@seams/wallet-server 0.9.3 → 0.10.0

package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoCapabilityCommit.js

@@ -1,42 +1,63 @@
-import { InMemoryRouterAbEd25519YaoRecoveryService, InMemoryRouterAbEd25519YaoRecoveryStateV1 } from "../recovery/routerAbEd25519YaoRecovery.js";
+import { InMemoryRouterAbEd25519YaoRecoveryService, InMemoryRouterAbEd25519YaoRecoveryStateV1, resolveRouterAbEd25519YaoActiveCapability } from "../recovery/routerAbEd25519YaoRecovery.js";
 //#region src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoCapabilityCommit.ts
-/** The wallet and its initial capability become visible in the same transaction. */
-function commitRouterAbEd25519YaoRegistrationCapability(store, installation, walletWrite) {
-	return commitCapability(store, installRegistration.bind(void 0, installation), walletWrite);
+/**
+* Checks a registration's capability against its admission and its result.
+* The signer row of the wallet commit holds the capability, so a registration
+* reads and writes no recovery state.
+*/
+function validateRouterAbEd25519YaoRegistrationCapability(installation) {
+	return capabilityService(new InMemoryRouterAbEd25519YaoRecoveryStateV1()).installRegistrationFinalizeCapability(installation);
 }
-function rehydrateRouterAbEd25519YaoCapability(store, capability) {
-	return commitCapability(store, installPersisted.bind(void 0, capability), Promise.resolve(null));
-}
-async function commitCapability(store, install, preparedWrite) {
+/**
+* Stores a signer row's capability in the recovery state, where a recovery
+* admission suspends it.
+*/
+async function rehydrateRouterAbEd25519YaoCapability(store, capability) {
 	for (let attempt = 0; attempt < 2; attempt += 1) {
-		const [snapshot, companionWrite] = await Promise.all([store.loadCapabilities(), preparedWrite]);
-		const state = new InMemoryRouterAbEd25519YaoRecoveryStateV1();
-		for (const [key, capability] of snapshot.value.recoveryCapabilities) state.capabilities.set(key, capability);
-		for (const [key, capabilityKey] of snapshot.value.recoveryIdentityCapabilities) state.identityCapabilities.set(key, capabilityKey);
-		const result = install(new InMemoryRouterAbEd25519YaoRecoveryService({
-			admitRecovery: rejectProtocolExecution,
-			resolveRecoveryDispatchRoot: rejectProtocolExecution,
-			executeRecovery: rejectProtocolExecution,
-			activateRecovery: rejectProtocolExecution
-		}, state));
+		const snapshot = await store.loadCapabilities();
+		const state = recoveryStateFromSnapshot(snapshot);
+		const result = capabilityService(state).installPersistedActiveCapability(capability);
 		if (!result.ok) return result;
 		if ((await store.commitCapabilities(snapshot, {
 			capabilities: state.capabilities,
 			identityCapabilities: state.identityCapabilities
-		}, companionWrite)).kind === "stored") return result;
+		}, null)).kind === "stored") return result;
 	}
 	throw new Error("Capability state remained contended after one reconciliation");
 }
-function installRegistration(input, service) {
-	return service.installRegistrationFinalizeCapability(input);
+/**
+* The active capability of a signer row, as the recovery state allows it: a
+* capability that a recovery suspended is not active, and one that a recovery
+* retired conflicts. Nothing is written.
+*/
+function resolveRouterAbEd25519YaoPersistedActiveCapability(snapshot, persisted, lookup) {
+	const state = recoveryStateFromSnapshot(snapshot);
+	const installed = capabilityService(state).installPersistedActiveCapability(persisted);
+	if (!installed.ok) return {
+		ok: false,
+		code: "capability_conflict",
+		message: installed.message
+	};
+	return resolveRouterAbEd25519YaoActiveCapability(state.capabilities, lookup);
+}
+function recoveryStateFromSnapshot(snapshot) {
+	const state = new InMemoryRouterAbEd25519YaoRecoveryStateV1();
+	for (const [key, capability] of snapshot.value.recoveryCapabilities) state.capabilities.set(key, capability);
+	for (const [key, capabilityKey] of snapshot.value.recoveryIdentityCapabilities) state.identityCapabilities.set(key, capabilityKey);
+	return state;
 }
-function installPersisted(input, service) {
-	return service.installPersistedActiveCapability(input);
+function capabilityService(state) {
+	return new InMemoryRouterAbEd25519YaoRecoveryService({
+		admitRecovery: rejectProtocolExecution,
+		resolveRecoveryDispatchRoot: rejectProtocolExecution,
+		executeRecovery: rejectProtocolExecution,
+		activateRecovery: rejectProtocolExecution
+	}, state);
 }
 function rejectProtocolExecution() {
 	throw new Error("A capability commit cannot execute a protocol");
 }
 //#endregion
-export { commitRouterAbEd25519YaoRegistrationCapability, rehydrateRouterAbEd25519YaoCapability };
+export { rehydrateRouterAbEd25519YaoCapability, resolveRouterAbEd25519YaoPersistedActiveCapability, validateRouterAbEd25519YaoRegistrationCapability };
 
 //# sourceMappingURL=routerAbEd25519YaoCapabilityCommit.js.map

package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js

@@ -223,10 +223,10 @@ var RouterAbEd25519YaoProductRegistrationRuntime = class {
 	startRegistrationDispatchRoot() {
 		return null;
 	}
-	async bindAndAdmitVerifiedRegistration(input) {
+	async bindAndAdmitVerifiedRegistration(input, _companionWrite, _startedDispatchRoot, mintedSessionId) {
 		const bound = await this.input.authorization.bindAndAuthorizeAdmission(input);
 		if (!bound.ok) return bound;
-		const admitted = await this.input.registrationService.admit(bound.admissionRequest);
+		const admitted = await this.input.registrationService.admit(bound.admissionRequest, void 0, mintedSessionId);
 		if (!admitted.ok) return admitted;
 		return {
 			ok: true,
@@ -236,6 +236,33 @@ var RouterAbEd25519YaoProductRegistrationRuntime = class {
 			companionWrite: "not_committed"
 		};
 	}
+	/** This runtime issues a receipt at its admission only. */
+	async describeRegistrationAdmission() {
+		return {
+			ok: false,
+			status: 503,
+			code: "admission_failed",
+			message: "This runtime describes no admission before its proof"
+		};
+	}
+	/** This runtime executes through its registration route only. */
+	async executeAdmittedRegistration() {
+		return {
+			result: {
+				ok: false,
+				status: 503,
+				code: "execution_failed",
+				message: "This runtime executes a registration through its execute route"
+			},
+			timing: {
+				credentialDigestMs: 0,
+				d1AdmissionReadMs: 0,
+				routerExecutionMs: 0,
+				routerServerTiming: null,
+				resultReconstructionMs: 0
+			}
+		};
+	}
 	async consumeActivated(request) {
 		return await this.input.registrationService.consumeActivated(request);
 	}
@@ -245,6 +272,10 @@ var RouterAbEd25519YaoProductRegistrationRuntime = class {
 	async resolveActiveCapability(input) {
 		return await this.input.capabilityResolver.resolveActiveCapability(input);
 	}
+	/** This runtime's recovery state already holds every capability it resolves. */
+	async rehydrateActiveCapability(input) {
+		return await this.input.capabilityResolver.resolveActiveCapability(input);
+	}
 };
 /**
 * Projects the Ed25519 Yao view of one exact Wallet Session. Issuance itself
@@ -314,6 +345,24 @@ function createRouterAbEd25519YaoMaterialActivationRefV1(input) {
 	});
 }
 /**
+* Mints the Yao identity of a registration's NEAR branch: its material
+* identity and the session of its admission. Setup stores it, and the
+* admission that follows the proof is issued over it.
+*/
+function mintRouterAbEd25519YaoRegistrationIdentityV1(input) {
+	const sessionId = new Uint8Array(32);
+	do
+		globalThis.crypto.getRandomValues(sessionId);
+	while (sessionId.every(isZeroByte));
+	return {
+		materialActivation: createRouterAbEd25519YaoMaterialActivationRefV1(input),
+		sessionId: Array.from(sessionId)
+	};
+}
+function isZeroByte(byte) {
+	return byte === 0;
+}
+/**
 * Takes the authority *scope* rather than the authority because setup admits
 * before the proof exists. Callers holding a verified authority
 * pass `registrationEd25519AuthorityScopeFromAuthority(authority)`; setup
@@ -400,6 +449,6 @@ async function buildRouterAbEd25519YaoAddSignerAdmissionRequestV1(input) {
 	return parsed.value;
 }
 //#endregion
-export { buildRouterAbEd25519YaoAddSignerAdmissionRequestV1, buildRouterAbEd25519YaoProductAdmissionRequestV1, createRouterAbEd25519YaoMaterialActivationRefV1, createRouterAbEd25519YaoProductRegistrationCompositionFromPortsV1, createRouterAbEd25519YaoProductRegistrationRuntimeV1, createRouterAbEd25519YaoProductRegistrationStateFromPartsV1, createRouterAbEd25519YaoProductRegistrationStateV1, parseRouterAbEd25519YaoProductRegistrationStateV1, projectRouterAbEd25519YaoExactWalletSession, routerAbEd25519YaoPersistedCapabilityMatchesLookupV1 };
+export { buildRouterAbEd25519YaoAddSignerAdmissionRequestV1, buildRouterAbEd25519YaoProductAdmissionRequestV1, createRouterAbEd25519YaoMaterialActivationRefV1, createRouterAbEd25519YaoProductRegistrationCompositionFromPortsV1, createRouterAbEd25519YaoProductRegistrationRuntimeV1, createRouterAbEd25519YaoProductRegistrationStateFromPartsV1, createRouterAbEd25519YaoProductRegistrationStateV1, mintRouterAbEd25519YaoRegistrationIdentityV1, parseRouterAbEd25519YaoProductRegistrationStateV1, projectRouterAbEd25519YaoExactWalletSession, routerAbEd25519YaoPersistedCapabilityMatchesLookupV1 };
 
 //# sourceMappingURL=routerAbEd25519YaoProductRegistration.js.map

package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore.js

@@ -1,7 +1,7 @@
-import { buildRouterAbEd25519YaoRegistrationExecutionAuthorityV1 } from "../registration/routerAbEd25519YaoRegistrationExecutionRecord.js";
 import { createRouterAbEd25519YaoProductRegistrationStateV1 } from "./routerAbEd25519YaoProductRegistration.js";
 import { encodeRouterAbEd25519YaoProductRegistrationStateV1, parseRouterAbEd25519YaoProductRegistrationStateJsonV1 } from "./routerAbEd25519YaoProductRegistrationPersistence.js";
 import { boundedRouterAbEd25519YaoProductRegistrationSharedStateV1, mergeRouterAbEd25519YaoProductRegistrationStatePartitionV1, partitionRouterAbEd25519YaoProductRegistrationStateV1 } from "./routerAbEd25519YaoProductRegistrationPartitioning.js";
+import { buildRouterAbEd25519YaoRegistrationExecutionAuthorityV1 } from "../registration/routerAbEd25519YaoRegistrationExecutionRecord.js";
 //#region src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore.ts
 const ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1 = "router-ab-ed25519-yao:shared";
 const PARTITION_RECORD_CODEC_KIND = "router_ab_ed25519_yao_product_registration_partition_record_json_v1";

package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitioning.js

@@ -1,6 +1,12 @@
 import { createRouterAbEd25519YaoProductRegistrationStateFromPartsV1 } from "./routerAbEd25519YaoProductRegistration.js";
 //#region src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitioning.ts
-const MAX_SHARED_RECOVERY_CAPABILITIES = 32;
+/** A suspended capability belongs to a recovery in progress and has no other record. */
+const MAX_SUSPENDED_RECOVERY_CAPABILITIES = 32;
+/**
+* An active or a retired capability repeats its signer row. A recovery stores
+* one between its installation and its suspension, so only the newest few stay.
+*/
+const MAX_SETTLED_RECOVERY_CAPABILITIES = 4;
 /**
 * Projects the tenant-wide state into shared and lifecycle-owned records.
 * Capability ownership and export nonce replay state deliberately stay in the
@@ -107,14 +113,16 @@ function boundedRouterAbEd25519YaoProductRegistrationSharedStateV1(source) {
 	};
 }
 function boundedRecoveryCapabilities(source) {
-	if (source.size <= MAX_SHARED_RECOVERY_CAPABILITIES) return new Map(source);
 	const entries = [...source.entries()];
 	const suspended = entries.filter(([, capability]) => capability.kind === "suspended");
 	const retained = /* @__PURE__ */ new Set();
-	for (const [key] of suspended.slice(-MAX_SHARED_RECOVERY_CAPABILITIES)) retained.add(key);
-	for (let index = entries.length - 1; index >= 0 && retained.size < MAX_SHARED_RECOVERY_CAPABILITIES; index -= 1) {
+	for (const [key] of suspended.slice(-MAX_SUSPENDED_RECOVERY_CAPABILITIES)) retained.add(key);
+	let settled = 0;
+	for (let index = entries.length - 1; index >= 0 && settled < MAX_SETTLED_RECOVERY_CAPABILITIES; index -= 1) {
 		const entry = entries[index];
-		if (entry) retained.add(entry[0]);
+		if (!entry || entry[1].kind === "suspended") continue;
+		retained.add(entry[0]);
+		settled += 1;
 	}
 	const bounded = /* @__PURE__ */ new Map();
 	for (const [key, capability] of entries) if (retained.has(key)) bounded.set(key, capability);

package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationRequestScopedRuntime.js

@@ -1,12 +1,13 @@
-import { InMemoryRouterAbEd25519YaoRegistrationService } from "../registration/routerAbEd25519YaoRegistration.js";
-import { InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter } from "../registration/routerAbEd25519YaoRegistrationIntentAuthorization.js";
-import { pinRouterAbEd25519YaoRegistrationDispatchRootV1, routerAbEd25519YaoRegistrationExecuteRequestFromRouterRequestJsonV1, routerAbEd25519YaoRegistrationResultFromRouterAnswerV1 } from "../registration/routerAbEd25519YaoRegistrationExecutionRecord.js";
+import { InMemoryRouterAbEd25519YaoRegistrationService, describeRouterAbEd25519YaoRegistrationAdmissionV1 } from "../registration/routerAbEd25519YaoRegistration.js";
+import { InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter, routerAbEd25519YaoCredentialDigestSha256HexV1 } from "../registration/routerAbEd25519YaoRegistrationIntentAuthorization.js";
 import { resolveRouterAbEd25519YaoActiveCapability } from "../recovery/routerAbEd25519YaoRecovery.js";
 import { routerAbEd25519YaoRegistrationSigningRootIdV1 } from "../routerAbEd25519YaoGatewayEnvelope.js";
 import { routerAbEd25519YaoPersistedCapabilityMatchesLookupV1 } from "./routerAbEd25519YaoProductRegistration.js";
-import { routerAbEd25519YaoAdmittedRegistrationAuthorityV1 } from "./routerAbEd25519YaoProductRegistrationPartitionedStateStore.js";
 import { parseRouterAbEd25519YaoRegistrationRouterAnswerV1 } from "../registration/routerAbEd25519YaoHttpRegistrationBackend.js";
-import { rehydrateRouterAbEd25519YaoCapability } from "./routerAbEd25519YaoCapabilityCommit.js";
+import { pinRouterAbEd25519YaoRegistrationDispatchRootV1, routerAbEd25519YaoRegistrationExecuteRequestFromRouterRequestJsonV1, routerAbEd25519YaoRegistrationResultFromRouterAnswerV1 } from "../registration/routerAbEd25519YaoRegistrationExecutionRecord.js";
+import { routerAbEd25519YaoAdmittedRegistrationAuthorityV1 } from "./routerAbEd25519YaoProductRegistrationPartitionedStateStore.js";
+import { executeRouterAbEd25519YaoAdmittedRegistrationV1 } from "../registration/routerAbEd25519YaoRegistrationRequestScopedCloudflare.js";
+import { rehydrateRouterAbEd25519YaoCapability, resolveRouterAbEd25519YaoPersistedActiveCapability } from "./routerAbEd25519YaoCapabilityCommit.js";
 //#region src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationRequestScopedRuntime.ts
 const MAX_DETERMINISTIC_COMMIT_ATTEMPTS = 2;
 /**
@@ -43,15 +44,33 @@ var RouterAbEd25519YaoProductRegistrationRequestScopedRuntime = class {
 			dispatchRoot
 		};
 	}
-	async bindAndAdmitVerifiedRegistration(input, companionWrite, startedDispatchRoot) {
+	async bindAndAdmitVerifiedRegistration(input, companionWrite, startedDispatchRoot, mintedSessionId) {
 		return await bindAndAdmitVerifiedRegistration({
 			input,
 			companionWrite,
 			startedDispatchRoot,
+			mintedSessionId,
 			store: this.input.store,
 			backend: this.input.registrationBackend
 		});
 	}
+	async describeRegistrationAdmission(request, mintedSessionId) {
+		return await describeRouterAbEd25519YaoRegistrationAdmissionV1({
+			backend: this.input.registrationBackend,
+			request,
+			mintedSessionId
+		});
+	}
+	async executeAdmittedRegistration(input) {
+		return await executeRouterAbEd25519YaoAdmittedRegistrationV1({
+			store: this.input.store,
+			backend: this.input.registrationBackend,
+			request: input.request,
+			credentialDigestSha256Hex: await routerAbEd25519YaoCredentialDigestSha256HexV1(input.credential),
+			credentialDigestMs: 0,
+			trace: input.trace
+		});
+	}
 	/**
 	* Consumes a registration's activation at the Router, which owns its
 	* execution: the first consumer binding wins, and the same binding
@@ -102,7 +121,21 @@ var RouterAbEd25519YaoProductRegistrationRequestScopedRuntime = class {
 	async installPersistedActiveCapability(input) {
 		return await rehydrateRouterAbEd25519YaoCapability(this.input.store, input);
 	}
+	/**
+	* The signer row holds a wallet's capability, and the recovery state says
+	* whether a recovery suspended it. Both are read together and nothing is
+	* written, so a lookup never contends with another wallet.
+	*/
 	async resolveActiveCapability(input) {
+		const invalid = resolveRouterAbEd25519YaoActiveCapability(NO_CAPABILITIES, input);
+		if (!invalid.ok && invalid.code === "invalid_lookup") return invalid;
+		const loadPersisted = this.input.loadPersistedActiveCapability;
+		const [loaded, persisted] = await Promise.all([this.input.store.loadCapabilities(), loadPersisted ? loadPersisted(input) : null]);
+		const result = resolveRouterAbEd25519YaoActiveCapability(loaded.value.recoveryCapabilities, input);
+		if (result.ok || result.code !== "unknown_capability" || !persisted || !routerAbEd25519YaoPersistedCapabilityMatchesLookupV1(persisted, input)) return result;
+		return resolveRouterAbEd25519YaoPersistedActiveCapability(loaded, persisted, input);
+	}
+	async rehydrateActiveCapability(input) {
 		const result = resolveRouterAbEd25519YaoActiveCapability((await this.input.store.loadCapabilities()).value.recoveryCapabilities, input);
 		if (result.ok || result.code !== "unknown_capability" || !this.input.loadPersistedActiveCapability) return result;
 		const persisted = await this.input.loadPersistedActiveCapability(input);
@@ -116,6 +149,7 @@ var RouterAbEd25519YaoProductRegistrationRequestScopedRuntime = class {
 		return resolveRouterAbEd25519YaoActiveCapability((await this.input.store.loadCapabilities()).value.recoveryCapabilities, input);
 	}
 };
+const NO_CAPABILITIES = /* @__PURE__ */ new Map();
 /**
 * Binds a verified intent and admits its registration. The tenant root the
 * registration dispatches to is resolved once, for a fresh admission, and
@@ -161,7 +195,7 @@ async function bindAndAdmitVerifiedRegistration(input) {
 			}
 		}
 		if (backendResult === null) try {
-			backendResult = await input.backend.admit(bound.admissionRequest);
+			backendResult = await input.backend.admit(bound.admissionRequest, void 0, input.mintedSessionId);
 		} catch (error) {
 			return {
 				ok: false,

package/dist/esm/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryRequestScopedCloudflare.js

@@ -374,7 +374,7 @@ async function runRecoveryRequest(context, request) {
 async function runAdmissionRequest(context, request) {
 	const first = await runAdmissionTwoPhase(context, request);
 	if (first.kind !== "rejected" || first.value.ok || first.value.code !== "unknown_capability") return mapAdmissionResult(first);
-	const resolved = await context.input.capabilities.resolveActiveCapability({
+	const resolved = await context.input.capabilities.rehydrateActiveCapability({
 		kind: "router_ab_ed25519_yao_active_capability_lookup_v1",
 		walletId: request.application_binding.wallet_id,
 		nearEd25519SigningKeyId: request.application_binding.near_ed25519_signing_key_id,

package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoHttpRegistrationBackend.js

@@ -88,6 +88,9 @@ function randomSession() {
 	while (isZero(bytes));
 	return Array.from(bytes);
 }
+function isSessionId(bytes) {
+	return bytes.length === 32 && bytes.every((byte) => Number.isInteger(byte) && byte >= 0 && byte <= 255) && bytes.some((byte) => byte !== 0);
+}
 function isZero(bytes) {
 	for (const byte of bytes) if (byte !== 0) return false;
 	return true;
@@ -415,8 +418,19 @@ var RouterAbEd25519YaoHttpRegistrationBackend = class {
 		this.lastRouterServerTiming = null;
 		return timing;
 	}
-	async admit(request, _traceContext) {
-		return await this.admitActivation(request, "registration");
+	async prepareRegistrationPair(identity, request, receipt, expiresAtMs) {
+		const tenantRoot = await this.resolveRegistrationDispatchRoot(routerAbEd25519YaoRegistrationSigningRootIdV1(request));
+		if (!(await this.post("/router-ab/router/ed25519-yao/registration/prepare", identity, {
+			tenant_root: tenantRoot,
+			application: request.application_binding,
+			participant_ids: request.participant_ids,
+			binding: receipt.binding,
+			ownership_generation: identity.ownershipGeneration,
+			expires_at_ms: expiresAtMs
+		}, createRouterAbTraceContextV1().value, "exact")).ok) throw new Error("Registration pair preparation failed");
+	}
+	async admit(request, _traceContext, mintedSessionId) {
+		return await this.admitActivation(request, "registration", mintedSessionId);
 	}
 	async admitRecovery(request, _traceContext) {
 		return await this.admitActivation(request, "recovery");
@@ -477,7 +491,7 @@ var RouterAbEd25519YaoHttpRegistrationBackend = class {
 			signing_worker_recipient_public_key: this.config.signingWorkerRecipientPublicKey
 		};
 	}
-	async admitActivation(request, operation) {
+	async admitActivation(request, operation, mintedSessionId) {
 		if (request.scope.signing_worker_id !== this.config.signingWorkerId) return {
 			ok: false,
 			status: 400,
@@ -486,7 +500,13 @@ var RouterAbEd25519YaoHttpRegistrationBackend = class {
 		};
 		const stableContextBinding = await deriveRouterAbEd25519YaoStableContextBindingV1(request.application_binding, request.participant_ids);
 		const keyset = this.keyset();
-		const sessionId = randomSession();
+		if (mintedSessionId !== void 0 && !isSessionId(mintedSessionId)) return {
+			ok: false,
+			status: 500,
+			code: "admission_failed",
+			message: `${operation} minted session is invalid`
+		};
+		const sessionId = mintedSessionId === void 0 ? randomSession() : [...mintedSessionId];
 		switch (operation) {
 			case "registration": return {
 				ok: true,

package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistration.js

@@ -42,6 +42,25 @@ function canonicalWireFingerprint(value) {
 function encodeRouterAbEd25519YaoRegistrationAdmissionFingerprintV1(request) {
 	return canonicalWireFingerprint(request);
 }
+/**
+* The receipt that `backend` issues for `request` over the session that setup
+* minted, checked as an admission checks it. It stores nothing and admits
+* nothing: the admission still follows the verified proof.
+*/
+async function describeRouterAbEd25519YaoRegistrationAdmissionV1(input) {
+	return admissionReceiptFromBackend(input.request, await input.backend.admit(input.request, void 0, input.mintedSessionId));
+}
+function admissionReceiptFromBackend(request, backendResult) {
+	if (!backendResult.ok) return backendFailure(backendResult, "admission_failed");
+	const parsed = parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1(backendResult.body);
+	if (!parsed.ok) return invalidBackendResponse(parsed.message);
+	if (!registrationScopeMatchesReceipt(request, parsed.value)) return invalidBackendResponse("registration admission receipt scope does not match request");
+	return {
+		ok: true,
+		status: 200,
+		value: parsed.value
+	};
+}
 function registrationScopeMatchesReceipt(request, receipt) {
 	const scope = request.scope;
 	const lifecycle = receipt.binding.lifecycle;
@@ -205,7 +224,7 @@ var InMemoryRouterAbEd25519YaoRegistrationService = class {
 		this.lifecycleSessions = state.lifecycleSessions;
 		this.admissionClaims = state.admissionClaims;
 	}
-	async admit(request, traceContext) {
+	async admit(request, traceContext, mintedSessionId) {
 		const preparation = this.prepareAdmit(request);
 		switch (preparation.kind) {
 			case "completed": return {
@@ -219,7 +238,7 @@ var InMemoryRouterAbEd25519YaoRegistrationService = class {
 				try {
 					outcome = {
 						kind: "backend_response",
-						result: await this.backend.admit(request, traceContext)
+						result: await this.backend.admit(request, traceContext, mintedSessionId)
 					};
 				} catch (error) {
 					outcome = {
@@ -290,19 +309,10 @@ var InMemoryRouterAbEd25519YaoRegistrationService = class {
 			code: "admission_uncertain",
 			message: input.outcome.message
 		};
-		const backendResult = input.outcome.result;
-		if (!backendResult.ok) {
-			this.admissionClaims.delete(input.claim.lifecycleId);
-			return backendFailure(backendResult, "admission_failed");
-		}
-		const parsed = parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1(backendResult.body);
+		const parsed = admissionReceiptFromBackend(input.request, input.outcome.result);
 		if (!parsed.ok) {
 			this.admissionClaims.delete(input.claim.lifecycleId);
-			return invalidBackendResponse(parsed.message);
-		}
-		if (!registrationScopeMatchesReceipt(input.request, parsed.value)) {
-			this.admissionClaims.delete(input.claim.lifecycleId);
-			return invalidBackendResponse("registration admission receipt scope does not match request");
+			return parsed;
 		}
 		const key = registrationSessionKey(parsed.value);
 		if (this.states.has(key)) return {
@@ -551,6 +561,6 @@ var InMemoryRouterAbEd25519YaoRegistrationService = class {
 	}
 };
 //#endregion
-export { InMemoryRouterAbEd25519YaoRegistrationService, InMemoryRouterAbEd25519YaoRegistrationStateV1, createRouterAbEd25519YaoRegistrationModule, encodeRouterAbEd25519YaoRegistrationAdmissionFingerprintV1, routerAbEd25519YaoExecutionMatchesAdmissionV1 };
+export { InMemoryRouterAbEd25519YaoRegistrationService, InMemoryRouterAbEd25519YaoRegistrationStateV1, createRouterAbEd25519YaoRegistrationModule, describeRouterAbEd25519YaoRegistrationAdmissionV1, encodeRouterAbEd25519YaoRegistrationAdmissionFingerprintV1, routerAbEd25519YaoExecutionMatchesAdmissionV1 };
 
 //# sourceMappingURL=routerAbEd25519YaoRegistration.js.map

package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationIntentAuthorization.js

@@ -65,6 +65,15 @@ async function routerAbEd25519YaoBearerCredentialDigestV1(request) {
 function routerAbEd25519YaoCredentialDigestHexV1(digest) {
 	return bytesToHex(digest);
 }
+/** The digest that an admission binds for the credential of its registration intent. */
+async function routerAbEd25519YaoCredentialDigestSha256HexV1(credential) {
+	const digest = await credentialDigestSha256(credential);
+	try {
+		return bytesToHex(digest);
+	} finally {
+		digest.fill(0);
+	}
+}
 function bytesToHex(bytes) {
 	let encoded = "";
 	for (const byte of bytes) encoded += byte.toString(16).padStart(2, "0");
@@ -356,6 +365,6 @@ var InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter = class {
 	}
 };
 //#endregion
-export { InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter, InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationStateV1, routerAbEd25519YaoBearerCredentialDigestV1, routerAbEd25519YaoCredentialDigestHexV1 };
+export { InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter, InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationStateV1, routerAbEd25519YaoBearerCredentialDigestV1, routerAbEd25519YaoCredentialDigestHexV1, routerAbEd25519YaoCredentialDigestSha256HexV1 };
 
 //# sourceMappingURL=routerAbEd25519YaoRegistrationIntentAuthorization.js.map

package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationRequestScopedCloudflare.js

@@ -3,8 +3,8 @@ import { ROUTER_AB_TRACE_ID_HEADER_V1, createRouterAbTraceContextV1, parseRouter
 import { json, readJson } from "../../../framework/http.js";
 import { InMemoryRouterAbEd25519YaoRegistrationService, routerAbEd25519YaoExecutionMatchesAdmissionV1 } from "./routerAbEd25519YaoRegistration.js";
 import { InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter, routerAbEd25519YaoBearerCredentialDigestV1 } from "./routerAbEd25519YaoRegistrationIntentAuthorization.js";
-import { pinRouterAbEd25519YaoRegistrationDispatchRootV1, routerAbEd25519YaoRegistrationResultFromRouterAnswerV1 } from "./routerAbEd25519YaoRegistrationExecutionRecord.js";
 import { routerAbEd25519YaoRegistrationSigningRootIdV1 } from "../routerAbEd25519YaoGatewayEnvelope.js";
+import { pinRouterAbEd25519YaoRegistrationDispatchRootV1, routerAbEd25519YaoRegistrationResultFromRouterAnswerV1 } from "./routerAbEd25519YaoRegistrationExecutionRecord.js";
 import { routerAbEd25519YaoAdmittedRegistrationAuthorityV1 } from "../capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore.js";
 import { runRouterAbEd25519YaoRegistrationTwoPhaseV1 } from "./routerAbEd25519YaoRegistrationTwoPhaseRunner.js";
 //#region src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationRequestScopedCloudflare.ts
@@ -172,17 +172,41 @@ async function runAdmissionRequest(input, request, trace) {
 * again, so a completed execution's answer outlives the root's lineage.
 */
 async function runExecutionRequest(input, request, trace) {
-	const lifecycleId = request.binding.lifecycle.lifecycle_id;
 	const credentialStartedAt = performance.now();
 	const credential = await routerAbEd25519YaoBearerCredentialDigestV1(input.request);
+	const credentialDigestMs = elapsedMs(credentialStartedAt);
+	if (!credential.ok) return timedExecutionResult(credential.result, {
+		credentialDigestMs,
+		d1AdmissionReadMs: 0,
+		routerExecutionMs: 0,
+		routerServerTiming: null,
+		resultReconstructionMs: 0
+	});
+	return await executeRouterAbEd25519YaoAdmittedRegistrationV1({
+		store: input.store,
+		backend: input.backend,
+		request,
+		credentialDigestSha256Hex: credential.digestSha256Hex,
+		credentialDigestMs,
+		trace
+	});
+}
+/**
+* Runs one admitted registration for the holder of its credential. The
+* execute route takes the credential from its bearer. A respond that carries
+* the execute request takes it from the signed setup that it just verified.
+*/
+async function executeRouterAbEd25519YaoAdmittedRegistrationV1(input) {
+	const { request, trace } = input;
+	const credential = { digestSha256Hex: input.credentialDigestSha256Hex };
+	const lifecycleId = request.binding.lifecycle.lifecycle_id;
 	const timing = {
-		credentialDigestMs: elapsedMs(credentialStartedAt),
+		credentialDigestMs: input.credentialDigestMs,
 		d1AdmissionReadMs: 0,
 		routerExecutionMs: 0,
 		routerServerTiming: null,
 		resultReconstructionMs: 0
 	};
-	if (!credential.ok) return timedExecutionResult(credential.result, timing);
 	const admissionStartedAt = performance.now();
 	const authority = routerAbEd25519YaoAdmittedRegistrationAuthorityV1((await input.store.loadRegistration(lifecycleId)).state, lifecycleId);
 	const timingBeforeRouter = {
@@ -356,6 +380,22 @@ function registrationResultResponse(result, timing) {
 	}
 	return response;
 }
+/**
+* The timing of one execution as Server-Timing entries, for a route that
+* reports them in its own header: a respond that ran the execution.
+*/
+function routerAbEd25519YaoRegistrationExecutionTimingEntriesV1(timing) {
+	const entries = [
+		["yao_d1_admission_read", timing.d1AdmissionReadMs],
+		["yao_router_execution", timing.routerExecutionMs],
+		["yao_result_reconstruction", timing.resultReconstructionMs]
+	];
+	for (const metric of (timing.routerServerTiming ?? "").split(",")) {
+		const parsed = /^\s*([A-Za-z0-9_]+);dur=([0-9.]+)\s*$/u.exec(metric);
+		if (parsed?.[1] && parsed[2]) entries.push([parsed[1], Number(parsed[2])]);
+	}
+	return entries;
+}
 function registrationExecutionServerTiming(timing) {
 	const gatewayTiming = [
 		serverTimingMetric("yao_credential_digest", timing.credentialDigestMs),
@@ -413,6 +453,6 @@ function terminalStateConflictFailure(result) {
 	};
 }
 //#endregion
-export { handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1 };
+export { executeRouterAbEd25519YaoAdmittedRegistrationV1, handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1, routerAbEd25519YaoRegistrationExecutionTimingEntriesV1 };
 
 //# sourceMappingURL=routerAbEd25519YaoRegistrationRequestScopedCloudflare.js.map

package/dist/esm/router/domains/walletRegistration/walletRegistrationRoutes.js

@@ -5,6 +5,7 @@ import { base64UrlDecode } from "../../../shared-ts/src/utils/base64.js";
 import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { base58Encode } from "../../../shared-ts/src/utils/base58.js";
 import "../../../shared-ts/src/utils/encoders.js";
+import { parseRouterAbEd25519YaoRegistrationActivationExecuteRequestV1 } from "../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { ecdsaClientRootPublicKey33B64uFromString } from "../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { normalizeRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
 import { parseRouterAbEcdsaRegistrationActivationRequestV1, parseRouterAbEcdsaRegistrationRequestV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
@@ -1603,6 +1604,22 @@ async function handleRouterApiWalletRegistrationSetup(input) {
 	});
 	if (!resolved.ok) return routeJson(resolved.status, resolved.body);
 	const principal = context.principal;
+	if (input.services.registrationSetupRateLimit) try {
+		if (!(await input.services.registrationSetupRateLimit({
+			apiKeyId: principal.apiKeyId,
+			orgId: principal.orgId,
+			projectId: context.environment.projectId,
+			envId: context.environment.key,
+			sourceIp: input.sourceIp || "unknown"
+		})).allowed) return routeJson(429, {
+			ok: false,
+			code: "rate_limited",
+			message: "Too many registration attempts. Wait one minute and try again.",
+			retryAfterMs: 6e4
+		});
+	} catch {
+		return routeError(503, "internal", "Registration setup rate limit is unavailable");
+	}
 	const runtimePolicyScope = {
 		orgId: principal.orgId,
 		projectId: context.environment.projectId,
@@ -1729,15 +1746,38 @@ function parseWalletRegistrationRespondRequest(body) {
 	const parsedAuthority = parseWalletRegistrationAuthorityProof(body);
 	if (!parsedAuthority.ok) return parsedAuthority;
 	const authority = parsedAuthority.value;
-	if (planKind === "near_ed25519") return {
-		ok: true,
-		value: {
-			registrationCeremonyId,
-			signedSetup,
-			authority,
-			planKind
-		}
+	if (planKind !== "near_ed25519" && body.ed25519Execution !== void 0) return {
+		ok: false,
+		code: "invalid_body",
+		message: "only an Ed25519-only respond carries its Yao execution"
 	};
+	if (planKind === "near_ed25519") {
+		if (body.ed25519Execution === void 0) return {
+			ok: true,
+			value: {
+				registrationCeremonyId,
+				signedSetup,
+				authority,
+				planKind
+			}
+		};
+		const ed25519Execution = parseRouterAbEd25519YaoRegistrationActivationExecuteRequestV1(body.ed25519Execution);
+		if (!ed25519Execution.ok) return {
+			ok: false,
+			code: "invalid_body",
+			message: ed25519Execution.message
+		};
+		return {
+			ok: true,
+			value: {
+				registrationCeremonyId,
+				signedSetup,
+				authority,
+				planKind,
+				ed25519Execution: ed25519Execution.value
+			}
+		};
+	}
 	const ecdsa = isPlainObject(body.ecdsa) ? body.ecdsa : null;
 	if (!ecdsa || ecdsa.kind !== "router_ab_ecdsa_registration_v1") return {
 		ok: false,