.database = options.database;
 		this.scope = options.scope;
 		this.walletAuthMethodStore = options.walletAuthMethodStore ?? new D1WalletAuthMethodStore({
@@ -146,6 +149,27 @@ var CloudflareD1WalletCustodyCommitStore = class {
 			keyPrefix: PASSKEY_ENVELOPE_KEY_PREFIX
 		});
 	}
+	async publishRecoveryOperation(walletId, operationId) {
+		const result = await this.recoveryRouting?.publishRecovery({
+			kind: "operation",
+			walletId,
+			operationId
+		});
+		if (result && !result.ok) throw new Error("Recovery operation routing conflicts");
+	}
+	async claimRecoveryCodeRoutes(walletId, records) {
+		if (!this.recoveryRouting) return true;
+		const locators = [];
+		for (const record of records) {
+			if (record.walletId !== walletId) throw new Error("Recovery code routing wallet differs");
+			locators.push(record.locatorB64u);
+		}
+		return (await this.recoveryRouting.publishRecovery({
+			kind: "codes",
+			walletId,
+			locators
+		})).ok;
+	}
 	async readRecoveryCodeLocator(locatorB64u) {
 		const row = await this.database.prepare(`SELECT locator_b64u, wallet_id, recovery_key_id
            FROM wallet_recovery_code_locators
@@ -334,6 +358,10 @@ var CloudflareD1WalletCustodyCommitStore = class {
 			kind: "inconsistent",
 			reason: inconsistency
 		};
+		if (!await this.claimRecoveryCodeRoutes(commit.recoverySet.walletId, commit.recoveryCodeLocators)) return {
+			kind: "inconsistent",
+			reason: "recovery code locator already exists"
+		};
 		const envelopeKey = passkeyCustodyEnvelopeRecordKey(passkeyCustodyEnvelopeLocatorOf(commit.envelope));
 		const recoverySetKey = walletRecoveryEnvelopeSetRecordKey(commit.recoverySet.walletId);
 		const recoveryBackupAcknowledgementKey = walletRecoveryBackupAcknowledgementRecordKey(commit.recoverySet.walletId);
@@ -465,6 +493,7 @@ var CloudflareD1WalletCustodyCommitStore = class {
 	* the explicit acknowledge route. Both rows are guarded against races.
 	*/
 	async replaceRecoveryEnvelopeSetAndPreserveBackupAcknowledgement(input) {
+		if (!await this.claimRecoveryCodeRoutes(input.record.walletId, input.recoveryCodeLocators)) return { kind: "collision" };
 		const acknowledgementKey = walletRecoveryBackupAcknowledgementRecordKey(input.record.walletId);
 		const existingAcknowledgement = await this.records.read(acknowledgementKey);
 		const mutations = [{
@@ -551,6 +580,11 @@ var CloudflareD1WalletCustodyCommitStore = class {
 			userId: input.authenticatorCommit.userId,
 			record: input.authenticatorCommit.authenticator
 		});
+		await reservePasskeyCredential(this.credentialClaims, {
+			walletId: targetMethod.walletId,
+			rpId: targetMethod.rpId,
+			credentialIdB64u: targetMethod.credentialIdB64u
+		});
 		const bindingStatement = prepareD1WebAuthnCredentialBindingInsertStatement({
 			database: this.database,
 			scope: this.tenantScope(),

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore.js

@@ -61,6 +61,14 @@ var D1RegistrationCeremonyRecordStore = class {
 		if (recordsMatch(current, prepared)) return;
 		throw conflict("Registration ceremony record conflicts with the stored value");
 	}
+	async insertOrRead(mutation) {
+		const key = this.normalizeKey(mutation.scope, mutation.id);
+		const prepared = prepareValue(mutation.value, mutation.expiresAtMs);
+		await this.insert(key, prepared);
+		const stored = await this.get(mutation.scope, mutation.id);
+		if (!stored) throw conflict("Registration setup expired during persistence");
+		return stored;
+	}
 	async updateExpected(input) {
 		const key = this.normalizeKey(input.scope, input.id);
 		const current = await this.get(input.scope, input.id);
@@ -117,8 +125,7 @@ var D1RegistrationCeremonyRecordStore = class {
 		const parsed = parseStoredRow(row);
 		return {
 			value: parsed.value,
-			version: parsed.version,
-			expiresAtMs: parsed.expiresAtMs
+			version: parsed.version
 		};
 	}
 	async updateExpectedVersion(input) {
@@ -235,7 +242,6 @@ function prepareValue(value, expiresAtMs) {
 	const normalizedExpiresAtMs = Math.floor(Number(expiresAtMs));
 	if (!Number.isSafeInteger(normalizedExpiresAtMs) || normalizedExpiresAtMs <= Date.now()) throw new Error("Registration ceremony record expiry must be in the future");
 	return {
-		value,
 		recordJson: alphabetizeStringify(value),
 		expiresAtMs: normalizedExpiresAtMs
 	};

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyRecords.js

@@ -2,8 +2,6 @@ import { parseChallengeSubjectId, parseEmailOtpChallengeId, parseOrgId, parsePro
 import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../../shared-ts/src/utils/near.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { parseWalletAddAuthMethodRegistrationOptions } from "../../../../shared-ts/src/utils/addAuthMethodRegistration.js";
 import { parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationActivationResultV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { deriveEvmFamilySigningKeySlotId } from "../../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";
@@ -16,24 +14,22 @@ import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/
 import { parseWebAuthnAuthenticatorDeviceInfo, unknownWebAuthnAuthenticatorDeviceInfo } from "../../../../shared-ts/src/utils/webauthnDeviceInfo.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { parseRouterAbEd25519NormalSigningState } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
-import { parseEcdsaDerivationPublicIdentity, parseThresholdEd25519AuthorityScope, thresholdEd25519AuthorityScopeFromWalletAuthAuthority, thresholdEd25519AuthorityScopesMatch } from "../../../../core/ThresholdService/validation.js";
 import { thresholdEcdsaChainTargetKey } from "../../../../shared-ts/src/utils/thresholdEcdsaChainTarget.js";
 import { thresholdEcdsaChainTargetFromValue } from "../../../../core/thresholdEcdsaChainTarget.js";
 import { buildWalletEcdsaSignerRecord, parseWalletEd25519SignerRecord } from "../../../../core/d1WalletStore.js";
-import { createServerAllocatedWalletId, nearEd25519SigningKeyIdFromString, walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
+import { nearEd25519SigningKeyIdFromString, walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { registrationPreparationIdFromString } from "../../../../core/types.js";
 import "../../../../shared-ts/src/signing-lanes/index.js";
 import { parsePasskeyCustodyEnvelopeRecord } from "../../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
+import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../../shared-ts/src/utils/near.js";
 import { normalizeAddSignerSelection, normalizeRegistrationSignerPlan, registrationSignerBranchKeyFromString, registrationSignerSetSelectionFromPlan } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
 import { addAuthMethodIntentGrantFromString, addSignerIntentGrantFromString, normalizeAddAuthMethodIntentCaller } from "../../../../shared-ts/src/utils/registrationIntent.js";
+import { parseEcdsaDerivationPublicIdentity, parseThresholdEd25519AuthorityScope, thresholdEd25519AuthorityScopeFromWalletAuthAuthority, thresholdEd25519AuthorityScopesMatch } from "../../../../core/ThresholdService/validation.js";
 import { toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";
-import { parseStoredRouterAbEcdsaPendingActivationV1 } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
 import { parseStoredRegistrationSignerPlan, parseStoredWalletRegistrationPreparedContext, storedRegistrationSignerPlansMatch } from "../../../../core/RegistrationCeremonyStore.js";
+import { parseStoredRouterAbEcdsaPendingActivationV1 } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
 //#region src/router/cloudflare/d1/registration/d1RegistrationCeremonyRecords.ts
-function createD1ServerAllocatedWalletId() {
-	return createServerAllocatedWalletId();
-}
 function inferRuntimePolicyScopeFromSigningRoot(input) {
 	const signingRootId = normalizeOptionalTrimmedString(input.signingRootId);
 	const signingRootVersion = normalizeOptionalTrimmedString(input.signingRootVersion);
@@ -48,7 +44,7 @@ function inferRuntimePolicyScopeFromSigningRoot(input) {
 	};
 }
 function buildRegistrationIntent(input) {
-	const nonceB64u = secureRandomBase64Url(32);
+	const nonceB64u = input.nonceB64u;
 	const foundingWalletAuthMethodId = input.foundingWalletAuthMethodId;
 	if (input.runtimePolicyScope) return {
 		version: "registration_intent_v1",
@@ -1369,7 +1365,6 @@ function parseD1EcdsaDerivationServerBootstrapResponse(raw) {
 	const publicIdentity = parseD1EcdsaDerivationPublicIdentity(record.publicIdentity);
 	const clientShareRetryCounter = safeInteger(record.clientShareRetryCounter);
 	const relayerShareRetryCounter = safeInteger(record.relayerShareRetryCounter);
-	const publicTranscriptDigest32B64u = normalizeOptionalTrimmedString(record.publicTranscriptDigest32B64u);
 	const keyHandle = normalizeOptionalTrimmedString(record.keyHandle);
 	const signingRootId = normalizeOptionalTrimmedString(record.signingRootId);
 	const signingRootVersion = normalizeOptionalTrimmedString(record.signingRootVersion);
@@ -1384,7 +1379,7 @@ function parseD1EcdsaDerivationServerBootstrapResponse(raw) {
 	const expiresAt = normalizeOptionalTrimmedString(record.expiresAt);
 	const remainingUses = safeInteger(record.remainingUses);
 	const routerAbEcdsaDerivationNormalSigning = parseRouterAbEcdsaDerivationNormalSigningStateV1(record.routerAbEcdsaDerivationNormalSigning);
-	if (!walletId || !evmFamilySigningKeySlotId || !ecdsaThresholdKeyId || !relayerKeyId || !applicationBindingDigestB64u || !contextBinding32B64u || !publicIdentity || clientShareRetryCounter === null || relayerShareRetryCounter === null || !publicTranscriptDigest32B64u || !keyHandle || !signingRootId || !signingRootVersion || !thresholdEcdsaPublicKeyB64u || !ethereumAddress || !relayerVerifyingShareB64u || !participantIds || !thresholdSessionId || !activationEpoch || expiresAtMs === null || !expiresAt || remainingUses === null || !routerAbEcdsaDerivationNormalSigning) return null;
+	if (!walletId || !evmFamilySigningKeySlotId || !ecdsaThresholdKeyId || !relayerKeyId || !applicationBindingDigestB64u || !contextBinding32B64u || !publicIdentity || clientShareRetryCounter === null || relayerShareRetryCounter === null || !keyHandle || !signingRootId || !signingRootVersion || !thresholdEcdsaPublicKeyB64u || !ethereumAddress || !relayerVerifyingShareB64u || !participantIds || !thresholdSessionId || !activationEpoch || expiresAtMs === null || !expiresAt || remainingUses === null || !routerAbEcdsaDerivationNormalSigning) return null;
 	return {
 		formatVersion: "ecdsa-derivation-role-local",
 		walletId,
@@ -1396,7 +1391,6 @@ function parseD1EcdsaDerivationServerBootstrapResponse(raw) {
 		publicIdentity,
 		clientShareRetryCounter,
 		relayerShareRetryCounter,
-		publicTranscriptDigest32B64u,
 		keyHandle,
 		signingRootId,
 		signingRootVersion,
@@ -2034,6 +2028,6 @@ function unreachableAddAuthMethodInput(value) {
 	throw new Error(`Unhandled add-auth-method input kind: ${String(value)}`);
 }
 //#endregion
-export { buildAddAuthMethodIntent, buildAddSignerIntent, buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, buildD1WalletRecord, buildRegistrationIntent, createD1ServerAllocatedWalletId, deriveEvmFamilySigningKeySlotId, inferRuntimePolicyScopeFromSigningRoot, intentScopeMetadata, normalizeThresholdEcdsaChainTargets, parseD1AddSignerIntent, parseD1EcdsaDerivationServerBootstrapResponse, parseD1RuntimePolicyScope, parseD1StoredAddAuthMethodIntent, parseD1StoredAddSignerAuth, parseD1StoredAddSignerIntent, parseD1StoredWalletAddAuthMethodCeremony, parseD1StoredWalletAddAuthMethodFinalizeReplay, parseD1StoredWalletAddSignerCeremony, parseD1StoredWalletAddSignerFinalizeReplay, parseD1StoredWalletRegistrationCeremony, parseD1WalletAddSignerFinalizeTerminalResponse, parseD1WalletRegistrationCommittedInstallationProjection, parseD1WalletRegistrationFinalizeReplayResponse, parseWalletIdForIntent, positiveIntegerArraysEqual, runtimePolicyScopeMatches, thresholdEcdsaChainTargetsEqual };
+export { buildAddAuthMethodIntent, buildAddSignerIntent, buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, buildD1WalletRecord, buildRegistrationIntent, deriveEvmFamilySigningKeySlotId, inferRuntimePolicyScopeFromSigningRoot, intentScopeMetadata, normalizeThresholdEcdsaChainTargets, parseD1AddSignerIntent, parseD1EcdsaDerivationServerBootstrapResponse, parseD1RuntimePolicyScope, parseD1StoredAddAuthMethodIntent, parseD1StoredAddSignerAuth, parseD1StoredAddSignerIntent, parseD1StoredWalletAddAuthMethodCeremony, parseD1StoredWalletAddAuthMethodFinalizeReplay, parseD1StoredWalletAddSignerCeremony, parseD1StoredWalletAddSignerFinalizeReplay, parseD1StoredWalletRegistrationCeremony, parseD1WalletAddSignerFinalizeTerminalResponse, parseD1WalletRegistrationCommittedInstallationProjection, parseD1WalletRegistrationFinalizeReplayResponse, parseWalletIdForIntent, positiveIntegerArraysEqual, runtimePolicyScopeMatches, thresholdEcdsaChainTargetsEqual };
 
 //# sourceMappingURL=d1RegistrationCeremonyRecords.js.map

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyStore.js

@@ -7,13 +7,32 @@ var CloudflareD1RegistrationCeremonyIntentStore = class {
 	constructor(input) {
 		this.storage = new D1RegistrationCeremonyRecordStore(input);
 	}
-	async putCeremony(ceremony) {
-		await this.put({
+	async getSetupCeremony(ceremonyId) {
+		const stored = await this.storage.get("setup-ceremony", ceremonyId);
+		if (!stored) return null;
+		const ceremony = parseD1StoredWalletRegistrationCeremony(stored.value);
+		if (!ceremony) throw new Error("Registration setup snapshot is invalid");
+		return ceremony;
+	}
+	async reserveSetupCeremony(proposed) {
+		const ceremony = parseD1StoredWalletRegistrationCeremony((await this.storage.insertOrRead({
+			scope: "setup-ceremony",
+			id: proposed.registrationCeremonyId,
+			value: encodeRecord(proposed),
+			expiresAtMs: proposed.expiresAtMs
+		})).value);
+		if (!ceremony || ceremony.registrationCeremonyId !== proposed.registrationCeremonyId || ceremony.expiresAtMs !== proposed.expiresAtMs || ceremony.orgId !== proposed.orgId || ceremony.digestB64u !== proposed.digestB64u || ceremony.foundingWalletAuthorityId !== proposed.foundingWalletAuthorityId || ceremony.foundingDeviceId !== proposed.foundingDeviceId || ceremony.foundingWalletAuthMethodId !== proposed.foundingWalletAuthMethodId || ceremony.expectedOrigin !== proposed.expectedOrigin) throw new Error("Registration setup snapshot conflicts with its reservation");
+		await this.ensureSetupCeremony(ceremony);
+		return ceremony;
+	}
+	async ensureSetupCeremony(setup) {
+		const current = parseD1StoredWalletRegistrationCeremony((await this.storage.insertOrRead({
 			scope: "ceremony",
-			id: ceremony.registrationCeremonyId,
-			record: ceremony,
-			expiresAtMs: ceremony.expiresAtMs
-		});
+			id: setup.registrationCeremonyId,
+			value: encodeRecord(setup),
+			expiresAtMs: setup.expiresAtMs
+		})).value);
+		if (!current || current.registrationCeremonyId !== setup.registrationCeremonyId || current.expiresAtMs !== setup.expiresAtMs || current.orgId !== setup.orgId || current.digestB64u !== setup.digestB64u || current.foundingWalletAuthorityId !== setup.foundingWalletAuthorityId || current.foundingDeviceId !== setup.foundingDeviceId || current.foundingWalletAuthMethodId !== setup.foundingWalletAuthMethodId || current.expectedOrigin !== setup.expectedOrigin) throw new Error("Registration ceremony conflicts with its setup snapshot");
 	}
 	async getCeremony(registrationCeremonyId) {
 		return (await this.getCeremonySnapshot(registrationCeremonyId))?.ceremony ?? null;
@@ -80,13 +99,6 @@ var CloudflareD1RegistrationCeremonyIntentStore = class {
 			expiresAtMs: input.next.expiresAtMs
 		});
 	}
-	async takeCeremony(registrationCeremonyId) {
-		const id = normalizeOptionalTrimmedString(registrationCeremonyId);
-		if (!id) return null;
-		const ceremony = parseD1StoredWalletRegistrationCeremony(await this.getDel("ceremony", id));
-		if (!ceremony || ceremony.expiresAtMs <= Date.now()) return null;
-		return ceremony;
-	}
 	async deleteCeremony(registrationCeremonyId) {
 		const id = normalizeOptionalTrimmedString(registrationCeremonyId);
 		if (!id) return false;

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationIntentService.js

@@ -1,6 +1,5 @@
 import { parseWalletAuthMethodId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { normalizeAddAuthMethodInput } from "../../../../shared-ts/src/utils/registrationAuthMethodInput.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { failure } from "../../../../shared-ts/src/utils/failure.js";