@seams/wallet-server 0.10.2 → 0.11.0

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore.js

@@ -40,6 +40,25 @@ var D1RegistrationCeremonyRecordStore = class {
 	prepareGet(scope, id) {
 		return this.prepareRead(this.normalizeKey(scope, id));
 	}
+	/** Load the ceremony's immutable founding identities and their current records together. */
+	prepareFoundingRecordsRead(id) {
+		const key = this.normalizeKey("ceremony", id);
+		return this.database.prepare(`
+      SELECT json_extract(ceremony.record_json, '$.foundingWalletAuthorityId') AS authority_id,
+             json_extract(ceremony.record_json, '$.foundingWalletAuthMethodId') AS auth_method_id,
+             (SELECT record_json FROM wallet_authorities
+               WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+                 AND authority_id = json_extract(ceremony.record_json, '$.foundingWalletAuthorityId'))
+               AS authority_json,
+             (SELECT record_json FROM wallet_auth_methods
+               WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+                 AND wallet_auth_method_id = json_extract(ceremony.record_json, '$.foundingWalletAuthMethodId'))
+               AS auth_method_json
+        FROM registration_ceremony_records AS ceremony
+       WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+         AND record_scope = ?5 AND record_id = ?6
+    `).bind(...this.bindKey(key));
+	}
 	async parseGet(scope, id, row) {
 		if (!row) return null;
 		const parsed = parseStoredRow(row);

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyRecords.js

@@ -20,16 +20,16 @@ import { thresholdEcdsaChainTargetFromValue } from "../../../../core/thresholdEc
 import { buildWalletEcdsaSignerRecord, parseWalletEd25519SignerRecord } from "../../../../core/d1WalletStore.js";
 import { nearEd25519SigningKeyIdFromString, walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { registrationPreparationIdFromString } from "../../../../core/types.js";
-import "../../../../shared-ts/src/signing-lanes/index.js";
-import { parsePasskeyCustodyEnvelopeRecord } from "../../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
-import "../../../../shared-ts/src/passkey-custody/index.js";
 import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../../shared-ts/src/utils/near.js";
 import { findRegistrationSignerPlanNearEd25519Branch, normalizeAddSignerSelection, normalizeRegistrationSignerPlan, registrationSignerBranchKeyFromString, registrationSignerSetSelectionFromPlan } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
+import { parseStoredRegistrationSignerPlan, parseStoredWalletRegistrationPreparedContext, storedRegistrationSignerPlansMatch } from "../../../../core/RegistrationCeremonyStore.js";
+import "../../../../shared-ts/src/signing-lanes/index.js";
 import { addAuthMethodIntentGrantFromString, addSignerIntentGrantFromString, normalizeAddAuthMethodIntentCaller } from "../../../../shared-ts/src/utils/registrationIntent.js";
+import { parsePasskeyCustodyEnvelopeRecord } from "../../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
+import "../../../../shared-ts/src/passkey-custody/index.js";
 import { parseEcdsaDerivationPublicIdentity, parseThresholdEd25519AuthorityScope, thresholdEd25519AuthorityScopeFromWalletAuthAuthority, thresholdEd25519AuthorityScopesMatch } from "../../../../core/ThresholdService/validation.js";
-import { toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";
-import { parseStoredRegistrationSignerPlan, parseStoredWalletRegistrationPreparedContext, storedRegistrationSignerPlansMatch } from "../../../../core/RegistrationCeremonyStore.js";
 import { parseStoredRouterAbEcdsaPendingActivationV1 } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
+import { toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";
 //#region src/router/cloudflare/d1/registration/d1RegistrationCeremonyRecords.ts
 function inferRuntimePolicyScopeFromSigningRoot(input) {
 	const signingRootId = normalizeOptionalTrimmedString(input.signingRootId);

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyStore.js

@@ -1,9 +1,9 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
-import { prepareD1RegistrationHomeReservation } from "./d1WalletExecutionAuthority.js";
+import { D1RegistrationCeremonyRecordStore } from "./d1RegistrationCeremonyRecordStore.js";
 import { parseD1StoredAddAuthMethodIntent, parseD1StoredAddSignerIntent, parseD1StoredWalletAddAuthMethodCeremony, parseD1StoredWalletAddAuthMethodFinalizeReplay, parseD1StoredWalletAddSignerCeremony, parseD1StoredWalletAddSignerFinalizeReplay, parseD1StoredWalletRegistrationCeremony } from "./d1RegistrationCeremonyRecords.js";
+import { prepareD1RegistrationHomeReservation } from "./d1WalletExecutionAuthority.js";
 import { retryTransientD1 } from "../../../../storage/d1Retry.js";
-import { D1RegistrationCeremonyRecordStore } from "./d1RegistrationCeremonyRecordStore.js";
 //#region src/router/cloudflare/d1/registration/d1RegistrationCeremonyStore.ts
 var CloudflareD1RegistrationCeremonyIntentStore = class {
 	constructor(input) {
@@ -47,6 +47,9 @@ var CloudflareD1RegistrationCeremonyIntentStore = class {
 	prepareCeremonyRead(registrationCeremonyId) {
 		return this.storage.prepareGet("ceremony", registrationCeremonyId);
 	}
+	prepareFoundingRecordsRead(registrationCeremonyId) {
+		return this.storage.prepareFoundingRecordsRead(registrationCeremonyId);
+	}
 	async parseCeremonyRead(registrationCeremonyId, result) {
 		return (await this.parseCeremonySnapshotRead(registrationCeremonyId, result))?.ceremony ?? null;
 	}

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationSetupSupport.js

@@ -71,6 +71,12 @@ function registrationSignerBranchesFromPlan(plan) {
 function recordRegistrationServerTiming(sink, name, startedAtMs) {
 	sink.push([name, Math.max(0, Date.now() - startedAtMs)]);
 }
+/** The `Server-Timing` header of a registration route's recorded waits. */
+function registrationServerTimingHeaders(serverTiming) {
+	if (serverTiming.length === 0) return void 0;
+	const header = serverTiming.map(([name, durationMs]) => `${name};dur=${Math.max(0, durationMs).toFixed(1)}`).join(", ");
+	return { "Server-Timing": header };
+}
 async function recordRegistrationPromiseTiming(args) {
 	try {
 		return await args.promise;
@@ -79,6 +85,6 @@ async function recordRegistrationPromiseTiming(args) {
 	}
 }
 //#endregion
-export { createD1RegistrationRouteTimingRecorder, errorMessage, finishD1RegistrationRouteTiming, recordRegistrationPromiseTiming, recordRegistrationServerTiming, registrationIntentSignerBranches, registrationPreparedContextEcdsaChainTargets, registrationSignerBranchesFromPlan, resolveRegistrationPreparedContextFromPlan, startD1RegistrationRouteTiming };
+export { createD1RegistrationRouteTimingRecorder, errorMessage, finishD1RegistrationRouteTiming, recordRegistrationPromiseTiming, recordRegistrationServerTiming, registrationIntentSignerBranches, registrationPreparedContextEcdsaChainTargets, registrationServerTimingHeaders, registrationSignerBranchesFromPlan, resolveRegistrationPreparedContextFromPlan, startD1RegistrationRouteTiming };
 
 //# sourceMappingURL=d1RegistrationSetupSupport.js.map

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationCommitStore.js

@@ -1,4 +1,4 @@
-import { mpcMaterialActivationRefsEqual, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { mpcMaterialActivationRefsEqual, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { parseWalletAuthMethodRecordV2, sameWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
@@ -123,6 +123,30 @@ function canExtendFoundingAuthorityWithEd25519(existing, next) {
 	const nextEcdsa = next.signerActivations.ecdsa;
 	return existing.signerActivations.keyFamilies.length === 1 && existing.signerActivations.keyFamilies[0] === "ecdsa_secp256k1" && next.signerActivations.keyFamilies.length === 2 && next.signerActivations.keyFamilies[0] === "ed25519" && next.signerActivations.keyFamilies[1] === "ecdsa_secp256k1" && existingEcdsa !== void 0 && nextEcdsa !== void 0 && sameWalletEcdsaSignerActivationV1(existingEcdsa, nextEcdsa) && foundingAuthorityIdentityMatches(existing, next) && next.updatedAtMs >= existing.updatedAtMs;
 }
+function parseRegistrationFoundingRead(result) {
+	if (!result.success) throw new Error("Registration founding records read failed");
+	const row = result.results?.[0];
+	if (!row) return null;
+	const authorityId = parseWalletAuthorityId(row.authority_id);
+	const authMethodId = parseWalletAuthMethodId(row.auth_method_id);
+	if (!authorityId.ok || !authMethodId.ok) throw new Error("Registration founding identity is invalid");
+	return {
+		kind: "snapshot",
+		records: {
+			walletAuthorityId: authorityId.value,
+			walletAuthMethodId: authMethodId.value,
+			authorityRow: row.authority_json === null ? null : { record_json: row.authority_json },
+			authMethodRow: row.auth_method_json === null ? null : { record_json: row.auth_method_json }
+		}
+	};
+}
+function readFoundingRecords(database, scope, founding) {
+	if (founding === null) return Promise.resolve(null);
+	switch (founding.kind) {
+		case "read": return readStoredFoundingRecords(database, scope, founding.ids);
+		case "snapshot": return Promise.resolve(founding.records);
+	}
+}
 async function readStoredFoundingRecords(database, scope, ids) {
 	const authorityRead = database.prepare(`SELECT record_json
          FROM wallet_authorities
@@ -196,7 +220,8 @@ function prepareFoundingStatements(input) {
 	if (!authMethodRow) statements.push(prepareD1WalletAuthMethodV2PutStatement({
 		database: input.database,
 		scope: input.scope,
-		record: foundingAuthMethod
+		record: foundingAuthMethod,
+		insertOnly: true
 	}));
 	return statements;
 }
@@ -224,7 +249,7 @@ var CloudflareD1WalletRegistrationCommitStore = class {
 			walletId: authority.walletId,
 			rpId: authority.rpId,
 			credentialIdB64u: authority.credentialIdB64u
-		}) : void 0, founding ? readStoredFoundingRecords(this.database, this.scope, founding) : null]);
+		}) : void 0, readFoundingRecords(this.database, this.scope, founding)]);
 		return this.commit.bind(this, authority, stored);
 	}
 	async claimPasskeyAhead(input) {
@@ -336,6 +361,6 @@ function isEd25519Signer(signer) {
 	return signer.version === "wallet_signer_ed25519_v1";
 }
 //#endregion
-export { CloudflareD1WalletRegistrationCommitStore };
+export { CloudflareD1WalletRegistrationCommitStore, parseRegistrationFoundingRead };
 
 //# sourceMappingURL=d1WalletRegistrationCommitStore.js.map

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationRead.js

@@ -1,4 +1,5 @@
 import { parseRouterAbEd25519YaoRegistrationAdmissionReadV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore.js";
+import { parseRegistrationFoundingRead } from "./d1WalletRegistrationCommitStore.js";
 //#region src/router/cloudflare/d1/registration/d1WalletRegistrationRead.ts
 /** Read admission and immutable finalization state from one D1 snapshot. */
 var D1WalletRegistrationRead = class {
@@ -42,16 +43,18 @@ var D1WalletRegistrationRead = class {
 			ceremonies.prepareCeremonyRead(home.ceremonyId),
 			this.decisions.prepareRead(home.ceremonyId),
 			this.passkeyClaims.prepareHeldPasskeyClaimRead(home.ceremonyId),
-			this.yaoRecords.prepareRead(home.ceremonyId)
+			this.yaoRecords.prepareRead(home.ceremonyId),
+			ceremonies.prepareFoundingRecordsRead(home.ceremonyId)
 		]);
-		const [homeRead, operationRead, ceremonyRead, decisionRead, passkeyClaimRead, yaoRead] = results;
-		if (results.length !== 6 || !homeRead || !operationRead || !ceremonyRead || !decisionRead || !passkeyClaimRead || !yaoRead) throw new Error("Registration finalization D1 batch returned incomplete results");
+		const [homeRead, operationRead, ceremonyRead, decisionRead, passkeyClaimRead, yaoRead, foundingRead] = results;
+		if (results.length !== 7 || !homeRead || !operationRead || !ceremonyRead || !decisionRead || !passkeyClaimRead || !yaoRead || !foundingRead) throw new Error("Registration finalization D1 batch returned incomplete results");
 		const admission = await this.authority.admitHomeRead(home, homeRead);
 		if (!admission.ok) return admission;
 		if (!ceremonyRead.success) throw new Error("Registration ceremony D1 read failed");
 		return {
 			ok: true,
 			operation: this.operations.parseReadResult(operationRead),
+			readFounding: parseRegistrationFoundingRead.bind(void 0, foundingRead),
 			decision: this.decisions.parseRead(home.ceremonyId, decisionRead),
 			heldPasskeyClaim: this.passkeyClaims.parseHeldPasskeyClaimRead(passkeyClaimRead),
 			readCeremony: ceremonies.parseCeremonyRead.bind(ceremonies, home.ceremonyId, ceremonyRead),

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationService.js

@@ -20,34 +20,34 @@ import { buildActiveWalletAuthorityV1, buildWalletSignerActivationSetV1, compute
 import { ROUTER_AB_ED25519_NORMAL_SIGNING_STATE_KIND } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
 import { normalizeThresholdEd25519ParticipantIds } from "../../../../shared-ts/src/threshold/participants.js";
 import { nearEd25519SigningKeyIdFromString, registrationEd25519AuthorityScopeFromAuthority, walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
-import { walletCustodyCeremonyCommitPayloadFromWire } from "../../../../shared-ts/src/passkey-custody/ceremonyCommitPayload.js";
-import "../../../../shared-ts/src/passkey-custody/index.js";
+import { admitRegistrationReservationHome, cancelRegistrationHome } from "../../../domains/walletRegistration/walletRegistrationReservation.js";
 import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../../shared-ts/src/utils/near.js";
 import { registrationNearEd25519BranchKey } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
+import { buildStoredWalletRegistrationEvmFamilyEcdsaFinalizedBranch, buildStoredWalletRegistrationNearEd25519YaoAuthorizedBranch, findStoredWalletRegistrationEvmFamilyEcdsaBranch, findStoredWalletRegistrationNearEd25519YaoBranch, replaceStoredWalletRegistrationSignerBranch, storedRegistrationAuthoritiesMatch, verifiedRegistrationCeremonyAuthority } from "../../../../core/RegistrationCeremonyStore.js";
 import { registrationIntentGrantFromString } from "../../../../shared-ts/src/utils/registrationIntent.js";
+import { walletCustodyCeremonyCommitPayloadFromWire } from "../../../../shared-ts/src/passkey-custody/ceremonyCommitPayload.js";
+import "../../../../shared-ts/src/passkey-custody/index.js";
+import { parseEcdsaDerivationPublicIdentity, thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
 import { createRouterAbTraceContextV1 } from "../../../../shared-ts/src/utils/routerAbTraceContext.js";
+import { routerAbEcdsaStrictRegistrationRequestBindingJson } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
+import { buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, buildD1WalletRecord, parseWalletIdForIntent, thresholdEcdsaChainTargetsEqual } from "./d1RegistrationCeremonyRecords.js";
+import { createD1RegistrationRouteTimingRecorder, errorMessage, finishD1RegistrationRouteTiming, recordRegistrationPromiseTiming, recordRegistrationServerTiming, registrationSignerBranchesFromPlan, startD1RegistrationRouteTiming } from "./d1RegistrationSetupSupport.js";
 import { buildTenantRootIdentityFromAuthenticatedDeploymentV1 } from "../../../../shared-ts/src/tenant-root/tenantRootIdentity.js";
 import { DEFAULT_WALLET_SESSION_TTL_MS } from "../../../../shared-ts/src/threshold/sessionPolicy.js";
-import { parseEcdsaDerivationPublicIdentity, thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
 import { walletAuthAuthorityFromRegistrationAuthority, walletRegistrationFinalizeAuthMethodFromAuthority } from "../wallet/d1WalletAuthMethodBoundary.js";
 import { buildRouterAbEd25519YaoRegistrationCapabilityRecordV1 } from "../../../domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery.js";
 import { buildRouterAbEd25519YaoProductAdmissionRequestV1, projectRouterAbEd25519YaoExactWalletSession } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js";
 import { routerAbEd25519YaoRegistrationExecutionTimingEntriesV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationRequestScopedCloudflare.js";
 import { runRouterAbEd25519YaoRegistrationSideEffectV2, throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
 import { buildYaoEd25519WalletSignerRecord, ed25519NearPublicKeyFromBytes, implicitNearAccountIdFromEd25519PublicKeyBytes } from "../ed25519Yao/d1Ed25519YaoWalletSigner.js";
-import { buildStoredWalletRegistrationEvmFamilyEcdsaFinalizedBranch, buildStoredWalletRegistrationNearEd25519YaoAuthorizedBranch, findStoredWalletRegistrationEvmFamilyEcdsaBranch, findStoredWalletRegistrationNearEd25519YaoBranch, replaceStoredWalletRegistrationSignerBranch, storedRegistrationAuthoritiesMatch, verifiedRegistrationCeremonyAuthority } from "../../../../core/RegistrationCeremonyStore.js";
-import { routerAbEcdsaStrictRegistrationRequestBindingJson } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
-import { buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, buildD1WalletRecord, parseWalletIdForIntent, thresholdEcdsaChainTargetsEqual } from "./d1RegistrationCeremonyRecords.js";
 import { deriveThresholdEcdsaKeyHandle } from "../../../../shared-ts/src/utils/thresholdEcdsaKeyHandle.js";
 import { isTransientD1Error, retryTransientD1 } from "../../../../storage/d1Retry.js";
-import { admitRegistrationReservationHome, cancelRegistrationHome } from "../../../domains/walletRegistration/walletRegistrationReservation.js";
 import { listThresholdEcdsaKeyIdentityTargetsForUser } from "../../../../core/authService/thresholdEcdsaKeyInventory.js";
 import { routerAbEd25519YaoLifecycleDecisionLookupV1, routerAbEd25519YaoLifecycleDecisionV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoLifecycleDecision.js";
 import { reserveRegistrationCustody } from "../../../domains/passkeyCustody/registrationCustodyOutcome.js";
 import { resolveTenantRootIdentityV1 } from "../../../domains/tenantRoot/tenantRootIdentityResolution.js";
 import { walletRegistrationOperationPreparedFromCeremony } from "./d1WalletRegistrationPreparation.js";
 import { computeWalletRegistrationSetupDigestB64u, parseWalletRegistrationSetupClaims, verifySignedWalletRegistrationSetup, verifyWalletRegistrationSetupClaims } from "../../../domains/walletRegistration/walletRegistrationSetupPayload.js";
-import { createD1RegistrationRouteTimingRecorder, errorMessage, finishD1RegistrationRouteTiming, recordRegistrationPromiseTiming, recordRegistrationServerTiming, registrationSignerBranchesFromPlan, startD1RegistrationRouteTiming } from "./d1RegistrationSetupSupport.js";
 import { projectWalletRegistrationSessionCommitReceiptV2, registrationCommitActivation, registrationReplayAuthMethodFields, replayedRegistrationCommit, unissuedRegistrationCommit } from "./walletRegistrationSessionCommitReceipt.js";
 import { assertDirectWalletSessionOwnerProof, buildRegistrationOwnerProof, issueDirectRegistrationEstablishedEcdsaSession, issueDirectRegistrationEstablishedEd25519Session, projectCurrentNearRegistrationSession, replayDirectRegistrationEstablishedEcdsaSession, replayDirectRegistrationEstablishedEd25519Session, walletSessionPrincipalId } from "./walletRegistrationEstablishedSessionIssuer.js";
 import { commitWalletRegistration } from "./d1WalletRegistrationInitialSession.js";
@@ -2154,7 +2154,7 @@ var CloudflareD1WalletRegistrationService = class {
 		}, effectivePrepared, source, args.serverTiming, initialSessionPlan, args.lifecycleDecision, args.heldPasskeyClaim, {
 			kind: "snapshot",
 			authority: args.readYaoAdmission()
-		});
+		}, args.readFounding());
 		if (!execution.ok) return unissuedRegistrationCommit(throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1(execution));
 		const finalized = execution.finalized;
 		if (finalized.kind !== "near_ed25519") {
@@ -2357,22 +2357,29 @@ var CloudflareD1WalletRegistrationService = class {
 			};
 			const admissionStartedAtMs = Date.now();
 			const operationKey = `near-provisioning:${input.registrationCeremonyId}:${input.idempotencyKey}`;
-			const initial = await this.registrationRead.readFinalization({
-				ceremonyId: verified.claims.registrationCeremonyId,
-				walletId: walletIdFromString(verified.claims.walletId)
-			}, operationKey);
-			recordRegistrationServerTiming(serverTiming, "near_finalize_initial_read", admissionStartedAtMs);
+			const [initial, requestFingerprintBytes] = await Promise.all([recordRegistrationPromiseTiming({
+				sink: serverTiming,
+				name: "near_finalize_initial_read",
+				startedAtMs: admissionStartedAtMs,
+				promise: this.registrationRead.readFinalization({
+					ceremonyId: verified.claims.registrationCeremonyId,
+					walletId: walletIdFromString(verified.claims.walletId)
+				}, operationKey)
+			}), recordRegistrationPromiseTiming({
+				sink: serverTiming,
+				name: "near_finalize_fingerprint",
+				startedAtMs: Date.now(),
+				promise: sha256BytesUtf8(alphabetizeStringify({
+					version: "wallet_registration_near_provisioning_digest_v1",
+					registrationCeremonyId: input.registrationCeremonyId,
+					setupDigestB64u: verified.claims.setupDigestB64u,
+					idempotencyKey: input.idempotencyKey,
+					ed25519: input.ed25519,
+					emailOtpEnrollment: input.emailOtpEnrollment
+				}))
+			})]);
 			if (!initial.ok) return initial;
-			const fingerprintStartedAtMs = Date.now();
-			const requestFingerprint = base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
-				version: "wallet_registration_near_provisioning_digest_v1",
-				registrationCeremonyId: input.registrationCeremonyId,
-				setupDigestB64u: verified.claims.setupDigestB64u,
-				idempotencyKey: input.idempotencyKey,
-				ed25519: input.ed25519,
-				emailOtpEnrollment: input.emailOtpEnrollment
-			})));
-			recordRegistrationServerTiming(serverTiming, "near_finalize_fingerprint", fingerprintStartedAtMs);
+			const requestFingerprint = base64UrlEncode(requestFingerprintBytes);
 			const sideEffectStartedAtMs = Date.now();
 			let preparedCeremony = null;
 			const run = await runRouterAbEd25519YaoRegistrationSideEffectV2(this.registrationRead.operations, {
@@ -2403,7 +2410,8 @@ var CloudflareD1WalletRegistrationService = class {
 					preparedCeremony: () => preparedCeremony,
 					lifecycleDecision: initial.decision,
 					heldPasskeyClaim: initial.heldPasskeyClaim,
-					readYaoAdmission: initial.readYaoAdmission
+					readYaoAdmission: initial.readYaoAdmission,
+					readFounding: initial.readFounding
 				}),
 				projectReceipt: (execution) => projectWalletRegistrationSessionCommitReceiptV2({
 					operation: "near_provisioning",
@@ -2553,6 +2561,7 @@ var CloudflareD1WalletRegistrationService = class {
 		const ceremony = input.ceremony;
 		const stored = storedRespondEd25519DeferredWork(ceremony.signerState);
 		let authority;
+		const authorityStartedAtMs = Date.now();
 		if (stored) {
 			const replayAuthority = await this.verifyRespondReplayAuthority({
 				ceremony,
@@ -2586,6 +2595,7 @@ var CloudflareD1WalletRegistrationService = class {
 			};
 			authority = verified.authority;
 		}
+		recordRegistrationServerTiming(input.serverTiming, "respond_authority_verify", authorityStartedAtMs);
 		if (authority.walletId !== ceremony.intent.walletId) return {
 			ok: false,
 			code: "scope_mismatch",
@@ -2597,12 +2607,14 @@ var CloudflareD1WalletRegistrationService = class {
 			code: "not_configured",
 			message: "Ed25519 Yao registration is unavailable"
 		};
+		const requestStartedAtMs = Date.now();
 		const admissionRequest = stored ? stored.admissionRequest : await buildRespondEd25519AdmissionRequest({
 			ceremony,
 			branch: input.branch,
 			authority,
 			signingWorkerId: runtime.signingWorkerId
 		});
+		recordRegistrationServerTiming(input.serverTiming, "yao_admission_request", requestStartedAtMs);
 		const verifiedAuthority = authority;
 		const branchKey = input.branch.branchKey;
 		const ceremonyStore = this.getRegistrationCeremonyIntentStore();
@@ -2620,6 +2632,7 @@ var CloudflareD1WalletRegistrationService = class {
 				})]
 			}
 		});
+		const bindStartedAtMs = Date.now();
 		const admitted = await runtime.bindAndAdmitVerifiedRegistration({
 			kind: "verified_registration_intent",
 			ownershipGeneration: input.ownershipGeneration,
@@ -2631,6 +2644,7 @@ var CloudflareD1WalletRegistrationService = class {
 			expected: input.snapshot,
 			next: authorizedCeremony(bound)
 		}), input.startedDispatchRoot, requireRegistrationEd25519YaoMint(ceremony).sessionId);
+		recordRegistrationServerTiming(input.serverTiming, "yao_admission_bind", bindStartedAtMs);
 		if (!admitted.ok) return {
 			ok: false,
 			code: admitted.code,
@@ -2638,6 +2652,7 @@ var CloudflareD1WalletRegistrationService = class {
 		};
 		if (!stored && admitted.companionWrite === "not_committed") {
 			const next = authorizedCeremony(admitted.admissionRequest);
+			const commitStartedAtMs = Date.now();
 			try {
 				await ceremonyStore.commitEcdsaClaim({
 					expected: input.snapshot,
@@ -2647,6 +2662,7 @@ var CloudflareD1WalletRegistrationService = class {
 				const committed = await ceremonyStore.getCeremony(ceremony.registrationCeremonyId);
 				if (!committed || alphabetizeStringify(committed) !== alphabetizeStringify(next)) throw error;
 			}
+			recordRegistrationServerTiming(input.serverTiming, "respond_ceremony_commit", commitStartedAtMs);
 		}
 		if (!stored && input.waitUntil && verifiedAuthority.kind === "passkey") input.waitUntil(this.walletRegistrationCommitStore.claimPasskeyAhead({
 			registrationCeremonyId: ceremony.registrationCeremonyId,
@@ -2901,7 +2917,7 @@ var CloudflareD1WalletRegistrationService = class {
 		}, prepared, {
 			kind: "stored_ceremony",
 			ceremony: activatedCeremony
-		}, [], { kind: "separate" }, null, null, { kind: "stored" });
+		}, [], { kind: "separate" }, null, null, { kind: "stored" }, null);
 		if (!execution.ok) return unissuedRegistrationCommit(throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1(execution));
 		const commit = execution.finalized;
 		if (commit.kind !== "evm_family_ecdsa") {
@@ -3237,7 +3253,7 @@ var CloudflareD1WalletRegistrationService = class {
 			};
 		}
 	}
-	async executeWalletRegistrationFinalize(request, prepared, source, serverTiming, initialSessionPlan, lifecycleDecision, heldPasskeyClaim, yaoAdmission) {
+	async executeWalletRegistrationFinalize(request, prepared, source, serverTiming, initialSessionPlan, lifecycleDecision, heldPasskeyClaim, yaoAdmission, founding) {
 		const finalizeTiming = createD1RegistrationRouteTimingRecorder("wallets_register_finalize");
 		const totalTiming = startD1RegistrationRouteTiming("registerFinalizeTotalMs");
 		let startedCustody = null;
@@ -3476,7 +3492,10 @@ var CloudflareD1WalletRegistrationService = class {
 					sink: serverTiming,
 					name: "near_finalize_authority_reserve",
 					startedAtMs: Date.now(),
-					promise: this.walletRegistrationCommitStore.reserveAuthority(ceremonyAuthority, heldPasskeyClaim, prepared)
+					promise: this.walletRegistrationCommitStore.reserveAuthority(ceremonyAuthority, heldPasskeyClaim, founding ?? {
+						kind: "read",
+						ids: prepared
+					})
 				})]);
 				if (activationConsumption.status === "rejected") throw activationConsumption.reason;
 				if (authorityReservation.status === "rejected") throw authorityReservation.reason;
@@ -3605,7 +3624,10 @@ var CloudflareD1WalletRegistrationService = class {
 			} else {
 				custodyReservation = reserveCustody();
 				startedCustody = custodyReservation;
-				commitWallet = await this.walletRegistrationCommitStore.reserveAuthority(ceremonyAuthority, null, prepared);
+				commitWallet = await this.walletRegistrationCommitStore.reserveAuthority(ceremonyAuthority, null, {
+					kind: "read",
+					ids: prepared
+				});
 			}
 			if (yaoDecisionFound?.kind === "decided_otherwise") return {
 				ok: false,

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationSetupExecution.js

@@ -1,37 +1,53 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { deriveSigningRootId } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { registrationPreparationIdFromString } from "../../../../core/types.js";
-import { buildRouterAbEd25519YaoProductAdmissionRequestV1, mintRouterAbEd25519YaoRegistrationIdentityV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js";
 import { buildStoredWalletRegistrationEvmFamilyEcdsaPreparedBranch, findStoredWalletRegistrationEvmFamilyEcdsaBranch } from "../../../../core/RegistrationCeremonyStore.js";
 import { routerAbEcdsaStrictRegistrationFactsBindingJson } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
 import { buildRegistrationIntent, inferRuntimePolicyScopeFromSigningRoot } from "./d1RegistrationCeremonyRecords.js";
+import { errorMessage, recordRegistrationPromiseTiming, recordRegistrationServerTiming, registrationIntentSignerBranches, registrationPreparedContextEcdsaChainTargets, registrationSignerBranchesFromPlan, resolveRegistrationPreparedContextFromPlan } from "./d1RegistrationSetupSupport.js";
+import { buildRouterAbEd25519YaoProductAdmissionRequestV1, mintRouterAbEd25519YaoRegistrationIdentityV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js";
 import { isTransientD1Error } from "../../../../storage/d1Retry.js";
-import { errorMessage, registrationIntentSignerBranches, registrationPreparedContextEcdsaChainTargets, registrationSignerBranchesFromPlan, resolveRegistrationPreparedContextFromPlan } from "./d1RegistrationSetupSupport.js";
 import { buildWalletRegistrationSetupSignature, normalizeWalletRegistrationSetupRequest, walletRegistrationSetupError, walletRegistrationSetupExpiresAtMs, walletRegistrationSetupIntentDigest } from "./d1WalletRegistrationSetup.js";
 import { buildD1EvmFamilyEcdsaRegistrationPrepare } from "./d1EvmFamilyEcdsaRegistrationBranch.js";
 //#region src/router/cloudflare/d1/registration/d1WalletRegistrationSetupExecution.ts
 async function executeD1WalletRegistrationSetup(input, dependencies) {
+	const serverTiming = input.serverTiming ?? [];
 	try {
 		const normalized = normalizeWalletRegistrationSetupRequest(input.request);
 		if (!normalized.ok) return walletRegistrationSetupError(normalized.code, normalized.message);
 		if (!dependencies.reservation) return walletRegistrationSetupError("registration_authority_unavailable", "Registration reservation authority is required");
+		const reserveStartedAtMs = Date.now();
 		const admitted = await dependencies.reservation.reserve(input);
+		recordRegistrationServerTiming(serverTiming, "setup_reserve", reserveStartedAtMs);
 		if (!admitted.ok) return admitted;
 		const reservation = admitted.reservation;
 		const wallet = { walletId: reservation.walletId };
 		if (input.request.wallet?.kind === "provided" && input.request.wallet.walletId !== wallet.walletId) return walletRegistrationSetupError("reservation_conflict", "Registration reservation changed the requested wallet");
 		const expiresAtMs = walletRegistrationSetupExpiresAtMs(reservation.reservedAtMs);
 		if (Date.now() >= expiresAtMs) return walletRegistrationSetupError("registration_expired", "Registration setup has expired");
-		const [startup, setup] = await Promise.allSettled([dependencies.startRegistrationWallets?.({
-			kind: "objects",
-			walletId: wallet.walletId,
-			ownershipGeneration: admitted.ownershipGeneration
-		}), completeReservedRegistrationSetup(input, dependencies, admitted, normalized, expiresAtMs)]);
+		const parallelStartedAtMs = Date.now();
+		const [startup, setup] = await Promise.allSettled([recordRegistrationPromiseTiming({
+			sink: serverTiming,
+			name: "setup_wallet_objects",
+			startedAtMs: parallelStartedAtMs,
+			promise: dependencies.startRegistrationWallets?.({
+				kind: "objects",
+				walletId: wallet.walletId,
+				ownershipGeneration: admitted.ownershipGeneration
+			})
+		}), recordRegistrationPromiseTiming({
+			sink: serverTiming,
+			name: "setup_ceremony",
+			startedAtMs: parallelStartedAtMs,
+			promise: completeReservedRegistrationSetup(input, dependencies, admitted, normalized, expiresAtMs)
+		})]);
 		if (setup.status === "rejected") throw setup.reason;
 		if (!setup.value.ok) return setup.value;
 		if (startup.status === "rejected") throw startup.reason;
 		if (dependencies.startRegistrationWallets) try {
+			const pairStartedAtMs = Date.now();
 			const preparation = await describeCommittedSetupPair(setup.value, dependencies);
+			recordRegistrationServerTiming(serverTiming, "setup_pair_describe", pairStartedAtMs);
 			if (preparation.status === "described") await dependencies.startRegistrationWallets({
 				kind: "pair",
 				walletId: wallet.walletId,

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAddSignerFinalizeRecord.js

@@ -2,8 +2,8 @@ import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import "../../../../shared-ts/src/utils/encoders.js";
-import { parseRouterAbEd25519YaoRegistrationSideEffectRecordV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
 import { parseD1WalletAddSignerFinalizeTerminalResponse, parseWalletIdForIntent } from "../registration/d1RegistrationCeremonyRecords.js";
+import { parseRouterAbEd25519YaoRegistrationSideEffectRecordV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
 //#region src/router/cloudflare/d1/wallet/d1WalletAddSignerFinalizeRecord.ts
 function parseWalletAddSignerFinalizePrepared(raw) {
 	if (!isPlainObject(raw)) return null;

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAddSignerService.js

@@ -13,14 +13,14 @@ import { buildRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaRegis
 import { buildWalletEcdsaSignerActivationV1, extendEd25519WalletAuthorityWithEcdsa, isActiveEd25519WalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { registrationPreparationIdFromString } from "../../../../core/types.js";
 import { addSignerIntentGrantFromString, computeAddSignerIntentDigestB64u, sameAddSignerIntentV1 } from "../../../../shared-ts/src/utils/registrationIntent.js";
+import { routerAbEcdsaStrictRegistrationRequestMatchesFacts } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
+import { buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, normalizeThresholdEcdsaChainTargets, parseD1AddSignerIntent, parseD1RuntimePolicyScope, parseD1StoredAddSignerAuth, parseD1StoredAddSignerIntent, parseD1StoredWalletAddSignerCeremony, parseWalletIdForIntent, positiveIntegerArraysEqual, runtimePolicyScopeMatches, thresholdEcdsaChainTargetsEqual } from "../registration/d1RegistrationCeremonyRecords.js";
 import { buildTenantRootIdentityFromAuthenticatedDeploymentV1 } from "../../../../shared-ts/src/tenant-root/tenantRootIdentity.js";
 import { WalletAuthorityCommitConflictError } from "./d1WalletAuthorityStore.js";
 import { buildRouterAbEd25519YaoRegistrationCapabilityRecordV1 } from "../../../domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery.js";
 import { buildRouterAbEd25519YaoAddSignerAdmissionRequestV1, createRouterAbEd25519YaoMaterialActivationRefV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js";
 import { parseRouterAbEd25519YaoRegistrationSideEffectRecordV1, runRouterAbEd25519YaoRegistrationSideEffectV1, throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
 import { buildYaoEd25519WalletSignerRecord, ed25519NearPublicKeyFromBytes, implicitNearAccountIdFromEd25519PublicKeyBytes } from "../ed25519Yao/d1Ed25519YaoWalletSigner.js";
-import { routerAbEcdsaStrictRegistrationRequestMatchesFacts } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
-import { buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, normalizeThresholdEcdsaChainTargets, parseD1AddSignerIntent, parseD1RuntimePolicyScope, parseD1StoredAddSignerAuth, parseD1StoredAddSignerIntent, parseD1StoredWalletAddSignerCeremony, parseWalletIdForIntent, positiveIntegerArraysEqual, runtimePolicyScopeMatches, thresholdEcdsaChainTargetsEqual } from "../registration/d1RegistrationCeremonyRecords.js";
 import { buildD1WalletAddSignerFinalizePrepared, fingerprintD1WalletAddSignerFinalizePrepared, rejectUnexpectedWalletAddSignerFinalizePreparation, returnD1WalletAddSignerFinalizePrepared } from "./d1WalletAddSignerFinalizeRecord.js";
 import { routerAbEd25519YaoLifecycleDecisionLookupV1, routerAbEd25519YaoLifecycleDecisionV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoLifecycleDecision.js";
 import { buildD1EvmFamilyEcdsaRegistrationPrepare } from "../registration/d1EvmFamilyEcdsaRegistrationBranch.js";

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthMethodService.js

@@ -13,15 +13,15 @@ import { deriveWebAuthnAuthenticatorDeviceInfo } from "../../../../shared-ts/src
 import { parseSessionOrigin } from "../../../../authorization/domain.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { PASSKEY_PRF_FIRST_SALT_V1, PASSKEY_PRF_SECOND_SALT_V1 } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
+import { addAuthMethodIntentGrantFromString, computeAddAuthMethodIntentDigestB64u } from "../../../../shared-ts/src/utils/registrationIntent.js";
 import { parsePasskeyCustodyEnvelopeRecord } from "../../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
-import { addAuthMethodIntentGrantFromString, computeAddAuthMethodIntentDigestB64u } from "../../../../shared-ts/src/utils/registrationIntent.js";
+import { toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";
+import { parseWalletIdForIntent } from "../registration/d1RegistrationCeremonyRecords.js";
 import { parseWebAuthnClientDataJsonBase64url, webAuthnOriginHostnameOrEmpty } from "../../../auth/webAuthnCredentialCodecs.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { resolveWalletAuthMethodIdForAuthority } from "../../../../core/signingLanes/WalletExecutionLaneProjection.js";
-import { toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";
 import { d1HostIsWithinWebAuthnRpId, resolveD1AddAuthMethodExistingAuth, resolveD1AddSignerExistingAuth, verifyD1LinkedDeviceFreshRevokeProofV1, walletAuthAuthorityFromRegistrationAuthority } from "./d1WalletAuthMethodBoundary.js";
-import { parseWalletIdForIntent } from "../registration/d1RegistrationCeremonyRecords.js";
 import { runtimePolicyScopeKey } from "../../../../core/EmailOtpRecords.js";
 import { expiredGoogleEmailOtpRegistrationAttemptRecord } from "../emailOtp/d1GoogleEmailOtpRegistrationRecords.js";
 import { admitAddWalletAuthMethod } from "../../../../shared-ts/src/utils/addWalletAuthMethod.js";

package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnAuthService.js

@@ -4,8 +4,8 @@ import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimit
 import { WalletLifecycleLocator } from "../../../../authorization/lifecycleRouting.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { failedVerification, failure } from "../../../../shared-ts/src/utils/failure.js";
-import { decodeWebAuthnBase64UrlOrBase64, parseWebAuthnAuthenticationCredential, parseWebAuthnClientDataJsonBase64url, webAuthnCredentialIdB64uFromCredential, webAuthnOriginHostnameOrEmpty } from "../../../auth/webAuthnCredentialCodecs.js";
 import { nonNegativeSafeInteger, optionalNonNegativeInteger, parseD1BoundaryWalletId, parseD1BoundaryWalletIdResult, parseJsonObject } from "../auth/d1RouterApiAuthBoundary.js";
+import { decodeWebAuthnBase64UrlOrBase64, parseWebAuthnAuthenticationCredential, parseWebAuthnClientDataJsonBase64url, webAuthnCredentialIdB64uFromCredential, webAuthnOriginHostnameOrEmpty } from "../../../auth/webAuthnCredentialCodecs.js";
 import { parseWebAuthnAuthenticatorRowDeviceInfo, webAuthnSyncWalletBindingFromCredentialBinding } from "./d1WebAuthnRecords.js";
 import { d1HostIsWithinWebAuthnRpId } from "../wallet/d1WalletAuthMethodBoundary.js";
 import { webAuthnAuthenticationFailure, webAuthnLoginEd25519, webAuthnSyncCredentialBinding } from "../../../../core/authService/webauthnVerificationOutcomes.js";

package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnRecords.js

@@ -8,8 +8,8 @@ import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/
 import { parseWebAuthnAuthenticatorDeviceInfoJson } from "../../../../shared-ts/src/utils/webauthnDeviceInfo.js";
 import { hasExactKeys } from "../../../../shared-ts/src/utils/exactKeys.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
-import { parseRecoveryCodeReservationId } from "../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
 import { nonNegativeSafeInteger, optionalNonNegativeInteger, positiveInteger } from "../auth/d1RouterApiAuthBoundary.js";
+import { parseRecoveryCodeReservationId } from "../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
 //#region src/router/cloudflare/d1/webauthn/d1WebAuthnRecords.ts
 function parseWebAuthnAuthenticatorRowDeviceInfo(raw) {
 	return parseWebAuthnAuthenticatorDeviceInfoJson(raw);

package/dist/esm/router/cloudflare-adaptor.js

@@ -1,6 +1,6 @@
 import { ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, parseRouterAbPublicKeysetV2 } from "../shared-ts/src/utils/routerAbPublicKeyset.js";
 import { defineRoute, matchesRouteDefinitionRequest } from "./framework/routeDefinitions.js";
-import { extractBearerCredential, extractRouterApiEnvironmentId, resolveSourceIpFromExpressRequest, resolveSourceIpFromFetchHeaders } from "./auth/routerApiKeyAuth.js";
+import { extractBearerCredential, extractRouterApiEnvironmentId, resolveSourceIpFromFetchHeaders } from "./auth/routerApiKeyAuth.js";
 import { InMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createRouterAbNormalSigningAdmissionAdapter } from "./domains/signingOperations/routerAbNormalSigningAdmissionCore.js";
 import { CloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1RouterAbNormalSigningAdmissionStore } from "./cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.js";
 import { getRouterApiRouteExtensionRoutes } from "./framework/routeExtensions.js";
@@ -41,4 +41,4 @@ import { handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1 } from ".
 import { createRouterAbEd25519YaoProductRegistrationRequestScopedRuntimeV1 } from "./domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationRequestScopedRuntime.js";
 import { runRouterAbEd25519YaoRegistrationSideEffectV1 } from "./domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
 import { CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1, CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1, createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1, createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1 } from "./cloudflare/signingLanes/cloudflareOrdinaryInactiveSignerMaterialReservation.js";
-export { CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, CloudflareD1AuthorizationStore, CloudflareD1RouterAbNormalSigningAdmissionStore, CloudflareD1VaultProxyStore, CloudflareD1VersionedJsonRecordStore, CloudflareD1VersionedJsonRecordStoreError, CloudflareD1WebAuthnAuthService, CloudflareD1WebAuthnStore, CloudflareDurableObjectVersionedJsonRecordStore, CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1, CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1, CloudflareVersionedJsonRecordStoreError, DEFAULT_WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_V1, DEFAULT_WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_V1, InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter, InMemoryRouterAbEd25519YaoRegistrationService, InMemoryRouterAbNormalSigningAdmissionStore, ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1, ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, RouterAbEd25519YaoHttpRegistrationBackend, StaticCloudflareTenantStorageRouteResolver, UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, WALLET_CONSOLE_API_WALLET_DETAIL_PREFIX_V1, WALLET_CONSOLE_OPS_BASE_PATH_V1, WALLET_CONSOLE_OP_PATHS_V1, WALLET_CONSOLE_SERVICE_ORIGIN_V1, WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_ID_V1, WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_ID_V1, WALLET_CONTROL_AUTH_MARKER_V1, WALLET_CONTROL_BASE_PATH_V1, WALLET_CONTROL_SERVICE_ORIGIN_V1, WALLET_RUNTIME_OPS_BASE_PATH_V1, WALLET_RUNTIME_OP_PATHS_V1, WALLET_RUNTIME_SERVICE_ORIGIN_V1, buildRouterAbEd25519YaoProductAdmissionRequestV1, coerceRouterLogger, createCloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1VersionedJsonRecordStore, createCloudflareDurableObjectVersionedJsonRecordStore, createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1, createCloudflareRouter, createCloudflareTenantStorageRoute, createCloudflareWalletGatewayRouterV1, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterApiRuntimeSnapshotConsumer, createRouterAbEd25519YaoCeremonyStateStoreV1, createRouterAbEd25519YaoHttpRegistrationBackendFromEnv, createRouterAbEd25519YaoProductRegistrationCompositionFromPortsV1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, createRouterAbEd25519YaoProductRegistrationRequestScopedRuntimeV1, createRouterAbEd25519YaoProductRegistrationRuntimeV1, createRouterAbEd25519YaoProductRegistrationStateV1, createRouterAbEd25519YaoRegistrationModule, createRouterAbNormalSigningAdmissionAdapter, createRouterApiModule, createSelfHostedCloudflareSigningRouter, createSelfHostedCloudflareSigningWorker, createSignerD1DoStorageTarget, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, createStaticWalletConsoleBindingV1, createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1, createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, createWalletConsoleOpsClient, createWalletConsoleRelayProxyExtensionV1, createWalletControlClientBindings, createWalletRuntimeOpsHandler, decodeWalletConsoleTenantRootActiveLineageRequestV1, decodeWalletConsoleTenantRootActiveLineageResponseV1, defineRoute, encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1, encodeRouterAbEd25519YaoProductRegistrationStateV1, extractBearerCredential, extractRouterApiEnvironmentId, getRouterApiRouteExtensionRoutes, handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1, handleStaticWalletConsoleRequestV1, handleWalletControlRequest, matchesRouteDefinitionRequest, mergeRouterAbEd25519YaoProductRegistrationStatePartitionV1, parseRouterAbEd25519YaoCeremonyKeyV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoProductRegistrationStateJsonV1, parseRouterAbPublicKeysetV2, parseStaticWalletConsoleBindingConfigV1, parseWalletRegistrationContextResponse, parseWalletRuntimeExecuteSignedDelegateRequest, parseWalletRuntimeExecuteSignedDelegateResponse, parseWalletRuntimeExecuteSignedDelegateResult, parseWalletRuntimeRelayerAccount, parseWalletRuntimeWalletIdentitiesResult, parseWalletRuntimeWalletIdentityRequest, partitionRouterAbEd25519YaoProductRegistrationStateV1, randomTenantRootCreationGrantBytesV1, readEnvironmentCsv, readEnvironmentString, requireEnvironmentString, resolveRouterAbEd25519YaoCeremonyKeyFromRequestV1, resolveRuntimeTenantRootLineage, resolveSourceIpFromExpressRequest, resolveSourceIpFromFetchHeaders, runRouterAbEd25519YaoProductRegistrationRequestScopedV1, runRouterAbEd25519YaoRegistrationSideEffectV1, runRouterAbEd25519YaoRegistrationTwoPhaseV1, runRouterAbPrewarmScheduledV1, signTenantRootCreationGrantV1, tenantRootIdentityDigestB64uV1, validateRuntimeSnapshotExpectation, walletConsoleApiWalletGetRouteDefinitionV1, walletConsoleApiWalletListRouteDefinitionV1, walletConsoleApiWalletSearchRouteDefinitionV1, walletConsoleRelayRouteDefinitionsV1, walletConsoleSignedDelegateRouteDefinitionV1, walletConsoleSponsoredEvmCallRouteDefinitionV1 };
+export { CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, CloudflareD1AuthorizationStore, CloudflareD1RouterAbNormalSigningAdmissionStore, CloudflareD1VaultProxyStore, CloudflareD1VersionedJsonRecordStore, CloudflareD1VersionedJsonRecordStoreError, CloudflareD1WebAuthnAuthService, CloudflareD1WebAuthnStore, CloudflareDurableObjectVersionedJsonRecordStore, CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1, CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1, CloudflareVersionedJsonRecordStoreError, DEFAULT_WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_V1, DEFAULT_WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_V1, InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter, InMemoryRouterAbEd25519YaoRegistrationService, InMemoryRouterAbNormalSigningAdmissionStore, ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1, ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, RouterAbEd25519YaoHttpRegistrationBackend, StaticCloudflareTenantStorageRouteResolver, UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, WALLET_CONSOLE_API_WALLET_DETAIL_PREFIX_V1, WALLET_CONSOLE_OPS_BASE_PATH_V1, WALLET_CONSOLE_OP_PATHS_V1, WALLET_CONSOLE_SERVICE_ORIGIN_V1, WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_ID_V1, WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_ID_V1, WALLET_CONTROL_AUTH_MARKER_V1, WALLET_CONTROL_BASE_PATH_V1, WALLET_CONTROL_SERVICE_ORIGIN_V1, WALLET_RUNTIME_OPS_BASE_PATH_V1, WALLET_RUNTIME_OP_PATHS_V1, WALLET_RUNTIME_SERVICE_ORIGIN_V1, buildRouterAbEd25519YaoProductAdmissionRequestV1, coerceRouterLogger, createCloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1VersionedJsonRecordStore, createCloudflareDurableObjectVersionedJsonRecordStore, createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1, createCloudflareRouter, createCloudflareTenantStorageRoute, createCloudflareWalletGatewayRouterV1, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterApiRuntimeSnapshotConsumer, createRouterAbEd25519YaoCeremonyStateStoreV1, createRouterAbEd25519YaoHttpRegistrationBackendFromEnv, createRouterAbEd25519YaoProductRegistrationCompositionFromPortsV1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, createRouterAbEd25519YaoProductRegistrationRequestScopedRuntimeV1, createRouterAbEd25519YaoProductRegistrationRuntimeV1, createRouterAbEd25519YaoProductRegistrationStateV1, createRouterAbEd25519YaoRegistrationModule, createRouterAbNormalSigningAdmissionAdapter, createRouterApiModule, createSelfHostedCloudflareSigningRouter, createSelfHostedCloudflareSigningWorker, createSignerD1DoStorageTarget, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, createStaticWalletConsoleBindingV1, createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1, createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, createWalletConsoleOpsClient, createWalletConsoleRelayProxyExtensionV1, createWalletControlClientBindings, createWalletRuntimeOpsHandler, decodeWalletConsoleTenantRootActiveLineageRequestV1, decodeWalletConsoleTenantRootActiveLineageResponseV1, defineRoute, encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1, encodeRouterAbEd25519YaoProductRegistrationStateV1, extractBearerCredential, extractRouterApiEnvironmentId, getRouterApiRouteExtensionRoutes, handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1, handleStaticWalletConsoleRequestV1, handleWalletControlRequest, matchesRouteDefinitionRequest, mergeRouterAbEd25519YaoProductRegistrationStatePartitionV1, parseRouterAbEd25519YaoCeremonyKeyV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoProductRegistrationStateJsonV1, parseRouterAbPublicKeysetV2, parseStaticWalletConsoleBindingConfigV1, parseWalletRegistrationContextResponse, parseWalletRuntimeExecuteSignedDelegateRequest, parseWalletRuntimeExecuteSignedDelegateResponse, parseWalletRuntimeExecuteSignedDelegateResult, parseWalletRuntimeRelayerAccount, parseWalletRuntimeWalletIdentitiesResult, parseWalletRuntimeWalletIdentityRequest, partitionRouterAbEd25519YaoProductRegistrationStateV1, randomTenantRootCreationGrantBytesV1, readEnvironmentCsv, readEnvironmentString, requireEnvironmentString, resolveRouterAbEd25519YaoCeremonyKeyFromRequestV1, resolveRuntimeTenantRootLineage, resolveSourceIpFromFetchHeaders, runRouterAbEd25519YaoProductRegistrationRequestScopedV1, runRouterAbEd25519YaoRegistrationSideEffectV1, runRouterAbEd25519YaoRegistrationTwoPhaseV1, runRouterAbPrewarmScheduledV1, signTenantRootCreationGrantV1, tenantRootIdentityDigestB64uV1, validateRuntimeSnapshotExpectation, walletConsoleApiWalletGetRouteDefinitionV1, walletConsoleApiWalletListRouteDefinitionV1, walletConsoleApiWalletSearchRouteDefinitionV1, walletConsoleRelayRouteDefinitionsV1, walletConsoleSignedDelegateRouteDefinitionV1, walletConsoleSponsoredEvmCallRouteDefinitionV1 };