@seams/wallet-server 0.7.3 → 0.8.0

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationSetupSupport.js

@@ -0,0 +1,74 @@
+import { findRegistrationSignerPlanEvmFamilyEcdsaBranch, findRegistrationSignerPlanNearEd25519Branch, registrationSignerPlanFromSelection } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
+import { buildStoredWalletRegistrationPreparedContext } from "../../../../core/RegistrationCeremonyStore.js";
+import { normalizeThresholdEcdsaChainTargets } from "./d1RegistrationCeremonyRecords.js";
+//#region src/router/cloudflare/d1/registration/d1RegistrationSetupSupport.ts
+function errorMessage(error) {
+	return error instanceof Error ? error.message : String(error || "");
+}
+function startD1RegistrationRouteTiming(name) {
+	return {
+		name,
+		startedAtMs: Date.now()
+	};
+}
+function finishD1RegistrationRouteTiming(recorder, mark) {
+	recorder.entries.push({
+		name: mark.name,
+		durationMs: Math.max(0, Date.now() - mark.startedAtMs)
+	});
+}
+function createD1RegistrationRouteTimingRecorder(route) {
+	return {
+		route,
+		entries: []
+	};
+}
+function registrationIntentSignerBranches(intent) {
+	const plan = registrationSignerPlanFromSelection(intent.signerSelection);
+	if (!plan.ok) return plan;
+	return {
+		ok: true,
+		value: registrationSignerBranchesFromPlan(plan.value)
+	};
+}
+function resolveRegistrationPreparedContextFromPlan(input) {
+	const branches = registrationSignerBranchesFromPlan(input.signerPlan);
+	const ecdsaChainTargets = branches.evmFamilyEcdsa ? normalizeThresholdEcdsaChainTargets(branches.evmFamilyEcdsa.chainTargets) : null;
+	if (branches.evmFamilyEcdsa && !ecdsaChainTargets) return {
+		ok: false,
+		code: "invalid_body",
+		message: "ECDSA registration contains an invalid chain target"
+	};
+	try {
+		return {
+			ok: true,
+			preparedContext: buildStoredWalletRegistrationPreparedContext({
+				signingRootId: input.signingRootId,
+				signingRootVersion: input.signingRootVersion,
+				runtimePolicyScope: input.runtimePolicyScope || null,
+				ecdsaChainTargets
+			}),
+			ecdsaChainTargets
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			code: "invalid_body",
+			message: errorMessage(error) || "registration prepared context is invalid"
+		};
+	}
+}
+function registrationPreparedContextEcdsaChainTargets(preparedContext) {
+	return preparedContext.ecdsa.kind === "evm_family_ecdsa_requested" ? preparedContext.ecdsa.chainTargets : null;
+}
+function registrationSignerBranchesFromPlan(plan) {
+	return {
+		plan,
+		nearEd25519: findRegistrationSignerPlanNearEd25519Branch(plan),
+		evmFamilyEcdsa: findRegistrationSignerPlanEvmFamilyEcdsaBranch(plan)
+	};
+}
+//#endregion
+export { createD1RegistrationRouteTimingRecorder, errorMessage, finishD1RegistrationRouteTiming, registrationIntentSignerBranches, registrationPreparedContextEcdsaChainTargets, registrationSignerBranchesFromPlan, resolveRegistrationPreparedContextFromPlan, startD1RegistrationRouteTiming };
+
+//# sourceMappingURL=d1RegistrationSetupSupport.js.map

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationCommitStore.js

@@ -1,12 +1,12 @@
 import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { parseWalletAuthMethodRecordV2, sameWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { buildWalletSessionCapabilitySubjectsV1 } from "../../../../authorization/domain.js";
 import { parseD1JsonColumn } from "../../../../storage/d1Sql.js";
 import { prepareD1WalletPutSignerStatement, prepareD1WalletPutSubjectStatement } from "../../../../core/d1WalletStore.js";
 import { prepareD1WalletAuthMethodV2PutStatement } from "../../../../core/d1WalletAuthMethodStore.js";
+import { reservePasskeyCredential } from "../../../../core/passkeyCredentialClaims.js";
 import { prepareD1WebAuthnCredentialBindingPutStatement } from "../../../../core/WebAuthnCredentialBindingStore.js";
 import { prepareD1WebAuthnAuthenticatorPutStatement } from "../webauthn/d1WebAuthnStore.js";
 import { prepareD1WalletSessionAuthorityProjectionStatements } from "../authorization/walletSessionAuthorityProjection.js";
@@ -192,11 +192,17 @@ function emailOtpCommitStatements(input) {
 }
 var CloudflareD1WalletRegistrationCommitStore = class {
 	constructor(input) {
+		this.credentialClaims = input.credentialClaims;
 		this.database = input.database;
 		this.scope = normalizeScope(input);
 	}
 	async commit(input) {
 		assertCommitWalletIdentity(input);
+		if (input.authority.kind === "passkey") await reservePasskeyCredential(this.credentialClaims, {
+			walletId: input.authority.walletId,
+			rpId: input.authority.rpId,
+			credentialIdB64u: input.authority.credentialIdB64u
+		});
 		const foundingStatements = await prepareFoundingStatements({
 			database: this.database,
 			scope: this.scope,

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationService.js

@@ -1,12 +1,10 @@
-import { mpcMaterialActivationRefsEqual, parseThresholdEd25519SessionId, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletKeyId, parseWebAuthnCredentialIdB64u } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseDeviceId, parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { mpcMaterialActivationRefsEqual, parseThresholdEd25519SessionId, parseWalletKeyId, parseWebAuthnCredentialIdB64u } from "../../../../shared-ts/src/utils/domainIds.js";
+import { parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, bytesToUnprefixedHex, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import "../../../../shared-ts/src/utils/encoders.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../../shared-ts/src/utils/near.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { buildFullOwnerPermissionsV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { parseEd25519PublicKeyB64u, parseSecp256k1CompressedPublicKeyB64u } from "../../../../shared-ts/src/passkey-custody/primitives.js";
 import { buildExactAdministeredSignerManifestV1 } from "../../../../shared-ts/src/device-linking/delegatedActivationPlan.js";
@@ -14,39 +12,40 @@ import { routerAbMpcMaterialActivationRefFromWire, routerAbMpcMaterialActivation
 import { deriveRouterAbEd25519YaoRuntimePolicyBindingV1 } from "../../../../shared-ts/src/utils/routerAbEd25519YaoDigests.js";
 import { sameRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { ecdsaClientRootPublicKey33B64uFromString } from "../../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
-import { deriveSigningRootId, signingRootScopeFromRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
+import { signingRootScopeFromRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority, walletAuthAuthoritiesMatch } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1, buildRouterAbEcdsaDerivationActiveStateIdV1, buildRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaDerivationNormalSigningStateV1, sameRouterAbEcdsaDerivationNormalSigningStateV1, sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaRegistrationActivationReceiptV1, sameRouterAbEcdsaVerifiedClientActivationFactsV1, sameRouterAbPublicDigest32V1Wire } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { buildWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { buildActiveWalletAuthorityV1, buildWalletSignerActivationSetV1, computeWalletAuthorityDigestB64u, computeWalletSignerActivationSetDigestB64u, extendEcdsaWalletAuthorityWithEd25519, isActiveEcdsaWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
-import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { ROUTER_AB_ED25519_NORMAL_SIGNING_STATE_KIND } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
 import { normalizeThresholdEd25519ParticipantIds } from "../../../../shared-ts/src/threshold/participants.js";
-import { parseEcdsaDerivationPublicIdentity, thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
 import { nearEd25519SigningKeyIdFromString, registrationEd25519AuthorityScopeFromAuthority, walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
-import { registrationPreparationIdFromString } from "../../../../core/types.js";
 import { buildTenantRootIdentityFromAuthenticatedDeploymentV1 } from "../../../../shared-ts/src/tenant-root/tenantRootIdentity.js";
 import { walletCustodyCeremonyCommitPayloadFromWire } from "../../../../shared-ts/src/passkey-custody/ceremonyCommitPayload.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
 import { computeWalletRegistrationSetupDigestB64u, parseWalletRegistrationSetupClaims, verifySignedWalletRegistrationSetup, verifyWalletRegistrationSetupClaims } from "../../../domains/walletRegistration/walletRegistrationSetupPayload.js";
-import { findRegistrationSignerPlanEvmFamilyEcdsaBranch, findRegistrationSignerPlanNearEd25519Branch, registrationNearEd25519BranchKey, registrationSignerPlanFromSelection } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
+import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../../shared-ts/src/utils/near.js";
+import { registrationNearEd25519BranchKey } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
 import { registrationIntentGrantFromString } from "../../../../shared-ts/src/utils/registrationIntent.js";
 import { DEFAULT_WALLET_SESSION_TTL_MS } from "../../../../shared-ts/src/threshold/sessionPolicy.js";
+import { parseEcdsaDerivationPublicIdentity, thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
 import { walletAuthAuthorityFromRegistrationAuthority, walletRegistrationFinalizeAuthMethodFromAuthority } from "../wallet/d1WalletAuthMethodBoundary.js";
 import { buildRouterAbEd25519YaoRegistrationCapabilityRecordV1 } from "../../../domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery.js";
 import { buildRouterAbEd25519YaoProductAdmissionRequestV1, createRouterAbEd25519YaoMaterialActivationRefV1, projectRouterAbEd25519YaoExactWalletSession } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js";
 import { runRouterAbEd25519YaoRegistrationSideEffectV2, throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
 import { buildYaoEd25519WalletSignerRecord, ed25519NearPublicKeyFromBytes, implicitNearAccountIdFromEd25519PublicKeyBytes } from "../ed25519Yao/d1Ed25519YaoWalletSigner.js";
+import { buildStoredWalletRegistrationEvmFamilyEcdsaFinalizedBranch, buildStoredWalletRegistrationNearEd25519YaoAuthorizedBranch, findStoredWalletRegistrationEvmFamilyEcdsaBranch, findStoredWalletRegistrationNearEd25519YaoBranch, replaceStoredWalletRegistrationSignerBranch, storedRegistrationAuthoritiesMatch, verifiedRegistrationCeremonyAuthority } from "../../../../core/RegistrationCeremonyStore.js";
+import { routerAbEcdsaStrictRegistrationRequestBindingJson } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
+import { buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, buildD1WalletRecord, parseWalletIdForIntent, thresholdEcdsaChainTargetsEqual } from "./d1RegistrationCeremonyRecords.js";
 import { deriveThresholdEcdsaKeyHandle } from "../../../../shared-ts/src/utils/thresholdEcdsaKeyHandle.js";
-import { routerAbEcdsaStrictRegistrationFactsBindingJson, routerAbEcdsaStrictRegistrationRequestBindingJson } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
-import { buildStoredWalletRegistrationEvmFamilyEcdsaFinalizedBranch, buildStoredWalletRegistrationEvmFamilyEcdsaPreparedBranch, buildStoredWalletRegistrationNearEd25519YaoAuthorizedBranch, buildStoredWalletRegistrationPreparedContext, findStoredWalletRegistrationEvmFamilyEcdsaBranch, findStoredWalletRegistrationNearEd25519YaoBranch, replaceStoredWalletRegistrationSignerBranch, storedRegistrationAuthoritiesMatch, verifiedRegistrationCeremonyAuthority } from "../../../../core/RegistrationCeremonyStore.js";
-import { buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, buildD1WalletRecord, buildRegistrationIntent, createD1ServerAllocatedWalletId, inferRuntimePolicyScopeFromSigningRoot, normalizeThresholdEcdsaChainTargets, parseWalletIdForIntent, thresholdEcdsaChainTargetsEqual } from "./d1RegistrationCeremonyRecords.js";
-import { resolveTenantRootIdentityV1 } from "../../../domains/tenantRoot/tenantRootIdentityResolution.js";
+import { admitRegistrationReservationHome, completeRegistrationReservation } from "../../../domains/walletRegistration/walletRegistrationReservation.js";
 import { listThresholdEcdsaKeyIdentityTargetsForUser } from "../../../../core/authService/thresholdEcdsaKeyInventory.js";
-import { buildWalletRegistrationSetupSignature, normalizeWalletRegistrationSetupRequest, resolveWalletRegistrationSetupWalletId, storedRespondEd25519DeferredWork, walletRegistrationRespondResult, walletRegistrationSetupError, walletRegistrationSetupExpiresAtMs, walletRegistrationSetupIds, walletRegistrationSetupIntentDigest } from "./d1WalletRegistrationSetup.js";
-import { commitRegistrationCustody } from "../../../domains/passkeyCustody/registrationCustodyOutcome.js";
-import { buildD1EvmFamilyEcdsaRegistrationPrepare } from "./d1EvmFamilyEcdsaRegistrationBranch.js";
 import { routerAbEd25519YaoLifecycleDecisionLookupV1, routerAbEd25519YaoLifecycleDecisionV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoLifecycleDecision.js";
+import { commitRegistrationCustody } from "../../../domains/passkeyCustody/registrationCustodyOutcome.js";
+import { resolveTenantRootIdentityV1 } from "../../../domains/tenantRoot/tenantRootIdentityResolution.js";
+import { createD1RegistrationRouteTimingRecorder, errorMessage, finishD1RegistrationRouteTiming, registrationSignerBranchesFromPlan, startD1RegistrationRouteTiming } from "./d1RegistrationSetupSupport.js";
+import { storedRespondEd25519DeferredWork, walletRegistrationRespondResult } from "./d1WalletRegistrationSetup.js";
+import { executeD1WalletRegistrationSetup } from "./d1WalletRegistrationSetupExecution.js";
 import { projectWalletRegistrationSessionCommitReceiptV2, registrationReplayAuthMethodFields, replayedRegistrationCommit, unissuedRegistrationCommit } from "./walletRegistrationSessionCommitReceipt.js";
 import { assertDirectWalletSessionOwnerProof, buildRegistrationOwnerProof, issueDirectRegistrationEstablishedEcdsaSession, issueDirectRegistrationEstablishedEd25519Session, projectCurrentNearRegistrationSession, replayDirectRegistrationEstablishedEcdsaSession, replayDirectRegistrationEstablishedEd25519Session, walletSessionPrincipalId } from "./walletRegistrationEstablishedSessionIssuer.js";
 //#region src/router/cloudflare/d1/registration/d1WalletRegistrationService.ts
@@ -92,7 +91,7 @@ function sameRouterAbEcdsaRegistrationRequest(left, right) {
 	return routerAbEcdsaStrictRegistrationRequestBindingJson(left) === routerAbEcdsaStrictRegistrationRequestBindingJson(right) && left.client_ephemeral_public_key === right.client_ephemeral_public_key && sameRouterAbEcdsaRegistrationEnvelope(left.deriver_a_envelope, right.deriver_a_envelope) && sameRouterAbEcdsaRegistrationEnvelope(left.deriver_b_envelope, right.deriver_b_envelope);
 }
 function sameEcdsaDerivationServerBootstrap(left, right) {
-	return left.formatVersion === right.formatVersion && left.walletId === right.walletId && left.evmFamilySigningKeySlotId === right.evmFamilySigningKeySlotId && left.ecdsaThresholdKeyId === right.ecdsaThresholdKeyId && left.relayerKeyId === right.relayerKeyId && left.applicationBindingDigestB64u === right.applicationBindingDigestB64u && left.contextBinding32B64u === right.contextBinding32B64u && sameEcdsaDerivationPublicIdentity(left.publicIdentity, right.publicIdentity) && left.clientShareRetryCounter === right.clientShareRetryCounter && left.relayerShareRetryCounter === right.relayerShareRetryCounter && left.publicTranscriptDigest32B64u === right.publicTranscriptDigest32B64u && left.keyHandle === right.keyHandle && left.signingRootId === right.signingRootId && left.signingRootVersion === right.signingRootVersion && left.thresholdEcdsaPublicKeyB64u === right.thresholdEcdsaPublicKeyB64u && left.ethereumAddress === right.ethereumAddress && left.relayerVerifyingShareB64u === right.relayerVerifyingShareB64u && sameEcdsaParticipantIds(left.participantIds, right.participantIds) && left.thresholdSessionId === right.thresholdSessionId && left.activationEpoch === right.activationEpoch && left.expiresAtMs === right.expiresAtMs && left.expiresAt === right.expiresAt && left.remainingUses === right.remainingUses && sameRouterAbEcdsaDerivationNormalSigningStateV1(left.routerAbEcdsaDerivationNormalSigning, right.routerAbEcdsaDerivationNormalSigning);
+	return left.formatVersion === right.formatVersion && left.walletId === right.walletId && left.evmFamilySigningKeySlotId === right.evmFamilySigningKeySlotId && left.ecdsaThresholdKeyId === right.ecdsaThresholdKeyId && left.relayerKeyId === right.relayerKeyId && left.applicationBindingDigestB64u === right.applicationBindingDigestB64u && left.contextBinding32B64u === right.contextBinding32B64u && sameEcdsaDerivationPublicIdentity(left.publicIdentity, right.publicIdentity) && left.clientShareRetryCounter === right.clientShareRetryCounter && left.relayerShareRetryCounter === right.relayerShareRetryCounter && left.keyHandle === right.keyHandle && left.signingRootId === right.signingRootId && left.signingRootVersion === right.signingRootVersion && left.thresholdEcdsaPublicKeyB64u === right.thresholdEcdsaPublicKeyB64u && left.ethereumAddress === right.ethereumAddress && left.relayerVerifyingShareB64u === right.relayerVerifyingShareB64u && sameEcdsaParticipantIds(left.participantIds, right.participantIds) && left.thresholdSessionId === right.thresholdSessionId && left.activationEpoch === right.activationEpoch && left.expiresAtMs === right.expiresAtMs && left.expiresAt === right.expiresAt && left.remainingUses === right.remainingUses && sameRouterAbEcdsaDerivationNormalSigningStateV1(left.routerAbEcdsaDerivationNormalSigning, right.routerAbEcdsaDerivationNormalSigning);
 }
 function linkedEd25519ProjectionMaterialActivationWire(projection) {
 	return routerAbMpcMaterialActivationRefToWire(projection.materialActivation);
@@ -203,14 +202,6 @@ function requirePreparedRegistrationId(result, label) {
 	if (!result.ok) throw new Error(`${label} is invalid: ${result.error.message}`);
 	return result.value;
 }
-function allocateWalletRegistrationOperationPrepared() {
-	return {
-		kind: "d1_wallet_registration_operation_prepared_v1",
-		walletAuthorityId: requirePreparedRegistrationId(parseWalletAuthorityId(`wallet-authority:${secureRandomBase64Url(32)}`), "walletAuthorityId"),
-		deviceId: requirePreparedRegistrationId(parseDeviceId(`device:${secureRandomBase64Url(32)}`), "deviceId"),
-		walletAuthMethodId: requirePreparedRegistrationId(parseWalletAuthMethodId(`wallet-auth-method:${secureRandomBase64Url(32)}`), "walletAuthMethodId")
-	};
-}
 function walletRegistrationOperationPreparedFromCeremony(ceremony) {
 	if (String(ceremony.foundingWalletAuthMethodId) !== String(ceremony.intent.foundingWalletAuthMethodId)) throw new Error("registration ceremony and intent name different founding auth methods");
 	return {
@@ -528,9 +519,6 @@ function ed25519AlreadyCommittedWalletSessionResponse(committed) {
 function registrationWalletAuthAuthority(input) {
 	return walletAuthAuthorityFromRegistrationAuthority(input);
 }
-function errorMessage(error) {
-	return error instanceof Error ? error.message : String(error || "");
-}
 function assertNeverSponsoredNamedNearAccountCreationResult(value) {
 	throw new Error(`Unexpected sponsored NEAR account creation result: ${String(value)}`);
 }
@@ -551,24 +539,6 @@ async function cleanupFinalizedRegistrationCeremony(input) {
 		await input.store.deleteCeremony(input.registrationCeremonyId);
 	} catch {}
 }
-function createD1RegistrationRouteTimingRecorder(route) {
-	return {
-		route,
-		entries: []
-	};
-}
-function startD1RegistrationRouteTiming(name) {
-	return {
-		name,
-		startedAtMs: Date.now()
-	};
-}
-function finishD1RegistrationRouteTiming(recorder, mark) {
-	recorder.entries.push({
-		name: mark.name,
-		durationMs: Math.max(0, Date.now() - mark.startedAtMs)
-	});
-}
 function d1RegistrationRouteDiagnostics(recorder) {
 	return {
 		kind: "wallet_registration_route_diagnostics_v1",
@@ -602,48 +572,6 @@ function hasEcdsaKeyHandleSetMismatch(expectedKeyHandles, actualKeyHandles) {
 	for (const keyHandle of expected) if (!actual.has(keyHandle)) return true;
 	return false;
 }
-function registrationIntentSignerBranches(intent) {
-	const plan = registrationSignerPlanFromSelection(intent.signerSelection);
-	if (!plan.ok) return plan;
-	return {
-		ok: true,
-		value: registrationSignerBranchesFromPlan(plan.value)
-	};
-}
-function registrationSignerBranchesFromPlan(plan) {
-	return {
-		plan,
-		nearEd25519: findRegistrationSignerPlanNearEd25519Branch(plan),
-		evmFamilyEcdsa: findRegistrationSignerPlanEvmFamilyEcdsaBranch(plan)
-	};
-}
-function resolveRegistrationPreparedContextFromPlan(input) {
-	const branches = registrationSignerBranchesFromPlan(input.signerPlan);
-	const ecdsaChainTargets = branches.evmFamilyEcdsa ? normalizeThresholdEcdsaChainTargets(branches.evmFamilyEcdsa.chainTargets) : null;
-	if (branches.evmFamilyEcdsa && !ecdsaChainTargets) return {
-		ok: false,
-		code: "invalid_body",
-		message: "ECDSA registration contains an invalid chain target"
-	};
-	try {
-		return {
-			ok: true,
-			preparedContext: buildStoredWalletRegistrationPreparedContext({
-				signingRootId: input.signingRootId,
-				signingRootVersion: input.signingRootVersion,
-				runtimePolicyScope: input.runtimePolicyScope || null,
-				ecdsaChainTargets
-			}),
-			ecdsaChainTargets
-		};
-	} catch (error) {
-		return {
-			ok: false,
-			code: "invalid_body",
-			message: errorMessage(error) || "registration prepared context is invalid"
-		};
-	}
-}
 function registrationPreparedContextRuntimePolicyScope(preparedContext) {
 	return preparedContext.runtimePolicy.kind === "runtime_policy_scope" ? preparedContext.runtimePolicy.scope : void 0;
 }
@@ -659,9 +587,6 @@ function registrationTenantRootIdentity(preparedContext) {
 	});
 	return identity.ok ? identity.value : null;
 }
-function registrationPreparedContextEcdsaChainTargets(preparedContext) {
-	return preparedContext.ecdsa.kind === "evm_family_ecdsa_requested" ? preparedContext.ecdsa.chainTargets : null;
-}
 /**
 * A verified authority must name the same wallet the intent does. A ceremony
 * still awaiting its proof has no authority to disagree with, so it matches
@@ -837,7 +762,6 @@ async function buildActivatedEcdsaFamilyBootstrap(input) {
 		publicIdentity,
 		clientShareRetryCounter: input.publicFacts.clientShareRetryCounter,
 		relayerShareRetryCounter: identity.server_share_retry_counter,
-		publicTranscriptDigest32B64u: input.publicFacts.proofTranscriptDigestB64u,
 		keyHandle,
 		signingRootId: prepare.signingRootId,
 		signingRootVersion: prepare.signingRootVersion,
@@ -948,6 +872,7 @@ async function recordRegistrationPromiseTiming(args) {
 }
 var CloudflareD1WalletRegistrationService = class {
 	constructor(input) {
+		this.registrationAuthority = input.registrationAuthority;
 		this.authorizationService = input.authorizationService;
 		this.authorizationTenantId = input.authorizationTenantId;
 		this.createSponsoredNamedNearAccount = input.createSponsoredNamedNearAccount;
@@ -1664,148 +1589,12 @@ var CloudflareD1WalletRegistrationService = class {
 			};
 		}
 	}
-	/**
-	* `/wallets/register/setup` — grant, intent, and start in one request, with
-	* one D1 write.
-	*
-	* Setup runs before the client's WebAuthn create, because it issues the
-	* challenge that create signs. So the ECDSA prepare and the Ed25519
-	* admission — the two Router calls that dominated the measured cold path —
-	* overlap the authenticator prompt instead of being serialized after it.
-	* They are started before either is awaited: they share no state and neither
-	* can invalidate the other.
-	*/
 	async setupWalletRegistration(input) {
-		const timing = createD1RegistrationRouteTimingRecorder("wallets_register_setup");
-		const total = startD1RegistrationRouteTiming("registerSetupTotalMs");
-		try {
-			const normalized = normalizeWalletRegistrationSetupRequest(input.request);
-			if (!normalized.ok) return walletRegistrationSetupError(normalized.code, normalized.message);
-			const wallet = resolveWalletRegistrationSetupWalletId({
-				wallet: input.request?.wallet,
-				parseProvided: parseWalletIdForIntent,
-				createServerAllocated: createD1ServerAllocatedWalletId
-			});
-			if (!wallet.ok) return walletRegistrationSetupError(wallet.code, wallet.message);
-			const runtimePolicyScope = input.runtimePolicyScope || inferRuntimePolicyScopeFromSigningRoot({
-				orgId: input.orgId,
-				signingRootId: input.signingRootId,
-				signingRootVersion: input.signingRootVersion
-			});
-			const signingRootId = normalizeOptionalTrimmedString(input.signingRootId) || (runtimePolicyScope ? deriveSigningRootId(runtimePolicyScope) : "");
-			const signingRootVersion = normalizeOptionalTrimmedString(input.signingRootVersion) || runtimePolicyScope?.signingRootVersion || "default";
-			if (!signingRootId) return walletRegistrationSetupError("invalid_body", "registration requires a signing root");
-			const registrationOperation = allocateWalletRegistrationOperationPrepared();
-			const intent = buildRegistrationIntent({
-				walletId: wallet.walletId,
-				authMethod: normalized.authMethod,
-				signerSelection: normalized.signerSelection,
-				foundingWalletAuthMethodId: registrationOperation.walletAuthMethodId,
-				...runtimePolicyScope ? { runtimePolicyScope } : {}
-			});
-			const digestB64u = await walletRegistrationSetupIntentDigest(intent);
-			const branches = registrationIntentSignerBranches(intent);
-			if (!branches.ok) return walletRegistrationSetupError(branches.code, branches.message);
-			const ecdsaBranch = branches.value.evmFamilyEcdsa;
-			const nearEd25519Branch = branches.value.nearEd25519;
-			if (!ecdsaBranch && !nearEd25519Branch) return walletRegistrationSetupError("invalid_body", "registration signer branch is required");
-			const preparedContext = resolveRegistrationPreparedContextFromPlan({
-				signerPlan: branches.value.plan,
-				runtimePolicyScope,
-				signingRootId,
-				signingRootVersion
-			});
-			if (!preparedContext.ok) return walletRegistrationSetupError(preparedContext.code, preparedContext.message);
-			if (ecdsaBranch && !runtimePolicyScope) return walletRegistrationSetupError("invalid_body", "ECDSA registration requires an exact runtime policy scope");
-			const chainTargets = ecdsaBranch ? registrationPreparedContextEcdsaChainTargets(preparedContext.preparedContext) : null;
-			if (ecdsaBranch && !chainTargets) return walletRegistrationSetupError("invalid_body", "ECDSA chain targets are required");
-			const expiresAtMs = walletRegistrationSetupExpiresAtMs(Date.now());
-			const { registrationCeremonyId, registrationPreparationId } = walletRegistrationSetupIds();
-			const ecdsaPrepared = ecdsaBranch && chainTargets && runtimePolicyScope ? await buildD1EvmFamilyEcdsaRegistrationPrepare({
-				registrationPurpose: "wallet_registration",
-				registrationCeremonyId,
-				registrationPreparationId: registrationPreparationIdFromString(registrationPreparationId),
-				walletId: wallet.walletId,
-				signingRootId,
-				signingRootVersion,
-				chainTargets,
-				participantIds: [...ecdsaBranch.participantIds],
-				strictRegistration: this.ecdsaStrictRegistration,
-				runtimePolicyScope
-			}) : null;
-			if (ecdsaPrepared && !ecdsaPrepared.ok) return walletRegistrationSetupError(ecdsaPrepared.code, ecdsaPrepared.message);
-			const storedBranches = [];
-			if (ecdsaPrepared?.ok && ecdsaBranch) storedBranches.push(buildStoredWalletRegistrationEvmFamilyEcdsaPreparedBranch({
-				branchKey: ecdsaBranch.branchKey,
-				ecdsa: {
-					kind: ecdsaPrepared.ecdsa.kind,
-					chainTargets: ecdsaPrepared.ecdsa.chainTargets,
-					prepare: ecdsaPrepared.ecdsa.prepare,
-					strictRegistration: ecdsaPrepared.ecdsa.strictRegistration,
-					strictRegistrationBindingJson: routerAbEcdsaStrictRegistrationFactsBindingJson(ecdsaPrepared.ecdsa.strictRegistration)
-				}
-			}));
-			const ceremony = {
-				registrationCeremonyId,
-				foundingWalletAuthorityId: registrationOperation.walletAuthorityId,
-				foundingDeviceId: registrationOperation.deviceId,
-				foundingWalletAuthMethodId: registrationOperation.walletAuthMethodId,
-				intent,
-				digestB64u,
-				signerPlan: branches.value.plan,
-				preparedContext: preparedContext.preparedContext,
-				orgId: normalizeOptionalTrimmedString(input.orgId) || "",
-				signingRootId,
-				signingRootVersion,
-				...input.expectedOrigin ? { expectedOrigin: input.expectedOrigin } : {},
-				expiresAtMs,
-				authorityState: {
-					kind: "awaiting_proof",
-					authMethod: normalized.authMethod
-				},
-				signerState: {
-					kind: "signer_set_registration",
-					branches: storedBranches
-				}
-			};
-			const ceremonyWriteTiming = startD1RegistrationRouteTiming("registrationCeremonyInsertMs");
-			try {
-				await this.getRegistrationCeremonyIntentStore().putCeremony(ceremony);
-			} finally {
-				finishD1RegistrationRouteTiming(timing, ceremonyWriteTiming);
-			}
-			const { signedSetup } = await buildWalletRegistrationSetupSignature({
-				signer: input.signer,
-				ceremony,
-				expectedOrigin: input.expectedOrigin
-			});
-			finishD1RegistrationRouteTiming(timing, total);
-			const success = {
-				ok: true,
-				registrationCeremonyId,
-				walletId: String(wallet.walletId),
-				walletAuthMethodId: registrationOperation.walletAuthMethodId,
-				registrationIntentDigestB64u: digestB64u,
-				intent,
-				signedSetup
-			};
-			if (!ecdsaPrepared?.ok || !ecdsaBranch) return {
-				...success,
-				kind: "near_ed25519"
-			};
-			return {
-				...success,
-				kind: nearEd25519Branch ? "near_ed25519_and_evm_family_ecdsa" : "evm_family_ecdsa",
-				ecdsa: {
-					kind: ecdsaPrepared.ecdsa.kind,
-					chainTargets: ecdsaPrepared.ecdsa.chainTargets,
-					prepare: ecdsaPrepared.ecdsa.prepare,
-					strictRegistration: ecdsaPrepared.ecdsa.strictRegistration
-				}
-			};
-		} catch (error) {
-			return walletRegistrationSetupError("internal", errorMessage(error) || "Failed to set up wallet registration");
-		}
+		return executeD1WalletRegistrationSetup(input, {
+			reservation: this.registrationAuthority,
+			store: this.getRegistrationCeremonyIntentStore(),
+			ecdsaStrictRegistration: this.ecdsaStrictRegistration
+		});
 	}
 	async authorizeWalletRegistrationNearAdmission(input) {
 		try {
@@ -1847,6 +1636,11 @@ var CloudflareD1WalletRegistrationService = class {
 				code: verifiedSetup.code,
 				message: verifiedSetup.message
 			};
+			const homeAdmission = await admitRegistrationReservationHome(this.registrationAuthority, {
+				ceremonyId: ceremony.registrationCeremonyId,
+				walletId: ceremony.intent.walletId
+			});
+			if (!homeAdmission.ok) return homeAdmission;
 			const registrationBearerToken = normalizeOptionalTrimmedString(input.signedSetup);
 			if (!registrationBearerToken) return {
 				ok: false,
@@ -1940,6 +1734,11 @@ var CloudflareD1WalletRegistrationService = class {
 				code: verifiedSetup.code,
 				message: verifiedSetup.message
 			};
+			const homeAdmission = await admitRegistrationReservationHome(this.registrationAuthority, {
+				ceremonyId: ceremony.registrationCeremonyId,
+				walletId: ceremony.intent.walletId
+			});
+			if (!homeAdmission.ok) return homeAdmission;
 			const registrationBearerToken = normalizeOptionalTrimmedString(input.signedSetup);
 			if (!registrationBearerToken) return {
 				ok: false,
@@ -2103,10 +1902,18 @@ var CloudflareD1WalletRegistrationService = class {
 			})]);
 			mark("ecdsa_respond_router", routerStartedAtMs);
 			if (!strictResult.ok) {
-				if (!strictResult.retryable) await store.cancelTerminalCeremony({
-					registrationCeremonyId: ceremony.registrationCeremonyId,
-					walletId: ceremony.intent.walletId
-				});
+				if (!strictResult.retryable) {
+					const completedHome = await completeRegistrationReservation(this.registrationAuthority, {
+						ceremonyId: ceremony.registrationCeremonyId,
+						walletId: ceremony.intent.walletId,
+						outcome: "cancelled"
+					});
+					if (!completedHome.ok) return completedHome;
+					await store.cancelTerminalCeremony({
+						registrationCeremonyId: ceremony.registrationCeremonyId,
+						walletId: ceremony.intent.walletId
+					});
+				}
 				return {
 					ok: false,
 					code: strictResult.code,
@@ -2565,6 +2372,11 @@ var CloudflareD1WalletRegistrationService = class {
 				code: verified.code,
 				message: verified.message
 			};
+			const homeAdmission = await admitRegistrationReservationHome(this.registrationAuthority, {
+				ceremonyId: verified.claims.registrationCeremonyId,
+				walletId: walletIdFromString(verified.claims.walletId)
+			});
+			if (!homeAdmission.ok) return homeAdmission;
 			const fingerprintStartedAtMs = Date.now();
 			const requestFingerprint = base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
 				version: "wallet_registration_near_provisioning_digest_v1",
@@ -2642,6 +2454,12 @@ var CloudflareD1WalletRegistrationService = class {
 				message: "NEAR provisioning did not establish a Wallet Session",
 				nearProvisioning: { status: "near_failed_retryable" }
 			};
+			const completedHome = await completeRegistrationReservation(this.registrationAuthority, {
+				ceremonyId: input.registrationCeremonyId,
+				walletId: walletIdFromString(committed.walletId),
+				outcome: "established"
+			});
+			if (!completedHome.ok) return completedHome;
 			const cleanup = recordRegistrationPromiseTiming({
 				sink: serverTiming,
 				name: "near_finalize_cleanup",
@@ -2990,6 +2808,11 @@ var CloudflareD1WalletRegistrationService = class {
 				code: verifiedSetup.code,
 				message: verifiedSetup.message
 			};
+			const homeAdmission = await admitRegistrationReservationHome(this.registrationAuthority, {
+				ceremonyId: verifiedSetup.claims.registrationCeremonyId,
+				walletId: walletIdFromString(verifiedSetup.claims.walletId)
+			});
+			if (!homeAdmission.ok) return homeAdmission;
 			const claims = verifiedSetup.claims;
 			const idempotencyKey = normalizeOptionalTrimmedString(input.idempotencyKey);
 			if (!idempotencyKey) return {
@@ -3032,6 +2855,14 @@ var CloudflareD1WalletRegistrationService = class {
 			switch (run.kind) {
 				case "executed":
 				case "exact_replay":
+					if (run.value.response.ok && run.value.response.kind !== "near_ed25519") {
+						const completedHome = await completeRegistrationReservation(this.registrationAuthority, {
+							ceremonyId: claims.registrationCeremonyId,
+							walletId: walletIdFromString(run.value.response.walletId),
+							outcome: "established"
+						});
+						if (!completedHome.ok) return completedHome;
+					}
 					if (run.value.response.ok && run.value.response.kind === "evm_family_ecdsa") await cleanupFinalizedRegistrationCeremony({
 						store: this.getRegistrationCeremonyIntentStore(),
 						registrationCeremonyId: claims.registrationCeremonyId
@@ -3389,7 +3220,6 @@ var CloudflareD1WalletRegistrationService = class {
 						publicIdentity: bootstrap.publicIdentity,
 						clientShareRetryCounter: bootstrap.clientShareRetryCounter,
 						relayerShareRetryCounter: bootstrap.relayerShareRetryCounter,
-						publicTranscriptDigest32B64u: bootstrap.publicTranscriptDigest32B64u,
 						keyHandle: bootstrap.keyHandle,
 						signingRootId: bootstrap.signingRootId,
 						signingRootVersion: bootstrap.signingRootVersion,
@@ -3713,6 +3543,7 @@ var CloudflareD1WalletRegistrationService = class {
 				const sponsoredAccountId = sponsoredNamedRegistrationAccountId(finalizeNearEd25519.accountProvisioning);
 				if (sponsoredAccountId) {
 					const created = await this.createSponsoredNamedNearAccount({
+						walletId: ceremony.intent.walletId,
 						accountId: sponsoredAccountId,
 						publicKey,
 						idempotencyKey: bytesToUnprefixedHex(Uint8Array.from(consumed.activation.result.binding.session_id))