@seams/wallet-server 0.9.1 → 0.9.3

package/artifact-manifest.json

@@ -2,17 +2,17 @@
   "schemaVersion": "seams_wallet_server_artifact_manifest_v1",
   "package": {
     "name": "@seams/wallet-server",
-    "version": "0.9.1"
+    "version": "0.9.3"
   },
   "workers": {
     "router": {
       "entry": "cloudflare-router-ab/build/router/worker/shim.mjs",
-      "fingerprint": "fa090144e437ce96ebd3e9f2e9976ad9419f31c644b7549f032c921d34f5551f",
+      "fingerprint": "9aa6adbab32e5358ec10422887961436e7fef549c9c740331e05f51aa6f095e7",
       "files": [
         {
           "path": "cloudflare-router-ab/build/router/build-stamp.json",
           "bytes": 119,
-          "sha256": "4c874df0cfa4c298109b9e0d2743878362d9cc32f3dfc5f9a84d5eb619ca4e95"
+          "sha256": "e0dc70f76677f14be6bfe19283b8d1ac143e19f87f747f1b7b547301d6d1d732"
         },
         {
           "path": "cloudflare-router-ab/build/router/index.js",
@@ -21,8 +21,8 @@
         },
         {
           "path": "cloudflare-router-ab/build/router/index_bg.wasm",
-          "bytes": 9585441,
-          "sha256": "b93fafd76ff89a2a1308572ac0d12e68a158fe096aa62c60e3bd9a1e2aecaea3"
+          "bytes": 8093903,
+          "sha256": "07aec63f57a09dbcb3c6fa25dee6184ef45fa6e9168816b0d80a3b9259a4cd4d"
         },
         {
           "path": "cloudflare-router-ab/build/router/package.json",
@@ -38,12 +38,12 @@
     },
     "deriver-a": {
       "entry": "cloudflare-router-ab/build/deriver-a/worker/shim.mjs",
-      "fingerprint": "f6d804b3eab07dee2e8eb85a6300dd4288fb606b52298728b2163bc36e0dfc08",
+      "fingerprint": "9d5e7b103536e7ebb8171d92441c5e9e3d0ffc56e7fa2c14ae366b4c830a6021",
       "files": [
         {
           "path": "cloudflare-router-ab/build/deriver-a/build-stamp.json",
           "bytes": 122,
-          "sha256": "9360fbc8ecd55cc50e63a4e994abf7606ea810e707336982177fcdbaa9598f72"
+          "sha256": "f4584b8a1735dceb2c83fe247d053a368d36f195baea47e0e84a0db749c0489a"
         },
         {
           "path": "cloudflare-router-ab/build/deriver-a/index.js",
@@ -52,8 +52,8 @@
         },
         {
           "path": "cloudflare-router-ab/build/deriver-a/index_bg.wasm",
-          "bytes": 15515779,
-          "sha256": "c1cb040e2140a132ecee2fe9822bc24a669f67d325ab34968eae5daccd2d5bce"
+          "bytes": 13967465,
+          "sha256": "ab240fd5d74b80184b32d46427b490b72df08c2d90a42a47124a7f1d132f1bbd"
         },
         {
           "path": "cloudflare-router-ab/build/deriver-a/package.json",
@@ -69,12 +69,12 @@
     },
     "deriver-b": {
       "entry": "cloudflare-router-ab/build/deriver-b/worker/shim.mjs",
-      "fingerprint": "cf673f8bbba1ca5a716971851b14ccbdfb664957c9b679141eab6b5f40afb6ee",
+      "fingerprint": "7d00d2bd13540dbf54852a229719bb49f63e13f63156eae27ed6d02bf155bfd5",
       "files": [
         {
           "path": "cloudflare-router-ab/build/deriver-b/build-stamp.json",
           "bytes": 122,
-          "sha256": "2cf0dcc3eefd36c5a0280b11dca688f8ff47c912dfe68eafd17b6a489b4a1b34"
+          "sha256": "42b32d715606dc48c314c621a98bf9427aa497d4a2b5ea42d90fd5773ee10f7d"
         },
         {
           "path": "cloudflare-router-ab/build/deriver-b/index.js",
@@ -83,8 +83,8 @@
         },
         {
           "path": "cloudflare-router-ab/build/deriver-b/index_bg.wasm",
-          "bytes": 15613711,
-          "sha256": "84f3acdae49765c3c49a0b26a8eea05662b1281b3be09abc0579d7caeb1f9715"
+          "bytes": 14020253,
+          "sha256": "5ed975153c24dd4504d9bab7eb418fb4478edc25a26e424001b166cde68522a6"
         },
         {
           "path": "cloudflare-router-ab/build/deriver-b/package.json",
@@ -100,12 +100,12 @@
     },
     "signing-worker": {
       "entry": "cloudflare-router-ab/build/signing-worker/worker/shim.mjs",
-      "fingerprint": "09511c8571ec458f4523f7cc2b9c2cb71faaccc189edd759d9af1f6d772fc506",
+      "fingerprint": "70f940a849724cee4ccbd8aab11645858179e95578badd8dab090a657a816e90",
       "files": [
         {
           "path": "cloudflare-router-ab/build/signing-worker/build-stamp.json",
           "bytes": 127,
-          "sha256": "dedc96cabc8588370f1e252ba0297f70b6aa3a4a41062a91dd6702686459ae06"
+          "sha256": "01ea18855d322077772ed0ecd6d4b0117627648fdbbfb06c0d946f704dcc3d07"
         },
         {
           "path": "cloudflare-router-ab/build/signing-worker/index.js",
@@ -114,8 +114,8 @@
         },
         {
           "path": "cloudflare-router-ab/build/signing-worker/index_bg.wasm",
-          "bytes": 11035697,
-          "sha256": "12d038715f4acf588212242409cd9aef787e375142950d49a81aee5a9384f98d"
+          "bytes": 8988257,
+          "sha256": "2410f507efeb9b7501018dcfee4de2ffc36a664fe8ab59b3c3e487368ba05f56"
         },
         {
           "path": "cloudflare-router-ab/build/signing-worker/package.json",
@@ -131,12 +131,12 @@
     },
     "tenant-root-control-plane": {
       "entry": "cloudflare-router-ab/build/tenant-root-control-plane/worker/shim.mjs",
-      "fingerprint": "d72a232927c25de160c55b8435aa2b0fd6d2bd94852df3848ed200210f469a6e",
+      "fingerprint": "6ea385bf5cdad01cd1363343344884ee9c96dc3497896a398c49f3757b6c501a",
       "files": [
         {
           "path": "cloudflare-router-ab/build/tenant-root-control-plane/build-stamp.json",
           "bytes": 139,
-          "sha256": "fc2b97971d6a78159210253f9ee42c446057179edaf11c22df9a8a97c90bdc28"
+          "sha256": "f55647bb6cda0be99e58c921780c808e6b40ef608e08fef94163ab3b66c57938"
         },
         {
           "path": "cloudflare-router-ab/build/tenant-root-control-plane/index.js",
@@ -145,8 +145,8 @@
         },
         {
           "path": "cloudflare-router-ab/build/tenant-root-control-plane/index_bg.wasm",
-          "bytes": 6275434,
-          "sha256": "4b8adb07f6d2a93b9f01a598e37ee71ce078d1d645561508f7aa8951271122da"
+          "bytes": 5220037,
+          "sha256": "58da690b6240f7f081a47a300d05c109e23428793c429e47b368f168ca93f917"
         },
         {
           "path": "cloudflare-router-ab/build/tenant-root-control-plane/package.json",
@@ -164,8 +164,8 @@
   "migrations": {
     "signer": {
       "directory": "migrations/d1-signer",
-      "head": "0077_wallet_object_addresses.sql",
-      "fingerprint": "ad5b9c7b4a2a23fdde929400763b5f3baba6514a2497f0e65177429bee454ac2",
+      "head": "0078_registration_passkey_claims.sql",
+      "fingerprint": "d1305343eafa23d821d280e0ca7955ea4cbb685850ead2a2e4b611e7cab5fb33",
       "files": [
         {
           "path": "migrations/d1-signer/0001_signer_d1_initial.sql",
@@ -551,6 +551,11 @@
           "path": "migrations/d1-signer/0077_wallet_object_addresses.sql",
           "bytes": 1243,
           "sha256": "693c3606116f2ff49c1eb77a56631c97448cc296855753c7cf54c1e9a103e9f6"
+        },
+        {
+          "path": "migrations/d1-signer/0078_registration_passkey_claims.sql",
+          "bytes": 880,
+          "sha256": "c0bab803761cc25b502217a1f9b3fe7d5082711d4632ab1ffc117ba47581f530"
         }
       ]
     },

package/cloudflare-router-ab/build/deriver-a/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":true,"features":"strict-worker-deriver-a-entrypoint","started_at_ms":1791780253066}
+{"profile":"release","wallet_objects":true,"features":"strict-worker-deriver-a-entrypoint","started_at_ms":1791827115529}

package/cloudflare-router-ab/build/deriver-b/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":true,"features":"strict-worker-deriver-b-entrypoint","started_at_ms":1791780483686}
+{"profile":"release","wallet_objects":true,"features":"strict-worker-deriver-b-entrypoint","started_at_ms":1791827364267}

package/cloudflare-router-ab/build/router/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":true,"features":"strict-worker-router-entrypoint","started_at_ms":1791780687305}
+{"profile":"release","wallet_objects":true,"features":"strict-worker-router-entrypoint","started_at_ms":1791827596969}

package/cloudflare-router-ab/build/signing-worker/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":true,"features":"strict-worker-signing-worker-entrypoint","started_at_ms":1791779948156}
+{"profile":"release","wallet_objects":true,"features":"strict-worker-signing-worker-entrypoint","started_at_ms":1791826784348}

package/cloudflare-router-ab/build/tenant-root-control-plane/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":false,"features":"strict-worker-tenant-root-control-plane-entrypoint","started_at_ms":1791780899928}
+{"profile":"release","wallet_objects":false,"features":"strict-worker-tenant-root-control-plane-entrypoint","started_at_ms":1791827823651}

package/dist/esm/router/cloudflare/d1/auth/d1RouterApiAuthService.js

@@ -846,7 +846,7 @@ function createCloudflareD1RouterApiAuthAssembly(input) {
 		tenantRootCustodyLineage: options.tenantRootCustodyLineage,
 		getWalletStore,
 		activateSideEffects: walletRegistrationActivateSideEffectStore(options),
-		registrationRead: new D1WalletRegistrationRead(options.database, options.registrationAuthority ?? null, walletRegistrationNearProvisioningSideEffectStore(options), getRegistrationCeremonyIntentStore, yaoLifecycleDecisions),
+		registrationRead: new D1WalletRegistrationRead(options.database, options.registrationAuthority ?? null, walletRegistrationNearProvisioningSideEffectStore(options), getRegistrationCeremonyIntentStore, yaoLifecycleDecisions, walletRegistrationCommitStore),
 		walletRegistrationCommitStore,
 		walletCustodyCommitStore,
 		walletAuthMethods,

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationCommitStore.js

@@ -201,20 +201,64 @@ function emailOtpCommitStatements(input) {
 		case "email_otp_wallet_registration_commit_v1": return input.emailOtp.statements;
 	}
 }
+function heldClaimCovers(held, authority) {
+	return held !== null && held.walletId === authority.walletId && held.rpId === authority.rpId && held.credentialIdB64u === authority.credentialIdB64u;
+}
 var CloudflareD1WalletRegistrationCommitStore = class {
 	constructor(input) {
 		this.credentialClaims = input.credentialClaims;
 		this.database = input.database;
 		this.scope = normalizeScope(input);
 	}
-	async reserveAuthority(authority) {
-		if (authority.kind === "passkey") await reservePasskeyCredential(this.credentialClaims, {
+	async reserveAuthority(authority, held = null) {
+		if (authority.kind === "passkey" && !heldClaimCovers(held, authority)) await reservePasskeyCredential(this.credentialClaims, {
 			walletId: authority.walletId,
 			rpId: authority.rpId,
 			credentialIdB64u: authority.credentialIdB64u
 		});
 		return this.commit.bind(this, authority);
 	}
+	async claimPasskeyAhead(input) {
+		const { authority } = input;
+		if (authority.kind !== "passkey" || !this.credentialClaims) return;
+		if (!await this.credentialClaims.claim({
+			walletId: authority.walletId,
+			rpId: authority.rpId,
+			credentialIdB64u: authority.credentialIdB64u
+		})) return;
+		await this.database.prepare(`INSERT OR IGNORE INTO registration_passkey_claims (
+           namespace, org_id, project_id, env_id, registration_ceremony_id,
+           wallet_id, rp_id, credential_id_b64u, claimed_at_ms
+         ) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9)`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, input.registrationCeremonyId, authority.walletId, authority.rpId, authority.credentialIdB64u, input.nowMs).run();
+	}
+	prepareHeldPasskeyClaimRead(registrationCeremonyId) {
+		return this.database.prepare(`SELECT wallet_id, rp_id, credential_id_b64u
+           FROM registration_passkey_claims
+          WHERE namespace = ?1
+            AND org_id = ?2
+            AND project_id = ?3
+            AND env_id = ?4
+            AND registration_ceremony_id = ?5`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, registrationCeremonyId);
+	}
+	parseHeldPasskeyClaimRead(result) {
+		if (!result.success) throw new Error("Registration passkey claim read failed");
+		const row = result.results?.[0];
+		if (!row) return null;
+		if (typeof row.wallet_id !== "string" || typeof row.rp_id !== "string" || typeof row.credential_id_b64u !== "string") throw new Error("Stored registration passkey claim is invalid");
+		return {
+			walletId: row.wallet_id,
+			rpId: row.rp_id,
+			credentialIdB64u: row.credential_id_b64u
+		};
+	}
+	async deleteHeldPasskeyClaim(registrationCeremonyId) {
+		await this.database.prepare(`DELETE FROM registration_passkey_claims
+          WHERE namespace = ?1
+            AND org_id = ?2
+            AND project_id = ?3
+            AND env_id = ?4
+            AND registration_ceremony_id = ?5`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, registrationCeremonyId).run();
+	}
 	async commit(authority, input, executeBatch) {
 		assertCommitWalletIdentity(input, authority);
 		const ed25519Signer = input.walletSigners.find(isEd25519Signer);

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationRead.js

@@ -1,12 +1,13 @@
 //#region src/router/cloudflare/d1/registration/d1WalletRegistrationRead.ts
 /** Read admission and immutable finalization state from one D1 snapshot. */
 var D1WalletRegistrationRead = class {
-	constructor(database, authority, operations, getCeremonies, decisions) {
+	constructor(database, authority, operations, getCeremonies, decisions, passkeyClaims) {
 		this.database = database;
 		this.authority = authority;
 		this.operations = operations;
 		this.getCeremonies = getCeremonies;
 		this.decisions = decisions;
+		this.passkeyClaims = passkeyClaims;
 	}
 	async readRespond(home) {
 		if (!this.authority) return {
@@ -37,10 +38,11 @@ var D1WalletRegistrationRead = class {
 			this.authority.prepareHomeRead(home),
 			this.operations.prepareRead(operationKey),
 			ceremonies.prepareCeremonyRead(home.ceremonyId),
-			this.decisions.prepareRead(home.ceremonyId)
+			this.decisions.prepareRead(home.ceremonyId),
+			this.passkeyClaims.prepareHeldPasskeyClaimRead(home.ceremonyId)
 		]);
-		const [homeRead, operationRead, ceremonyRead, decisionRead] = results;
-		if (results.length !== 4 || !homeRead || !operationRead || !ceremonyRead || !decisionRead) throw new Error("Registration finalization D1 batch returned incomplete results");
+		const [homeRead, operationRead, ceremonyRead, decisionRead, passkeyClaimRead] = results;
+		if (results.length !== 5 || !homeRead || !operationRead || !ceremonyRead || !decisionRead || !passkeyClaimRead) throw new Error("Registration finalization D1 batch returned incomplete results");
 		const admission = await this.authority.admitHomeRead(home, homeRead);
 		if (!admission.ok) return admission;
 		if (!ceremonyRead.success) throw new Error("Registration ceremony D1 read failed");
@@ -48,6 +50,7 @@ var D1WalletRegistrationRead = class {
 			ok: true,
 			operation: this.operations.parseReadResult(operationRead),
 			decision: this.decisions.parseRead(home.ceremonyId, decisionRead),
+			heldPasskeyClaim: this.passkeyClaims.parseHeldPasskeyClaimRead(passkeyClaimRead),
 			readCeremony: ceremonies.parseCeremonyRead.bind(ceremonies, home.ceremonyId, ceremonyRead)
 		};
 	}

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationService.js

@@ -529,9 +529,7 @@ function assertNeverRegistrationReceiptCommit(value) {
 	throw new Error(`Unsupported registration receipt commit: ${String(value)}`);
 }
 async function cleanupFinalizedRegistrationCeremony(input) {
-	try {
-		await input.store.deleteCeremony(input.registrationCeremonyId);
-	} catch {}
+	await Promise.allSettled([input.store.deleteCeremony(input.registrationCeremonyId), input.passkeyClaims?.deleteHeldPasskeyClaim(input.registrationCeremonyId)]);
 }
 function d1RegistrationRouteDiagnostics(recorder) {
 	return {
@@ -1690,7 +1688,7 @@ var CloudflareD1WalletRegistrationService = class {
 			};
 		}
 	}
-	async respondWalletRegistration(input, traceContext, timingSink) {
+	async respondWalletRegistration(input, traceContext, timingSink, waitUntil) {
 		const serverTiming = timingSink ?? [];
 		const totalStartedAtMs = Date.now();
 		const mark = (name, startedAtMs) => {
@@ -1769,6 +1767,7 @@ var CloudflareD1WalletRegistrationService = class {
 				ownershipGeneration: homeAdmission.ownershipGeneration,
 				startedDispatchRoot,
 				expectedOrigin,
+				waitUntil,
 				...input.userAgent ? { userAgent: input.userAgent } : {}
 			});
 			if (!ecdsaBranch) return {
@@ -2167,7 +2166,7 @@ var CloudflareD1WalletRegistrationService = class {
 			ed25519: args.input.ed25519,
 			emailOtpEnrollment: args.input.emailOtpEnrollment,
 			walletCustodyCommit: args.input.walletCustodyCommit
-		}, effectivePrepared, source, args.serverTiming, initialSessionPlan, args.lifecycleDecision);
+		}, effectivePrepared, source, args.serverTiming, initialSessionPlan, args.lifecycleDecision, args.heldPasskeyClaim);
 		if (!execution.ok) return unissuedRegistrationCommit(throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1(execution));
 		const finalized = execution.finalized;
 		if (finalized.kind !== "near_ed25519") {
@@ -2414,7 +2413,8 @@ var CloudflareD1WalletRegistrationService = class {
 					setupClaims: verified.claims,
 					authoritySource: verified.source,
 					preparedCeremony: () => preparedCeremony,
-					lifecycleDecision: initial.decision
+					lifecycleDecision: initial.decision,
+					heldPasskeyClaim: initial.heldPasskeyClaim
 				}),
 				projectReceipt: (execution) => projectWalletRegistrationSessionCommitReceiptV2({
 					operation: "near_provisioning",
@@ -2475,7 +2475,8 @@ var CloudflareD1WalletRegistrationService = class {
 				startedAtMs: Date.now(),
 				promise: cleanupFinalizedRegistrationCeremony({
 					store: this.getRegistrationCeremonyIntentStore(),
-					registrationCeremonyId: input.registrationCeremonyId
+					registrationCeremonyId: input.registrationCeremonyId,
+					passkeyClaims: this.walletRegistrationCommitStore
 				})
 			});
 			if (waitUntil) waitUntil(cleanup);
@@ -2650,6 +2651,16 @@ var CloudflareD1WalletRegistrationService = class {
 			expected: input.snapshot,
 			next: authorizedCeremony(admitted.admissionRequest)
 		});
+		if (!stored && input.waitUntil && verifiedAuthority.kind === "passkey") input.waitUntil(this.walletRegistrationCommitStore.claimPasskeyAhead({
+			registrationCeremonyId: ceremony.registrationCeremonyId,
+			authority: verifiedAuthority,
+			nowMs: Date.now()
+		}).catch((error) => {
+			console.warn("[wallet-registration] early passkey claim failed", {
+				registrationCeremonyId: ceremony.registrationCeremonyId,
+				reason: errorMessage(error)
+			});
+		}));
 		return {
 			ok: true,
 			registrationCeremonyId: ceremony.registrationCeremonyId,
@@ -3215,7 +3226,7 @@ var CloudflareD1WalletRegistrationService = class {
 			};
 		}
 	}
-	async executeWalletRegistrationFinalize(request, prepared, source, serverTiming, initialSessionPlan, lifecycleDecision) {
+	async executeWalletRegistrationFinalize(request, prepared, source, serverTiming, initialSessionPlan, lifecycleDecision, heldPasskeyClaim = null) {
 		const finalizeTiming = createD1RegistrationRouteTimingRecorder("wallets_register_finalize");
 		const totalTiming = startD1RegistrationRouteTiming("registerFinalizeTotalMs");
 		let startedCustody = null;
@@ -3450,7 +3461,12 @@ var CloudflareD1WalletRegistrationService = class {
 						},
 						consumerBinding: requestFingerprint
 					})
-				}), this.walletRegistrationCommitStore.reserveAuthority(ceremonyAuthority)]);
+				}), recordRegistrationPromiseTiming({
+					sink: serverTiming,
+					name: "near_finalize_authority_reserve",
+					startedAtMs: Date.now(),
+					promise: this.walletRegistrationCommitStore.reserveAuthority(ceremonyAuthority, heldPasskeyClaim)
+				})]);
 				if (activationConsumption.status === "rejected") throw activationConsumption.reason;
 				if (authorityReservation.status === "rejected") throw authorityReservation.reason;
 				const consumed = activationConsumption.value;

package/dist/esm/router/cloudflare.js

@@ -13961,7 +13961,7 @@ async function handleRouterApiWalletRegistrationRespond(input) {
 		...parsed.value,
 		verifier: session,
 		...registrationUserAgentFromHeaders(input.headers) ? { userAgent: registrationUserAgentFromHeaders(input.headers) } : {}
-	}, traceContext.value ?? void 0, serverTiming);
+	}, traceContext.value ?? void 0, serverTiming, input.waitUntil);
 	return routeJson(result.ok ? 200 : 400, result, { headers: ecdsaGatewayServerTimingHeaders(serverTiming) });
 }
 async function handleRouterApiWalletRegistrationNearAdmission(input) {

package/dist/esm/router/domains/walletRegistration/walletRegistrationRoutes.js

@@ -1641,7 +1641,7 @@ async function handleRouterApiWalletRegistrationRespond(input) {
 		...parsed.value,
 		verifier: session,
 		...registrationUserAgentFromHeaders(input.headers) ? { userAgent: registrationUserAgentFromHeaders(input.headers) } : {}
-	}, traceContext.value ?? void 0, serverTiming);
+	}, traceContext.value ?? void 0, serverTiming, input.waitUntil);
 	return routeJson(result.ok ? 200 : 400, result, { headers: ecdsaGatewayServerTimingHeaders(serverTiming) });
 }
 async function handleRouterApiWalletRegistrationNearAdmission(input) {

package/dist/esm/router/express.js

@@ -9314,7 +9314,7 @@ async function handleRouterApiWalletRegistrationRespond(input) {
 		...parsed.value,
 		verifier: session,
 		...registrationUserAgentFromHeaders(input.headers) ? { userAgent: registrationUserAgentFromHeaders(input.headers) } : {}
-	}, traceContext.value ?? void 0, serverTiming);
+	}, traceContext.value ?? void 0, serverTiming, input.waitUntil);
 	return routeJson(result.ok ? 200 : 400, result, { headers: ecdsaGatewayServerTimingHeaders(serverTiming) });
 }
 async function handleRouterApiWalletRegistrationNearAdmission(input) {

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationCommitStore.d.ts

@@ -31,8 +31,32 @@ type D1WalletRegistrationCommitInput = (D1WalletRegistrationCommitBase & D1Walle
     readonly kind: 'email_otp_wallet_registration_commit_v1';
     readonly emailOtp: D1EmailOtpRegistrationCommitPlan;
 });
+/** A passkey claim that shared authority granted for one ceremony before its finalization. */
+export type HeldRegistrationPasskeyClaim = {
+    readonly walletId: string;
+    readonly rpId: string;
+    readonly credentialIdB64u: string;
+};
 export interface D1WalletRegistrationCommitStore {
-    reserveAuthority(authority: RegistrationAuthority): Promise<ReservedWalletRegistrationCommit>;
+    /**
+     * Claims the authority's passkey through shared authority, unless `held`
+     * records that the same claim was already granted for this ceremony.
+     */
+    reserveAuthority(authority: RegistrationAuthority, held?: HeldRegistrationPasskeyClaim | null): Promise<ReservedWalletRegistrationCommit>;
+    /**
+     * Claims a verified passkey before finalization and records a granted
+     * claim. A refusal records nothing, so finalization claims again and
+     * reports it.
+     */
+    claimPasskeyAhead(input: {
+        readonly registrationCeremonyId: string;
+        readonly authority: RegistrationAuthority;
+        readonly nowMs: number;
+    }): Promise<void>;
+    prepareHeldPasskeyClaimRead(registrationCeremonyId: string): D1PreparedStatementLike;
+    parseHeldPasskeyClaimRead(result: D1ResultLike<Record<string, unknown>>): HeldRegistrationPasskeyClaim | null;
+    /** Removes the record of a finalized ceremony. Shared authority keeps the claim. */
+    deleteHeldPasskeyClaim(registrationCeremonyId: string): Promise<void>;
 }
 export declare class CloudflareD1WalletRegistrationCommitStore implements D1WalletRegistrationCommitStore {
     private readonly database;
@@ -46,7 +70,15 @@ export declare class CloudflareD1WalletRegistrationCommitStore implements D1Wall
         readonly projectId: string;
         readonly envId: string;
     });
-    reserveAuthority(authority: RegistrationAuthority): Promise<ReservedWalletRegistrationCommit>;
+    reserveAuthority(authority: RegistrationAuthority, held?: HeldRegistrationPasskeyClaim | null): Promise<ReservedWalletRegistrationCommit>;
+    claimPasskeyAhead(input: {
+        readonly registrationCeremonyId: string;
+        readonly authority: RegistrationAuthority;
+        readonly nowMs: number;
+    }): Promise<void>;
+    prepareHeldPasskeyClaimRead(registrationCeremonyId: string): D1PreparedStatementLike;
+    parseHeldPasskeyClaimRead(result: D1ResultLike<Record<string, unknown>>): HeldRegistrationPasskeyClaim | null;
+    deleteHeldPasskeyClaim(registrationCeremonyId: string): Promise<void>;
     private commit;
 }
 export {};

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationRead.d.ts

@@ -3,6 +3,7 @@ import type { WalletRegistrationHomeAuthority } from '../../../domains/walletReg
 import type { CloudflareD1RegistrationCeremonyIntentStore } from './d1RegistrationCeremonyStore';
 import type { D1WalletExecutionAuthority } from './d1WalletExecutionAuthority';
 import type { D1WalletOperationStore } from './d1WalletOperationStore';
+import type { D1WalletRegistrationCommitStore } from './d1WalletRegistrationCommitStore';
 import type { D1WalletRegistrationNearProvisioningSideEffectRecord } from './d1WalletRegistrationService';
 import type { CloudflareD1Ed25519YaoLifecycleDecisionStoreV1 } from '../ed25519Yao/d1Ed25519YaoLifecycleDecisionStore';
 /** Read admission and immutable finalization state from one D1 snapshot. */
@@ -12,7 +13,8 @@ export declare class D1WalletRegistrationRead {
     readonly operations: D1WalletOperationStore<D1WalletRegistrationNearProvisioningSideEffectRecord>;
     private readonly getCeremonies;
     private readonly decisions;
-    constructor(database: D1DatabaseLike, authority: D1WalletExecutionAuthority | null, operations: D1WalletOperationStore<D1WalletRegistrationNearProvisioningSideEffectRecord>, getCeremonies: () => CloudflareD1RegistrationCeremonyIntentStore, decisions: CloudflareD1Ed25519YaoLifecycleDecisionStoreV1);
+    private readonly passkeyClaims;
+    constructor(database: D1DatabaseLike, authority: D1WalletExecutionAuthority | null, operations: D1WalletOperationStore<D1WalletRegistrationNearProvisioningSideEffectRecord>, getCeremonies: () => CloudflareD1RegistrationCeremonyIntentStore, decisions: CloudflareD1Ed25519YaoLifecycleDecisionStoreV1, passkeyClaims: Pick<D1WalletRegistrationCommitStore, 'prepareHeldPasskeyClaimRead' | 'parseHeldPasskeyClaimRead'>);
     readRespond(home: Parameters<WalletRegistrationHomeAuthority['admitHome']>[0]): Promise<{
         readonly ok: false;
         readonly code: string;
@@ -37,6 +39,7 @@ export declare class D1WalletRegistrationRead {
         ok: true;
         operation: import("../../../cloudflare-adaptor").VersionedJsonRecordReadResult<D1WalletRegistrationNearProvisioningSideEffectRecord>;
         decision: import("../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoLifecycleDecision").RouterAbEd25519YaoLifecycleDecisionV1 | null;
+        heldPasskeyClaim: import("./d1WalletRegistrationCommitStore").HeldRegistrationPasskeyClaim | null;
         readCeremony: () => Promise<import("../../../../core/RegistrationCeremonyStore").StoredWalletRegistrationCeremony | null>;
     }>;
 }

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationService.d.ts

@@ -260,7 +260,7 @@ export declare class CloudflareD1WalletRegistrationService {
     provisionEd25519YaoWalletSession(request: RouterAbEd25519YaoVerifiedWalletUnlockRequestV1): Promise<RouterAbEd25519YaoVerifiedWalletUnlockResponseV1>;
     setupWalletRegistration(input: WalletRegistrationSetupInput): Promise<WalletRegistrationSetupResponseV2>;
     authorizeWalletRegistrationNearAdmission(input: WalletRegistrationNearAdmissionInput): Promise<WalletRegistrationNearAdmissionResponseV2>;
-    respondWalletRegistration(input: WalletRegistrationRespondInput, traceContext?: RouterAbTraceContextV1, timingSink?: Array<readonly [string, number]>): Promise<WalletRegistrationRespondResponseV2>;
+    respondWalletRegistration(input: WalletRegistrationRespondInput, traceContext?: RouterAbTraceContextV1, timingSink?: Array<readonly [string, number]>, waitUntil?: (promise: Promise<unknown>) => void): Promise<WalletRegistrationRespondResponseV2>;
     /** For callers that must read the context before finalize tombstones it. */
     private registrationOwnerProofWithContext;
     authorizeNearRegistrationContinuation(input: {

package/dist/types/wallet-server/src/router/framework/authServicePort.d.ts

@@ -1031,7 +1031,7 @@ export interface RouterApiWalletRegistrationService {
     listWalletEcdsaKeyFactsInventory(input: RouterApiMethodTypes['listWalletEcdsaKeyFactsInventory']['input']): Promise<RouterApiMethodTypes['listWalletEcdsaKeyFactsInventory']['result']>;
     readActiveEmailOtpEnrollment(input: RouterApiMethodTypes['readActiveEmailOtpEnrollment']['input']): Promise<RouterApiMethodTypes['readActiveEmailOtpEnrollment']['result']>;
     setupWalletRegistration(input: WalletRegistrationSetupInput): Promise<RouteResponse>;
-    respondWalletRegistration(input: WalletRegistrationRespondInput, traceContext?: RouterAbTraceContextV1, serverTiming?: Array<readonly [string, number]>): Promise<WalletRegistrationRespondResponseV2>;
+    respondWalletRegistration(input: WalletRegistrationRespondInput, traceContext?: RouterAbTraceContextV1, serverTiming?: Array<readonly [string, number]>, waitUntil?: (promise: Promise<unknown>) => void): Promise<WalletRegistrationRespondResponseV2>;
     authorizeWalletRegistrationNearAdmission(input: WalletRegistrationNearAdmissionInput): Promise<WalletRegistrationNearAdmissionResponseV2>;
     activateWalletRegistration(input: WalletRegistrationActivateInput, traceContext?: RouterAbTraceContextV1, serverTiming?: Array<readonly [string, number]>): Promise<WalletRegistrationActivateResponseV2>;
     completeWalletRegistrationNearProvisioning(input: WalletRegistrationNearProvisioningInput, serverTiming?: Array<readonly [string, number]>, waitUntil?: (promise: Promise<unknown>) => void): Promise<WalletRegistrationNearProvisioningResponseV2>;

package/migrations/d1-signer/0078_registration_passkey_claims.sql

@@ -0,0 +1,20 @@
+-- A passkey ownership claim that shared authority granted for one registration
+-- ceremony before its finalization. Finalization reads the row and skips its
+-- own claim request. A missing row means only that finalization claims again.
+CREATE TABLE registration_passkey_claims (
+  namespace TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  project_id TEXT NOT NULL,
+  env_id TEXT NOT NULL,
+  registration_ceremony_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL,
+  rp_id TEXT NOT NULL,
+  credential_id_b64u TEXT NOT NULL,
+  claimed_at_ms INTEGER NOT NULL,
+  PRIMARY KEY (namespace, org_id, project_id, env_id, registration_ceremony_id)
+);
+
+-- Shared authority never reassigns a claim, so a recorded claim never changes.
+CREATE TRIGGER registration_passkey_claims_immutable
+BEFORE UPDATE ON registration_passkey_claims
+BEGIN SELECT RAISE(ABORT, 'registration_passkey_claims_immutable'); END;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seams/wallet-server",
-  "version": "0.9.1",
+  "version": "0.9.3",
   "type": "module",
   "description": "Seams server TypeScript SDK for NEAR and EVM-family wallets",
   "main": "./dist/esm/index.js",