@seams/wallet-server 0.7.3 → 0.9.0

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationSetup.js

@@ -1,11 +1,9 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { normalizeRegistrationAuthMethodInput } from "../../../../shared-ts/src/utils/registrationAuthMethodInput.js";
-import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { thresholdEcdsaChainTargetFromValue } from "../../../../core/thresholdEcdsaChainTarget.js";
-import { computeWalletRegistrationSetupDigestB64u, mintSignedWalletRegistrationSetup } from "../../../domains/walletRegistration/walletRegistrationSetupPayload.js";
 import { normalizeRegistrationSignerPlan, registrationSignerSetSelectionFromPlan } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
 import { computeRegistrationIntentDigestB64u } from "../../../../shared-ts/src/utils/registrationIntent.js";
+import { computeWalletRegistrationSetupDigestB64u, mintSignedWalletRegistrationSetup } from "../../../domains/walletRegistration/walletRegistrationSetupPayload.js";
 //#region src/router/cloudflare/d1/registration/d1WalletRegistrationSetup.ts
 /**
 * `/wallets/register/setup` — one request replacing the bootstrap grant, the
@@ -42,45 +40,6 @@ import { computeRegistrationIntentDigestB64u } from "../../../../shared-ts/src/u
 */
 /** Setup's ceremony lives only as long as an authenticator prompt plausibly takes. */
 const WALLET_REGISTRATION_SETUP_TTL_MS = 10 * 6e4;
-function walletRegistrationSetupIds() {
-	return {
-		registrationCeremonyId: `wrc_${secureRandomBase64Url(32)}`,
-		registrationPreparationId: `regprep_${secureRandomBase64Url(32)}`
-	};
-}
-/**
-* Resolves the wallet id without reserving it.
-*
-* A provided id is taken as given; an absent or server-allocated one is
-* generated. There is no existence pre-check: it cost a serialized read on
-* every registration to catch a collision that the commit-time uniqueness
-* constraint catches anyway, and for a freshly generated random id it could
-* essentially never fire.
-*/
-function resolveWalletRegistrationSetupWalletId(input) {
-	const wallet = input.wallet;
-	if (!wallet || wallet.kind === "server_allocated") return {
-		ok: true,
-		walletId: input.createServerAllocated()
-	};
-	if (wallet.kind === "provided") {
-		const walletId = input.parseProvided(wallet.walletId);
-		if (!walletId) return {
-			ok: false,
-			code: "invalid_body",
-			message: "walletId is required"
-		};
-		return {
-			ok: true,
-			walletId
-		};
-	}
-	return {
-		ok: false,
-		code: "invalid_body",
-		message: "wallet.kind is unsupported"
-	};
-}
 function normalizeWalletRegistrationSetupRequest(request) {
 	const signerPlan = normalizeRegistrationSignerPlan(request?.signerSelection);
 	if (!signerPlan.ok) return signerPlan;
@@ -116,20 +75,17 @@ async function buildWalletRegistrationSetupSignature(input) {
 		signingRootVersion,
 		expectedOrigin: input.expectedOrigin
 	});
-	return {
-		signedSetup: await mintSignedWalletRegistrationSetup(input.signer, {
-			kind: "wallet_registration_setup_v1",
-			registrationCeremonyId: input.ceremony.registrationCeremonyId,
-			walletId: String(input.ceremony.intent.walletId),
-			orgId: input.ceremony.orgId,
-			signingRootId,
-			signingRootVersion,
-			policy: input.ceremony.preparedContext.runtimePolicy,
-			setupDigestB64u,
-			expiresAtMs: input.ceremony.expiresAtMs
-		}),
-		setupDigestB64u
-	};
+	return { signedSetup: await mintSignedWalletRegistrationSetup(input.signer, {
+		kind: "wallet_registration_setup_v1",
+		registrationCeremonyId: input.ceremony.registrationCeremonyId,
+		walletId: String(input.ceremony.intent.walletId),
+		orgId: input.ceremony.orgId,
+		signingRootId,
+		signingRootVersion,
+		policy: input.ceremony.preparedContext.runtimePolicy,
+		setupDigestB64u,
+		expiresAtMs: input.ceremony.expiresAtMs
+	}) };
 }
 async function walletRegistrationSetupIntentDigest(intent) {
 	return await computeRegistrationIntentDigestB64u(intent);
@@ -178,6 +134,6 @@ function walletRegistrationSetupError(code, message) {
 	};
 }
 //#endregion
-export { buildWalletRegistrationSetupSignature, normalizeWalletRegistrationSetupRequest, resolveWalletRegistrationSetupWalletId, storedRespondEd25519DeferredWork, walletRegistrationRespondResult, walletRegistrationSetupError, walletRegistrationSetupExpiresAtMs, walletRegistrationSetupIds, walletRegistrationSetupIntentDigest };
+export { buildWalletRegistrationSetupSignature, normalizeWalletRegistrationSetupRequest, storedRespondEd25519DeferredWork, walletRegistrationRespondResult, walletRegistrationSetupError, walletRegistrationSetupExpiresAtMs, walletRegistrationSetupIntentDigest };
 
 //# sourceMappingURL=d1WalletRegistrationSetup.js.map

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationSetupExecution.js

@@ -0,0 +1,169 @@
+import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
+import { deriveSigningRootId } from "../../../../shared-ts/src/threshold/signingRootScope.js";
+import { registrationPreparationIdFromString } from "../../../../core/types.js";
+import { buildStoredWalletRegistrationEvmFamilyEcdsaPreparedBranch, findStoredWalletRegistrationEvmFamilyEcdsaBranch } from "../../../../core/RegistrationCeremonyStore.js";
+import { routerAbEcdsaStrictRegistrationFactsBindingJson } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
+import { buildRegistrationIntent, inferRuntimePolicyScopeFromSigningRoot } from "./d1RegistrationCeremonyRecords.js";
+import { errorMessage, registrationIntentSignerBranches, registrationPreparedContextEcdsaChainTargets, resolveRegistrationPreparedContextFromPlan } from "./d1RegistrationSetupSupport.js";
+import { buildWalletRegistrationSetupSignature, normalizeWalletRegistrationSetupRequest, walletRegistrationSetupError, walletRegistrationSetupExpiresAtMs, walletRegistrationSetupIntentDigest } from "./d1WalletRegistrationSetup.js";
+import { buildD1EvmFamilyEcdsaRegistrationPrepare } from "./d1EvmFamilyEcdsaRegistrationBranch.js";
+//#region src/router/cloudflare/d1/registration/d1WalletRegistrationSetupExecution.ts
+async function executeD1WalletRegistrationSetup(input, dependencies) {
+	try {
+		const normalized = normalizeWalletRegistrationSetupRequest(input.request);
+		if (!normalized.ok) return walletRegistrationSetupError(normalized.code, normalized.message);
+		if (!dependencies.reservation) return walletRegistrationSetupError("registration_authority_unavailable", "Registration reservation authority is required");
+		const admitted = await dependencies.reservation.reserve(input);
+		if (!admitted.ok) return admitted;
+		const reservation = admitted.reservation;
+		const wallet = { walletId: reservation.walletId };
+		if (input.request.wallet?.kind === "provided" && input.request.wallet.walletId !== wallet.walletId) return walletRegistrationSetupError("reservation_conflict", "Registration reservation changed the requested wallet");
+		const expiresAtMs = walletRegistrationSetupExpiresAtMs(reservation.reservedAtMs);
+		if (Date.now() >= expiresAtMs) return walletRegistrationSetupError("registration_expired", "Registration setup has expired");
+		const [startup, setup] = await Promise.allSettled([dependencies.startRegistrationWallets?.({
+			walletId: wallet.walletId,
+			ownershipGeneration: admitted.ownershipGeneration
+		}), completeReservedRegistrationSetup(input, dependencies, admitted, normalized, expiresAtMs)]);
+		if (setup.status === "rejected") throw setup.reason;
+		if (!setup.value.ok) return setup.value;
+		if (startup.status === "rejected") throw startup.reason;
+		return setup.value;
+	} catch (error) {
+		return walletRegistrationSetupError("internal", errorMessage(error) || "Failed to set up wallet registration");
+	}
+}
+async function completeReservedRegistrationSetup(input, dependencies, admitted, normalized, expiresAtMs) {
+	const reservation = admitted.reservation;
+	const wallet = { walletId: reservation.walletId };
+	const registrationCeremonyId = reservation.ceremonyId;
+	const registrationPreparationId = reservation.preparationId;
+	const runtimePolicyScope = input.runtimePolicyScope || inferRuntimePolicyScopeFromSigningRoot({
+		orgId: input.orgId,
+		signingRootId: input.signingRootId,
+		signingRootVersion: input.signingRootVersion
+	});
+	const signingRootId = normalizeOptionalTrimmedString(input.signingRootId) || (runtimePolicyScope ? deriveSigningRootId(runtimePolicyScope) : "");
+	const signingRootVersion = normalizeOptionalTrimmedString(input.signingRootVersion) || runtimePolicyScope?.signingRootVersion || "default";
+	if (!signingRootId) return walletRegistrationSetupError("invalid_body", "registration requires a signing root");
+	const registrationOperation = reservation;
+	const intent = buildRegistrationIntent({
+		nonceB64u: registrationCeremonyId.slice(4),
+		walletId: wallet.walletId,
+		authMethod: normalized.authMethod,
+		signerSelection: normalized.signerSelection,
+		foundingWalletAuthMethodId: registrationOperation.walletAuthMethodId,
+		...runtimePolicyScope ? { runtimePolicyScope } : {}
+	});
+	const digestB64u = await walletRegistrationSetupIntentDigest(intent);
+	const branches = registrationIntentSignerBranches(intent);
+	if (!branches.ok) return walletRegistrationSetupError(branches.code, branches.message);
+	const existing = admitted.lifecycle === "established" || branches.value.evmFamilyEcdsa ? await dependencies.store.getSetupCeremony(registrationCeremonyId) : null;
+	if (existing) {
+		if (existing.digestB64u !== digestB64u || existing.expectedOrigin !== input.expectedOrigin || existing.foundingWalletAuthorityId !== reservation.walletAuthorityId || existing.foundingDeviceId !== reservation.deviceId || existing.foundingWalletAuthMethodId !== reservation.walletAuthMethodId || existing.expiresAtMs !== expiresAtMs) return walletRegistrationSetupError("reservation_conflict", "Registration setup conflicts with its reservation");
+		if (admitted.lifecycle === "reserved") await dependencies.store.reserveSetupCeremony(existing, admitted.ownershipGeneration);
+		return await setupResponseFromCeremony(input, dependencies.home, existing);
+	}
+	if (admitted.lifecycle === "established") return walletRegistrationSetupError("registration_closed", "Completed registration setup snapshot is unavailable");
+	const ecdsaBranch = branches.value.evmFamilyEcdsa;
+	const nearEd25519Branch = branches.value.nearEd25519;
+	if (!ecdsaBranch && !nearEd25519Branch) return walletRegistrationSetupError("invalid_body", "registration signer branch is required");
+	const preparedContext = resolveRegistrationPreparedContextFromPlan({
+		signerPlan: branches.value.plan,
+		runtimePolicyScope,
+		signingRootId,
+		signingRootVersion
+	});
+	if (!preparedContext.ok) return walletRegistrationSetupError(preparedContext.code, preparedContext.message);
+	if (ecdsaBranch && !runtimePolicyScope) return walletRegistrationSetupError("invalid_body", "ECDSA registration requires an exact runtime policy scope");
+	const chainTargets = ecdsaBranch ? registrationPreparedContextEcdsaChainTargets(preparedContext.preparedContext) : null;
+	if (ecdsaBranch && !chainTargets) return walletRegistrationSetupError("invalid_body", "ECDSA chain targets are required");
+	const ecdsaPrepared = ecdsaBranch && chainTargets && runtimePolicyScope ? await buildD1EvmFamilyEcdsaRegistrationPrepare({
+		registrationPurpose: "wallet_registration",
+		registrationCeremonyId,
+		registrationPreparationId: registrationPreparationIdFromString(registrationPreparationId),
+		walletId: wallet.walletId,
+		signingRootId,
+		signingRootVersion,
+		chainTargets,
+		participantIds: [...ecdsaBranch.participantIds],
+		strictRegistration: dependencies.ecdsaStrictRegistration,
+		runtimePolicyScope
+	}) : null;
+	if (ecdsaPrepared && !ecdsaPrepared.ok) return walletRegistrationSetupError(ecdsaPrepared.code, ecdsaPrepared.message);
+	const storedBranches = [];
+	if (ecdsaPrepared?.ok && ecdsaBranch) storedBranches.push(buildStoredWalletRegistrationEvmFamilyEcdsaPreparedBranch({
+		branchKey: ecdsaBranch.branchKey,
+		ecdsa: {
+			kind: ecdsaPrepared.ecdsa.kind,
+			chainTargets: ecdsaPrepared.ecdsa.chainTargets,
+			prepare: ecdsaPrepared.ecdsa.prepare,
+			strictRegistration: ecdsaPrepared.ecdsa.strictRegistration,
+			strictRegistrationBindingJson: routerAbEcdsaStrictRegistrationFactsBindingJson(ecdsaPrepared.ecdsa.strictRegistration)
+		}
+	}));
+	const ceremony = {
+		registrationCeremonyId,
+		foundingWalletAuthorityId: registrationOperation.walletAuthorityId,
+		foundingDeviceId: registrationOperation.deviceId,
+		foundingWalletAuthMethodId: registrationOperation.walletAuthMethodId,
+		intent,
+		digestB64u,
+		signerPlan: branches.value.plan,
+		preparedContext: preparedContext.preparedContext,
+		orgId: normalizeOptionalTrimmedString(input.orgId) || "",
+		signingRootId,
+		signingRootVersion,
+		...input.expectedOrigin ? { expectedOrigin: input.expectedOrigin } : {},
+		expiresAtMs,
+		authorityState: {
+			kind: "awaiting_proof",
+			authMethod: normalized.authMethod
+		},
+		signerState: {
+			kind: "signer_set_registration",
+			branches: storedBranches
+		}
+	};
+	const stored = await dependencies.store.reserveSetupCeremony(ceremony, admitted.ownershipGeneration);
+	return await setupResponseFromCeremony(input, dependencies.home, stored);
+}
+async function setupResponseFromCeremony(input, home, ceremony) {
+	const { signedSetup } = await buildWalletRegistrationSetupSignature({
+		signer: input.signer,
+		ceremony,
+		expectedOrigin: input.expectedOrigin
+	});
+	const branches = registrationIntentSignerBranches(ceremony.intent);
+	if (!branches.ok) return branches;
+	const success = {
+		home,
+		ok: true,
+		registrationCeremonyId: ceremony.registrationCeremonyId,
+		walletId: String(ceremony.intent.walletId),
+		walletAuthMethodId: ceremony.foundingWalletAuthMethodId,
+		registrationIntentDigestB64u: ceremony.digestB64u,
+		intent: ceremony.intent,
+		signedSetup
+	};
+	if (!branches.value.evmFamilyEcdsa) return {
+		...success,
+		kind: "near_ed25519"
+	};
+	if (ceremony.signerState.kind !== "signer_set_registration") return walletRegistrationSetupError("invalid_state", "Registration setup signer state is invalid");
+	const ecdsa = findStoredWalletRegistrationEvmFamilyEcdsaBranch(ceremony.signerState);
+	if (!ecdsa || ecdsa.kind !== "evm_family_ecdsa_prepared") return walletRegistrationSetupError("invalid_state", "Registration setup snapshot is not prepared");
+	return {
+		...success,
+		kind: branches.value.nearEd25519 ? "near_ed25519_and_evm_family_ecdsa" : "evm_family_ecdsa",
+		ecdsa: {
+			kind: ecdsa.derivationKind,
+			chainTargets: ecdsa.chainTargets,
+			prepare: ecdsa.prepare,
+			strictRegistration: ecdsa.strictRegistration
+		}
+	};
+}
+//#endregion
+export { executeD1WalletRegistrationSetup };
+
+//# sourceMappingURL=d1WalletRegistrationSetupExecution.js.map

package/dist/esm/router/cloudflare/d1/registration/walletRegistrationEstablishedSessionIssuer.js

@@ -4,21 +4,58 @@ import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import "../../../../shared-ts/src/utils/encoders.js";
-import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../../shared-ts/src/utils/near.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { isEmailOtpWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseSessionOrigin, parseVerifiedOwnerProofId } from "../../../../authorization/domain.js";
 import { buildVerifiedOwnerProof, buildVerifiedWalletSessionEmailOtpFactorResult, buildVerifiedWalletSessionPasskeyFactorResult } from "../../../../authorization/factorEvidence.js";
 import { nearEd25519SigningKeyIdFromString, walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
+import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../../shared-ts/src/utils/near.js";
 import { DEFAULT_WALLET_SESSION_TTL_MS } from "../../../../shared-ts/src/threshold/sessionPolicy.js";
 import { deriveThresholdEcdsaKeyHandle } from "../../../../shared-ts/src/utils/thresholdEcdsaKeyHandle.js";
 import { registrationEstablishedMintId } from "./walletRegistrationSessionCommitReceipt.js";
 //#region src/router/cloudflare/d1/registration/walletRegistrationEstablishedSessionIssuer.ts
+async function commitInitialEd25519RegistrationSession(input, commitSession) {
+	const issuedAtMs = Date.now();
+	await assertDirectWalletSessionOwnerProof({
+		proof: input.proof,
+		tenantId: input.authorizationTenantId,
+		authority: input.authority,
+		activeAuthority: input.foundingAuthority,
+		walletAuthMethodId: input.walletAuthMethodId,
+		nowMs: issuedAtMs
+	});
+	const policy = registrationSessionPolicy({
+		issuedAtMs,
+		expiresAtMs: input.expiresAtMs,
+		remainingUses: input.remainingUses
+	});
+	return input.authorizationService.commitDirectWalletSessionAuthorizationV2({
+		tenantId: input.authorizationTenantId,
+		principalId: walletSessionPrincipalId(input.authority),
+		walletId: walletIdFromString(String(input.authority.walletId)),
+		authority: input.foundingAuthority,
+		walletAuthMethodId: input.walletAuthMethodId,
+		mintId: registrationEstablishedMintId(input.registrationCeremonyId),
+		remainingUses: policy.remainingUses,
+		issuedAtMs,
+		expiresAtMs: policy.expiresAtMs
+	}, { kind: "validated_registration_authority_projection" }, {
+		kind: "registration",
+		ceremonyId: input.registrationCeremonyId
+	}, commitSession);
+}
 function requireWalletSessionPrincipalId(value) {
 	const parsed = parsePrincipalId(value);
 	if (!parsed.ok) throw new Error(`Wallet Session principal is invalid: ${parsed.error.message}`);
 	return parsed.value;
 }
+function publishCommittedRegistration(home, committed) {
+	if (!committed.registration) throw new Error("Registration publication requires a committed registration session");
+	return home.publishEstablished({
+		registration: committed.registration,
+		session: committed.publication
+	});
+}
 function walletSessionPrincipalId(authority) {
 	return requireWalletSessionPrincipalId(isEmailOtpWalletAuthAuthority(authority) ? String(authority.factor.providerUserId) : String(authority.walletId));
 }
@@ -229,13 +266,15 @@ function directRegistrationResultFromIssue(input) {
 		case "issued": return {
 			kind: "issued",
 			session: directRegistrationSession(input.authorization, input.tokens, input.directIssue.operationCredential),
-			issuedAtMs: input.authorization.session.createdAtMs
+			issuedAtMs: input.authorization.session.createdAtMs,
+			activation: input.activation
 		};
 		case "already_committed": return {
 			kind: "already_committed",
 			session: projectDirectRegistrationSession(input.authorization, input.tokens),
 			next: input.directIssue.next,
-			issuedAtMs: input.authorization.session.createdAtMs
+			issuedAtMs: input.authorization.session.createdAtMs,
+			activation: input.activation
 		};
 		default: return assertNeverDirectRegistrationIssue(input.directIssue);
 	}
@@ -248,15 +287,13 @@ async function assertDirectWalletSessionOwnerProof(input) {
 	if (input.proof.tenantId !== input.tenantId || input.proof.walletId !== input.authority.walletId || input.proof.principalId !== walletSessionPrincipalId(input.authority) || input.proof.authority.walletId !== authorityRef.walletId || input.proof.authority.authorityDigest !== authorityRef.authorityDigest || input.proof.authority.walletAuthMethodId !== authorityRef.walletAuthMethodId || input.activeAuthority.walletId !== input.authority.walletId || input.activeAuthority.state !== "active" || input.walletAuthMethodId !== authorityRef.walletAuthMethodId || input.proof.verifiedAtMs > input.nowMs || input.proof.expiresAtMs <= input.nowMs) throw new Error("Owner proof does not authorize direct Wallet Session issuance");
 }
 async function issueDirectRegistrationEstablishedEcdsaSession(input) {
-	const activeRegistration = await input.walletAuthMethods.readActiveRegistrationAuthority(input.registrationAuthority);
-	if (!activeRegistration || activeRegistration.authority.walletId !== input.authority.walletId || activeRegistration.walletAuthMethodId !== input.walletAuthMethodId) throw new Error("Registration founding authority is unavailable after commit");
 	const issuedAtMs = Date.now();
 	await assertDirectWalletSessionOwnerProof({
 		proof: input.proof,
 		tenantId: input.authorizationTenantId,
 		authority: input.authority,
-		activeAuthority: activeRegistration.authority,
-		walletAuthMethodId: activeRegistration.walletAuthMethodId,
+		activeAuthority: input.foundingAuthority,
+		walletAuthMethodId: input.walletAuthMethodId,
 		nowMs: issuedAtMs
 	});
 	const policy = registrationSessionPolicy({
@@ -264,17 +301,21 @@ async function issueDirectRegistrationEstablishedEcdsaSession(input) {
 		expiresAtMs: input.expiresAtMs,
 		remainingUses: input.remainingUses
 	});
-	const directIssue = await input.authorizationService.issueDirectWalletSessionAuthorizationV2({
+	const committed = await input.authorizationService.commitDirectWalletSessionAuthorizationV2({
 		tenantId: input.authorizationTenantId,
 		principalId: walletSessionPrincipalId(input.authority),
 		walletId: walletIdFromString(String(input.authority.walletId)),
-		authority: activeRegistration.authority,
-		walletAuthMethodId: activeRegistration.walletAuthMethodId,
+		authority: input.foundingAuthority,
+		walletAuthMethodId: input.walletAuthMethodId,
 		mintId: registrationEstablishedMintId(input.registrationCeremonyId),
 		remainingUses: policy.remainingUses,
 		issuedAtMs,
 		expiresAtMs: policy.expiresAtMs
+	}, { kind: "strict" }, {
+		kind: "registration",
+		ceremonyId: input.registrationCeremonyId
 	});
+	const directIssue = committed.result;
 	let authorization;
 	switch (directIssue.kind) {
 		case "issued":
@@ -288,7 +329,6 @@ async function issueDirectRegistrationEstablishedEcdsaSession(input) {
 				authorizationService: input.authorizationService,
 				authorizationTenantId: input.authorizationTenantId,
 				authority: input.authority,
-				registrationCeremonyId: input.registrationCeremonyId,
 				committed: directIssue
 			});
 			break;
@@ -306,29 +346,29 @@ async function issueDirectRegistrationEstablishedEcdsaSession(input) {
 		runtimePolicyScope: input.runtimePolicyScope,
 		keyHandle
 	});
+	const published = await publishCommittedRegistration(input.homeCompletion, committed);
+	if (!published.ok) throw new Error(published.message);
 	return directRegistrationResultFromIssue({
 		directIssue,
 		authorization,
-		tokens
+		tokens,
+		activation: published.activation
 	});
 }
 async function issueDirectRegistrationEstablishedEd25519Session(input) {
-	const activeRegistration = await input.walletAuthMethods.readActiveRegistrationAuthority(input.registrationAuthority);
-	if (!activeRegistration || activeRegistration.authority.walletId !== input.authority.walletId || activeRegistration.walletAuthMethodId !== input.walletAuthMethodId) throw new Error("Registration founding authority is unavailable after commit");
-	const issuedAtMs = Date.now();
-	await assertDirectWalletSessionOwnerProof({
-		proof: input.proof,
-		tenantId: input.authorizationTenantId,
-		authority: input.authority,
-		activeAuthority: activeRegistration.authority,
-		walletAuthMethodId: activeRegistration.walletAuthMethodId,
-		nowMs: issuedAtMs
-	});
 	if (input.predecessor.kind === "resumed_mixed") {
+		await assertDirectWalletSessionOwnerProof({
+			proof: input.proof,
+			tenantId: input.authorizationTenantId,
+			authority: input.authority,
+			activeAuthority: input.foundingAuthority,
+			walletAuthMethodId: input.walletAuthMethodId,
+			nowMs: Date.now()
+		});
 		const authorization = await input.authorizationService.refreshWalletSessionAuthorizationV2AuthorityProjection({
 			existing: input.predecessor.authorization,
-			authority: activeRegistration.authority,
-			walletAuthMethodId: activeRegistration.walletAuthMethodId
+			authority: input.foundingAuthority,
+			walletAuthMethodId: input.walletAuthMethodId
 		});
 		return {
 			kind: "already_committed",
@@ -340,25 +380,12 @@ async function issueDirectRegistrationEstablishedEd25519Session(input) {
 				predecessor: input.predecessor
 			})),
 			next: "unlock_exact_method",
-			issuedAtMs: authorization.session.createdAtMs
+			issuedAtMs: authorization.session.createdAtMs,
+			activation: null
 		};
 	}
-	const policy = registrationSessionPolicy({
-		issuedAtMs,
-		expiresAtMs: input.expiresAtMs,
-		remainingUses: input.remainingUses
-	});
-	const directIssue = await input.authorizationService.issueDirectRegistrationPromotedWalletSessionAuthorizationV2({
-		tenantId: input.authorizationTenantId,
-		principalId: walletSessionPrincipalId(input.authority),
-		walletId: walletIdFromString(String(input.authority.walletId)),
-		authority: activeRegistration.authority,
-		walletAuthMethodId: activeRegistration.walletAuthMethodId,
-		mintId: registrationEstablishedMintId(input.registrationCeremonyId),
-		remainingUses: policy.remainingUses,
-		issuedAtMs,
-		expiresAtMs: policy.expiresAtMs
-	});
+	const committed = input.initialSession.kind === "committed" ? input.initialSession.value : await commitInitialEd25519RegistrationSession(input);
+	const directIssue = committed.result;
 	let authorization;
 	switch (directIssue.kind) {
 		case "issued":
@@ -372,13 +399,12 @@ async function issueDirectRegistrationEstablishedEd25519Session(input) {
 				authorizationService: input.authorizationService,
 				authorizationTenantId: input.authorizationTenantId,
 				authority: input.authority,
-				registrationCeremonyId: input.registrationCeremonyId,
 				committed: directIssue
 			});
 			authorization = await input.authorizationService.refreshWalletSessionAuthorizationV2AuthorityProjection({
 				existing,
-				authority: activeRegistration.authority,
-				walletAuthMethodId: activeRegistration.walletAuthMethodId
+				authority: input.foundingAuthority,
+				walletAuthMethodId: input.walletAuthMethodId
 			});
 			break;
 		}
@@ -391,10 +417,16 @@ async function issueDirectRegistrationEstablishedEd25519Session(input) {
 		}).ed25519,
 		predecessor: input.predecessor
 	});
+	const [publication, preparation] = await Promise.allSettled([publishCommittedRegistration(input.homeCompletion, committed), input.onSessionCommitted?.(projectDirectRegistrationSession(authorization, tokens))]);
+	if (publication.status === "rejected") throw publication.reason;
+	if (preparation.status === "rejected") throw preparation.reason;
+	const published = publication.value;
+	if (!published.ok) throw new Error(published.message);
 	return directRegistrationResultFromIssue({
 		directIssue,
 		authorization,
-		tokens
+		tokens,
+		activation: published.activation
 	});
 }
 function projectCurrentNearRegistrationSession(authorization, tokens) {
@@ -418,6 +450,6 @@ function replayDirectRegistrationEstablishedEd25519Session(receipt) {
 	};
 }
 //#endregion
-export { assertDirectWalletSessionOwnerProof, buildRegistrationOwnerProof, issueDirectRegistrationEstablishedEcdsaSession, issueDirectRegistrationEstablishedEd25519Session, projectCurrentNearRegistrationSession, replayDirectRegistrationEstablishedEcdsaSession, replayDirectRegistrationEstablishedEd25519Session, walletSessionPrincipalId };
+export { assertDirectWalletSessionOwnerProof, buildRegistrationOwnerProof, commitInitialEd25519RegistrationSession, issueDirectRegistrationEstablishedEcdsaSession, issueDirectRegistrationEstablishedEd25519Session, projectCurrentNearRegistrationSession, replayDirectRegistrationEstablishedEcdsaSession, replayDirectRegistrationEstablishedEd25519Session, walletSessionPrincipalId };
 
 //# sourceMappingURL=walletRegistrationEstablishedSessionIssuer.js.map

package/dist/esm/router/cloudflare/d1/registration/walletRegistrationSessionCommitReceipt.js

@@ -9,6 +9,15 @@ import { hasExactKeys } from "../../../../shared-ts/src/utils/exactKeys.js";
 import { parseWalletCustodyRegistrationOutcome } from "../../../../shared-ts/src/passkey-custody/ceremonyCommitPayload.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
 //#region src/router/cloudflare/d1/registration/walletRegistrationSessionCommitReceipt.ts
+/** The home activation that a commit left for the record that completes its operation. */
+function registrationCommitActivation(execution) {
+	switch (execution.kind) {
+		case "session_issued":
+		case "session_issued_with_installation_projection": return execution.activation;
+		case "unissued":
+		case "replayed": return null;
+	}
+}
 function unissuedRegistrationCommit(response) {
 	return {
 		kind: "unissued",
@@ -59,7 +68,7 @@ function projectWalletRegistrationSessionCommitReceiptV2(input) {
 			}
 		};
 	}
-	if (input.execution.kind === "unissued" || input.execution.kind === "replayed") throw new Error("Registration commit receipt requires an issued or pending response");
+	if (input.execution.kind === "unissued" || input.execution.kind === "replayed") throw new Error("Registration commit receipt requires an issued response");
 	const expectedOrigin = input.execution.expectedOrigin;
 	const metadata = {
 		kind: "wallet_registration_session_commit_receipt_v2",
@@ -72,17 +81,6 @@ function projectWalletRegistrationSessionCommitReceiptV2(input) {
 		expectedOrigin,
 		..."registrationDiagnostics" in response && response.registrationDiagnostics ? { registrationDiagnostics: response.registrationDiagnostics } : {}
 	};
-	if (response.kind === "near_ed25519" && !("registrationEstablishedSession" in response)) {
-		if (input.execution.kind !== "near_pending") throw new Error("Pending registration commit receipt has an issued-session marker");
-		return {
-			...metadata,
-			walletAuthMethodId: response.authority.bindingId,
-			committed: {
-				kind: "near_pending",
-				nearProvisioning: { status: "near_pending" }
-			}
-		};
-	}
 	if (response.kind === "evm_family_ecdsa") {
 		if (!("registrationEstablishedSession" in response)) throw new Error("ECDSA registration commit receipt is missing its session");
 		if (input.execution.kind !== "session_issued" && input.execution.kind !== "session_issued_with_installation_projection") throw new Error("ECDSA registration commit receipt is missing its issue identity");
@@ -235,28 +233,6 @@ function parseWalletRegistrationSessionCommitReceiptV2(raw, parseCommitted) {
 		expectedOrigin,
 		...registrationDiagnostics ? { registrationDiagnostics } : {}
 	};
-	if (committedRecord.kind === "near_pending") {
-		if (operation !== "registration_activate" || !hasExactKeys(record, [
-			"kind",
-			"operation",
-			"operationFingerprint",
-			"registrationCeremonyId",
-			"walletId",
-			"walletAuthMethodId",
-			"authority",
-			"authMethod",
-			"expectedOrigin",
-			...registrationDiagnostics ? ["registrationDiagnostics"] : [],
-			"committed"
-		]) || !hasExactKeys(committedRecord, ["kind", "nearProvisioning"]) || committedRecord.nearProvisioning === null || typeof committedRecord.nearProvisioning !== "object" || Array.isArray(committedRecord.nearProvisioning) || !hasExactKeys(committedRecord.nearProvisioning, ["status"]) || committedRecord.nearProvisioning.status !== "near_pending") return null;
-		return {
-			...common,
-			committed: {
-				kind: "near_pending",
-				nearProvisioning: { status: "near_pending" }
-			}
-		};
-	}
 	if (committedRecord.kind !== "ecdsa_ready" && committedRecord.kind !== "near_ready") return null;
 	if (committedRecord.kind === "ecdsa_ready" && operation !== "registration_activate" || committedRecord.kind === "near_ready" && operation !== "near_provisioning") return null;
 	const foundingAuthority = parseWalletAuthorityV1(record.foundingAuthority);
@@ -478,6 +454,6 @@ function containsPersistedRegistrationCredential(value) {
 	return false;
 }
 //#endregion
-export { parseWalletRegistrationSessionCommitReceiptV2, projectWalletRegistrationSessionCommitReceiptV2, registrationEstablishedMintId, registrationReplayAuthMethodFields, replayedRegistrationCommit, unissuedRegistrationCommit };
+export { parseWalletRegistrationSessionCommitReceiptV2, projectWalletRegistrationSessionCommitReceiptV2, registrationCommitActivation, registrationEstablishedMintId, registrationReplayAuthMethodFields, replayedRegistrationCommit, unissuedRegistrationCommit };
 
 //# sourceMappingURL=walletRegistrationSessionCommitReceipt.js.map