@seams/wallet-server 0.10.2 → 0.11.0

package/dist/esm/cloud-host.js

@@ -26,12 +26,15 @@ import { RouterAbEcdsaPresignRuntime, parseRouterAbEcdsaPresignRuntimeConfig } f
 import { registrationPreparationIdFromString } from "./core/types.js";
 import { ActionType } from "./shared-ts/src/near/actions.js";
 import { enforceDelegatePolicy, executeSignedDelegateWithRelayer, normalizeHashToBytes, validateDelegateExpiryAndNonce } from "./delegateAction/index.js";
+import { parseWalletRegistrationSetupReservation, proposeWalletRegistrationSetup, walletRegistrationSetupRequestDigest } from "./router/domains/walletRegistration/walletRegistrationReservation.js";
+import { LocalRegistrationSetupAuthority } from "./localRegistrationSetupAuthority.js";
 import { createWalletRegistrationContextResolver, unavailableRegistrationContext, walletRegistrationContext } from "./router/auth/walletRegistrationContext.js";
-import { extractBearerCredential, extractRouterApiEnvironmentId, normalizeSourceIp, resolveRequestOriginRateLimitKeyFromExpressRequest, resolveRequestOriginRateLimitKeyFromFetchHeaders, resolveSourceIpFromExpressRequest, resolveSourceIpFromFetchHeaders } from "./router/auth/routerApiKeyAuth.js";
+import { ROUTER_AB_TRACE_ID_HEADER_V1 } from "./shared-ts/src/utils/routerAbTraceContext.js";
+import { createRouterAbEcdsaEd25519CeremonyTokenIssuer, createRouterAbEcdsaStrictPostRegistrationPort, createRouterAbEcdsaStrictRegistrationPort, parseRouterAbEcdsaEd25519PrivateJwk, parseRouterAbEcdsaStrictRegistrationTopology, parseStoredRouterAbEcdsaPendingActivationV1, routerAbEcdsaStrictRegistrationFactsBindingJson, routerAbEcdsaStrictRegistrationRequestBindingJson, routerAbEcdsaStrictRegistrationRequestMatchesFacts } from "./router/domains/ecdsa/routerAbEcdsaStrictRegistration.js";
+import { extractBearerCredential, extractRouterApiEnvironmentId, normalizeSourceIp, resolveRequestOriginRateLimitKeyFromFetchHeaders, resolveSourceIpFromFetchHeaders } from "./router/auth/routerApiKeyAuth.js";
 import { publishableKeyRoutePrincipal, resolvePublishableKeyApiCredentialAuth, resolveSecretKeyApiCredentialAuth, resolveWalletRegistrationContext } from "./router/auth/routerApiCredentialAuth.js";
 import { enforceRoutePolicy } from "./router/framework/enforceRoutePolicy.js";
-import { routeError, routeJson, sendExpressRouteResponse, toFetchRouteResponse } from "./router/framework/routeResponses.js";
-import { ROUTER_AB_TRACE_ID_HEADER_V1 } from "./shared-ts/src/utils/routerAbTraceContext.js";
+import { routeError, routeJson, toFetchRouteResponse } from "./router/framework/routeResponses.js";
 import { parseWalletRegistrationSetupRequest } from "./router/domains/walletRegistration/walletRegistrationRoutes.js";
 import { applyRouteMetering } from "./router/framework/applyRouteMetering.js";
 import { InMemoryRouterAbNormalSigningAdmissionStore, abusePrincipalKey, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createRouterAbNormalSigningAdmissionAdapter, runtimePolicyScopeKey } from "./router/domains/signingOperations/routerAbNormalSigningAdmissionCore.js";
@@ -103,12 +106,10 @@ import { CloudflareD1OidcJwksCache, parseBooleanJwtClaim, parseCacheControlMaxAg
 import { createSigningSessionSealOptions, parseSigningSessionSealRootConfig } from "./threshold/session/signingSessionSeal/options.js";
 import { normalizeD1RouterApiAuthOptions, normalizeLinkedDevicePasskeyTargetConfigurationV1, parseBooleanFlag, requireD1RouterApiAuthScopeString } from "./router/cloudflare/d1/auth/d1RouterApiAuthConfig.js";
 import { decodeJsonRpcEnvelope } from "./shared-ts/src/utils/jsonRpc.js";
-import { createRouterAbEcdsaEd25519CeremonyTokenIssuer, createRouterAbEcdsaStrictPostRegistrationPort, createRouterAbEcdsaStrictRegistrationPort, parseRouterAbEcdsaEd25519PrivateJwk, parseRouterAbEcdsaStrictRegistrationTopology, parseStoredRouterAbEcdsaPendingActivationV1, routerAbEcdsaStrictRegistrationFactsBindingJson, routerAbEcdsaStrictRegistrationRequestBindingJson, routerAbEcdsaStrictRegistrationRequestMatchesFacts } from "./router/domains/ecdsa/routerAbEcdsaStrictRegistration.js";
 import { parseGoogleEmailOtpRegistrationAttemptRecord, parseGoogleEmailOtpRegistrationOfferCandidates, requireRuntimePolicyScope } from "./router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationRecords.js";
 import { CloudflareD1GoogleEmailOtpRegistrationAttemptStore } from "./router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationAttemptStore.js";
 import { D1IdentityStore } from "./core/d1IdentityStore.js";
 import { verifyGoogleOidcToken } from "./router/cloudflare/d1/oidc/googleOidcToken.js";
-import { parseWalletRegistrationSetupReservation, proposeWalletRegistrationSetup, walletRegistrationSetupRequestDigest } from "./router/domains/walletRegistration/walletRegistrationReservation.js";
 import { D1LinkedDeviceEd25519ExportRootStoreV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceEd25519ExportRootStore.js";
 import { D1LinkedDeviceRequestProofNonceStoreV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceRequestProofNonceStore.js";
 import { createD1LinkedDeviceSessionServiceV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionService.js";
@@ -131,4 +132,4 @@ import { handleRouterAbEd25519YaoRecoveryRequestScopedCloudflareV1 } from "./rou
 import { RouterAbEd25519YaoRecoveryWalletSessionAuthorizationAdapter } from "./router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryWalletSessionAuthorization.js";
 import { keccak256Bytes } from "./shared-ts/src/utils/keccak.js";
 import { decodeEvmBlockHeader, decodeEvmTransactionByHash, decodeEvmTransactionCall, decodeEvmTransactionReceipt, parseRpcHexQuantity } from "./shared-ts/src/utils/evmRpcResults.js";
-export { API_CREDENTIAL_ROUTE_SCOPES, API_CREDENTIAL_TYPES, ActionType, CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, CloudflareD1AuthorizationStore, CloudflareD1GoogleEmailOtpRegistrationAttemptStore, CloudflareD1OidcJwksCache, CloudflareD1RouterAbEd25519YaoCapabilityPersistence, CloudflareD1RouterAbNormalSigningAdmissionStore, CloudflareD1VaultProxyStore, CloudflareD1VersionedJsonRecordStore, CloudflareD1VersionedJsonRecordStoreError, CloudflareD1WebAuthnAuthService, CloudflareD1WebAuthnStore, CloudflareDurableObjectVersionedJsonRecordStore, CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1, CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1, CloudflareVersionedJsonRecordStoreError, CrossSiteSessionCookieAdapter, D1IdentityStore, D1LinkedDeviceAuthorityInstallServiceV1, D1LinkedDeviceEd25519ExportRootStoreV1, D1LinkedDeviceRequestProofNonceStoreV1, D1LinkedDeviceSessionStoreV1, D1LinkedDeviceSourceContributionPreparationPlannerV1, D1LinkedDeviceTargetAuthenticatorStoreV1, D1LinkedDeviceTargetCredentialProviderV1, D1LinkedDeviceTargetPlannerV1, D1WalletAuthMethodStore, D1WalletObjectAddresses, D1WalletStore, D1_BATCH_CAS_GUARD_SQL, DEFAULT_SESSION_COOKIE_NAME, DEFAULT_WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_V1, DEFAULT_WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_V1, DEFAULT_WALLET_SESSION_REMAINING_USES, DEFAULT_WALLET_SESSION_TTL_MS, ED25519_SIGNER_ACTIVATION_ID_PATH, InMemoryRouterAbEd25519YaoExportService, InMemoryRouterAbEd25519YaoExportStateV1, InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter, InMemoryRouterAbEd25519YaoRegistrationService, InMemoryRouterAbNormalSigningAdmissionStore, LINKED_DEVICE_OWNER_AUTHORIZATION_PATH_V1, LinkedDeviceRetiredTargetRegistrationShapeErrorV1, LinkedDeviceSourceFamilyUnavailableErrorV1, LinkedDeviceWebAuthnRegistrationVerifierV1, MAX_WALLET_SESSION_REMAINING_USES, MAX_WALLET_SESSION_TTL_MS, PUBLIC_PROOF_TYPES, ROUTER_AB_ECDSA_DERIVATION_PRIVATE_SIGNING_PATHS, ROUTER_AB_ED25519_PRIVATE_SIGNING_PATHS, ROUTER_AB_ED25519_YAO_CAPABILITY_REPLACEMENT_TABLE_V1, ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_STATUS_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1, ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, ROUTER_AB_MPC_ROUTER_ORIGIN, ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, ROUTER_AB_SIGNING_WORKER_ORIGIN, ROUTER_AB_TRACE_ID_HEADER_V1, ROUTER_API_CREDENTIAL_SCOPES, ROUTE_SERVICE_KEYS, RouterAbEcdsaPresignRuntime, RouterAbEd25519YaoExportOwnerProofAuthorizationAdapter, RouterAbEd25519YaoHttpRegistrationBackend, RouterAbEd25519YaoRecoveryWalletSessionAuthorizationAdapter, SESSION_CAS_GUARD_SQL, SessionService, StaticCloudflareTenantStorageRouteResolver, UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, WALLET_AUTH_METHOD_D1_STORE, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL, WALLET_CONSOLE_API_WALLET_DETAIL_PREFIX_V1, WALLET_CONSOLE_OPS_BASE_PATH_V1, WALLET_CONSOLE_OP_PATHS_V1, WALLET_CONSOLE_SERVICE_ORIGIN_V1, WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_ID_V1, WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_ID_V1, WALLET_CONTROL_AUTH_MARKER_V1, WALLET_CONTROL_BASE_PATH_V1, WALLET_CONTROL_SERVICE_ORIGIN_V1, WALLET_RUNTIME_OPS_BASE_PATH_V1, WALLET_RUNTIME_OP_PATHS_V1, WALLET_RUNTIME_SERVICE_ORIGIN_V1, WALLET_STORE_D1_SCHEMA_SQL, WalletHomeCustodyBinding, WalletLifecycleLocator, WalletObjectAddressSnapshot, WalletPlacementRoutes, abusePrincipalKey, addSecp256k1PublicKeys33, admitD1EstablishedWalletHome, admitRouterAbEcdsaReusableWalletSessionOperation, applyRouteMetering, assertUniqueRouterApiRouteDefinitions, authenticateDeviceLinkingOwnerWalletSessionRequestV1, authenticateRouterAbEcdsaOperationStepUp, authenticateRouterAbWalletOperationStepUp, authenticateRouterAbWalletOperationStepUpIdentity, authorizeRouterAbEcdsaDerivationNormalSigningRoute, authorizeRouterAbEd25519NormalSigningRoute, base64UrlDecode, base64UrlEncode, bindWalletAuthMethodIdentity, bindWalletAuthMethodIdentityV2, buildCorsOrigins, buildRouterAbEcdsaDerivationPrivateSigningWorkerBody, buildRouterAbEcdsaOwnerOperationStepUpPreparation, buildRouterAbEd25519OwnerOperationStepUpPreparation, buildRouterAbEd25519PrivateSigningWorkerBody, buildRouterAbEd25519YaoAddSignerAdmissionRequestV1, buildRouterAbEd25519YaoProductAdmissionRequestV1, buildTenantRootIdentityFromAuthenticatedDeploymentV1, buildVerifiedLinkInputV1, buildVerifiedTargetFactorV1, buildWalletEcdsaSignerRecord, claimRouterAbEcdsaOperationStepUp, coerceLogger, coerceRouterLogger, completeRouterAbEcdsaOperation, computeEip1559TxHash, computeLinkedDeviceSessionClaimDigestV1, computeRouterAbEd25519NormalSigningAdmissionMaterial, computeVerifiedTargetFactorVerificationDigestV1, createCloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1RouterApiAuthService, createCloudflareD1VersionedJsonRecordStore, createCloudflareDurableObjectVersionedJsonRecordStore, createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1, createCloudflareRouter, createCloudflareTenantStorageRoute, createCloudflareWalletGatewayRouterV1, createD1LinkedDeviceOwnerAuthorizationMetadataSourceV1, createD1LinkedDeviceOwnerAuthorizationProviderV1, createD1LinkedDeviceOwnerSourceChildReaderV1, createD1LinkedDeviceRouteServiceV1, createD1LinkedDeviceSessionServiceV1, createD1LinkedDeviceSourceContributionPreparationPlannerV1, createD1LinkedDeviceVerifiedLinkSourceReaderV1, createDeviceLinkingOwnerRequestAuthenticatorV1, createEd25519SessionAdapter, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterApiRuntimeSnapshotConsumer, createRouterAbEcdsaEd25519CeremonyTokenIssuer, createRouterAbEcdsaStrictPostRegistrationPort, createRouterAbEcdsaStrictRegistrationPort, createRouterAbEd25519YaoCeremonyStateStoreV1, createRouterAbEd25519YaoExportModule, createRouterAbEd25519YaoHttpRegistrationBackendFromEnv, createRouterAbEd25519YaoMaterialActivationRefV1, createRouterAbEd25519YaoProductRegistrationCompositionFromPortsV1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, createRouterAbEd25519YaoProductRegistrationRequestScopedRuntimeV1, createRouterAbEd25519YaoProductRegistrationRuntimeV1, createRouterAbEd25519YaoProductRegistrationStateFromPartsV1, createRouterAbEd25519YaoProductRegistrationStateV1, createRouterAbEd25519YaoRegistrationModule, createRouterAbNormalSigningAdmissionAdapter, createRouterAbServiceBindingFetch, createRouterApiModule, createRouterApiRouteDefinitions, createSelfHostedCloudflareSigningRouter, createSelfHostedCloudflareSigningWorker, createSignerD1DoStorageTarget, createSigningSessionSealOptions, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, createStaticWalletConsoleBindingV1, createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1, createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, createWalletConsoleOpsClient, createWalletConsoleRelayProxyExtensionV1, createWalletControlClientBindings, createWalletRegistrationContextResolver, createWalletRuntimeOpsHandler, d1ChangedRows, d1Integer, d1Number, decideRouterAbEcdsaOwnerOperationAuthorization, decideRouterAbEd25519OwnerOperationAuthorization, decodeEvmBlockHeader, decodeEvmTransactionByHash, decodeEvmTransactionCall, decodeEvmTransactionReceipt, decodeJsonRpcEnvelope, decodeWalletConsoleTenantRootActiveLineageRequestV1, decodeWalletConsoleTenantRootActiveLineageResponseV1, defineRoute, defineRouteExtension, deriveJwtExpiresAtIso, deriveRecoveryCodeLocatorV1FromBytes, digestOpaqueValue, encodeEip1559SignedTxFromSignature65, encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1, encodeRouterAbEd25519YaoProductRegistrationStateV1, encodeSessionJsonSegment, encodeTenantRootIdentityV1, enforceDelegatePolicy, enforceRoutePolicy, ensureEvmCryptoWasm, ensureLeadingSlash, ensureWalletAuthMethodStoreD1Schema, ensureWalletStoreD1Schema, evaluateRouterAbNormalSigningAdmission, executeRouterAbEd25519YaoAdmittedRegistrationV1, executeSignedDelegateWithRelayer, extractBearerCredential, extractRouterApiEnvironmentId, findRouteDefinitionById, findRouteDefinitionForRequest, formatD1ExecStatement, getRouterApiRouteExtensionDefinitions, getRouterApiRouteExtensionRoutes, getRouterApiRouteExtensionsForTransport, handleRouterAbEcdsaDerivationNormalSigningRouteCore, handleRouterAbEd25519YaoExportRequestScopedCloudflareV1, handleRouterAbEd25519YaoRecoveryRequestScopedCloudflareV1, handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1, handleStaticWalletConsoleRequestV1, handleWalletControlRequest, headersToRecord, isD1DatabaseLike, isObject, isPlainObject, json, jsonFailure, keccak256Bytes, linkedDeviceSignerManifestsEqualV1, linkedDeviceX25519RecipientPublicKeyB64uV1, loadCloudflareSignerWasmModule, matchesRouteDefinitionRequest, mergeRouterAbEd25519YaoProductRegistrationStatePartitionV1, mintRouterAbEd25519YaoRegistrationIdentityV1, normalizeBoundedPositiveInteger, normalizeCorsOrigin, normalizeD1RouterApiAuthOptions, normalizeHashToBytes, normalizeLinkedDevicePasskeyTargetConfigurationV1, normalizeLogger, normalizeLowercaseString, normalizeSessionString, normalizeSessionTtlSeconds, normalizeSourceIp, normalizeTrimmedString, normalizeWalletAuthMethod, normalizeWalletAuthMethodV2, parseBooleanFlag, parseBooleanJwtClaim, parseCacheControlMaxAgeSec, parseCsvList, parseD1JsonArrayColumn, parseD1JsonColumn, parseD1JsonObjectColumn, parseD1LinkedDeviceSessionRowV1, parseD1LinkedDeviceSessionTranscriptRowV1, parseGoogleEmailOtpRegistrationAttemptRecord, parseGoogleEmailOtpRegistrationOfferCandidates, parseGoogleJwks, parseGoogleLoginVerifyRequest, parseInstalledEcdsaCustodySnapshotV1, parseJwtAud, parseLinkedDeviceSessionRecordV1, parseOrgId, parseRecoveryCodeLocatorV1, parseRouterAbEcdsaEd25519PrivateJwk, parseRouterAbEcdsaPresignRuntimeConfig, parseRouterAbEcdsaStrictRegistrationTopology, parseRouterAbEd25519NormalSigningScopeV2, parseRouterAbEd25519OperationStepUpScope, parseRouterAbEd25519YaoActivationKeysetFromEnvV1, parseRouterAbEd25519YaoCeremonyKeyV1, parseRouterAbEd25519YaoExportAdmissionEnvelopeV1, parseRouterAbEd25519YaoExportExecuteEnvelopeV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordJsonV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoProductRegistrationStateJsonV1, parseRouterAbEd25519YaoProductRegistrationStateV1, parseRouterAbEd25519YaoRegistrationAdmissionReadV1, parseRouterAbEd25519YaoRegistrationRouterAnswerV1, parseRouterAbEd25519YaoTenantRootWireV1, parseRouterAbOperationStepUpOperation, parseRouterAbPublicKeysetV2, parseRpcHexQuantity, parseRs256JwtForVerification, parseSessionJwt, parseSigningSessionSealRootConfig, parseStaticWalletConsoleBindingConfigV1, parseStoredRouterAbEcdsaPendingActivationV1, parseWalletEd25519SignerRecord, parseWalletId, parseWalletRecoveryOperationId, parseWalletRegistrationContextResponse, parseWalletRegistrationSetupRequest, parseWalletRegistrationSetupReservation, parseWalletRuntimeExecuteSignedDelegateRequest, parseWalletRuntimeExecuteSignedDelegateResponse, parseWalletRuntimeExecuteSignedDelegateResult, parseWalletRuntimeRelayerAccount, parseWalletRuntimeWalletIdentitiesResult, parseWalletRuntimeWalletIdentityRequest, parseWebAuthnRpId, parseWebAuthnSyncChallengeRecord, partitionRouterAbEd25519YaoProductRegistrationStateV1, postRouterAbSigningWorkerJson, prepareD1TenantStatement, prepareD1WalletAuthMethodInsertStatement, prepareD1WalletAuthMethodPutStatement, prepareD1WalletAuthMethodV2PutStatement, prepareD1WalletPutSignerStatement, prepareD1WalletPutSubjectStatement, prepareD1WebAuthnAuthenticatorInsertStatement, prepareD1WebAuthnAuthenticatorPutStatement, projectRouterAbEd25519YaoExactWalletSession, proposeWalletRegistrationSetup, publishableKeyRoutePrincipal, queryD1All, queryD1One, randomTenantRootCreationGrantBytesV1, readD1LinkedDeviceEcdsaSourceV1, readD1LinkedDeviceEd25519SourceV1, readEnvironmentCsv, readEnvironmentString, readJson, registrationPreparationIdFromString, requireD1RouterApiAuthScopeString, requireEnvironmentString, requireNormalizedSessionString, requireRuntimePolicyScope, resolveFreshRouterAbEcdsaMaterialActivation, resolvePublishableKeyApiCredentialAuth, resolveRequestOriginRateLimitKeyFromExpressRequest, resolveRequestOriginRateLimitKeyFromFetchHeaders, resolveRouterAbEd25519YaoCeremonyKeyFromRequestV1, resolveRuntimeTenantRootLineage, resolveSecretKeyApiCredentialAuth, resolveSourceIpFromExpressRequest, resolveSourceIpFromFetchHeaders, resolveWalletRegistrationContext, routeError, routeJson, routerAbEcdsaAtomicAuthorizationConfigured, routerAbEcdsaOperationInProgressResult, routerAbEcdsaOwnerOperationFailureResult, routerAbEcdsaRecordedResponse, routerAbEcdsaReplayHttpResponse, routerAbEcdsaReplayResult, routerAbEcdsaReplayUnavailableResult, routerAbEcdsaStrictRegistrationFactsBindingJson, routerAbEcdsaStrictRegistrationRequestBindingJson, routerAbEcdsaStrictRegistrationRequestMatchesFacts, routerAbEd25519OwnerOperationFailureResult, routerAbEd25519YaoAdmittedRegistrationAuthorityV1, routerAbEd25519YaoPartitionedStateAfterStoredCommitV1, routerAbEd25519YaoPersistedCapabilityMatchesLookupV1, routerAbEd25519YaoRegistrationExecutionTimingEntriesV1, routerAbEd25519YaoRegistrationSigningRootIdV1, routerAbEd25519YaoTenantRootWireV1, runRouterAbEd25519YaoProductRegistrationRequestScopedV1, runRouterAbEd25519YaoRegistrationSideEffectV1, runRouterAbEd25519YaoRegistrationTwoPhaseV1, runRouterAbPrewarmScheduledV1, runtimePolicyScopeKey, sameRouterAbEd25519YaoSharedStateCanonicalEncodingV1, secp256k1PrivateKey32ToPublicKey33, secp256k1PublicKey33ToEthereumAddress, secureRandomBase36, secureRandomBase64Url, selectWalletEd25519Signer, sendExpressRouteResponse, sessionJwtTimeClaims, sha256Bytes, sha256BytesSync, signSecp256k1Recoverable, signTenantRootCreationGrantV1, tenantRootIdentityDigestB64uV1, tenantStorageRouteBackendFamily, tenantStorageRouteDiagnostic, toFetchRouteResponse, normalizeOptionalTrimmedString as toOptionalTrimmedString, toResponse, toSessionArrayBufferCopy, unavailableRegistrationContext, validateDelegateExpiryAndNonce, validateGoogleIdTokenClaims, validateRuntimeSnapshotExpectation, validateSecp256k1PublicKey33, verifyGoogleOidcToken, verifyRs256JwtSignature, verifySecp256k1Bip340SignatureAgainstPublicKey33, verifySecp256k1RecoverableSignatureAgainstPublicKey33, walletAuthMethodId, walletAuthMethodV2Id, walletConsoleApiWalletGetRouteDefinitionV1, walletConsoleApiWalletListRouteDefinitionV1, walletConsoleApiWalletSearchRouteDefinitionV1, walletConsoleRelayRouteDefinitionsV1, walletConsoleSignedDelegateRouteDefinitionV1, walletConsoleSponsoredEvmCallRouteDefinitionV1, walletObjectIdentity, walletRegistrationContext, walletRegistrationSetupRequestDigest, webAuthnCredentialIdB64uFromCredential, withCors };
+export { API_CREDENTIAL_ROUTE_SCOPES, API_CREDENTIAL_TYPES, ActionType, CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, CloudflareD1AuthorizationStore, CloudflareD1GoogleEmailOtpRegistrationAttemptStore, CloudflareD1OidcJwksCache, CloudflareD1RouterAbEd25519YaoCapabilityPersistence, CloudflareD1RouterAbNormalSigningAdmissionStore, CloudflareD1VaultProxyStore, CloudflareD1VersionedJsonRecordStore, CloudflareD1VersionedJsonRecordStoreError, CloudflareD1WebAuthnAuthService, CloudflareD1WebAuthnStore, CloudflareDurableObjectVersionedJsonRecordStore, CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1, CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1, CloudflareVersionedJsonRecordStoreError, CrossSiteSessionCookieAdapter, D1IdentityStore, D1LinkedDeviceAuthorityInstallServiceV1, D1LinkedDeviceEd25519ExportRootStoreV1, D1LinkedDeviceRequestProofNonceStoreV1, D1LinkedDeviceSessionStoreV1, D1LinkedDeviceSourceContributionPreparationPlannerV1, D1LinkedDeviceTargetAuthenticatorStoreV1, D1LinkedDeviceTargetCredentialProviderV1, D1LinkedDeviceTargetPlannerV1, D1WalletAuthMethodStore, D1WalletObjectAddresses, D1WalletStore, D1_BATCH_CAS_GUARD_SQL, DEFAULT_SESSION_COOKIE_NAME, DEFAULT_WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_V1, DEFAULT_WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_V1, DEFAULT_WALLET_SESSION_REMAINING_USES, DEFAULT_WALLET_SESSION_TTL_MS, ED25519_SIGNER_ACTIVATION_ID_PATH, InMemoryRouterAbEd25519YaoExportService, InMemoryRouterAbEd25519YaoExportStateV1, InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter, InMemoryRouterAbEd25519YaoRegistrationService, InMemoryRouterAbNormalSigningAdmissionStore, LINKED_DEVICE_OWNER_AUTHORIZATION_PATH_V1, LinkedDeviceRetiredTargetRegistrationShapeErrorV1, LinkedDeviceSourceFamilyUnavailableErrorV1, LinkedDeviceWebAuthnRegistrationVerifierV1, LocalRegistrationSetupAuthority, MAX_WALLET_SESSION_REMAINING_USES, MAX_WALLET_SESSION_TTL_MS, PUBLIC_PROOF_TYPES, ROUTER_AB_ECDSA_DERIVATION_PRIVATE_SIGNING_PATHS, ROUTER_AB_ED25519_PRIVATE_SIGNING_PATHS, ROUTER_AB_ED25519_YAO_CAPABILITY_REPLACEMENT_TABLE_V1, ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_STATUS_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1, ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, ROUTER_AB_MPC_ROUTER_ORIGIN, ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, ROUTER_AB_SIGNING_WORKER_ORIGIN, ROUTER_AB_TRACE_ID_HEADER_V1, ROUTER_API_CREDENTIAL_SCOPES, ROUTE_SERVICE_KEYS, RouterAbEcdsaPresignRuntime, RouterAbEd25519YaoExportOwnerProofAuthorizationAdapter, RouterAbEd25519YaoHttpRegistrationBackend, RouterAbEd25519YaoRecoveryWalletSessionAuthorizationAdapter, SESSION_CAS_GUARD_SQL, SessionService, StaticCloudflareTenantStorageRouteResolver, UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, WALLET_AUTH_METHOD_D1_STORE, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL, WALLET_CONSOLE_API_WALLET_DETAIL_PREFIX_V1, WALLET_CONSOLE_OPS_BASE_PATH_V1, WALLET_CONSOLE_OP_PATHS_V1, WALLET_CONSOLE_SERVICE_ORIGIN_V1, WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_ID_V1, WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_ID_V1, WALLET_CONTROL_AUTH_MARKER_V1, WALLET_CONTROL_BASE_PATH_V1, WALLET_CONTROL_SERVICE_ORIGIN_V1, WALLET_RUNTIME_OPS_BASE_PATH_V1, WALLET_RUNTIME_OP_PATHS_V1, WALLET_RUNTIME_SERVICE_ORIGIN_V1, WALLET_STORE_D1_SCHEMA_SQL, WalletHomeCustodyBinding, WalletLifecycleLocator, WalletObjectAddressSnapshot, WalletPlacementRoutes, abusePrincipalKey, addSecp256k1PublicKeys33, admitD1EstablishedWalletHome, admitRouterAbEcdsaReusableWalletSessionOperation, applyRouteMetering, assertUniqueRouterApiRouteDefinitions, authenticateDeviceLinkingOwnerWalletSessionRequestV1, authenticateRouterAbEcdsaOperationStepUp, authenticateRouterAbWalletOperationStepUp, authenticateRouterAbWalletOperationStepUpIdentity, authorizeRouterAbEcdsaDerivationNormalSigningRoute, authorizeRouterAbEd25519NormalSigningRoute, base64UrlDecode, base64UrlEncode, bindWalletAuthMethodIdentity, bindWalletAuthMethodIdentityV2, buildCorsOrigins, buildRouterAbEcdsaDerivationPrivateSigningWorkerBody, buildRouterAbEcdsaOwnerOperationStepUpPreparation, buildRouterAbEd25519OwnerOperationStepUpPreparation, buildRouterAbEd25519PrivateSigningWorkerBody, buildRouterAbEd25519YaoAddSignerAdmissionRequestV1, buildRouterAbEd25519YaoProductAdmissionRequestV1, buildTenantRootIdentityFromAuthenticatedDeploymentV1, buildVerifiedLinkInputV1, buildVerifiedTargetFactorV1, buildWalletEcdsaSignerRecord, claimRouterAbEcdsaOperationStepUp, coerceLogger, coerceRouterLogger, completeRouterAbEcdsaOperation, computeEip1559TxHash, computeLinkedDeviceSessionClaimDigestV1, computeRouterAbEd25519NormalSigningAdmissionMaterial, computeVerifiedTargetFactorVerificationDigestV1, createCloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1RouterApiAuthService, createCloudflareD1VersionedJsonRecordStore, createCloudflareDurableObjectVersionedJsonRecordStore, createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1, createCloudflareRouter, createCloudflareTenantStorageRoute, createCloudflareWalletGatewayRouterV1, createD1LinkedDeviceOwnerAuthorizationMetadataSourceV1, createD1LinkedDeviceOwnerAuthorizationProviderV1, createD1LinkedDeviceOwnerSourceChildReaderV1, createD1LinkedDeviceRouteServiceV1, createD1LinkedDeviceSessionServiceV1, createD1LinkedDeviceSourceContributionPreparationPlannerV1, createD1LinkedDeviceVerifiedLinkSourceReaderV1, createDeviceLinkingOwnerRequestAuthenticatorV1, createEd25519SessionAdapter, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterApiRuntimeSnapshotConsumer, createRouterAbEcdsaEd25519CeremonyTokenIssuer, createRouterAbEcdsaStrictPostRegistrationPort, createRouterAbEcdsaStrictRegistrationPort, createRouterAbEd25519YaoCeremonyStateStoreV1, createRouterAbEd25519YaoExportModule, createRouterAbEd25519YaoHttpRegistrationBackendFromEnv, createRouterAbEd25519YaoMaterialActivationRefV1, createRouterAbEd25519YaoProductRegistrationCompositionFromPortsV1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, createRouterAbEd25519YaoProductRegistrationRequestScopedRuntimeV1, createRouterAbEd25519YaoProductRegistrationRuntimeV1, createRouterAbEd25519YaoProductRegistrationStateFromPartsV1, createRouterAbEd25519YaoProductRegistrationStateV1, createRouterAbEd25519YaoRegistrationModule, createRouterAbNormalSigningAdmissionAdapter, createRouterAbServiceBindingFetch, createRouterApiModule, createRouterApiRouteDefinitions, createSelfHostedCloudflareSigningRouter, createSelfHostedCloudflareSigningWorker, createSignerD1DoStorageTarget, createSigningSessionSealOptions, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, createStaticWalletConsoleBindingV1, createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1, createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, createWalletConsoleOpsClient, createWalletConsoleRelayProxyExtensionV1, createWalletControlClientBindings, createWalletRegistrationContextResolver, createWalletRuntimeOpsHandler, d1ChangedRows, d1Integer, d1Number, decideRouterAbEcdsaOwnerOperationAuthorization, decideRouterAbEd25519OwnerOperationAuthorization, decodeEvmBlockHeader, decodeEvmTransactionByHash, decodeEvmTransactionCall, decodeEvmTransactionReceipt, decodeJsonRpcEnvelope, decodeWalletConsoleTenantRootActiveLineageRequestV1, decodeWalletConsoleTenantRootActiveLineageResponseV1, defineRoute, defineRouteExtension, deriveJwtExpiresAtIso, deriveRecoveryCodeLocatorV1FromBytes, digestOpaqueValue, encodeEip1559SignedTxFromSignature65, encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1, encodeRouterAbEd25519YaoProductRegistrationStateV1, encodeSessionJsonSegment, encodeTenantRootIdentityV1, enforceDelegatePolicy, enforceRoutePolicy, ensureEvmCryptoWasm, ensureLeadingSlash, ensureWalletAuthMethodStoreD1Schema, ensureWalletStoreD1Schema, evaluateRouterAbNormalSigningAdmission, executeRouterAbEd25519YaoAdmittedRegistrationV1, executeSignedDelegateWithRelayer, extractBearerCredential, extractRouterApiEnvironmentId, findRouteDefinitionById, findRouteDefinitionForRequest, formatD1ExecStatement, getRouterApiRouteExtensionDefinitions, getRouterApiRouteExtensionRoutes, getRouterApiRouteExtensionsForTransport, handleRouterAbEcdsaDerivationNormalSigningRouteCore, handleRouterAbEd25519YaoExportRequestScopedCloudflareV1, handleRouterAbEd25519YaoRecoveryRequestScopedCloudflareV1, handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1, handleStaticWalletConsoleRequestV1, handleWalletControlRequest, headersToRecord, isD1DatabaseLike, isObject, isPlainObject, json, jsonFailure, keccak256Bytes, linkedDeviceSignerManifestsEqualV1, linkedDeviceX25519RecipientPublicKeyB64uV1, loadCloudflareSignerWasmModule, matchesRouteDefinitionRequest, mergeRouterAbEd25519YaoProductRegistrationStatePartitionV1, mintRouterAbEd25519YaoRegistrationIdentityV1, normalizeBoundedPositiveInteger, normalizeCorsOrigin, normalizeD1RouterApiAuthOptions, normalizeHashToBytes, normalizeLinkedDevicePasskeyTargetConfigurationV1, normalizeLogger, normalizeLowercaseString, normalizeSessionString, normalizeSessionTtlSeconds, normalizeSourceIp, normalizeTrimmedString, normalizeWalletAuthMethod, normalizeWalletAuthMethodV2, parseBooleanFlag, parseBooleanJwtClaim, parseCacheControlMaxAgeSec, parseCsvList, parseD1JsonArrayColumn, parseD1JsonColumn, parseD1JsonObjectColumn, parseD1LinkedDeviceSessionRowV1, parseD1LinkedDeviceSessionTranscriptRowV1, parseGoogleEmailOtpRegistrationAttemptRecord, parseGoogleEmailOtpRegistrationOfferCandidates, parseGoogleJwks, parseGoogleLoginVerifyRequest, parseInstalledEcdsaCustodySnapshotV1, parseJwtAud, parseLinkedDeviceSessionRecordV1, parseOrgId, parseRecoveryCodeLocatorV1, parseRouterAbEcdsaEd25519PrivateJwk, parseRouterAbEcdsaPresignRuntimeConfig, parseRouterAbEcdsaStrictRegistrationTopology, parseRouterAbEd25519NormalSigningScopeV2, parseRouterAbEd25519OperationStepUpScope, parseRouterAbEd25519YaoActivationKeysetFromEnvV1, parseRouterAbEd25519YaoCeremonyKeyV1, parseRouterAbEd25519YaoExportAdmissionEnvelopeV1, parseRouterAbEd25519YaoExportExecuteEnvelopeV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordJsonV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoProductRegistrationStateJsonV1, parseRouterAbEd25519YaoProductRegistrationStateV1, parseRouterAbEd25519YaoRegistrationAdmissionReadV1, parseRouterAbEd25519YaoRegistrationRouterAnswerV1, parseRouterAbEd25519YaoTenantRootWireV1, parseRouterAbOperationStepUpOperation, parseRouterAbPublicKeysetV2, parseRpcHexQuantity, parseRs256JwtForVerification, parseSessionJwt, parseSigningSessionSealRootConfig, parseStaticWalletConsoleBindingConfigV1, parseStoredRouterAbEcdsaPendingActivationV1, parseWalletEd25519SignerRecord, parseWalletId, parseWalletRecoveryOperationId, parseWalletRegistrationContextResponse, parseWalletRegistrationSetupRequest, parseWalletRegistrationSetupReservation, parseWalletRuntimeExecuteSignedDelegateRequest, parseWalletRuntimeExecuteSignedDelegateResponse, parseWalletRuntimeExecuteSignedDelegateResult, parseWalletRuntimeRelayerAccount, parseWalletRuntimeWalletIdentitiesResult, parseWalletRuntimeWalletIdentityRequest, parseWebAuthnRpId, parseWebAuthnSyncChallengeRecord, partitionRouterAbEd25519YaoProductRegistrationStateV1, postRouterAbSigningWorkerJson, prepareD1TenantStatement, prepareD1WalletAuthMethodInsertStatement, prepareD1WalletAuthMethodPutStatement, prepareD1WalletAuthMethodV2PutStatement, prepareD1WalletPutSignerStatement, prepareD1WalletPutSubjectStatement, prepareD1WebAuthnAuthenticatorInsertStatement, prepareD1WebAuthnAuthenticatorPutStatement, projectRouterAbEd25519YaoExactWalletSession, proposeWalletRegistrationSetup, publishableKeyRoutePrincipal, queryD1All, queryD1One, randomTenantRootCreationGrantBytesV1, readD1LinkedDeviceEcdsaSourceV1, readD1LinkedDeviceEd25519SourceV1, readEnvironmentCsv, readEnvironmentString, readJson, registrationPreparationIdFromString, requireD1RouterApiAuthScopeString, requireEnvironmentString, requireNormalizedSessionString, requireRuntimePolicyScope, resolveFreshRouterAbEcdsaMaterialActivation, resolvePublishableKeyApiCredentialAuth, resolveRequestOriginRateLimitKeyFromFetchHeaders, resolveRouterAbEd25519YaoCeremonyKeyFromRequestV1, resolveRuntimeTenantRootLineage, resolveSecretKeyApiCredentialAuth, resolveSourceIpFromFetchHeaders, resolveWalletRegistrationContext, routeError, routeJson, routerAbEcdsaAtomicAuthorizationConfigured, routerAbEcdsaOperationInProgressResult, routerAbEcdsaOwnerOperationFailureResult, routerAbEcdsaRecordedResponse, routerAbEcdsaReplayHttpResponse, routerAbEcdsaReplayResult, routerAbEcdsaReplayUnavailableResult, routerAbEcdsaStrictRegistrationFactsBindingJson, routerAbEcdsaStrictRegistrationRequestBindingJson, routerAbEcdsaStrictRegistrationRequestMatchesFacts, routerAbEd25519OwnerOperationFailureResult, routerAbEd25519YaoAdmittedRegistrationAuthorityV1, routerAbEd25519YaoPartitionedStateAfterStoredCommitV1, routerAbEd25519YaoPersistedCapabilityMatchesLookupV1, routerAbEd25519YaoRegistrationExecutionTimingEntriesV1, routerAbEd25519YaoRegistrationSigningRootIdV1, routerAbEd25519YaoTenantRootWireV1, runRouterAbEd25519YaoProductRegistrationRequestScopedV1, runRouterAbEd25519YaoRegistrationSideEffectV1, runRouterAbEd25519YaoRegistrationTwoPhaseV1, runRouterAbPrewarmScheduledV1, runtimePolicyScopeKey, sameRouterAbEd25519YaoSharedStateCanonicalEncodingV1, secp256k1PrivateKey32ToPublicKey33, secp256k1PublicKey33ToEthereumAddress, secureRandomBase36, secureRandomBase64Url, selectWalletEd25519Signer, sessionJwtTimeClaims, sha256Bytes, sha256BytesSync, signSecp256k1Recoverable, signTenantRootCreationGrantV1, tenantRootIdentityDigestB64uV1, tenantStorageRouteBackendFamily, tenantStorageRouteDiagnostic, toFetchRouteResponse, normalizeOptionalTrimmedString as toOptionalTrimmedString, toResponse, toSessionArrayBufferCopy, unavailableRegistrationContext, validateDelegateExpiryAndNonce, validateGoogleIdTokenClaims, validateRuntimeSnapshotExpectation, validateSecp256k1PublicKey33, verifyGoogleOidcToken, verifyRs256JwtSignature, verifySecp256k1Bip340SignatureAgainstPublicKey33, verifySecp256k1RecoverableSignatureAgainstPublicKey33, walletAuthMethodId, walletAuthMethodV2Id, walletConsoleApiWalletGetRouteDefinitionV1, walletConsoleApiWalletListRouteDefinitionV1, walletConsoleApiWalletSearchRouteDefinitionV1, walletConsoleRelayRouteDefinitionsV1, walletConsoleSignedDelegateRouteDefinitionV1, walletConsoleSponsoredEvmCallRouteDefinitionV1, walletObjectIdentity, walletRegistrationContext, walletRegistrationSetupRequestDigest, webAuthnCredentialIdB64uFromCredential, withCors };

package/dist/esm/hosted-wallet-gateway.js

@@ -9,6 +9,7 @@ import { D1WalletStore } from "./core/d1WalletStore.js";
 import { D1WalletAuthMethodStore } from "./core/d1WalletAuthMethodStore.js";
 import { WALLET_OBJECT_ADDRESSES_HEADER, WALLET_OBJECT_IDENTITY_HEADER, walletObjectIdentity, walletObjectIdentityHeaders } from "./router/cloudflare/runtime/walletObjectAddresses.js";
 import { RouterAbEcdsaPresignRuntime } from "./core/routerAbSigning/RouterAbEcdsaPresignRuntime.js";
+import { createRouterAbEcdsaEd25519CeremonyTokenIssuer, createRouterAbEcdsaStrictPostRegistrationPort, createRouterAbEcdsaStrictRegistrationPort, parseRouterAbEcdsaEd25519PrivateJwk, parseRouterAbEcdsaStrictRegistrationTopology } from "./router/domains/ecdsa/routerAbEcdsaStrictRegistration.js";
 import { buildTenantRootIdentityFromAuthenticatedDeploymentV1, decodeTenantRootIdentityWireV1 } from "./shared-ts/src/tenant-root/tenantRootIdentity.js";
 import "./shared-ts/src/tenant-root/index.js";
 import { createWalletConsoleOpsClient } from "./router/cloudflare/runtime/walletConsoleOpsClient.js";
@@ -32,7 +33,6 @@ import { createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, cr
 import { CloudflareD1RouterAbEd25519YaoCapabilityPersistence } from "./router/cloudflare/d1/ed25519Yao/d1Ed25519YaoCapabilityPersistence.js";
 import { warmSigningSessionSealRuntime } from "./threshold/session/signingSessionSeal/crypto/shamir3PassWasm.js";
 import { createSigningSessionSealOptions } from "./threshold/session/signingSessionSeal/options.js";
-import { createRouterAbEcdsaEd25519CeremonyTokenIssuer, createRouterAbEcdsaStrictPostRegistrationPort, createRouterAbEcdsaStrictRegistrationPort, parseRouterAbEcdsaEd25519PrivateJwk, parseRouterAbEcdsaStrictRegistrationTopology } from "./router/domains/ecdsa/routerAbEcdsaStrictRegistration.js";
 import { D1LinkedDeviceTargetCredentialProviderV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetCredentialProvider.js";
 import { createD1LinkedDeviceOwnerSourceChildReaderV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceOwnerAuthorizationProvider.js";
 import { createCloudflareD1RouterApiAuthService } from "./router/cloudflare/d1/auth/d1RouterApiAuthService.js";

package/dist/esm/index.js

@@ -32,9 +32,8 @@ import { parseBool, requireEnvVar } from "./core/config.js";
 import { createInMemorySigningSessionSealIdempotencyStore } from "./threshold/session/signingSessionSeal/idempotency.js";
 import { createRedisTcpSigningSessionSealRateLimiter, createUpstashSigningSessionSealRateLimiter, resolveSigningSessionSealRateLimitFromEnv } from "./threshold/session/signingSessionSeal/guards/backends.js";
 import { createRedisTcpSigningSessionSealIdempotencyStore, createUpstashSigningSessionSealIdempotencyStore, resolveSigningSessionSealIdempotencyFromEnv } from "./threshold/session/signingSessionSeal/idempotencyBackends.js";
-import { registerSigningSessionSealRoutes } from "./threshold/session/signingSessionSeal/transport/express.js";
 import "./threshold/session/signingSessionSeal/index.js";
 import { StaticRorOriginsProvider } from "./router/framework/ror/staticProvider.js";
 import { createRorOptions } from "./router/framework/ror/options.js";
 import "./router/framework/ror/index.js";
-export { AUTHORIZED_OPERATION_REPLAY_BODY_MAX_BYTES, AuthorizationService, CloudflareD1RouterAbNormalSigningAdmissionStore, D1IdentityStore, D1WalletAuthMethodStore, D1WalletStore, IDENTITY_STORE_D1_SCHEMA_SQL, InMemoryRouterAbNormalSigningAdmissionStore, LocalWorkerVaultProxyGateway, OrdinaryInactiveSignerMaterialReservationServiceV1, RouterAbEcdsaPresignRuntime, SessionService, StaticCloudflareTenantStorageRouteResolver, StaticRorOriginsProvider, VaultProxyUseService, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, WALLET_STORE_D1_SCHEMA_SQL, authorizeSigningSessionSealRequest, authorizedOperationReplayBodyInit, buildActiveWalletSessionQuota, buildAuthorizedOperation, buildCorsOrigins, buildExactWalletSessionQuotaProjectionV1, buildPersistedActiveWalletSessionAuthorizationV2, buildSigningSessionSealApplyPath, buildSigningSessionSealRemovePath, buildVaultProxyUseOperation, buildWalletEcdsaSignerRecord, buildWalletEd25519SignerId, buildWalletSessionAuthorizationV2, buildWalletSessionCapabilitySubjectsV1, composeSigningSessionSealGuards, computeAuthorizedOperationResultDigest, computeEip1559TxHash, createCloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareTenantStorageRoute, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createInMemorySigningSessionSealIdempotencyStore, createInMemorySigningSessionSealRateLimiter, createOrdinaryInactiveSignerMaterialReservationServiceV1, createPassthroughSigningSessionSealCipherAdapter, createRedisTcpSigningSessionSealIdempotencyStore, createRedisTcpSigningSessionSealRateLimiter, createRorOptions, createRouterAbNormalSigningAdmissionAdapter, createRouterApiModule, createSignerD1DoStorageTarget, createSigningSessionSealAuditLogger, createSigningSessionSealCipherAdapter, createSigningSessionSealOptions, createSigningSessionSealRateLimitGuard, createSigningSessionSealRoutesOptions, createSigningSessionSealService, createSigningSessionSealShamir3PassCipherAdapter, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, createUpstashSigningSessionSealIdempotencyStore, createUpstashSigningSessionSealRateLimiter, createVaultProxyUseRouteExtension, digestOpaqueValue, encodeEip1559SignedTxFromSignature65, encodeSigningSessionSealServerLockContext, ensureEvmCryptoWasm, ensureIdentityStoreD1Schema, ensureWalletAuthMethodStoreD1Schema, ensureWalletStoreD1Schema, exactWalletSessionCapabilitySubjectsResolveAuthority, formatSigningSessionSealKeyVersionForWire, handleSigningSessionSealRoutes, normalizeRorHost, normalizeWalletAuthMethod, parseAuthorizedOperationReplayResponse, parseBool, parseCsvList, parseHostedWalletSeamsSessionExchangeCode, parseHostedWalletSeamsSessionExchangeNonce, parseHostedWalletSessionCredentialId, parseHostedWalletSessionOperationCredentialToken, parseHostedWalletSessionOperationCredentialV1, parseMpcWalletSigningQuotaId, parseOrdinaryEcdsaSignerMaterialDeactivationResultV1, parseOrdinaryEcdsaSignerMaterialWorkerReservationV1, parseOrdinaryEd25519SignerMaterialDeactivationResultV1, parseOrdinaryEd25519SignerMaterialWorkerReservationV1, parsePrimaryWalletSessionOperationCredentialToken, parseSessionOrigin, parseSigningSessionSealApplyBody, parseSigningSessionSealKeyVersion, parseSigningSessionSealRemoveBody, parseSigningSessionSealRootConfig, parseVaultProxyDestination, parseVerifiedOwnerProofId, parseWalletSessionAuthorizationV2, parseWalletSessionId, projectActiveWalletSession, projectExactWalletSessionAuthorizationV1, registerSigningSessionSealRoutes, registrationPreparationIdFromString, requireEnvVar, resolveRorRpId, resolveSigningSessionSealBasePath, resolveSigningSessionSealIdempotencyFromEnv, resolveSigningSessionSealRateLimitFromEnv, sanitizeRorOrigins, secp256k1PrivateKey32ToPublicKey33, secp256k1PublicKey33ToEthereumAddress, signSecp256k1Recoverable, signingSessionSealAuthorizeStatusCode, signingSessionSealStatusCode, tenantStorageRouteBackendFamily, tenantStorageRouteDiagnostic, validateOrdinaryInactiveSignerMaterialDeactivationRequestV1, validateOrdinaryInactiveSignerMaterialReservationRequestV1, validateRouterApiRorOptions, walletSessionAuthorizationV2RecordsEqual, walletSessionCapabilitySubjectsV1Equal };
+export { AUTHORIZED_OPERATION_REPLAY_BODY_MAX_BYTES, AuthorizationService, CloudflareD1RouterAbNormalSigningAdmissionStore, D1IdentityStore, D1WalletAuthMethodStore, D1WalletStore, IDENTITY_STORE_D1_SCHEMA_SQL, InMemoryRouterAbNormalSigningAdmissionStore, LocalWorkerVaultProxyGateway, OrdinaryInactiveSignerMaterialReservationServiceV1, RouterAbEcdsaPresignRuntime, SessionService, StaticCloudflareTenantStorageRouteResolver, StaticRorOriginsProvider, VaultProxyUseService, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, WALLET_STORE_D1_SCHEMA_SQL, authorizeSigningSessionSealRequest, authorizedOperationReplayBodyInit, buildActiveWalletSessionQuota, buildAuthorizedOperation, buildCorsOrigins, buildExactWalletSessionQuotaProjectionV1, buildPersistedActiveWalletSessionAuthorizationV2, buildSigningSessionSealApplyPath, buildSigningSessionSealRemovePath, buildVaultProxyUseOperation, buildWalletEcdsaSignerRecord, buildWalletEd25519SignerId, buildWalletSessionAuthorizationV2, buildWalletSessionCapabilitySubjectsV1, composeSigningSessionSealGuards, computeAuthorizedOperationResultDigest, computeEip1559TxHash, createCloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareTenantStorageRoute, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createInMemorySigningSessionSealIdempotencyStore, createInMemorySigningSessionSealRateLimiter, createOrdinaryInactiveSignerMaterialReservationServiceV1, createPassthroughSigningSessionSealCipherAdapter, createRedisTcpSigningSessionSealIdempotencyStore, createRedisTcpSigningSessionSealRateLimiter, createRorOptions, createRouterAbNormalSigningAdmissionAdapter, createRouterApiModule, createSignerD1DoStorageTarget, createSigningSessionSealAuditLogger, createSigningSessionSealCipherAdapter, createSigningSessionSealOptions, createSigningSessionSealRateLimitGuard, createSigningSessionSealRoutesOptions, createSigningSessionSealService, createSigningSessionSealShamir3PassCipherAdapter, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, createUpstashSigningSessionSealIdempotencyStore, createUpstashSigningSessionSealRateLimiter, createVaultProxyUseRouteExtension, digestOpaqueValue, encodeEip1559SignedTxFromSignature65, encodeSigningSessionSealServerLockContext, ensureEvmCryptoWasm, ensureIdentityStoreD1Schema, ensureWalletAuthMethodStoreD1Schema, ensureWalletStoreD1Schema, exactWalletSessionCapabilitySubjectsResolveAuthority, formatSigningSessionSealKeyVersionForWire, handleSigningSessionSealRoutes, normalizeRorHost, normalizeWalletAuthMethod, parseAuthorizedOperationReplayResponse, parseBool, parseCsvList, parseHostedWalletSeamsSessionExchangeCode, parseHostedWalletSeamsSessionExchangeNonce, parseHostedWalletSessionCredentialId, parseHostedWalletSessionOperationCredentialToken, parseHostedWalletSessionOperationCredentialV1, parseMpcWalletSigningQuotaId, parseOrdinaryEcdsaSignerMaterialDeactivationResultV1, parseOrdinaryEcdsaSignerMaterialWorkerReservationV1, parseOrdinaryEd25519SignerMaterialDeactivationResultV1, parseOrdinaryEd25519SignerMaterialWorkerReservationV1, parsePrimaryWalletSessionOperationCredentialToken, parseSessionOrigin, parseSigningSessionSealApplyBody, parseSigningSessionSealKeyVersion, parseSigningSessionSealRemoveBody, parseSigningSessionSealRootConfig, parseVaultProxyDestination, parseVerifiedOwnerProofId, parseWalletSessionAuthorizationV2, parseWalletSessionId, projectActiveWalletSession, projectExactWalletSessionAuthorizationV1, registrationPreparationIdFromString, requireEnvVar, resolveRorRpId, resolveSigningSessionSealBasePath, resolveSigningSessionSealIdempotencyFromEnv, resolveSigningSessionSealRateLimitFromEnv, sanitizeRorOrigins, secp256k1PrivateKey32ToPublicKey33, secp256k1PublicKey33ToEthereumAddress, signSecp256k1Recoverable, signingSessionSealAuthorizeStatusCode, signingSessionSealStatusCode, tenantStorageRouteBackendFamily, tenantStorageRouteDiagnostic, validateOrdinaryInactiveSignerMaterialDeactivationRequestV1, validateOrdinaryInactiveSignerMaterialReservationRequestV1, validateRouterApiRorOptions, walletSessionAuthorizationV2RecordsEqual, walletSessionCapabilitySubjectsV1Equal };

package/dist/esm/localHostedWalletGatewayHandler.js

@@ -1,10 +1,11 @@
 import { requireCanonicalString } from "./shared-ts/src/utils/validation.js";
 import "./shared-ts/src/utils/routerAbEd25519Yao.js";
+import { D1RegistrationCeremonyRecordStore } from "./router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore.js";
+import { LocalRegistrationSetupAuthority } from "./localRegistrationSetupAuthority.js";
 import { WALLET_CONSOLE_OP_PATHS_V1 } from "./router/cloudflare/runtime/walletConsoleOps.js";
 import { WalletHomeCustodyBinding } from "./router/cloudflare/runtime/routerAbServiceBindings.js";
 import { createStaticWalletConsoleBindingV1, parseStaticWalletConsoleBindingConfigV1 } from "./router/cloudflare/runtime/staticWalletConsoleBinding.js";
 import { handleSplitGatewayRequest } from "./hosted-wallet-gateway.js";
-import { LocalRegistrationSetupAuthority } from "./localRegistrationSetupAuthority.js";
 import { localPresignCancellationProbe } from "./localIntendedPresignCancellation.js";
 import { LOCAL_INTENDED_YAO_FAULT_HEADER_V1, LOCAL_INTENDED_YAO_FAULT_TOKEN_HEADER_V1, LocalIntendedYaoFaultControllerV1, parseLocalIntendedYaoFaultModeV1, parseLocalIntendedYaoFaultTokenV1, requestWithoutLocalIntendedYaoFaultHeadersV1, responseWithLocalIntendedYaoFaultOutcomeV1 } from "./localIntendedYaoFault.js";
 import { localMaterialAdmissionFault } from "./localIntendedMaterialAdmissionFault.js";
@@ -101,7 +102,7 @@ async function handleEcdsaRespondFault(request, env, ctx, dependencies, fault, e
 /**
 * The local Gateway: the hosted Gateway handler plus the intended-suite
 * transport faults, which a request arms with local-only headers. The local
-* Worker and the local Node host both serve through this.
+* Worker serves through this handler.
 */
 async function handleLocalHostedWalletGatewayRequestV1(request, env, ctx, dependencies) {
 	const config = parseStaticWalletConsoleBindingConfigV1(JSON.parse(env.WALLET_LOCAL_DEPLOYMENT_JSON));
@@ -122,6 +123,11 @@ async function handleLocalHostedWalletGatewayRequestV1(request, env, ctx, depend
 		SIGNING_WORKER: new WalletHomeCustodyBinding(env.SIGNING_WORKER, "US", env.SIGNER_DB, tenantScope.namespace, null),
 		WALLET_CONSOLE: createStaticWalletConsoleBindingV1(config)
 	};
+	const faultStorage = new D1RegistrationCeremonyRecordStore({
+		database: env.SIGNER_DB,
+		scope: tenantScope,
+		keyPrefix: "local-intended:"
+	});
 	const canceledPresign = await localPresignCancellationProbe(request, gatewayEnv, ctx, dependencies);
 	if (canceledPresign) return canceledPresign;
 	const ecdsaFault = request.headers.get(ECDSA_RESPOND_FAULT_HEADER);
@@ -131,10 +137,10 @@ async function handleLocalHostedWalletGatewayRequestV1(request, env, ctx, depend
 	if (ecdsaFinalizeMode !== null || ecdsaFinalizeToken !== null) return await handleEcdsaFinalizeFault(request, gatewayEnv, ctx, dependencies, ecdsaFinalizeMode, ecdsaFinalizeToken);
 	const yaoRecoveryMode = request.headers.get(LOCAL_INTENDED_YAO_RECOVERY_FAULT_HEADER_V1);
 	const yaoRecoveryToken = request.headers.get(LOCAL_INTENDED_YAO_RECOVERY_FAULT_TOKEN_HEADER_V1);
-	if (yaoRecoveryMode !== null || yaoRecoveryToken !== null) return await handleYaoRecoveryFault(request, gatewayEnv, ctx, dependencies, yaoRecoveryMode, yaoRecoveryToken);
+	if (yaoRecoveryMode !== null || yaoRecoveryToken !== null) return await handleYaoRecoveryFault(request, gatewayEnv, ctx, dependencies, yaoRecoveryMode, yaoRecoveryToken, faultStorage);
 	const yaoSigningMode = request.headers.get(LOCAL_INTENDED_YAO_SIGNING_FAULT_HEADER_V1);
 	const yaoSigningToken = request.headers.get(LOCAL_INTENDED_YAO_SIGNING_FAULT_TOKEN_HEADER_V1);
-	if (yaoSigningMode !== null || yaoSigningToken !== null) return await handleYaoSigningFault(request, gatewayEnv, ctx, dependencies, yaoSigningMode, yaoSigningToken);
+	if (yaoSigningMode !== null || yaoSigningToken !== null) return await handleYaoSigningFault(request, gatewayEnv, ctx, dependencies, yaoSigningMode, yaoSigningToken, faultStorage);
 	const yaoExportMode = request.headers.get(LOCAL_INTENDED_YAO_EXPORT_FAULT_HEADER_V1);
 	const yaoExportToken = request.headers.get(LOCAL_INTENDED_YAO_EXPORT_FAULT_TOKEN_HEADER_V1);
 	if (yaoExportMode !== null || yaoExportToken !== null) return await handleYaoExportFault(request, gatewayEnv, ctx, dependencies, yaoExportMode, yaoExportToken);
@@ -167,7 +173,7 @@ async function handleLocalHostedWalletGatewayRequestV1(request, env, ctx, depend
 	const token = parseLocalIntendedYaoFaultTokenV1(rawToken);
 	const url = new URL(request.url);
 	if (url.protocol !== "http:" || url.hostname !== "127.0.0.1" || url.pathname !== "/router-ab/ed25519/yao/registration/execute" && url.pathname !== REGISTRATION_RESPOND_PATH || request.method !== "POST" || !mode || !token) return Response.json({ code: "invalid_intended_yao_fault" }, { status: 400 });
-	const controller = new LocalIntendedYaoFaultControllerV1(gatewayEnv.MPC_ROUTER.fetch.bind(gatewayEnv.MPC_ROUTER));
+	const controller = new LocalIntendedYaoFaultControllerV1(gatewayEnv.MPC_ROUTER.fetch.bind(gatewayEnv.MPC_ROUTER), ctx.waitUntil.bind(ctx));
 	controller.arm(mode);
 	return responseWithLocalIntendedYaoFaultOutcomeV1(await handleSplitGatewayRequest(sanitizedRequest, {
 		...gatewayEnv,
@@ -195,13 +201,13 @@ async function handleLinkExecuteFault(request, env, ctx, dependencies, rawMode,
 * every reply after the Router ran it, or keeps it from the Router, or sends
 * a kept one to the Router now. Local only.
 */
-async function handleYaoRecoveryFault(request, env, ctx, dependencies, rawMode, rawToken) {
+async function handleYaoRecoveryFault(request, env, ctx, dependencies, rawMode, rawToken, storage) {
 	const mode = parseLocalIntendedYaoRecoveryFaultModeV1(rawMode);
 	const token = parseLocalIntendedYaoRecoveryFaultTokenV1(rawToken);
 	const url = new URL(request.url);
 	if (url.protocol !== "http:" || url.hostname !== "127.0.0.1" || url.pathname !== "/router-ab/ed25519/yao/recovery/execute" || request.method !== "POST" || !mode || !token) return Response.json({ code: "invalid_intended_yao_recovery_fault" }, { status: 400 });
-	if (mode === "release_router_recovery_execute") return await releaseLocalIntendedYaoRecoveryExecuteV1(env.MPC_ROUTER, token);
-	const controller = new LocalIntendedYaoRecoveryFaultControllerV1(env.MPC_ROUTER.fetch.bind(env.MPC_ROUTER), mode, token);
+	if (mode === "release_router_recovery_execute") return await releaseLocalIntendedYaoRecoveryExecuteV1(env.MPC_ROUTER, token, storage);
+	const controller = new LocalIntendedYaoRecoveryFaultControllerV1(env.MPC_ROUTER.fetch.bind(env.MPC_ROUTER), mode, token, storage);
 	return responseWithLocalIntendedYaoRecoveryFaultOutcomeV1(await handleSplitGatewayRequest(requestWithoutLocalIntendedYaoRecoveryFaultHeadersV1(request), {
 		...env,
 		MPC_ROUTER: controller
@@ -260,13 +266,13 @@ async function handleYaoFinalizeFault(request, env, ctx, dependencies, rawMode,
 * run or withheld, or sends a kept one to the Router again: a request
 * authorized before a recovery, arriving after it. Local only.
 */
-async function handleYaoSigningFault(request, env, ctx, dependencies, rawMode, rawToken) {
+async function handleYaoSigningFault(request, env, ctx, dependencies, rawMode, rawToken, storage) {
 	const mode = parseLocalIntendedYaoSigningFaultModeV1(rawMode);
 	const token = parseLocalIntendedYaoSigningFaultTokenV1(rawToken);
 	const url = new URL(request.url);
 	if (url.protocol !== "http:" || url.hostname !== "127.0.0.1" || url.pathname !== "/router-ab/ed25519/sign" || request.method !== "POST" || !mode || !token) return Response.json({ code: "invalid_intended_yao_signing_fault" }, { status: 400 });
-	if (mode === "release_signing_finalize") return await releaseLocalIntendedYaoSigningFinalizeV1(env.MPC_ROUTER, token);
-	const controller = new LocalIntendedYaoSigningFaultControllerV1(env.MPC_ROUTER.fetch.bind(env.MPC_ROUTER), mode, token);
+	if (mode === "release_signing_finalize") return await releaseLocalIntendedYaoSigningFinalizeV1(env.MPC_ROUTER, token, storage);
+	const controller = new LocalIntendedYaoSigningFaultControllerV1(env.MPC_ROUTER.fetch.bind(env.MPC_ROUTER), mode, token, storage);
 	return responseWithLocalIntendedYaoSigningFaultOutcomeV1(await handleSplitGatewayRequest(requestWithoutLocalIntendedYaoSigningFaultHeadersV1(request), {
 		...env,
 		MPC_ROUTER: controller

package/dist/esm/localIntendedYaoFault.js

@@ -1,3 +1,4 @@
+import { assertString, requireArray, requireRecord } from "./shared-ts/src/utils/validation.js";
 import "./shared-ts/src/utils/routerAbTraceContext.js";
 //#region src/localIntendedYaoFault.ts
 const LOCAL_INTENDED_YAO_FAULT_HEADER_V1 = "x-seams-intended-yao-fault-v1";
@@ -15,7 +16,8 @@ function equalRequestBytes(left, right) {
 function parseLocalIntendedYaoFaultModeV1(value) {
 	switch (value) {
 		case "drop_router_response_once":
-		case "return_terminal_burned_once": return value;
+		case "return_terminal_burned_once":
+		case "answer_retryable_while_running_once": return value;
 		default: return null;
 	}
 }
@@ -26,9 +28,25 @@ function parseLocalIntendedYaoFaultTokenV1(value) {
 function isLocalIntendedYaoFaultTokenV1(value) {
 	return !!value && LOCAL_INTENDED_YAO_FAULT_TOKEN_PATTERN_V1.test(value);
 }
+/** Reconstructs a local fault request from its persisted boundary value. */
+function parseLocalIntendedKeptRouterRequestV1(value) {
+	const record = requireRecord(value, "Kept Router request");
+	const headers = new Headers();
+	for (const value of requireArray(record.headers, "Kept Router headers")) {
+		const pair = requireArray(value, "Kept Router header");
+		if (pair.length !== 2) throw new Error("Kept Router header must contain a name and value");
+		headers.append(assertString(pair[0], "header name"), assertString(pair[1], "header value"));
+	}
+	return new Request(assertString(record.url, "Kept Router URL"), {
+		method: "POST",
+		headers,
+		body: assertString(record.body, "Kept Router body")
+	});
+}
 var LocalIntendedYaoFaultControllerV1 = class {
-	constructor(baseFetch) {
+	constructor(baseFetch, keepRunning) {
 		this.baseFetch = baseFetch;
+		this.keepRunning = keepRunning;
 		this.state = { kind: "idle" };
 	}
 	arm(mode) {
@@ -82,6 +100,19 @@ var LocalIntendedYaoFaultControllerV1 = class {
 		}
 	}
 	async handleArmedExecute(request, mode) {
+		if (mode === "answer_retryable_while_running_once") {
+			const running = this.baseFetch.call(globalThis, request);
+			this.keepRunning(running.then((response) => response.arrayBuffer()));
+			this.state = {
+				kind: "proved",
+				proof: "execution_left_running"
+			};
+			return Response.json({
+				status: "recoverable_failure",
+				code: "conflicting_pair",
+				retry_after_ms: 100
+			});
+		}
 		if (mode === "return_terminal_burned_once") {
 			const headers = new Headers(request.headers);
 			headers.set(LOCAL_INTENDED_ROUTER_BURN_HEADER_V1, "burned");
@@ -171,6 +202,6 @@ function responseWithLocalIntendedYaoFaultOutcomeV1(response, outcome, token) {
 	});
 }
 //#endregion
-export { LOCAL_INTENDED_YAO_FAULT_HEADER_V1, LOCAL_INTENDED_YAO_FAULT_TOKEN_HEADER_V1, LocalIntendedYaoFaultControllerV1, isLocalIntendedYaoFaultTokenV1, parseLocalIntendedYaoFaultModeV1, parseLocalIntendedYaoFaultTokenV1, requestWithoutLocalIntendedYaoFaultHeadersV1, responseWithLocalIntendedYaoFaultOutcomeV1 };
+export { LOCAL_INTENDED_YAO_FAULT_HEADER_V1, LOCAL_INTENDED_YAO_FAULT_TOKEN_HEADER_V1, LocalIntendedYaoFaultControllerV1, isLocalIntendedYaoFaultTokenV1, parseLocalIntendedKeptRouterRequestV1, parseLocalIntendedYaoFaultModeV1, parseLocalIntendedYaoFaultTokenV1, requestWithoutLocalIntendedYaoFaultHeadersV1, responseWithLocalIntendedYaoFaultOutcomeV1 };
 
 //# sourceMappingURL=localIntendedYaoFault.js.map

package/dist/esm/localIntendedYaoRecoveryFault.js

@@ -1,10 +1,12 @@
-import { isLocalIntendedYaoFaultTokenV1 } from "./localIntendedYaoFault.js";
+import { isPlainObject } from "./shared-ts/src/utils/validation.js";
+import { isLocalIntendedYaoFaultTokenV1, parseLocalIntendedKeptRouterRequestV1 } from "./localIntendedYaoFault.js";
 //#region src/localIntendedYaoRecoveryFault.ts
 const LOCAL_INTENDED_YAO_RECOVERY_FAULT_HEADER_V1 = "x-seams-intended-yao-recovery-fault-v1";
 const LOCAL_INTENDED_YAO_RECOVERY_FAULT_TOKEN_HEADER_V1 = "x-seams-intended-yao-recovery-fault-token-v1";
 const LOCAL_INTENDED_YAO_FAULT_PROOF_HEADER_V1 = "x-seams-intended-yao-fault-proof-v1";
 const ROUTER_AB_YAO_EXECUTE_PATH_V1 = "/router-ab/router/ed25519-yao/execute";
-const keptRecoveryExecutes = /* @__PURE__ */ new Map();
+const KEPT_RECOVERY_SCOPE = "recovery-execute";
+const KEPT_RECOVERY_TTL_MS = 600 * 1e3;
 function parseLocalIntendedYaoRecoveryFaultModeV1(value) {
 	switch (value) {
 		case "lose_router_recovery_replies":
@@ -18,10 +20,11 @@ function parseLocalIntendedYaoRecoveryFaultTokenV1(value) {
 }
 /** The Gateway's Router binding, faulting every call to a recovery execution. */
 var LocalIntendedYaoRecoveryFaultControllerV1 = class {
-	constructor(baseFetch, mode, token) {
+	constructor(baseFetch, mode, token, storage) {
 		this.baseFetch = baseFetch;
 		this.mode = mode;
 		this.token = token;
+		this.storage = storage;
 		this.executed = false;
 		this.failed = false;
 		this.kept = false;
@@ -30,17 +33,22 @@ var LocalIntendedYaoRecoveryFaultControllerV1 = class {
 		const request = new Request(input, init);
 		if (request.method !== "POST" || new URL(request.url).pathname !== ROUTER_AB_YAO_EXECUTE_PATH_V1) return await this.baseFetch.call(globalThis, request);
 		if (this.mode === "withhold_router_recovery_execute") {
-			if (!keptRecoveryExecutes.has(this.token)) keptRecoveryExecutes.set(this.token, {
-				url: request.url,
-				headers: [...request.headers],
-				body: await request.clone().text()
+			await this.storage.insertOrRead({
+				scope: KEPT_RECOVERY_SCOPE,
+				id: this.token,
+				value: {
+					url: request.url,
+					headers: [...request.headers],
+					body: await request.clone().text()
+				},
+				expiresAtMs: Date.now() + KEPT_RECOVERY_TTL_MS
 			});
 			this.kept = true;
 			throw new Error("Local intended Yao recovery fault withheld the Router execution");
 		}
 		const response = await this.baseFetch.call(globalThis, request);
 		const answer = await response.clone().json().catch(() => null);
-		if (response.ok && typeof answer === "object" && answer !== null && answer.status === "succeeded") this.executed = true;
+		if (response.ok && isPlainObject(answer) && answer.status === "succeeded") this.executed = true;
 		else this.failed = true;
 		throw new Error("Local intended Yao recovery fault lost the Router reply");
 	}
@@ -67,15 +75,10 @@ var LocalIntendedYaoRecoveryFaultControllerV1 = class {
 	}
 };
 /** Sends the execution kept under `token` to the Router, exactly. */
-async function releaseLocalIntendedYaoRecoveryExecuteV1(router, token) {
-	const kept = keptRecoveryExecutes.get(token);
+async function releaseLocalIntendedYaoRecoveryExecuteV1(router, token, storage) {
+	const kept = await storage.take(KEPT_RECOVERY_SCOPE, token);
 	if (!kept) return Response.json({ code: "intended_recovery_execute_missing" }, { status: 404 });
-	keptRecoveryExecutes.delete(token);
-	const reply = await router.fetch(new Request(kept.url, {
-		method: "POST",
-		headers: kept.headers.map(([name, value]) => [name, value]),
-		body: kept.body
-	}));
+	const reply = await router.fetch(parseLocalIntendedKeptRouterRequestV1(kept));
 	return Response.json({
 		status: reply.status,
 		body: await reply.text()

package/dist/esm/localIntendedYaoSigningFault.js

@@ -1,10 +1,12 @@
-import { isLocalIntendedYaoFaultTokenV1 } from "./localIntendedYaoFault.js";
+import { assertString, requireRecord } from "./shared-ts/src/utils/validation.js";
+import { isLocalIntendedYaoFaultTokenV1, parseLocalIntendedKeptRouterRequestV1 } from "./localIntendedYaoFault.js";
 //#region src/localIntendedYaoSigningFault.ts
 const LOCAL_INTENDED_YAO_SIGNING_FAULT_HEADER_V1 = "x-seams-intended-yao-signing-fault-v1";
 const LOCAL_INTENDED_YAO_SIGNING_FAULT_TOKEN_HEADER_V1 = "x-seams-intended-yao-signing-fault-token-v1";
 const LOCAL_INTENDED_YAO_FAULT_PROOF_HEADER_V1 = "x-seams-intended-yao-fault-proof-v1";
 const ROUTER_AB_ED25519_SIGNING_FINALIZE_PATH_V1 = "/router-ab/ed25519/sign";
-const keptFinalizes = /* @__PURE__ */ new Map();
+const KEPT_FINALIZE_SCOPE = "signing-finalize";
+const KEPT_FINALIZE_TTL_MS = 600 * 1e3;
 function parseLocalIntendedYaoSigningFaultModeV1(value) {
 	switch (value) {
 		case "capture_signing_finalize":
@@ -18,10 +20,11 @@ function parseLocalIntendedYaoSigningFaultTokenV1(value) {
 }
 /** The Gateway's Router binding, keeping the first NEAR finalize it carries. */
 var LocalIntendedYaoSigningFaultControllerV1 = class {
-	constructor(baseFetch, mode, token) {
+	constructor(baseFetch, mode, token, storage) {
 		this.baseFetch = baseFetch;
 		this.mode = mode;
 		this.token = token;
+		this.storage = storage;
 		this.kept = false;
 	}
 	async fetch(input, init) {
@@ -33,7 +36,7 @@ var LocalIntendedYaoSigningFaultControllerV1 = class {
 			body: await request.clone().text()
 		};
 		if (this.mode === "withhold_signing_finalize") {
-			this.keep({
+			await this.keep({
 				request: kept,
 				original: null
 			});
@@ -44,7 +47,7 @@ var LocalIntendedYaoSigningFaultControllerV1 = class {
 			}, { status: 409 });
 		}
 		const response = await this.baseFetch.call(globalThis, request);
-		this.keep({
+		await this.keep({
 			request: kept,
 			original: {
 				status: response.status,
@@ -53,9 +56,14 @@ var LocalIntendedYaoSigningFaultControllerV1 = class {
 		});
 		return response;
 	}
-	keep(finalize) {
+	async keep(finalize) {
+		await this.storage.insertOrRead({
+			scope: KEPT_FINALIZE_SCOPE,
+			id: this.token,
+			value: finalize,
+			expiresAtMs: Date.now() + KEPT_FINALIZE_TTL_MS
+		});
 		this.kept = true;
-		if (!keptFinalizes.has(this.token)) keptFinalizes.set(this.token, finalize);
 	}
 	outcome() {
 		if (!this.kept) return `${this.token}:violated:signing_finalize_not_observed`;
@@ -63,21 +71,28 @@ var LocalIntendedYaoSigningFaultControllerV1 = class {
 	}
 };
 /** Sends the finalize kept under `token` to the Router again, exactly. */
-async function releaseLocalIntendedYaoSigningFinalizeV1(router, token) {
-	const kept = keptFinalizes.get(token);
+async function releaseLocalIntendedYaoSigningFinalizeV1(router, token, storage) {
+	const kept = await storage.take(KEPT_FINALIZE_SCOPE, token);
 	if (!kept) return Response.json({ code: "intended_signing_finalize_missing" }, { status: 404 });
-	keptFinalizes.delete(token);
-	const reply = await router.fetch(new Request(kept.request.url, {
-		method: "POST",
-		headers: kept.request.headers.map(([name, value]) => [name, value]),
-		body: kept.request.body
-	}));
+	const request = parseLocalIntendedKeptRouterRequestV1(kept.request);
+	const original = parseKeptOriginalReply(kept.original);
+	const reply = await router.fetch(request);
 	return Response.json({
 		status: reply.status,
 		body: await reply.text(),
-		original: kept.original
+		original
 	});
 }
+function parseKeptOriginalReply(value) {
+	if (value === null) return null;
+	const record = requireRecord(value, "Kept original reply");
+	const status = record.status;
+	if (typeof status !== "number" || !Number.isInteger(status) || status < 100 || status > 599) throw new Error("Kept original reply status is invalid");
+	return {
+		status,
+		body: assertString(record.body, "Kept original reply body")
+	};
+}
 function requestWithoutLocalIntendedYaoSigningFaultHeadersV1(request) {
 	const headers = new Headers(request.headers);
 	headers.delete(LOCAL_INTENDED_YAO_SIGNING_FAULT_HEADER_V1);

package/dist/esm/router/auth/routerApiKeyAuth.js

@@ -32,24 +32,12 @@ function extractRouterApiEnvironmentId(headers) {
 	if (fallback) return fallback;
 	return null;
 }
-function resolveSourceIpFromExpressRequest(input) {
-	const forwarded = readHeader(input.headers, "x-forwarded-for");
-	const realIp = readHeader(input.headers, "x-real-ip");
-	return normalizeSourceIp(forwarded || realIp || String(input.ip || ""));
-}
 function resolveSourceIpFromFetchHeaders(headers) {
 	const cfConnecting = readHeader(headers, "cf-connecting-ip");
 	const forwarded = readHeader(headers, "x-forwarded-for");
 	const realIp = readHeader(headers, "x-real-ip");
 	return normalizeSourceIp(cfConnecting || forwarded || realIp);
 }
-function resolveRequestOriginRateLimitKeyFromExpressRequest(input) {
-	const sourceIp = resolveSourceIpFromExpressRequest(input);
-	if (sourceIp) return `ip:${sourceIp}`;
-	const origin = readHeader(input.headers, "origin");
-	if (origin) return `origin:${origin}`;
-	return "origin:unknown-express";
-}
 function resolveRequestOriginRateLimitKeyFromFetchHeaders(headers) {
 	const sourceIp = resolveSourceIpFromFetchHeaders(headers);
 	if (sourceIp) return `ip:${sourceIp}`;
@@ -58,6 +46,6 @@ function resolveRequestOriginRateLimitKeyFromFetchHeaders(headers) {
 	return "origin:unknown-fetch";
 }
 //#endregion
-export { extractBearerCredential, extractRouterApiEnvironmentId, normalizeSourceIp, resolveRequestOriginRateLimitKeyFromExpressRequest, resolveRequestOriginRateLimitKeyFromFetchHeaders, resolveSourceIpFromExpressRequest, resolveSourceIpFromFetchHeaders };
+export { extractBearerCredential, extractRouterApiEnvironmentId, normalizeSourceIp, resolveRequestOriginRateLimitKeyFromFetchHeaders, resolveSourceIpFromFetchHeaders };
 
 //# sourceMappingURL=routerApiKeyAuth.js.map

package/dist/esm/router/cloudflare/d1/auth/d1RouterApiAuthService.js

@@ -6,12 +6,13 @@ import { D1WalletStore } from "../../../../core/d1WalletStore.js";
 import { D1WalletAuthMethodStore } from "../../../../core/d1WalletAuthMethodStore.js";
 import { normalizeLogger } from "../../../../core/logger.js";
 import { executeSignedDelegateWithRelayer } from "../../../../delegateAction/index.js";
+import { sha256BytesPortable, toRecordValue } from "./d1RouterApiAuthBoundary.js";
+import { parseD1EcdsaDerivationServerBootstrapResponse, parseD1WalletRegistrationCommittedInstallationProjection, parseD1WalletRegistrationFinalizeReplayResponse } from "../registration/d1RegistrationCeremonyRecords.js";
 import { parseWalletUnlockIssuanceRejectionCode } from "../../../framework/authServicePort.js";
 import { parseWebAuthnAuthenticationCredential } from "../../../auth/webAuthnCredentialCodecs.js";
 import { resolveActiveOwnerWalletExecutionLane, resolveWalletAuthMethodIdForAuthority } from "../../../../core/signingLanes/WalletExecutionLaneProjection.js";
 import { DEFAULT_WALLET_SESSION_TTL_MS } from "../../../../shared-ts/src/threshold/sessionPolicy.js";
 import { createDeviceLinkingOwnerRequestAuthenticatorV1 } from "../../../transport/fetch/routes/deviceLinkingOwnerAuthorization.js";
-import { sha256BytesPortable, toRecordValue } from "./d1RouterApiAuthBoundary.js";
 import { verifyD1LinkedDeviceFreshRevokeProofV1 } from "../wallet/d1WalletAuthMethodBoundary.js";
 import { D1LinkedDeviceAuthorityInstallServiceV1 } from "../deviceLinking/d1LinkedDeviceAuthorityInstallService.js";
 import { D1WalletAuthorityStore } from "../wallet/d1WalletAuthorityStore.js";
@@ -25,7 +26,6 @@ import { toPublicKeyStringFromSecretKey } from "../../../../core/nearKeys.js";
 import { MinimalNearClient } from "../../../../core/rpcClients/near/NearClient.js";
 import { fundImplicitNearAccountWithRelayer } from "../../../../core/nearRelayerAccountProvisioning.js";
 import { createSponsoredNamedNearAccountForOptions } from "../near/d1SponsoredNearAccount.js";
-import { parseD1EcdsaDerivationServerBootstrapResponse, parseD1WalletRegistrationCommittedInstallationProjection, parseD1WalletRegistrationFinalizeReplayResponse } from "../registration/d1RegistrationCeremonyRecords.js";
 import { parseD1WalletAddSignerFinalizeSideEffectRecord } from "../wallet/d1WalletAddSignerFinalizeRecord.js";
 import { dispatchWalletRegistrationSetup } from "../../../framework/registrationSetupDispatch.js";
 import { readActiveWalletSessionCredential, readEd25519WalletSessionSigningRead, readExhaustedWalletSessionCredential, readWalletSessionSigningCandidate } from "./walletSessionCredentialReaders.js";
@@ -53,8 +53,8 @@ import { D1WalletAuthMethodRevocationReplayStoreV1 } from "../wallet/d1WalletAut
 import { CloudflareD1WalletAuthMethodService } from "../wallet/d1WalletAuthMethodService.js";
 import { parseWalletRegistrationSessionCommitReceiptV2 } from "../registration/walletRegistrationSessionCommitReceipt.js";
 import { CloudflareD1WalletRegistrationService } from "../registration/d1WalletRegistrationService.js";
-import { D1WalletRegistrationRead } from "../registration/d1WalletRegistrationRead.js";
 import { CloudflareD1WalletRegistrationCommitStore } from "../registration/d1WalletRegistrationCommitStore.js";
+import { D1WalletRegistrationRead } from "../registration/d1WalletRegistrationRead.js";
 import { CloudflareD1Ed25519YaoLifecycleDecisionStoreV1 } from "../ed25519Yao/d1Ed25519YaoLifecycleDecisionStore.js";
 import { createD1PasskeyCustodyRouteService } from "../passkeyCustody/d1PasskeyCustodyRouteService.js";
 import { CloudflareD1WalletRecoveryGoogleEmailOtpAttemptStore } from "../passkeyCustody/d1WalletRecoveryGoogleEmailOtpAttemptStore.js";

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceOwnerAuthorizationProvider.js

@@ -11,9 +11,9 @@ import { buildEmailOtpWalletAuthAuthority, buildPasskeyWalletAuthAuthority, wall
 import { walletAuthorityDigestsMatchV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { buildWalletSessionLinkedDeviceOwnerAuthorizationV1, parseQrLinkedDeviceSessionPayloadV5 } from "../../../../shared-ts/src/device-linking/parsers.js";
 import { computeLinkedDevicePublicKeyDigestV1 } from "../../../../shared-ts/src/device-linking/requestProof.js";
+import { thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
 import { resolveActiveOwnerWalletExecutionLane, resolveWalletAuthMethodIdForAuthority } from "../../../../core/signingLanes/WalletExecutionLaneProjection.js";
 import "../../../../core/deviceLinking/requestProof.js";
-import { thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
 import { sourceKeyManifestDigestForFamilyV1 } from "../../../../core/deviceLinking/linkedDeviceSessionRecord.js";
 import { LinkedDeviceSourceFamilyUnavailableErrorV1 } from "./d1LinkedDeviceVerifiedLinkSourceReader.js";
 import { linkedDeviceSignerManifestsEqualV1 } from "./d1LinkedDeviceVerifiedLinkBuilder.js";

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRecords.js

@@ -3,8 +3,8 @@ import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
 import "../../../../shared-ts/src/utils/encoders.js";
 import { hasExactKeys } from "../../../../shared-ts/src/utils/exactKeys.js";
 import { failure } from "../../../../shared-ts/src/utils/failure.js";
-import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_UNLOCK_OPERATION, isWalletEmailOtpLoginOperation } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { isB64uString, nonNegativeSafeInteger, parseJsonObject, positiveSafeInteger } from "../auth/d1RouterApiAuthBoundary.js";
+import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_UNLOCK_OPERATION, isWalletEmailOtpLoginOperation } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { parseCurrentEmailOtpChallengeRow, parseCurrentEmailOtpGrantRow, parseCurrentEmailOtpUnlockChallengeRow, parseEmailOtpChallengePurpose } from "../../../../core/EmailOtpRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpRecords.ts
 function maskEmail(email) {

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRecoveryService.js

@@ -2,8 +2,8 @@ import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { failedVerification, failure } from "../../../../shared-ts/src/utils/failure.js";
 import { validateSecp256k1PublicKey33, verifySecp256k1RecoverableSignatureAgainstPublicKey33 } from "../../../../core/ThresholdService/evmCryptoWasm.js";
-import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { parseD1BoundaryWalletIdResult } from "../auth/d1RouterApiAuthBoundary.js";
+import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { bytesEqual, clampedEmailOtpUnlockTtlMs, decodeFixedBase64Url, emailOtpUnlockChallengeRecord } from "./d1EmailOtpRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpRecoveryService.ts
 function errorMessage(error) {

package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpSessionResolver.js

@@ -3,8 +3,8 @@ import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { createServerAllocatedWalletId } from "../../../../shared-ts/src/utils/registrationIds.js";
-import { hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
 import { parseD1BoundaryWalletId, parseD1BoundaryWalletIdResult } from "../auth/d1RouterApiAuthBoundary.js";
+import { hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
 import { abandonedGoogleEmailOtpRegistrationAttemptRecord, expiredGoogleEmailOtpRegistrationAttemptRecord, googleEmailOtpRegistrationOfferForResponse, requireRuntimePolicyScope } from "./d1GoogleEmailOtpRegistrationRecords.js";
 import { googleEmailOtpStaleIdentityMapping, hasDifferentWalletIdentitySubject } from "../identity/d1IdentityRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpSessionResolver.ts