@seams/wallet-server 0.27.0 → 0.28.0

package/dist/esm/cloud-host.js

@@ -3,22 +3,28 @@ import { ensureLeadingSlash, normalizeBoundedPositiveInteger, normalizeLowercase
 import { isObject, isPlainObject } from "./shared-ts/src/utils/validation.js";
 import { base64UrlDecode, base64UrlEncode } from "./shared-ts/src/utils/base64.js";
 import { sha256Bytes } from "./shared-ts/src/utils/digests.js";
+import { parseExternalAuthConfiguration } from "./shared-ts/src/auth/externalAuth.js";
 import "./shared-ts/src/utils/encoders.js";
+import { CloudflareD1OidcJwksCache, parseBooleanJwtClaim, parseCacheControlMaxAgeSec, parseGoogleJwks, parseJwtAud, parseRs256JwtForVerification, validateGoogleIdTokenClaims, verifyRs256JwtSignature } from "./router/cloudflare/d1/oidc/d1OidcBoundary.js";
+import { verifyGoogleOidcToken } from "./router/cloudflare/d1/oidc/googleOidcToken.js";
+import { D1_BATCH_CAS_GUARD_SQL, d1ChangedRows, d1Integer, d1Number, formatD1ExecStatement, isD1DatabaseLike, parseD1JsonArrayColumn, parseD1JsonColumn, parseD1JsonObjectColumn, queryD1All, queryD1One } from "./storage/d1Sql.js";
+import { prepareD1TenantStatement } from "./core/d1TenantStore.js";
 import { ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, parseRouterAbPublicKeysetV2 } from "./shared-ts/src/utils/routerAbPublicKeyset.js";
 import { ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_STATUS_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1 } from "./shared-ts/src/utils/routerAbEd25519Yao.js";
 import { computeLinkedDeviceSessionClaimDigestV1 } from "./shared-ts/src/device-linking/digests.js";
 import { WalletLifecycleLocator } from "./authorization/lifecycleRouting.js";
 import { secureRandomBase36, secureRandomBase64Url } from "./shared-ts/src/utils/secureRandomId.js";
 import { digestOpaqueValue } from "./authorization/service.js";
+import { extractBearerCredential, extractRouterApiEnvironmentId, normalizeSourceIp, resolveRequestOriginRateLimitKeyFromFetchHeaders, resolveSourceIpFromFetchHeaders } from "./router/auth/routerApiKeyAuth.js";
+import { SessionService, buildCorsOrigins, normalizeCorsOrigin, parseCsvList } from "./core/SessionService.js";
+import { ROUTER_AB_TRACE_ID_HEADER_V1 } from "./shared-ts/src/utils/routerAbTraceContext.js";
+import { headersToRecord, json, jsonFailure, readJson, toResponse, withCors } from "./router/framework/http.js";
 import { ROUTER_API_CREDENTIAL_SCOPES } from "./router/framework/apiCredentialPorts.js";
 import { API_CREDENTIAL_ROUTE_SCOPES, API_CREDENTIAL_TYPES, PUBLIC_PROOF_TYPES } from "./router/framework/routeAuthPolicy.js";
 import { ROUTE_SERVICE_KEYS } from "./router/framework/routeExecutionContext.js";
 import { createRouterApiRouteDefinitions, defineRoute, defineRouteExtension, findRouteDefinitionById, findRouteDefinitionForRequest, matchesRouteDefinitionRequest } from "./router/framework/routeDefinitions.js";
-import { SessionService, buildCorsOrigins, normalizeCorsOrigin, parseCsvList } from "./core/SessionService.js";
 import { addSecp256k1PublicKeys33, computeEip1559TxHash, encodeEip1559SignedTxFromSignature65, ensureEvmCryptoWasm, secp256k1PrivateKey32ToPublicKey33, secp256k1PublicKey33ToEthereumAddress, sha256BytesSync, signSecp256k1Recoverable, validateSecp256k1PublicKey33, verifySecp256k1Bip340SignatureAgainstPublicKey33, verifySecp256k1RecoverableSignatureAgainstPublicKey33 } from "./core/ThresholdService/evmCryptoWasm.js";
-import { D1_BATCH_CAS_GUARD_SQL, d1ChangedRows, d1Integer, d1Number, formatD1ExecStatement, isD1DatabaseLike, parseD1JsonArrayColumn, parseD1JsonColumn, parseD1JsonObjectColumn, queryD1All, queryD1One } from "./storage/d1Sql.js";
 import { D1WalletStore, ED25519_SIGNER_ACTIVATION_ID_PATH, WALLET_STORE_D1_SCHEMA_SQL, buildWalletEcdsaSignerRecord, ensureWalletStoreD1Schema, parseWalletEd25519SignerRecord, prepareD1WalletPutSignerStatement, prepareD1WalletPutSubjectStatement, selectWalletEd25519Signer } from "./core/d1WalletStore.js";
-import { prepareD1TenantStatement } from "./core/d1TenantStore.js";
 import { D1WalletAuthMethodStore, WALLET_AUTH_METHOD_D1_STORE, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL, bindWalletAuthMethodIdentity, bindWalletAuthMethodIdentityV2, ensureWalletAuthMethodStoreD1Schema, normalizeWalletAuthMethod, normalizeWalletAuthMethodV2, prepareD1WalletAuthMethodInsertStatement, prepareD1WalletAuthMethodPutStatement, prepareD1WalletAuthMethodV2PutStatement, walletAuthMethodId, walletAuthMethodV2Id } from "./core/d1WalletAuthMethodStore.js";
 import { coerceLogger, normalizeLogger } from "./core/logger.js";
 import { WalletObjectAddressSnapshot, walletObjectIdentity } from "./router/cloudflare/runtime/walletObjectAddresses.js";
@@ -29,11 +35,9 @@ import { enforceDelegatePolicy, executeSignedDelegateWithRelayer, normalizeHashT
 import { parseWalletRegistrationSetupReservation, proposeWalletRegistrationSetup, walletRegistrationSetupRequestDigest } from "./router/domains/walletRegistration/walletRegistrationReservation.js";
 import { LocalRegistrationSetupAuthority } from "./localRegistrationSetupAuthority.js";
 import { createWalletRegistrationContextResolver, unavailableRegistrationContext, walletRegistrationContext } from "./router/auth/walletRegistrationContext.js";
-import { extractBearerCredential, extractRouterApiEnvironmentId, normalizeSourceIp, resolveRequestOriginRateLimitKeyFromFetchHeaders, resolveSourceIpFromFetchHeaders } from "./router/auth/routerApiKeyAuth.js";
 import { publishableKeyRoutePrincipal, resolvePublishableKeyApiCredentialAuth, resolveSecretKeyApiCredentialAuth, resolveWalletRegistrationContext } from "./router/auth/routerApiCredentialAuth.js";
 import { enforceRoutePolicy } from "./router/framework/enforceRoutePolicy.js";
 import { routeError, routeJson, toFetchRouteResponse } from "./router/framework/routeResponses.js";
-import { ROUTER_AB_TRACE_ID_HEADER_V1 } from "./shared-ts/src/utils/routerAbTraceContext.js";
 import { parseWalletRegistrationSetupRequest } from "./router/domains/walletRegistration/walletRegistrationRoutes.js";
 import { applyRouteMetering } from "./router/framework/applyRouteMetering.js";
 import { InMemoryRouterAbNormalSigningAdmissionStore, abusePrincipalKey, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createRouterAbNormalSigningAdmissionAdapter, runtimePolicyScopeKey } from "./router/domains/signingOperations/routerAbNormalSigningAdmissionCore.js";
@@ -43,7 +47,6 @@ import { coerceRouterLogger } from "./router/framework/logger.js";
 import { buildTenantRootIdentityFromAuthenticatedDeploymentV1, encodeTenantRootIdentityV1 } from "./shared-ts/src/tenant-root/tenantRootIdentity.js";
 import { WALLET_CONSOLE_OPS_BASE_PATH_V1, WALLET_CONSOLE_OP_PATHS_V1, WALLET_CONSOLE_SERVICE_ORIGIN_V1, decodeWalletConsoleTenantRootActiveLineageRequestV1, decodeWalletConsoleTenantRootActiveLineageResponseV1 } from "./router/cloudflare/runtime/walletConsoleOps.js";
 import { createWalletConsoleOpsClient, parseWalletRegistrationContextResponse } from "./router/cloudflare/runtime/walletConsoleOpsClient.js";
-import { headersToRecord, json, jsonFailure, readJson, toResponse, withCors } from "./router/framework/http.js";
 import { webAuthnCredentialIdB64uFromCredential } from "./router/auth/webAuthnCredentialCodecs.js";
 import { deriveRecoveryCodeLocatorV1FromBytes, parseRecoveryCodeLocatorV1 } from "./shared-ts/src/wallet-recovery/recoveryCodeLocator.js";
 import { evaluateRouterAbNormalSigningAdmission } from "./router/domains/signingOperations/routerAbNormalSigningAdmission.js";
@@ -100,7 +103,6 @@ import { runRouterAbEd25519YaoRegistrationSideEffectV1 } from "./router/domains/
 import { CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1, CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1, createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1, createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1 } from "./router/cloudflare/signingLanes/cloudflareOrdinaryInactiveSignerMaterialReservation.js";
 import "./router/cloudflare-adaptor.js";
 import { CloudflareD1RouterAbEd25519YaoCapabilityPersistence, ROUTER_AB_ED25519_YAO_CAPABILITY_REPLACEMENT_TABLE_V1 } from "./router/cloudflare/d1/ed25519Yao/d1Ed25519YaoCapabilityPersistence.js";
-import { CloudflareD1OidcJwksCache, parseBooleanJwtClaim, parseCacheControlMaxAgeSec, parseGoogleJwks, parseJwtAud, parseRs256JwtForVerification, validateGoogleIdTokenClaims, verifyRs256JwtSignature } from "./router/cloudflare/d1/oidc/d1OidcBoundary.js";
 import { createSigningSessionSealOptions, parseSigningSessionSealRootConfig } from "./threshold/session/signingSessionSeal/options.js";
 import { normalizeD1RouterApiAuthOptions, normalizeLinkedDevicePasskeyTargetConfigurationV1, parseBooleanFlag, requireD1RouterApiAuthScopeString } from "./router/cloudflare/d1/auth/d1RouterApiAuthConfig.js";
 import { decodeJsonRpcEnvelope } from "./shared-ts/src/utils/jsonRpc.js";
@@ -108,7 +110,6 @@ import { createRouterAbEcdsaEd25519CeremonyTokenIssuer, createRouterAbEcdsaStric
 import { parseGoogleEmailOtpRegistrationAttemptRecord, parseGoogleEmailOtpRegistrationOfferCandidates, requireRuntimePolicyScope } from "./router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationRecords.js";
 import { CloudflareD1GoogleEmailOtpRegistrationAttemptStore } from "./router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationAttemptStore.js";
 import { D1IdentityStore } from "./core/d1IdentityStore.js";
-import { verifyGoogleOidcToken } from "./router/cloudflare/d1/oidc/googleOidcToken.js";
 import { D1LinkedDeviceEd25519ExportRootStoreV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceEd25519ExportRootStore.js";
 import { D1LinkedDeviceRequestProofNonceStoreV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceRequestProofNonceStore.js";
 import { createD1LinkedDeviceSessionServiceV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionService.js";
@@ -131,4 +132,4 @@ import { handleRouterAbEd25519YaoRecoveryRequestScopedCloudflareV1 } from "./rou
 import { RouterAbEd25519YaoRecoveryWalletSessionAuthorizationAdapter } from "./router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryWalletSessionAuthorization.js";
 import { keccak256Bytes } from "./shared-ts/src/utils/keccak.js";
 import { decodeEvmBlockHeader, decodeEvmTransactionByHash, decodeEvmTransactionCall, decodeEvmTransactionReceipt, parseRpcHexQuantity } from "./shared-ts/src/utils/evmRpcResults.js";
-export { API_CREDENTIAL_ROUTE_SCOPES, API_CREDENTIAL_TYPES, ActionType, CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, CloudflareD1AuthorizationStore, CloudflareD1GoogleEmailOtpRegistrationAttemptStore, CloudflareD1OidcJwksCache, CloudflareD1RouterAbEd25519YaoCapabilityPersistence, CloudflareD1RouterAbNormalSigningAdmissionStore, CloudflareD1VaultProxyStore, CloudflareD1VersionedJsonRecordStore, CloudflareD1VersionedJsonRecordStoreError, CloudflareD1WebAuthnAuthService, CloudflareD1WebAuthnStore, CloudflareDurableObjectVersionedJsonRecordStore, CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1, CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1, CloudflareVersionedJsonRecordStoreError, CrossSiteSessionCookieAdapter, D1IdentityStore, D1LinkedDeviceAuthorityInstallServiceV1, D1LinkedDeviceEd25519ExportRootStoreV1, D1LinkedDeviceRequestProofNonceStoreV1, D1LinkedDeviceSessionStoreV1, D1LinkedDeviceSourceContributionPreparationPlannerV1, D1LinkedDeviceTargetAuthenticatorStoreV1, D1LinkedDeviceTargetCredentialProviderV1, D1LinkedDeviceTargetPlannerV1, D1WalletAuthMethodStore, D1WalletObjectAddresses, D1WalletStore, D1_BATCH_CAS_GUARD_SQL, DEFAULT_SESSION_COOKIE_NAME, DEFAULT_WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_V1, DEFAULT_WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_V1, DEFAULT_WALLET_SESSION_REMAINING_USES, DEFAULT_WALLET_SESSION_TTL_MS, ED25519_SIGNER_ACTIVATION_ID_PATH, InMemoryRouterAbEd25519YaoExportService, InMemoryRouterAbEd25519YaoExportStateV1, InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter, InMemoryRouterAbEd25519YaoRegistrationService, InMemoryRouterAbNormalSigningAdmissionStore, LINKED_DEVICE_OWNER_AUTHORIZATION_PATH_V1, LinkedDeviceRetiredTargetRegistrationShapeErrorV1, LinkedDeviceSourceFamilyUnavailableErrorV1, LinkedDeviceWebAuthnRegistrationVerifierV1, LocalRegistrationSetupAuthority, MAX_WALLET_SESSION_REMAINING_USES, MAX_WALLET_SESSION_TTL_MS, PUBLIC_PROOF_TYPES, ROUTER_AB_ECDSA_DERIVATION_PRIVATE_SIGNING_PATHS, ROUTER_AB_ED25519_PRIVATE_SIGNING_PATHS, ROUTER_AB_ED25519_YAO_CAPABILITY_REPLACEMENT_TABLE_V1, ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_STATUS_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1, ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, ROUTER_AB_MPC_ROUTER_ORIGIN, ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, ROUTER_AB_SIGNING_WORKER_ORIGIN, ROUTER_AB_TRACE_ID_HEADER_V1, ROUTER_API_CREDENTIAL_SCOPES, ROUTE_SERVICE_KEYS, RouterAbEcdsaPresignRuntime, RouterAbEd25519YaoExportOwnerProofAuthorizationAdapter, RouterAbEd25519YaoHttpRegistrationBackend, RouterAbEd25519YaoRecoveryWalletSessionAuthorizationAdapter, SESSION_CAS_GUARD_SQL, SessionService, StaticCloudflareTenantStorageRouteResolver, UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, WALLET_AUTH_METHOD_D1_STORE, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL, WALLET_CONSOLE_API_WALLET_DETAIL_PREFIX_V1, WALLET_CONSOLE_OPS_BASE_PATH_V1, WALLET_CONSOLE_OP_PATHS_V1, WALLET_CONSOLE_SERVICE_ORIGIN_V1, WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_ID_V1, WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_ID_V1, WALLET_CONTROL_AUTH_MARKER_V1, WALLET_CONTROL_BASE_PATH_V1, WALLET_CONTROL_SERVICE_ORIGIN_V1, WALLET_RUNTIME_OPS_BASE_PATH_V1, WALLET_RUNTIME_OP_PATHS_V1, WALLET_RUNTIME_SERVICE_ORIGIN_V1, WALLET_STORE_D1_SCHEMA_SQL, WalletHomeCustodyBinding, WalletLifecycleLocator, WalletObjectAddressSnapshot, WalletPlacementRoutes, abusePrincipalKey, addSecp256k1PublicKeys33, admitD1EstablishedWalletHome, admitRouterAbEcdsaReusableWalletSessionOperation, applyRouteMetering, assertUniqueRouterApiRouteDefinitions, authenticateDeviceLinkingOwnerWalletSessionRequestV1, authenticateRouterAbEcdsaOperationStepUp, authenticateRouterAbWalletOperationStepUp, authenticateRouterAbWalletOperationStepUpIdentity, authorizeRouterAbEcdsaDerivationNormalSigningRoute, authorizeRouterAbEd25519NormalSigningRoute, base64UrlDecode, base64UrlEncode, bindWalletAuthMethodIdentity, bindWalletAuthMethodIdentityV2, buildCorsOrigins, buildRouterAbEcdsaDerivationPrivateSigningWorkerBody, buildRouterAbEcdsaOwnerOperationStepUpPreparation, buildRouterAbEd25519OwnerOperationStepUpPreparation, buildRouterAbEd25519PrivateSigningWorkerBody, buildRouterAbEd25519YaoAddSignerAdmissionRequestV1, buildRouterAbEd25519YaoProductAdmissionRequestV1, buildTenantRootIdentityFromAuthenticatedDeploymentV1, buildVerifiedLinkInputV1, buildVerifiedTargetFactorV1, buildWalletEcdsaSignerRecord, claimRouterAbEcdsaOperationStepUp, coerceLogger, coerceRouterLogger, completeRouterAbEcdsaOperation, computeEip1559TxHash, computeLinkedDeviceSessionClaimDigestV1, computeRouterAbEd25519NormalSigningAdmissionMaterial, computeVerifiedTargetFactorVerificationDigestV1, createCloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1RouterApiAuthService, createCloudflareD1VersionedJsonRecordStore, createCloudflareDurableObjectVersionedJsonRecordStore, createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1, createCloudflareRouter, createCloudflareTenantStorageRoute, createCloudflareWalletGatewayRouterV1, createD1LinkedDeviceOwnerAuthorizationMetadataSourceV1, createD1LinkedDeviceOwnerAuthorizationProviderV1, createD1LinkedDeviceOwnerSourceChildReaderV1, createD1LinkedDeviceRouteServiceV1, createD1LinkedDeviceSessionServiceV1, createD1LinkedDeviceSourceContributionPreparationPlannerV1, createD1LinkedDeviceVerifiedLinkSourceReaderV1, createDeviceLinkingOwnerRequestAuthenticatorV1, createEd25519SessionAdapter, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterApiRuntimeSnapshotConsumer, createRouterAbEcdsaEd25519CeremonyTokenIssuer, createRouterAbEcdsaStrictPostRegistrationPort, createRouterAbEcdsaStrictRegistrationPort, createRouterAbEd25519YaoCeremonyStateStoreV1, createRouterAbEd25519YaoExportModule, createRouterAbEd25519YaoHttpRegistrationBackendFromEnv, createRouterAbEd25519YaoMaterialActivationRefV1, createRouterAbEd25519YaoProductRegistrationCompositionFromPortsV1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, createRouterAbEd25519YaoProductRegistrationRequestScopedRuntimeV1, createRouterAbEd25519YaoProductRegistrationRuntimeV1, createRouterAbEd25519YaoProductRegistrationStateFromPartsV1, createRouterAbEd25519YaoProductRegistrationStateV1, createRouterAbEd25519YaoRegistrationModule, createRouterAbNormalSigningAdmissionAdapter, createRouterAbServiceBindingFetch, createRouterApiModule, createRouterApiRouteDefinitions, createSignerD1DoStorageTarget, createSigningSessionSealOptions, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, createStaticWalletConsoleBindingV1, createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1, createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, createWalletConsoleOpsClient, createWalletConsoleRelayProxyExtensionV1, createWalletControlClientBindings, createWalletRegistrationContextResolver, createWalletRuntimeOpsHandler, d1ChangedRows, d1Integer, d1Number, decideRouterAbEcdsaOwnerOperationAuthorization, decideRouterAbEd25519OwnerOperationAuthorization, decodeEvmBlockHeader, decodeEvmTransactionByHash, decodeEvmTransactionCall, decodeEvmTransactionReceipt, decodeJsonRpcEnvelope, decodeWalletConsoleTenantRootActiveLineageRequestV1, decodeWalletConsoleTenantRootActiveLineageResponseV1, defineRoute, defineRouteExtension, deriveJwtExpiresAtIso, deriveRecoveryCodeLocatorV1FromBytes, digestOpaqueValue, encodeEip1559SignedTxFromSignature65, encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1, encodeRouterAbEd25519YaoProductRegistrationStateV1, encodeSessionJsonSegment, encodeTenantRootIdentityV1, enforceDelegatePolicy, enforceRoutePolicy, ensureEvmCryptoWasm, ensureLeadingSlash, ensureWalletAuthMethodStoreD1Schema, ensureWalletStoreD1Schema, evaluateRouterAbNormalSigningAdmission, executeRouterAbEd25519YaoAdmittedRegistrationV1, executeSignedDelegateWithRelayer, extractBearerCredential, extractRouterApiEnvironmentId, findRouteDefinitionById, findRouteDefinitionForRequest, formatD1ExecStatement, getRouterApiRouteExtensionDefinitions, getRouterApiRouteExtensionRoutes, getRouterApiRouteExtensionsForTransport, handleRouterAbEcdsaDerivationNormalSigningRouteCore, handleRouterAbEd25519YaoExportRequestScopedCloudflareV1, handleRouterAbEd25519YaoRecoveryRequestScopedCloudflareV1, handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1, handleStaticWalletConsoleRequestV1, handleWalletControlRequest, headersToRecord, isD1DatabaseLike, isObject, isPlainObject, json, jsonFailure, keccak256Bytes, linkedDeviceSignerManifestsEqualV1, linkedDeviceX25519RecipientPublicKeyB64uV1, loadCloudflareSignerWasmModule, matchesRouteDefinitionRequest, mergeRouterAbEd25519YaoProductRegistrationStatePartitionV1, mintRouterAbEd25519YaoRegistrationIdentityV1, normalizeBoundedPositiveInteger, normalizeCorsOrigin, normalizeD1RouterApiAuthOptions, normalizeHashToBytes, normalizeLinkedDevicePasskeyTargetConfigurationV1, normalizeLogger, normalizeLowercaseString, normalizeSessionString, normalizeSessionTtlSeconds, normalizeSourceIp, normalizeTrimmedString, normalizeWalletAuthMethod, normalizeWalletAuthMethodV2, parseBooleanFlag, parseBooleanJwtClaim, parseCacheControlMaxAgeSec, parseCsvList, parseD1JsonArrayColumn, parseD1JsonColumn, parseD1JsonObjectColumn, parseD1LinkedDeviceSessionRowV1, parseD1LinkedDeviceSessionTranscriptRowV1, parseGoogleEmailOtpRegistrationAttemptRecord, parseGoogleEmailOtpRegistrationOfferCandidates, parseGoogleJwks, parseGoogleLoginVerifyRequest, parseInstalledEcdsaCustodySnapshotV1, parseJwtAud, parseLinkedDeviceSessionRecordV1, parseOrgId, parseRecoveryCodeLocatorV1, parseRouterAbEcdsaEd25519PrivateJwk, parseRouterAbEcdsaPresignRuntimeConfig, parseRouterAbEcdsaStrictRegistrationTopology, parseRouterAbEd25519NormalSigningScopeV2, parseRouterAbEd25519OperationStepUpScope, parseRouterAbEd25519YaoActivationKeysetFromEnvV1, parseRouterAbEd25519YaoCeremonyKeyV1, parseRouterAbEd25519YaoExportAdmissionEnvelopeV1, parseRouterAbEd25519YaoExportExecuteEnvelopeV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordJsonV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoProductRegistrationStateJsonV1, parseRouterAbEd25519YaoProductRegistrationStateV1, parseRouterAbEd25519YaoRegistrationAdmissionReadV1, parseRouterAbEd25519YaoRegistrationRouterAnswerV1, parseRouterAbEd25519YaoTenantRootWireV1, parseRouterAbOperationStepUpOperation, parseRouterAbPublicKeysetV2, parseRpcHexQuantity, parseRs256JwtForVerification, parseSessionJwt, parseSigningSessionSealRootConfig, parseStaticWalletConsoleBindingConfigV1, parseStoredRouterAbEcdsaPendingActivationV1, parseWalletEd25519SignerRecord, parseWalletId, parseWalletRecoveryOperationId, parseWalletRegistrationContextResponse, parseWalletRegistrationSetupRequest, parseWalletRegistrationSetupReservation, parseWalletRuntimeExecuteSignedDelegateRequest, parseWalletRuntimeExecuteSignedDelegateResponse, parseWalletRuntimeExecuteSignedDelegateResult, parseWalletRuntimeRelayerAccount, parseWalletRuntimeWalletIdentitiesResult, parseWalletRuntimeWalletIdentityRequest, parseWebAuthnRpId, parseWebAuthnSyncChallengeRecord, partitionRouterAbEd25519YaoProductRegistrationStateV1, postRouterAbSigningWorkerJson, prepareD1TenantStatement, prepareD1WalletAuthMethodInsertStatement, prepareD1WalletAuthMethodPutStatement, prepareD1WalletAuthMethodV2PutStatement, prepareD1WalletPutSignerStatement, prepareD1WalletPutSubjectStatement, prepareD1WebAuthnAuthenticatorInsertStatement, prepareD1WebAuthnAuthenticatorPutStatement, projectRouterAbEd25519YaoExactWalletSession, proposeWalletRegistrationSetup, publishableKeyRoutePrincipal, queryD1All, queryD1One, randomTenantRootCreationGrantBytesV1, readD1LinkedDeviceEcdsaSourceV1, readD1LinkedDeviceEd25519SourceV1, readEnvironmentCsv, readEnvironmentString, readJson, registrationPreparationIdFromString, requireD1RouterApiAuthScopeString, requireEnvironmentString, requireNormalizedSessionString, requireRuntimePolicyScope, resolveFreshRouterAbEcdsaMaterialActivation, resolvePublishableKeyApiCredentialAuth, resolveRequestOriginRateLimitKeyFromFetchHeaders, resolveRouterAbEd25519YaoCeremonyKeyFromRequestV1, resolveRuntimeTenantRootLineage, resolveSecretKeyApiCredentialAuth, resolveSourceIpFromFetchHeaders, resolveWalletRegistrationContext, resumeRegistrationDirectoryPublicationsV1, routeError, routeJson, routerAbEcdsaAtomicAuthorizationConfigured, routerAbEcdsaOperationInProgressResult, routerAbEcdsaOwnerOperationFailureResult, routerAbEcdsaRecordedResponse, routerAbEcdsaReplayHttpResponse, routerAbEcdsaReplayResult, routerAbEcdsaReplayUnavailableResult, routerAbEcdsaStrictRegistrationFactsBindingJson, routerAbEcdsaStrictRegistrationRequestBindingJson, routerAbEcdsaStrictRegistrationRequestMatchesFacts, routerAbEd25519OwnerOperationFailureResult, routerAbEd25519YaoAdmittedRegistrationAuthorityV1, routerAbEd25519YaoPartitionedStateAfterStoredCommitV1, routerAbEd25519YaoPersistedCapabilityMatchesLookupV1, routerAbEd25519YaoRegistrationExecutionTimingEntriesV1, routerAbEd25519YaoRegistrationSigningRootIdV1, routerAbEd25519YaoTenantRootWireV1, runRouterAbEd25519YaoProductRegistrationRequestScopedV1, runRouterAbEd25519YaoRegistrationSideEffectV1, runRouterAbEd25519YaoRegistrationTwoPhaseV1, runRouterAbPrewarmScheduledV1, runtimePolicyScopeKey, sameRouterAbEd25519YaoSharedStateCanonicalEncodingV1, secp256k1PrivateKey32ToPublicKey33, secp256k1PublicKey33ToEthereumAddress, secureRandomBase36, secureRandomBase64Url, selectWalletEd25519Signer, sessionJwtTimeClaims, sha256Bytes, sha256BytesSync, signSecp256k1Recoverable, signTenantRootCreationGrantV1, tenantRootIdentityDigestB64uV1, tenantStorageRouteBackendFamily, tenantStorageRouteDiagnostic, toFetchRouteResponse, normalizeOptionalTrimmedString as toOptionalTrimmedString, toResponse, toSessionArrayBufferCopy, unavailableRegistrationContext, validateDelegateExpiryAndNonce, validateGoogleIdTokenClaims, validateRuntimeSnapshotExpectation, validateSecp256k1PublicKey33, verifyGoogleOidcToken, verifyRs256JwtSignature, verifySecp256k1Bip340SignatureAgainstPublicKey33, verifySecp256k1RecoverableSignatureAgainstPublicKey33, walletAuthMethodId, walletAuthMethodV2Id, walletConsoleApiWalletGetRouteDefinitionV1, walletConsoleApiWalletListRouteDefinitionV1, walletConsoleApiWalletSearchRouteDefinitionV1, walletConsoleRelayRouteDefinitionsV1, walletConsoleSignedDelegateRouteDefinitionV1, walletConsoleSponsoredEvmCallRouteDefinitionV1, walletObjectIdentity, walletRegistrationContext, walletRegistrationSetupRequestDigest, webAuthnCredentialIdB64uFromCredential, withCors };
+export { API_CREDENTIAL_ROUTE_SCOPES, API_CREDENTIAL_TYPES, ActionType, CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, CloudflareD1AuthorizationStore, CloudflareD1GoogleEmailOtpRegistrationAttemptStore, CloudflareD1OidcJwksCache, CloudflareD1RouterAbEd25519YaoCapabilityPersistence, CloudflareD1RouterAbNormalSigningAdmissionStore, CloudflareD1VaultProxyStore, CloudflareD1VersionedJsonRecordStore, CloudflareD1VersionedJsonRecordStoreError, CloudflareD1WebAuthnAuthService, CloudflareD1WebAuthnStore, CloudflareDurableObjectVersionedJsonRecordStore, CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1, CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1, CloudflareVersionedJsonRecordStoreError, CrossSiteSessionCookieAdapter, D1IdentityStore, D1LinkedDeviceAuthorityInstallServiceV1, D1LinkedDeviceEd25519ExportRootStoreV1, D1LinkedDeviceRequestProofNonceStoreV1, D1LinkedDeviceSessionStoreV1, D1LinkedDeviceSourceContributionPreparationPlannerV1, D1LinkedDeviceTargetAuthenticatorStoreV1, D1LinkedDeviceTargetCredentialProviderV1, D1LinkedDeviceTargetPlannerV1, D1WalletAuthMethodStore, D1WalletObjectAddresses, D1WalletStore, D1_BATCH_CAS_GUARD_SQL, DEFAULT_SESSION_COOKIE_NAME, DEFAULT_WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_V1, DEFAULT_WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_V1, DEFAULT_WALLET_SESSION_REMAINING_USES, DEFAULT_WALLET_SESSION_TTL_MS, ED25519_SIGNER_ACTIVATION_ID_PATH, InMemoryRouterAbEd25519YaoExportService, InMemoryRouterAbEd25519YaoExportStateV1, InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter, InMemoryRouterAbEd25519YaoRegistrationService, InMemoryRouterAbNormalSigningAdmissionStore, LINKED_DEVICE_OWNER_AUTHORIZATION_PATH_V1, LinkedDeviceRetiredTargetRegistrationShapeErrorV1, LinkedDeviceSourceFamilyUnavailableErrorV1, LinkedDeviceWebAuthnRegistrationVerifierV1, LocalRegistrationSetupAuthority, MAX_WALLET_SESSION_REMAINING_USES, MAX_WALLET_SESSION_TTL_MS, PUBLIC_PROOF_TYPES, ROUTER_AB_ECDSA_DERIVATION_PRIVATE_SIGNING_PATHS, ROUTER_AB_ED25519_PRIVATE_SIGNING_PATHS, ROUTER_AB_ED25519_YAO_CAPABILITY_REPLACEMENT_TABLE_V1, ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_STATUS_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1, ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, ROUTER_AB_MPC_ROUTER_ORIGIN, ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, ROUTER_AB_SIGNING_WORKER_ORIGIN, ROUTER_AB_TRACE_ID_HEADER_V1, ROUTER_API_CREDENTIAL_SCOPES, ROUTE_SERVICE_KEYS, RouterAbEcdsaPresignRuntime, RouterAbEd25519YaoExportOwnerProofAuthorizationAdapter, RouterAbEd25519YaoHttpRegistrationBackend, RouterAbEd25519YaoRecoveryWalletSessionAuthorizationAdapter, SESSION_CAS_GUARD_SQL, SessionService, StaticCloudflareTenantStorageRouteResolver, UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, WALLET_AUTH_METHOD_D1_STORE, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL, WALLET_CONSOLE_API_WALLET_DETAIL_PREFIX_V1, WALLET_CONSOLE_OPS_BASE_PATH_V1, WALLET_CONSOLE_OP_PATHS_V1, WALLET_CONSOLE_SERVICE_ORIGIN_V1, WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_ID_V1, WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_ID_V1, WALLET_CONTROL_AUTH_MARKER_V1, WALLET_CONTROL_BASE_PATH_V1, WALLET_CONTROL_SERVICE_ORIGIN_V1, WALLET_RUNTIME_OPS_BASE_PATH_V1, WALLET_RUNTIME_OP_PATHS_V1, WALLET_RUNTIME_SERVICE_ORIGIN_V1, WALLET_STORE_D1_SCHEMA_SQL, WalletHomeCustodyBinding, WalletLifecycleLocator, WalletObjectAddressSnapshot, WalletPlacementRoutes, abusePrincipalKey, addSecp256k1PublicKeys33, admitD1EstablishedWalletHome, admitRouterAbEcdsaReusableWalletSessionOperation, applyRouteMetering, assertUniqueRouterApiRouteDefinitions, authenticateDeviceLinkingOwnerWalletSessionRequestV1, authenticateRouterAbEcdsaOperationStepUp, authenticateRouterAbWalletOperationStepUp, authenticateRouterAbWalletOperationStepUpIdentity, authorizeRouterAbEcdsaDerivationNormalSigningRoute, authorizeRouterAbEd25519NormalSigningRoute, base64UrlDecode, base64UrlEncode, bindWalletAuthMethodIdentity, bindWalletAuthMethodIdentityV2, buildCorsOrigins, buildRouterAbEcdsaDerivationPrivateSigningWorkerBody, buildRouterAbEcdsaOwnerOperationStepUpPreparation, buildRouterAbEd25519OwnerOperationStepUpPreparation, buildRouterAbEd25519PrivateSigningWorkerBody, buildRouterAbEd25519YaoAddSignerAdmissionRequestV1, buildRouterAbEd25519YaoProductAdmissionRequestV1, buildTenantRootIdentityFromAuthenticatedDeploymentV1, buildVerifiedLinkInputV1, buildVerifiedTargetFactorV1, buildWalletEcdsaSignerRecord, claimRouterAbEcdsaOperationStepUp, coerceLogger, coerceRouterLogger, completeRouterAbEcdsaOperation, computeEip1559TxHash, computeLinkedDeviceSessionClaimDigestV1, computeRouterAbEd25519NormalSigningAdmissionMaterial, computeVerifiedTargetFactorVerificationDigestV1, createCloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1RouterApiAuthService, createCloudflareD1VersionedJsonRecordStore, createCloudflareDurableObjectVersionedJsonRecordStore, createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1, createCloudflareRouter, createCloudflareTenantStorageRoute, createCloudflareWalletGatewayRouterV1, createD1LinkedDeviceOwnerAuthorizationMetadataSourceV1, createD1LinkedDeviceOwnerAuthorizationProviderV1, createD1LinkedDeviceOwnerSourceChildReaderV1, createD1LinkedDeviceRouteServiceV1, createD1LinkedDeviceSessionServiceV1, createD1LinkedDeviceSourceContributionPreparationPlannerV1, createD1LinkedDeviceVerifiedLinkSourceReaderV1, createDeviceLinkingOwnerRequestAuthenticatorV1, createEd25519SessionAdapter, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterApiRuntimeSnapshotConsumer, createRouterAbEcdsaEd25519CeremonyTokenIssuer, createRouterAbEcdsaStrictPostRegistrationPort, createRouterAbEcdsaStrictRegistrationPort, createRouterAbEd25519YaoCeremonyStateStoreV1, createRouterAbEd25519YaoExportModule, createRouterAbEd25519YaoHttpRegistrationBackendFromEnv, createRouterAbEd25519YaoMaterialActivationRefV1, createRouterAbEd25519YaoProductRegistrationCompositionFromPortsV1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, createRouterAbEd25519YaoProductRegistrationRequestScopedRuntimeV1, createRouterAbEd25519YaoProductRegistrationRuntimeV1, createRouterAbEd25519YaoProductRegistrationStateFromPartsV1, createRouterAbEd25519YaoProductRegistrationStateV1, createRouterAbEd25519YaoRegistrationModule, createRouterAbNormalSigningAdmissionAdapter, createRouterAbServiceBindingFetch, createRouterApiModule, createRouterApiRouteDefinitions, createSignerD1DoStorageTarget, createSigningSessionSealOptions, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, createStaticWalletConsoleBindingV1, createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1, createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, createWalletConsoleOpsClient, createWalletConsoleRelayProxyExtensionV1, createWalletControlClientBindings, createWalletRegistrationContextResolver, createWalletRuntimeOpsHandler, d1ChangedRows, d1Integer, d1Number, decideRouterAbEcdsaOwnerOperationAuthorization, decideRouterAbEd25519OwnerOperationAuthorization, decodeEvmBlockHeader, decodeEvmTransactionByHash, decodeEvmTransactionCall, decodeEvmTransactionReceipt, decodeJsonRpcEnvelope, decodeWalletConsoleTenantRootActiveLineageRequestV1, decodeWalletConsoleTenantRootActiveLineageResponseV1, defineRoute, defineRouteExtension, deriveJwtExpiresAtIso, deriveRecoveryCodeLocatorV1FromBytes, digestOpaqueValue, encodeEip1559SignedTxFromSignature65, encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1, encodeRouterAbEd25519YaoProductRegistrationStateV1, encodeSessionJsonSegment, encodeTenantRootIdentityV1, enforceDelegatePolicy, enforceRoutePolicy, ensureEvmCryptoWasm, ensureLeadingSlash, ensureWalletAuthMethodStoreD1Schema, ensureWalletStoreD1Schema, evaluateRouterAbNormalSigningAdmission, executeRouterAbEd25519YaoAdmittedRegistrationV1, executeSignedDelegateWithRelayer, extractBearerCredential, extractRouterApiEnvironmentId, findRouteDefinitionById, findRouteDefinitionForRequest, formatD1ExecStatement, getRouterApiRouteExtensionDefinitions, getRouterApiRouteExtensionRoutes, getRouterApiRouteExtensionsForTransport, handleRouterAbEcdsaDerivationNormalSigningRouteCore, handleRouterAbEd25519YaoExportRequestScopedCloudflareV1, handleRouterAbEd25519YaoRecoveryRequestScopedCloudflareV1, handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1, handleStaticWalletConsoleRequestV1, handleWalletControlRequest, headersToRecord, isD1DatabaseLike, isObject, isPlainObject, json, jsonFailure, keccak256Bytes, linkedDeviceSignerManifestsEqualV1, linkedDeviceX25519RecipientPublicKeyB64uV1, loadCloudflareSignerWasmModule, matchesRouteDefinitionRequest, mergeRouterAbEd25519YaoProductRegistrationStatePartitionV1, mintRouterAbEd25519YaoRegistrationIdentityV1, normalizeBoundedPositiveInteger, normalizeCorsOrigin, normalizeD1RouterApiAuthOptions, normalizeHashToBytes, normalizeLinkedDevicePasskeyTargetConfigurationV1, normalizeLogger, normalizeLowercaseString, normalizeSessionString, normalizeSessionTtlSeconds, normalizeSourceIp, normalizeTrimmedString, normalizeWalletAuthMethod, normalizeWalletAuthMethodV2, parseBooleanFlag, parseBooleanJwtClaim, parseCacheControlMaxAgeSec, parseCsvList, parseD1JsonArrayColumn, parseD1JsonColumn, parseD1JsonObjectColumn, parseD1LinkedDeviceSessionRowV1, parseD1LinkedDeviceSessionTranscriptRowV1, parseExternalAuthConfiguration, parseGoogleEmailOtpRegistrationAttemptRecord, parseGoogleEmailOtpRegistrationOfferCandidates, parseGoogleJwks, parseGoogleLoginVerifyRequest, parseInstalledEcdsaCustodySnapshotV1, parseJwtAud, parseLinkedDeviceSessionRecordV1, parseOrgId, parseRecoveryCodeLocatorV1, parseRouterAbEcdsaEd25519PrivateJwk, parseRouterAbEcdsaPresignRuntimeConfig, parseRouterAbEcdsaStrictRegistrationTopology, parseRouterAbEd25519NormalSigningScopeV2, parseRouterAbEd25519OperationStepUpScope, parseRouterAbEd25519YaoActivationKeysetFromEnvV1, parseRouterAbEd25519YaoCeremonyKeyV1, parseRouterAbEd25519YaoExportAdmissionEnvelopeV1, parseRouterAbEd25519YaoExportExecuteEnvelopeV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordJsonV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoProductRegistrationStateJsonV1, parseRouterAbEd25519YaoProductRegistrationStateV1, parseRouterAbEd25519YaoRegistrationAdmissionReadV1, parseRouterAbEd25519YaoRegistrationRouterAnswerV1, parseRouterAbEd25519YaoTenantRootWireV1, parseRouterAbOperationStepUpOperation, parseRouterAbPublicKeysetV2, parseRpcHexQuantity, parseRs256JwtForVerification, parseSessionJwt, parseSigningSessionSealRootConfig, parseStaticWalletConsoleBindingConfigV1, parseStoredRouterAbEcdsaPendingActivationV1, parseWalletEd25519SignerRecord, parseWalletId, parseWalletRecoveryOperationId, parseWalletRegistrationContextResponse, parseWalletRegistrationSetupRequest, parseWalletRegistrationSetupReservation, parseWalletRuntimeExecuteSignedDelegateRequest, parseWalletRuntimeExecuteSignedDelegateResponse, parseWalletRuntimeExecuteSignedDelegateResult, parseWalletRuntimeRelayerAccount, parseWalletRuntimeWalletIdentitiesResult, parseWalletRuntimeWalletIdentityRequest, parseWebAuthnRpId, parseWebAuthnSyncChallengeRecord, partitionRouterAbEd25519YaoProductRegistrationStateV1, postRouterAbSigningWorkerJson, prepareD1TenantStatement, prepareD1WalletAuthMethodInsertStatement, prepareD1WalletAuthMethodPutStatement, prepareD1WalletAuthMethodV2PutStatement, prepareD1WalletPutSignerStatement, prepareD1WalletPutSubjectStatement, prepareD1WebAuthnAuthenticatorInsertStatement, prepareD1WebAuthnAuthenticatorPutStatement, projectRouterAbEd25519YaoExactWalletSession, proposeWalletRegistrationSetup, publishableKeyRoutePrincipal, queryD1All, queryD1One, randomTenantRootCreationGrantBytesV1, readD1LinkedDeviceEcdsaSourceV1, readD1LinkedDeviceEd25519SourceV1, readEnvironmentCsv, readEnvironmentString, readJson, registrationPreparationIdFromString, requireD1RouterApiAuthScopeString, requireEnvironmentString, requireNormalizedSessionString, requireRuntimePolicyScope, resolveFreshRouterAbEcdsaMaterialActivation, resolvePublishableKeyApiCredentialAuth, resolveRequestOriginRateLimitKeyFromFetchHeaders, resolveRouterAbEd25519YaoCeremonyKeyFromRequestV1, resolveRuntimeTenantRootLineage, resolveSecretKeyApiCredentialAuth, resolveSourceIpFromFetchHeaders, resolveWalletRegistrationContext, resumeRegistrationDirectoryPublicationsV1, routeError, routeJson, routerAbEcdsaAtomicAuthorizationConfigured, routerAbEcdsaOperationInProgressResult, routerAbEcdsaOwnerOperationFailureResult, routerAbEcdsaRecordedResponse, routerAbEcdsaReplayHttpResponse, routerAbEcdsaReplayResult, routerAbEcdsaReplayUnavailableResult, routerAbEcdsaStrictRegistrationFactsBindingJson, routerAbEcdsaStrictRegistrationRequestBindingJson, routerAbEcdsaStrictRegistrationRequestMatchesFacts, routerAbEd25519OwnerOperationFailureResult, routerAbEd25519YaoAdmittedRegistrationAuthorityV1, routerAbEd25519YaoPartitionedStateAfterStoredCommitV1, routerAbEd25519YaoPersistedCapabilityMatchesLookupV1, routerAbEd25519YaoRegistrationExecutionTimingEntriesV1, routerAbEd25519YaoRegistrationSigningRootIdV1, routerAbEd25519YaoTenantRootWireV1, runRouterAbEd25519YaoProductRegistrationRequestScopedV1, runRouterAbEd25519YaoRegistrationSideEffectV1, runRouterAbEd25519YaoRegistrationTwoPhaseV1, runRouterAbPrewarmScheduledV1, runtimePolicyScopeKey, sameRouterAbEd25519YaoSharedStateCanonicalEncodingV1, secp256k1PrivateKey32ToPublicKey33, secp256k1PublicKey33ToEthereumAddress, secureRandomBase36, secureRandomBase64Url, selectWalletEd25519Signer, sessionJwtTimeClaims, sha256Bytes, sha256BytesSync, signSecp256k1Recoverable, signTenantRootCreationGrantV1, tenantRootIdentityDigestB64uV1, tenantStorageRouteBackendFamily, tenantStorageRouteDiagnostic, toFetchRouteResponse, normalizeOptionalTrimmedString as toOptionalTrimmedString, toResponse, toSessionArrayBufferCopy, unavailableRegistrationContext, validateDelegateExpiryAndNonce, validateGoogleIdTokenClaims, validateRuntimeSnapshotExpectation, validateSecp256k1PublicKey33, verifyGoogleOidcToken, verifyRs256JwtSignature, verifySecp256k1Bip340SignatureAgainstPublicKey33, verifySecp256k1RecoverableSignatureAgainstPublicKey33, walletAuthMethodId, walletAuthMethodV2Id, walletConsoleApiWalletGetRouteDefinitionV1, walletConsoleApiWalletListRouteDefinitionV1, walletConsoleApiWalletSearchRouteDefinitionV1, walletConsoleRelayRouteDefinitionsV1, walletConsoleSignedDelegateRouteDefinitionV1, walletConsoleSponsoredEvmCallRouteDefinitionV1, walletObjectIdentity, walletRegistrationContext, walletRegistrationSetupRequestDigest, webAuthnCredentialIdB64uFromCredential, withCors };

package/dist/esm/core/ThresholdService/validation.js

@@ -1,10 +1,10 @@
 import { parseWebAuthnRpId } from "../../shared-ts/src/utils/domainIds.js";
 import { normalizeOptionalString } from "../../shared-ts/src/utils/normalize.js";
 import { isPlainObject } from "../../shared-ts/src/utils/validation.js";
-import { rejectUnknownFields } from "../../shared-ts/src/utils/exactRecord.js";
 import { base64UrlDecode } from "../../shared-ts/src/utils/base64.js";
 import { parseDigestB64u } from "../../shared-ts/src/utils/canonicalPrimitives.js";
 import "../../shared-ts/src/utils/encoders.js";
+import { rejectUnknownFields } from "../../shared-ts/src/utils/exactRecord.js";
 import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority, isVoiceIdWalletAuthAuthority } from "../../shared-ts/src/utils/walletAuthAuthority.js";
 //#region src/core/ThresholdService/validation.ts
 function decodeFixedB64u(value, expectedLength) {

package/dist/esm/core/WebAuthnCredentialBindingStore.js

@@ -1,7 +1,7 @@
 import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
 import { isObject } from "../shared-ts/src/utils/validation.js";
-import { normalizeRuntimePolicyScope } from "../shared-ts/src/threshold/signingRootScope.js";
 import { prepareD1TenantStatement } from "./d1TenantStore.js";
+import { normalizeRuntimePolicyScope } from "../shared-ts/src/threshold/signingRootScope.js";
 //#region src/core/WebAuthnCredentialBindingStore.ts
 const INSERT_CREDENTIAL_BINDING_SQL = `INSERT INTO webauthn_credential_bindings (
         namespace,

package/dist/esm/core/authService/webauthn.js

@@ -1,7 +1,7 @@
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import { base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
-import "../../shared-ts/src/utils/encoders.js";
 import { failure } from "../../shared-ts/src/utils/failure.js";
+import "../../shared-ts/src/utils/encoders.js";
 import { errorMessage } from "../../shared-ts/src/utils/errors.js";
 import { decodeBase64UrlOrBase64, isHostWithinRpId, loadSimpleWebAuthnServer, originHostnameOrEmpty, parseClientDataJsonBase64url } from "./webauthnOidcHelpers.js";
 //#region src/core/authService/webauthn.ts

package/dist/esm/core/d1EcdsaSignerRead.js

@@ -1,8 +1,8 @@
 import { isPlainObject } from "../shared-ts/src/utils/validation.js";
+import { parseD1JsonColumn } from "../storage/d1Sql.js";
 import { sameRouterAbMpcMaterialActivationRef } from "../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { EcdsaMaterialReadSnapshot } from "./ecdsaMaterialReadSnapshot.js";
 import { parseWalletEcdsaSignerRecord } from "./WalletStore.js";
-import { parseD1JsonColumn } from "../storage/d1Sql.js";
 //#region src/core/d1EcdsaSignerRead.ts
 function prepareWalletEcdsaSignersRead(database, scope, walletId) {
 	return database.prepare(`SELECT record_json FROM wallet_signers

package/dist/esm/core/d1WalletAuthMethodStore.js

@@ -1,10 +1,10 @@
 import { parseWebAuthnRpId } from "../shared-ts/src/utils/domainIds.js";
 import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
 import { isPlainObject } from "../shared-ts/src/utils/validation.js";
-import { parseWalletAuthMethodRecordV2, walletAuthMethodRecordId } from "../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { D1_BATCH_CAS_GUARD_SQL, parseD1JsonColumn } from "../storage/d1Sql.js";
-import { walletIdFromString } from "../shared-ts/src/utils/registrationIds.js";
 import { D1Schema, D1TenantTable, ensureD1Schema } from "./d1TenantStore.js";
+import { parseWalletAuthMethodRecordV2, walletAuthMethodRecordId } from "../shared-ts/src/utils/walletAuthMethodRecord.js";
+import { walletIdFromString } from "../shared-ts/src/utils/registrationIds.js";
 //#region src/core/d1WalletAuthMethodStore.ts
 /** Names the wallet auth-method store in D1 scope errors. */
 const WALLET_AUTH_METHOD_D1_STORE = "wallet auth-method store";

package/dist/esm/core/d1WalletStore.js

@@ -1,13 +1,13 @@
 import { parseWalletId } from "../shared-ts/src/utils/domainIds.js";
 import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
 import { isPlainObject } from "../shared-ts/src/utils/validation.js";
+import { D1_BATCH_CAS_GUARD_SQL, formatD1ExecStatement, parseD1JsonColumn } from "../storage/d1Sql.js";
 import { sameRouterAbMpcMaterialActivationRef } from "../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseRouterAbEd25519YaoRecoveryActivationResultV1, parseRouterAbEd25519YaoRecoveryAdmissionRequestV1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationActivationResultV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { normalizeRuntimePolicyScope, signingRootScopeFromRuntimePolicyScope } from "../shared-ts/src/threshold/signingRootScope.js";
 import { sameRouterAbEcdsaDerivationPublicCapabilityV1 } from "../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { thresholdEcdsaChainTargetKey } from "../shared-ts/src/utils/thresholdEcdsaChainTarget.js";
 import { ecdsaPostRegistrationRequestMatchesCapability, parseWalletEcdsaPendingSessionActivationRecord, parseWalletEcdsaSignerRecord } from "./WalletStore.js";
-import { D1_BATCH_CAS_GUARD_SQL, formatD1ExecStatement, parseD1JsonColumn } from "../storage/d1Sql.js";
 import { EcdsaMaterialRead, parseWalletEcdsaSignerRows, prepareWalletEcdsaSignersRead } from "./d1EcdsaSignerRead.js";
 import { normalizeThresholdEd25519ParticipantIds } from "../shared-ts/src/threshold/participants.js";
 //#region src/core/d1WalletStore.ts

package/dist/esm/core/deviceLinking/linkedDeviceEmailOtpGrant.js

@@ -1,10 +1,10 @@
 import { parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseVerifiedEmailAddress, parseWalletAuthMethodId, parseWalletId, parseWebAuthnCredentialIdB64u } from "../../shared-ts/src/utils/domainIds.js";
 import { requireRecord } from "../../shared-ts/src/utils/validation.js";
-import { rejectUnknownFields } from "../../shared-ts/src/utils/exactRecord.js";
 import { base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
 import { sha256BytesUtf8 } from "../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u, sha256Utf8DigestB64u } from "../../shared-ts/src/utils/canonicalPrimitives.js";
 import { parseUnixMs, requireParsed } from "../../shared-ts/src/passkey-custody/primitives.js";
+import { rejectUnknownFields } from "../../shared-ts/src/utils/exactRecord.js";
 //#region src/core/deviceLinking/linkedDeviceEmailOtpGrant.ts
 /**
 * The durable one-time Email OTP verification grant.

package/dist/esm/core/deviceLinking/linkedDeviceManagement.js

@@ -1,6 +1,6 @@
 import { parseLinkedDeviceId, parseWalletAuthorityId } from "../../shared-ts/src/utils/domainIds.js";
-import { buildDelegatedWalletAuthorityV1, buildFullOwnerPermissionsV1, hasDelegatedWalletPermissionV1, sameDelegatedWalletAuthorityV1 } from "../../shared-ts/src/authorization/delegatedAuthority.js";
 import { base64UrlDecode, base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
+import { buildDelegatedWalletAuthorityV1, buildFullOwnerPermissionsV1, hasDelegatedWalletPermissionV1, sameDelegatedWalletAuthorityV1 } from "../../shared-ts/src/authorization/delegatedAuthority.js";
 //#region src/core/deviceLinking/linkedDeviceManagement.ts
 const MAX_LINKED_DEVICE_LIST_LIMIT_V1 = 50;
 var LinkedDeviceListCursorError = class extends Error {

package/dist/esm/core/deviceLinking/linkedDeviceSessionRecord.js

@@ -1,8 +1,8 @@
 import { hasWhitespaceOrControlCharacters, parseLinkDeviceSessionId, parseVerifiedEmailAddress, parseWalletAuthMethodId, parseWalletAuthorityId } from "../../shared-ts/src/utils/domainIds.js";
-import { parseDeviceId } from "../../shared-ts/src/authorization/capabilityKinds.js";
 import { requireRecordCopy } from "../../shared-ts/src/utils/validation.js";
-import { sameDelegatedWalletAuthorityV1 } from "../../shared-ts/src/authorization/delegatedAuthority.js";
 import { parseDigestB64u } from "../../shared-ts/src/utils/canonicalPrimitives.js";
+import { parseDeviceId } from "../../shared-ts/src/authorization/capabilityKinds.js";
+import { sameDelegatedWalletAuthorityV1 } from "../../shared-ts/src/authorization/delegatedAuthority.js";
 import { assertNeverLinkSessionStateV1 } from "../../shared-ts/src/device-linking/contracts.js";
 import { parseExactAdministeredSignerManifestV1 } from "../../shared-ts/src/device-linking/delegatedActivationPlan.js";
 import { parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1 } from "../../shared-ts/src/device-linking/sourceContribution.js";

package/dist/esm/core/nearRelayerAccountProvisioning.js

@@ -1,9 +1,9 @@
 import { coerceNonEmptyString, requireRecordOrArray } from "../shared-ts/src/utils/validation.js";
 import { base64UrlDecode, base64UrlEncode } from "../shared-ts/src/utils/base64.js";
 import { sha256Bytes } from "../shared-ts/src/utils/digests.js";
+import { failure } from "../shared-ts/src/utils/failure.js";
 import { base58Encode } from "../shared-ts/src/utils/base58.js";
 import "../shared-ts/src/utils/encoders.js";
-import { failure } from "../shared-ts/src/utils/failure.js";
 import { ActionType, validateActionArgsWasm } from "../shared-ts/src/near/actions.js";
 import { deriveImplicitNearAccountIdFromEd25519PublicKey, parseImplicitNearAccountId, parseNamedNearAccountId } from "../shared-ts/src/utils/near.js";
 import { errorMessage } from "../shared-ts/src/utils/errors.js";

package/dist/esm/hosted-wallet-gateway.js

@@ -1,10 +1,11 @@
 import { parseWalletId } from "./shared-ts/src/utils/domainIds.js";
-import { parseTenantId } from "./shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlEncode } from "./shared-ts/src/utils/base64.js";
+import { parseD1JsonColumn } from "./storage/d1Sql.js";
+import { parseTenantId } from "./shared-ts/src/authorization/capabilityKinds.js";
 import { parseRouterAbPublicKeysetV2 } from "./shared-ts/src/utils/routerAbPublicKeyset.js";
 import { ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_STATUS_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1 } from "./shared-ts/src/utils/routerAbEd25519Yao.js";
 import { parseSessionOrigin } from "./authorization/domain.js";
-import { parseD1JsonColumn } from "./storage/d1Sql.js";
+import { withCors } from "./router/framework/http.js";
 import { D1WalletStore } from "./core/d1WalletStore.js";
 import { D1WalletAuthMethodStore } from "./core/d1WalletAuthMethodStore.js";
 import { WALLET_OBJECT_ADDRESSES_HEADER, WALLET_OBJECT_IDENTITY_HEADER, walletObjectIdentity, walletObjectIdentityHeaders } from "./router/cloudflare/runtime/walletObjectAddresses.js";
@@ -12,7 +13,6 @@ import { RouterAbEcdsaPresignRuntime } from "./core/routerAbSigning/RouterAbEcds
 import { buildTenantRootIdentityFromAuthenticatedDeploymentV1, decodeTenantRootIdentityWireV1 } from "./shared-ts/src/tenant-root/tenantRootIdentity.js";
 import "./shared-ts/src/tenant-root/index.js";
 import { createWalletConsoleOpsClient } from "./router/cloudflare/runtime/walletConsoleOpsClient.js";
-import { withCors } from "./router/framework/http.js";
 import { createCloudflareWalletGatewayRouterV1 } from "./router/cloudflare/runtime/walletGateway.js";
 import { createWalletRuntimeOpsHandler } from "./router/cloudflare/runtime/walletRuntimeOpsHandler.js";
 import { handleWalletControlRequest } from "./router/cloudflare/runtime/walletControlOps.js";

package/dist/esm/index.js

@@ -1,9 +1,9 @@
 import { parseMpcWalletSigningQuotaId, parseWalletSessionId } from "./shared-ts/src/authorization/capabilityKinds.js";
 import { AUTHORIZED_OPERATION_REPLAY_BODY_MAX_BYTES, authorizedOperationReplayBodyInit, buildActiveWalletSessionQuota, buildAuthorizedOperation, buildExactWalletSessionQuotaProjectionV1, buildPersistedActiveWalletSessionAuthorizationV2, buildWalletSessionAuthorizationV2, buildWalletSessionCapabilitySubjectsV1, computeAuthorizedOperationResultDigest, exactWalletSessionCapabilitySubjectsResolveAuthority, parseAuthorizedOperationReplayResponse, parseHostedWalletSeamsSessionExchangeCode, parseHostedWalletSeamsSessionExchangeNonce, parseHostedWalletSessionCredentialId, parseHostedWalletSessionOperationCredentialToken, parseHostedWalletSessionOperationCredentialV1, parsePrimaryWalletSessionOperationCredentialToken, parseSessionOrigin, parseVerifiedOwnerProofId, parseWalletSessionAuthorizationV2, projectActiveWalletSession, projectExactWalletSessionAuthorizationV1, walletSessionAuthorizationV2RecordsEqual, walletSessionCapabilitySubjectsV1Equal } from "./authorization/domain.js";
 import { AuthorizationService, digestOpaqueValue } from "./authorization/service.js";
+import { SessionService, buildCorsOrigins, parseCsvList } from "./core/SessionService.js";
 import { authorizeSigningSessionSealRequest, buildSigningSessionSealApplyPath, buildSigningSessionSealRemovePath, parseSigningSessionSealApplyBody, parseSigningSessionSealRemoveBody, resolveSigningSessionSealBasePath, signingSessionSealAuthorizeStatusCode, signingSessionSealStatusCode } from "./threshold/session/signingSessionSeal/transport/shared.js";
 import { LocalWorkerVaultProxyGateway, VaultProxyUseService, buildVaultProxyUseOperation, createVaultProxyUseRouteExtension, parseVaultProxyDestination } from "./authorization/vaultProxyUse.js";
-import { SessionService, buildCorsOrigins, parseCsvList } from "./core/SessionService.js";
 import { computeEip1559TxHash, encodeEip1559SignedTxFromSignature65, ensureEvmCryptoWasm, secp256k1PrivateKey32ToPublicKey33, secp256k1PublicKey33ToEthereumAddress, signSecp256k1Recoverable } from "./core/ThresholdService/evmCryptoWasm.js";
 import { buildWalletEd25519SignerId } from "./core/WalletStore.js";
 import { D1WalletStore, WALLET_STORE_D1_SCHEMA_SQL, buildWalletEcdsaSignerRecord, ensureWalletStoreD1Schema } from "./core/d1WalletStore.js";

package/dist/esm/router/auth/webAuthnCredentialCodecs.js

@@ -1,8 +1,8 @@
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import { isPlainObject } from "../../shared-ts/src/utils/validation.js";
 import { base64Decode, base64UrlDecode, base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
-import "../../shared-ts/src/utils/encoders.js";
 import { failure } from "../../shared-ts/src/utils/failure.js";
+import "../../shared-ts/src/utils/encoders.js";
 import { errorMessage } from "../../shared-ts/src/utils/errors.js";
 //#region src/router/auth/webAuthnCredentialCodecs.ts
 function containsWebAuthnExtensionOutput(value) {

package/dist/esm/router/cloudflare/d1/auth/d1RouterApiAuthService.js

@@ -1,6 +1,9 @@
 import { parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseDeviceId, parsePrincipalId, parseTenantId, parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import { sha256BytesPortable, toRecordValue } from "./d1RouterApiAuthBoundary.js";
+import { ExternalAuthService } from "../../../../auth/externalAuthService.js";
+import { ExternalAuthStore } from "../../../../auth/externalAuthStore.js";
+import { parseDeviceId, parsePrincipalId, parseTenantId, parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { parseRouterAbEcdsaRegistrationActivationReceiptV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { D1WalletStore } from "../../../../core/d1WalletStore.js";
 import { D1WalletAuthMethodStore } from "../../../../core/d1WalletAuthMethodStore.js";
@@ -11,7 +14,6 @@ import { parseWebAuthnAuthenticationCredential } from "../../../auth/webAuthnCre
 import { resolveActiveOwnerWalletExecutionLane, resolveWalletAuthMethodIdForAuthority } from "../../../../core/signingLanes/WalletExecutionLaneProjection.js";
 import { DEFAULT_WALLET_SESSION_TTL_MS, LINKED_DEVICE_WALLET_SESSION_TTL_MS } from "../../../../shared-ts/src/threshold/sessionPolicy.js";
 import { createDeviceLinkingOwnerRequestAuthenticatorV1 } from "../../../transport/fetch/routes/deviceLinkingOwnerAuthorization.js";
-import { sha256BytesPortable, toRecordValue } from "./d1RouterApiAuthBoundary.js";
 import { verifyD1LinkedDeviceFreshRevokeProofV1 } from "../wallet/d1WalletAuthMethodBoundary.js";
 import { D1LinkedDeviceAuthorityInstallServiceV1 } from "../deviceLinking/d1LinkedDeviceAuthorityInstallService.js";
 import { D1WalletAuthorityStore } from "../wallet/d1WalletAuthorityStore.js";
@@ -1315,6 +1317,7 @@ function createD1RouterAccountRouteService(assembly) {
 function createCloudflareD1RouterApiAuthService(input) {
 	const assembly = createCloudflareD1RouterApiAuthAssembly(input);
 	return {
+		externalAuth: new ExternalAuthService(new ExternalAuthStore(assembly.options.database, assembly.options), assembly.walletStore, assembly.walletAuthMethodStore),
 		walletExecution: assembly.options.walletExecution,
 		relocationEmailOtp: assembly.relocationEmailOtp,
 		walletRegistration: createD1WalletRegistrationRouteService(assembly),

package/dist/esm/router/cloudflare/d1/authorization/d1AuthorizationStore.js

@@ -1,11 +1,11 @@
 import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { CAPABILITY_KINDS, parseAuthorizationAuditEventId, parseAuthorizationGrantRef, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parseCapabilityOperationRef, parseMpcWalletSigningQuotaId, parsePrincipalId, parseTenantId, parseWalletSessionAuthorizationId, parseWalletSessionId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { D1_BATCH_CAS_GUARD_SQL, d1ChangedRows, parseD1JsonColumn } from "../../../../storage/d1Sql.js";
+import { CAPABILITY_KINDS, parseAuthorizationAuditEventId, parseAuthorizationGrantRef, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parseCapabilityOperationRef, parseMpcWalletSigningQuotaId, parsePrincipalId, parseTenantId, parseWalletSessionAuthorizationId, parseWalletSessionId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { buildCapabilityOperationEnvelope, computeCapabilityOperationFingerprintDigest, parseCapabilityOperationFingerprintDigest } from "../../../../shared-ts/src/authorization/operationFingerprint.js";
 import { routerAbMpcMaterialActivationRefFromWire, routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { buildActiveWalletSessionQuota, buildAuthorizedOperation, buildExactWalletSessionQuotaProjectionV1, computeAuthorizedOperationResultDigest, exactWalletSessionCapabilitySubjectsResolveAuthority, parseAuthorizedOperationReplayResponse, parseHostedWalletSessionCredentialId, parseSessionOrigin, parseWalletSessionAuthorizationV2, walletSessionAuthorizationV2RecordsEqual } from "../../../../authorization/domain.js";
 import { ECDSA_INSTALLATION_SNAPSHOT_COLUMNS } from "../../../../core/ecdsaMaterialReadSnapshot.js";
-import { D1_BATCH_CAS_GUARD_SQL, d1ChangedRows, parseD1JsonColumn } from "../../../../storage/d1Sql.js";
 import { EcdsaMaterialRead } from "../../../../core/d1EcdsaSignerRead.js";
 import { D1WalletStore, ED25519_SIGNER_ACTIVATION_ID_PATH } from "../../../../core/d1WalletStore.js";
 import { normalizeWalletAuthMethodV2 } from "../../../../core/d1WalletAuthMethodStore.js";

package/dist/esm/router/cloudflare/d1/authorization/d1VaultProxyStore.js

@@ -1,8 +1,8 @@
-import { parseCapabilityId, parseTenantId, parseVaultId, parseVaultItemId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
-import { parseVaultProxyDestination } from "../../../../authorization/vaultProxyUse.js";
 import { toArrayBufferCopy } from "../../../../core/authService/portableCrypto.js";
+import { parseCapabilityId, parseTenantId, parseVaultId, parseVaultItemId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { parseVaultProxyDestination } from "../../../../authorization/vaultProxyUse.js";
 //#region src/router/cloudflare/d1/authorization/d1VaultProxyStore.ts
 const VAULT_PROXY_SECRET_AAD_DOMAIN_V1 = "seams:vault:proxy-secret:v1";
 const AES_GCM_NONCE_BYTES = 12;

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService.js

@@ -1,10 +1,11 @@
 import { mpcMaterialActivationRefsEqual, parseLinkDeviceSessionId, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWalletKeyId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseDeviceId, parsePrincipalId, parseTenantId, parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
-import { buildDelegatedWalletAuthorityV1, parseDelegatedWalletPermissionSetV1, validateDelegatedWalletAuthorityAttenuationV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { parseD1JsonColumn } from "../../../../storage/d1Sql.js";
+import { parseDeviceId, parsePrincipalId, parseTenantId, parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { buildDelegatedWalletAuthorityV1, parseDelegatedWalletPermissionSetV1, validateDelegatedWalletAuthorityAttenuationV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { routerAbMpcMaterialActivationRefFromWire, routerAbMpcMaterialActivationRefToWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseRouterAbEd25519YaoApplicationBindingFactsV1, parseRouterAbEd25519YaoCeremonyBindingV1, sameRouterAbEd25519YaoActivationBindingV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { assertLinkedDeviceOrdinaryMaterialSourceContributionMatchesContextV1, parseLinkedDeviceEcdsaSourceContributionPackageV1, parseLinkedDeviceEcdsaSourceDerivationV1, parseLinkedDeviceOrdinaryMaterialSourceContributionV1 } from "../../../../shared-ts/src/device-linking/sourceContribution.js";
@@ -19,7 +20,6 @@ import { computeLinkedDevicePublicKeyDigestV1 } from "../../../../shared-ts/src/
 import { walletSessionAuthorizationV2RecordsEqual } from "../../../../authorization/domain.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { EcdsaMaterialReadSnapshot } from "../../../../core/ecdsaMaterialReadSnapshot.js";
-import { parseD1JsonColumn } from "../../../../storage/d1Sql.js";
 import { parseWalletEcdsaSignerRows, prepareWalletEcdsaSignersRead } from "../../../../core/d1EcdsaSignerRead.js";
 import "../../../../core/deviceLinking/requestProof.js";
 import { reservePasskeyCredential } from "../../../../core/passkeyCredentialClaims.js";

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEd25519ExportRootStore.js

@@ -1,5 +1,5 @@
-import { linkedDeviceEd25519ExportRootMatchesRecipientV1, parseLinkedDeviceEd25519ExportRootPackageV1, parseLinkedDeviceEd25519ExportRootRecipientV1 } from "../../../../shared-ts/src/device-linking/ed25519ExportRoot.js";
 import { d1ChangedRows, queryD1One } from "../../../../storage/d1Sql.js";
+import { linkedDeviceEd25519ExportRootMatchesRecipientV1, parseLinkedDeviceEd25519ExportRootPackageV1, parseLinkedDeviceEd25519ExportRootRecipientV1 } from "../../../../shared-ts/src/device-linking/ed25519ExportRoot.js";
 //#region src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEd25519ExportRootStore.ts
 const TRANSFER_TABLE = "linked_device_ed25519_export_root_transfers";
 var D1LinkedDeviceEd25519ExportRootStoreV1 = class {

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceOwnerAuthorizationProvider.js

@@ -1,10 +1,10 @@
 import { mpcMaterialActivationRefsEqual, parseEcdsaRelayerKeyId, parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseProviderSubject } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseWalletSessionAuthorizationId, parseWalletSessionId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
-import { buildFullOwnerDelegatedWalletAuthorityV1, hasDelegatedWalletPermissionV1, validateDelegatedWalletAuthorityAttenuationV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { parseSecp256k1CompressedPublicKeyB64u } from "../../../../shared-ts/src/passkey-custody/primitives.js";
+import { parseWalletSessionAuthorizationId, parseWalletSessionId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { buildFullOwnerDelegatedWalletAuthorityV1, hasDelegatedWalletPermissionV1, validateDelegatedWalletAuthorityAttenuationV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { deriveRouterAbEd25519YaoApplicationBindingDigestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519YaoDigests.js";
 import { parseRouterAbEd25519YaoActivationBindingV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionStore.js

@@ -1,8 +1,8 @@
 import { hasControlCharacter, parseLinkDeviceSessionId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { d1ChangedRows, queryD1All } from "../../../../storage/d1Sql.js";
 import { assertNeverLinkSessionStateV1 } from "../../../../shared-ts/src/device-linking/contracts.js";
 import { parseLinkedDeviceApprovalV1, parseLinkedDeviceSessionClaimV1 } from "../../../../shared-ts/src/device-linking/parsers.js";
 import { computeLinkedDeviceApprovalDigestV1, computeLinkedDeviceSessionClaimDigestV1 } from "../../../../shared-ts/src/device-linking/digests.js";
-import { d1ChangedRows, queryD1All } from "../../../../storage/d1Sql.js";
 import { requireLinkedDeviceBootstrapRecord } from "../../../../core/deviceLinking/linkedDeviceBootstrap.js";
 import { LinkedDeviceRetiredSessionShapeErrorV1, approvalTranscriptMatchesDigest, claimTranscriptMatchesDigest, conflictResult, integrityResult, invalidStateResult, isPrecommitState, linkedDeviceEmailOtpChallengesEqualV1, linkedDeviceQrPayloadsEqualV1, parseLinkedDeviceSessionRecordV1, sessionExpiryMsV1, sourceContributionTranscriptMatchesDigest } from "../../../../core/deviceLinking/linkedDeviceSessionRecord.js";
 import { parseD1LinkedDeviceSessionRowV1, parseD1LinkedDeviceSessionTranscriptRowV1 } from "./d1LinkedDeviceSessionRecords.js";

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSourceContributionPreparationPlanner.js

@@ -1,7 +1,7 @@
 import { buildMpcMaterialActivationRef, parseMpcMaterialActivationId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { parseSecp256k1CompressedPublicKeyB64u } from "../../../../shared-ts/src/passkey-custody/primitives.js";
+import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { routerAbMpcMaterialActivationRefToWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1 } from "../../../../shared-ts/src/device-linking/sourceContribution.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetAuthenticatorStore.js

@@ -1,6 +1,6 @@
 import { parseWebAuthnCredentialIdB64u } from "../../../../shared-ts/src/utils/domainIds.js";
-import { unknownWebAuthnAuthenticatorDeviceInfo } from "../../../../shared-ts/src/utils/webauthnDeviceInfo.js";
 import { d1ChangedRows } from "../../../../storage/d1Sql.js";
+import { unknownWebAuthnAuthenticatorDeviceInfo } from "../../../../shared-ts/src/utils/webauthnDeviceInfo.js";
 //#region src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetAuthenticatorStore.ts
 const TARGET_CREDENTIAL_TABLE = "linked_device_target_credentials";
 var D1LinkedDeviceTargetAuthenticatorStoreV1 = class {

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetCredentialProvider.js

@@ -3,11 +3,11 @@ import { requireCanonicalString, requireRecord } from "../../../../shared-ts/src
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u, sha256Utf8DigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { d1ChangedRows } from "../../../../storage/d1Sql.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1 } from "../../../../shared-ts/src/device-linking/sourceContribution.js";
 import { parseLinkedDeviceTargetCredentialRegistrationResultV1, parseLinkedDeviceTargetCredentialRegistrationV1, parseLinkedDeviceTargetPreparationV1 } from "../../../../shared-ts/src/device-linking/parsers.js";
 import { assertLinkedDeviceTargetCredentialRegistrationMatchesPreparationV1, computeLinkedDevicePasskeyTargetConfigurationDigestV1, computeLinkedDeviceTargetPreparationDigestV1 } from "../../../../shared-ts/src/device-linking/digests.js";
-import { d1ChangedRows } from "../../../../storage/d1Sql.js";
 import { errorMessage } from "../../../../shared-ts/src/utils/errors.js";
 import { parseClientDataJsonBase64url } from "../../../../core/authService/webauthnOidcHelpers.js";
 import { linkedDeviceX25519RecipientPublicKeyB64uV1 } from "./d1LinkedDeviceSourceContributionPreparationPlanner.js";

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetPlanner.js

@@ -1,6 +1,6 @@
 import { parseWalletAuthMethodId, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { hasDelegatedWalletPermissionV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
+import { hasDelegatedWalletPermissionV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { buildLinkedDeviceTargetPreparationV1 } from "../../../../shared-ts/src/device-linking/parsers.js";
 import { computeLinkedDevicePasskeyTargetConfigurationDigestV1 } from "../../../../shared-ts/src/device-linking/digests.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceVerifiedLinkBuilder.js

@@ -1,9 +1,9 @@
 import { parseWebAuthnCredentialIdB64u } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
-import { buildDelegatedWalletAuthorityV1, validateDelegatedWalletAuthorityAttenuationV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
 import { sha256Utf8DigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { buildDelegatedWalletAuthorityV1, validateDelegatedWalletAuthorityAttenuationV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { buildExactAdministeredSignerManifestV1 } from "../../../../shared-ts/src/device-linking/delegatedActivationPlan.js";
 import { walletAuthorityDigestsMatchV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { sourceKeyManifestDigestForFamilyV1 } from "../../../../core/deviceLinking/linkedDeviceSessionRecord.js";

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceVerifiedLinkSourceReader.js

@@ -1,7 +1,7 @@
 import { mpcMaterialActivationRefsEqual, parseWalletKeyId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseWalletSessionAuthorizationId, parseWalletSessionId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { parseWalletSessionAuthorizationId, parseWalletSessionId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { buildExactAdministeredSignerManifestV1 } from "../../../../shared-ts/src/device-linking/delegatedActivationPlan.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { deriveEvmFamilySigningKeySlotId } from "../../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";

package/dist/esm/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoCapabilityPersistence.js

@@ -1,8 +1,8 @@
 import { mpcMaterialActivationRefsEqual, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseWalletAuthorityV1, replaceActiveWalletAuthorityEd25519MaterialActivationV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { buildWalletSessionAuthorizationV2, buildWalletSessionCapabilitySubjectsV1 } from "../../../../authorization/domain.js";
-import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
 import { parsePersistedWalletSessionAuthorizationV2 } from "../authorization/persistedWalletSessionAuthorization.js";
 import { ed25519NearPublicKeyFromBytes, replaceYaoEd25519WalletSignerActiveCapability } from "./d1Ed25519YaoWalletSigner.js";
 //#region src/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoCapabilityPersistence.ts

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeIssuer.js

@@ -1,6 +1,6 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { failure } from "../../../../shared-ts/src/utils/failure.js";
+import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { emailOtpChallengePurposeIsValid, emailOtpChallengeRecord, generateNumericOtp } from "./d1EmailOtpRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeIssuer.ts

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeService.js

@@ -1,6 +1,6 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { failure } from "../../../../shared-ts/src/utils/failure.js";
+import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { emailOtpGrantRecord, maskEmail, parseEmailOtpLoginOperation } from "./d1EmailOtpRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeService.ts

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeStore.js

@@ -1,5 +1,5 @@
-import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
 import { parseD1NonNegativeCount } from "../auth/d1RouterApiAuthBoundary.js";
+import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
 import { emailOtpChallengeContextValues, emailOtpChallengeWithAttemptCount, parseEmailOtpChallengeRow, parseEmailOtpRegistrationVerificationReceiptV1, parseEmailOtpUnlockChallengeRow } from "./d1EmailOtpRecords.js";
 import { emailOtpChallengeRows, emailOtpUnlockChallengeRows } from "../../../../core/emailOtpD1Statements.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeStore.ts