@seams/wallet-server 0.15.6 → 0.17.0

package/dist/esm/router/cloudflare.js

@@ -182,10 +182,8 @@ function parseRouterAbPublicKeysetV2(value) {
 //#endregion
 //#region src/router/domains/signingOperations/routerAbNormalSigningAdmissionCore.ts
 var InMemoryRouterAbNormalSigningAdmissionStore = class {
-	constructor() {
-		this.projectPolicies = /* @__PURE__ */ new Map();
-		this.abuseDecisions = /* @__PURE__ */ new Map();
-	}
+	projectPolicies = /* @__PURE__ */ new Map();
+	abuseDecisions = /* @__PURE__ */ new Map();
 	setProjectPolicy(scope, decision) {
 		this.projectPolicies.set(runtimePolicyScopeKey(scope), decision);
 	}
@@ -324,6 +322,13 @@ var MpcMaterialActivationReference = class {
 	retainProof() {
 		return true;
 	}
+	kind;
+	activationId;
+	capability;
+	materialOwner;
+	keyBinding;
+	lifecycleBinding;
+	signingWorker;
 	constructor(fields) {
 		this.retainProof();
 		this.kind = "mpc_material_activation_ref";
@@ -1255,9 +1260,9 @@ const DELEGATED_WALLET_PERMISSION_VALUE_SET = new Set([
 ]);
 const canonicalPermissionSetBrand = Symbol("canonicalPermissionSetBrand");
 var CanonicalDelegatedWalletPermissionSetProof = class CanonicalDelegatedWalletPermissionSetProof extends Array {
+	[canonicalPermissionSetBrand] = true;
 	constructor(permissions) {
 		super(...permissions);
-		this[canonicalPermissionSetBrand] = true;
 		Object.freeze(this);
 	}
 	static create(permissions) {
@@ -3588,7 +3593,8 @@ function parseExportBinding(value) {
 		authorization_digest: requireBytes32$1(record.authorization_digest, "export binding.authorization_digest", true)
 	};
 }
-function requireActivationBinding(binding) {
+function parseRouterAbEd25519YaoActivationBindingV1(value) {
+	const binding = parseCeremonyBinding(value);
 	switch (binding.operation) {
 		case "registration":
 			if (binding.lifecycle.work_kind !== REGISTRATION_WORK_KIND || binding.lifecycle.primitive_request_kind !== REGISTRATION_PRIMITIVE_REQUEST_KIND) throw new Error("activation binding has the wrong registration lifecycle kind");
@@ -3923,7 +3929,7 @@ function parseExportResultValue(value) {
 function parseActivationAdmissionReceiptValue(value) {
 	const record = requireRecord$1(value, "activation admission receipt");
 	requireExactKeys$4(record, "activation admission receipt", ["binding", "keyset"]);
-	const binding = requireActivationBinding(parseCeremonyBinding(record.binding));
+	const binding = parseRouterAbEd25519YaoActivationBindingV1(record.binding);
 	const keyset = parseKeyset(record.keyset);
 	switch (binding.operation) {
 		case "registration": return {
@@ -3943,7 +3949,7 @@ function parseActivationExecuteRequestValue(value) {
 		"deriver_a_input",
 		"deriver_b_input"
 	]);
-	const binding = requireActivationBinding(parseCeremonyBinding(record.binding));
+	const binding = parseRouterAbEd25519YaoActivationBindingV1(record.binding);
 	const deriverAInput = requireActivationInput(binding, parseEncryptedInput(record.deriver_a_input, "deriver_a_input"), "deriver_a", "deriver_a_input");
 	const deriverBInput = requireActivationInput(binding, parseEncryptedInput(record.deriver_b_input, "deriver_b_input"), "deriver_b", "deriver_b_input");
 	if (binding.operation === "registration") {
@@ -3969,7 +3975,7 @@ function parseActivationResultValue(value) {
 		"deriver_b_client_package",
 		"public_receipt"
 	]);
-	const binding = requireActivationBinding(parseCeremonyBinding(record.binding));
+	const binding = parseRouterAbEd25519YaoActivationBindingV1(record.binding);
 	const receipt = parseRouterAbEd25519YaoActivationPublicReceiptV1(record.public_receipt);
 	if (!sameRouterAbMpcMaterialActivationRef(binding.material_activation, receipt.material_activation)) throw new Error("activation result receipt material does not match the admitted binding");
 	const packageA = parseEncryptedPackage(record.deriver_a_client_package, "deriver_a_client_package");
@@ -3992,7 +3998,7 @@ function parseActivationResultValue(value) {
 	}
 }
 function requireRecoveryBinding(value) {
-	const binding = requireActivationBinding(parseCeremonyBinding(value));
+	const binding = parseRouterAbEd25519YaoActivationBindingV1(value);
 	switch (binding.operation) {
 		case "registration": throw new Error("recovery activation requires a recovery binding");
 		case "recovery": return binding;
@@ -4473,9 +4479,12 @@ function prepareD1WalletPutSignerStatement(input) {
         updated_at_ms = MAX(wallet_signers.updated_at_ms, EXCLUDED.updated_at_ms)`).bind(input.scope.namespace, input.scope.orgId, input.scope.projectId, input.scope.envId, parsed.walletId, signerFamily(parsed), parsed.signerId, recordChainTargetKey(parsed), JSON.stringify(parsed), parsed.createdAtMs, parsed.updatedAtMs);
 }
 var D1WalletStore = class {
+	adapterKind = "d1";
+	database;
+	scope;
+	ensureSchemaOnUse;
+	schemaReady = false;
 	constructor(input) {
-		this.adapterKind = "d1";
-		this.schemaReady = false;
 		const normalized = normalizeD1WalletStoreOptions(input);
 		this.database = normalized.database;
 		this.scope = {
@@ -4803,6 +4812,9 @@ var D1WalletStore = class {
 //#region src/router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.ts
 const ROUTER_AB_NORMAL_SIGNING_ADMISSION_TABLE = "router_ab_normal_signing_admission_records";
 var CloudflareD1RouterAbNormalSigningAdmissionStore = class {
+	database;
+	storageNamespace;
+	now;
 	constructor(options) {
 		if (!isD1DatabaseLike(options.database)) throw new Error("Router A/B normal-signing admission D1 database is required");
 		this.database = options.database;
@@ -5905,6 +5917,11 @@ const TENANT_ROOT_IDENTITY_DOMAIN_V1 = new TextEncoder().encode("seams/tenant-ro
 * incompatible with the trusted identity.
 */
 var TenantRootIdentityProof = class TenantRootIdentityProof {
+	orgId;
+	projectId;
+	envId;
+	signingRootId;
+	signingRootVersion;
 	retainProof() {
 		return true;
 	}
@@ -7067,7 +7084,7 @@ function parseEd25519SourceContributionPreparation(record) {
 		"sourceRegisteredPublicKeyB64u"
 	], "linked-device Ed25519 source contribution preparation");
 	if (record.kind !== "linked_device_ed25519_source_contribution_preparation_v1") throw new Error("linked-device Ed25519 source contribution preparation kind is invalid");
-	const sourceBinding = parseRegistrationBinding(record.sourceBinding, "sourceBinding");
+	const sourceBinding = parseRouterAbEd25519YaoActivationBindingV1(record.sourceBinding);
 	const targetAdmissionResult = parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1(record.targetAdmission);
 	if (!targetAdmissionResult.ok) throw new Error(`targetAdmission ${targetAdmissionResult.message}`);
 	const targetAdmission = targetAdmissionResult.value;
@@ -7131,7 +7148,7 @@ function parseEd25519Contribution(record) {
 	], "linked-device Ed25519 source contribution");
 	if (record.kind !== "linked_device_ed25519_source_contribution_v1") throw new Error("linked-device Ed25519 source contribution kind is invalid");
 	if (record.keyFamily !== "ed25519") throw new Error("linked-device Ed25519 source contribution family is invalid");
-	const sourceBinding = parseRegistrationBinding(record.sourceBinding, "sourceBinding");
+	const sourceBinding = parseRouterAbEd25519YaoActivationBindingV1(record.sourceBinding);
 	const targetMaterialActivation = parseActivation$2(record.targetMaterialActivation, "source contribution targetMaterialActivation");
 	const targetBinding = parseRegistrationBinding(record.targetBinding, "targetBinding");
 	const activationReceipt = parseRouterAbEd25519YaoActivationPublicReceiptV1(record.activationReceipt);
@@ -7408,7 +7425,7 @@ function parseLinkedDeviceEcdsaEncryptedSourceContributionV1(raw, label) {
 	};
 }
 function parseRegistrationBinding(raw, label) {
-	const binding = parseRouterAbEd25519YaoCeremonyBindingV1(raw);
+	const binding = parseRouterAbEd25519YaoActivationBindingV1(raw);
 	if (binding.operation !== "registration") throw new Error(`${label} must use the registration operation`);
 	return binding;
 }
@@ -7422,7 +7439,7 @@ function assertSourceBindingContext(binding, linkSessionId, label) {
 	if (binding.session_id.length !== 32 || String(linkSessionId).length === 0) throw new Error(`${label} link binding is invalid`);
 }
 function sameEdStableIdentity(left, right) {
-	return left.operation === right.operation && left.stable_key_context_binding.every((value, index) => value === right.stable_key_context_binding[index]) && left.material_activation.capability === right.material_activation.capability && left.material_activation.material_owner === right.material_activation.material_owner && left.material_activation.key_binding === right.material_activation.key_binding && left.material_activation.lifecycle_binding === right.material_activation.lifecycle_binding && left.material_activation.signing_worker === right.material_activation.signing_worker && left.lifecycle.root_share_epoch === right.lifecycle.root_share_epoch && left.lifecycle.account_id === right.lifecycle.account_id && left.lifecycle.signer_set_id === right.lifecycle.signer_set_id && left.lifecycle.selected_server_id === right.lifecycle.selected_server_id;
+	return left.stable_key_context_binding.every((value, index) => value === right.stable_key_context_binding[index]) && left.material_activation.capability === right.material_activation.capability && left.material_activation.material_owner === right.material_activation.material_owner && left.material_activation.key_binding === right.material_activation.key_binding && left.material_activation.lifecycle_binding === right.material_activation.lifecycle_binding && left.material_activation.signing_worker === right.material_activation.signing_worker && left.lifecycle.root_share_epoch === right.lifecycle.root_share_epoch && left.lifecycle.account_id === right.lifecycle.account_id && left.lifecycle.signer_set_id === right.lifecycle.signer_set_id && left.lifecycle.selected_server_id === right.lifecycle.selected_server_id;
 }
 function sameEcdsaSourceSigner$1(left, right) {
 	return mpcMaterialActivationRefsEqual(left.activation, right.activation) && left.clientPublicKey33B64u === right.clientPublicKey33B64u && left.relayerPublicKey33B64u === right.relayerPublicKey33B64u && left.thresholdPublicKey33B64u === right.thresholdPublicKey33B64u && left.thresholdEthereumAddress20B64u === right.thresholdEthereumAddress20B64u;
@@ -9576,7 +9593,7 @@ const WALLET_MANAGEMENT_PROTOCOL_HEADER = "X-Seams-Wallet-Protocol";
 //#endregion
 //#region src/router/framework/http.ts
 const CORS_ALLOW_METHODS = "GET,POST,PUT,PATCH,DELETE,OPTIONS";
-const CORS_PREFLIGHT_MAX_AGE_SECONDS = 600;
+const CORS_PREFLIGHT_MAX_AGE_SECONDS = 7200;
 const CORS_ALLOW_HEADERS = [
 	"Content-Type",
 	WALLET_MANAGEMENT_PROTOCOL_HEADER,
@@ -10015,6 +10032,12 @@ async function computeOwnerLaneParticipantBindingDigestV1(input) {
 //#region ../shared-ts/src/authorization/operationFingerprint.ts
 const CAPABILITY_OPERATION_FINGERPRINT_DOMAIN_V1 = "seams:authorization:capability-operation-fingerprint:v1";
 var CapabilityOperationEnvelopeProof = class {
+	tenantId;
+	principalId;
+	capabilityId;
+	operationId;
+	operation;
+	digests;
 	retainProof() {
 		return true;
 	}
@@ -11159,10 +11182,10 @@ async function enforceRoutePolicy(input) {
 //#region src/router/domains/walletRegistration/registrationSessionSeal.ts
 /** Holds one request's computation until registration can publish its response. */
 var RegistrationPreparedSessionSeal = class {
+	prepared = null;
 	constructor(request, service) {
 		this.request = request;
 		this.service = service;
-		this.prepared = null;
 	}
 	async prepare(session) {
 		await this.finish(session);
@@ -27481,10 +27504,7 @@ var DeviceLinkingInputError = class extends Error {
 //#endregion
 //#region src/core/deviceLinking/linkedDeviceManagement.ts
 var LinkedDeviceListCursorError = class extends Error {
-	constructor(..._args) {
-		super(..._args);
-		this.kind = "linked_device_list_cursor_error_v1";
-	}
+	kind = "linked_device_list_cursor_error_v1";
 };
 //#endregion
 //#region src/router/transport/fetch/routes/deviceManagement.ts
@@ -31303,8 +31323,11 @@ function prepareD1WebAuthnAuthenticatorInsertStatement(input) {
 	return prepareAuthenticatorStatement(INSERT_WEBAUTHN_AUTHENTICATOR_SQL, input);
 }
 var CloudflareD1WebAuthnStore = class {
+	syncChallenges;
+	database;
+	scope;
+	credentialClaims;
 	constructor(input) {
-		this.prepare = (sql, values) => prepareD1TenantStatement(this.database, this.scope, sql, values);
 		this.credentialClaims = input.credentialClaims;
 		this.syncChallenges = input.syncChallenges;
 		this.database = input.database;
@@ -31464,6 +31487,7 @@ var CloudflareD1WebAuthnStore = class {
 	async consumeChallenge(input) {
 		return await webAuthnChallengeRows.consume(this.prepare, input.challengeId, input.challengeKind, Date.now()).first();
 	}
+	prepare = (sql, values) => prepareD1TenantStatement(this.database, this.scope, sql, values);
 };
 //#endregion
 //#region src/authorization/lifecycleRouting.ts
@@ -31542,6 +31566,10 @@ function errorMessage$1(error) {
 	return error instanceof Error ? error.message : String(error || "");
 }
 var CloudflareD1WebAuthnAuthService = class {
+	lifecycleRouting;
+	webAuthnStore;
+	walletManifestSource;
+	walletAuthMethodStore;
 	constructor(input) {
 		this.lifecycleRouting = input.lifecycleRouting;
 		this.webAuthnStore = input.webAuthnStore;
@@ -32262,10 +32290,10 @@ function storedReservationGeneration(record) {
 //#region src/router/cloudflare/d1/registration/d1RegistrationSessionTransaction.ts
 /** The wallet's version checks and the session's winner read share one batch. */
 var D1RegistrationSessionTransaction = class {
+	sessionResults = null;
 	constructor(database, commitWallet) {
 		this.database = database;
 		this.commitWallet = commitWallet;
-		this.sessionResults = null;
 	}
 	async execute(sessionStatements) {
 		await this.commitWallet(this.commit.bind(this, sessionStatements));
@@ -33097,6 +33125,11 @@ function activeV2AuthorityMethodBindings(scope, session) {
 	];
 }
 var CloudflareD1AuthorizationStore = class {
+	database;
+	namespace;
+	walletSignerScope;
+	walletStore;
+	getLinkedDeviceAuthorityReader;
 	constructor(options) {
 		this.getLinkedDeviceAuthorityReader = options.getLinkedDeviceAuthorityReader ?? (() => null);
 		this.database = options.database;
@@ -35175,6 +35208,7 @@ const VAULT_PROXY_SECRET_AAD_DOMAIN_V1 = "seams:vault:proxy-secret:v1";
 const AES_GCM_NONCE_BYTES = 12;
 const AES_GCM_KEY_BYTES = 32;
 var CloudflareD1VaultProxyStore = class {
+	key;
 	constructor(database, namespace, encryptionKey) {
 		this.database = database;
 		this.namespace = namespace;
@@ -35294,12 +35328,11 @@ function resolveTraceContext$2(request) {
 	};
 }
 var InMemoryRouterAbEd25519YaoRegistrationStateV1 = class {
-	constructor() {
-		this.states = /* @__PURE__ */ new Map();
-		this.lifecycleSessions = /* @__PURE__ */ new Map();
-		this.admissionClaims = /* @__PURE__ */ new Map();
-		this.dispatchRoots = /* @__PURE__ */ new Map();
-	}
+	states = /* @__PURE__ */ new Map();
+	lifecycleSessions = /* @__PURE__ */ new Map();
+	admissionClaims = /* @__PURE__ */ new Map();
+	/** The tenant root each admitted lifecycle dispatches to, pinned at admission. */
+	dispatchRoots = /* @__PURE__ */ new Map();
 };
 function registrationSessionKey(receipt) {
 	return bytesToHex$3(receipt.binding.session_id);
@@ -35416,12 +35449,12 @@ function routeFailureResponse$1(result) {
 	}, { status: result.status });
 }
 var RouterAbEd25519YaoRegistrationRouteExtension = class {
+	kind = "fetch_route_extension";
+	id = "router_ab_ed25519_yao_registration";
+	routes = ROUTER_AB_ED25519_YAO_REGISTRATION_ROUTES;
 	constructor(service, authorization) {
 		this.service = service;
 		this.authorization = authorization;
-		this.kind = "fetch_route_extension";
-		this.id = "router_ab_ed25519_yao_registration";
-		this.routes = ROUTER_AB_ED25519_YAO_REGISTRATION_ROUTES;
 	}
 	async handleFetchRoute(input) {
 		if (input.method !== "POST") return json$3({
@@ -35494,6 +35527,9 @@ function createRouterAbEd25519YaoRegistrationModule(input) {
 	});
 }
 var InMemoryRouterAbEd25519YaoRegistrationService = class {
+	states;
+	lifecycleSessions;
+	admissionClaims;
 	constructor(backend, state = new InMemoryRouterAbEd25519YaoRegistrationStateV1()) {
 		this.backend = backend;
 		this.states = state.states;
@@ -36051,11 +36087,10 @@ function findAuthorityByLifecycleId(authorities, lifecycleId) {
 	return null;
 }
 var InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationStateV1 = class {
-	constructor() {
-		this.authorities = [];
-	}
+	authorities = [];
 };
 var InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter = class {
+	authorities;
 	constructor(state = new InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationStateV1()) {
 		this.authorities = state.authorities;
 	}
@@ -36278,12 +36313,10 @@ var EphemeralRouterAbEd25519YaoCapabilityPersistenceV1 = class {
 	}
 };
 var InMemoryRouterAbEd25519YaoRecoveryStateV1 = class {
-	constructor() {
-		this.capabilities = /* @__PURE__ */ new Map();
-		this.identityCapabilities = /* @__PURE__ */ new Map();
-		this.recoveries = /* @__PURE__ */ new Map();
-		this.recoverySessions = /* @__PURE__ */ new Map();
-	}
+	capabilities = /* @__PURE__ */ new Map();
+	identityCapabilities = /* @__PURE__ */ new Map();
+	recoveries = /* @__PURE__ */ new Map();
+	recoverySessions = /* @__PURE__ */ new Map();
 };
 const ROUTER_AB_ED25519_YAO_RECOVERY_ROUTES = Object.freeze([
 	defineRoute({
@@ -36910,6 +36943,10 @@ function resolveRouterAbEd25519YaoActiveCapability(capabilities, input) {
 	};
 }
 var InMemoryRouterAbEd25519YaoRecoveryService = class {
+	capabilities;
+	identityCapabilities;
+	recoveries;
+	recoverySessions;
 	constructor(backend, state = new InMemoryRouterAbEd25519YaoRecoveryStateV1(), capabilityPersistence = new EphemeralRouterAbEd25519YaoCapabilityPersistenceV1()) {
 		this.backend = backend;
 		this.capabilityPersistence = capabilityPersistence;
@@ -37810,14 +37847,14 @@ var InMemoryRouterAbEd25519YaoRecoveryService = class {
 	}
 };
 var RouterAbEd25519YaoRecoveryRouteExtension = class {
+	kind = "fetch_route_extension";
+	id = "router_ab_ed25519_yao_recovery";
+	routes = ROUTER_AB_ED25519_YAO_RECOVERY_ROUTES;
 	constructor(service, capabilities, authorization, linkedAuthorities = null) {
 		this.service = service;
 		this.capabilities = capabilities;
 		this.authorization = authorization;
 		this.linkedAuthorities = linkedAuthorities;
-		this.kind = "fetch_route_extension";
-		this.id = "router_ab_ed25519_yao_recovery";
-		this.routes = ROUTER_AB_ED25519_YAO_RECOVERY_ROUTES;
 	}
 	async handleFetchRoute(input) {
 		if (input.method !== "POST") return json$3({
@@ -37985,11 +38022,9 @@ function resolveTraceContext(request) {
 	};
 }
 var InMemoryRouterAbEd25519YaoExportStateV1 = class {
-	constructor() {
-		this.exports = /* @__PURE__ */ new Map();
-		this.authorizationNonceOwners = /* @__PURE__ */ new Map();
-		this.authorizationUncertainOwners = /* @__PURE__ */ new Map();
-	}
+	exports = /* @__PURE__ */ new Map();
+	authorizationNonceOwners = /* @__PURE__ */ new Map();
+	authorizationUncertainOwners = /* @__PURE__ */ new Map();
 };
 const ROUTES = Object.freeze([defineRoute({
 	id: "router_ab_ed25519_yao_export_admit",
@@ -38136,12 +38171,12 @@ function parseRouterAbEd25519YaoExportExecuteEnvelopeV1(value) {
 	};
 }
 var RouterAbEd25519YaoExportRouteExtension = class {
+	kind = "fetch_route_extension";
+	id = "router_ab_ed25519_yao_export";
+	routes = ROUTES;
 	constructor(service, authorization) {
 		this.service = service;
 		this.authorization = authorization;
-		this.kind = "fetch_route_extension";
-		this.id = "router_ab_ed25519_yao_export";
-		this.routes = ROUTES;
 	}
 	async handleFetchRoute(input) {
 		if (input.method !== "POST") return json$3({
@@ -38452,9 +38487,10 @@ function createRouterAbEd25519YaoProductRegistrationCompositionFromPortsV1(input
 	};
 }
 var RouterAbEd25519YaoProductRegistrationRuntime = class {
+	kind = "router_ab_ed25519_yao_product_registration_runtime_v1";
+	signingWorkerId;
 	constructor(input) {
 		this.input = input;
-		this.kind = "router_ab_ed25519_yao_product_registration_runtime_v1";
 		this.signingWorkerId = input.signingWorkerId.trim();
 		if (!this.signingWorkerId) throw new Error("Ed25519 Yao SigningWorker ID is required");
 	}
@@ -38974,8 +39010,9 @@ function requestInitWithReplayHeader(init) {
 	};
 }
 var RouterAbEd25519YaoHttpRegistrationBackend = class {
+	config;
+	lastRouterServerTiming = null;
 	constructor(config) {
-		this.lastRouterServerTiming = null;
 		this.config = validateConfig(config);
 	}
 	takeLastRouterServerTiming() {
@@ -39325,6 +39362,10 @@ function createCloudflareTenantStorageRoute(input) {
 	};
 }
 var StaticCloudflareTenantStorageRouteResolver = class {
+	routeVersion;
+	topology;
+	jurisdiction;
+	signerTarget;
 	constructor(input) {
 		this.routeVersion = normalizeRouteVersion(input.routeVersion);
 		this.topology = input.topology;
@@ -39475,6 +39516,7 @@ function createInMemoryRouterApiRuntimeSnapshotConsumer() {
 //#endregion
 //#region src/router/cloudflare/durableObjects/versionedJsonRecordStore.ts
 var CloudflareVersionedJsonRecordStoreError = class extends Error {
+	code;
 	constructor(code, message) {
 		super(message);
 		this.name = "CloudflareVersionedJsonRecordStoreError";
@@ -39482,6 +39524,11 @@ var CloudflareVersionedJsonRecordStoreError = class extends Error {
 	}
 };
 var CloudflareDurableObjectVersionedJsonRecordStore = class {
+	namespace;
+	objectNameForKey;
+	encode;
+	parse;
+	keyPrefix;
 	constructor(options) {
 		if (!isDurableObjectNamespaceLike(options.namespace)) throw new Error("Cloudflare Durable Object namespace is required");
 		if (typeof options.objectNameForKey !== "function") throw new Error("Cloudflare versioned JSON object-name resolver is required");
@@ -39664,6 +39711,7 @@ function assertNever$6(value) {
 const TABLE_NAME = "router_ab_yao_versioned_json_records";
 const CAS_GUARD_SQL = D1_BATCH_CAS_GUARD_SQL;
 var CloudflareD1VersionedJsonRecordStoreError = class extends Error {
+	code;
 	constructor(code, message) {
 		super(message);
 		this.name = "CloudflareD1VersionedJsonRecordStoreError";
@@ -39671,6 +39719,11 @@ var CloudflareD1VersionedJsonRecordStoreError = class extends Error {
 	}
 };
 var CloudflareD1VersionedJsonRecordStore = class {
+	database;
+	scope;
+	encode;
+	parse;
+	keyPrefix;
 	constructor(options) {
 		if (!isD1DatabaseLike(options.database)) throw new Error("Cloudflare D1 versioned JSON database is required");
 		this.database = options.database;
@@ -41076,10 +41129,10 @@ function createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V
 	return createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1(new D1LifecycleRecords(options, createD1Ed25519YaoLifecycleRecords(options)));
 }
 var D1LifecycleRecords = class {
+	observed = /* @__PURE__ */ new Map();
 	constructor(options, records) {
 		this.options = options;
 		this.records = records;
-		this.observed = /* @__PURE__ */ new Map();
 	}
 	async readMany(keys) {
 		const entries = await this.records.readMany(keys);
@@ -41731,9 +41784,10 @@ function createRouterAbEd25519YaoProductRegistrationRequestScopedRuntimeV1(input
 	return new RouterAbEd25519YaoProductRegistrationRequestScopedRuntime(input);
 }
 var RouterAbEd25519YaoProductRegistrationRequestScopedRuntime = class {
+	kind = "router_ab_ed25519_yao_product_registration_runtime_v1";
+	signingWorkerId;
 	constructor(input) {
 		this.input = input;
-		this.kind = "router_ab_ed25519_yao_product_registration_runtime_v1";
 		this.signingWorkerId = input.signingWorkerId.trim();
 		if (!this.signingWorkerId) throw new Error("Ed25519 Yao SigningWorker ID is required");
 	}
@@ -42280,7 +42334,6 @@ function validateOrdinaryInactiveSignerMaterialReservationRequestV1(request) {
 			const targetBinding = parseRouterAbEd25519YaoCeremonyBindingV1(request.preparation.targetBinding);
 			if (targetBinding.operation !== "registration") throw new Error("ordinary Ed25519 target binding must use registration");
 			assertMaterialActivationMatchesV1(request.plannedActivationRef, routerAbMpcMaterialActivationRefFromWire(targetBinding.material_activation));
-			if (request.preparation.sourceContribution.sourceBinding.operation !== "registration") throw new Error("ordinary Ed25519 source contribution must use registration");
 			parseRouterAbEd25519YaoParticipantIdsV1(request.preparation.sourceContribution.participantIds);
 			return;
 		}
@@ -42824,10 +42877,10 @@ function hasExactKeysV1(value, keys) {
 * silently changing the request while preserving the endpoint's exact result.
 */
 var CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1 = class {
+	ed25519Reservations = /* @__PURE__ */ new Map();
+	ecdsaReservations = /* @__PURE__ */ new Map();
 	constructor(endpoint) {
 		this.endpoint = endpoint;
-		this.ed25519Reservations = /* @__PURE__ */ new Map();
-		this.ecdsaReservations = /* @__PURE__ */ new Map();
 	}
 	async reserveInactiveEd25519SignerMaterialV1(input) {
 		validateOrdinaryInactiveSignerMaterialReservationRequestV1(input);
@@ -42866,9 +42919,9 @@ function createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1(inpu
 	return createOrdinaryInactiveSignerMaterialReservationServiceV1({ worker: new CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1(input.endpoint) });
 }
 var CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1 = class {
+	terminalOperations = /* @__PURE__ */ new Map();
 	constructor(endpoint) {
 		this.endpoint = endpoint;
-		this.terminalOperations = /* @__PURE__ */ new Map();
 	}
 	async deactivateOrdinarySignerMaterialV1(input) {
 		validateOrdinaryInactiveSignerMaterialDeactivationRequestV1(input);

package/dist/esm/router/domains/ecdsa/routerAbEcdsaStrictRegistration.js

@@ -496,9 +496,9 @@ function routerAbEcdsaStrictRegistrationRequestBindingJson(request) {
 	});
 }
 var Ed25519CeremonyTokenIssuer = class {
+	signingKey = null;
 	constructor(config) {
 		this.config = config;
-		this.signingKey = null;
 		validateCeremonyTokenIssuerConfig(config);
 	}
 	async issue(claims) {

package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js

@@ -210,9 +210,10 @@ async function resolveRouterAbEd25519YaoWalletSessionTermsV1(input) {
 	}
 }
 var RouterAbEd25519YaoProductRegistrationRuntime = class {
+	kind = "router_ab_ed25519_yao_product_registration_runtime_v1";
+	signingWorkerId;
 	constructor(input) {
 		this.input = input;
-		this.kind = "router_ab_ed25519_yao_product_registration_runtime_v1";
 		this.signingWorkerId = input.signingWorkerId.trim();
 		if (!this.signingWorkerId) throw new Error("Ed25519 Yao SigningWorker ID is required");
 	}

package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationRequestScopedRuntime.js

@@ -21,9 +21,10 @@ function createRouterAbEd25519YaoProductRegistrationRequestScopedRuntimeV1(input
 	return new RouterAbEd25519YaoProductRegistrationRequestScopedRuntime(input);
 }
 var RouterAbEd25519YaoProductRegistrationRequestScopedRuntime = class {
+	kind = "router_ab_ed25519_yao_product_registration_runtime_v1";
+	signingWorkerId;
 	constructor(input) {
 		this.input = input;
-		this.kind = "router_ab_ed25519_yao_product_registration_runtime_v1";
 		this.signingWorkerId = input.signingWorkerId.trim();
 		if (!this.signingWorkerId) throw new Error("Ed25519 Yao SigningWorker ID is required");
 	}

package/dist/esm/router/domains/ed25519Yao/export/routerAbEd25519YaoExport.js

@@ -43,11 +43,9 @@ function resolveTraceContext(request) {
 	};
 }
 var InMemoryRouterAbEd25519YaoExportStateV1 = class {
-	constructor() {
-		this.exports = /* @__PURE__ */ new Map();
-		this.authorizationNonceOwners = /* @__PURE__ */ new Map();
-		this.authorizationUncertainOwners = /* @__PURE__ */ new Map();
-	}
+	exports = /* @__PURE__ */ new Map();
+	authorizationNonceOwners = /* @__PURE__ */ new Map();
+	authorizationUncertainOwners = /* @__PURE__ */ new Map();
 };
 function bytesToHex(bytes) {
 	let encoded = "";
@@ -1259,12 +1257,12 @@ function parseRouterAbEd25519YaoExportExecuteEnvelopeV1(value) {
 	};
 }
 var RouterAbEd25519YaoExportRouteExtension = class {
+	kind = "fetch_route_extension";
+	id = "router_ab_ed25519_yao_export";
+	routes = ROUTES;
 	constructor(service, authorization) {
 		this.service = service;
 		this.authorization = authorization;
-		this.kind = "fetch_route_extension";
-		this.id = "router_ab_ed25519_yao_export";
-		this.routes = ROUTES;
 	}
 	async handleFetchRoute(input) {
 		if (input.method !== "POST") return json({

package/dist/esm/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery.js

@@ -87,12 +87,10 @@ var EphemeralRouterAbEd25519YaoCapabilityPersistenceV1 = class {
 	}
 };
 var InMemoryRouterAbEd25519YaoRecoveryStateV1 = class {
-	constructor() {
-		this.capabilities = /* @__PURE__ */ new Map();
-		this.identityCapabilities = /* @__PURE__ */ new Map();
-		this.recoveries = /* @__PURE__ */ new Map();
-		this.recoverySessions = /* @__PURE__ */ new Map();
-	}
+	capabilities = /* @__PURE__ */ new Map();
+	identityCapabilities = /* @__PURE__ */ new Map();
+	recoveries = /* @__PURE__ */ new Map();
+	recoverySessions = /* @__PURE__ */ new Map();
 };
 const ROUTER_AB_ED25519_YAO_RECOVERY_ROUTES = Object.freeze([
 	defineRoute({
@@ -727,6 +725,10 @@ function resolveRouterAbEd25519YaoActiveCapability(capabilities, input) {
 	};
 }
 var InMemoryRouterAbEd25519YaoRecoveryService = class {
+	capabilities;
+	identityCapabilities;
+	recoveries;
+	recoverySessions;
 	constructor(backend, state = new InMemoryRouterAbEd25519YaoRecoveryStateV1(), capabilityPersistence = new EphemeralRouterAbEd25519YaoCapabilityPersistenceV1()) {
 		this.backend = backend;
 		this.capabilityPersistence = capabilityPersistence;
@@ -1627,14 +1629,14 @@ var InMemoryRouterAbEd25519YaoRecoveryService = class {
 	}
 };
 var RouterAbEd25519YaoRecoveryRouteExtension = class {
+	kind = "fetch_route_extension";
+	id = "router_ab_ed25519_yao_recovery";
+	routes = ROUTER_AB_ED25519_YAO_RECOVERY_ROUTES;
 	constructor(service, capabilities, authorization, linkedAuthorities = null) {
 		this.service = service;
 		this.capabilities = capabilities;
 		this.authorization = authorization;
 		this.linkedAuthorities = linkedAuthorities;
-		this.kind = "fetch_route_extension";
-		this.id = "router_ab_ed25519_yao_recovery";
-		this.routes = ROUTER_AB_ED25519_YAO_RECOVERY_ROUTES;
 	}
 	async handleFetchRoute(input) {
 		if (input.method !== "POST") return json({

package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoHttpRegistrationBackend.js

@@ -409,8 +409,9 @@ function requestInitWithReplayHeader(init) {
 	};
 }
 var RouterAbEd25519YaoHttpRegistrationBackend = class {
+	config;
+	lastRouterServerTiming = null;
 	constructor(config) {
-		this.lastRouterServerTiming = null;
 		this.config = validateConfig(config);
 	}
 	takeLastRouterServerTiming() {