@seams/wallet-server 0.10.2 → 0.12.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (106) hide show
  1. package/THIRD_PARTY_NOTICES.md +33 -1812
  2. package/artifact-manifest.json +28 -28
  3. package/cloudflare-router-ab/build/deriver-a/build-stamp.json +1 -1
  4. package/cloudflare-router-ab/build/deriver-a/index.js +2 -2
  5. package/cloudflare-router-ab/build/deriver-a/index_bg.wasm +0 -0
  6. package/cloudflare-router-ab/build/deriver-b/build-stamp.json +1 -1
  7. package/cloudflare-router-ab/build/deriver-b/index.js +2 -2
  8. package/cloudflare-router-ab/build/deriver-b/index_bg.wasm +0 -0
  9. package/cloudflare-router-ab/build/local-tools/darwin-arm64/router_ab_local_init +0 -0
  10. package/cloudflare-router-ab/build/local-tools/darwin-x64/router_ab_local_init +0 -0
  11. package/cloudflare-router-ab/build/local-tools/linux-x64/router_ab_local_init +0 -0
  12. package/cloudflare-router-ab/build/router/build-stamp.json +1 -1
  13. package/cloudflare-router-ab/build/router/index.js +2 -2
  14. package/cloudflare-router-ab/build/router/index_bg.wasm +0 -0
  15. package/cloudflare-router-ab/build/signing-worker/build-stamp.json +1 -1
  16. package/cloudflare-router-ab/build/signing-worker/index.js +2 -2
  17. package/cloudflare-router-ab/build/signing-worker/index_bg.wasm +0 -0
  18. package/cloudflare-router-ab/build/tenant-root-control-plane/build-stamp.json +1 -1
  19. package/cloudflare-router-ab/build/tenant-root-control-plane/index.js +2 -2
  20. package/cloudflare-router-ab/build/tenant-root-control-plane/index_bg.wasm +0 -0
  21. package/cloudflare-router-ab/scripts/start-local-role-workers.mjs +3 -0
  22. package/cloudflare-router-ab/scripts/start-local-wallet-system.mjs +3 -0
  23. package/dist/esm/cloud-host.js +7 -7
  24. package/dist/esm/core/ThresholdService/kv.js +1 -218
  25. package/dist/esm/hosted-wallet-gateway.js +1 -1
  26. package/dist/esm/index.js +3 -4
  27. package/dist/esm/localHostedWalletGatewayHandler.js +17 -11
  28. package/dist/esm/localIntendedYaoFault.js +34 -3
  29. package/dist/esm/localIntendedYaoRecoveryFault.js +19 -16
  30. package/dist/esm/localIntendedYaoSigningFault.js +31 -16
  31. package/dist/esm/router/auth/routerApiKeyAuth.js +1 -13
  32. package/dist/esm/router/cloudflare/d1/auth/d1RouterApiAuthService.js +3 -3
  33. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceOwnerAuthorizationProvider.js +1 -1
  34. package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRecords.js +1 -1
  35. package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRecoveryService.js +1 -1
  36. package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpSessionResolver.js +1 -1
  37. package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore.js +19 -0
  38. package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyRecords.js +5 -5
  39. package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyStore.js +5 -2
  40. package/dist/esm/router/cloudflare/d1/registration/d1RegistrationSetupSupport.js +7 -1
  41. package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationCommitStore.js +29 -4
  42. package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationRead.js +6 -3
  43. package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationService.js +51 -29
  44. package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationSetupExecution.js +23 -7
  45. package/dist/esm/router/cloudflare/d1/wallet/d1WalletAddSignerFinalizeRecord.js +1 -1
  46. package/dist/esm/router/cloudflare/d1/wallet/d1WalletAddSignerService.js +2 -2
  47. package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthMethodService.js +3 -3
  48. package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnAuthService.js +1 -1
  49. package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnRecords.js +1 -1
  50. package/dist/esm/router/cloudflare-adaptor.js +2 -3
  51. package/dist/esm/router/cloudflare.js +2470 -2515
  52. package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js +1 -1
  53. package/dist/esm/router/domains/walletRegistration/walletRegistrationRoutes.js +39 -32
  54. package/dist/esm/router/framework/registrationSetupDispatch.js +11 -3
  55. package/dist/esm/router/framework/routeResponses.js +1 -5
  56. package/dist/esm/router/transport/fetch/routes/deviceLinkingOwnerAuthorization.js +1 -1
  57. package/dist/esm/router/transport/fetch/routes/passkeyCustody.js +2 -2
  58. package/dist/esm/router/transport/fetch/routes/thresholdEd25519.js +51 -24
  59. package/dist/esm/shared-ts/src/utils/validation.js +5 -1
  60. package/dist/esm/threshold/session/signingSessionSeal/guards/backends.js +2 -98
  61. package/dist/esm/threshold/session/signingSessionSeal/idempotencyBackends.js +2 -69
  62. package/dist/esm/threshold/session/signingSessionSeal/index.js +3 -4
  63. package/dist/esm/wasm/evm_crypto/pkg/evm_crypto_bg.wasm +0 -0
  64. package/dist/esm/wasm/near_signer/pkg/wasm_signer_worker_bg.wasm +0 -0
  65. package/dist/esm/wasm/shamir3pass_runtime/pkg/shamir3pass_runtime_bg.wasm +0 -0
  66. package/dist/types/wallet-server/src/cloud-host.d.ts +1 -0
  67. package/dist/types/wallet-server/src/core/ThresholdService/kv.d.ts +0 -29
  68. package/dist/types/wallet-server/src/localHostedWalletGatewayHandler.d.ts +1 -1
  69. package/dist/types/wallet-server/src/localIntendedYaoFault.d.ts +13 -3
  70. package/dist/types/wallet-server/src/localIntendedYaoRecoveryFault.d.ts +4 -2
  71. package/dist/types/wallet-server/src/localIntendedYaoSigningFault.d.ts +4 -2
  72. package/dist/types/wallet-server/src/router/auth/routerApiKeyAuth.d.ts +0 -8
  73. package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore.d.ts +2 -0
  74. package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationCeremonyStore.d.ts +1 -0
  75. package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationSetupSupport.d.ts +2 -0
  76. package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationCommitStore.d.ts +25 -5
  77. package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationRead.d.ts +15 -0
  78. package/dist/types/wallet-server/src/router/cloudflare-adaptor.d.ts +1 -3
  79. package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationInputs.d.ts +2 -0
  80. package/dist/types/wallet-server/src/router/framework/routeResponses.d.ts +0 -2
  81. package/dist/types/wallet-server/src/threshold/session/signingSessionSeal/guards/backends.d.ts +1 -16
  82. package/dist/types/wallet-server/src/threshold/session/signingSessionSeal/idempotencyBackends.d.ts +1 -16
  83. package/dist/types/wallet-server/src/threshold/session/signingSessionSeal/index.d.ts +5 -6
  84. package/package.json +2 -9
  85. package/src/README.md +5 -3
  86. package/dist/esm/router/cloudflare/runtime/createSelfHostedCloudflareSigningWorker.js +0 -93
  87. package/dist/esm/router/express-adaptor.js +0 -84
  88. package/dist/esm/router/express.js +0 -26400
  89. package/dist/esm/router/node/nodeHostedWalletGateway.js +0 -64
  90. package/dist/esm/router/node/nodeHostedWalletGatewayCheck.js +0 -163
  91. package/dist/esm/router/node/nodeHostedWalletGatewayMain.js +0 -120
  92. package/dist/esm/router/node/nodeHttp.js +0 -79
  93. package/dist/esm/router/node/nodeSqlite.js +0 -43
  94. package/dist/esm/router/node/signerSqlMigrations.js +0 -48
  95. package/dist/esm/storage/syncSqlite.js +0 -79
  96. package/dist/esm/threshold/session/signingSessionSeal/transport/express.js +0 -75
  97. package/dist/types/wallet-server/src/router/cloudflare/runtime/createSelfHostedCloudflareSigningWorker.d.ts +0 -23
  98. package/dist/types/wallet-server/src/router/express-adaptor.d.ts +0 -22
  99. package/dist/types/wallet-server/src/router/node/nodeHostedWalletGateway.d.ts +0 -34
  100. package/dist/types/wallet-server/src/router/node/nodeHostedWalletGatewayCheck.d.ts +0 -21
  101. package/dist/types/wallet-server/src/router/node/nodeHostedWalletGatewayMain.d.ts +0 -2
  102. package/dist/types/wallet-server/src/router/node/nodeHttp.d.ts +0 -13
  103. package/dist/types/wallet-server/src/router/node/nodeSqlite.d.ts +0 -22
  104. package/dist/types/wallet-server/src/router/node/signerSqlMigrations.d.ts +0 -20
  105. package/dist/types/wallet-server/src/storage/syncSqlite.d.ts +0 -28
  106. package/dist/types/wallet-server/src/threshold/session/signingSessionSeal/transport/express.d.ts +0 -12
@@ -1,37 +1,53 @@
1
1
  import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
2
2
  import { deriveSigningRootId } from "../../../../shared-ts/src/threshold/signingRootScope.js";
3
3
  import { registrationPreparationIdFromString } from "../../../../core/types.js";
4
- import { buildRouterAbEd25519YaoProductAdmissionRequestV1, mintRouterAbEd25519YaoRegistrationIdentityV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js";
5
4
  import { buildStoredWalletRegistrationEvmFamilyEcdsaPreparedBranch, findStoredWalletRegistrationEvmFamilyEcdsaBranch } from "../../../../core/RegistrationCeremonyStore.js";
6
5
  import { routerAbEcdsaStrictRegistrationFactsBindingJson } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
7
6
  import { buildRegistrationIntent, inferRuntimePolicyScopeFromSigningRoot } from "./d1RegistrationCeremonyRecords.js";
7
+ import { errorMessage, recordRegistrationPromiseTiming, recordRegistrationServerTiming, registrationIntentSignerBranches, registrationPreparedContextEcdsaChainTargets, registrationSignerBranchesFromPlan, resolveRegistrationPreparedContextFromPlan } from "./d1RegistrationSetupSupport.js";
8
+ import { buildRouterAbEd25519YaoProductAdmissionRequestV1, mintRouterAbEd25519YaoRegistrationIdentityV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js";
8
9
  import { isTransientD1Error } from "../../../../storage/d1Retry.js";
9
- import { errorMessage, registrationIntentSignerBranches, registrationPreparedContextEcdsaChainTargets, registrationSignerBranchesFromPlan, resolveRegistrationPreparedContextFromPlan } from "./d1RegistrationSetupSupport.js";
10
10
  import { buildWalletRegistrationSetupSignature, normalizeWalletRegistrationSetupRequest, walletRegistrationSetupError, walletRegistrationSetupExpiresAtMs, walletRegistrationSetupIntentDigest } from "./d1WalletRegistrationSetup.js";
11
11
  import { buildD1EvmFamilyEcdsaRegistrationPrepare } from "./d1EvmFamilyEcdsaRegistrationBranch.js";
12
12
  //#region src/router/cloudflare/d1/registration/d1WalletRegistrationSetupExecution.ts
13
13
  async function executeD1WalletRegistrationSetup(input, dependencies) {
14
+ const serverTiming = input.serverTiming ?? [];
14
15
  try {
15
16
  const normalized = normalizeWalletRegistrationSetupRequest(input.request);
16
17
  if (!normalized.ok) return walletRegistrationSetupError(normalized.code, normalized.message);
17
18
  if (!dependencies.reservation) return walletRegistrationSetupError("registration_authority_unavailable", "Registration reservation authority is required");
19
+ const reserveStartedAtMs = Date.now();
18
20
  const admitted = await dependencies.reservation.reserve(input);
21
+ recordRegistrationServerTiming(serverTiming, "setup_reserve", reserveStartedAtMs);
19
22
  if (!admitted.ok) return admitted;
20
23
  const reservation = admitted.reservation;
21
24
  const wallet = { walletId: reservation.walletId };
22
25
  if (input.request.wallet?.kind === "provided" && input.request.wallet.walletId !== wallet.walletId) return walletRegistrationSetupError("reservation_conflict", "Registration reservation changed the requested wallet");
23
26
  const expiresAtMs = walletRegistrationSetupExpiresAtMs(reservation.reservedAtMs);
24
27
  if (Date.now() >= expiresAtMs) return walletRegistrationSetupError("registration_expired", "Registration setup has expired");
25
- const [startup, setup] = await Promise.allSettled([dependencies.startRegistrationWallets?.({
26
- kind: "objects",
27
- walletId: wallet.walletId,
28
- ownershipGeneration: admitted.ownershipGeneration
29
- }), completeReservedRegistrationSetup(input, dependencies, admitted, normalized, expiresAtMs)]);
28
+ const parallelStartedAtMs = Date.now();
29
+ const [startup, setup] = await Promise.allSettled([recordRegistrationPromiseTiming({
30
+ sink: serverTiming,
31
+ name: "setup_wallet_objects",
32
+ startedAtMs: parallelStartedAtMs,
33
+ promise: dependencies.startRegistrationWallets?.({
34
+ kind: "objects",
35
+ walletId: wallet.walletId,
36
+ ownershipGeneration: admitted.ownershipGeneration
37
+ })
38
+ }), recordRegistrationPromiseTiming({
39
+ sink: serverTiming,
40
+ name: "setup_ceremony",
41
+ startedAtMs: parallelStartedAtMs,
42
+ promise: completeReservedRegistrationSetup(input, dependencies, admitted, normalized, expiresAtMs)
43
+ })]);
30
44
  if (setup.status === "rejected") throw setup.reason;
31
45
  if (!setup.value.ok) return setup.value;
32
46
  if (startup.status === "rejected") throw startup.reason;
33
47
  if (dependencies.startRegistrationWallets) try {
48
+ const pairStartedAtMs = Date.now();
34
49
  const preparation = await describeCommittedSetupPair(setup.value, dependencies);
50
+ recordRegistrationServerTiming(serverTiming, "setup_pair_describe", pairStartedAtMs);
35
51
  if (preparation.status === "described") await dependencies.startRegistrationWallets({
36
52
  kind: "pair",
37
53
  walletId: wallet.walletId,
@@ -2,8 +2,8 @@ import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
2
2
  import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
3
3
  import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
4
4
  import "../../../../shared-ts/src/utils/encoders.js";
5
- import { parseRouterAbEd25519YaoRegistrationSideEffectRecordV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
6
5
  import { parseD1WalletAddSignerFinalizeTerminalResponse, parseWalletIdForIntent } from "../registration/d1RegistrationCeremonyRecords.js";
6
+ import { parseRouterAbEd25519YaoRegistrationSideEffectRecordV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
7
7
  //#region src/router/cloudflare/d1/wallet/d1WalletAddSignerFinalizeRecord.ts
8
8
  function parseWalletAddSignerFinalizePrepared(raw) {
9
9
  if (!isPlainObject(raw)) return null;
@@ -13,14 +13,14 @@ import { buildRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaRegis
13
13
  import { buildWalletEcdsaSignerActivationV1, extendEd25519WalletAuthorityWithEcdsa, isActiveEd25519WalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
14
14
  import { registrationPreparationIdFromString } from "../../../../core/types.js";
15
15
  import { addSignerIntentGrantFromString, computeAddSignerIntentDigestB64u, sameAddSignerIntentV1 } from "../../../../shared-ts/src/utils/registrationIntent.js";
16
+ import { routerAbEcdsaStrictRegistrationRequestMatchesFacts } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
17
+ import { buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, normalizeThresholdEcdsaChainTargets, parseD1AddSignerIntent, parseD1RuntimePolicyScope, parseD1StoredAddSignerAuth, parseD1StoredAddSignerIntent, parseD1StoredWalletAddSignerCeremony, parseWalletIdForIntent, positiveIntegerArraysEqual, runtimePolicyScopeMatches, thresholdEcdsaChainTargetsEqual } from "../registration/d1RegistrationCeremonyRecords.js";
16
18
  import { buildTenantRootIdentityFromAuthenticatedDeploymentV1 } from "../../../../shared-ts/src/tenant-root/tenantRootIdentity.js";
17
19
  import { WalletAuthorityCommitConflictError } from "./d1WalletAuthorityStore.js";
18
20
  import { buildRouterAbEd25519YaoRegistrationCapabilityRecordV1 } from "../../../domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery.js";
19
21
  import { buildRouterAbEd25519YaoAddSignerAdmissionRequestV1, createRouterAbEd25519YaoMaterialActivationRefV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js";
20
22
  import { parseRouterAbEd25519YaoRegistrationSideEffectRecordV1, runRouterAbEd25519YaoRegistrationSideEffectV1, throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
21
23
  import { buildYaoEd25519WalletSignerRecord, ed25519NearPublicKeyFromBytes, implicitNearAccountIdFromEd25519PublicKeyBytes } from "../ed25519Yao/d1Ed25519YaoWalletSigner.js";
22
- import { routerAbEcdsaStrictRegistrationRequestMatchesFacts } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
23
- import { buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, normalizeThresholdEcdsaChainTargets, parseD1AddSignerIntent, parseD1RuntimePolicyScope, parseD1StoredAddSignerAuth, parseD1StoredAddSignerIntent, parseD1StoredWalletAddSignerCeremony, parseWalletIdForIntent, positiveIntegerArraysEqual, runtimePolicyScopeMatches, thresholdEcdsaChainTargetsEqual } from "../registration/d1RegistrationCeremonyRecords.js";
24
24
  import { buildD1WalletAddSignerFinalizePrepared, fingerprintD1WalletAddSignerFinalizePrepared, rejectUnexpectedWalletAddSignerFinalizePreparation, returnD1WalletAddSignerFinalizePrepared } from "./d1WalletAddSignerFinalizeRecord.js";
25
25
  import { routerAbEd25519YaoLifecycleDecisionLookupV1, routerAbEd25519YaoLifecycleDecisionV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoLifecycleDecision.js";
26
26
  import { buildD1EvmFamilyEcdsaRegistrationPrepare } from "../registration/d1EvmFamilyEcdsaRegistrationBranch.js";
@@ -13,15 +13,15 @@ import { deriveWebAuthnAuthenticatorDeviceInfo } from "../../../../shared-ts/src
13
13
  import { parseSessionOrigin } from "../../../../authorization/domain.js";
14
14
  import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
15
15
  import { PASSKEY_PRF_FIRST_SALT_V1, PASSKEY_PRF_SECOND_SALT_V1 } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
16
+ import { addAuthMethodIntentGrantFromString, computeAddAuthMethodIntentDigestB64u } from "../../../../shared-ts/src/utils/registrationIntent.js";
16
17
  import { parsePasskeyCustodyEnvelopeRecord } from "../../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
17
18
  import "../../../../shared-ts/src/passkey-custody/index.js";
18
- import { addAuthMethodIntentGrantFromString, computeAddAuthMethodIntentDigestB64u } from "../../../../shared-ts/src/utils/registrationIntent.js";
19
+ import { toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";
20
+ import { parseWalletIdForIntent } from "../registration/d1RegistrationCeremonyRecords.js";
19
21
  import { parseWebAuthnClientDataJsonBase64url, webAuthnOriginHostnameOrEmpty } from "../../../auth/webAuthnCredentialCodecs.js";
20
22
  import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
21
23
  import { resolveWalletAuthMethodIdForAuthority } from "../../../../core/signingLanes/WalletExecutionLaneProjection.js";
22
- import { toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";
23
24
  import { d1HostIsWithinWebAuthnRpId, resolveD1AddAuthMethodExistingAuth, resolveD1AddSignerExistingAuth, verifyD1LinkedDeviceFreshRevokeProofV1, walletAuthAuthorityFromRegistrationAuthority } from "./d1WalletAuthMethodBoundary.js";
24
- import { parseWalletIdForIntent } from "../registration/d1RegistrationCeremonyRecords.js";
25
25
  import { runtimePolicyScopeKey } from "../../../../core/EmailOtpRecords.js";
26
26
  import { expiredGoogleEmailOtpRegistrationAttemptRecord } from "../emailOtp/d1GoogleEmailOtpRegistrationRecords.js";
27
27
  import { admitAddWalletAuthMethod } from "../../../../shared-ts/src/utils/addWalletAuthMethod.js";
@@ -4,8 +4,8 @@ import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimit
4
4
  import { WalletLifecycleLocator } from "../../../../authorization/lifecycleRouting.js";
5
5
  import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
6
6
  import { failedVerification, failure } from "../../../../shared-ts/src/utils/failure.js";
7
- import { decodeWebAuthnBase64UrlOrBase64, parseWebAuthnAuthenticationCredential, parseWebAuthnClientDataJsonBase64url, webAuthnCredentialIdB64uFromCredential, webAuthnOriginHostnameOrEmpty } from "../../../auth/webAuthnCredentialCodecs.js";
8
7
  import { nonNegativeSafeInteger, optionalNonNegativeInteger, parseD1BoundaryWalletId, parseD1BoundaryWalletIdResult, parseJsonObject } from "../auth/d1RouterApiAuthBoundary.js";
8
+ import { decodeWebAuthnBase64UrlOrBase64, parseWebAuthnAuthenticationCredential, parseWebAuthnClientDataJsonBase64url, webAuthnCredentialIdB64uFromCredential, webAuthnOriginHostnameOrEmpty } from "../../../auth/webAuthnCredentialCodecs.js";
9
9
  import { parseWebAuthnAuthenticatorRowDeviceInfo, webAuthnSyncWalletBindingFromCredentialBinding } from "./d1WebAuthnRecords.js";
10
10
  import { d1HostIsWithinWebAuthnRpId } from "../wallet/d1WalletAuthMethodBoundary.js";
11
11
  import { webAuthnAuthenticationFailure, webAuthnLoginEd25519, webAuthnSyncCredentialBinding } from "../../../../core/authService/webauthnVerificationOutcomes.js";
@@ -8,8 +8,8 @@ import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/
8
8
  import { parseWebAuthnAuthenticatorDeviceInfoJson } from "../../../../shared-ts/src/utils/webauthnDeviceInfo.js";
9
9
  import { hasExactKeys } from "../../../../shared-ts/src/utils/exactKeys.js";
10
10
  import "../../../../shared-ts/src/passkey-custody/index.js";
11
- import { parseRecoveryCodeReservationId } from "../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
12
11
  import { nonNegativeSafeInteger, optionalNonNegativeInteger, positiveInteger } from "../auth/d1RouterApiAuthBoundary.js";
12
+ import { parseRecoveryCodeReservationId } from "../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
13
13
  //#region src/router/cloudflare/d1/webauthn/d1WebAuthnRecords.ts
14
14
  function parseWebAuthnAuthenticatorRowDeviceInfo(raw) {
15
15
  return parseWebAuthnAuthenticatorDeviceInfoJson(raw);
@@ -1,6 +1,6 @@
1
1
  import { ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, parseRouterAbPublicKeysetV2 } from "../shared-ts/src/utils/routerAbPublicKeyset.js";
2
2
  import { defineRoute, matchesRouteDefinitionRequest } from "./framework/routeDefinitions.js";
3
- import { extractBearerCredential, extractRouterApiEnvironmentId, resolveSourceIpFromExpressRequest, resolveSourceIpFromFetchHeaders } from "./auth/routerApiKeyAuth.js";
3
+ import { extractBearerCredential, extractRouterApiEnvironmentId, resolveSourceIpFromFetchHeaders } from "./auth/routerApiKeyAuth.js";
4
4
  import { InMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createRouterAbNormalSigningAdmissionAdapter } from "./domains/signingOperations/routerAbNormalSigningAdmissionCore.js";
5
5
  import { CloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1RouterAbNormalSigningAdmissionStore } from "./cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.js";
6
6
  import { getRouterApiRouteExtensionRoutes } from "./framework/routeExtensions.js";
@@ -28,7 +28,6 @@ import { buildRouterAbEd25519YaoProductAdmissionRequestV1, createRouterAbEd25519
28
28
  import { RouterAbEd25519YaoHttpRegistrationBackend, createRouterAbEd25519YaoHttpRegistrationBackendFromEnv } from "./domains/ed25519Yao/registration/routerAbEd25519YaoHttpRegistrationBackend.js";
29
29
  import { StaticCloudflareTenantStorageRouteResolver, createCloudflareTenantStorageRoute, createSignerD1DoStorageTarget, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings } from "../storage/tenantRoute.js";
30
30
  import { createInMemoryRouterApiRuntimeSnapshotConsumer, validateRuntimeSnapshotExpectation } from "./framework/runtimeSnapshotConsumer.js";
31
- import { createSelfHostedCloudflareSigningRouter, createSelfHostedCloudflareSigningWorker } from "./cloudflare/runtime/createSelfHostedCloudflareSigningWorker.js";
32
31
  import { CloudflareDurableObjectVersionedJsonRecordStore, CloudflareVersionedJsonRecordStoreError, createCloudflareDurableObjectVersionedJsonRecordStore } from "./cloudflare/durableObjects/versionedJsonRecordStore.js";
33
32
  import { CloudflareD1VersionedJsonRecordStore, CloudflareD1VersionedJsonRecordStoreError, createCloudflareD1VersionedJsonRecordStore } from "./cloudflare/d1/versionedJson/d1VersionedJsonRecordStore.js";
34
33
  import { createRouterAbEd25519YaoCeremonyStateStoreV1, encodeRouterAbEd25519YaoProductRegistrationStateV1, parseRouterAbEd25519YaoCeremonyKeyV1, parseRouterAbEd25519YaoProductRegistrationStateJsonV1, resolveRouterAbEd25519YaoCeremonyKeyFromRequestV1 } from "./domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPersistence.js";
@@ -41,4 +40,4 @@ import { handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1 } from ".
41
40
  import { createRouterAbEd25519YaoProductRegistrationRequestScopedRuntimeV1 } from "./domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationRequestScopedRuntime.js";
42
41
  import { runRouterAbEd25519YaoRegistrationSideEffectV1 } from "./domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
43
42
  import { CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1, CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1, createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1, createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1 } from "./cloudflare/signingLanes/cloudflareOrdinaryInactiveSignerMaterialReservation.js";
44
- export { CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, CloudflareD1AuthorizationStore, CloudflareD1RouterAbNormalSigningAdmissionStore, CloudflareD1VaultProxyStore, CloudflareD1VersionedJsonRecordStore, CloudflareD1VersionedJsonRecordStoreError, CloudflareD1WebAuthnAuthService, CloudflareD1WebAuthnStore, CloudflareDurableObjectVersionedJsonRecordStore, CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1, CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1, CloudflareVersionedJsonRecordStoreError, DEFAULT_WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_V1, DEFAULT_WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_V1, InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter, InMemoryRouterAbEd25519YaoRegistrationService, InMemoryRouterAbNormalSigningAdmissionStore, ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1, ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, RouterAbEd25519YaoHttpRegistrationBackend, StaticCloudflareTenantStorageRouteResolver, UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, WALLET_CONSOLE_API_WALLET_DETAIL_PREFIX_V1, WALLET_CONSOLE_OPS_BASE_PATH_V1, WALLET_CONSOLE_OP_PATHS_V1, WALLET_CONSOLE_SERVICE_ORIGIN_V1, WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_ID_V1, WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_ID_V1, WALLET_CONTROL_AUTH_MARKER_V1, WALLET_CONTROL_BASE_PATH_V1, WALLET_CONTROL_SERVICE_ORIGIN_V1, WALLET_RUNTIME_OPS_BASE_PATH_V1, WALLET_RUNTIME_OP_PATHS_V1, WALLET_RUNTIME_SERVICE_ORIGIN_V1, buildRouterAbEd25519YaoProductAdmissionRequestV1, coerceRouterLogger, createCloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1VersionedJsonRecordStore, createCloudflareDurableObjectVersionedJsonRecordStore, createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1, createCloudflareRouter, createCloudflareTenantStorageRoute, createCloudflareWalletGatewayRouterV1, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterApiRuntimeSnapshotConsumer, createRouterAbEd25519YaoCeremonyStateStoreV1, createRouterAbEd25519YaoHttpRegistrationBackendFromEnv, createRouterAbEd25519YaoProductRegistrationCompositionFromPortsV1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, createRouterAbEd25519YaoProductRegistrationRequestScopedRuntimeV1, createRouterAbEd25519YaoProductRegistrationRuntimeV1, createRouterAbEd25519YaoProductRegistrationStateV1, createRouterAbEd25519YaoRegistrationModule, createRouterAbNormalSigningAdmissionAdapter, createRouterApiModule, createSelfHostedCloudflareSigningRouter, createSelfHostedCloudflareSigningWorker, createSignerD1DoStorageTarget, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, createStaticWalletConsoleBindingV1, createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1, createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, createWalletConsoleOpsClient, createWalletConsoleRelayProxyExtensionV1, createWalletControlClientBindings, createWalletRuntimeOpsHandler, decodeWalletConsoleTenantRootActiveLineageRequestV1, decodeWalletConsoleTenantRootActiveLineageResponseV1, defineRoute, encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1, encodeRouterAbEd25519YaoProductRegistrationStateV1, extractBearerCredential, extractRouterApiEnvironmentId, getRouterApiRouteExtensionRoutes, handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1, handleStaticWalletConsoleRequestV1, handleWalletControlRequest, matchesRouteDefinitionRequest, mergeRouterAbEd25519YaoProductRegistrationStatePartitionV1, parseRouterAbEd25519YaoCeremonyKeyV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoProductRegistrationStateJsonV1, parseRouterAbPublicKeysetV2, parseStaticWalletConsoleBindingConfigV1, parseWalletRegistrationContextResponse, parseWalletRuntimeExecuteSignedDelegateRequest, parseWalletRuntimeExecuteSignedDelegateResponse, parseWalletRuntimeExecuteSignedDelegateResult, parseWalletRuntimeRelayerAccount, parseWalletRuntimeWalletIdentitiesResult, parseWalletRuntimeWalletIdentityRequest, partitionRouterAbEd25519YaoProductRegistrationStateV1, randomTenantRootCreationGrantBytesV1, readEnvironmentCsv, readEnvironmentString, requireEnvironmentString, resolveRouterAbEd25519YaoCeremonyKeyFromRequestV1, resolveRuntimeTenantRootLineage, resolveSourceIpFromExpressRequest, resolveSourceIpFromFetchHeaders, runRouterAbEd25519YaoProductRegistrationRequestScopedV1, runRouterAbEd25519YaoRegistrationSideEffectV1, runRouterAbEd25519YaoRegistrationTwoPhaseV1, runRouterAbPrewarmScheduledV1, signTenantRootCreationGrantV1, tenantRootIdentityDigestB64uV1, validateRuntimeSnapshotExpectation, walletConsoleApiWalletGetRouteDefinitionV1, walletConsoleApiWalletListRouteDefinitionV1, walletConsoleApiWalletSearchRouteDefinitionV1, walletConsoleRelayRouteDefinitionsV1, walletConsoleSignedDelegateRouteDefinitionV1, walletConsoleSponsoredEvmCallRouteDefinitionV1 };
43
+ export { CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, CloudflareD1AuthorizationStore, CloudflareD1RouterAbNormalSigningAdmissionStore, CloudflareD1VaultProxyStore, CloudflareD1VersionedJsonRecordStore, CloudflareD1VersionedJsonRecordStoreError, CloudflareD1WebAuthnAuthService, CloudflareD1WebAuthnStore, CloudflareDurableObjectVersionedJsonRecordStore, CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1, CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1, CloudflareVersionedJsonRecordStoreError, DEFAULT_WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_V1, DEFAULT_WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_V1, InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter, InMemoryRouterAbEd25519YaoRegistrationService, InMemoryRouterAbNormalSigningAdmissionStore, ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1, ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, RouterAbEd25519YaoHttpRegistrationBackend, StaticCloudflareTenantStorageRouteResolver, UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, WALLET_CONSOLE_API_WALLET_DETAIL_PREFIX_V1, WALLET_CONSOLE_OPS_BASE_PATH_V1, WALLET_CONSOLE_OP_PATHS_V1, WALLET_CONSOLE_SERVICE_ORIGIN_V1, WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_ID_V1, WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_ID_V1, WALLET_CONTROL_AUTH_MARKER_V1, WALLET_CONTROL_BASE_PATH_V1, WALLET_CONTROL_SERVICE_ORIGIN_V1, WALLET_RUNTIME_OPS_BASE_PATH_V1, WALLET_RUNTIME_OP_PATHS_V1, WALLET_RUNTIME_SERVICE_ORIGIN_V1, buildRouterAbEd25519YaoProductAdmissionRequestV1, coerceRouterLogger, createCloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1VersionedJsonRecordStore, createCloudflareDurableObjectVersionedJsonRecordStore, createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1, createCloudflareRouter, createCloudflareTenantStorageRoute, createCloudflareWalletGatewayRouterV1, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterApiRuntimeSnapshotConsumer, createRouterAbEd25519YaoCeremonyStateStoreV1, createRouterAbEd25519YaoHttpRegistrationBackendFromEnv, createRouterAbEd25519YaoProductRegistrationCompositionFromPortsV1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, createRouterAbEd25519YaoProductRegistrationRequestScopedRuntimeV1, createRouterAbEd25519YaoProductRegistrationRuntimeV1, createRouterAbEd25519YaoProductRegistrationStateV1, createRouterAbEd25519YaoRegistrationModule, createRouterAbNormalSigningAdmissionAdapter, createRouterApiModule, createSignerD1DoStorageTarget, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, createStaticWalletConsoleBindingV1, createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1, createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, createWalletConsoleOpsClient, createWalletConsoleRelayProxyExtensionV1, createWalletControlClientBindings, createWalletRuntimeOpsHandler, decodeWalletConsoleTenantRootActiveLineageRequestV1, decodeWalletConsoleTenantRootActiveLineageResponseV1, defineRoute, encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1, encodeRouterAbEd25519YaoProductRegistrationStateV1, extractBearerCredential, extractRouterApiEnvironmentId, getRouterApiRouteExtensionRoutes, handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1, handleStaticWalletConsoleRequestV1, handleWalletControlRequest, matchesRouteDefinitionRequest, mergeRouterAbEd25519YaoProductRegistrationStatePartitionV1, parseRouterAbEd25519YaoCeremonyKeyV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoProductRegistrationStateJsonV1, parseRouterAbPublicKeysetV2, parseStaticWalletConsoleBindingConfigV1, parseWalletRegistrationContextResponse, parseWalletRuntimeExecuteSignedDelegateRequest, parseWalletRuntimeExecuteSignedDelegateResponse, parseWalletRuntimeExecuteSignedDelegateResult, parseWalletRuntimeRelayerAccount, parseWalletRuntimeWalletIdentitiesResult, parseWalletRuntimeWalletIdentityRequest, partitionRouterAbEd25519YaoProductRegistrationStateV1, randomTenantRootCreationGrantBytesV1, readEnvironmentCsv, readEnvironmentString, requireEnvironmentString, resolveRouterAbEd25519YaoCeremonyKeyFromRequestV1, resolveRuntimeTenantRootLineage, resolveSourceIpFromFetchHeaders, runRouterAbEd25519YaoProductRegistrationRequestScopedV1, runRouterAbEd25519YaoRegistrationSideEffectV1, runRouterAbEd25519YaoRegistrationTwoPhaseV1, runRouterAbPrewarmScheduledV1, signTenantRootCreationGrantV1, tenantRootIdentityDigestB64uV1, validateRuntimeSnapshotExpectation, walletConsoleApiWalletGetRouteDefinitionV1, walletConsoleApiWalletListRouteDefinitionV1, walletConsoleApiWalletSearchRouteDefinitionV1, walletConsoleRelayRouteDefinitionsV1, walletConsoleSignedDelegateRouteDefinitionV1, walletConsoleSponsoredEvmCallRouteDefinitionV1 };