@seams/wallet-server 0.7.3 → 0.9.0

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationCeremonyRecords.d.ts

@@ -1,27 +1,26 @@
-import type { WalletRegistrationFinalizeSuccess } from '../../../../core/registrationContracts';
+import { deriveEvmFamilySigningKeySlotId } from '../../../../../../shared-ts/src/signing-lanes';
 import { type EcdsaClientRootPublicKey33B64u } from '../../../../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap';
+import type { RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
+import { type WalletAuthMethodId } from '../../../../../../shared-ts/src/utils/domainIds';
+import { type AddAuthMethodInput, type RegistrationAuthMethodInput } from '../../../../../../shared-ts/src/utils/registrationAuthMethodInput';
 import { type AddAuthMethodIntentCallerV1, type AddAuthMethodIntentV1, type AddSignerIntentV1, type RegistrationIntentV1, type RuntimePolicyScopeLike, type WalletId } from '../../../../../../shared-ts/src/utils/registrationIntent';
-import { type ServerAllocatedWalletId } from '../../../../../../shared-ts/src/utils/registrationIds';
 import { type AddSignerSelection, type RegistrationSignerSetSelection } from '../../../../../../shared-ts/src/utils/registrationSignerPlan';
-import { type AddAuthMethodInput, type RegistrationAuthMethodInput } from '../../../../../../shared-ts/src/utils/registrationAuthMethodInput';
-import { type WalletAuthMethodId } from '../../../../../../shared-ts/src/utils/domainIds';
-import type { RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
-import { deriveEvmFamilySigningKeySlotId } from '../../../../../../shared-ts/src/signing-lanes';
+import type { WalletRegistrationFinalizeSuccess } from '../../../../core/registrationContracts';
 import { type RouterAbEcdsaDerivationPublicCapabilityV1, type RouterAbEcdsaRegistrationActivationReceiptV1 } from '../../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
-import type { EcdsaDerivationServerBootstrapResponse } from '../../../../core/types';
+import { type WalletEcdsaSignerRecord, type WalletRecord } from '../../../../core/d1WalletStore';
+import { StoredAddAuthMethodIntent, StoredAddSignerIntent, StoredWalletAddAuthMethodCeremony, StoredWalletAddAuthMethodFinalizeReplay, StoredWalletAddSignerCeremony, StoredWalletAddSignerFinalizeReplay, StoredWalletRegistrationCeremony } from '../../../../core/RegistrationCeremonyStore';
+import type { WalletAddSignerFinalizeResponse, WalletRegistrationEcdsaWalletKey } from '../../../../core/registrationContracts';
 import type { WalletRegistrationCommittedInstallationProjectionV1 } from '../../../../core/threeRouteRegistrationContracts';
-import type { WalletRegistrationEcdsaWalletKey, WalletAddSignerFinalizeResponse } from '../../../../core/registrationContracts';
-import { StoredAddAuthMethodIntent, StoredAddSignerIntent, StoredWalletAddAuthMethodCeremony, StoredWalletAddSignerCeremony, StoredWalletAddSignerFinalizeReplay, StoredWalletAddAuthMethodFinalizeReplay, StoredWalletRegistrationCeremony } from '../../../../core/RegistrationCeremonyStore';
 import { type ThresholdEcdsaChainTarget } from '../../../../core/thresholdEcdsaChainTarget';
-import { type WalletEcdsaSignerRecord, type WalletRecord } from '../../../../core/d1WalletStore';
+import type { EcdsaDerivationServerBootstrapResponse } from '../../../../core/types';
 type D1WalletRegistrationFinalizeReplaySuccess = WalletRegistrationFinalizeSuccess;
-export declare function createD1ServerAllocatedWalletId(): ServerAllocatedWalletId;
 export declare function inferRuntimePolicyScopeFromSigningRoot(input: {
     readonly orgId: string;
     readonly signingRootId?: string;
     readonly signingRootVersion?: string;
 }): RuntimePolicyScope | undefined;
 export declare function buildRegistrationIntent(input: {
+    readonly nonceB64u: string;
     readonly walletId: WalletId;
     readonly authMethod: RegistrationAuthMethodInput;
     readonly signerSelection: RegistrationSignerSetSelection;

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationCeremonyStore.d.ts

@@ -1,4 +1,4 @@
-import type { D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import type { D1PreparedStatementLike, D1ResultLike } from '../../../../storage/tenantRoute';
 import { StoredAddAuthMethodIntent, StoredAddSignerIntent, StoredWalletAddAuthMethodCeremony, StoredWalletAddSignerCeremony, StoredWalletAddSignerFinalizeReplay, StoredWalletAddAuthMethodFinalizeReplay, StoredWalletRegistrationCeremony, type StoredWalletRegistrationEvmFamilyEcdsaActivationClaimedBranch, type StoredWalletRegistrationEvmFamilyEcdsaResponseClaimedBranch, type TerminalRegistrationCeremonyCancellationResult } from '../../../../core/RegistrationCeremonyStore';
 import type { WalletId } from '../../../../core/registrationContracts';
 import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
@@ -13,11 +13,21 @@ type D1WalletRegistrationEcdsaCeremonyClaimV1 = {
     readonly ceremony: StoredWalletRegistrationCeremony;
     readonly version: number;
 };
+type D1WalletRegistrationCeremonyCommitV1 = {
+    readonly expected: D1WalletRegistrationEcdsaCeremonyClaimV1;
+    readonly next: StoredWalletRegistrationCeremony;
+};
 export declare class CloudflareD1RegistrationCeremonyIntentStore {
+    private readonly input;
     private readonly storage;
     constructor(input: RegistrationCeremonyIntentStoreConfig);
-    putCeremony(ceremony: StoredWalletRegistrationCeremony): Promise<void>;
+    getSetupCeremony(ceremonyId: string): Promise<StoredWalletRegistrationCeremony | null>;
+    /** One batch stores the setup snapshot, ceremony, and authenticated execution identity. */
+    reserveSetupCeremony(proposed: StoredWalletRegistrationCeremony, ownershipGeneration: number): Promise<StoredWalletRegistrationCeremony>;
     getCeremony(registrationCeremonyId: string): Promise<StoredWalletRegistrationCeremony | null>;
+    prepareCeremonyRead(registrationCeremonyId: string): D1PreparedStatementLike;
+    parseCeremonyRead(registrationCeremonyId: string, result: D1ResultLike<Record<string, unknown>>): Promise<StoredWalletRegistrationCeremony | null>;
+    parseCeremonySnapshotRead(registrationCeremonyId: string, result: D1ResultLike<Record<string, unknown>>): Promise<D1WalletRegistrationEcdsaCeremonyClaimV1 | null>;
     getCeremonySnapshot(registrationCeremonyId: string): Promise<D1WalletRegistrationEcdsaCeremonyClaimV1 | null>;
     updateCeremony(input: {
         readonly expected: StoredWalletRegistrationCeremony;
@@ -37,11 +47,11 @@ export declare class CloudflareD1RegistrationCeremonyIntentStore {
         readonly activationRequestDigestB64u: string;
         readonly activationOwner: string;
     }): Promise<D1WalletRegistrationEcdsaCeremonyClaimV1 | null>;
-    commitEcdsaClaim(input: {
-        readonly expected: D1WalletRegistrationEcdsaCeremonyClaimV1;
-        readonly next: StoredWalletRegistrationCeremony;
-    }): Promise<void>;
-    takeCeremony(registrationCeremonyId: string): Promise<StoredWalletRegistrationCeremony | null>;
+    commitEcdsaClaim(input: D1WalletRegistrationCeremonyCommitV1): Promise<void>;
+    /** `commitEcdsaClaim` as statements for a batch that another store owns on this database. */
+    prepareEcdsaClaimCommit(input: D1WalletRegistrationCeremonyCommitV1): {
+        readonly statements: readonly D1PreparedStatementLike[];
+    };
     deleteCeremony(registrationCeremonyId: string): Promise<boolean>;
     cancelTerminalCeremony(input: {
         readonly registrationCeremonyId: string;

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationSessionTransaction.d.ts

@@ -0,0 +1,13 @@
+import type { D1Row } from '../../../../storage/d1Sql';
+import type { D1DatabaseLike, D1PreparedStatementLike, D1ResultLike } from '../../../../storage/tenantRoute';
+import type { D1RegistrationCommitBatch } from './d1WalletRegistrationCommitStore';
+/** The wallet's version checks and the session's winner read share one batch. */
+export declare class D1RegistrationSessionTransaction {
+    private readonly database;
+    private readonly commitWallet;
+    private sessionResults;
+    constructor(database: D1DatabaseLike, commitWallet: (executeBatch: D1RegistrationCommitBatch) => Promise<void>);
+    execute(sessionStatements: readonly D1PreparedStatementLike[]): Promise<readonly D1ResultLike<D1Row>[]>;
+    private commit;
+}
+//# sourceMappingURL=d1RegistrationSessionTransaction.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationSetupSupport.d.ts

@@ -0,0 +1,58 @@
+import { type RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
+import { type RegistrationIntentV1 } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import { type RegistrationEvmFamilyEcdsaSignerPlan, type RegistrationNearEd25519SignerPlan, type RegistrationSignerPlan } from '../../../../../../shared-ts/src/utils/registrationSignerPlan';
+import { type StoredWalletRegistrationPreparedContext } from '../../../../core/RegistrationCeremonyStore';
+import { type WalletRegistrationRouteDiagnostics, type WalletRegistrationRouteTimingName } from '../../../../core/registrationContracts';
+import { type ThresholdEcdsaChainTarget } from '../../../../core/thresholdEcdsaChainTarget';
+export declare function errorMessage(error: unknown): string;
+export declare function startD1RegistrationRouteTiming(name: WalletRegistrationRouteTimingName): D1RegistrationRouteTimingMark;
+export declare function finishD1RegistrationRouteTiming(recorder: D1RegistrationRouteTimingRecorder, mark: D1RegistrationRouteTimingMark): void;
+export declare function createD1RegistrationRouteTimingRecorder(route: WalletRegistrationRouteDiagnostics['route']): D1RegistrationRouteTimingRecorder;
+export declare function registrationIntentSignerBranches(intent: RegistrationIntentV1): RegistrationIntentSignerBranchesResult;
+export declare function resolveRegistrationPreparedContextFromPlan(input: {
+    readonly signerPlan: RegistrationSignerPlan;
+    readonly runtimePolicyScope: RuntimePolicyScope | undefined;
+    readonly signingRootId: string;
+    readonly signingRootVersion: string;
+}): RegistrationPreparedContextResolution;
+export declare function registrationPreparedContextEcdsaChainTargets(preparedContext: StoredWalletRegistrationPreparedContext): readonly ThresholdEcdsaChainTarget[] | null;
+type D1RegistrationRouteTimingMark = {
+    readonly name: WalletRegistrationRouteTimingName;
+    readonly startedAtMs: number;
+};
+export type D1RegistrationRouteTimingRecorder = {
+    readonly route: WalletRegistrationRouteDiagnostics['route'];
+    readonly entries: WalletRegistrationRouteDiagnostics['entries'];
+};
+type RegistrationIntentSignerBranchesResult = {
+    ok: true;
+    value: RegistrationIntentSignerBranches;
+} | {
+    ok: false;
+    code: string;
+    message: string;
+};
+export declare function registrationSignerBranchesFromPlan(plan: RegistrationSignerPlan): RegistrationIntentSignerBranches;
+type RegistrationPreparedContextResolution = {
+    ok: true;
+    preparedContext: StoredWalletRegistrationPreparedContext;
+    ecdsaChainTargets: readonly ThresholdEcdsaChainTarget[] | null;
+} | {
+    ok: false;
+    code: 'invalid_body';
+    message: string;
+};
+type RegistrationIntentSignerBranches = {
+    readonly plan: RegistrationSignerPlan;
+    readonly nearEd25519: RegistrationNearEd25519SignerPlan | null;
+    readonly evmFamilyEcdsa: RegistrationEvmFamilyEcdsaSignerPlan | null;
+};
+export declare function recordRegistrationServerTiming(sink: Array<readonly [string, number]>, name: string, startedAtMs: number): void;
+export declare function recordRegistrationPromiseTiming<T>(args: {
+    readonly sink: Array<readonly [string, number]>;
+    readonly name: string;
+    readonly startedAtMs: number;
+    readonly promise: T | Promise<T>;
+}): Promise<T>;
+export {};
+//# sourceMappingURL=d1RegistrationSetupSupport.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletExecutionAuthority.d.ts

@@ -0,0 +1,41 @@
+import { type D1TenantScope } from '../../../../core/d1TenantStore';
+import type { D1DatabaseLike, D1ResultLike } from '../../../../storage/tenantRoute';
+import type { RegistrationEstablishedPublication, WalletExecutionAuthority, WalletRegistrationHomeAuthority, WalletRegistrationReservationAuthority } from '../../../domains/walletRegistration/walletRegistrationReservation';
+type Authority = WalletRegistrationReservationAuthority;
+type HomeAdmission = Awaited<ReturnType<Authority['admitHome']>>;
+type OrdinaryAdmission = Awaited<ReturnType<WalletExecutionAuthority['admitEstablishedHome']>>;
+type RegistrationHomeRow = {
+    readonly generation: number;
+    readonly state: string;
+    readonly registration_completion: string;
+    readonly relocation_blocked: number;
+};
+export declare class D1WalletExecutionAuthority implements WalletRegistrationHomeAuthority, WalletExecutionAuthority {
+    private readonly database;
+    private readonly scope;
+    private readonly registration;
+    constructor(database: D1DatabaseLike, scope: D1TenantScope, registration: Authority);
+    reserve(input: Parameters<Authority['reserve']>[0]): Promise<import("../../../domains/walletRegistration/walletRegistrationReservation").WalletRegistrationSetupReservationResult>;
+    admitHome(input: Parameters<Authority['admitHome']>[0]): Promise<HomeAdmission>;
+    prepareHomeRead(input: Parameters<Authority['admitHome']>[0]): import("../../../cloudflare-adaptor").D1PreparedStatementLike;
+    admitHomeRead(input: Parameters<Authority['admitHome']>[0], result: D1ResultLike<Partial<Record<keyof RegistrationHomeRow, unknown>>>): Promise<HomeAdmission>;
+    cancel(input: Parameters<WalletRegistrationHomeAuthority['cancel']>[0]): Promise<{
+        readonly ok: true;
+    } | {
+        readonly ok: false;
+        readonly code: string;
+        readonly message: string;
+    }>;
+    publishEstablished(input: Parameters<WalletRegistrationHomeAuthority['publishEstablished']>[0]): Promise<RegistrationEstablishedPublication>;
+    private fixCancellation;
+    /** The state update with its guard. The guard reads the row count of the update before it. */
+    private prepareState;
+    admitEstablishedHome(input: Parameters<WalletExecutionAuthority['admitEstablishedHome']>[0]): Promise<OrdinaryAdmission>;
+}
+/** Records the authenticated reservation beside setup without reopening a retired home. */
+export declare function prepareD1RegistrationHomeReservation(database: D1DatabaseLike, scope: D1TenantScope, input: Parameters<Authority['admitHome']>[0] & {
+    readonly ownershipGeneration: number;
+}): import("../../../cloudflare-adaptor").D1PreparedStatementLike[];
+export declare function admitD1EstablishedWalletHome(database: D1DatabaseLike, scope: D1TenantScope, input: Parameters<WalletExecutionAuthority['admitEstablishedHome']>[0]): Promise<OrdinaryAdmission>;
+export {};
+//# sourceMappingURL=d1WalletExecutionAuthority.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletOperationStore.d.ts

@@ -0,0 +1,28 @@
+import type { WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
+import type { VersionedJsonRecordPutResult } from '../../../framework/versionedJsonRecordStore';
+import type { D1PreparedStatementLike, D1ResultLike } from '../../../../storage/tenantRoute';
+import { type CloudflareD1VersionedJsonRecordStoreOptions } from '../versionedJson/d1VersionedJsonRecordStore';
+type WalletOperation = {
+    readonly kind: 'router_ab_ed25519_yao_registration_side_effect_claim_v1' | 'router_ab_ed25519_yao_registration_side_effect_completion_v1' | 'router_ab_ed25519_yao_registration_side_effect_completion_v2';
+};
+export declare class D1WalletOperationStore<T extends WalletOperation> {
+    private readonly options;
+    private readonly walletId;
+    private readonly records;
+    private readonly activity;
+    constructor(options: CloudflareD1VersionedJsonRecordStoreOptions<T>, walletId: (record: T) => WalletId);
+    read(key: string): Promise<import("../../../cloudflare-adaptor").VersionedJsonRecordReadResult<T>>;
+    prepareRead(key: string): D1PreparedStatementLike;
+    parseReadResult(result: D1ResultLike<Record<string, unknown>>): import("../../../cloudflare-adaptor").VersionedJsonRecordReadResult<T>;
+    listByKeyPrefix(key: string, options?: {
+        readonly limit?: number;
+    }): Promise<readonly import("../versionedJson/d1VersionedJsonRecordStore").CloudflareD1VersionedJsonRecordReadManyEntryV1<T>[]>;
+    put(key: string, value: T, expectedVersion: string | null): Promise<VersionedJsonRecordPutResult>;
+    /** As `put`, with another store's write on this database in the same batch. */
+    putWithCompanion(key: string, value: T, expectedVersion: string | null, companionWrite: {
+        readonly statements: readonly D1PreparedStatementLike[];
+    }): Promise<VersionedJsonRecordPutResult>;
+    private commit;
+}
+export {};
+//# sourceMappingURL=d1WalletOperationStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationCommitStore.d.ts

@@ -1,9 +1,12 @@
+import { type PasskeyCredentialClaims } from '../../../../core/passkeyCredentialClaims';
 import type { ActiveWalletAuthorityV1 } from '../../../../../../shared-ts/src/authorization/walletAuthority';
 import { type ActiveWalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
 import { type RegistrationAuthority } from '../../../../../../shared-ts/src/utils/registrationAuthMethodInput';
 import type { WalletRecord, WalletSignerRecord } from '../../../../core/WalletStore';
-import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import type { D1DatabaseLike, D1PreparedStatementLike, D1ResultLike } from '../../../../storage/tenantRoute';
 import type { D1EmailOtpRegistrationCommitPlan } from '../emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer';
+export type D1RegistrationCommitBatch = (statements: readonly D1PreparedStatementLike[]) => Promise<readonly D1ResultLike[]>;
+type ReservedWalletRegistrationCommit = (input: D1WalletRegistrationCommitInput, executeBatch?: D1RegistrationCommitBatch) => Promise<void>;
 type D1WalletRegistrationCommitBase = {
     readonly wallet: WalletRecord;
     readonly walletSigners: readonly WalletSignerRecord[];
@@ -23,31 +26,28 @@ type D1WalletRegistrationFoundingFields = {
 };
 type D1WalletRegistrationCommitInput = (D1WalletRegistrationCommitBase & D1WalletRegistrationFoundingFields & {
     readonly kind: 'passkey_wallet_registration_commit_v1';
-    readonly authority: Extract<RegistrationAuthority, {
-        readonly kind: 'passkey';
-    }>;
     readonly emailOtp?: never;
 }) | (D1WalletRegistrationCommitBase & D1WalletRegistrationFoundingFields & {
     readonly kind: 'email_otp_wallet_registration_commit_v1';
-    readonly authority: Extract<RegistrationAuthority, {
-        readonly kind: 'email_otp';
-    }>;
     readonly emailOtp: D1EmailOtpRegistrationCommitPlan;
 });
 export interface D1WalletRegistrationCommitStore {
-    commit(input: D1WalletRegistrationCommitInput): Promise<void>;
+    reserveAuthority(authority: RegistrationAuthority): Promise<ReservedWalletRegistrationCommit>;
 }
 export declare class CloudflareD1WalletRegistrationCommitStore implements D1WalletRegistrationCommitStore {
     private readonly database;
     private readonly scope;
+    private readonly credentialClaims;
     constructor(input: {
+        readonly credentialClaims?: PasskeyCredentialClaims;
         readonly database: D1DatabaseLike;
         readonly namespace: string;
         readonly orgId: string;
         readonly projectId: string;
         readonly envId: string;
     });
-    commit(input: D1WalletRegistrationCommitInput): Promise<void>;
+    reserveAuthority(authority: RegistrationAuthority): Promise<ReservedWalletRegistrationCommit>;
+    private commit;
 }
 export {};
 //# sourceMappingURL=d1WalletRegistrationCommitStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationInitialSession.d.ts

@@ -0,0 +1,17 @@
+import type { CloudflareD1AuthorizationStore } from '../authorization/d1AuthorizationStore';
+import type { D1WalletRegistrationCommitStore } from './d1WalletRegistrationCommitStore';
+import { commitInitialEd25519RegistrationSession, type RegistrationInitialSessionCommit } from './walletRegistrationEstablishedSessionIssuer';
+export type RegistrationSessionTransactionStore = Pick<CloudflareD1AuthorizationStore, 'commitRegistrationWalletSessionAuthorizationV2'>;
+export type RegistrationInitialSessionPlan = {
+    readonly kind: 'separate';
+    readonly store?: never;
+    readonly request?: never;
+} | {
+    readonly kind: 'initial_near';
+    readonly store: RegistrationSessionTransactionStore;
+    readonly request: Omit<Parameters<typeof commitInitialEd25519RegistrationSession>[0], 'foundingAuthority'>;
+};
+type ReservedWalletCommit = Awaited<ReturnType<D1WalletRegistrationCommitStore['reserveAuthority']>>;
+export declare function commitWalletRegistration(commitWallet: ReservedWalletCommit, input: Parameters<ReservedWalletCommit>[0], session: RegistrationInitialSessionPlan): Promise<RegistrationInitialSessionCommit>;
+export {};
+//# sourceMappingURL=d1WalletRegistrationInitialSession.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationPreparation.d.ts

@@ -0,0 +1,12 @@
+import type { DeviceId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
+import type { WalletAuthMethodId, WalletAuthorityId, WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
+import type { StoredWalletRegistrationCeremony } from '../../../../core/RegistrationCeremonyStore';
+export type D1WalletRegistrationOperationPreparedV1 = {
+    readonly kind: 'd1_wallet_registration_operation_prepared_v1';
+    readonly walletId: WalletId;
+    readonly walletAuthorityId: WalletAuthorityId;
+    readonly deviceId: DeviceId;
+    readonly walletAuthMethodId: WalletAuthMethodId;
+};
+export declare function walletRegistrationOperationPreparedFromCeremony(ceremony: StoredWalletRegistrationCeremony, allocated: D1WalletRegistrationOperationPreparedV1 | null): D1WalletRegistrationOperationPreparedV1;
+//# sourceMappingURL=d1WalletRegistrationPreparation.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationRead.d.ts

@@ -0,0 +1,43 @@
+import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
+import type { WalletRegistrationHomeAuthority } from '../../../domains/walletRegistration/walletRegistrationReservation';
+import type { CloudflareD1RegistrationCeremonyIntentStore } from './d1RegistrationCeremonyStore';
+import type { D1WalletExecutionAuthority } from './d1WalletExecutionAuthority';
+import type { D1WalletOperationStore } from './d1WalletOperationStore';
+import type { D1WalletRegistrationNearProvisioningSideEffectRecord } from './d1WalletRegistrationService';
+import type { CloudflareD1Ed25519YaoLifecycleDecisionStoreV1 } from '../ed25519Yao/d1Ed25519YaoLifecycleDecisionStore';
+/** Read admission and immutable finalization state from one D1 snapshot. */
+export declare class D1WalletRegistrationRead {
+    private readonly database;
+    private readonly authority;
+    readonly operations: D1WalletOperationStore<D1WalletRegistrationNearProvisioningSideEffectRecord>;
+    private readonly getCeremonies;
+    private readonly decisions;
+    constructor(database: D1DatabaseLike, authority: D1WalletExecutionAuthority | null, operations: D1WalletOperationStore<D1WalletRegistrationNearProvisioningSideEffectRecord>, getCeremonies: () => CloudflareD1RegistrationCeremonyIntentStore, decisions: CloudflareD1Ed25519YaoLifecycleDecisionStoreV1);
+    readRespond(home: Parameters<WalletRegistrationHomeAuthority['admitHome']>[0]): Promise<{
+        readonly ok: false;
+        readonly code: string;
+        readonly message: string;
+        readonly ownershipGeneration?: never;
+        readonly purpose?: never;
+    } | {
+        ok: true;
+        ownershipGeneration: number;
+        snapshot: {
+            readonly ceremony: import("../../../../core/RegistrationCeremonyStore").StoredWalletRegistrationCeremony;
+            readonly version: number;
+        } | null;
+    }>;
+    readFinalization(home: Parameters<WalletRegistrationHomeAuthority['admitHome']>[0], operationKey: string): Promise<{
+        readonly ok: false;
+        readonly code: string;
+        readonly message: string;
+        readonly ownershipGeneration?: never;
+        readonly purpose?: never;
+    } | {
+        ok: true;
+        operation: import("../../../cloudflare-adaptor").VersionedJsonRecordReadResult<D1WalletRegistrationNearProvisioningSideEffectRecord>;
+        decision: import("../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoLifecycleDecision").RouterAbEd25519YaoLifecycleDecisionV1 | null;
+        readCeremony: () => Promise<import("../../../../core/RegistrationCeremonyStore").StoredWalletRegistrationCeremony | null>;
+    }>;
+}
+//# sourceMappingURL=d1WalletRegistrationRead.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationService.d.ts

@@ -1,39 +1,45 @@
-import type { EcdsaMaterialActivationReadInput } from '../../../../core/d1EcdsaSignerRead';
-import type { EcdsaMaterialReadSnapshot } from '../../../../core/ecdsaMaterialReadSnapshot';
-import type { InstalledEcdsaCustodySnapshotV1 } from '../deviceLinking/d1LinkedDeviceAuthorityInstallService';
-import type { VerifiedNearRegistrationContinuationV1 } from '../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationIntentAuthorization';
-import { type DeviceId, type TenantId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
-import type { AuthorizationService } from '../../../../authorization/service';
-import { type WalletId } from '../../../../../../shared-ts/src/utils/registrationIntent';
-import type { RouterAbTraceContextV1 } from '../../../../../../shared-ts/src/utils/routerAbTraceContext';
-import { type RouterAbMpcMaterialActivationRefWire } from '../../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
-import { type RouterAbEd25519YaoExportAuthorizationIdentityV1 } from '../../../../../../shared-ts/src/utils/routerAbEd25519Yao';
+import type { WalletSessionHome } from '../../../../../../shared-ts/src/device-linking/contracts';
+import type { SponsoredNamedNearAccountInput } from '../near/d1SponsoredNearAccount';
+import { type TenantId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
+import { type RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
 import type { DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
 import { type MpcMaterialActivationRef, type WalletAuthMethodId, type WalletAuthorityId } from '../../../../../../shared-ts/src/utils/domainIds';
-import { type RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
-import { type EcdsaDerivationServerBootstrapResponse } from '../../../../core/types';
-import { type RouterAbEcdsaDerivationNormalSigningStateV1, type RouterAbEcdsaDerivationActivationRefreshForwardedResponseV1, type RouterAbEcdsaDerivationActivationRefreshRequestV1, type RouterAbEcdsaPostRegistrationSessionActivationRequestV1, type RouterAbEcdsaRegistrationActivationReceiptV1, type RouterAbEcdsaRegistrationRequestFactsV1, type RouterAbEcdsaVerifiedClientActivationFactsV1 } from '../../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
+import { type WalletId } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import { type RouterAbEcdsaDerivationActivationRefreshForwardedResponseV1, type RouterAbEcdsaDerivationActivationRefreshRequestV1, type RouterAbEcdsaDerivationNormalSigningStateV1, type RouterAbEcdsaPostRegistrationSessionActivationRequestV1, type RouterAbEcdsaRegistrationActivationReceiptV1, type RouterAbEcdsaRegistrationRequestFactsV1, type RouterAbEcdsaVerifiedClientActivationFactsV1 } from '../../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
+import { type RouterAbEd25519YaoExportAuthorizationIdentityV1 } from '../../../../../../shared-ts/src/utils/routerAbEd25519Yao';
+import { type RouterAbMpcMaterialActivationRefWire } from '../../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
+import type { RouterAbTraceContextV1 } from '../../../../../../shared-ts/src/utils/routerAbTraceContext';
+import type { AuthorizationService } from '../../../../authorization/service';
+import { type ThresholdEcdsaKeyInventoryDiagnostics, type ThresholdEcdsaKeyInventoryRecord } from '../../../../core/authService/thresholdEcdsaKeyInventory';
+import type { EcdsaMaterialActivationReadInput } from '../../../../core/d1EcdsaSignerRead';
+import type { D1WalletStore } from '../../../../core/d1WalletStore';
+import type { EcdsaMaterialReadSnapshot } from '../../../../core/ecdsaMaterialReadSnapshot';
+import type { Ed25519SignerRead } from '../../../../core/d1Ed25519SignerRead';
+import { type StoredWalletRegistrationEvmFamilyEcdsaPendingActivationBranch } from '../../../../core/RegistrationCeremonyStore';
 import { WalletRegistrationEcdsaActivationResponse } from '../../../../core/registrationContracts';
+import type { WalletRegistrationActivateResponseV2, WalletRegistrationNearAdmissionResponseV2, WalletRegistrationNearProvisioningResponseV2, WalletRegistrationRespondResponseV2, WalletRegistrationSessionCommitReceiptV2, WalletRegistrationSetupResponseV2 } from '../../../../core/threeRouteRegistrationContracts';
+import { type EcdsaDerivationServerBootstrapResponse } from '../../../../core/types';
+import { type WalletEcdsaSignerKey, type WalletEcdsaSignerRecord } from '../../../../core/WalletStore';
 import { type RouterAbEcdsaStrictRegistrationPort } from '../../../domains/ecdsa/routerAbEcdsaStrictRegistration';
+import { type RouterAbEd25519YaoProductRegistrationRuntimeV1 } from '../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration';
+import type { VerifiedNearRegistrationContinuationV1 } from '../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationIntentAuthorization';
+import { type RouterAbEd25519YaoRegistrationSideEffectRecordV2, type RouterAbEd25519YaoRegistrationSideEffectStoreV2 } from '../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary';
+import type { RouterAbEd25519YaoBudgetRefreshRequestV1, RouterAbEd25519YaoBudgetRefreshResponseV1, RouterAbEd25519YaoVerifiedWalletUnlockRequestV1, RouterAbEd25519YaoVerifiedWalletUnlockResponseV1 } from '../../../domains/ed25519Yao/session/routerAbEd25519YaoWalletSession';
 import type { TenantRootCustodyLineageResolverV1 } from '../../../domains/tenantRoot/tenantRootCustodyLineage';
 import { type TenantRootIdentityV1 } from '../../../domains/tenantRoot/tenantRootIdentityResolution';
-import { CloudflareD1RegistrationCeremonyIntentStore } from './d1RegistrationCeremonyStore';
-import type { InstalledLinkedDeviceEcdsaAuthorityProjectionV1, InstalledLinkedDeviceEd25519AuthorityProjectionV1 } from '../deviceLinking/d1LinkedDeviceAuthorityInstallService';
-import { type ThresholdEcdsaKeyInventoryDiagnostics, type ThresholdEcdsaKeyInventoryRecord } from '../../../../core/authService/thresholdEcdsaKeyInventory';
-import { type StoredWalletRegistrationEvmFamilyEcdsaPendingActivationBranch } from '../../../../core/RegistrationCeremonyStore';
-import type { WalletRegistrationNearProvisioningResponseV2, WalletRegistrationNearAdmissionResponseV2, WalletRegistrationActivateResponseV2, WalletRegistrationRespondResponseV2, WalletRegistrationSetupResponseV2, WalletRegistrationSessionCommitReceiptV2 } from '../../../../core/threeRouteRegistrationContracts';
-import type { WalletRegistrationSetupInput, WalletRegistrationRespondInput, WalletRegistrationActivateInput, WalletRegistrationNearProvisioningInput, WalletRegistrationNearAdmissionInput } from '../../../domains/walletRegistration/walletRegistrationInputs';
-import type { CloudflareD1WalletCustodyCommitStore } from '../passkeyCustody/d1WalletCustodyCommitStore';
+import type { WalletRegistrationActivateInput, WalletRegistrationNearAdmissionInput, WalletRegistrationNearProvisioningInput, WalletRegistrationRespondInput, WalletRegistrationSetupInput } from '../../../domains/walletRegistration/walletRegistrationInputs';
+import type { WalletExecutionAuthority, RegistrationWalletStarter, WalletRegistrationHomeAuthority } from '../../../domains/walletRegistration/walletRegistrationReservation';
+import type { D1WalletRegistrationRead } from './d1WalletRegistrationRead';
+import { type D1WalletRegistrationOperationPreparedV1 } from './d1WalletRegistrationPreparation';
+import type { InstalledEcdsaCustodySnapshotV1, InstalledLinkedDeviceEcdsaAuthorityProjectionV1, InstalledLinkedDeviceEd25519AuthorityProjectionV1 } from '../deviceLinking/d1LinkedDeviceAuthorityInstallService';
+import type { CloudflareD1Ed25519YaoLifecycleDecisionStoreV1 } from '../ed25519Yao/d1Ed25519YaoLifecycleDecisionStore';
 import { CloudflareD1EmailOtpRegistrationEnrollmentFinalizer } from '../emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer';
+import type { CloudflareD1WalletCustodyCommitStore } from '../passkeyCustody/d1WalletCustodyCommitStore';
+import type { CloudflareD1VersionedJsonRecordReadManyEntryV1 } from '../versionedJson/d1VersionedJsonRecordStore';
 import { CloudflareD1WalletAuthMethodService } from '../wallet/d1WalletAuthMethodService';
+import { CloudflareD1RegistrationCeremonyIntentStore } from './d1RegistrationCeremonyStore';
 import type { D1WalletRegistrationCommitStore } from './d1WalletRegistrationCommitStore';
-import type { CloudflareD1Ed25519YaoLifecycleDecisionStoreV1 } from '../ed25519Yao/d1Ed25519YaoLifecycleDecisionStore';
-import { type WalletEcdsaSignerKey, type WalletEcdsaSignerRecord } from '../../../../core/WalletStore';
-import type { D1WalletStore } from '../../../../core/d1WalletStore';
-import { type RouterAbEd25519YaoProductRegistrationRuntimeV1 } from '../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration';
-import type { RouterAbEd25519YaoBudgetRefreshRequestV1, RouterAbEd25519YaoBudgetRefreshResponseV1, RouterAbEd25519YaoVerifiedWalletUnlockRequestV1, RouterAbEd25519YaoVerifiedWalletUnlockResponseV1 } from '../../../domains/ed25519Yao/session/routerAbEd25519YaoWalletSession';
-import { type RouterAbEd25519YaoRegistrationSideEffectRecordV2, type RouterAbEd25519YaoRegistrationSideEffectStoreV2 } from '../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary';
-import type { CloudflareD1VersionedJsonRecordReadManyEntryV1 } from '../versionedJson/d1VersionedJsonRecordStore';
+import { type RegistrationSessionTransactionStore } from './d1WalletRegistrationInitialSession';
 type ActivateWalletRegistrationEcdsaInput = {
     readonly registrationCeremonyId: string;
     readonly ecdsa: {
@@ -64,12 +70,6 @@ type D1LinkedDeviceEd25519AuthorityReaderV1 = {
         readonly materialActivation: MpcMaterialActivationRef;
     }): Promise<InstalledEcdsaCustodySnapshotV1 | null>;
 };
-export type D1WalletRegistrationOperationPreparedV1 = {
-    readonly kind: 'd1_wallet_registration_operation_prepared_v1';
-    readonly walletAuthorityId: WalletAuthorityId;
-    readonly deviceId: DeviceId;
-    readonly walletAuthMethodId: WalletAuthMethodId;
-};
 /** The activate operation row stores one credential-free commit receipt. */
 export type D1WalletRegistrationActivateSideEffectRecord = RouterAbEd25519YaoRegistrationSideEffectRecordV2<WalletRegistrationSessionCommitReceiptV2, D1WalletRegistrationOperationPreparedV1>;
 export type D1WalletRegistrationActivateSideEffectStore = RouterAbEd25519YaoRegistrationSideEffectStoreV2<WalletRegistrationSessionCommitReceiptV2, D1WalletRegistrationOperationPreparedV1> & {
@@ -77,7 +77,6 @@ export type D1WalletRegistrationActivateSideEffectStore = RouterAbEd25519YaoRegi
         readonly limit?: number;
     }): Promise<readonly CloudflareD1VersionedJsonRecordReadManyEntryV1<D1WalletRegistrationActivateSideEffectRecord>[]>;
 };
-export type D1WalletRegistrationNearProvisioningSideEffectStore = RouterAbEd25519YaoRegistrationSideEffectStoreV2<WalletRegistrationSessionCommitReceiptV2, D1WalletRegistrationOperationPreparedV1>;
 export type D1WalletRegistrationNearProvisioningSideEffectRecord = RouterAbEd25519YaoRegistrationSideEffectRecordV2<WalletRegistrationSessionCommitReceiptV2, D1WalletRegistrationOperationPreparedV1>;
 type RegistrationCeremonyStoreProvider = () => CloudflareD1RegistrationCeremonyIntentStore;
 type WalletStoreProvider = () => D1WalletStore;
@@ -94,16 +93,7 @@ export type SponsoredNamedNearAccountCreationResult = {
     readonly message: string;
     readonly retryAfterMs: number;
 };
-type SponsoredNamedNearAccountCreator = (input: {
-    readonly accountId: string;
-    readonly publicKey: string;
-    /**
-     * Registration-scoped key. The provisioning boundary persists the signed
-     * transaction under this key before broadcasting, so a retry replays those
-     * exact bytes instead of building a second transaction.
-     */
-    readonly idempotencyKey: string;
-}) => Promise<SponsoredNamedNearAccountCreationResult>;
+type SponsoredNamedNearAccountCreator = (input: SponsoredNamedNearAccountInput) => Promise<SponsoredNamedNearAccountCreationResult>;
 export declare function ecdsaStrictRegistrationAuthority(facts: RouterAbEcdsaRegistrationRequestFactsV1): {
     readonly subjectId: string;
     readonly sessionId: string;
@@ -126,7 +116,10 @@ type EcdsaPostRegistrationProofInput = {
     readonly response: RouterAbEcdsaDerivationActivationRefreshForwardedResponseV1;
 };
 export declare class CloudflareD1WalletRegistrationService {
+    private readonly executionAuthority;
+    private readonly registrationAuthority;
     private readonly authorizationService;
+    private readonly registrationSessionStore;
     private readonly authorizationTenantId;
     private readonly createSponsoredNamedNearAccount;
     private readonly emailOtpRegistrationEnrollmentFinalizer;
@@ -137,16 +130,23 @@ export declare class CloudflareD1WalletRegistrationService {
     private readonly getWalletStore;
     /** The single Gateway operation row for activate-with-finalize. */
     private readonly activateSideEffects;
-    /** Deferred NEAR provisioning's own operation row. */
-    private readonly nearProvisioningSideEffects;
+    /** Registration admission and state loaded in one database snapshot. */
+    private readonly registrationRead;
     private readonly walletRegistrationCommitStore;
     /** Where a ceremony's sealed custody seed and its recovery set land. */
     private readonly walletCustodyCommitStore;
     private readonly walletAuthMethods;
     private readonly getLinkedDeviceEd25519AuthorityReader;
     private readonly yaoLifecycleDecisions;
+    private readonly home;
+    private readonly startRegistrationWallets;
     constructor(input: {
+        readonly home: WalletSessionHome;
+        readonly executionAuthority: WalletExecutionAuthority;
+        readonly registrationAuthority: WalletRegistrationHomeAuthority | null;
+        readonly startRegistrationWallets: RegistrationWalletStarter | null;
         readonly authorizationService: AuthorizationService;
+        readonly registrationSessionStore: RegistrationSessionTransactionStore;
         readonly authorizationTenantId: TenantId;
         readonly createSponsoredNamedNearAccount: SponsoredNamedNearAccountCreator;
         readonly emailOtpRegistrationEnrollmentFinalizer: CloudflareD1EmailOtpRegistrationEnrollmentFinalizer;
@@ -156,7 +156,7 @@ export declare class CloudflareD1WalletRegistrationService {
         readonly tenantRootCustodyLineage: TenantRootCustodyLineageResolverV1;
         readonly getWalletStore: WalletStoreProvider;
         readonly activateSideEffects: D1WalletRegistrationActivateSideEffectStore;
-        readonly nearProvisioningSideEffects: D1WalletRegistrationNearProvisioningSideEffectStore;
+        readonly registrationRead: D1WalletRegistrationRead;
         readonly walletRegistrationCommitStore: D1WalletRegistrationCommitStore;
         readonly walletCustodyCommitStore: CloudflareD1WalletCustodyCommitStore;
         readonly walletAuthMethods: CloudflareD1WalletAuthMethodService;
@@ -166,6 +166,7 @@ export declare class CloudflareD1WalletRegistrationService {
     resolveEd25519MaterialActivation(input: {
         readonly walletId: string;
         readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
+        readonly signerRead?: Ed25519SignerRead;
     }): Promise<{
         readonly ok: true;
         readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
@@ -212,6 +213,7 @@ export declare class CloudflareD1WalletRegistrationService {
         readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
     }): Promise<{
         readonly ok: true;
+        readonly ownershipGeneration: number;
         readonly identityDigestB64u: string;
         readonly custodyLineageB64u: string;
         readonly projectEnvironmentId: string;
@@ -256,26 +258,9 @@ export declare class CloudflareD1WalletRegistrationService {
     }>;
     refreshEd25519YaoWalletSession(request: RouterAbEd25519YaoBudgetRefreshRequestV1): Promise<RouterAbEd25519YaoBudgetRefreshResponseV1>;
     provisionEd25519YaoWalletSession(request: RouterAbEd25519YaoVerifiedWalletUnlockRequestV1): Promise<RouterAbEd25519YaoVerifiedWalletUnlockResponseV1>;
-    /**
-     * `/wallets/register/setup` — grant, intent, and start in one request, with
-     * one D1 write.
-     *
-     * Setup runs before the client's WebAuthn create, because it issues the
-     * challenge that create signs. So the ECDSA prepare and the Ed25519
-     * admission — the two Router calls that dominated the measured cold path —
-     * overlap the authenticator prompt instead of being serialized after it.
-     * They are started before either is awaited: they share no state and neither
-     * can invalidate the other.
-     */
     setupWalletRegistration(input: WalletRegistrationSetupInput): Promise<WalletRegistrationSetupResponseV2>;
     authorizeWalletRegistrationNearAdmission(input: WalletRegistrationNearAdmissionInput): Promise<WalletRegistrationNearAdmissionResponseV2>;
     respondWalletRegistration(input: WalletRegistrationRespondInput, traceContext?: RouterAbTraceContextV1, timingSink?: Array<readonly [string, number]>): Promise<WalletRegistrationRespondResponseV2>;
-    /**
-     * The Ed25519 commit core, extracted so deferred provisioning reaches it
-     * without going through the standalone finalize wrapper. The operation row
-     * owns idempotency here, so the commit keeps no replay cache of its own.
-     */
-    private readRegistrationOwnerProofContext;
     /** For callers that must read the context before finalize tombstones it. */
     private registrationOwnerProofWithContext;
     authorizeNearRegistrationContinuation(input: {
@@ -284,37 +269,14 @@ export declare class CloudflareD1WalletRegistrationService {
     }): Promise<VerifiedNearRegistrationContinuationV1 | null>;
     private readNearRegistrationContinuationContext;
     private readCommittedRegistrationInstallation;
+    /** Carries the preparation's ceremony into this request's execution. */
     private prepareNearProvisioningOperation;
     private commitDeferredEd25519Signer;
     private replayWalletRegistrationActivateCommit;
     private replayWalletRegistrationNearProvisioningCommit;
-    /**
-     * Deferred NEAR provisioning. Verifies the signed setup, then reuses the
-     * existing deferred Ed25519 commit — the same path lazy-Yao 4+5 built — so
-     * signer installation and the implicit-account projection keep one
-     * implementation across both plans.
-     *
-     * A retryable failure leaves the pending wallet intact: the wallet must not
-     * be destroyed because its signer ceremony needs another attempt.
-     */
+    /** Verifies registration or continuation authority without destroying retryable state. */
     private verifyNearProvisioningAuthority;
-    completeWalletRegistrationNearProvisioning(input: WalletRegistrationNearProvisioningInput, timingSink?: Array<readonly [string, number]>): Promise<WalletRegistrationNearProvisioningResponseV2>;
-    /**
-     * Persists the Ed25519-only wallet in `near_pending`: wallet, profile, and
-     * authentication state, and no signer record — the signer does not exist
-     * until deferred Yao produces it.
-     *
-     * The terminal response carries no signer, resolved account, or key
-     * identity, because none of those are known yet. Reporting them would be
-     * fabricating readiness.
-     */
-    private commitEd25519PendingWallet;
-    /**
-     * Ed25519-only respond. The wallet's sole signer is Yao, and that is
-     * deliberately not a reason to block: the admission is returned as deferred
-     * work exactly as on a mixed plan, and the wallet lives in `near_pending`
-     * until the computation completes.
-     */
+    completeWalletRegistrationNearProvisioning(input: WalletRegistrationNearProvisioningInput, timingSink?: Array<readonly [string, number]>, waitUntil?: (promise: Promise<unknown>) => void): Promise<WalletRegistrationNearProvisioningResponseV2>;
     /**
      * Respond replay stays authority-bound.
      *