@seams/wallet-server 0.10.1 → 0.11.0

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationService.js

@@ -20,33 +20,34 @@ import { buildActiveWalletAuthorityV1, buildWalletSignerActivationSetV1, compute
 import { ROUTER_AB_ED25519_NORMAL_SIGNING_STATE_KIND } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
 import { normalizeThresholdEd25519ParticipantIds } from "../../../../shared-ts/src/threshold/participants.js";
 import { nearEd25519SigningKeyIdFromString, registrationEd25519AuthorityScopeFromAuthority, walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
-import { walletCustodyCeremonyCommitPayloadFromWire } from "../../../../shared-ts/src/passkey-custody/ceremonyCommitPayload.js";
-import "../../../../shared-ts/src/passkey-custody/index.js";
+import { admitRegistrationReservationHome, cancelRegistrationHome } from "../../../domains/walletRegistration/walletRegistrationReservation.js";
 import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../../shared-ts/src/utils/near.js";
 import { registrationNearEd25519BranchKey } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
+import { buildStoredWalletRegistrationEvmFamilyEcdsaFinalizedBranch, buildStoredWalletRegistrationNearEd25519YaoAuthorizedBranch, findStoredWalletRegistrationEvmFamilyEcdsaBranch, findStoredWalletRegistrationNearEd25519YaoBranch, replaceStoredWalletRegistrationSignerBranch, storedRegistrationAuthoritiesMatch, verifiedRegistrationCeremonyAuthority } from "../../../../core/RegistrationCeremonyStore.js";
 import { registrationIntentGrantFromString } from "../../../../shared-ts/src/utils/registrationIntent.js";
+import { walletCustodyCeremonyCommitPayloadFromWire } from "../../../../shared-ts/src/passkey-custody/ceremonyCommitPayload.js";
+import "../../../../shared-ts/src/passkey-custody/index.js";
+import { parseEcdsaDerivationPublicIdentity, thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
 import { createRouterAbTraceContextV1 } from "../../../../shared-ts/src/utils/routerAbTraceContext.js";
+import { routerAbEcdsaStrictRegistrationRequestBindingJson } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
+import { buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, buildD1WalletRecord, parseWalletIdForIntent, thresholdEcdsaChainTargetsEqual } from "./d1RegistrationCeremonyRecords.js";
+import { createD1RegistrationRouteTimingRecorder, errorMessage, finishD1RegistrationRouteTiming, recordRegistrationPromiseTiming, recordRegistrationServerTiming, registrationSignerBranchesFromPlan, startD1RegistrationRouteTiming } from "./d1RegistrationSetupSupport.js";
 import { buildTenantRootIdentityFromAuthenticatedDeploymentV1 } from "../../../../shared-ts/src/tenant-root/tenantRootIdentity.js";
 import { DEFAULT_WALLET_SESSION_TTL_MS } from "../../../../shared-ts/src/threshold/sessionPolicy.js";
-import { parseEcdsaDerivationPublicIdentity, thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
 import { walletAuthAuthorityFromRegistrationAuthority, walletRegistrationFinalizeAuthMethodFromAuthority } from "../wallet/d1WalletAuthMethodBoundary.js";
 import { buildRouterAbEd25519YaoRegistrationCapabilityRecordV1 } from "../../../domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery.js";
 import { buildRouterAbEd25519YaoProductAdmissionRequestV1, projectRouterAbEd25519YaoExactWalletSession } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js";
 import { routerAbEd25519YaoRegistrationExecutionTimingEntriesV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationRequestScopedCloudflare.js";
 import { runRouterAbEd25519YaoRegistrationSideEffectV2, throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
 import { buildYaoEd25519WalletSignerRecord, ed25519NearPublicKeyFromBytes, implicitNearAccountIdFromEd25519PublicKeyBytes } from "../ed25519Yao/d1Ed25519YaoWalletSigner.js";
-import { buildStoredWalletRegistrationEvmFamilyEcdsaFinalizedBranch, buildStoredWalletRegistrationNearEd25519YaoAuthorizedBranch, findStoredWalletRegistrationEvmFamilyEcdsaBranch, findStoredWalletRegistrationNearEd25519YaoBranch, replaceStoredWalletRegistrationSignerBranch, storedRegistrationAuthoritiesMatch, verifiedRegistrationCeremonyAuthority } from "../../../../core/RegistrationCeremonyStore.js";
-import { routerAbEcdsaStrictRegistrationRequestBindingJson } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
-import { buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, buildD1WalletRecord, parseWalletIdForIntent, thresholdEcdsaChainTargetsEqual } from "./d1RegistrationCeremonyRecords.js";
 import { deriveThresholdEcdsaKeyHandle } from "../../../../shared-ts/src/utils/thresholdEcdsaKeyHandle.js";
-import { admitRegistrationReservationHome, cancelRegistrationHome } from "../../../domains/walletRegistration/walletRegistrationReservation.js";
+import { isTransientD1Error, retryTransientD1 } from "../../../../storage/d1Retry.js";
 import { listThresholdEcdsaKeyIdentityTargetsForUser } from "../../../../core/authService/thresholdEcdsaKeyInventory.js";
 import { routerAbEd25519YaoLifecycleDecisionLookupV1, routerAbEd25519YaoLifecycleDecisionV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoLifecycleDecision.js";
 import { reserveRegistrationCustody } from "../../../domains/passkeyCustody/registrationCustodyOutcome.js";
 import { resolveTenantRootIdentityV1 } from "../../../domains/tenantRoot/tenantRootIdentityResolution.js";
 import { walletRegistrationOperationPreparedFromCeremony } from "./d1WalletRegistrationPreparation.js";
 import { computeWalletRegistrationSetupDigestB64u, parseWalletRegistrationSetupClaims, verifySignedWalletRegistrationSetup, verifyWalletRegistrationSetupClaims } from "../../../domains/walletRegistration/walletRegistrationSetupPayload.js";
-import { createD1RegistrationRouteTimingRecorder, errorMessage, finishD1RegistrationRouteTiming, recordRegistrationPromiseTiming, recordRegistrationServerTiming, registrationSignerBranchesFromPlan, startD1RegistrationRouteTiming } from "./d1RegistrationSetupSupport.js";
 import { projectWalletRegistrationSessionCommitReceiptV2, registrationCommitActivation, registrationReplayAuthMethodFields, replayedRegistrationCommit, unissuedRegistrationCommit } from "./walletRegistrationSessionCommitReceipt.js";
 import { assertDirectWalletSessionOwnerProof, buildRegistrationOwnerProof, issueDirectRegistrationEstablishedEcdsaSession, issueDirectRegistrationEstablishedEd25519Session, projectCurrentNearRegistrationSession, replayDirectRegistrationEstablishedEcdsaSession, replayDirectRegistrationEstablishedEd25519Session, walletSessionPrincipalId } from "./walletRegistrationEstablishedSessionIssuer.js";
 import { commitWalletRegistration } from "./d1WalletRegistrationInitialSession.js";
@@ -1646,7 +1647,24 @@ var CloudflareD1WalletRegistrationService = class {
 			};
 		}
 	}
+	/**
+	* Respond replays exactly, so a transient D1 fault runs it again, as a client
+	* retry would. A fault that outlasts the retries reports `storage_unavailable`
+	* without the driver's text.
+	*/
 	async respondWalletRegistration(input, traceContext, timingSink, waitUntil) {
+		try {
+			return await retryTransientD1(() => this.respondWalletRegistrationAttempt(input, traceContext, timingSink, waitUntil));
+		} catch (error) {
+			if (!isTransientD1Error(error)) throw error;
+			return {
+				ok: false,
+				code: "storage_unavailable",
+				message: "Wallet registration storage is unavailable"
+			};
+		}
+	}
+	async respondWalletRegistrationAttempt(input, traceContext, timingSink, waitUntil) {
 		const serverTiming = timingSink ?? [];
 		const totalStartedAtMs = Date.now();
 		const mark = (name, startedAtMs) => {
@@ -1948,6 +1966,7 @@ var CloudflareD1WalletRegistrationService = class {
 				ed25519: ed25519Admission.deferred
 			});
 		} catch (error) {
+			if (isTransientD1Error(error)) throw error;
 			return {
 				ok: false,
 				code: "internal",
@@ -2132,7 +2151,10 @@ var CloudflareD1WalletRegistrationService = class {
 			ed25519: args.input.ed25519,
 			emailOtpEnrollment: args.input.emailOtpEnrollment,
 			walletCustodyCommit: args.input.walletCustodyCommit
-		}, effectivePrepared, source, args.serverTiming, initialSessionPlan, args.lifecycleDecision, args.heldPasskeyClaim);
+		}, effectivePrepared, source, args.serverTiming, initialSessionPlan, args.lifecycleDecision, args.heldPasskeyClaim, {
+			kind: "snapshot",
+			authority: args.readYaoAdmission()
+		}, args.readFounding());
 		if (!execution.ok) return unissuedRegistrationCommit(throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1(execution));
 		const finalized = execution.finalized;
 		if (finalized.kind !== "near_ed25519") {
@@ -2335,22 +2357,29 @@ var CloudflareD1WalletRegistrationService = class {
 			};
 			const admissionStartedAtMs = Date.now();
 			const operationKey = `near-provisioning:${input.registrationCeremonyId}:${input.idempotencyKey}`;
-			const initial = await this.registrationRead.readFinalization({
-				ceremonyId: verified.claims.registrationCeremonyId,
-				walletId: walletIdFromString(verified.claims.walletId)
-			}, operationKey);
-			recordRegistrationServerTiming(serverTiming, "near_finalize_initial_read", admissionStartedAtMs);
+			const [initial, requestFingerprintBytes] = await Promise.all([recordRegistrationPromiseTiming({
+				sink: serverTiming,
+				name: "near_finalize_initial_read",
+				startedAtMs: admissionStartedAtMs,
+				promise: this.registrationRead.readFinalization({
+					ceremonyId: verified.claims.registrationCeremonyId,
+					walletId: walletIdFromString(verified.claims.walletId)
+				}, operationKey)
+			}), recordRegistrationPromiseTiming({
+				sink: serverTiming,
+				name: "near_finalize_fingerprint",
+				startedAtMs: Date.now(),
+				promise: sha256BytesUtf8(alphabetizeStringify({
+					version: "wallet_registration_near_provisioning_digest_v1",
+					registrationCeremonyId: input.registrationCeremonyId,
+					setupDigestB64u: verified.claims.setupDigestB64u,
+					idempotencyKey: input.idempotencyKey,
+					ed25519: input.ed25519,
+					emailOtpEnrollment: input.emailOtpEnrollment
+				}))
+			})]);
 			if (!initial.ok) return initial;
-			const fingerprintStartedAtMs = Date.now();
-			const requestFingerprint = base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
-				version: "wallet_registration_near_provisioning_digest_v1",
-				registrationCeremonyId: input.registrationCeremonyId,
-				setupDigestB64u: verified.claims.setupDigestB64u,
-				idempotencyKey: input.idempotencyKey,
-				ed25519: input.ed25519,
-				emailOtpEnrollment: input.emailOtpEnrollment
-			})));
-			recordRegistrationServerTiming(serverTiming, "near_finalize_fingerprint", fingerprintStartedAtMs);
+			const requestFingerprint = base64UrlEncode(requestFingerprintBytes);
 			const sideEffectStartedAtMs = Date.now();
 			let preparedCeremony = null;
 			const run = await runRouterAbEd25519YaoRegistrationSideEffectV2(this.registrationRead.operations, {
@@ -2380,7 +2409,9 @@ var CloudflareD1WalletRegistrationService = class {
 					authoritySource: verified.source,
 					preparedCeremony: () => preparedCeremony,
 					lifecycleDecision: initial.decision,
-					heldPasskeyClaim: initial.heldPasskeyClaim
+					heldPasskeyClaim: initial.heldPasskeyClaim,
+					readYaoAdmission: initial.readYaoAdmission,
+					readFounding: initial.readFounding
 				}),
 				projectReceipt: (execution) => projectWalletRegistrationSessionCommitReceiptV2({
 					operation: "near_provisioning",
@@ -2530,6 +2561,7 @@ var CloudflareD1WalletRegistrationService = class {
 		const ceremony = input.ceremony;
 		const stored = storedRespondEd25519DeferredWork(ceremony.signerState);
 		let authority;
+		const authorityStartedAtMs = Date.now();
 		if (stored) {
 			const replayAuthority = await this.verifyRespondReplayAuthority({
 				ceremony,
@@ -2563,6 +2595,7 @@ var CloudflareD1WalletRegistrationService = class {
 			};
 			authority = verified.authority;
 		}
+		recordRegistrationServerTiming(input.serverTiming, "respond_authority_verify", authorityStartedAtMs);
 		if (authority.walletId !== ceremony.intent.walletId) return {
 			ok: false,
 			code: "scope_mismatch",
@@ -2574,12 +2607,14 @@ var CloudflareD1WalletRegistrationService = class {
 			code: "not_configured",
 			message: "Ed25519 Yao registration is unavailable"
 		};
+		const requestStartedAtMs = Date.now();
 		const admissionRequest = stored ? stored.admissionRequest : await buildRespondEd25519AdmissionRequest({
 			ceremony,
 			branch: input.branch,
 			authority,
 			signingWorkerId: runtime.signingWorkerId
 		});
+		recordRegistrationServerTiming(input.serverTiming, "yao_admission_request", requestStartedAtMs);
 		const verifiedAuthority = authority;
 		const branchKey = input.branch.branchKey;
 		const ceremonyStore = this.getRegistrationCeremonyIntentStore();
@@ -2597,6 +2632,7 @@ var CloudflareD1WalletRegistrationService = class {
 				})]
 			}
 		});
+		const bindStartedAtMs = Date.now();
 		const admitted = await runtime.bindAndAdmitVerifiedRegistration({
 			kind: "verified_registration_intent",
 			ownershipGeneration: input.ownershipGeneration,
@@ -2608,15 +2644,26 @@ var CloudflareD1WalletRegistrationService = class {
 			expected: input.snapshot,
 			next: authorizedCeremony(bound)
 		}), input.startedDispatchRoot, requireRegistrationEd25519YaoMint(ceremony).sessionId);
+		recordRegistrationServerTiming(input.serverTiming, "yao_admission_bind", bindStartedAtMs);
 		if (!admitted.ok) return {
 			ok: false,
 			code: admitted.code,
 			message: admitted.message
 		};
-		if (!stored && admitted.companionWrite === "not_committed") await ceremonyStore.commitEcdsaClaim({
-			expected: input.snapshot,
-			next: authorizedCeremony(admitted.admissionRequest)
-		});
+		if (!stored && admitted.companionWrite === "not_committed") {
+			const next = authorizedCeremony(admitted.admissionRequest);
+			const commitStartedAtMs = Date.now();
+			try {
+				await ceremonyStore.commitEcdsaClaim({
+					expected: input.snapshot,
+					next
+				});
+			} catch (error) {
+				const committed = await ceremonyStore.getCeremony(ceremony.registrationCeremonyId);
+				if (!committed || alphabetizeStringify(committed) !== alphabetizeStringify(next)) throw error;
+			}
+			recordRegistrationServerTiming(input.serverTiming, "respond_ceremony_commit", commitStartedAtMs);
+		}
 		if (!stored && input.waitUntil && verifiedAuthority.kind === "passkey") input.waitUntil(this.walletRegistrationCommitStore.claimPasskeyAhead({
 			registrationCeremonyId: ceremony.registrationCeremonyId,
 			authority: verifiedAuthority,
@@ -2870,7 +2917,7 @@ var CloudflareD1WalletRegistrationService = class {
 		}, prepared, {
 			kind: "stored_ceremony",
 			ceremony: activatedCeremony
-		}, [], { kind: "separate" }, null);
+		}, [], { kind: "separate" }, null, null, { kind: "stored" }, null);
 		if (!execution.ok) return unissuedRegistrationCommit(throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1(execution));
 		const commit = execution.finalized;
 		if (commit.kind !== "evm_family_ecdsa") {
@@ -3206,7 +3253,7 @@ var CloudflareD1WalletRegistrationService = class {
 			};
 		}
 	}
-	async executeWalletRegistrationFinalize(request, prepared, source, serverTiming, initialSessionPlan, lifecycleDecision, heldPasskeyClaim = null) {
+	async executeWalletRegistrationFinalize(request, prepared, source, serverTiming, initialSessionPlan, lifecycleDecision, heldPasskeyClaim, yaoAdmission, founding) {
 		const finalizeTiming = createD1RegistrationRouteTimingRecorder("wallets_register_finalize");
 		const totalTiming = startD1RegistrationRouteTiming("registerFinalizeTotalMs");
 		let startedCustody = null;
@@ -3440,12 +3487,15 @@ var CloudflareD1WalletRegistrationService = class {
 							sessionId: activationReference.session_id
 						},
 						consumerBinding: requestFingerprint
-					})
+					}, yaoAdmission)
 				}), recordRegistrationPromiseTiming({
 					sink: serverTiming,
 					name: "near_finalize_authority_reserve",
 					startedAtMs: Date.now(),
-					promise: this.walletRegistrationCommitStore.reserveAuthority(ceremonyAuthority, heldPasskeyClaim)
+					promise: this.walletRegistrationCommitStore.reserveAuthority(ceremonyAuthority, heldPasskeyClaim, founding ?? {
+						kind: "read",
+						ids: prepared
+					})
 				})]);
 				if (activationConsumption.status === "rejected") throw activationConsumption.reason;
 				if (authorityReservation.status === "rejected") throw authorityReservation.reason;
@@ -3574,7 +3624,10 @@ var CloudflareD1WalletRegistrationService = class {
 			} else {
 				custodyReservation = reserveCustody();
 				startedCustody = custodyReservation;
-				commitWallet = await this.walletRegistrationCommitStore.reserveAuthority(ceremonyAuthority);
+				commitWallet = await this.walletRegistrationCommitStore.reserveAuthority(ceremonyAuthority, null, {
+					kind: "read",
+					ids: prepared
+				});
 			}
 			if (yaoDecisionFound?.kind === "decided_otherwise") return {
 				ok: false,

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationSetupExecution.js

@@ -1,37 +1,53 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { deriveSigningRootId } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { registrationPreparationIdFromString } from "../../../../core/types.js";
-import { buildRouterAbEd25519YaoProductAdmissionRequestV1, mintRouterAbEd25519YaoRegistrationIdentityV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js";
 import { buildStoredWalletRegistrationEvmFamilyEcdsaPreparedBranch, findStoredWalletRegistrationEvmFamilyEcdsaBranch } from "../../../../core/RegistrationCeremonyStore.js";
 import { routerAbEcdsaStrictRegistrationFactsBindingJson } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
 import { buildRegistrationIntent, inferRuntimePolicyScopeFromSigningRoot } from "./d1RegistrationCeremonyRecords.js";
+import { errorMessage, recordRegistrationPromiseTiming, recordRegistrationServerTiming, registrationIntentSignerBranches, registrationPreparedContextEcdsaChainTargets, registrationSignerBranchesFromPlan, resolveRegistrationPreparedContextFromPlan } from "./d1RegistrationSetupSupport.js";
+import { buildRouterAbEd25519YaoProductAdmissionRequestV1, mintRouterAbEd25519YaoRegistrationIdentityV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js";
 import { isTransientD1Error } from "../../../../storage/d1Retry.js";
-import { errorMessage, registrationIntentSignerBranches, registrationPreparedContextEcdsaChainTargets, registrationSignerBranchesFromPlan, resolveRegistrationPreparedContextFromPlan } from "./d1RegistrationSetupSupport.js";
 import { buildWalletRegistrationSetupSignature, normalizeWalletRegistrationSetupRequest, walletRegistrationSetupError, walletRegistrationSetupExpiresAtMs, walletRegistrationSetupIntentDigest } from "./d1WalletRegistrationSetup.js";
 import { buildD1EvmFamilyEcdsaRegistrationPrepare } from "./d1EvmFamilyEcdsaRegistrationBranch.js";
 //#region src/router/cloudflare/d1/registration/d1WalletRegistrationSetupExecution.ts
 async function executeD1WalletRegistrationSetup(input, dependencies) {
+	const serverTiming = input.serverTiming ?? [];
 	try {
 		const normalized = normalizeWalletRegistrationSetupRequest(input.request);
 		if (!normalized.ok) return walletRegistrationSetupError(normalized.code, normalized.message);
 		if (!dependencies.reservation) return walletRegistrationSetupError("registration_authority_unavailable", "Registration reservation authority is required");
+		const reserveStartedAtMs = Date.now();
 		const admitted = await dependencies.reservation.reserve(input);
+		recordRegistrationServerTiming(serverTiming, "setup_reserve", reserveStartedAtMs);
 		if (!admitted.ok) return admitted;
 		const reservation = admitted.reservation;
 		const wallet = { walletId: reservation.walletId };
 		if (input.request.wallet?.kind === "provided" && input.request.wallet.walletId !== wallet.walletId) return walletRegistrationSetupError("reservation_conflict", "Registration reservation changed the requested wallet");
 		const expiresAtMs = walletRegistrationSetupExpiresAtMs(reservation.reservedAtMs);
 		if (Date.now() >= expiresAtMs) return walletRegistrationSetupError("registration_expired", "Registration setup has expired");
-		const [startup, setup] = await Promise.allSettled([dependencies.startRegistrationWallets?.({
-			kind: "objects",
-			walletId: wallet.walletId,
-			ownershipGeneration: admitted.ownershipGeneration
-		}), completeReservedRegistrationSetup(input, dependencies, admitted, normalized, expiresAtMs)]);
+		const parallelStartedAtMs = Date.now();
+		const [startup, setup] = await Promise.allSettled([recordRegistrationPromiseTiming({
+			sink: serverTiming,
+			name: "setup_wallet_objects",
+			startedAtMs: parallelStartedAtMs,
+			promise: dependencies.startRegistrationWallets?.({
+				kind: "objects",
+				walletId: wallet.walletId,
+				ownershipGeneration: admitted.ownershipGeneration
+			})
+		}), recordRegistrationPromiseTiming({
+			sink: serverTiming,
+			name: "setup_ceremony",
+			startedAtMs: parallelStartedAtMs,
+			promise: completeReservedRegistrationSetup(input, dependencies, admitted, normalized, expiresAtMs)
+		})]);
 		if (setup.status === "rejected") throw setup.reason;
 		if (!setup.value.ok) return setup.value;
 		if (startup.status === "rejected") throw startup.reason;
 		if (dependencies.startRegistrationWallets) try {
+			const pairStartedAtMs = Date.now();
 			const preparation = await describeCommittedSetupPair(setup.value, dependencies);
+			recordRegistrationServerTiming(serverTiming, "setup_pair_describe", pairStartedAtMs);
 			if (preparation.status === "described") await dependencies.startRegistrationWallets({
 				kind: "pair",
 				walletId: wallet.walletId,

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAddSignerFinalizeRecord.js

@@ -2,8 +2,8 @@ import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import "../../../../shared-ts/src/utils/encoders.js";
-import { parseRouterAbEd25519YaoRegistrationSideEffectRecordV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
 import { parseD1WalletAddSignerFinalizeTerminalResponse, parseWalletIdForIntent } from "../registration/d1RegistrationCeremonyRecords.js";
+import { parseRouterAbEd25519YaoRegistrationSideEffectRecordV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
 //#region src/router/cloudflare/d1/wallet/d1WalletAddSignerFinalizeRecord.ts
 function parseWalletAddSignerFinalizePrepared(raw) {
 	if (!isPlainObject(raw)) return null;

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAddSignerService.js

@@ -13,14 +13,14 @@ import { buildRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaRegis
 import { buildWalletEcdsaSignerActivationV1, extendEd25519WalletAuthorityWithEcdsa, isActiveEd25519WalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { registrationPreparationIdFromString } from "../../../../core/types.js";
 import { addSignerIntentGrantFromString, computeAddSignerIntentDigestB64u, sameAddSignerIntentV1 } from "../../../../shared-ts/src/utils/registrationIntent.js";
+import { routerAbEcdsaStrictRegistrationRequestMatchesFacts } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
+import { buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, normalizeThresholdEcdsaChainTargets, parseD1AddSignerIntent, parseD1RuntimePolicyScope, parseD1StoredAddSignerAuth, parseD1StoredAddSignerIntent, parseD1StoredWalletAddSignerCeremony, parseWalletIdForIntent, positiveIntegerArraysEqual, runtimePolicyScopeMatches, thresholdEcdsaChainTargetsEqual } from "../registration/d1RegistrationCeremonyRecords.js";
 import { buildTenantRootIdentityFromAuthenticatedDeploymentV1 } from "../../../../shared-ts/src/tenant-root/tenantRootIdentity.js";
 import { WalletAuthorityCommitConflictError } from "./d1WalletAuthorityStore.js";
 import { buildRouterAbEd25519YaoRegistrationCapabilityRecordV1 } from "../../../domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery.js";
 import { buildRouterAbEd25519YaoAddSignerAdmissionRequestV1, createRouterAbEd25519YaoMaterialActivationRefV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js";
 import { parseRouterAbEd25519YaoRegistrationSideEffectRecordV1, runRouterAbEd25519YaoRegistrationSideEffectV1, throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
 import { buildYaoEd25519WalletSignerRecord, ed25519NearPublicKeyFromBytes, implicitNearAccountIdFromEd25519PublicKeyBytes } from "../ed25519Yao/d1Ed25519YaoWalletSigner.js";
-import { routerAbEcdsaStrictRegistrationRequestMatchesFacts } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
-import { buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, normalizeThresholdEcdsaChainTargets, parseD1AddSignerIntent, parseD1RuntimePolicyScope, parseD1StoredAddSignerAuth, parseD1StoredAddSignerIntent, parseD1StoredWalletAddSignerCeremony, parseWalletIdForIntent, positiveIntegerArraysEqual, runtimePolicyScopeMatches, thresholdEcdsaChainTargetsEqual } from "../registration/d1RegistrationCeremonyRecords.js";
 import { buildD1WalletAddSignerFinalizePrepared, fingerprintD1WalletAddSignerFinalizePrepared, rejectUnexpectedWalletAddSignerFinalizePreparation, returnD1WalletAddSignerFinalizePrepared } from "./d1WalletAddSignerFinalizeRecord.js";
 import { routerAbEd25519YaoLifecycleDecisionLookupV1, routerAbEd25519YaoLifecycleDecisionV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoLifecycleDecision.js";
 import { buildD1EvmFamilyEcdsaRegistrationPrepare } from "../registration/d1EvmFamilyEcdsaRegistrationBranch.js";
@@ -1255,7 +1255,7 @@ var CloudflareD1WalletAddSignerService = class {
 				const consumed = await yaoRuntime.consumeActivated({
 					reference: requestedActivationReference,
 					consumerBinding: input.consumerBinding
-				});
+				}, { kind: "stored" });
 				if (!consumed.ok) return consumed;
 				if (!sameRouterAbEd25519YaoRegistrationAdmissionRequestV1(consumed.activation.admissionRequest, currentState.admissionRequest)) return {
 					ok: false,

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthMethodService.js

@@ -13,15 +13,15 @@ import { deriveWebAuthnAuthenticatorDeviceInfo } from "../../../../shared-ts/src
 import { parseSessionOrigin } from "../../../../authorization/domain.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { PASSKEY_PRF_FIRST_SALT_V1, PASSKEY_PRF_SECOND_SALT_V1 } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
+import { addAuthMethodIntentGrantFromString, computeAddAuthMethodIntentDigestB64u } from "../../../../shared-ts/src/utils/registrationIntent.js";
 import { parsePasskeyCustodyEnvelopeRecord } from "../../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
-import { addAuthMethodIntentGrantFromString, computeAddAuthMethodIntentDigestB64u } from "../../../../shared-ts/src/utils/registrationIntent.js";
+import { toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";
+import { parseWalletIdForIntent } from "../registration/d1RegistrationCeremonyRecords.js";
 import { parseWebAuthnClientDataJsonBase64url, webAuthnOriginHostnameOrEmpty } from "../../../auth/webAuthnCredentialCodecs.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { resolveWalletAuthMethodIdForAuthority } from "../../../../core/signingLanes/WalletExecutionLaneProjection.js";
-import { toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";
 import { d1HostIsWithinWebAuthnRpId, resolveD1AddAuthMethodExistingAuth, resolveD1AddSignerExistingAuth, verifyD1LinkedDeviceFreshRevokeProofV1, walletAuthAuthorityFromRegistrationAuthority } from "./d1WalletAuthMethodBoundary.js";
-import { parseWalletIdForIntent } from "../registration/d1RegistrationCeremonyRecords.js";
 import { runtimePolicyScopeKey } from "../../../../core/EmailOtpRecords.js";
 import { expiredGoogleEmailOtpRegistrationAttemptRecord } from "../emailOtp/d1GoogleEmailOtpRegistrationRecords.js";
 import { admitAddWalletAuthMethod } from "../../../../shared-ts/src/utils/addWalletAuthMethod.js";

package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnAuthService.js

@@ -4,8 +4,8 @@ import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimit
 import { WalletLifecycleLocator } from "../../../../authorization/lifecycleRouting.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { failedVerification, failure } from "../../../../shared-ts/src/utils/failure.js";
-import { decodeWebAuthnBase64UrlOrBase64, parseWebAuthnAuthenticationCredential, parseWebAuthnClientDataJsonBase64url, webAuthnCredentialIdB64uFromCredential, webAuthnOriginHostnameOrEmpty } from "../../../auth/webAuthnCredentialCodecs.js";
 import { nonNegativeSafeInteger, optionalNonNegativeInteger, parseD1BoundaryWalletId, parseD1BoundaryWalletIdResult, parseJsonObject } from "../auth/d1RouterApiAuthBoundary.js";
+import { decodeWebAuthnBase64UrlOrBase64, parseWebAuthnAuthenticationCredential, parseWebAuthnClientDataJsonBase64url, webAuthnCredentialIdB64uFromCredential, webAuthnOriginHostnameOrEmpty } from "../../../auth/webAuthnCredentialCodecs.js";
 import { parseWebAuthnAuthenticatorRowDeviceInfo, webAuthnSyncWalletBindingFromCredentialBinding } from "./d1WebAuthnRecords.js";
 import { d1HostIsWithinWebAuthnRpId } from "../wallet/d1WalletAuthMethodBoundary.js";
 import { webAuthnAuthenticationFailure, webAuthnLoginEd25519, webAuthnSyncCredentialBinding } from "../../../../core/authService/webauthnVerificationOutcomes.js";

package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnRecords.js

@@ -8,8 +8,8 @@ import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/
 import { parseWebAuthnAuthenticatorDeviceInfoJson } from "../../../../shared-ts/src/utils/webauthnDeviceInfo.js";
 import { hasExactKeys } from "../../../../shared-ts/src/utils/exactKeys.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
-import { parseRecoveryCodeReservationId } from "../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
 import { nonNegativeSafeInteger, optionalNonNegativeInteger, positiveInteger } from "../auth/d1RouterApiAuthBoundary.js";
+import { parseRecoveryCodeReservationId } from "../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
 //#region src/router/cloudflare/d1/webauthn/d1WebAuthnRecords.ts
 function parseWebAuthnAuthenticatorRowDeviceInfo(raw) {
 	return parseWebAuthnAuthenticatorDeviceInfoJson(raw);

package/dist/esm/router/cloudflare-adaptor.js

@@ -1,6 +1,6 @@
 import { ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, parseRouterAbPublicKeysetV2 } from "../shared-ts/src/utils/routerAbPublicKeyset.js";
 import { defineRoute, matchesRouteDefinitionRequest } from "./framework/routeDefinitions.js";
-import { extractBearerCredential, extractRouterApiEnvironmentId, resolveSourceIpFromExpressRequest, resolveSourceIpFromFetchHeaders } from "./auth/routerApiKeyAuth.js";
+import { extractBearerCredential, extractRouterApiEnvironmentId, resolveSourceIpFromFetchHeaders } from "./auth/routerApiKeyAuth.js";
 import { InMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createRouterAbNormalSigningAdmissionAdapter } from "./domains/signingOperations/routerAbNormalSigningAdmissionCore.js";
 import { CloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1RouterAbNormalSigningAdmissionStore } from "./cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.js";
 import { getRouterApiRouteExtensionRoutes } from "./framework/routeExtensions.js";
@@ -41,4 +41,4 @@ import { handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1 } from ".
 import { createRouterAbEd25519YaoProductRegistrationRequestScopedRuntimeV1 } from "./domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationRequestScopedRuntime.js";
 import { runRouterAbEd25519YaoRegistrationSideEffectV1 } from "./domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
 import { CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1, CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1, createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1, createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1 } from "./cloudflare/signingLanes/cloudflareOrdinaryInactiveSignerMaterialReservation.js";
-export { CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, CloudflareD1AuthorizationStore, CloudflareD1RouterAbNormalSigningAdmissionStore, CloudflareD1VaultProxyStore, CloudflareD1VersionedJsonRecordStore, CloudflareD1VersionedJsonRecordStoreError, CloudflareD1WebAuthnAuthService, CloudflareD1WebAuthnStore, CloudflareDurableObjectVersionedJsonRecordStore, CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1, CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1, CloudflareVersionedJsonRecordStoreError, DEFAULT_WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_V1, DEFAULT_WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_V1, InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter, InMemoryRouterAbEd25519YaoRegistrationService, InMemoryRouterAbNormalSigningAdmissionStore, ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1, ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, RouterAbEd25519YaoHttpRegistrationBackend, StaticCloudflareTenantStorageRouteResolver, UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, WALLET_CONSOLE_API_WALLET_DETAIL_PREFIX_V1, WALLET_CONSOLE_OPS_BASE_PATH_V1, WALLET_CONSOLE_OP_PATHS_V1, WALLET_CONSOLE_SERVICE_ORIGIN_V1, WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_ID_V1, WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_ID_V1, WALLET_CONTROL_AUTH_MARKER_V1, WALLET_CONTROL_BASE_PATH_V1, WALLET_CONTROL_SERVICE_ORIGIN_V1, WALLET_RUNTIME_OPS_BASE_PATH_V1, WALLET_RUNTIME_OP_PATHS_V1, WALLET_RUNTIME_SERVICE_ORIGIN_V1, buildRouterAbEd25519YaoProductAdmissionRequestV1, coerceRouterLogger, createCloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1VersionedJsonRecordStore, createCloudflareDurableObjectVersionedJsonRecordStore, createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1, createCloudflareRouter, createCloudflareTenantStorageRoute, createCloudflareWalletGatewayRouterV1, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterApiRuntimeSnapshotConsumer, createRouterAbEd25519YaoCeremonyStateStoreV1, createRouterAbEd25519YaoHttpRegistrationBackendFromEnv, createRouterAbEd25519YaoProductRegistrationCompositionFromPortsV1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, createRouterAbEd25519YaoProductRegistrationRequestScopedRuntimeV1, createRouterAbEd25519YaoProductRegistrationRuntimeV1, createRouterAbEd25519YaoProductRegistrationStateV1, createRouterAbEd25519YaoRegistrationModule, createRouterAbNormalSigningAdmissionAdapter, createRouterApiModule, createSelfHostedCloudflareSigningRouter, createSelfHostedCloudflareSigningWorker, createSignerD1DoStorageTarget, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, createStaticWalletConsoleBindingV1, createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1, createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, createWalletConsoleOpsClient, createWalletConsoleRelayProxyExtensionV1, createWalletControlClientBindings, createWalletRuntimeOpsHandler, decodeWalletConsoleTenantRootActiveLineageRequestV1, decodeWalletConsoleTenantRootActiveLineageResponseV1, defineRoute, encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1, encodeRouterAbEd25519YaoProductRegistrationStateV1, extractBearerCredential, extractRouterApiEnvironmentId, getRouterApiRouteExtensionRoutes, handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1, handleStaticWalletConsoleRequestV1, handleWalletControlRequest, matchesRouteDefinitionRequest, mergeRouterAbEd25519YaoProductRegistrationStatePartitionV1, parseRouterAbEd25519YaoCeremonyKeyV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoProductRegistrationStateJsonV1, parseRouterAbPublicKeysetV2, parseStaticWalletConsoleBindingConfigV1, parseWalletRegistrationContextResponse, parseWalletRuntimeExecuteSignedDelegateRequest, parseWalletRuntimeExecuteSignedDelegateResponse, parseWalletRuntimeExecuteSignedDelegateResult, parseWalletRuntimeRelayerAccount, parseWalletRuntimeWalletIdentitiesResult, parseWalletRuntimeWalletIdentityRequest, partitionRouterAbEd25519YaoProductRegistrationStateV1, randomTenantRootCreationGrantBytesV1, readEnvironmentCsv, readEnvironmentString, requireEnvironmentString, resolveRouterAbEd25519YaoCeremonyKeyFromRequestV1, resolveRuntimeTenantRootLineage, resolveSourceIpFromExpressRequest, resolveSourceIpFromFetchHeaders, runRouterAbEd25519YaoProductRegistrationRequestScopedV1, runRouterAbEd25519YaoRegistrationSideEffectV1, runRouterAbEd25519YaoRegistrationTwoPhaseV1, runRouterAbPrewarmScheduledV1, signTenantRootCreationGrantV1, tenantRootIdentityDigestB64uV1, validateRuntimeSnapshotExpectation, walletConsoleApiWalletGetRouteDefinitionV1, walletConsoleApiWalletListRouteDefinitionV1, walletConsoleApiWalletSearchRouteDefinitionV1, walletConsoleRelayRouteDefinitionsV1, walletConsoleSignedDelegateRouteDefinitionV1, walletConsoleSponsoredEvmCallRouteDefinitionV1 };
+export { CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, CloudflareD1AuthorizationStore, CloudflareD1RouterAbNormalSigningAdmissionStore, CloudflareD1VaultProxyStore, CloudflareD1VersionedJsonRecordStore, CloudflareD1VersionedJsonRecordStoreError, CloudflareD1WebAuthnAuthService, CloudflareD1WebAuthnStore, CloudflareDurableObjectVersionedJsonRecordStore, CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1, CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1, CloudflareVersionedJsonRecordStoreError, DEFAULT_WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_V1, DEFAULT_WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_V1, InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter, InMemoryRouterAbEd25519YaoRegistrationService, InMemoryRouterAbNormalSigningAdmissionStore, ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1, ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, RouterAbEd25519YaoHttpRegistrationBackend, StaticCloudflareTenantStorageRouteResolver, UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, WALLET_CONSOLE_API_WALLET_DETAIL_PREFIX_V1, WALLET_CONSOLE_OPS_BASE_PATH_V1, WALLET_CONSOLE_OP_PATHS_V1, WALLET_CONSOLE_SERVICE_ORIGIN_V1, WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_ID_V1, WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_ID_V1, WALLET_CONTROL_AUTH_MARKER_V1, WALLET_CONTROL_BASE_PATH_V1, WALLET_CONTROL_SERVICE_ORIGIN_V1, WALLET_RUNTIME_OPS_BASE_PATH_V1, WALLET_RUNTIME_OP_PATHS_V1, WALLET_RUNTIME_SERVICE_ORIGIN_V1, buildRouterAbEd25519YaoProductAdmissionRequestV1, coerceRouterLogger, createCloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1VersionedJsonRecordStore, createCloudflareDurableObjectVersionedJsonRecordStore, createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1, createCloudflareRouter, createCloudflareTenantStorageRoute, createCloudflareWalletGatewayRouterV1, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterApiRuntimeSnapshotConsumer, createRouterAbEd25519YaoCeremonyStateStoreV1, createRouterAbEd25519YaoHttpRegistrationBackendFromEnv, createRouterAbEd25519YaoProductRegistrationCompositionFromPortsV1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, createRouterAbEd25519YaoProductRegistrationRequestScopedRuntimeV1, createRouterAbEd25519YaoProductRegistrationRuntimeV1, createRouterAbEd25519YaoProductRegistrationStateV1, createRouterAbEd25519YaoRegistrationModule, createRouterAbNormalSigningAdmissionAdapter, createRouterApiModule, createSelfHostedCloudflareSigningRouter, createSelfHostedCloudflareSigningWorker, createSignerD1DoStorageTarget, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, createStaticWalletConsoleBindingV1, createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1, createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, createWalletConsoleOpsClient, createWalletConsoleRelayProxyExtensionV1, createWalletControlClientBindings, createWalletRuntimeOpsHandler, decodeWalletConsoleTenantRootActiveLineageRequestV1, decodeWalletConsoleTenantRootActiveLineageResponseV1, defineRoute, encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1, encodeRouterAbEd25519YaoProductRegistrationStateV1, extractBearerCredential, extractRouterApiEnvironmentId, getRouterApiRouteExtensionRoutes, handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1, handleStaticWalletConsoleRequestV1, handleWalletControlRequest, matchesRouteDefinitionRequest, mergeRouterAbEd25519YaoProductRegistrationStatePartitionV1, parseRouterAbEd25519YaoCeremonyKeyV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoProductRegistrationStateJsonV1, parseRouterAbPublicKeysetV2, parseStaticWalletConsoleBindingConfigV1, parseWalletRegistrationContextResponse, parseWalletRuntimeExecuteSignedDelegateRequest, parseWalletRuntimeExecuteSignedDelegateResponse, parseWalletRuntimeExecuteSignedDelegateResult, parseWalletRuntimeRelayerAccount, parseWalletRuntimeWalletIdentitiesResult, parseWalletRuntimeWalletIdentityRequest, partitionRouterAbEd25519YaoProductRegistrationStateV1, randomTenantRootCreationGrantBytesV1, readEnvironmentCsv, readEnvironmentString, requireEnvironmentString, resolveRouterAbEd25519YaoCeremonyKeyFromRequestV1, resolveRuntimeTenantRootLineage, resolveSourceIpFromFetchHeaders, runRouterAbEd25519YaoProductRegistrationRequestScopedV1, runRouterAbEd25519YaoRegistrationSideEffectV1, runRouterAbEd25519YaoRegistrationTwoPhaseV1, runRouterAbPrewarmScheduledV1, signTenantRootCreationGrantV1, tenantRootIdentityDigestB64uV1, validateRuntimeSnapshotExpectation, walletConsoleApiWalletGetRouteDefinitionV1, walletConsoleApiWalletListRouteDefinitionV1, walletConsoleApiWalletSearchRouteDefinitionV1, walletConsoleRelayRouteDefinitionsV1, walletConsoleSignedDelegateRouteDefinitionV1, walletConsoleSponsoredEvmCallRouteDefinitionV1 };