@seams/wallet-server 0.27.0 → 0.29.0

package/dist/esm/auth/externalAuthStore.js

@@ -0,0 +1,353 @@
+import { requireCanonicalString } from "../shared-ts/src/utils/validation.js";
+import { parseUnixMs } from "../shared-ts/src/passkey-custody/primitives.js";
+import { parseExternalWalletAuthentication, parseStoredExternalIdentity, serializeExternalIdentity } from "../shared-ts/src/auth/externalAuth.js";
+import { d1ChangedRows } from "../storage/d1Sql.js";
+import { prepareD1TenantStatement } from "../core/d1TenantStore.js";
+//#region src/auth/externalAuthStore.ts
+const SCOPE = "namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4";
+const ACTIVE_HOME = `EXISTS (SELECT 1 FROM wallet_execution_generations home
+  WHERE home.namespace = a.namespace AND home.org_id = a.org_id
+    AND home.project_id = a.project_id AND home.env_id = a.env_id
+    AND home.wallet_id = a.wallet_id AND home.state = 'active'
+    AND NOT EXISTS (SELECT 1 FROM wallet_relocation_write_blocks block
+      WHERE block.namespace = home.namespace AND block.org_id = home.org_id
+        AND block.project_id = home.project_id AND block.env_id = home.env_id
+        AND block.wallet_id = home.wallet_id AND block.source_generation = home.generation
+        AND block.state != 'released'))`;
+const LIVE_ASSOCIATION = `EXISTS (
+  SELECT 1 FROM external_auth_associations a
+  JOIN wallet_authorities w ON w.namespace = a.namespace AND w.org_id = a.org_id
+    AND w.project_id = a.project_id AND w.env_id = a.env_id
+    AND w.authority_id = a.authority_id AND w.wallet_id = a.wallet_id
+  WHERE a.namespace = external_auth_attempts.namespace
+    AND a.org_id = external_auth_attempts.org_id
+    AND a.project_id = external_auth_attempts.project_id
+    AND a.env_id = external_auth_attempts.env_id
+    AND a.association_id = external_auth_attempts.association_id
+    AND a.wallet_id = external_auth_attempts.wallet_id AND a.status = 'active'
+    AND w.lifecycle_state = 'active' AND w.revocation_epoch = a.authority_epoch
+    AND ${ACTIVE_HOME}
+)`;
+const AUTHENTICATION_COLUMNS = `attempt_id, association_id, wallet_id, session_expires_at_ms,
+  (SELECT a.provider_subject FROM external_auth_associations a
+   WHERE a.namespace = external_auth_attempts.namespace AND a.org_id = external_auth_attempts.org_id
+     AND a.project_id = external_auth_attempts.project_id AND a.env_id = external_auth_attempts.env_id
+     AND a.association_id = external_auth_attempts.association_id) AS provider_subject`;
+var ExternalAuthStore = class {
+	constructor(database, scope) {
+		this.database = database;
+		this.scope = scope;
+	}
+	prepare(sql, values = []) {
+		return prepareD1TenantStatement(this.database, this.scope, sql, values);
+	}
+	async consumeAuthenticationAllowance(rateKey, nowMs) {
+		return d1ChangedRows(await this.prepare(`INSERT INTO external_auth_rate_limits
+       (namespace, org_id, project_id, env_id, rate_key, consumed_count, reset_at_ms)
+       VALUES (?1, ?2, ?3, ?4, ?5, 1, ?7)
+       ON CONFLICT(namespace, org_id, project_id, env_id, rate_key) DO UPDATE SET
+         consumed_count = CASE WHEN reset_at_ms <= ?6 THEN 1 ELSE consumed_count + 1 END,
+         reset_at_ms = CASE WHEN reset_at_ms <= ?6 THEN ?7 ELSE reset_at_ms END
+       WHERE reset_at_ms <= ?6 OR consumed_count < 120`, [
+			rateKey,
+			nowMs,
+			nowMs + 6e4
+		]).run()) === 1;
+	}
+	async associate(input) {
+		const subject = serializeExternalIdentity(input.identity);
+		const revokePriorAuthority = this.prepare(`UPDATE external_auth_associations SET status = 'revoked'
+       WHERE ${SCOPE} AND wallet_id = ?5 AND provider_subject = ?6 AND status = 'active'
+         AND (authority_id != ?7 OR authority_epoch != ?8)
+         AND EXISTS (SELECT 1 FROM wallet_authorities WHERE ${SCOPE}
+           AND wallet_id = ?5 AND authority_id = ?7 AND lifecycle_state = 'active'
+           AND revocation_epoch = ?8)`, [
+			input.walletId,
+			subject,
+			input.authorityId,
+			input.authorityEpoch
+		]);
+		const createAssociation = this.prepare(`INSERT INTO external_auth_associations
+        (namespace, org_id, project_id, env_id, association_id, wallet_id,
+         provider_subject, authority_id, authority_epoch, status)
+       SELECT ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, 'active'
+       WHERE EXISTS (SELECT 1 FROM wallet_authorities WHERE ${SCOPE}
+         AND authority_id = ?8 AND wallet_id = ?6 AND lifecycle_state = 'active'
+         AND revocation_epoch = ?9)
+       ON CONFLICT(namespace, org_id, project_id, env_id, wallet_id, provider_subject)
+         WHERE status = 'active' DO NOTHING`, [
+			crypto.randomUUID(),
+			input.walletId,
+			subject,
+			input.authorityId,
+			input.authorityEpoch
+		]);
+		const [revoked, inserted] = await this.database.batch([revokePriorAuthority, createAssociation]);
+		if (!revoked?.success || !inserted?.success) throw new Error("Association update failed");
+		if (d1ChangedRows(inserted) === 1) return true;
+		return await this.prepare(`SELECT association_id FROM external_auth_associations WHERE ${SCOPE}
+       AND wallet_id = ?5 AND provider_subject = ?6 AND authority_id = ?7
+       AND authority_epoch = ?8 AND status = 'active'
+       AND EXISTS (SELECT 1 FROM wallet_authorities WHERE ${SCOPE}
+         AND wallet_id = ?5 AND authority_id = ?7 AND lifecycle_state = 'active'
+         AND revocation_epoch = ?8)`, [
+			input.walletId,
+			subject,
+			input.authorityId,
+			input.authorityEpoch
+		]).first() !== null;
+	}
+	async revokeAssociation(input) {
+		await this.prepare(`UPDATE external_auth_associations SET status = 'revoked'
+       WHERE ${SCOPE} AND wallet_id = ?5 AND association_id = ?6
+         AND EXISTS (SELECT 1 FROM wallet_authorities WHERE ${SCOPE}
+           AND wallet_id = ?5 AND authority_id = ?7 AND revocation_epoch = ?8 AND lifecycle_state = 'active')`, [
+			input.walletId,
+			input.associationId,
+			input.owner.authorityId,
+			input.owner.revocationEpoch
+		]).run();
+	}
+	async prepareUnlink(input) {
+		return d1ChangedRows(await this.prepare(`INSERT INTO external_auth_attempts
+       (namespace, org_id, project_id, env_id, attempt_id, wallet_id, origin, binding_hash,
+        session_token_hash, expires_at_ms, status, purpose, association_id, identity_subject, code_hash, trust_revision)
+       SELECT ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, 'verified', 'unlink', ?11, provider_subject, ?12, ?13
+       FROM external_auth_associations WHERE ${SCOPE} AND wallet_id = ?6 AND association_id = ?11`, [
+			input.attemptId,
+			input.walletId,
+			input.originBinding,
+			input.bindingHash,
+			input.sessionTokenHash,
+			input.expiresAtMs,
+			input.associationId,
+			input.codeHash,
+			input.trustRevision
+		]).run()) === 1;
+	}
+	async readOwnerAttempt(input) {
+		const row = await this.prepare(`SELECT purpose, status, identity_subject, association_id, expires_at_ms, owner_challenge_expires_at_ms
+       FROM external_auth_attempts WHERE ${SCOPE} AND wallet_id = ?5 AND attempt_id = ?6
+         AND origin = ?7 AND binding_hash = ?8 AND session_token_hash = ?9 AND code_hash = ?10
+         AND trust_revision = ?11 AND expires_at_ms > ?12 AND status IN ('verified', 'consumed')
+         AND purpose IN ('associate', 'unlink')`, [
+			input.walletId,
+			input.attemptId,
+			input.originBinding,
+			input.bindingHash,
+			input.sessionTokenHash,
+			input.codeHash,
+			input.trustRevision,
+			input.nowMs
+		]).first();
+		if (!row) return null;
+		if (row.status !== "verified" && row.status !== "consumed") throw new Error("Invalid owner attempt state");
+		const status = row.status;
+		const identity = parseStoredExternalIdentity(requireCanonicalString(row.identity_subject, "identity_subject"));
+		const expiresAtMs = parseUnixMs(row.expires_at_ms, "attempt expiry");
+		const challenge = row.owner_challenge_expires_at_ms === null ? { kind: "unprepared" } : {
+			kind: "ready",
+			expiresAtMs: parseUnixMs(row.owner_challenge_expires_at_ms, "owner challenge expiry")
+		};
+		switch (row.purpose) {
+			case "associate": return {
+				purpose: "associate",
+				walletId: input.walletId,
+				attemptId: input.attemptId,
+				identity,
+				originBinding: input.originBinding,
+				trustRevision: input.trustRevision,
+				expiresAtMs,
+				status,
+				challenge
+			};
+			case "unlink": return {
+				purpose: "unlink",
+				walletId: input.walletId,
+				attemptId: input.attemptId,
+				identity,
+				originBinding: input.originBinding,
+				trustRevision: input.trustRevision,
+				expiresAtMs,
+				status,
+				challenge,
+				associationId: requireCanonicalString(row.association_id, "association_id")
+			};
+			default: throw new Error("Invalid owner attempt purpose");
+		}
+	}
+	async prepareOwnerChallenge(input) {
+		await this.prepare(`UPDATE external_auth_attempts
+       SET owner_challenge_expires_at_ms = COALESCE(owner_challenge_expires_at_ms, MIN(expires_at_ms, ?13))
+       WHERE ${SCOPE} AND wallet_id = ?5 AND attempt_id = ?6 AND origin = ?7
+         AND binding_hash = ?8 AND session_token_hash = ?9 AND code_hash = ?10
+         AND trust_revision = ?11 AND expires_at_ms > ?12 AND status = 'verified'
+         AND purpose IN ('associate', 'unlink')`, [
+			input.walletId,
+			input.attemptId,
+			input.originBinding,
+			input.bindingHash,
+			input.sessionTokenHash,
+			input.codeHash,
+			input.trustRevision,
+			input.nowMs,
+			input.nowMs + 6e4
+		]).run();
+		return this.readOwnerAttempt(input);
+	}
+	async consumeOwnerAttempt(input, owner) {
+		return d1ChangedRows(await this.prepare(`UPDATE external_auth_attempts SET status = 'consumed'
+       WHERE ${SCOPE} AND wallet_id = ?5 AND attempt_id = ?6 AND origin = ?7
+         AND binding_hash = ?8 AND session_token_hash = ?9 AND code_hash = ?10
+         AND trust_revision = ?11 AND expires_at_ms > ?12 AND owner_challenge_expires_at_ms > ?12
+         AND status = 'verified' AND purpose IN ('associate', 'unlink')
+         AND EXISTS (SELECT 1 FROM wallet_authorities WHERE ${SCOPE}
+           AND wallet_id = ?5 AND authority_id = ?13 AND revocation_epoch = ?14 AND lifecycle_state = 'active')`, [
+			input.walletId,
+			input.attemptId,
+			input.originBinding,
+			input.bindingHash,
+			input.sessionTokenHash,
+			input.codeHash,
+			input.trustRevision,
+			input.nowMs,
+			owner.authorityId,
+			owner.revocationEpoch
+		]).run()) === 1;
+	}
+	async prepareAttempt(input) {
+		const nowMs = Date.now();
+		await this.database.batch([this.database.prepare(`DELETE FROM external_auth_attempts WHERE rowid IN (
+        SELECT rowid FROM external_auth_attempts
+        WHERE expires_at_ms <= ? AND (session_expires_at_ms IS NULL OR session_expires_at_ms <= ?) LIMIT 100
+      )`).bind(nowMs, nowMs), this.database.prepare(`DELETE FROM external_auth_rate_limits WHERE rowid IN (
+        SELECT rowid FROM external_auth_rate_limits WHERE reset_at_ms <= ? LIMIT 100
+      )`).bind(nowMs)]);
+		await this.prepare(`INSERT INTO external_auth_attempts
+        (namespace, org_id, project_id, env_id, attempt_id, wallet_id, origin,
+         binding_hash, session_token_hash, expires_at_ms, status, purpose)
+       VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, 'prepared', ?11)`, [
+			input.attemptId,
+			input.walletId,
+			input.originBinding,
+			input.bindingHash,
+			input.sessionTokenHash,
+			input.expiresAtMs,
+			input.purpose
+		]).run();
+	}
+	async readPreparedPurpose(walletId, attemptId, nowMs) {
+		const row = await this.prepare(`SELECT purpose FROM external_auth_attempts WHERE ${SCOPE} AND wallet_id = ?5
+         AND attempt_id = ?6 AND status = 'prepared' AND expires_at_ms > ?7`, [
+			walletId,
+			attemptId,
+			nowMs
+		]).first();
+		if (!row) return null;
+		switch (row.purpose) {
+			case "authenticate":
+			case "associate": return row.purpose;
+			default: return null;
+		}
+	}
+	async verifyAttempt(input) {
+		return d1ChangedRows(await this.prepare(`UPDATE external_auth_attempts SET status = 'verified',
+         association_id = (SELECT a.association_id FROM external_auth_associations a
+           JOIN wallet_authorities w ON w.namespace = a.namespace AND w.org_id = a.org_id
+             AND w.project_id = a.project_id AND w.env_id = a.env_id
+             AND w.authority_id = a.authority_id AND w.wallet_id = a.wallet_id
+           WHERE a.namespace = ?1 AND a.org_id = ?2 AND a.project_id = ?3 AND a.env_id = ?4
+             AND a.wallet_id = ?6 AND a.provider_subject = ?7 AND a.status = 'active'
+             AND w.lifecycle_state = 'active' AND w.revocation_epoch = a.authority_epoch
+             AND ${ACTIVE_HOME}),
+         trust_revision = ?8, code_hash = ?9, session_expires_at_ms = ?11, identity_subject = ?7
+       WHERE ${SCOPE} AND attempt_id = ?5 AND wallet_id = ?6
+         AND status = 'prepared' AND expires_at_ms > ?10 AND purpose = ?12
+         AND (purpose = 'associate' OR EXISTS (SELECT 1 FROM external_auth_associations a
+           JOIN wallet_authorities w ON w.namespace = a.namespace AND w.org_id = a.org_id
+             AND w.project_id = a.project_id AND w.env_id = a.env_id
+             AND w.authority_id = a.authority_id AND w.wallet_id = a.wallet_id
+           WHERE a.namespace = ?1 AND a.org_id = ?2 AND a.project_id = ?3 AND a.env_id = ?4
+             AND a.wallet_id = ?6 AND a.provider_subject = ?7 AND a.status = 'active'
+             AND w.lifecycle_state = 'active' AND w.revocation_epoch = a.authority_epoch
+             AND ${ACTIVE_HOME}))`, [
+			input.attemptId,
+			input.walletId,
+			serializeExternalIdentity(input.identity),
+			input.trust.revision,
+			input.codeHash,
+			input.nowMs,
+			input.sessionExpiresAtMs,
+			input.purpose
+		]).run()) === 1;
+	}
+	async redeem(input) {
+		await this.prepare(`UPDATE external_auth_attempts SET status = 'consumed'
+       WHERE ${SCOPE} AND attempt_id = ?5 AND wallet_id = ?6 AND origin = ?7
+         AND binding_hash = ?8 AND session_token_hash = ?9 AND code_hash = ?10
+         AND purpose = 'authenticate' AND status = 'verified' AND expires_at_ms > ?11 AND session_expires_at_ms > ?11
+         AND trust_revision = ?12 AND ${LIVE_ASSOCIATION}`, [
+			input.attemptId,
+			input.walletId,
+			input.originBinding,
+			input.bindingHash,
+			input.sessionTokenHash,
+			input.codeHash,
+			input.nowMs,
+			input.trustRevision
+		]).run();
+		const row = await this.prepare(`SELECT ${AUTHENTICATION_COLUMNS}
+       FROM external_auth_attempts WHERE ${SCOPE} AND attempt_id = ?5 AND wallet_id = ?6
+         AND origin = ?7 AND binding_hash = ?8 AND session_token_hash = ?9 AND code_hash = ?10
+         AND purpose = 'authenticate' AND status = 'consumed' AND session_expires_at_ms > ?11 AND trust_revision = ?12 AND ${LIVE_ASSOCIATION}`, [
+			input.attemptId,
+			input.walletId,
+			input.originBinding,
+			input.bindingHash,
+			input.sessionTokenHash,
+			input.codeHash,
+			input.nowMs,
+			input.trustRevision
+		]).first();
+		return row ? this.authentication(row) : null;
+	}
+	async readSession(input) {
+		const row = await this.prepare(`SELECT ${AUTHENTICATION_COLUMNS}
+       FROM external_auth_attempts WHERE ${SCOPE} AND session_token_hash = ?5 AND origin = ?6
+         AND purpose = 'authenticate' AND status = 'consumed' AND session_expires_at_ms > ?7
+         AND trust_revision = ?8 AND ${LIVE_ASSOCIATION}`, [
+			input.tokenHash,
+			input.originBinding,
+			input.nowMs,
+			input.trustRevision
+		]).first();
+		return row ? this.authentication(row) : null;
+	}
+	async revokeSession(tokenHash, originBinding) {
+		await this.prepare(`UPDATE external_auth_attempts SET status = 'revoked'
+       WHERE ${SCOPE} AND session_token_hash = ?5 AND origin = ?6`, [tokenHash, originBinding]).run();
+	}
+	async devices(walletId) {
+		const result = await this.prepare(`SELECT DISTINCT device_id FROM wallet_authorities WHERE ${SCOPE}
+       AND wallet_id = ?5 AND lifecycle_state = 'active' ORDER BY device_id`, [walletId]).all();
+		const devices = [];
+		for (const row of result.results || []) devices.push({ id: requireCanonicalString(row.device_id, "device_id") });
+		return devices;
+	}
+	authentication(row) {
+		return parseExternalWalletAuthentication({
+			kind: "external_authenticated",
+			walletId: row.wallet_id,
+			sessionId: row.attempt_id,
+			associationId: row.association_id,
+			environmentId: this.scope.envId,
+			provider: parseStoredExternalIdentity(requireCanonicalString(row.provider_subject, "provider_subject")).provider,
+			permission: "wallet_settings_read",
+			expiresAtMs: parseUnixMs(row.session_expires_at_ms, "session expiry")
+		});
+	}
+};
+//#endregion
+export { ExternalAuthStore };
+
+//# sourceMappingURL=externalAuthStore.js.map

package/dist/esm/auth/externalOwnerOperations.js

@@ -0,0 +1,82 @@
+import { externalAuthFailure, serializeExternalIdentity } from "../shared-ts/src/auth/externalAuth.js";
+import { computeWalletOwnerAdminChallengeDigest } from "../shared-ts/src/authorization/walletOwnerOperation.js";
+//#region src/auth/externalOwnerOperations.ts
+async function readExternalOwnerOperation(input) {
+	const attempt = input.phase === "prepare" ? await input.store.prepareOwnerChallenge(input.binding) : await input.store.readOwnerAttempt(input.binding);
+	if (!attempt) return externalAuthFailure("access_denied");
+	if (attempt.challenge.kind !== "ready") return externalAuthFailure("access_denied");
+	if (attempt.status === "verified" && attempt.challenge.expiresAtMs <= input.binding.nowMs) return externalAuthFailure("expired");
+	const identity = serializeExternalIdentity(attempt.identity);
+	let operation;
+	let payload;
+	switch (attempt.purpose) {
+		case "associate":
+			operation = "external_identity_associate";
+			payload = {
+				attemptId: attempt.attemptId,
+				identity,
+				originBinding: attempt.originBinding,
+				revision: attempt.trustRevision,
+				expiresAtMs: attempt.challenge.expiresAtMs
+			};
+			break;
+		case "unlink":
+			operation = "external_identity_unlink";
+			payload = {
+				attemptId: attempt.attemptId,
+				associationId: attempt.associationId,
+				identity,
+				originBinding: attempt.originBinding,
+				revision: attempt.trustRevision,
+				expiresAtMs: attempt.challenge.expiresAtMs
+			};
+			break;
+		default: return assertNever(attempt);
+	}
+	const challengeB64u = await computeWalletOwnerAdminChallengeDigest({
+		walletId: attempt.walletId,
+		operation,
+		payload,
+		requestOrigin: input.requestOrigin
+	});
+	return {
+		ok: true,
+		value: {
+			attempt,
+			operation,
+			payload,
+			challengeB64u
+		}
+	};
+}
+function externalOwnerChallenge(operation) {
+	const attempt = operation.attempt;
+	if (attempt.challenge.kind !== "ready") throw new Error("Owner challenge is not prepared");
+	switch (attempt.purpose) {
+		case "associate": return {
+			kind: "associate",
+			walletId: attempt.walletId,
+			attemptId: attempt.attemptId,
+			identity: attempt.identity,
+			challengeB64u: operation.challengeB64u,
+			expiresAtMs: attempt.challenge.expiresAtMs
+		};
+		case "unlink": return {
+			kind: "unlink",
+			walletId: attempt.walletId,
+			attemptId: attempt.attemptId,
+			associationId: attempt.associationId,
+			identity: attempt.identity,
+			challengeB64u: operation.challengeB64u,
+			expiresAtMs: attempt.challenge.expiresAtMs
+		};
+		default: return assertNever(attempt);
+	}
+}
+function assertNever(value) {
+	throw new Error(`Unsupported external owner operation: ${String(value)}`);
+}
+//#endregion
+export { externalOwnerChallenge, readExternalOwnerOperation };
+
+//# sourceMappingURL=externalOwnerOperations.js.map

package/dist/esm/authorization/domain.js

@@ -1,11 +1,11 @@
 import { mpcMaterialActivationRefsEqual, parseMpcMaterialActivationRef, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId } from "../shared-ts/src/utils/domainIds.js";
-import { parseMpcWalletSigningQuotaId, parsePrincipalId, parseTenantId, parseWalletSessionAuthorizationId, parseWalletSessionId, parseWalletSessionMintId } from "../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlEncode } from "../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../shared-ts/src/utils/canonicalPrimitives.js";
+import "../shared-ts/src/utils/encoders.js";
+import { parseMpcWalletSigningQuotaId, parsePrincipalId, parseTenantId, parseWalletSessionAuthorizationId, parseWalletSessionId, parseWalletSessionMintId } from "../shared-ts/src/authorization/capabilityKinds.js";
 import { parseActiveWalletSessionV1, parseWalletSessionHome } from "../shared-ts/src/device-linking/activeWalletSession.js";
 import { computeCapabilityOperationFingerprintDigest } from "../shared-ts/src/authorization/operationFingerprint.js";
-import "../shared-ts/src/utils/encoders.js";
 import "../shared-ts/src/device-linking/index.js";
 //#region src/authorization/domain.ts
 function buildExactWalletSessionQuotaProjectionV1(fields) {

package/dist/esm/authorization/factorEvidence.js

@@ -1,7 +1,7 @@
 import { parseProviderSubject } from "../shared-ts/src/utils/domainIds.js";
-import { AUTHORIZATION_EVIDENCE_KINDS } from "../shared-ts/src/authorization/capabilityKinds.js";
 import { alphabetizeStringify } from "../shared-ts/src/utils/digests.js";
 import { sha256Utf8DigestB64u } from "../shared-ts/src/utils/canonicalPrimitives.js";
+import { AUTHORIZATION_EVIDENCE_KINDS } from "../shared-ts/src/authorization/capabilityKinds.js";
 import { computeCapabilityOperationFingerprintDigest } from "../shared-ts/src/authorization/operationFingerprint.js";
 //#region src/authorization/factorEvidence.ts
 const FACTOR_EVIDENCE_DIGEST_DOMAIN_V1 = "seams:authorization:factor-evidence:v1";

package/dist/esm/authorization/service.js

@@ -1,9 +1,9 @@
-import { parseHostedWalletSessionExchangeCodeId, parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId } from "../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlEncode } from "../shared-ts/src/utils/base64.js";
 import { sha256BytesUtf8 } from "../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../shared-ts/src/utils/canonicalPrimitives.js";
-import { parseWalletSessionOperationCredentialV1 } from "../shared-ts/src/device-linking/activeWalletSession.js";
 import "../shared-ts/src/utils/encoders.js";
+import { parseHostedWalletSessionExchangeCodeId, parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId } from "../shared-ts/src/authorization/capabilityKinds.js";
+import { parseWalletSessionOperationCredentialV1 } from "../shared-ts/src/device-linking/activeWalletSession.js";
 import { buildActiveWalletSessionQuota, buildPersistedActiveWalletSessionAuthorizationV2, buildWalletSessionAuthorizationV2, buildWalletSessionCapabilitySubjectsV1, parseHostedWalletSeamsSessionExchangeCode, parseHostedWalletSeamsSessionExchangeNonce, parseHostedWalletSessionCredentialId, parseHostedWalletSessionOperationCredentialV1, parsePrimaryWalletSessionOperationCredentialToken, walletSessionCapabilitySubjectsV1Equal } from "./domain.js";
 import { buildVerifiedOwnerProof, buildVerifiedWalletOperationFactorEvidenceSet } from "./factorEvidence.js";
 import { secureRandomBase64Url } from "../shared-ts/src/utils/secureRandomId.js";

package/dist/esm/authorization/vaultProxyUse.js

@@ -1,6 +1,6 @@
-import { buildVaultOperationRef, parseAuthorizationAuditEventId, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parsePrincipalId, parseTenantId, parseVaultId, parseVaultItemId } from "../shared-ts/src/authorization/capabilityKinds.js";
 import { alphabetizeStringify } from "../shared-ts/src/utils/digests.js";
 import { parseDigestB64u, sha256Utf8DigestB64u } from "../shared-ts/src/utils/canonicalPrimitives.js";
+import { buildVaultOperationRef, parseAuthorizationAuditEventId, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parsePrincipalId, parseTenantId, parseVaultId, parseVaultItemId } from "../shared-ts/src/authorization/capabilityKinds.js";
 import { buildCapabilityOperationEnvelope } from "../shared-ts/src/authorization/operationFingerprint.js";
 import { AUTHORIZED_OPERATION_REPLAY_BODY_MAX_BYTES, authorizedOperationReplayBodyInit } from "./domain.js";
 import { hasExactKeys } from "../shared-ts/src/utils/exactKeys.js";

package/dist/esm/cloud-host.js

@@ -3,22 +3,30 @@ import { ensureLeadingSlash, normalizeBoundedPositiveInteger, normalizeLowercase
 import { isObject, isPlainObject } from "./shared-ts/src/utils/validation.js";
 import { base64UrlDecode, base64UrlEncode } from "./shared-ts/src/utils/base64.js";
 import { sha256Bytes } from "./shared-ts/src/utils/digests.js";
+import { parseExternalAuthConfiguration, parseExternalAuthProvider } from "./shared-ts/src/auth/externalAuth.js";
 import "./shared-ts/src/utils/encoders.js";
+import { CloudflareD1OidcJwksCache, parseBooleanJwtClaim, parseCacheControlMaxAgeSec, parseGoogleJwks, parseJwtAud, parseRs256JwtForVerification, validateGoogleIdTokenClaims, verifyRs256JwtSignature } from "./router/cloudflare/d1/oidc/d1OidcBoundary.js";
+import { verifyGoogleOidcToken } from "./router/cloudflare/d1/oidc/googleOidcToken.js";
+import { D1_BATCH_CAS_GUARD_SQL, d1ChangedRows, d1Integer, d1Number, formatD1ExecStatement, isD1DatabaseLike, parseD1JsonArrayColumn, parseD1JsonColumn, parseD1JsonObjectColumn, queryD1All, queryD1One } from "./storage/d1Sql.js";
+import { prepareD1TenantStatement } from "./core/d1TenantStore.js";
 import { ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, parseRouterAbPublicKeysetV2 } from "./shared-ts/src/utils/routerAbPublicKeyset.js";
 import { ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_STATUS_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1 } from "./shared-ts/src/utils/routerAbEd25519Yao.js";
 import { computeLinkedDeviceSessionClaimDigestV1 } from "./shared-ts/src/device-linking/digests.js";
 import { WalletLifecycleLocator } from "./authorization/lifecycleRouting.js";
 import { secureRandomBase36, secureRandomBase64Url } from "./shared-ts/src/utils/secureRandomId.js";
 import { digestOpaqueValue } from "./authorization/service.js";
+import { webAuthnCredentialIdB64uFromCredential } from "./router/auth/webAuthnCredentialCodecs.js";
+import { routeError, routeJson, toFetchRouteResponse } from "./router/framework/routeResponses.js";
+import { extractBearerCredential, extractRouterApiEnvironmentId, normalizeSourceIp, resolveRequestOriginRateLimitKeyFromFetchHeaders, resolveSourceIpFromFetchHeaders } from "./router/auth/routerApiKeyAuth.js";
+import { SessionService, buildCorsOrigins, normalizeCorsOrigin, parseCsvList } from "./core/SessionService.js";
+import { ROUTER_AB_TRACE_ID_HEADER_V1 } from "./shared-ts/src/utils/routerAbTraceContext.js";
+import { headersToRecord, json, jsonFailure, readJson, toResponse, withCors } from "./router/framework/http.js";
 import { ROUTER_API_CREDENTIAL_SCOPES } from "./router/framework/apiCredentialPorts.js";
 import { API_CREDENTIAL_ROUTE_SCOPES, API_CREDENTIAL_TYPES, PUBLIC_PROOF_TYPES } from "./router/framework/routeAuthPolicy.js";
 import { ROUTE_SERVICE_KEYS } from "./router/framework/routeExecutionContext.js";
 import { createRouterApiRouteDefinitions, defineRoute, defineRouteExtension, findRouteDefinitionById, findRouteDefinitionForRequest, matchesRouteDefinitionRequest } from "./router/framework/routeDefinitions.js";
-import { SessionService, buildCorsOrigins, normalizeCorsOrigin, parseCsvList } from "./core/SessionService.js";
 import { addSecp256k1PublicKeys33, computeEip1559TxHash, encodeEip1559SignedTxFromSignature65, ensureEvmCryptoWasm, secp256k1PrivateKey32ToPublicKey33, secp256k1PublicKey33ToEthereumAddress, sha256BytesSync, signSecp256k1Recoverable, validateSecp256k1PublicKey33, verifySecp256k1Bip340SignatureAgainstPublicKey33, verifySecp256k1RecoverableSignatureAgainstPublicKey33 } from "./core/ThresholdService/evmCryptoWasm.js";
-import { D1_BATCH_CAS_GUARD_SQL, d1ChangedRows, d1Integer, d1Number, formatD1ExecStatement, isD1DatabaseLike, parseD1JsonArrayColumn, parseD1JsonColumn, parseD1JsonObjectColumn, queryD1All, queryD1One } from "./storage/d1Sql.js";
 import { D1WalletStore, ED25519_SIGNER_ACTIVATION_ID_PATH, WALLET_STORE_D1_SCHEMA_SQL, buildWalletEcdsaSignerRecord, ensureWalletStoreD1Schema, parseWalletEd25519SignerRecord, prepareD1WalletPutSignerStatement, prepareD1WalletPutSubjectStatement, selectWalletEd25519Signer } from "./core/d1WalletStore.js";
-import { prepareD1TenantStatement } from "./core/d1TenantStore.js";
 import { D1WalletAuthMethodStore, WALLET_AUTH_METHOD_D1_STORE, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL, bindWalletAuthMethodIdentity, bindWalletAuthMethodIdentityV2, ensureWalletAuthMethodStoreD1Schema, normalizeWalletAuthMethod, normalizeWalletAuthMethodV2, prepareD1WalletAuthMethodInsertStatement, prepareD1WalletAuthMethodPutStatement, prepareD1WalletAuthMethodV2PutStatement, walletAuthMethodId, walletAuthMethodV2Id } from "./core/d1WalletAuthMethodStore.js";
 import { coerceLogger, normalizeLogger } from "./core/logger.js";
 import { WalletObjectAddressSnapshot, walletObjectIdentity } from "./router/cloudflare/runtime/walletObjectAddresses.js";
@@ -29,11 +37,8 @@ import { enforceDelegatePolicy, executeSignedDelegateWithRelayer, normalizeHashT
 import { parseWalletRegistrationSetupReservation, proposeWalletRegistrationSetup, walletRegistrationSetupRequestDigest } from "./router/domains/walletRegistration/walletRegistrationReservation.js";
 import { LocalRegistrationSetupAuthority } from "./localRegistrationSetupAuthority.js";
 import { createWalletRegistrationContextResolver, unavailableRegistrationContext, walletRegistrationContext } from "./router/auth/walletRegistrationContext.js";
-import { extractBearerCredential, extractRouterApiEnvironmentId, normalizeSourceIp, resolveRequestOriginRateLimitKeyFromFetchHeaders, resolveSourceIpFromFetchHeaders } from "./router/auth/routerApiKeyAuth.js";
 import { publishableKeyRoutePrincipal, resolvePublishableKeyApiCredentialAuth, resolveSecretKeyApiCredentialAuth, resolveWalletRegistrationContext } from "./router/auth/routerApiCredentialAuth.js";
 import { enforceRoutePolicy } from "./router/framework/enforceRoutePolicy.js";
-import { routeError, routeJson, toFetchRouteResponse } from "./router/framework/routeResponses.js";
-import { ROUTER_AB_TRACE_ID_HEADER_V1 } from "./shared-ts/src/utils/routerAbTraceContext.js";
 import { parseWalletRegistrationSetupRequest } from "./router/domains/walletRegistration/walletRegistrationRoutes.js";
 import { applyRouteMetering } from "./router/framework/applyRouteMetering.js";
 import { InMemoryRouterAbNormalSigningAdmissionStore, abusePrincipalKey, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createRouterAbNormalSigningAdmissionAdapter, runtimePolicyScopeKey } from "./router/domains/signingOperations/routerAbNormalSigningAdmissionCore.js";
@@ -43,8 +48,6 @@ import { coerceRouterLogger } from "./router/framework/logger.js";
 import { buildTenantRootIdentityFromAuthenticatedDeploymentV1, encodeTenantRootIdentityV1 } from "./shared-ts/src/tenant-root/tenantRootIdentity.js";
 import { WALLET_CONSOLE_OPS_BASE_PATH_V1, WALLET_CONSOLE_OP_PATHS_V1, WALLET_CONSOLE_SERVICE_ORIGIN_V1, decodeWalletConsoleTenantRootActiveLineageRequestV1, decodeWalletConsoleTenantRootActiveLineageResponseV1 } from "./router/cloudflare/runtime/walletConsoleOps.js";
 import { createWalletConsoleOpsClient, parseWalletRegistrationContextResponse } from "./router/cloudflare/runtime/walletConsoleOpsClient.js";
-import { headersToRecord, json, jsonFailure, readJson, toResponse, withCors } from "./router/framework/http.js";
-import { webAuthnCredentialIdB64uFromCredential } from "./router/auth/webAuthnCredentialCodecs.js";
 import { deriveRecoveryCodeLocatorV1FromBytes, parseRecoveryCodeLocatorV1 } from "./shared-ts/src/wallet-recovery/recoveryCodeLocator.js";
 import { evaluateRouterAbNormalSigningAdmission } from "./router/domains/signingOperations/routerAbNormalSigningAdmission.js";
 import { authenticateRouterAbWalletOperationStepUpIdentity } from "./router/domains/signingOperations/routerAbOperationStepUp.js";
@@ -100,7 +103,6 @@ import { runRouterAbEd25519YaoRegistrationSideEffectV1 } from "./router/domains/
 import { CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1, CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1, createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1, createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1 } from "./router/cloudflare/signingLanes/cloudflareOrdinaryInactiveSignerMaterialReservation.js";
 import "./router/cloudflare-adaptor.js";
 import { CloudflareD1RouterAbEd25519YaoCapabilityPersistence, ROUTER_AB_ED25519_YAO_CAPABILITY_REPLACEMENT_TABLE_V1 } from "./router/cloudflare/d1/ed25519Yao/d1Ed25519YaoCapabilityPersistence.js";
-import { CloudflareD1OidcJwksCache, parseBooleanJwtClaim, parseCacheControlMaxAgeSec, parseGoogleJwks, parseJwtAud, parseRs256JwtForVerification, validateGoogleIdTokenClaims, verifyRs256JwtSignature } from "./router/cloudflare/d1/oidc/d1OidcBoundary.js";
 import { createSigningSessionSealOptions, parseSigningSessionSealRootConfig } from "./threshold/session/signingSessionSeal/options.js";
 import { normalizeD1RouterApiAuthOptions, normalizeLinkedDevicePasskeyTargetConfigurationV1, parseBooleanFlag, requireD1RouterApiAuthScopeString } from "./router/cloudflare/d1/auth/d1RouterApiAuthConfig.js";
 import { decodeJsonRpcEnvelope } from "./shared-ts/src/utils/jsonRpc.js";
@@ -108,7 +110,6 @@ import { createRouterAbEcdsaEd25519CeremonyTokenIssuer, createRouterAbEcdsaStric
 import { parseGoogleEmailOtpRegistrationAttemptRecord, parseGoogleEmailOtpRegistrationOfferCandidates, requireRuntimePolicyScope } from "./router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationRecords.js";
 import { CloudflareD1GoogleEmailOtpRegistrationAttemptStore } from "./router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationAttemptStore.js";
 import { D1IdentityStore } from "./core/d1IdentityStore.js";
-import { verifyGoogleOidcToken } from "./router/cloudflare/d1/oidc/googleOidcToken.js";
 import { D1LinkedDeviceEd25519ExportRootStoreV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceEd25519ExportRootStore.js";
 import { D1LinkedDeviceRequestProofNonceStoreV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceRequestProofNonceStore.js";
 import { createD1LinkedDeviceSessionServiceV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionService.js";
@@ -131,4 +132,4 @@ import { handleRouterAbEd25519YaoRecoveryRequestScopedCloudflareV1 } from "./rou
 import { RouterAbEd25519YaoRecoveryWalletSessionAuthorizationAdapter } from "./router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryWalletSessionAuthorization.js";
 import { keccak256Bytes } from "./shared-ts/src/utils/keccak.js";
 import { decodeEvmBlockHeader, decodeEvmTransactionByHash, decodeEvmTransactionCall, decodeEvmTransactionReceipt, parseRpcHexQuantity } from "./shared-ts/src/utils/evmRpcResults.js";
-export { API_CREDENTIAL_ROUTE_SCOPES, API_CREDENTIAL_TYPES, ActionType, CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, CloudflareD1AuthorizationStore, CloudflareD1GoogleEmailOtpRegistrationAttemptStore, CloudflareD1OidcJwksCache, CloudflareD1RouterAbEd25519YaoCapabilityPersistence, CloudflareD1RouterAbNormalSigningAdmissionStore, CloudflareD1VaultProxyStore, CloudflareD1VersionedJsonRecordStore, CloudflareD1VersionedJsonRecordStoreError, CloudflareD1WebAuthnAuthService, CloudflareD1WebAuthnStore, CloudflareDurableObjectVersionedJsonRecordStore, CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1, CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1, CloudflareVersionedJsonRecordStoreError, CrossSiteSessionCookieAdapter, D1IdentityStore, D1LinkedDeviceAuthorityInstallServiceV1, D1LinkedDeviceEd25519ExportRootStoreV1, D1LinkedDeviceRequestProofNonceStoreV1, D1LinkedDeviceSessionStoreV1, D1LinkedDeviceSourceContributionPreparationPlannerV1, D1LinkedDeviceTargetAuthenticatorStoreV1, D1LinkedDeviceTargetCredentialProviderV1, D1LinkedDeviceTargetPlannerV1, D1WalletAuthMethodStore, D1WalletObjectAddresses, D1WalletStore, D1_BATCH_CAS_GUARD_SQL, DEFAULT_SESSION_COOKIE_NAME, DEFAULT_WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_V1, DEFAULT_WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_V1, DEFAULT_WALLET_SESSION_REMAINING_USES, DEFAULT_WALLET_SESSION_TTL_MS, ED25519_SIGNER_ACTIVATION_ID_PATH, InMemoryRouterAbEd25519YaoExportService, InMemoryRouterAbEd25519YaoExportStateV1, InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter, InMemoryRouterAbEd25519YaoRegistrationService, InMemoryRouterAbNormalSigningAdmissionStore, LINKED_DEVICE_OWNER_AUTHORIZATION_PATH_V1, LinkedDeviceRetiredTargetRegistrationShapeErrorV1, LinkedDeviceSourceFamilyUnavailableErrorV1, LinkedDeviceWebAuthnRegistrationVerifierV1, LocalRegistrationSetupAuthority, MAX_WALLET_SESSION_REMAINING_USES, MAX_WALLET_SESSION_TTL_MS, PUBLIC_PROOF_TYPES, ROUTER_AB_ECDSA_DERIVATION_PRIVATE_SIGNING_PATHS, ROUTER_AB_ED25519_PRIVATE_SIGNING_PATHS, ROUTER_AB_ED25519_YAO_CAPABILITY_REPLACEMENT_TABLE_V1, ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_STATUS_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1, ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, ROUTER_AB_MPC_ROUTER_ORIGIN, ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, ROUTER_AB_SIGNING_WORKER_ORIGIN, ROUTER_AB_TRACE_ID_HEADER_V1, ROUTER_API_CREDENTIAL_SCOPES, ROUTE_SERVICE_KEYS, RouterAbEcdsaPresignRuntime, RouterAbEd25519YaoExportOwnerProofAuthorizationAdapter, RouterAbEd25519YaoHttpRegistrationBackend, RouterAbEd25519YaoRecoveryWalletSessionAuthorizationAdapter, SESSION_CAS_GUARD_SQL, SessionService, StaticCloudflareTenantStorageRouteResolver, UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, WALLET_AUTH_METHOD_D1_STORE, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL, WALLET_CONSOLE_API_WALLET_DETAIL_PREFIX_V1, WALLET_CONSOLE_OPS_BASE_PATH_V1, WALLET_CONSOLE_OP_PATHS_V1, WALLET_CONSOLE_SERVICE_ORIGIN_V1, WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_ID_V1, WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_ID_V1, WALLET_CONTROL_AUTH_MARKER_V1, WALLET_CONTROL_BASE_PATH_V1, WALLET_CONTROL_SERVICE_ORIGIN_V1, WALLET_RUNTIME_OPS_BASE_PATH_V1, WALLET_RUNTIME_OP_PATHS_V1, WALLET_RUNTIME_SERVICE_ORIGIN_V1, WALLET_STORE_D1_SCHEMA_SQL, WalletHomeCustodyBinding, WalletLifecycleLocator, WalletObjectAddressSnapshot, WalletPlacementRoutes, abusePrincipalKey, addSecp256k1PublicKeys33, admitD1EstablishedWalletHome, admitRouterAbEcdsaReusableWalletSessionOperation, applyRouteMetering, assertUniqueRouterApiRouteDefinitions, authenticateDeviceLinkingOwnerWalletSessionRequestV1, authenticateRouterAbEcdsaOperationStepUp, authenticateRouterAbWalletOperationStepUp, authenticateRouterAbWalletOperationStepUpIdentity, authorizeRouterAbEcdsaDerivationNormalSigningRoute, authorizeRouterAbEd25519NormalSigningRoute, base64UrlDecode, base64UrlEncode, bindWalletAuthMethodIdentity, bindWalletAuthMethodIdentityV2, buildCorsOrigins, buildRouterAbEcdsaDerivationPrivateSigningWorkerBody, buildRouterAbEcdsaOwnerOperationStepUpPreparation, buildRouterAbEd25519OwnerOperationStepUpPreparation, buildRouterAbEd25519PrivateSigningWorkerBody, buildRouterAbEd25519YaoAddSignerAdmissionRequestV1, buildRouterAbEd25519YaoProductAdmissionRequestV1, buildTenantRootIdentityFromAuthenticatedDeploymentV1, buildVerifiedLinkInputV1, buildVerifiedTargetFactorV1, buildWalletEcdsaSignerRecord, claimRouterAbEcdsaOperationStepUp, coerceLogger, coerceRouterLogger, completeRouterAbEcdsaOperation, computeEip1559TxHash, computeLinkedDeviceSessionClaimDigestV1, computeRouterAbEd25519NormalSigningAdmissionMaterial, computeVerifiedTargetFactorVerificationDigestV1, createCloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1RouterApiAuthService, createCloudflareD1VersionedJsonRecordStore, createCloudflareDurableObjectVersionedJsonRecordStore, createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1, createCloudflareRouter, createCloudflareTenantStorageRoute, createCloudflareWalletGatewayRouterV1, createD1LinkedDeviceOwnerAuthorizationMetadataSourceV1, createD1LinkedDeviceOwnerAuthorizationProviderV1, createD1LinkedDeviceOwnerSourceChildReaderV1, createD1LinkedDeviceRouteServiceV1, createD1LinkedDeviceSessionServiceV1, createD1LinkedDeviceSourceContributionPreparationPlannerV1, createD1LinkedDeviceVerifiedLinkSourceReaderV1, createDeviceLinkingOwnerRequestAuthenticatorV1, createEd25519SessionAdapter, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterApiRuntimeSnapshotConsumer, createRouterAbEcdsaEd25519CeremonyTokenIssuer, createRouterAbEcdsaStrictPostRegistrationPort, createRouterAbEcdsaStrictRegistrationPort, createRouterAbEd25519YaoCeremonyStateStoreV1, createRouterAbEd25519YaoExportModule, createRouterAbEd25519YaoHttpRegistrationBackendFromEnv, createRouterAbEd25519YaoMaterialActivationRefV1, createRouterAbEd25519YaoProductRegistrationCompositionFromPortsV1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, createRouterAbEd25519YaoProductRegistrationRequestScopedRuntimeV1, createRouterAbEd25519YaoProductRegistrationRuntimeV1, createRouterAbEd25519YaoProductRegistrationStateFromPartsV1, createRouterAbEd25519YaoProductRegistrationStateV1, createRouterAbEd25519YaoRegistrationModule, createRouterAbNormalSigningAdmissionAdapter, createRouterAbServiceBindingFetch, createRouterApiModule, createRouterApiRouteDefinitions, createSignerD1DoStorageTarget, createSigningSessionSealOptions, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, createStaticWalletConsoleBindingV1, createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1, createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, createWalletConsoleOpsClient, createWalletConsoleRelayProxyExtensionV1, createWalletControlClientBindings, createWalletRegistrationContextResolver, createWalletRuntimeOpsHandler, d1ChangedRows, d1Integer, d1Number, decideRouterAbEcdsaOwnerOperationAuthorization, decideRouterAbEd25519OwnerOperationAuthorization, decodeEvmBlockHeader, decodeEvmTransactionByHash, decodeEvmTransactionCall, decodeEvmTransactionReceipt, decodeJsonRpcEnvelope, decodeWalletConsoleTenantRootActiveLineageRequestV1, decodeWalletConsoleTenantRootActiveLineageResponseV1, defineRoute, defineRouteExtension, deriveJwtExpiresAtIso, deriveRecoveryCodeLocatorV1FromBytes, digestOpaqueValue, encodeEip1559SignedTxFromSignature65, encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1, encodeRouterAbEd25519YaoProductRegistrationStateV1, encodeSessionJsonSegment, encodeTenantRootIdentityV1, enforceDelegatePolicy, enforceRoutePolicy, ensureEvmCryptoWasm, ensureLeadingSlash, ensureWalletAuthMethodStoreD1Schema, ensureWalletStoreD1Schema, evaluateRouterAbNormalSigningAdmission, executeRouterAbEd25519YaoAdmittedRegistrationV1, executeSignedDelegateWithRelayer, extractBearerCredential, extractRouterApiEnvironmentId, findRouteDefinitionById, findRouteDefinitionForRequest, formatD1ExecStatement, getRouterApiRouteExtensionDefinitions, getRouterApiRouteExtensionRoutes, getRouterApiRouteExtensionsForTransport, handleRouterAbEcdsaDerivationNormalSigningRouteCore, handleRouterAbEd25519YaoExportRequestScopedCloudflareV1, handleRouterAbEd25519YaoRecoveryRequestScopedCloudflareV1, handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1, handleStaticWalletConsoleRequestV1, handleWalletControlRequest, headersToRecord, isD1DatabaseLike, isObject, isPlainObject, json, jsonFailure, keccak256Bytes, linkedDeviceSignerManifestsEqualV1, linkedDeviceX25519RecipientPublicKeyB64uV1, loadCloudflareSignerWasmModule, matchesRouteDefinitionRequest, mergeRouterAbEd25519YaoProductRegistrationStatePartitionV1, mintRouterAbEd25519YaoRegistrationIdentityV1, normalizeBoundedPositiveInteger, normalizeCorsOrigin, normalizeD1RouterApiAuthOptions, normalizeHashToBytes, normalizeLinkedDevicePasskeyTargetConfigurationV1, normalizeLogger, normalizeLowercaseString, normalizeSessionString, normalizeSessionTtlSeconds, normalizeSourceIp, normalizeTrimmedString, normalizeWalletAuthMethod, normalizeWalletAuthMethodV2, parseBooleanFlag, parseBooleanJwtClaim, parseCacheControlMaxAgeSec, parseCsvList, parseD1JsonArrayColumn, parseD1JsonColumn, parseD1JsonObjectColumn, parseD1LinkedDeviceSessionRowV1, parseD1LinkedDeviceSessionTranscriptRowV1, parseGoogleEmailOtpRegistrationAttemptRecord, parseGoogleEmailOtpRegistrationOfferCandidates, parseGoogleJwks, parseGoogleLoginVerifyRequest, parseInstalledEcdsaCustodySnapshotV1, parseJwtAud, parseLinkedDeviceSessionRecordV1, parseOrgId, parseRecoveryCodeLocatorV1, parseRouterAbEcdsaEd25519PrivateJwk, parseRouterAbEcdsaPresignRuntimeConfig, parseRouterAbEcdsaStrictRegistrationTopology, parseRouterAbEd25519NormalSigningScopeV2, parseRouterAbEd25519OperationStepUpScope, parseRouterAbEd25519YaoActivationKeysetFromEnvV1, parseRouterAbEd25519YaoCeremonyKeyV1, parseRouterAbEd25519YaoExportAdmissionEnvelopeV1, parseRouterAbEd25519YaoExportExecuteEnvelopeV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordJsonV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoProductRegistrationStateJsonV1, parseRouterAbEd25519YaoProductRegistrationStateV1, parseRouterAbEd25519YaoRegistrationAdmissionReadV1, parseRouterAbEd25519YaoRegistrationRouterAnswerV1, parseRouterAbEd25519YaoTenantRootWireV1, parseRouterAbOperationStepUpOperation, parseRouterAbPublicKeysetV2, parseRpcHexQuantity, parseRs256JwtForVerification, parseSessionJwt, parseSigningSessionSealRootConfig, parseStaticWalletConsoleBindingConfigV1, parseStoredRouterAbEcdsaPendingActivationV1, parseWalletEd25519SignerRecord, parseWalletId, parseWalletRecoveryOperationId, parseWalletRegistrationContextResponse, parseWalletRegistrationSetupRequest, parseWalletRegistrationSetupReservation, parseWalletRuntimeExecuteSignedDelegateRequest, parseWalletRuntimeExecuteSignedDelegateResponse, parseWalletRuntimeExecuteSignedDelegateResult, parseWalletRuntimeRelayerAccount, parseWalletRuntimeWalletIdentitiesResult, parseWalletRuntimeWalletIdentityRequest, parseWebAuthnRpId, parseWebAuthnSyncChallengeRecord, partitionRouterAbEd25519YaoProductRegistrationStateV1, postRouterAbSigningWorkerJson, prepareD1TenantStatement, prepareD1WalletAuthMethodInsertStatement, prepareD1WalletAuthMethodPutStatement, prepareD1WalletAuthMethodV2PutStatement, prepareD1WalletPutSignerStatement, prepareD1WalletPutSubjectStatement, prepareD1WebAuthnAuthenticatorInsertStatement, prepareD1WebAuthnAuthenticatorPutStatement, projectRouterAbEd25519YaoExactWalletSession, proposeWalletRegistrationSetup, publishableKeyRoutePrincipal, queryD1All, queryD1One, randomTenantRootCreationGrantBytesV1, readD1LinkedDeviceEcdsaSourceV1, readD1LinkedDeviceEd25519SourceV1, readEnvironmentCsv, readEnvironmentString, readJson, registrationPreparationIdFromString, requireD1RouterApiAuthScopeString, requireEnvironmentString, requireNormalizedSessionString, requireRuntimePolicyScope, resolveFreshRouterAbEcdsaMaterialActivation, resolvePublishableKeyApiCredentialAuth, resolveRequestOriginRateLimitKeyFromFetchHeaders, resolveRouterAbEd25519YaoCeremonyKeyFromRequestV1, resolveRuntimeTenantRootLineage, resolveSecretKeyApiCredentialAuth, resolveSourceIpFromFetchHeaders, resolveWalletRegistrationContext, resumeRegistrationDirectoryPublicationsV1, routeError, routeJson, routerAbEcdsaAtomicAuthorizationConfigured, routerAbEcdsaOperationInProgressResult, routerAbEcdsaOwnerOperationFailureResult, routerAbEcdsaRecordedResponse, routerAbEcdsaReplayHttpResponse, routerAbEcdsaReplayResult, routerAbEcdsaReplayUnavailableResult, routerAbEcdsaStrictRegistrationFactsBindingJson, routerAbEcdsaStrictRegistrationRequestBindingJson, routerAbEcdsaStrictRegistrationRequestMatchesFacts, routerAbEd25519OwnerOperationFailureResult, routerAbEd25519YaoAdmittedRegistrationAuthorityV1, routerAbEd25519YaoPartitionedStateAfterStoredCommitV1, routerAbEd25519YaoPersistedCapabilityMatchesLookupV1, routerAbEd25519YaoRegistrationExecutionTimingEntriesV1, routerAbEd25519YaoRegistrationSigningRootIdV1, routerAbEd25519YaoTenantRootWireV1, runRouterAbEd25519YaoProductRegistrationRequestScopedV1, runRouterAbEd25519YaoRegistrationSideEffectV1, runRouterAbEd25519YaoRegistrationTwoPhaseV1, runRouterAbPrewarmScheduledV1, runtimePolicyScopeKey, sameRouterAbEd25519YaoSharedStateCanonicalEncodingV1, secp256k1PrivateKey32ToPublicKey33, secp256k1PublicKey33ToEthereumAddress, secureRandomBase36, secureRandomBase64Url, selectWalletEd25519Signer, sessionJwtTimeClaims, sha256Bytes, sha256BytesSync, signSecp256k1Recoverable, signTenantRootCreationGrantV1, tenantRootIdentityDigestB64uV1, tenantStorageRouteBackendFamily, tenantStorageRouteDiagnostic, toFetchRouteResponse, normalizeOptionalTrimmedString as toOptionalTrimmedString, toResponse, toSessionArrayBufferCopy, unavailableRegistrationContext, validateDelegateExpiryAndNonce, validateGoogleIdTokenClaims, validateRuntimeSnapshotExpectation, validateSecp256k1PublicKey33, verifyGoogleOidcToken, verifyRs256JwtSignature, verifySecp256k1Bip340SignatureAgainstPublicKey33, verifySecp256k1RecoverableSignatureAgainstPublicKey33, walletAuthMethodId, walletAuthMethodV2Id, walletConsoleApiWalletGetRouteDefinitionV1, walletConsoleApiWalletListRouteDefinitionV1, walletConsoleApiWalletSearchRouteDefinitionV1, walletConsoleRelayRouteDefinitionsV1, walletConsoleSignedDelegateRouteDefinitionV1, walletConsoleSponsoredEvmCallRouteDefinitionV1, walletObjectIdentity, walletRegistrationContext, walletRegistrationSetupRequestDigest, webAuthnCredentialIdB64uFromCredential, withCors };
+export { API_CREDENTIAL_ROUTE_SCOPES, API_CREDENTIAL_TYPES, ActionType, CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, CloudflareD1AuthorizationStore, CloudflareD1GoogleEmailOtpRegistrationAttemptStore, CloudflareD1OidcJwksCache, CloudflareD1RouterAbEd25519YaoCapabilityPersistence, CloudflareD1RouterAbNormalSigningAdmissionStore, CloudflareD1VaultProxyStore, CloudflareD1VersionedJsonRecordStore, CloudflareD1VersionedJsonRecordStoreError, CloudflareD1WebAuthnAuthService, CloudflareD1WebAuthnStore, CloudflareDurableObjectVersionedJsonRecordStore, CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1, CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1, CloudflareVersionedJsonRecordStoreError, CrossSiteSessionCookieAdapter, D1IdentityStore, D1LinkedDeviceAuthorityInstallServiceV1, D1LinkedDeviceEd25519ExportRootStoreV1, D1LinkedDeviceRequestProofNonceStoreV1, D1LinkedDeviceSessionStoreV1, D1LinkedDeviceSourceContributionPreparationPlannerV1, D1LinkedDeviceTargetAuthenticatorStoreV1, D1LinkedDeviceTargetCredentialProviderV1, D1LinkedDeviceTargetPlannerV1, D1WalletAuthMethodStore, D1WalletObjectAddresses, D1WalletStore, D1_BATCH_CAS_GUARD_SQL, DEFAULT_SESSION_COOKIE_NAME, DEFAULT_WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_V1, DEFAULT_WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_V1, DEFAULT_WALLET_SESSION_REMAINING_USES, DEFAULT_WALLET_SESSION_TTL_MS, ED25519_SIGNER_ACTIVATION_ID_PATH, InMemoryRouterAbEd25519YaoExportService, InMemoryRouterAbEd25519YaoExportStateV1, InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter, InMemoryRouterAbEd25519YaoRegistrationService, InMemoryRouterAbNormalSigningAdmissionStore, LINKED_DEVICE_OWNER_AUTHORIZATION_PATH_V1, LinkedDeviceRetiredTargetRegistrationShapeErrorV1, LinkedDeviceSourceFamilyUnavailableErrorV1, LinkedDeviceWebAuthnRegistrationVerifierV1, LocalRegistrationSetupAuthority, MAX_WALLET_SESSION_REMAINING_USES, MAX_WALLET_SESSION_TTL_MS, PUBLIC_PROOF_TYPES, ROUTER_AB_ECDSA_DERIVATION_PRIVATE_SIGNING_PATHS, ROUTER_AB_ED25519_PRIVATE_SIGNING_PATHS, ROUTER_AB_ED25519_YAO_CAPABILITY_REPLACEMENT_TABLE_V1, ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_STATUS_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1, ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, ROUTER_AB_MPC_ROUTER_ORIGIN, ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, ROUTER_AB_SIGNING_WORKER_ORIGIN, ROUTER_AB_TRACE_ID_HEADER_V1, ROUTER_API_CREDENTIAL_SCOPES, ROUTE_SERVICE_KEYS, RouterAbEcdsaPresignRuntime, RouterAbEd25519YaoExportOwnerProofAuthorizationAdapter, RouterAbEd25519YaoHttpRegistrationBackend, RouterAbEd25519YaoRecoveryWalletSessionAuthorizationAdapter, SESSION_CAS_GUARD_SQL, SessionService, StaticCloudflareTenantStorageRouteResolver, UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, WALLET_AUTH_METHOD_D1_STORE, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL, WALLET_CONSOLE_API_WALLET_DETAIL_PREFIX_V1, WALLET_CONSOLE_OPS_BASE_PATH_V1, WALLET_CONSOLE_OP_PATHS_V1, WALLET_CONSOLE_SERVICE_ORIGIN_V1, WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_ID_V1, WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_ID_V1, WALLET_CONTROL_AUTH_MARKER_V1, WALLET_CONTROL_BASE_PATH_V1, WALLET_CONTROL_SERVICE_ORIGIN_V1, WALLET_RUNTIME_OPS_BASE_PATH_V1, WALLET_RUNTIME_OP_PATHS_V1, WALLET_RUNTIME_SERVICE_ORIGIN_V1, WALLET_STORE_D1_SCHEMA_SQL, WalletHomeCustodyBinding, WalletLifecycleLocator, WalletObjectAddressSnapshot, WalletPlacementRoutes, abusePrincipalKey, addSecp256k1PublicKeys33, admitD1EstablishedWalletHome, admitRouterAbEcdsaReusableWalletSessionOperation, applyRouteMetering, assertUniqueRouterApiRouteDefinitions, authenticateDeviceLinkingOwnerWalletSessionRequestV1, authenticateRouterAbEcdsaOperationStepUp, authenticateRouterAbWalletOperationStepUp, authenticateRouterAbWalletOperationStepUpIdentity, authorizeRouterAbEcdsaDerivationNormalSigningRoute, authorizeRouterAbEd25519NormalSigningRoute, base64UrlDecode, base64UrlEncode, bindWalletAuthMethodIdentity, bindWalletAuthMethodIdentityV2, buildCorsOrigins, buildRouterAbEcdsaDerivationPrivateSigningWorkerBody, buildRouterAbEcdsaOwnerOperationStepUpPreparation, buildRouterAbEd25519OwnerOperationStepUpPreparation, buildRouterAbEd25519PrivateSigningWorkerBody, buildRouterAbEd25519YaoAddSignerAdmissionRequestV1, buildRouterAbEd25519YaoProductAdmissionRequestV1, buildTenantRootIdentityFromAuthenticatedDeploymentV1, buildVerifiedLinkInputV1, buildVerifiedTargetFactorV1, buildWalletEcdsaSignerRecord, claimRouterAbEcdsaOperationStepUp, coerceLogger, coerceRouterLogger, completeRouterAbEcdsaOperation, computeEip1559TxHash, computeLinkedDeviceSessionClaimDigestV1, computeRouterAbEd25519NormalSigningAdmissionMaterial, computeVerifiedTargetFactorVerificationDigestV1, createCloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1RouterApiAuthService, createCloudflareD1VersionedJsonRecordStore, createCloudflareDurableObjectVersionedJsonRecordStore, createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1, createCloudflareRouter, createCloudflareTenantStorageRoute, createCloudflareWalletGatewayRouterV1, createD1LinkedDeviceOwnerAuthorizationMetadataSourceV1, createD1LinkedDeviceOwnerAuthorizationProviderV1, createD1LinkedDeviceOwnerSourceChildReaderV1, createD1LinkedDeviceRouteServiceV1, createD1LinkedDeviceSessionServiceV1, createD1LinkedDeviceSourceContributionPreparationPlannerV1, createD1LinkedDeviceVerifiedLinkSourceReaderV1, createDeviceLinkingOwnerRequestAuthenticatorV1, createEd25519SessionAdapter, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterApiRuntimeSnapshotConsumer, createRouterAbEcdsaEd25519CeremonyTokenIssuer, createRouterAbEcdsaStrictPostRegistrationPort, createRouterAbEcdsaStrictRegistrationPort, createRouterAbEd25519YaoCeremonyStateStoreV1, createRouterAbEd25519YaoExportModule, createRouterAbEd25519YaoHttpRegistrationBackendFromEnv, createRouterAbEd25519YaoMaterialActivationRefV1, createRouterAbEd25519YaoProductRegistrationCompositionFromPortsV1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, createRouterAbEd25519YaoProductRegistrationRequestScopedRuntimeV1, createRouterAbEd25519YaoProductRegistrationRuntimeV1, createRouterAbEd25519YaoProductRegistrationStateFromPartsV1, createRouterAbEd25519YaoProductRegistrationStateV1, createRouterAbEd25519YaoRegistrationModule, createRouterAbNormalSigningAdmissionAdapter, createRouterAbServiceBindingFetch, createRouterApiModule, createRouterApiRouteDefinitions, createSignerD1DoStorageTarget, createSigningSessionSealOptions, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, createStaticWalletConsoleBindingV1, createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1, createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, createWalletConsoleOpsClient, createWalletConsoleRelayProxyExtensionV1, createWalletControlClientBindings, createWalletRegistrationContextResolver, createWalletRuntimeOpsHandler, d1ChangedRows, d1Integer, d1Number, decideRouterAbEcdsaOwnerOperationAuthorization, decideRouterAbEd25519OwnerOperationAuthorization, decodeEvmBlockHeader, decodeEvmTransactionByHash, decodeEvmTransactionCall, decodeEvmTransactionReceipt, decodeJsonRpcEnvelope, decodeWalletConsoleTenantRootActiveLineageRequestV1, decodeWalletConsoleTenantRootActiveLineageResponseV1, defineRoute, defineRouteExtension, deriveJwtExpiresAtIso, deriveRecoveryCodeLocatorV1FromBytes, digestOpaqueValue, encodeEip1559SignedTxFromSignature65, encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1, encodeRouterAbEd25519YaoProductRegistrationStateV1, encodeSessionJsonSegment, encodeTenantRootIdentityV1, enforceDelegatePolicy, enforceRoutePolicy, ensureEvmCryptoWasm, ensureLeadingSlash, ensureWalletAuthMethodStoreD1Schema, ensureWalletStoreD1Schema, evaluateRouterAbNormalSigningAdmission, executeRouterAbEd25519YaoAdmittedRegistrationV1, executeSignedDelegateWithRelayer, extractBearerCredential, extractRouterApiEnvironmentId, findRouteDefinitionById, findRouteDefinitionForRequest, formatD1ExecStatement, getRouterApiRouteExtensionDefinitions, getRouterApiRouteExtensionRoutes, getRouterApiRouteExtensionsForTransport, handleRouterAbEcdsaDerivationNormalSigningRouteCore, handleRouterAbEd25519YaoExportRequestScopedCloudflareV1, handleRouterAbEd25519YaoRecoveryRequestScopedCloudflareV1, handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1, handleStaticWalletConsoleRequestV1, handleWalletControlRequest, headersToRecord, isD1DatabaseLike, isObject, isPlainObject, json, jsonFailure, keccak256Bytes, linkedDeviceSignerManifestsEqualV1, linkedDeviceX25519RecipientPublicKeyB64uV1, loadCloudflareSignerWasmModule, matchesRouteDefinitionRequest, mergeRouterAbEd25519YaoProductRegistrationStatePartitionV1, mintRouterAbEd25519YaoRegistrationIdentityV1, normalizeBoundedPositiveInteger, normalizeCorsOrigin, normalizeD1RouterApiAuthOptions, normalizeHashToBytes, normalizeLinkedDevicePasskeyTargetConfigurationV1, normalizeLogger, normalizeLowercaseString, normalizeSessionString, normalizeSessionTtlSeconds, normalizeSourceIp, normalizeTrimmedString, normalizeWalletAuthMethod, normalizeWalletAuthMethodV2, parseBooleanFlag, parseBooleanJwtClaim, parseCacheControlMaxAgeSec, parseCsvList, parseD1JsonArrayColumn, parseD1JsonColumn, parseD1JsonObjectColumn, parseD1LinkedDeviceSessionRowV1, parseD1LinkedDeviceSessionTranscriptRowV1, parseExternalAuthConfiguration, parseExternalAuthProvider, parseGoogleEmailOtpRegistrationAttemptRecord, parseGoogleEmailOtpRegistrationOfferCandidates, parseGoogleJwks, parseGoogleLoginVerifyRequest, parseInstalledEcdsaCustodySnapshotV1, parseJwtAud, parseLinkedDeviceSessionRecordV1, parseOrgId, parseRecoveryCodeLocatorV1, parseRouterAbEcdsaEd25519PrivateJwk, parseRouterAbEcdsaPresignRuntimeConfig, parseRouterAbEcdsaStrictRegistrationTopology, parseRouterAbEd25519NormalSigningScopeV2, parseRouterAbEd25519OperationStepUpScope, parseRouterAbEd25519YaoActivationKeysetFromEnvV1, parseRouterAbEd25519YaoCeremonyKeyV1, parseRouterAbEd25519YaoExportAdmissionEnvelopeV1, parseRouterAbEd25519YaoExportExecuteEnvelopeV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordJsonV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoProductRegistrationStateJsonV1, parseRouterAbEd25519YaoProductRegistrationStateV1, parseRouterAbEd25519YaoRegistrationAdmissionReadV1, parseRouterAbEd25519YaoRegistrationRouterAnswerV1, parseRouterAbEd25519YaoTenantRootWireV1, parseRouterAbOperationStepUpOperation, parseRouterAbPublicKeysetV2, parseRpcHexQuantity, parseRs256JwtForVerification, parseSessionJwt, parseSigningSessionSealRootConfig, parseStaticWalletConsoleBindingConfigV1, parseStoredRouterAbEcdsaPendingActivationV1, parseWalletEd25519SignerRecord, parseWalletId, parseWalletRecoveryOperationId, parseWalletRegistrationContextResponse, parseWalletRegistrationSetupRequest, parseWalletRegistrationSetupReservation, parseWalletRuntimeExecuteSignedDelegateRequest, parseWalletRuntimeExecuteSignedDelegateResponse, parseWalletRuntimeExecuteSignedDelegateResult, parseWalletRuntimeRelayerAccount, parseWalletRuntimeWalletIdentitiesResult, parseWalletRuntimeWalletIdentityRequest, parseWebAuthnRpId, parseWebAuthnSyncChallengeRecord, partitionRouterAbEd25519YaoProductRegistrationStateV1, postRouterAbSigningWorkerJson, prepareD1TenantStatement, prepareD1WalletAuthMethodInsertStatement, prepareD1WalletAuthMethodPutStatement, prepareD1WalletAuthMethodV2PutStatement, prepareD1WalletPutSignerStatement, prepareD1WalletPutSubjectStatement, prepareD1WebAuthnAuthenticatorInsertStatement, prepareD1WebAuthnAuthenticatorPutStatement, projectRouterAbEd25519YaoExactWalletSession, proposeWalletRegistrationSetup, publishableKeyRoutePrincipal, queryD1All, queryD1One, randomTenantRootCreationGrantBytesV1, readD1LinkedDeviceEcdsaSourceV1, readD1LinkedDeviceEd25519SourceV1, readEnvironmentCsv, readEnvironmentString, readJson, registrationPreparationIdFromString, requireD1RouterApiAuthScopeString, requireEnvironmentString, requireNormalizedSessionString, requireRuntimePolicyScope, resolveFreshRouterAbEcdsaMaterialActivation, resolvePublishableKeyApiCredentialAuth, resolveRequestOriginRateLimitKeyFromFetchHeaders, resolveRouterAbEd25519YaoCeremonyKeyFromRequestV1, resolveRuntimeTenantRootLineage, resolveSecretKeyApiCredentialAuth, resolveSourceIpFromFetchHeaders, resolveWalletRegistrationContext, resumeRegistrationDirectoryPublicationsV1, routeError, routeJson, routerAbEcdsaAtomicAuthorizationConfigured, routerAbEcdsaOperationInProgressResult, routerAbEcdsaOwnerOperationFailureResult, routerAbEcdsaRecordedResponse, routerAbEcdsaReplayHttpResponse, routerAbEcdsaReplayResult, routerAbEcdsaReplayUnavailableResult, routerAbEcdsaStrictRegistrationFactsBindingJson, routerAbEcdsaStrictRegistrationRequestBindingJson, routerAbEcdsaStrictRegistrationRequestMatchesFacts, routerAbEd25519OwnerOperationFailureResult, routerAbEd25519YaoAdmittedRegistrationAuthorityV1, routerAbEd25519YaoPartitionedStateAfterStoredCommitV1, routerAbEd25519YaoPersistedCapabilityMatchesLookupV1, routerAbEd25519YaoRegistrationExecutionTimingEntriesV1, routerAbEd25519YaoRegistrationSigningRootIdV1, routerAbEd25519YaoTenantRootWireV1, runRouterAbEd25519YaoProductRegistrationRequestScopedV1, runRouterAbEd25519YaoRegistrationSideEffectV1, runRouterAbEd25519YaoRegistrationTwoPhaseV1, runRouterAbPrewarmScheduledV1, runtimePolicyScopeKey, sameRouterAbEd25519YaoSharedStateCanonicalEncodingV1, secp256k1PrivateKey32ToPublicKey33, secp256k1PublicKey33ToEthereumAddress, secureRandomBase36, secureRandomBase64Url, selectWalletEd25519Signer, sessionJwtTimeClaims, sha256Bytes, sha256BytesSync, signSecp256k1Recoverable, signTenantRootCreationGrantV1, tenantRootIdentityDigestB64uV1, tenantStorageRouteBackendFamily, tenantStorageRouteDiagnostic, toFetchRouteResponse, normalizeOptionalTrimmedString as toOptionalTrimmedString, toResponse, toSessionArrayBufferCopy, unavailableRegistrationContext, validateDelegateExpiryAndNonce, validateGoogleIdTokenClaims, validateRuntimeSnapshotExpectation, validateSecp256k1PublicKey33, verifyGoogleOidcToken, verifyRs256JwtSignature, verifySecp256k1Bip340SignatureAgainstPublicKey33, verifySecp256k1RecoverableSignatureAgainstPublicKey33, walletAuthMethodId, walletAuthMethodV2Id, walletConsoleApiWalletGetRouteDefinitionV1, walletConsoleApiWalletListRouteDefinitionV1, walletConsoleApiWalletSearchRouteDefinitionV1, walletConsoleRelayRouteDefinitionsV1, walletConsoleSignedDelegateRouteDefinitionV1, walletConsoleSponsoredEvmCallRouteDefinitionV1, walletObjectIdentity, walletRegistrationContext, walletRegistrationSetupRequestDigest, webAuthnCredentialIdB64uFromCredential, withCors };