@seams/wallet-server 0.9.3 → 0.10.0

package/dist/esm/router/express.js

@@ -9276,6 +9276,22 @@ async function handleRouterApiWalletRegistrationSetup(input) {
 	});
 	if (!resolved.ok) return routeJson(resolved.status, resolved.body);
 	const principal = context.principal;
+	if (input.services.registrationSetupRateLimit) try {
+		if (!(await input.services.registrationSetupRateLimit({
+			apiKeyId: principal.apiKeyId,
+			orgId: principal.orgId,
+			projectId: context.environment.projectId,
+			envId: context.environment.key,
+			sourceIp: input.sourceIp || "unknown"
+		})).allowed) return routeJson(429, {
+			ok: false,
+			code: "rate_limited",
+			message: "Too many registration attempts. Wait one minute and try again.",
+			retryAfterMs: 6e4
+		});
+	} catch {
+		return routeError(503, "internal", "Registration setup rate limit is unavailable");
+	}
 	const runtimePolicyScope = {
 		orgId: principal.orgId,
 		projectId: context.environment.projectId,
@@ -9402,15 +9418,38 @@ function parseWalletRegistrationRespondRequest(body) {
 	const parsedAuthority = parseWalletRegistrationAuthorityProof(body);
 	if (!parsedAuthority.ok) return parsedAuthority;
 	const authority = parsedAuthority.value;
-	if (planKind === "near_ed25519") return {
-		ok: true,
-		value: {
-			registrationCeremonyId,
-			signedSetup,
-			authority,
-			planKind
-		}
+	if (planKind !== "near_ed25519" && body.ed25519Execution !== void 0) return {
+		ok: false,
+		code: "invalid_body",
+		message: "only an Ed25519-only respond carries its Yao execution"
 	};
+	if (planKind === "near_ed25519") {
+		if (body.ed25519Execution === void 0) return {
+			ok: true,
+			value: {
+				registrationCeremonyId,
+				signedSetup,
+				authority,
+				planKind
+			}
+		};
+		const ed25519Execution = parseRouterAbEd25519YaoRegistrationActivationExecuteRequestV1(body.ed25519Execution);
+		if (!ed25519Execution.ok) return {
+			ok: false,
+			code: "invalid_body",
+			message: ed25519Execution.message
+		};
+		return {
+			ok: true,
+			value: {
+				registrationCeremonyId,
+				signedSetup,
+				authority,
+				planKind,
+				ed25519Execution: ed25519Execution.value
+			}
+		};
+	}
 	const ecdsa = isPlainObject(body.ecdsa) ? body.ecdsa : null;
 	if (!ecdsa || ecdsa.kind !== "router_ab_ecdsa_registration_v1") return {
 		ok: false,
@@ -10625,7 +10664,7 @@ function resolveWalletRegistrationRoute(ctx) {
 async function handleWalletRegistration(ctx) {
 	const route = resolveWalletRegistrationRoute(ctx);
 	if (!route) return null;
-	if (ctx.request.headers.get("X-Seams-Wallet-Protocol") !== "3") return jsonFailure(409, "wallet_protocol_mismatch", "Your wallet application needs an update. Reload this page and try again. If the problem continues, ask the application developer to upgrade the Wallet SDK.");
+	if (ctx.request.headers.get("X-Seams-Wallet-Protocol") !== "4") return jsonFailure(409, "wallet_protocol_mismatch", "Your wallet application needs an update. Reload this page and try again. If the problem continues, ask the application developer to upgrade the Wallet SDK.");
 	const common = {
 		body: await readJson(ctx.request),
 		headers: Object.fromEntries(ctx.request.headers.entries()),
@@ -10645,7 +10684,8 @@ async function handleWalletRegistration(ctx) {
 			routerAbPublicKeyset: ctx.opts.routerAbPublicKeyset,
 			session: ctx.opts.session,
 			publishableKeyAuth: ctx.opts.publishableKeyAuth,
-			registrationContext: ctx.opts.registrationContext
+			registrationContext: ctx.opts.registrationContext,
+			registrationSetupRateLimit: ctx.opts.registrationSetupRateLimit
 		},
 		sourceIp: resolveSourceIpFromFetchHeaders(ctx.request.headers) || void 0,
 		signingSessionSeal: ctx.opts.signingSessionSeal,
@@ -24750,6 +24790,9 @@ function randomSession() {
 	while (isZero(bytes));
 	return Array.from(bytes);
 }
+function isSessionId(bytes) {
+	return bytes.length === 32 && bytes.every((byte) => Number.isInteger(byte) && byte >= 0 && byte <= 255) && bytes.some((byte) => byte !== 0);
+}
 function isZero(bytes) {
 	for (const byte of bytes) if (byte !== 0) return false;
 	return true;
@@ -25067,8 +25110,19 @@ var RouterAbEd25519YaoHttpRegistrationBackend = class {
 		this.lastRouterServerTiming = null;
 		return timing;
 	}
-	async admit(request, _traceContext) {
-		return await this.admitActivation(request, "registration");
+	async prepareRegistrationPair(identity, request, receipt, expiresAtMs) {
+		const tenantRoot = await this.resolveRegistrationDispatchRoot(routerAbEd25519YaoRegistrationSigningRootIdV1(request));
+		if (!(await this.post("/router-ab/router/ed25519-yao/registration/prepare", identity, {
+			tenant_root: tenantRoot,
+			application: request.application_binding,
+			participant_ids: request.participant_ids,
+			binding: receipt.binding,
+			ownership_generation: identity.ownershipGeneration,
+			expires_at_ms: expiresAtMs
+		}, createRouterAbTraceContextV1().value, "exact")).ok) throw new Error("Registration pair preparation failed");
+	}
+	async admit(request, _traceContext, mintedSessionId) {
+		return await this.admitActivation(request, "registration", mintedSessionId);
 	}
 	async admitRecovery(request, _traceContext) {
 		return await this.admitActivation(request, "recovery");
@@ -25129,7 +25183,7 @@ var RouterAbEd25519YaoHttpRegistrationBackend = class {
 			signing_worker_recipient_public_key: this.config.signingWorkerRecipientPublicKey
 		};
 	}
-	async admitActivation(request, operation) {
+	async admitActivation(request, operation, mintedSessionId) {
 		if (request.scope.signing_worker_id !== this.config.signingWorkerId) return {
 			ok: false,
 			status: 400,
@@ -25138,7 +25192,13 @@ var RouterAbEd25519YaoHttpRegistrationBackend = class {
 		};
 		const stableContextBinding = await deriveRouterAbEd25519YaoStableContextBindingV1(request.application_binding, request.participant_ids);
 		const keyset = this.keyset();
-		const sessionId = randomSession();
+		if (mintedSessionId !== void 0 && !isSessionId(mintedSessionId)) return {
+			ok: false,
+			status: 500,
+			code: "admission_failed",
+			message: `${operation} minted session is invalid`
+		};
+		const sessionId = mintedSessionId === void 0 ? randomSession() : [...mintedSessionId];
 		switch (operation) {
 			case "registration": return {
 				ok: true,
@@ -26206,10 +26266,10 @@ var RouterAbEd25519YaoProductRegistrationRuntime = class {
 	startRegistrationDispatchRoot() {
 		return null;
 	}
-	async bindAndAdmitVerifiedRegistration(input) {
+	async bindAndAdmitVerifiedRegistration(input, _companionWrite, _startedDispatchRoot, mintedSessionId) {
 		const bound = await this.input.authorization.bindAndAuthorizeAdmission(input);
 		if (!bound.ok) return bound;
-		const admitted = await this.input.registrationService.admit(bound.admissionRequest);
+		const admitted = await this.input.registrationService.admit(bound.admissionRequest, void 0, mintedSessionId);
 		if (!admitted.ok) return admitted;
 		return {
 			ok: true,
@@ -26219,6 +26279,33 @@ var RouterAbEd25519YaoProductRegistrationRuntime = class {
 			companionWrite: "not_committed"
 		};
 	}
+	/** This runtime issues a receipt at its admission only. */
+	async describeRegistrationAdmission() {
+		return {
+			ok: false,
+			status: 503,
+			code: "admission_failed",
+			message: "This runtime describes no admission before its proof"
+		};
+	}
+	/** This runtime executes through its registration route only. */
+	async executeAdmittedRegistration() {
+		return {
+			result: {
+				ok: false,
+				status: 503,
+				code: "execution_failed",
+				message: "This runtime executes a registration through its execute route"
+			},
+			timing: {
+				credentialDigestMs: 0,
+				d1AdmissionReadMs: 0,
+				routerExecutionMs: 0,
+				routerServerTiming: null,
+				resultReconstructionMs: 0
+			}
+		};
+	}
 	async consumeActivated(request) {
 		return await this.input.registrationService.consumeActivated(request);
 	}
@@ -26228,6 +26315,10 @@ var RouterAbEd25519YaoProductRegistrationRuntime = class {
 	async resolveActiveCapability(input) {
 		return await this.input.capabilityResolver.resolveActiveCapability(input);
 	}
+	/** This runtime's recovery state already holds every capability it resolves. */
+	async rehydrateActiveCapability(input) {
+		return await this.input.capabilityResolver.resolveActiveCapability(input);
+	}
 };
 function createRouterAbEd25519YaoProductRegistrationRuntimeV1(input) {
 	return new RouterAbEd25519YaoProductRegistrationRuntime(input);

package/dist/esm/router/framework/registrationSetupDispatch.js

@@ -1,12 +1,38 @@
 //#region src/router/framework/registrationSetupDispatch.ts
+/** A transient storage fault outlived its retries. The same request can succeed later. */
+const SETUP_STORAGE_UNAVAILABLE = {
+	status: 503,
+	message: "Wallet registration setup is temporarily unavailable. Try again."
+};
+const SETUP_INTERNAL_FAILURE = {
+	status: 500,
+	message: "Wallet registration setup failed"
+};
 async function dispatchWalletRegistrationSetup(context, input) {
 	const forwarded = await context.dispatcher?.dispatch(input);
 	if (forwarded) return forwarded;
 	const result = await context.local.setupWalletRegistration(input);
-	return {
-		status: result.ok ? 200 : 400,
+	if (result.ok) return {
+		status: 200,
+		body: result
+	};
+	const serverFailure = result.code === "storage_unavailable" ? SETUP_STORAGE_UNAVAILABLE : result.code === "internal" ? SETUP_INTERNAL_FAILURE : null;
+	if (!serverFailure) return {
+		status: 400,
 		body: result
 	};
+	console.error("[wallet-registration] setup failed", {
+		code: result.code,
+		reason: result.message
+	});
+	return {
+		status: serverFailure.status,
+		body: {
+			ok: false,
+			code: result.code,
+			message: serverFailure.message
+		}
+	};
 }
 //#endregion
 export { dispatchWalletRegistrationSetup };

package/dist/esm/router/transport/fetch/routes/walletRegistration.js

@@ -44,7 +44,7 @@ function resolveWalletRegistrationRoute(ctx) {
 async function handleWalletRegistration(ctx) {
 	const route = resolveWalletRegistrationRoute(ctx);
 	if (!route) return null;
-	if (ctx.request.headers.get("X-Seams-Wallet-Protocol") !== "3") return jsonFailure(409, "wallet_protocol_mismatch", "Your wallet application needs an update. Reload this page and try again. If the problem continues, ask the application developer to upgrade the Wallet SDK.");
+	if (ctx.request.headers.get("X-Seams-Wallet-Protocol") !== "4") return jsonFailure(409, "wallet_protocol_mismatch", "Your wallet application needs an update. Reload this page and try again. If the problem continues, ask the application developer to upgrade the Wallet SDK.");
 	const common = {
 		body: await readJson(ctx.request),
 		headers: Object.fromEntries(ctx.request.headers.entries()),
@@ -64,7 +64,8 @@ async function handleWalletRegistration(ctx) {
 			routerAbPublicKeyset: ctx.opts.routerAbPublicKeyset,
 			session: ctx.opts.session,
 			publishableKeyAuth: ctx.opts.publishableKeyAuth,
-			registrationContext: ctx.opts.registrationContext
+			registrationContext: ctx.opts.registrationContext,
+			registrationSetupRateLimit: ctx.opts.registrationSetupRateLimit
 		},
 		sourceIp: resolveSourceIpFromFetchHeaders(ctx.request.headers) || void 0,
 		signingSessionSeal: ctx.opts.signingSessionSeal,

package/dist/esm/storage/d1Retry.js

@@ -0,0 +1,38 @@
+//#region src/storage/d1Retry.ts
+/**
+* The faults Cloudflare documents as safe to retry for D1: the connection to
+* the database dropped, or the database restarted under the query. The request
+* itself was sound. D1 retries read-only queries on its own; writes reach the
+* caller.
+*/
+const TRANSIENT_D1_ERROR_FRAGMENTS = [
+	"Network connection lost",
+	"storage caused object to be reset",
+	"reset because its code was updated"
+];
+/** One wait before each retry, so an operation runs three times at most. */
+const TRANSIENT_D1_RETRY_DELAYS_MS = [25, 100];
+function isTransientD1Error(error) {
+	const message = error instanceof Error ? error.message : String(error);
+	return TRANSIENT_D1_ERROR_FRAGMENTS.some((fragment) => message.includes(fragment));
+}
+/**
+* Runs `operation` again after a transient D1 fault. Such a fault does not say
+* whether a write committed, so `operation` must give the same result when it
+* runs after its own earlier commit: reads, `INSERT OR IGNORE`, and conditional
+* writes that accept their own outcome. It must build its statements on each
+* run. Every other error, and the last transient one, reaches the caller.
+*/
+async function retryTransientD1(operation) {
+	for (const delayMs of TRANSIENT_D1_RETRY_DELAYS_MS) try {
+		return await operation();
+	} catch (error) {
+		if (!isTransientD1Error(error)) throw error;
+		await new Promise((resolve) => setTimeout(resolve, delayMs));
+	}
+	return await operation();
+}
+//#endregion
+export { isTransientD1Error, retryTransientD1 };
+
+//# sourceMappingURL=d1Retry.js.map

package/dist/types/shared-ts/src/utils/walletManagementProtocol.d.ts

@@ -1,3 +1,3 @@
 export declare const WALLET_MANAGEMENT_PROTOCOL_HEADER = "X-Seams-Wallet-Protocol";
-export declare const WALLET_MANAGEMENT_PROTOCOL_VERSION = "3";
+export declare const WALLET_MANAGEMENT_PROTOCOL_VERSION = "4";
 //# sourceMappingURL=walletManagementProtocol.d.ts.map

package/dist/types/wallet-server/src/core/RegistrationCeremonyStore.d.ts

@@ -10,6 +10,7 @@ import type { RuntimePolicyScope } from '../../../shared-ts/src/threshold/signin
 import { type ThresholdEcdsaChainTarget } from './thresholdEcdsaChainTarget';
 import type { RouterAbEd25519YaoActivationAdmissionReceiptV1, RouterAbEd25519YaoActivationResultV1, RouterAbEd25519YaoBytes32V1, RouterAbEd25519YaoRegistrationAdmissionRequestV1 } from '../../../shared-ts/src/utils/routerAbEd25519Yao';
 import type { RouterAbEcdsaDerivationPublicCapabilityV1, RouterAbEcdsaRegistrationActivationReceiptV1, RouterAbEcdsaRegistrationRequestV1, RouterAbEcdsaStrictForwardedRegistrationResponseV1, RouterAbEcdsaVerifiedClientActivationFactsV1 } from '../../../shared-ts/src/utils/routerAbEcdsaDerivation';
+import type { RouterAbMpcMaterialActivationRefWire } from '../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
 import type { RouterAbEcdsaPendingActivationV1 } from '../router/domains/ecdsa/routerAbEcdsaStrictRegistration';
 import type { WalletEd25519SignerRecord } from './WalletStore';
 import { type WalletAuthAuthorityRef } from '../../../shared-ts/src/utils/walletAuthAuthority';
@@ -216,6 +217,15 @@ export type StoredWalletRegistrationCeremonyAuthorityState = {
     authority: StoredRegistrationAuthority;
     authMethod?: never;
 };
+/**
+ * The Yao identity of a registration's NEAR branch. Setup mints it, and the
+ * admission that respond issues after the proof is over these values. It
+ * grants nothing: no admission exists until the proof is verified.
+ */
+export type StoredWalletRegistrationEd25519YaoMint = {
+    materialActivation: RouterAbMpcMaterialActivationRefWire;
+    sessionId: RouterAbEd25519YaoBytes32V1;
+};
 type StoredWalletRegistrationCeremonyBase = {
     registrationCeremonyId: string;
     foundingWalletAuthorityId: WalletAuthorityId;
@@ -231,6 +241,8 @@ type StoredWalletRegistrationCeremonyBase = {
     expectedOrigin?: string;
     expiresAtMs: number;
     authorityState: StoredWalletRegistrationCeremonyAuthorityState;
+    /** `null` exactly when the signer plan has no NEAR branch. */
+    ed25519YaoMint: StoredWalletRegistrationEd25519YaoMint | null;
 };
 export type StoredWalletRegistrationCeremony = StoredWalletRegistrationCeremonyBase & {
     signerState: StoredWalletRegistrationSignerState;

package/dist/types/wallet-server/src/core/d1Ed25519SignerRead.d.ts

@@ -1,16 +1,13 @@
 import type { WalletId } from '../../../shared-ts/src/utils/domainIds';
 import { type RouterAbMpcMaterialActivationRefWire } from '../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
 import type { WalletEd25519SignerRecord } from './WalletStore';
-import { type RouterAbEd25519YaoActiveCapabilityLookupV1 } from '../router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery';
 /** Signer rows read with a Wallet Session; a failure surfaces after session validation. */
 export declare class Ed25519SignerRead {
     #private;
     private readonly walletId;
     private readonly activation;
-    private readonly capabilities;
     private constructor();
-    static fromRows(walletId: WalletId, activation: RouterAbMpcMaterialActivationRefWire, rows: unknown, capabilityPartition: unknown): Ed25519SignerRead;
-    resolveActiveCapability(input: RouterAbEd25519YaoActiveCapabilityLookupV1): import("../router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery").RouterAbEd25519YaoActiveCapabilityLookupResultV1 | null;
+    static fromRows(walletId: WalletId, activation: RouterAbMpcMaterialActivationRefWire, rows: unknown): Ed25519SignerRead;
     /** The session wallet's signer for the activation this read selected, or null. */
     resolve(walletId: WalletId, activation: RouterAbMpcMaterialActivationRefWire): WalletEd25519SignerRecord | null;
 }

package/dist/types/wallet-server/src/core/threeRouteRegistrationContracts.d.ts

@@ -11,7 +11,7 @@ import type { RegistrationAuthority } from '../../../shared-ts/src/utils/registr
 import type { WalletAuthAuthority } from '../../../shared-ts/src/utils/walletAuthAuthority';
 import type { WalletCustodyRegistrationOutcome } from '../../../shared-ts/src/passkey-custody';
 import type { DigestB64u } from '../../../shared-ts/src/utils/canonicalPrimitives';
-import type { RouterAbEd25519YaoActivationAdmissionReceiptV1 } from '../../../shared-ts/src/utils/routerAbEd25519Yao';
+import type { RouterAbEd25519YaoActivationAdmissionReceiptV1, RouterAbEd25519YaoActivationResultV1 } from '../../../shared-ts/src/utils/routerAbEd25519Yao';
 import type { ThresholdEd25519AuthorityScope, EcdsaDerivationServerBootstrapResponse } from './types';
 import type { StoredWalletRegistrationNearEd25519YaoAuthorizedBranch, StoredWalletRegistrationPreparedContext } from './RegistrationCeremonyStore';
 /**
@@ -151,6 +151,14 @@ export type WalletRegistrationRouteErrorV2 = {
  * defers is simpler and strictly safer, so Ed25519 work does not appear in the
  * setup request or response at all. Respond derives it, authority-bound, for
  * both methods.
+ *
+ * Setup does mint the Yao identity of a NEAR branch, its material identity
+ * and its session, and stores it with the ceremony. That identity binds no
+ * authority and admits nothing: respond issues the admission over it.
+ *
+ * For an Ed25519-only passkey plan, setup also describes that admission (see
+ * `WalletRegistrationSetupEd25519AdmissionV2`). The description is not work
+ * and not an admission. It lets the client prepare during the prompt.
  */
 type WalletRegistrationSetupSuccessBase = {
     readonly home: WalletSessionHome;
@@ -164,6 +172,27 @@ type WalletRegistrationSetupSuccessBase = {
     /** Opaque; echoed verbatim on routes 2 and 3. */
     signedSetup: SignedSetupPayloadB64u;
 };
+/**
+ * What setup says about the Yao admission of an Ed25519-only plan.
+ *
+ * A passkey's authority scope is its relying party, which the intent fixes.
+ * So setup can describe the admission that respond will issue: the request,
+ * and the receipt over the session that setup minted. The client prepares
+ * its protocol inputs from it during the prompt and sends them with the
+ * proof. Nothing is admitted until respond has verified that proof.
+ *
+ * An Email OTP scope holds the verified provider subject, so its admission
+ * is known after the proof only.
+ */
+export type WalletRegistrationSetupEd25519AdmissionV2 = {
+    readonly status: 'described';
+    readonly admissionRequest: RespondEd25519DeferredWorkV2['admissionRequest'];
+    readonly admissionReceipt: RouterAbEd25519YaoActivationAdmissionReceiptV1<'registration'>;
+} | {
+    readonly status: 'after_proof';
+    readonly admissionRequest?: never;
+    readonly admissionReceipt?: never;
+};
 /**
  * Setup's shape follows the signer plan, exhaustively.
  *
@@ -178,6 +207,7 @@ export type WalletRegistrationSetupResponseV2 = (WalletRegistrationSetupSuccessB
 }) | (WalletRegistrationSetupSuccessBase & {
     kind: 'near_ed25519';
     ecdsa?: never;
+    ed25519: WalletRegistrationSetupEd25519AdmissionV2;
 }) | WalletRegistrationRouteErrorV2;
 /**
  * What respond returns for the ceremony's signer plan.
@@ -205,11 +235,25 @@ type WalletRegistrationRespondSignerPlanV2 = {
     /** The client completes Yao and recovery backup before committing this wallet. */
     kind: 'near_ed25519';
     ecdsa?: never;
-    ed25519: {
-        readonly status: 'admitted';
-        readonly admissionRequest: RespondEd25519DeferredWorkV2['admissionRequest'];
-        readonly admissionReceipt: RouterAbEd25519YaoActivationAdmissionReceiptV1<'registration'>;
-    };
+    ed25519: WalletRegistrationRespondEd25519AdmissionV2;
+};
+/**
+ * `executed` answers a respond that carried the execute request: the Gateway
+ * admitted and then ran it, and `activationResult` is what the execute route
+ * returns. `admitted` answers every other respond, and a respond whose
+ * execution did not complete: the admission is stored, and the client runs
+ * or repeats the execution through the execute route.
+ */
+export type WalletRegistrationRespondEd25519AdmissionV2 = {
+    readonly status: 'admitted';
+    readonly admissionRequest: RespondEd25519DeferredWorkV2['admissionRequest'];
+    readonly admissionReceipt: RouterAbEd25519YaoActivationAdmissionReceiptV1<'registration'>;
+    readonly activationResult?: never;
+} | {
+    readonly status: 'executed';
+    readonly admissionRequest: RespondEd25519DeferredWorkV2['admissionRequest'];
+    readonly admissionReceipt: RouterAbEd25519YaoActivationAdmissionReceiptV1<'registration'>;
+    readonly activationResult: RouterAbEd25519YaoActivationResultV1<'registration'>;
 };
 /** Exact A/B role bundles, unchanged from the derivation respond leg. */
 type RespondEcdsaProofBundles = {

package/dist/types/wallet-server/src/hosted-wallet-gateway.d.ts

@@ -95,7 +95,7 @@ export interface HostedWalletGatewayDependenciesV1 {
     /** Host loader for the signer WASM; defaults to the Workers module import. */
     readonly signerWasm?: CloudflareD1RouterApiAuthServiceOptions['signerWasmModuleOrPath'];
 }
-export declare function createStagingEd25519YaoBackend(env: CloudflareD1GatewayBaseEnv, resolveTenantRoot: RouterAbEd25519YaoTenantRootResolverV1): import("./cloud-host").RouterAbEd25519YaoPinnedRegistrationBackend & import("./router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery").RouterAbEd25519YaoRecoveryBackend & import("./cloud-host").RouterAbEd25519YaoExportBackend;
+export declare function createStagingEd25519YaoBackend(env: CloudflareD1GatewayBaseEnv, resolveTenantRoot: RouterAbEd25519YaoTenantRootResolverV1): import("./cloud-host").RouterAbEd25519YaoHttpRegistrationBackend;
 /**
  * The split Wallet Gateway: serves the Wallet runtime only, holds no Console
  * database binding, and reaches the Wallet Console deployment exclusively

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationCeremonyStore.d.ts

@@ -22,7 +22,13 @@ export declare class CloudflareD1RegistrationCeremonyIntentStore {
     private readonly storage;
     constructor(input: RegistrationCeremonyIntentStoreConfig);
     getSetupCeremony(ceremonyId: string): Promise<StoredWalletRegistrationCeremony | null>;
-    /** One batch stores the setup snapshot, ceremony, and authenticated execution identity. */
+    /**
+     * One batch stores the setup snapshot, ceremony, and authenticated execution identity.
+     *
+     * The batch is safe to repeat after a transient fault. Its inserts ignore an
+     * existing row, its reads return the stored winner, and the home reservation
+     * accepts its own earlier row. A repeat after a lost commit is an exact retry.
+     */
     reserveSetupCeremony(proposed: StoredWalletRegistrationCeremony, ownershipGeneration: number): Promise<StoredWalletRegistrationCeremony>;
     getCeremony(registrationCeremonyId: string): Promise<StoredWalletRegistrationCeremony | null>;
     prepareCeremonyRead(registrationCeremonyId: string): D1PreparedStatementLike;

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationSetupRateLimit.d.ts

@@ -0,0 +1,7 @@
+import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
+import type { RegistrationSetupRateLimitInput } from '../../../framework/registrationSetupRateLimit';
+/** Regional counters bound the work that runs before a passkey is verified. */
+export declare function consumeRegistrationSetupRateLimit(database: D1DatabaseLike, namespace: string, input: RegistrationSetupRateLimitInput): Promise<{
+    readonly allowed: boolean;
+}>;
+//# sourceMappingURL=d1RegistrationSetupRateLimit.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationService.d.ts

@@ -8,7 +8,7 @@ import { type WalletId } from '../../../../../../shared-ts/src/utils/registratio
 import { type RouterAbEcdsaDerivationActivationRefreshForwardedResponseV1, type RouterAbEcdsaDerivationActivationRefreshRequestV1, type RouterAbEcdsaDerivationNormalSigningStateV1, type RouterAbEcdsaPostRegistrationSessionActivationRequestV1, type RouterAbEcdsaRegistrationActivationReceiptV1, type RouterAbEcdsaRegistrationRequestFactsV1, type RouterAbEcdsaVerifiedClientActivationFactsV1 } from '../../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
 import { type RouterAbEd25519YaoExportAuthorizationIdentityV1 } from '../../../../../../shared-ts/src/utils/routerAbEd25519Yao';
 import { type RouterAbMpcMaterialActivationRefWire } from '../../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
-import type { RouterAbTraceContextV1 } from '../../../../../../shared-ts/src/utils/routerAbTraceContext';
+import { type RouterAbTraceContextV1 } from '../../../../../../shared-ts/src/utils/routerAbTraceContext';
 import type { AuthorizationService } from '../../../../authorization/service';
 import { type ThresholdEcdsaKeyInventoryDiagnostics, type ThresholdEcdsaKeyInventoryRecord } from '../../../../core/authService/thresholdEcdsaKeyInventory';
 import type { EcdsaMaterialActivationReadInput } from '../../../../core/d1EcdsaSignerRead';

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationSetupExecution.d.ts

@@ -1,6 +1,7 @@
 import type { WalletSessionHome } from '../../../../../../shared-ts/src/device-linking/contracts';
 import type { WalletRegistrationSetupResponseV2 } from '../../../../core/threeRouteRegistrationContracts';
 import { type RouterAbEcdsaStrictRegistrationPort } from '../../../domains/ecdsa/routerAbEcdsaStrictRegistration';
+import { type RouterAbEd25519YaoProductRegistrationRuntimeV1 } from '../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration';
 import type { WalletRegistrationSetupInput } from '../../../domains/walletRegistration/walletRegistrationInputs';
 import type { RegistrationWalletStarter, WalletRegistrationReservationAuthority } from '../../../domains/walletRegistration/walletRegistrationReservation';
 import { CloudflareD1RegistrationCeremonyIntentStore } from './d1RegistrationCeremonyStore';
@@ -9,6 +10,8 @@ type WalletRegistrationSetupDependencies = {
     readonly reservation: Pick<WalletRegistrationReservationAuthority, 'reserve'> | null;
     readonly store: CloudflareD1RegistrationCeremonyIntentStore;
     readonly ecdsaStrictRegistration: RouterAbEcdsaStrictRegistrationPort;
+    /** The runtime of Ed25519 Yao registrations, or `null` when none is configured. */
+    readonly ed25519Yao: Pick<RouterAbEd25519YaoProductRegistrationRuntimeV1, 'signingWorkerId' | 'describeRegistrationAdmission'> | null;
     readonly startRegistrationWallets: RegistrationWalletStarter | null;
 };
 export declare function executeD1WalletRegistrationSetup(input: WalletRegistrationSetupInput, dependencies: WalletRegistrationSetupDependencies): Promise<WalletRegistrationSetupResponseV2>;

package/dist/types/wallet-server/src/router/cloudflare/runtime/walletGateway.d.ts

@@ -18,7 +18,7 @@ export declare function walletConsoleSignedDelegateRouteDefinitionV1(routePath:
 export declare function walletConsoleSponsoredEvmCallRouteDefinitionV1(routePath?: string): RouteDefinition;
 export declare function walletConsoleRelayRouteDefinitionsV1(): readonly RouteDefinition[];
 export declare function createWalletConsoleRelayProxyExtensionV1(binding: WalletConsoleServiceBinding): RouterApiRouteExtension;
-type WalletGatewayManagedRouterOption = 'apiKeyAuth' | 'publishableKeyAuth' | 'registrationContext' | 'apiKeyUsageMeter' | 'orgProjectEnv' | 'routerAbNormalSigningAdmission' | 'routeExtensions';
+type WalletGatewayManagedRouterOption = 'apiKeyAuth' | 'publishableKeyAuth' | 'registrationContext' | 'registrationSetupRateLimit' | 'apiKeyUsageMeter' | 'orgProjectEnv' | 'routerAbNormalSigningAdmission' | 'routeExtensions';
 export interface CloudflareWalletGatewayRouterOptionsV1 {
     readonly service: Parameters<typeof createCloudflareRouter>[0];
     readonly walletConsole: WalletConsoleServiceBinding;

package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoCapabilityCommit.d.ts

@@ -1,7 +1,21 @@
 import type { WalletEd25519YaoActiveCapabilityRecord } from '../../../../core/WalletStore';
-import { type RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallationV1, type RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallResultV1 } from '../recovery/routerAbEd25519YaoRecovery';
-import type { RouterAbEd25519YaoPreparedWriteV1, RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1 } from './routerAbEd25519YaoProductRegistrationPartitionedStateStore';
-/** The wallet and its initial capability become visible in the same transaction. */
-export declare function commitRouterAbEd25519YaoRegistrationCapability(store: RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, installation: RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallationV1, walletWrite: Promise<RouterAbEd25519YaoPreparedWriteV1>): Promise<RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallResultV1>;
+import { type RouterAbEd25519YaoActiveCapabilityLookupResultV1, type RouterAbEd25519YaoActiveCapabilityLookupV1, type RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallationV1, type RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallResultV1 } from '../recovery/routerAbEd25519YaoRecovery';
+import type { RouterAbEd25519YaoCapabilitySnapshotV1, RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1 } from './routerAbEd25519YaoProductRegistrationPartitionedStateStore';
+/**
+ * Checks a registration's capability against its admission and its result.
+ * The signer row of the wallet commit holds the capability, so a registration
+ * reads and writes no recovery state.
+ */
+export declare function validateRouterAbEd25519YaoRegistrationCapability(installation: RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallationV1): RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallResultV1;
+/**
+ * Stores a signer row's capability in the recovery state, where a recovery
+ * admission suspends it.
+ */
 export declare function rehydrateRouterAbEd25519YaoCapability(store: RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, capability: WalletEd25519YaoActiveCapabilityRecord): Promise<RouterAbEd25519YaoRegistrationFinalizeCapabilityInstallResultV1>;
+/**
+ * The active capability of a signer row, as the recovery state allows it: a
+ * capability that a recovery suspended is not active, and one that a recovery
+ * retired conflicts. Nothing is written.
+ */
+export declare function resolveRouterAbEd25519YaoPersistedActiveCapability(snapshot: RouterAbEd25519YaoCapabilitySnapshotV1, persisted: WalletEd25519YaoActiveCapabilityRecord, lookup: RouterAbEd25519YaoActiveCapabilityLookupV1): RouterAbEd25519YaoActiveCapabilityLookupResultV1;
 //# sourceMappingURL=routerAbEd25519YaoCapabilityCommit.d.ts.map

package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.d.ts

@@ -1,7 +1,9 @@
 import { type AddSignerIntentV1, type WalletId } from '../../../../../../shared-ts/src/utils/registrationIntent';
 import { type RegistrationEd25519AuthorityScope } from '../../../../../../shared-ts/src/utils/registrationIds';
 import { type RegistrationNearEd25519SignerPlan } from '../../../../../../shared-ts/src/utils/registrationSignerPlan';
-import { type RouterAbEd25519YaoActivationAdmissionReceiptV1, type RouterAbEd25519YaoRegistrationAdmissionRequestV1 } from '../../../../../../shared-ts/src/utils/routerAbEd25519Yao';
+import { type RouterAbEd25519YaoActivationAdmissionReceiptV1, type RouterAbEd25519YaoActivationExecuteRequestV1, type RouterAbEd25519YaoBytes32V1, type RouterAbEd25519YaoRegistrationAdmissionRequestV1 } from '../../../../../../shared-ts/src/utils/routerAbEd25519Yao';
+import type { RouterAbTraceContextV1 } from '../../../../../../shared-ts/src/utils/routerAbTraceContext';
+import type { RouterAbEd25519YaoTimedRegistrationExecutionResultV1 } from '../registration/routerAbEd25519YaoRegistrationRequestScopedCloudflare';
 import { type RouterAbMpcMaterialActivationRefWire } from '../../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
 import type { RouterAbEd25519YaoActivationConsumerV1, RouterAbEd25519YaoActivationConsumptionRequestV1, RouterAbEd25519YaoActivationConsumptionResultV1, RouterAbEd25519YaoRegistrationServiceResult } from '../registration/routerAbEd25519YaoRegistration';
 import { InMemoryRouterAbEd25519YaoRegistrationStateV1, type RouterAbEd25519YaoRegistrationAuthorizationAdapter, type RouterAbEd25519YaoRegistrationAuthorizationResult, type RouterAbEd25519YaoRegistrationAuthorizationFailure, type RouterAbEd25519YaoRegistrationService } from '../registration/routerAbEd25519YaoRegistration';
@@ -13,7 +15,7 @@ import { type RuntimePolicyScope } from '../../../../../../shared-ts/src/thresho
 import type { WalletAuthAuthority } from '../../../../../../shared-ts/src/utils/walletAuthAuthority';
 import type { WalletSessionOperationCredentialV1 } from '../../../../../../shared-ts/src/device-linking';
 import type { WalletRegistrationEd25519YaoBootstrapSession } from '../../../../../../shared-ts/src/utils/registrationContracts';
-import { InMemoryRouterAbEd25519YaoRecoveryStateV1, type RouterAbEd25519YaoActiveCapabilityLookupV1, type RouterAbEd25519YaoActiveCapabilityResolverV1, type RouterAbEd25519YaoPersistedActiveCapabilityInstallerV1, type RouterAbEd25519YaoRecoveryAuthorizationAdapter, type RouterAbEd25519YaoRecoveryService, type WarmBootstrapLinkedEd25519AuthorityReaderV1 } from '../recovery/routerAbEd25519YaoRecovery';
+import { InMemoryRouterAbEd25519YaoRecoveryStateV1, type RouterAbEd25519YaoActiveCapabilityLookupV1, type RouterAbEd25519YaoActiveCapabilityRehydratorV1, type RouterAbEd25519YaoActiveCapabilityResolverV1, type RouterAbEd25519YaoPersistedActiveCapabilityInstallerV1, type RouterAbEd25519YaoRecoveryAuthorizationAdapter, type RouterAbEd25519YaoRecoveryService, type WarmBootstrapLinkedEd25519AuthorityReaderV1 } from '../recovery/routerAbEd25519YaoRecovery';
 import type { WalletEd25519YaoActiveCapabilityRecord } from '../../../../core/WalletStore';
 import { InMemoryRouterAbEd25519YaoExportStateV1, type RouterAbEd25519YaoExportAuthorizationAdapter, type RouterAbEd25519YaoExportService } from '../export/routerAbEd25519YaoExport';
 import { type RouterAbEd25519YaoRegistrationSigningRootIdV1, type RouterAbEd25519YaoTenantRootWireV1 } from '../routerAbEd25519YaoGatewayEnvelope';
@@ -56,7 +58,7 @@ export type RouterAbEd25519YaoWalletSessionMintInputV1 = (RouterAbEd25519YaoWall
     readonly expiresAtMs: number;
     readonly remainingUses: number;
 });
-export type RouterAbEd25519YaoProductRegistrationRuntimeV1 = RouterAbEd25519YaoPersistedActiveCapabilityInstallerV1 & RouterAbEd25519YaoActiveCapabilityResolverV1 & {
+export type RouterAbEd25519YaoProductRegistrationRuntimeV1 = RouterAbEd25519YaoPersistedActiveCapabilityInstallerV1 & RouterAbEd25519YaoActiveCapabilityResolverV1 & RouterAbEd25519YaoActiveCapabilityRehydratorV1 & {
     readonly kind: 'router_ab_ed25519_yao_product_registration_runtime_v1';
     readonly signingWorkerId: string;
     /**
@@ -66,7 +68,24 @@ export type RouterAbEd25519YaoProductRegistrationRuntimeV1 = RouterAbEd25519YaoP
      * starts nothing.
      */
     startRegistrationDispatchRoot(signingRootId: RouterAbEd25519YaoRegistrationSigningRootIdV1): RouterAbEd25519YaoStartedDispatchRootV1 | null;
-    bindAndAdmitVerifiedRegistration(input: RouterAbEd25519YaoVerifiedActivationIntentV1, companionWrite: RouterAbEd25519YaoAdmissionCompanionWriteV1 | null, startedDispatchRoot: RouterAbEd25519YaoStartedDispatchRootV1 | null): Promise<RouterAbEd25519YaoVerifiedRegistrationAdmissionResultV1>;
+    /** `mintedSessionId` is the session that the registration's setup minted. */
+    bindAndAdmitVerifiedRegistration(input: RouterAbEd25519YaoVerifiedActivationIntentV1, companionWrite: RouterAbEd25519YaoAdmissionCompanionWriteV1 | null, startedDispatchRoot: RouterAbEd25519YaoStartedDispatchRootV1 | null, mintedSessionId: RouterAbEd25519YaoBytes32V1): Promise<RouterAbEd25519YaoVerifiedRegistrationAdmissionResultV1>;
+    /**
+     * The receipt of the admission that a registration gets for `request`
+     * over the session that its setup minted. Nothing is stored and nothing
+     * is admitted: the client may prepare its inputs before the proof, and
+     * the admission still follows the proof.
+     */
+    describeRegistrationAdmission(request: RouterAbEd25519YaoRegistrationAdmissionRequestV1, mintedSessionId: RouterAbEd25519YaoBytes32V1): Promise<RouterAbEd25519YaoRegistrationServiceResult<RouterAbEd25519YaoActivationAdmissionReceiptV1<'registration'>>>;
+    /**
+     * Runs an admitted registration for the holder of `credential`, as the
+     * execute route does for its bearer.
+     */
+    executeAdmittedRegistration(input: {
+        readonly request: RouterAbEd25519YaoActivationExecuteRequestV1<'registration'>;
+        readonly credential: string;
+        readonly trace: RouterAbTraceContextV1;
+    }): Promise<RouterAbEd25519YaoTimedRegistrationExecutionResultV1>;
     bindVerifiedIntent(input: RouterAbEd25519YaoVerifiedActivationIntentV1): Promise<RouterAbEd25519YaoRegistrationIntentBindingResult>;
     consumeActivated(request: RouterAbEd25519YaoActivationConsumptionRequestV1): Promise<RouterAbEd25519YaoActivationConsumptionResultV1>;
 };
@@ -176,6 +195,18 @@ export declare function createRouterAbEd25519YaoMaterialActivationRefV1(input: {
     readonly walletId: WalletId;
     readonly signingWorkerId: string;
 }): RouterAbMpcMaterialActivationRefWire;
+/**
+ * Mints the Yao identity of a registration's NEAR branch: its material
+ * identity and the session of its admission. Setup stores it, and the
+ * admission that follows the proof is issued over it.
+ */
+export declare function mintRouterAbEd25519YaoRegistrationIdentityV1(input: {
+    readonly walletId: WalletId;
+    readonly signingWorkerId: string;
+}): {
+    readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
+    readonly sessionId: RouterAbEd25519YaoBytes32V1;
+};
 /**
  * Takes the authority *scope* rather than the authority because setup admits
  * before the proof exists. Callers holding a verified authority