@seams/wallet-server 0.28.0 → 0.29.0

package/dist/esm/auth/externalOwnerOperations.js

@@ -0,0 +1,82 @@
+import { externalAuthFailure, serializeExternalIdentity } from "../shared-ts/src/auth/externalAuth.js";
+import { computeWalletOwnerAdminChallengeDigest } from "../shared-ts/src/authorization/walletOwnerOperation.js";
+//#region src/auth/externalOwnerOperations.ts
+async function readExternalOwnerOperation(input) {
+	const attempt = input.phase === "prepare" ? await input.store.prepareOwnerChallenge(input.binding) : await input.store.readOwnerAttempt(input.binding);
+	if (!attempt) return externalAuthFailure("access_denied");
+	if (attempt.challenge.kind !== "ready") return externalAuthFailure("access_denied");
+	if (attempt.status === "verified" && attempt.challenge.expiresAtMs <= input.binding.nowMs) return externalAuthFailure("expired");
+	const identity = serializeExternalIdentity(attempt.identity);
+	let operation;
+	let payload;
+	switch (attempt.purpose) {
+		case "associate":
+			operation = "external_identity_associate";
+			payload = {
+				attemptId: attempt.attemptId,
+				identity,
+				originBinding: attempt.originBinding,
+				revision: attempt.trustRevision,
+				expiresAtMs: attempt.challenge.expiresAtMs
+			};
+			break;
+		case "unlink":
+			operation = "external_identity_unlink";
+			payload = {
+				attemptId: attempt.attemptId,
+				associationId: attempt.associationId,
+				identity,
+				originBinding: attempt.originBinding,
+				revision: attempt.trustRevision,
+				expiresAtMs: attempt.challenge.expiresAtMs
+			};
+			break;
+		default: return assertNever(attempt);
+	}
+	const challengeB64u = await computeWalletOwnerAdminChallengeDigest({
+		walletId: attempt.walletId,
+		operation,
+		payload,
+		requestOrigin: input.requestOrigin
+	});
+	return {
+		ok: true,
+		value: {
+			attempt,
+			operation,
+			payload,
+			challengeB64u
+		}
+	};
+}
+function externalOwnerChallenge(operation) {
+	const attempt = operation.attempt;
+	if (attempt.challenge.kind !== "ready") throw new Error("Owner challenge is not prepared");
+	switch (attempt.purpose) {
+		case "associate": return {
+			kind: "associate",
+			walletId: attempt.walletId,
+			attemptId: attempt.attemptId,
+			identity: attempt.identity,
+			challengeB64u: operation.challengeB64u,
+			expiresAtMs: attempt.challenge.expiresAtMs
+		};
+		case "unlink": return {
+			kind: "unlink",
+			walletId: attempt.walletId,
+			attemptId: attempt.attemptId,
+			associationId: attempt.associationId,
+			identity: attempt.identity,
+			challengeB64u: operation.challengeB64u,
+			expiresAtMs: attempt.challenge.expiresAtMs
+		};
+		default: return assertNever(attempt);
+	}
+}
+function assertNever(value) {
+	throw new Error(`Unsupported external owner operation: ${String(value)}`);
+}
+//#endregion
+export { externalOwnerChallenge, readExternalOwnerOperation };
+
+//# sourceMappingURL=externalOwnerOperations.js.map

package/dist/esm/cloud-host.js

@@ -3,7 +3,7 @@ import { ensureLeadingSlash, normalizeBoundedPositiveInteger, normalizeLowercase
 import { isObject, isPlainObject } from "./shared-ts/src/utils/validation.js";
 import { base64UrlDecode, base64UrlEncode } from "./shared-ts/src/utils/base64.js";
 import { sha256Bytes } from "./shared-ts/src/utils/digests.js";
-import { parseExternalAuthConfiguration } from "./shared-ts/src/auth/externalAuth.js";
+import { parseExternalAuthConfiguration, parseExternalAuthProvider } from "./shared-ts/src/auth/externalAuth.js";
 import "./shared-ts/src/utils/encoders.js";
 import { CloudflareD1OidcJwksCache, parseBooleanJwtClaim, parseCacheControlMaxAgeSec, parseGoogleJwks, parseJwtAud, parseRs256JwtForVerification, validateGoogleIdTokenClaims, verifyRs256JwtSignature } from "./router/cloudflare/d1/oidc/d1OidcBoundary.js";
 import { verifyGoogleOidcToken } from "./router/cloudflare/d1/oidc/googleOidcToken.js";
@@ -15,6 +15,8 @@ import { computeLinkedDeviceSessionClaimDigestV1 } from "./shared-ts/src/device-
 import { WalletLifecycleLocator } from "./authorization/lifecycleRouting.js";
 import { secureRandomBase36, secureRandomBase64Url } from "./shared-ts/src/utils/secureRandomId.js";
 import { digestOpaqueValue } from "./authorization/service.js";
+import { webAuthnCredentialIdB64uFromCredential } from "./router/auth/webAuthnCredentialCodecs.js";
+import { routeError, routeJson, toFetchRouteResponse } from "./router/framework/routeResponses.js";
 import { extractBearerCredential, extractRouterApiEnvironmentId, normalizeSourceIp, resolveRequestOriginRateLimitKeyFromFetchHeaders, resolveSourceIpFromFetchHeaders } from "./router/auth/routerApiKeyAuth.js";
 import { SessionService, buildCorsOrigins, normalizeCorsOrigin, parseCsvList } from "./core/SessionService.js";
 import { ROUTER_AB_TRACE_ID_HEADER_V1 } from "./shared-ts/src/utils/routerAbTraceContext.js";
@@ -37,7 +39,6 @@ import { LocalRegistrationSetupAuthority } from "./localRegistrationSetupAuthori
 import { createWalletRegistrationContextResolver, unavailableRegistrationContext, walletRegistrationContext } from "./router/auth/walletRegistrationContext.js";
 import { publishableKeyRoutePrincipal, resolvePublishableKeyApiCredentialAuth, resolveSecretKeyApiCredentialAuth, resolveWalletRegistrationContext } from "./router/auth/routerApiCredentialAuth.js";
 import { enforceRoutePolicy } from "./router/framework/enforceRoutePolicy.js";
-import { routeError, routeJson, toFetchRouteResponse } from "./router/framework/routeResponses.js";
 import { parseWalletRegistrationSetupRequest } from "./router/domains/walletRegistration/walletRegistrationRoutes.js";
 import { applyRouteMetering } from "./router/framework/applyRouteMetering.js";
 import { InMemoryRouterAbNormalSigningAdmissionStore, abusePrincipalKey, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createRouterAbNormalSigningAdmissionAdapter, runtimePolicyScopeKey } from "./router/domains/signingOperations/routerAbNormalSigningAdmissionCore.js";
@@ -47,7 +48,6 @@ import { coerceRouterLogger } from "./router/framework/logger.js";
 import { buildTenantRootIdentityFromAuthenticatedDeploymentV1, encodeTenantRootIdentityV1 } from "./shared-ts/src/tenant-root/tenantRootIdentity.js";
 import { WALLET_CONSOLE_OPS_BASE_PATH_V1, WALLET_CONSOLE_OP_PATHS_V1, WALLET_CONSOLE_SERVICE_ORIGIN_V1, decodeWalletConsoleTenantRootActiveLineageRequestV1, decodeWalletConsoleTenantRootActiveLineageResponseV1 } from "./router/cloudflare/runtime/walletConsoleOps.js";
 import { createWalletConsoleOpsClient, parseWalletRegistrationContextResponse } from "./router/cloudflare/runtime/walletConsoleOpsClient.js";
-import { webAuthnCredentialIdB64uFromCredential } from "./router/auth/webAuthnCredentialCodecs.js";
 import { deriveRecoveryCodeLocatorV1FromBytes, parseRecoveryCodeLocatorV1 } from "./shared-ts/src/wallet-recovery/recoveryCodeLocator.js";
 import { evaluateRouterAbNormalSigningAdmission } from "./router/domains/signingOperations/routerAbNormalSigningAdmission.js";
 import { authenticateRouterAbWalletOperationStepUpIdentity } from "./router/domains/signingOperations/routerAbOperationStepUp.js";
@@ -132,4 +132,4 @@ import { handleRouterAbEd25519YaoRecoveryRequestScopedCloudflareV1 } from "./rou
 import { RouterAbEd25519YaoRecoveryWalletSessionAuthorizationAdapter } from "./router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryWalletSessionAuthorization.js";
 import { keccak256Bytes } from "./shared-ts/src/utils/keccak.js";
 import { decodeEvmBlockHeader, decodeEvmTransactionByHash, decodeEvmTransactionCall, decodeEvmTransactionReceipt, parseRpcHexQuantity } from "./shared-ts/src/utils/evmRpcResults.js";
-export { API_CREDENTIAL_ROUTE_SCOPES, API_CREDENTIAL_TYPES, ActionType, CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, CloudflareD1AuthorizationStore, CloudflareD1GoogleEmailOtpRegistrationAttemptStore, CloudflareD1OidcJwksCache, CloudflareD1RouterAbEd25519YaoCapabilityPersistence, CloudflareD1RouterAbNormalSigningAdmissionStore, CloudflareD1VaultProxyStore, CloudflareD1VersionedJsonRecordStore, CloudflareD1VersionedJsonRecordStoreError, CloudflareD1WebAuthnAuthService, CloudflareD1WebAuthnStore, CloudflareDurableObjectVersionedJsonRecordStore, CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1, CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1, CloudflareVersionedJsonRecordStoreError, CrossSiteSessionCookieAdapter, D1IdentityStore, D1LinkedDeviceAuthorityInstallServiceV1, D1LinkedDeviceEd25519ExportRootStoreV1, D1LinkedDeviceRequestProofNonceStoreV1, D1LinkedDeviceSessionStoreV1, D1LinkedDeviceSourceContributionPreparationPlannerV1, D1LinkedDeviceTargetAuthenticatorStoreV1, D1LinkedDeviceTargetCredentialProviderV1, D1LinkedDeviceTargetPlannerV1, D1WalletAuthMethodStore, D1WalletObjectAddresses, D1WalletStore, D1_BATCH_CAS_GUARD_SQL, DEFAULT_SESSION_COOKIE_NAME, DEFAULT_WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_V1, DEFAULT_WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_V1, DEFAULT_WALLET_SESSION_REMAINING_USES, DEFAULT_WALLET_SESSION_TTL_MS, ED25519_SIGNER_ACTIVATION_ID_PATH, InMemoryRouterAbEd25519YaoExportService, InMemoryRouterAbEd25519YaoExportStateV1, InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter, InMemoryRouterAbEd25519YaoRegistrationService, InMemoryRouterAbNormalSigningAdmissionStore, LINKED_DEVICE_OWNER_AUTHORIZATION_PATH_V1, LinkedDeviceRetiredTargetRegistrationShapeErrorV1, LinkedDeviceSourceFamilyUnavailableErrorV1, LinkedDeviceWebAuthnRegistrationVerifierV1, LocalRegistrationSetupAuthority, MAX_WALLET_SESSION_REMAINING_USES, MAX_WALLET_SESSION_TTL_MS, PUBLIC_PROOF_TYPES, ROUTER_AB_ECDSA_DERIVATION_PRIVATE_SIGNING_PATHS, ROUTER_AB_ED25519_PRIVATE_SIGNING_PATHS, ROUTER_AB_ED25519_YAO_CAPABILITY_REPLACEMENT_TABLE_V1, ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_STATUS_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1, ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, ROUTER_AB_MPC_ROUTER_ORIGIN, ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, ROUTER_AB_SIGNING_WORKER_ORIGIN, ROUTER_AB_TRACE_ID_HEADER_V1, ROUTER_API_CREDENTIAL_SCOPES, ROUTE_SERVICE_KEYS, RouterAbEcdsaPresignRuntime, RouterAbEd25519YaoExportOwnerProofAuthorizationAdapter, RouterAbEd25519YaoHttpRegistrationBackend, RouterAbEd25519YaoRecoveryWalletSessionAuthorizationAdapter, SESSION_CAS_GUARD_SQL, SessionService, StaticCloudflareTenantStorageRouteResolver, UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, WALLET_AUTH_METHOD_D1_STORE, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL, WALLET_CONSOLE_API_WALLET_DETAIL_PREFIX_V1, WALLET_CONSOLE_OPS_BASE_PATH_V1, WALLET_CONSOLE_OP_PATHS_V1, WALLET_CONSOLE_SERVICE_ORIGIN_V1, WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_ID_V1, WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_ID_V1, WALLET_CONTROL_AUTH_MARKER_V1, WALLET_CONTROL_BASE_PATH_V1, WALLET_CONTROL_SERVICE_ORIGIN_V1, WALLET_RUNTIME_OPS_BASE_PATH_V1, WALLET_RUNTIME_OP_PATHS_V1, WALLET_RUNTIME_SERVICE_ORIGIN_V1, WALLET_STORE_D1_SCHEMA_SQL, WalletHomeCustodyBinding, WalletLifecycleLocator, WalletObjectAddressSnapshot, WalletPlacementRoutes, abusePrincipalKey, addSecp256k1PublicKeys33, admitD1EstablishedWalletHome, admitRouterAbEcdsaReusableWalletSessionOperation, applyRouteMetering, assertUniqueRouterApiRouteDefinitions, authenticateDeviceLinkingOwnerWalletSessionRequestV1, authenticateRouterAbEcdsaOperationStepUp, authenticateRouterAbWalletOperationStepUp, authenticateRouterAbWalletOperationStepUpIdentity, authorizeRouterAbEcdsaDerivationNormalSigningRoute, authorizeRouterAbEd25519NormalSigningRoute, base64UrlDecode, base64UrlEncode, bindWalletAuthMethodIdentity, bindWalletAuthMethodIdentityV2, buildCorsOrigins, buildRouterAbEcdsaDerivationPrivateSigningWorkerBody, buildRouterAbEcdsaOwnerOperationStepUpPreparation, buildRouterAbEd25519OwnerOperationStepUpPreparation, buildRouterAbEd25519PrivateSigningWorkerBody, buildRouterAbEd25519YaoAddSignerAdmissionRequestV1, buildRouterAbEd25519YaoProductAdmissionRequestV1, buildTenantRootIdentityFromAuthenticatedDeploymentV1, buildVerifiedLinkInputV1, buildVerifiedTargetFactorV1, buildWalletEcdsaSignerRecord, claimRouterAbEcdsaOperationStepUp, coerceLogger, coerceRouterLogger, completeRouterAbEcdsaOperation, computeEip1559TxHash, computeLinkedDeviceSessionClaimDigestV1, computeRouterAbEd25519NormalSigningAdmissionMaterial, computeVerifiedTargetFactorVerificationDigestV1, createCloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1RouterApiAuthService, createCloudflareD1VersionedJsonRecordStore, createCloudflareDurableObjectVersionedJsonRecordStore, createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1, createCloudflareRouter, createCloudflareTenantStorageRoute, createCloudflareWalletGatewayRouterV1, createD1LinkedDeviceOwnerAuthorizationMetadataSourceV1, createD1LinkedDeviceOwnerAuthorizationProviderV1, createD1LinkedDeviceOwnerSourceChildReaderV1, createD1LinkedDeviceRouteServiceV1, createD1LinkedDeviceSessionServiceV1, createD1LinkedDeviceSourceContributionPreparationPlannerV1, createD1LinkedDeviceVerifiedLinkSourceReaderV1, createDeviceLinkingOwnerRequestAuthenticatorV1, createEd25519SessionAdapter, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterApiRuntimeSnapshotConsumer, createRouterAbEcdsaEd25519CeremonyTokenIssuer, createRouterAbEcdsaStrictPostRegistrationPort, createRouterAbEcdsaStrictRegistrationPort, createRouterAbEd25519YaoCeremonyStateStoreV1, createRouterAbEd25519YaoExportModule, createRouterAbEd25519YaoHttpRegistrationBackendFromEnv, createRouterAbEd25519YaoMaterialActivationRefV1, createRouterAbEd25519YaoProductRegistrationCompositionFromPortsV1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, createRouterAbEd25519YaoProductRegistrationRequestScopedRuntimeV1, createRouterAbEd25519YaoProductRegistrationRuntimeV1, createRouterAbEd25519YaoProductRegistrationStateFromPartsV1, createRouterAbEd25519YaoProductRegistrationStateV1, createRouterAbEd25519YaoRegistrationModule, createRouterAbNormalSigningAdmissionAdapter, createRouterAbServiceBindingFetch, createRouterApiModule, createRouterApiRouteDefinitions, createSignerD1DoStorageTarget, createSigningSessionSealOptions, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, createStaticWalletConsoleBindingV1, createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1, createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, createWalletConsoleOpsClient, createWalletConsoleRelayProxyExtensionV1, createWalletControlClientBindings, createWalletRegistrationContextResolver, createWalletRuntimeOpsHandler, d1ChangedRows, d1Integer, d1Number, decideRouterAbEcdsaOwnerOperationAuthorization, decideRouterAbEd25519OwnerOperationAuthorization, decodeEvmBlockHeader, decodeEvmTransactionByHash, decodeEvmTransactionCall, decodeEvmTransactionReceipt, decodeJsonRpcEnvelope, decodeWalletConsoleTenantRootActiveLineageRequestV1, decodeWalletConsoleTenantRootActiveLineageResponseV1, defineRoute, defineRouteExtension, deriveJwtExpiresAtIso, deriveRecoveryCodeLocatorV1FromBytes, digestOpaqueValue, encodeEip1559SignedTxFromSignature65, encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1, encodeRouterAbEd25519YaoProductRegistrationStateV1, encodeSessionJsonSegment, encodeTenantRootIdentityV1, enforceDelegatePolicy, enforceRoutePolicy, ensureEvmCryptoWasm, ensureLeadingSlash, ensureWalletAuthMethodStoreD1Schema, ensureWalletStoreD1Schema, evaluateRouterAbNormalSigningAdmission, executeRouterAbEd25519YaoAdmittedRegistrationV1, executeSignedDelegateWithRelayer, extractBearerCredential, extractRouterApiEnvironmentId, findRouteDefinitionById, findRouteDefinitionForRequest, formatD1ExecStatement, getRouterApiRouteExtensionDefinitions, getRouterApiRouteExtensionRoutes, getRouterApiRouteExtensionsForTransport, handleRouterAbEcdsaDerivationNormalSigningRouteCore, handleRouterAbEd25519YaoExportRequestScopedCloudflareV1, handleRouterAbEd25519YaoRecoveryRequestScopedCloudflareV1, handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1, handleStaticWalletConsoleRequestV1, handleWalletControlRequest, headersToRecord, isD1DatabaseLike, isObject, isPlainObject, json, jsonFailure, keccak256Bytes, linkedDeviceSignerManifestsEqualV1, linkedDeviceX25519RecipientPublicKeyB64uV1, loadCloudflareSignerWasmModule, matchesRouteDefinitionRequest, mergeRouterAbEd25519YaoProductRegistrationStatePartitionV1, mintRouterAbEd25519YaoRegistrationIdentityV1, normalizeBoundedPositiveInteger, normalizeCorsOrigin, normalizeD1RouterApiAuthOptions, normalizeHashToBytes, normalizeLinkedDevicePasskeyTargetConfigurationV1, normalizeLogger, normalizeLowercaseString, normalizeSessionString, normalizeSessionTtlSeconds, normalizeSourceIp, normalizeTrimmedString, normalizeWalletAuthMethod, normalizeWalletAuthMethodV2, parseBooleanFlag, parseBooleanJwtClaim, parseCacheControlMaxAgeSec, parseCsvList, parseD1JsonArrayColumn, parseD1JsonColumn, parseD1JsonObjectColumn, parseD1LinkedDeviceSessionRowV1, parseD1LinkedDeviceSessionTranscriptRowV1, parseExternalAuthConfiguration, parseGoogleEmailOtpRegistrationAttemptRecord, parseGoogleEmailOtpRegistrationOfferCandidates, parseGoogleJwks, parseGoogleLoginVerifyRequest, parseInstalledEcdsaCustodySnapshotV1, parseJwtAud, parseLinkedDeviceSessionRecordV1, parseOrgId, parseRecoveryCodeLocatorV1, parseRouterAbEcdsaEd25519PrivateJwk, parseRouterAbEcdsaPresignRuntimeConfig, parseRouterAbEcdsaStrictRegistrationTopology, parseRouterAbEd25519NormalSigningScopeV2, parseRouterAbEd25519OperationStepUpScope, parseRouterAbEd25519YaoActivationKeysetFromEnvV1, parseRouterAbEd25519YaoCeremonyKeyV1, parseRouterAbEd25519YaoExportAdmissionEnvelopeV1, parseRouterAbEd25519YaoExportExecuteEnvelopeV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordJsonV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoProductRegistrationStateJsonV1, parseRouterAbEd25519YaoProductRegistrationStateV1, parseRouterAbEd25519YaoRegistrationAdmissionReadV1, parseRouterAbEd25519YaoRegistrationRouterAnswerV1, parseRouterAbEd25519YaoTenantRootWireV1, parseRouterAbOperationStepUpOperation, parseRouterAbPublicKeysetV2, parseRpcHexQuantity, parseRs256JwtForVerification, parseSessionJwt, parseSigningSessionSealRootConfig, parseStaticWalletConsoleBindingConfigV1, parseStoredRouterAbEcdsaPendingActivationV1, parseWalletEd25519SignerRecord, parseWalletId, parseWalletRecoveryOperationId, parseWalletRegistrationContextResponse, parseWalletRegistrationSetupRequest, parseWalletRegistrationSetupReservation, parseWalletRuntimeExecuteSignedDelegateRequest, parseWalletRuntimeExecuteSignedDelegateResponse, parseWalletRuntimeExecuteSignedDelegateResult, parseWalletRuntimeRelayerAccount, parseWalletRuntimeWalletIdentitiesResult, parseWalletRuntimeWalletIdentityRequest, parseWebAuthnRpId, parseWebAuthnSyncChallengeRecord, partitionRouterAbEd25519YaoProductRegistrationStateV1, postRouterAbSigningWorkerJson, prepareD1TenantStatement, prepareD1WalletAuthMethodInsertStatement, prepareD1WalletAuthMethodPutStatement, prepareD1WalletAuthMethodV2PutStatement, prepareD1WalletPutSignerStatement, prepareD1WalletPutSubjectStatement, prepareD1WebAuthnAuthenticatorInsertStatement, prepareD1WebAuthnAuthenticatorPutStatement, projectRouterAbEd25519YaoExactWalletSession, proposeWalletRegistrationSetup, publishableKeyRoutePrincipal, queryD1All, queryD1One, randomTenantRootCreationGrantBytesV1, readD1LinkedDeviceEcdsaSourceV1, readD1LinkedDeviceEd25519SourceV1, readEnvironmentCsv, readEnvironmentString, readJson, registrationPreparationIdFromString, requireD1RouterApiAuthScopeString, requireEnvironmentString, requireNormalizedSessionString, requireRuntimePolicyScope, resolveFreshRouterAbEcdsaMaterialActivation, resolvePublishableKeyApiCredentialAuth, resolveRequestOriginRateLimitKeyFromFetchHeaders, resolveRouterAbEd25519YaoCeremonyKeyFromRequestV1, resolveRuntimeTenantRootLineage, resolveSecretKeyApiCredentialAuth, resolveSourceIpFromFetchHeaders, resolveWalletRegistrationContext, resumeRegistrationDirectoryPublicationsV1, routeError, routeJson, routerAbEcdsaAtomicAuthorizationConfigured, routerAbEcdsaOperationInProgressResult, routerAbEcdsaOwnerOperationFailureResult, routerAbEcdsaRecordedResponse, routerAbEcdsaReplayHttpResponse, routerAbEcdsaReplayResult, routerAbEcdsaReplayUnavailableResult, routerAbEcdsaStrictRegistrationFactsBindingJson, routerAbEcdsaStrictRegistrationRequestBindingJson, routerAbEcdsaStrictRegistrationRequestMatchesFacts, routerAbEd25519OwnerOperationFailureResult, routerAbEd25519YaoAdmittedRegistrationAuthorityV1, routerAbEd25519YaoPartitionedStateAfterStoredCommitV1, routerAbEd25519YaoPersistedCapabilityMatchesLookupV1, routerAbEd25519YaoRegistrationExecutionTimingEntriesV1, routerAbEd25519YaoRegistrationSigningRootIdV1, routerAbEd25519YaoTenantRootWireV1, runRouterAbEd25519YaoProductRegistrationRequestScopedV1, runRouterAbEd25519YaoRegistrationSideEffectV1, runRouterAbEd25519YaoRegistrationTwoPhaseV1, runRouterAbPrewarmScheduledV1, runtimePolicyScopeKey, sameRouterAbEd25519YaoSharedStateCanonicalEncodingV1, secp256k1PrivateKey32ToPublicKey33, secp256k1PublicKey33ToEthereumAddress, secureRandomBase36, secureRandomBase64Url, selectWalletEd25519Signer, sessionJwtTimeClaims, sha256Bytes, sha256BytesSync, signSecp256k1Recoverable, signTenantRootCreationGrantV1, tenantRootIdentityDigestB64uV1, tenantStorageRouteBackendFamily, tenantStorageRouteDiagnostic, toFetchRouteResponse, normalizeOptionalTrimmedString as toOptionalTrimmedString, toResponse, toSessionArrayBufferCopy, unavailableRegistrationContext, validateDelegateExpiryAndNonce, validateGoogleIdTokenClaims, validateRuntimeSnapshotExpectation, validateSecp256k1PublicKey33, verifyGoogleOidcToken, verifyRs256JwtSignature, verifySecp256k1Bip340SignatureAgainstPublicKey33, verifySecp256k1RecoverableSignatureAgainstPublicKey33, walletAuthMethodId, walletAuthMethodV2Id, walletConsoleApiWalletGetRouteDefinitionV1, walletConsoleApiWalletListRouteDefinitionV1, walletConsoleApiWalletSearchRouteDefinitionV1, walletConsoleRelayRouteDefinitionsV1, walletConsoleSignedDelegateRouteDefinitionV1, walletConsoleSponsoredEvmCallRouteDefinitionV1, walletObjectIdentity, walletRegistrationContext, walletRegistrationSetupRequestDigest, webAuthnCredentialIdB64uFromCredential, withCors };
+export { API_CREDENTIAL_ROUTE_SCOPES, API_CREDENTIAL_TYPES, ActionType, CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, CloudflareD1AuthorizationStore, CloudflareD1GoogleEmailOtpRegistrationAttemptStore, CloudflareD1OidcJwksCache, CloudflareD1RouterAbEd25519YaoCapabilityPersistence, CloudflareD1RouterAbNormalSigningAdmissionStore, CloudflareD1VaultProxyStore, CloudflareD1VersionedJsonRecordStore, CloudflareD1VersionedJsonRecordStoreError, CloudflareD1WebAuthnAuthService, CloudflareD1WebAuthnStore, CloudflareDurableObjectVersionedJsonRecordStore, CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1, CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1, CloudflareVersionedJsonRecordStoreError, CrossSiteSessionCookieAdapter, D1IdentityStore, D1LinkedDeviceAuthorityInstallServiceV1, D1LinkedDeviceEd25519ExportRootStoreV1, D1LinkedDeviceRequestProofNonceStoreV1, D1LinkedDeviceSessionStoreV1, D1LinkedDeviceSourceContributionPreparationPlannerV1, D1LinkedDeviceTargetAuthenticatorStoreV1, D1LinkedDeviceTargetCredentialProviderV1, D1LinkedDeviceTargetPlannerV1, D1WalletAuthMethodStore, D1WalletObjectAddresses, D1WalletStore, D1_BATCH_CAS_GUARD_SQL, DEFAULT_SESSION_COOKIE_NAME, DEFAULT_WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_V1, DEFAULT_WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_V1, DEFAULT_WALLET_SESSION_REMAINING_USES, DEFAULT_WALLET_SESSION_TTL_MS, ED25519_SIGNER_ACTIVATION_ID_PATH, InMemoryRouterAbEd25519YaoExportService, InMemoryRouterAbEd25519YaoExportStateV1, InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter, InMemoryRouterAbEd25519YaoRegistrationService, InMemoryRouterAbNormalSigningAdmissionStore, LINKED_DEVICE_OWNER_AUTHORIZATION_PATH_V1, LinkedDeviceRetiredTargetRegistrationShapeErrorV1, LinkedDeviceSourceFamilyUnavailableErrorV1, LinkedDeviceWebAuthnRegistrationVerifierV1, LocalRegistrationSetupAuthority, MAX_WALLET_SESSION_REMAINING_USES, MAX_WALLET_SESSION_TTL_MS, PUBLIC_PROOF_TYPES, ROUTER_AB_ECDSA_DERIVATION_PRIVATE_SIGNING_PATHS, ROUTER_AB_ED25519_PRIVATE_SIGNING_PATHS, ROUTER_AB_ED25519_YAO_CAPABILITY_REPLACEMENT_TABLE_V1, ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_STATUS_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1, ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, ROUTER_AB_MPC_ROUTER_ORIGIN, ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, ROUTER_AB_SIGNING_WORKER_ORIGIN, ROUTER_AB_TRACE_ID_HEADER_V1, ROUTER_API_CREDENTIAL_SCOPES, ROUTE_SERVICE_KEYS, RouterAbEcdsaPresignRuntime, RouterAbEd25519YaoExportOwnerProofAuthorizationAdapter, RouterAbEd25519YaoHttpRegistrationBackend, RouterAbEd25519YaoRecoveryWalletSessionAuthorizationAdapter, SESSION_CAS_GUARD_SQL, SessionService, StaticCloudflareTenantStorageRouteResolver, UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, WALLET_AUTH_METHOD_D1_STORE, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL, WALLET_CONSOLE_API_WALLET_DETAIL_PREFIX_V1, WALLET_CONSOLE_OPS_BASE_PATH_V1, WALLET_CONSOLE_OP_PATHS_V1, WALLET_CONSOLE_SERVICE_ORIGIN_V1, WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_ID_V1, WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_ID_V1, WALLET_CONTROL_AUTH_MARKER_V1, WALLET_CONTROL_BASE_PATH_V1, WALLET_CONTROL_SERVICE_ORIGIN_V1, WALLET_RUNTIME_OPS_BASE_PATH_V1, WALLET_RUNTIME_OP_PATHS_V1, WALLET_RUNTIME_SERVICE_ORIGIN_V1, WALLET_STORE_D1_SCHEMA_SQL, WalletHomeCustodyBinding, WalletLifecycleLocator, WalletObjectAddressSnapshot, WalletPlacementRoutes, abusePrincipalKey, addSecp256k1PublicKeys33, admitD1EstablishedWalletHome, admitRouterAbEcdsaReusableWalletSessionOperation, applyRouteMetering, assertUniqueRouterApiRouteDefinitions, authenticateDeviceLinkingOwnerWalletSessionRequestV1, authenticateRouterAbEcdsaOperationStepUp, authenticateRouterAbWalletOperationStepUp, authenticateRouterAbWalletOperationStepUpIdentity, authorizeRouterAbEcdsaDerivationNormalSigningRoute, authorizeRouterAbEd25519NormalSigningRoute, base64UrlDecode, base64UrlEncode, bindWalletAuthMethodIdentity, bindWalletAuthMethodIdentityV2, buildCorsOrigins, buildRouterAbEcdsaDerivationPrivateSigningWorkerBody, buildRouterAbEcdsaOwnerOperationStepUpPreparation, buildRouterAbEd25519OwnerOperationStepUpPreparation, buildRouterAbEd25519PrivateSigningWorkerBody, buildRouterAbEd25519YaoAddSignerAdmissionRequestV1, buildRouterAbEd25519YaoProductAdmissionRequestV1, buildTenantRootIdentityFromAuthenticatedDeploymentV1, buildVerifiedLinkInputV1, buildVerifiedTargetFactorV1, buildWalletEcdsaSignerRecord, claimRouterAbEcdsaOperationStepUp, coerceLogger, coerceRouterLogger, completeRouterAbEcdsaOperation, computeEip1559TxHash, computeLinkedDeviceSessionClaimDigestV1, computeRouterAbEd25519NormalSigningAdmissionMaterial, computeVerifiedTargetFactorVerificationDigestV1, createCloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1RouterApiAuthService, createCloudflareD1VersionedJsonRecordStore, createCloudflareDurableObjectVersionedJsonRecordStore, createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1, createCloudflareRouter, createCloudflareTenantStorageRoute, createCloudflareWalletGatewayRouterV1, createD1LinkedDeviceOwnerAuthorizationMetadataSourceV1, createD1LinkedDeviceOwnerAuthorizationProviderV1, createD1LinkedDeviceOwnerSourceChildReaderV1, createD1LinkedDeviceRouteServiceV1, createD1LinkedDeviceSessionServiceV1, createD1LinkedDeviceSourceContributionPreparationPlannerV1, createD1LinkedDeviceVerifiedLinkSourceReaderV1, createDeviceLinkingOwnerRequestAuthenticatorV1, createEd25519SessionAdapter, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterApiRuntimeSnapshotConsumer, createRouterAbEcdsaEd25519CeremonyTokenIssuer, createRouterAbEcdsaStrictPostRegistrationPort, createRouterAbEcdsaStrictRegistrationPort, createRouterAbEd25519YaoCeremonyStateStoreV1, createRouterAbEd25519YaoExportModule, createRouterAbEd25519YaoHttpRegistrationBackendFromEnv, createRouterAbEd25519YaoMaterialActivationRefV1, createRouterAbEd25519YaoProductRegistrationCompositionFromPortsV1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, createRouterAbEd25519YaoProductRegistrationRequestScopedRuntimeV1, createRouterAbEd25519YaoProductRegistrationRuntimeV1, createRouterAbEd25519YaoProductRegistrationStateFromPartsV1, createRouterAbEd25519YaoProductRegistrationStateV1, createRouterAbEd25519YaoRegistrationModule, createRouterAbNormalSigningAdmissionAdapter, createRouterAbServiceBindingFetch, createRouterApiModule, createRouterApiRouteDefinitions, createSignerD1DoStorageTarget, createSigningSessionSealOptions, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, createStaticWalletConsoleBindingV1, createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1, createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, createWalletConsoleOpsClient, createWalletConsoleRelayProxyExtensionV1, createWalletControlClientBindings, createWalletRegistrationContextResolver, createWalletRuntimeOpsHandler, d1ChangedRows, d1Integer, d1Number, decideRouterAbEcdsaOwnerOperationAuthorization, decideRouterAbEd25519OwnerOperationAuthorization, decodeEvmBlockHeader, decodeEvmTransactionByHash, decodeEvmTransactionCall, decodeEvmTransactionReceipt, decodeJsonRpcEnvelope, decodeWalletConsoleTenantRootActiveLineageRequestV1, decodeWalletConsoleTenantRootActiveLineageResponseV1, defineRoute, defineRouteExtension, deriveJwtExpiresAtIso, deriveRecoveryCodeLocatorV1FromBytes, digestOpaqueValue, encodeEip1559SignedTxFromSignature65, encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1, encodeRouterAbEd25519YaoProductRegistrationStateV1, encodeSessionJsonSegment, encodeTenantRootIdentityV1, enforceDelegatePolicy, enforceRoutePolicy, ensureEvmCryptoWasm, ensureLeadingSlash, ensureWalletAuthMethodStoreD1Schema, ensureWalletStoreD1Schema, evaluateRouterAbNormalSigningAdmission, executeRouterAbEd25519YaoAdmittedRegistrationV1, executeSignedDelegateWithRelayer, extractBearerCredential, extractRouterApiEnvironmentId, findRouteDefinitionById, findRouteDefinitionForRequest, formatD1ExecStatement, getRouterApiRouteExtensionDefinitions, getRouterApiRouteExtensionRoutes, getRouterApiRouteExtensionsForTransport, handleRouterAbEcdsaDerivationNormalSigningRouteCore, handleRouterAbEd25519YaoExportRequestScopedCloudflareV1, handleRouterAbEd25519YaoRecoveryRequestScopedCloudflareV1, handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1, handleStaticWalletConsoleRequestV1, handleWalletControlRequest, headersToRecord, isD1DatabaseLike, isObject, isPlainObject, json, jsonFailure, keccak256Bytes, linkedDeviceSignerManifestsEqualV1, linkedDeviceX25519RecipientPublicKeyB64uV1, loadCloudflareSignerWasmModule, matchesRouteDefinitionRequest, mergeRouterAbEd25519YaoProductRegistrationStatePartitionV1, mintRouterAbEd25519YaoRegistrationIdentityV1, normalizeBoundedPositiveInteger, normalizeCorsOrigin, normalizeD1RouterApiAuthOptions, normalizeHashToBytes, normalizeLinkedDevicePasskeyTargetConfigurationV1, normalizeLogger, normalizeLowercaseString, normalizeSessionString, normalizeSessionTtlSeconds, normalizeSourceIp, normalizeTrimmedString, normalizeWalletAuthMethod, normalizeWalletAuthMethodV2, parseBooleanFlag, parseBooleanJwtClaim, parseCacheControlMaxAgeSec, parseCsvList, parseD1JsonArrayColumn, parseD1JsonColumn, parseD1JsonObjectColumn, parseD1LinkedDeviceSessionRowV1, parseD1LinkedDeviceSessionTranscriptRowV1, parseExternalAuthConfiguration, parseExternalAuthProvider, parseGoogleEmailOtpRegistrationAttemptRecord, parseGoogleEmailOtpRegistrationOfferCandidates, parseGoogleJwks, parseGoogleLoginVerifyRequest, parseInstalledEcdsaCustodySnapshotV1, parseJwtAud, parseLinkedDeviceSessionRecordV1, parseOrgId, parseRecoveryCodeLocatorV1, parseRouterAbEcdsaEd25519PrivateJwk, parseRouterAbEcdsaPresignRuntimeConfig, parseRouterAbEcdsaStrictRegistrationTopology, parseRouterAbEd25519NormalSigningScopeV2, parseRouterAbEd25519OperationStepUpScope, parseRouterAbEd25519YaoActivationKeysetFromEnvV1, parseRouterAbEd25519YaoCeremonyKeyV1, parseRouterAbEd25519YaoExportAdmissionEnvelopeV1, parseRouterAbEd25519YaoExportExecuteEnvelopeV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordJsonV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoProductRegistrationStateJsonV1, parseRouterAbEd25519YaoProductRegistrationStateV1, parseRouterAbEd25519YaoRegistrationAdmissionReadV1, parseRouterAbEd25519YaoRegistrationRouterAnswerV1, parseRouterAbEd25519YaoTenantRootWireV1, parseRouterAbOperationStepUpOperation, parseRouterAbPublicKeysetV2, parseRpcHexQuantity, parseRs256JwtForVerification, parseSessionJwt, parseSigningSessionSealRootConfig, parseStaticWalletConsoleBindingConfigV1, parseStoredRouterAbEcdsaPendingActivationV1, parseWalletEd25519SignerRecord, parseWalletId, parseWalletRecoveryOperationId, parseWalletRegistrationContextResponse, parseWalletRegistrationSetupRequest, parseWalletRegistrationSetupReservation, parseWalletRuntimeExecuteSignedDelegateRequest, parseWalletRuntimeExecuteSignedDelegateResponse, parseWalletRuntimeExecuteSignedDelegateResult, parseWalletRuntimeRelayerAccount, parseWalletRuntimeWalletIdentitiesResult, parseWalletRuntimeWalletIdentityRequest, parseWebAuthnRpId, parseWebAuthnSyncChallengeRecord, partitionRouterAbEd25519YaoProductRegistrationStateV1, postRouterAbSigningWorkerJson, prepareD1TenantStatement, prepareD1WalletAuthMethodInsertStatement, prepareD1WalletAuthMethodPutStatement, prepareD1WalletAuthMethodV2PutStatement, prepareD1WalletPutSignerStatement, prepareD1WalletPutSubjectStatement, prepareD1WebAuthnAuthenticatorInsertStatement, prepareD1WebAuthnAuthenticatorPutStatement, projectRouterAbEd25519YaoExactWalletSession, proposeWalletRegistrationSetup, publishableKeyRoutePrincipal, queryD1All, queryD1One, randomTenantRootCreationGrantBytesV1, readD1LinkedDeviceEcdsaSourceV1, readD1LinkedDeviceEd25519SourceV1, readEnvironmentCsv, readEnvironmentString, readJson, registrationPreparationIdFromString, requireD1RouterApiAuthScopeString, requireEnvironmentString, requireNormalizedSessionString, requireRuntimePolicyScope, resolveFreshRouterAbEcdsaMaterialActivation, resolvePublishableKeyApiCredentialAuth, resolveRequestOriginRateLimitKeyFromFetchHeaders, resolveRouterAbEd25519YaoCeremonyKeyFromRequestV1, resolveRuntimeTenantRootLineage, resolveSecretKeyApiCredentialAuth, resolveSourceIpFromFetchHeaders, resolveWalletRegistrationContext, resumeRegistrationDirectoryPublicationsV1, routeError, routeJson, routerAbEcdsaAtomicAuthorizationConfigured, routerAbEcdsaOperationInProgressResult, routerAbEcdsaOwnerOperationFailureResult, routerAbEcdsaRecordedResponse, routerAbEcdsaReplayHttpResponse, routerAbEcdsaReplayResult, routerAbEcdsaReplayUnavailableResult, routerAbEcdsaStrictRegistrationFactsBindingJson, routerAbEcdsaStrictRegistrationRequestBindingJson, routerAbEcdsaStrictRegistrationRequestMatchesFacts, routerAbEd25519OwnerOperationFailureResult, routerAbEd25519YaoAdmittedRegistrationAuthorityV1, routerAbEd25519YaoPartitionedStateAfterStoredCommitV1, routerAbEd25519YaoPersistedCapabilityMatchesLookupV1, routerAbEd25519YaoRegistrationExecutionTimingEntriesV1, routerAbEd25519YaoRegistrationSigningRootIdV1, routerAbEd25519YaoTenantRootWireV1, runRouterAbEd25519YaoProductRegistrationRequestScopedV1, runRouterAbEd25519YaoRegistrationSideEffectV1, runRouterAbEd25519YaoRegistrationTwoPhaseV1, runRouterAbPrewarmScheduledV1, runtimePolicyScopeKey, sameRouterAbEd25519YaoSharedStateCanonicalEncodingV1, secp256k1PrivateKey32ToPublicKey33, secp256k1PublicKey33ToEthereumAddress, secureRandomBase36, secureRandomBase64Url, selectWalletEd25519Signer, sessionJwtTimeClaims, sha256Bytes, sha256BytesSync, signSecp256k1Recoverable, signTenantRootCreationGrantV1, tenantRootIdentityDigestB64uV1, tenantStorageRouteBackendFamily, tenantStorageRouteDiagnostic, toFetchRouteResponse, normalizeOptionalTrimmedString as toOptionalTrimmedString, toResponse, toSessionArrayBufferCopy, unavailableRegistrationContext, validateDelegateExpiryAndNonce, validateGoogleIdTokenClaims, validateRuntimeSnapshotExpectation, validateSecp256k1PublicKey33, verifyGoogleOidcToken, verifyRs256JwtSignature, verifySecp256k1Bip340SignatureAgainstPublicKey33, verifySecp256k1RecoverableSignatureAgainstPublicKey33, walletAuthMethodId, walletAuthMethodV2Id, walletConsoleApiWalletGetRouteDefinitionV1, walletConsoleApiWalletListRouteDefinitionV1, walletConsoleApiWalletSearchRouteDefinitionV1, walletConsoleRelayRouteDefinitionsV1, walletConsoleSignedDelegateRouteDefinitionV1, walletConsoleSponsoredEvmCallRouteDefinitionV1, walletObjectIdentity, walletRegistrationContext, walletRegistrationSetupRequestDigest, webAuthnCredentialIdB64uFromCredential, withCors };

package/dist/esm/core/nearRelayerAccountProvisioning.js

@@ -4,9 +4,9 @@ import { sha256Bytes } from "../shared-ts/src/utils/digests.js";
 import { failure } from "../shared-ts/src/utils/failure.js";
 import { base58Encode } from "../shared-ts/src/utils/base58.js";
 import "../shared-ts/src/utils/encoders.js";
+import { errorMessage } from "../shared-ts/src/utils/errors.js";
 import { ActionType, validateActionArgsWasm } from "../shared-ts/src/near/actions.js";
 import { deriveImplicitNearAccountIdFromEd25519PublicKey, parseImplicitNearAccountId, parseNamedNearAccountId } from "../shared-ts/src/utils/near.js";
-import { errorMessage } from "../shared-ts/src/utils/errors.js";
 import { threshold_ed25519_build_near_tx_unsigned_borsh, threshold_ed25519_decode_signed_near_tx_borsh, threshold_ed25519_finalize_near_tx_from_signature } from "../wasm/near_signer/pkg/wasm_signer_worker.js";
 import { toPublicKeyStringFromSecretKey } from "./nearKeys.js";
 import { requireFinalizeNearTxFromSignatureOutput, requireSingleUnsignedNearTxBorshOutput, signNearDigestWithSecretKey } from "./authService/nearPrivateKeySigning.js";

package/dist/esm/router/cloudflare/d1/auth/d1AuthorizedOperationRouteService.js

@@ -1,10 +1,12 @@
 import { parseTenantId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { resolveRecordedPasskeyOwnerOperation } from "./d1RecordedOwnerOperation.js";
 //#region src/router/cloudflare/d1/auth/d1AuthorizedOperationRouteService.ts
 function createD1AuthorizedOperationRouteService(assembly) {
 	const tenantId = parseTenantId(assembly.options.orgId);
 	if (!tenantId.ok) throw new Error(`orgId cannot identify an authorization tenant: ${tenantId.error.message}`);
 	return {
 		tenantId: tenantId.value,
+		resolveRecordedPasskeyOwnerOperation: resolveRecordedPasskeyOwnerOperation.bind(null, assembly, tenantId.value),
 		resolveEcdsaWalletSessionOperation: assembly.authorizationStore.resolveEcdsaWalletSessionOperation.bind(assembly.authorizationStore),
 		admitEcdsaWalletSessionOperation: assembly.authorizationStore.admitEcdsaWalletSessionOperation.bind(assembly.authorizationStore),
 		admitEd25519WalletSessionOperation: assembly.authorizationStore.admitEd25519WalletSessionOperation.bind(assembly.authorizationStore),

package/dist/esm/router/cloudflare/d1/auth/d1RecordedOwnerOperation.js

@@ -0,0 +1,43 @@
+import { CAPABILITY_KINDS } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
+//#region src/router/cloudflare/d1/auth/d1RecordedOwnerOperation.ts
+/** A continuation uses only the factor digest and exact operation recorded after owner verification. */
+async function resolveRecordedPasskeyOwnerOperation(source, tenantId, input) {
+	const operation = await source.authorizationService.readAuthorizedOperationById({
+		tenantId,
+		authorizedOperationId: input.authorizedOperationId
+	});
+	if (!operation || operation.authorization.kind !== "verified_step_up" || operation.quota.kind !== "quota_neutral" || operation.operation.operation.capabilityKind !== CAPABILITY_KINDS.nearEd25519MpcSigning) return null;
+	const scope = source.options;
+	const evidence = await scope.database.prepare(`SELECT authority_digest, expires_at_ms
+       FROM verified_wallet_operation_evidence_sets
+      WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
+        AND tenant_id = ? AND wallet_id = ? AND principal_id = ?
+        AND evidence_set_digest = ? AND request_origin = ? AND audience = ?
+        AND lane_digest = ? AND intent_digest = ? AND display_digest = ?
+        AND capability_kind = ? AND operation_kind = ?
+        AND verified_at_ms <= ? AND expires_at_ms > ? AND assurance = 'step_up'
+      LIMIT 1`).bind(scope.namespace, scope.orgId, scope.projectId, scope.envId, tenantId, input.walletId, operation.operation.principalId, operation.authorization.evidenceSetDigest, input.requestOrigin, input.requestOrigin, operation.operation.digests.laneDigest, operation.operation.digests.intentDigest, operation.operation.digests.displayDigest, operation.operation.operation.capabilityKind, operation.operation.operation.operationKind, input.nowMs, input.nowMs).first();
+	if (!evidence || typeof evidence.authority_digest !== "string" || typeof evidence.expires_at_ms !== "number") return null;
+	const methods = await source.walletAuthMethodStore.listForWalletV2({ walletId: input.walletId });
+	for (const method of methods) {
+		if (method.kind !== "passkey" || method.status !== "active") continue;
+		const resolved = await source.walletAuthMethods.resolveActivePasskeyAuthorityForVerifiedCredential({
+			walletId: input.walletId,
+			rpId: method.rpId,
+			credentialIdB64u: method.credentialIdB64u
+		});
+		if (!resolved.ok) continue;
+		if ((await walletAuthAuthorityRef({ authority: resolved.authority })).authorityDigest !== evidence.authority_digest) continue;
+		return {
+			operation,
+			authority: resolved.authority,
+			expiresAtMs: evidence.expires_at_ms
+		};
+	}
+	return null;
+}
+//#endregion
+export { resolveRecordedPasskeyOwnerOperation };
+
+//# sourceMappingURL=d1RecordedOwnerOperation.js.map

package/dist/esm/router/cloudflare/d1/auth/d1RouterApiAuthService.js

@@ -5,12 +5,12 @@ import { ExternalAuthService } from "../../../../auth/externalAuthService.js";
 import { ExternalAuthStore } from "../../../../auth/externalAuthStore.js";
 import { parseDeviceId, parsePrincipalId, parseTenantId, parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { parseRouterAbEcdsaRegistrationActivationReceiptV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { parseWebAuthnAuthenticationCredential } from "../../../auth/webAuthnCredentialCodecs.js";
 import { D1WalletStore } from "../../../../core/d1WalletStore.js";
 import { D1WalletAuthMethodStore } from "../../../../core/d1WalletAuthMethodStore.js";
 import { normalizeLogger } from "../../../../core/logger.js";
 import { executeSignedDelegateWithRelayer } from "../../../../delegateAction/index.js";
 import { parseWalletUnlockIssuanceRejectionCode } from "../../../framework/authServicePort.js";
-import { parseWebAuthnAuthenticationCredential } from "../../../auth/webAuthnCredentialCodecs.js";
 import { resolveActiveOwnerWalletExecutionLane, resolveWalletAuthMethodIdForAuthority } from "../../../../core/signingLanes/WalletExecutionLaneProjection.js";
 import { DEFAULT_WALLET_SESSION_TTL_MS, LINKED_DEVICE_WALLET_SESSION_TTL_MS } from "../../../../shared-ts/src/threshold/sessionPolicy.js";
 import { createDeviceLinkingOwnerRequestAuthenticatorV1 } from "../../../transport/fetch/routes/deviceLinkingOwnerAuthorization.js";
@@ -475,6 +475,27 @@ function parseWalletRegistrationSessionCommitReceipt(raw) {
 function parseWalletRegistrationSessionCommitReceiptCommitted(raw, receipt) {
 	const record = toRecordValue(raw);
 	if (!record || typeof record.kind !== "string") return null;
+	if (record.kind === "near_owner_ready") {
+		if (!hasExactKeys(record, [
+			"kind",
+			"expectedOrigin",
+			"response"
+		])) return null;
+		const response = parseD1WalletRegistrationFinalizeReplayResponse(record.response);
+		if (!response?.ok || response.kind !== "near_ed25519") return null;
+		let expectedOrigin;
+		try {
+			expectedOrigin = new URL(String(record.expectedOrigin)).origin;
+		} catch {
+			return null;
+		}
+		if (expectedOrigin !== record.expectedOrigin) return null;
+		return {
+			kind: "near_owner_ready",
+			expectedOrigin,
+			response
+		};
+	}
 	if (record.kind === "ecdsa_ready") {
 		if (!hasExactKeys(record, [
 			"kind",

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRecoveryService.js

@@ -2,8 +2,8 @@ import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/
 import { failedVerification, failure } from "../../../../shared-ts/src/utils/failure.js";
 import { parseD1BoundaryWalletIdResult } from "../auth/d1RouterApiAuthBoundary.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
-import { validateSecp256k1PublicKey33, verifySecp256k1RecoverableSignatureAgainstPublicKey33 } from "../../../../core/ThresholdService/evmCryptoWasm.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
+import { validateSecp256k1PublicKey33, verifySecp256k1RecoverableSignatureAgainstPublicKey33 } from "../../../../core/ThresholdService/evmCryptoWasm.js";
 import { bytesEqual, clampedEmailOtpUnlockTtlMs, decodeFixedBase64Url, emailOtpUnlockChallengeRecord } from "./d1EmailOtpRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpRecoveryService.ts
 function errorMessage(error) {

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer.js

@@ -1,7 +1,7 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { failure } from "../../../../shared-ts/src/utils/failure.js";
-import { validateSecp256k1PublicKey33 } from "../../../../core/ThresholdService/evmCryptoWasm.js";
 import { emailOtpDeviceEnrollmentId } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
+import { validateSecp256k1PublicKey33 } from "../../../../core/ThresholdService/evmCryptoWasm.js";
 import { validateEmailOtpEnrollmentMaterial } from "./d1EmailOtpRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer.ts
 function parseEmailOtpEnrollmentMaterialBoundaryInput(value) {

package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpSessionResolver.js

@@ -3,8 +3,8 @@ import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/
 import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { parseD1BoundaryWalletId, parseD1BoundaryWalletIdResult } from "../auth/d1RouterApiAuthBoundary.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
-import { createServerAllocatedWalletId } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
+import { createServerAllocatedWalletId } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { abandonedGoogleEmailOtpRegistrationAttemptRecord, expiredGoogleEmailOtpRegistrationAttemptRecord, googleEmailOtpRegistrationOfferForResponse, requireRuntimePolicyScope } from "./d1GoogleEmailOtpRegistrationRecords.js";
 import { googleEmailOtpStaleIdentityMapping, hasDifferentWalletIdentitySubject } from "../identity/d1IdentityRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpSessionResolver.ts

package/dist/esm/router/cloudflare/d1/passkeyCustody/d1PasskeyCustodyRouteService.js

@@ -6,10 +6,10 @@ import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilit
 import { isActiveRecoveredWalletAuthorityV1, walletAuthorityDigestsMatchV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { PASSKEY_PRF_FIRST_SALT_V1, PASSKEY_PRF_SECOND_SALT_V1 } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
-import { isHostWithinRpId, originHostnameOrEmpty } from "../../../../core/authService/webauthnOidcHelpers.js";
+import { deriveRecoveryCodeLocatorV1FromBytes } from "../../../../shared-ts/src/wallet-recovery/recoveryCodeLocator.js";
 import { buildWalletRecoveryBackupAcknowledgementV1, walletRecoveryBackupIsOutstanding } from "../../../../shared-ts/src/wallet-recovery/backupAcknowledgement.js";
 import "../../../../shared-ts/src/wallet-recovery/recoveryCodes.js";
-import { deriveRecoveryCodeLocatorV1FromBytes } from "../../../../shared-ts/src/wallet-recovery/recoveryCodeLocator.js";
+import { isHostWithinRpId, originHostnameOrEmpty } from "../../../../core/authService/webauthnOidcHelpers.js";
 import { buildWebAuthnRecoveryContinuityAnchorRecord } from "../webauthn/d1WebAuthnRecords.js";
 import { buildWalletRecoveryCommittedProjectionV1 } from "../../../../shared-ts/src/wallet-recovery/walletRecoveryCommittedProjection.js";
 import { envelopeFactorRef } from "./d1PasskeyCustodyEnvelopeStore.js";

package/dist/esm/router/cloudflare/d1/passkeyCustody/d1WalletCustodyCommitStore.js

@@ -4,15 +4,15 @@ import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
 import { buildDelegatedWalletAuthorityV1, buildFullOwnerDelegatedWalletAuthorityV1, sameDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { sameWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { sameVerifiedActiveWalletAuthorityV1, walletAuthorityDigestsMatchV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
+import { WALLET_EMAIL_OTP_ACTIONS, emailOtpDeviceEnrollmentId } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { D1WalletAuthMethodStore } from "../../../../core/d1WalletAuthMethodStore.js";
 import { parsePasskeyCustodyEnvelopeRecord } from "../../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
-import { WALLET_EMAIL_OTP_ACTIONS, emailOtpDeviceEnrollmentId } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
+import { parseRecoveryCodeLocatorV1 } from "../../../../shared-ts/src/wallet-recovery/recoveryCodeLocator.js";
 import { parseDerivedWalletRecoveryKeyId } from "../../../../shared-ts/src/wallet-recovery/recoveryKeyId.js";
 import { parseWalletRecoveryBackupAcknowledgementV1 } from "../../../../shared-ts/src/wallet-recovery/backupAcknowledgement.js";
 import "../../../../shared-ts/src/wallet-recovery/recoveryCodes.js";
 import { parseWalletRecoveryEnvelopeSetRecord } from "../../../../shared-ts/src/wallet-recovery/walletRecoveryEnvelopeSet.js";
-import { parseRecoveryCodeLocatorV1 } from "../../../../shared-ts/src/wallet-recovery/recoveryCodeLocator.js";
 import { reservePasskeyCredential } from "../../../../core/passkeyCredentialClaims.js";
 import { prepareD1WebAuthnCredentialBindingInsertStatement } from "../../../../core/WebAuthnCredentialBindingStore.js";
 import { prepareD1WebAuthnAuthenticatorInsertStatement } from "../webauthn/d1WebAuthnStore.js";

package/dist/esm/router/cloudflare/d1/passkeyCustody/d1WalletRecoveryGoogleEmailOtpService.js

@@ -5,9 +5,9 @@ import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimit
 import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import "../../../../shared-ts/src/utils/encoders.js";
 import { buildWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
-import { consumeReservedRecoveryCode } from "../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
-import { hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
+import { hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
+import { consumeReservedRecoveryCode } from "../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
 import { sealEmailOtpFactorSecretForWorker } from "../../../domains/emailOtp/emailOtpRouteHandlers.js";
 import { markWalletRecoveryGoogleEmailOtpAttemptIssued, markWalletRecoveryGoogleEmailOtpAttemptVerified, sameWalletRecoveryGoogleEmailOtpFinalizationInputV1, walletRecoveryGoogleEmailOtpFinalizationInput } from "./d1WalletRecoveryGoogleEmailOtpRecords.js";
 import { buildWalletRecoveryEcdsaPossessionChallengesV1, resolveWalletRecoveryKeyManifestV1, verifyWalletRecoveryKeyActivationsV1 } from "../../../domains/passkeyCustody/walletRecoveryKeyManifest.js";

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyRecords.js

@@ -49,6 +49,7 @@ function buildRegistrationIntent(input) {
 	const foundingWalletAuthMethodId = input.foundingWalletAuthMethodId;
 	if (input.runtimePolicyScope) return {
 		version: "registration_intent_v1",
+		completion: input.completion,
 		walletId: input.walletId,
 		authMethod: input.authMethod,
 		signerSelection: input.signerSelection,
@@ -58,6 +59,7 @@ function buildRegistrationIntent(input) {
 	};
 	return {
 		version: "registration_intent_v1",
+		completion: input.completion,
 		walletId: input.walletId,
 		authMethod: input.authMethod,
 		signerSelection: input.signerSelection,
@@ -139,6 +141,7 @@ function parseD1RegistrationIntent(raw) {
 	if (record.runtimePolicyScope !== void 0 && !runtimePolicyScope) return null;
 	if (runtimePolicyScope) return {
 		version: "registration_intent_v1",
+		completion: parsePersistedRegistrationCompletion(record.completion),
 		walletId,
 		authMethod,
 		signerSelection: signerSelection.value,
@@ -148,6 +151,7 @@ function parseD1RegistrationIntent(raw) {
 	};
 	return {
 		version: "registration_intent_v1",
+		completion: parsePersistedRegistrationCompletion(record.completion),
 		walletId,
 		authMethod,
 		signerSelection: signerSelection.value,
@@ -2046,6 +2050,11 @@ function safeInteger(raw) {
 function unreachableAddAuthMethodInput(value) {
 	throw new Error(`Unhandled add-auth-method input kind: ${String(value)}`);
 }
+function parsePersistedRegistrationCompletion(raw) {
+	if (raw === void 0 || raw === "wallet_session") return "wallet_session";
+	if (raw === "owner_operations") return "owner_operations";
+	throw new Error("Stored registration completion is invalid");
+}
 //#endregion
 export { buildAddAuthMethodIntent, buildAddSignerIntent, buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, buildD1WalletRecord, buildRegistrationIntent, deriveEvmFamilySigningKeySlotId, inferRuntimePolicyScopeFromSigningRoot, intentScopeMetadata, normalizeThresholdEcdsaChainTargets, parseD1AddSignerIntent, parseD1EcdsaDerivationServerBootstrapResponse, parseD1RuntimePolicyScope, parseD1StoredAddAuthMethodIntent, parseD1StoredAddSignerAuth, parseD1StoredAddSignerIntent, parseD1StoredWalletAddAuthMethodCeremony, parseD1StoredWalletAddAuthMethodFinalizeReplay, parseD1StoredWalletAddSignerCeremony, parseD1StoredWalletAddSignerFinalizeReplay, parseD1StoredWalletRegistrationCeremony, parseD1WalletAddSignerFinalizeTerminalResponse, parseD1WalletRegistrationCommittedInstallationProjection, parseD1WalletRegistrationFinalizeReplayResponse, parseWalletIdForIntent, positiveIntegerArraysEqual, runtimePolicyScopeMatches, thresholdEcdsaChainTargetsEqual };
 

package/dist/esm/router/cloudflare/d1/registration/d1WalletExecutionAuthority.js

@@ -1,5 +1,6 @@
 import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
 import { prepareD1TenantStatement } from "../../../../core/d1TenantStore.js";
+import { parseRegistrationSessionPublication } from "../../../domains/walletRegistration/walletRegistrationReservation.js";
 //#region src/router/cloudflare/d1/registration/d1WalletExecutionAuthority.ts
 /** The finalize response normally delivers first; the scheduled resumption waits this long. */
 const DIRECTORY_PUBLICATION_FIRST_RETRY_MS = 6e4;
@@ -91,20 +92,18 @@ var D1WalletExecutionAuthority = class {
 		const publication = {
 			walletId: input.registration.walletId,
 			ceremonyId: input.registration.ceremonyId,
-			digest: input.session.digest,
-			expiresAtMs: input.session.expiresAtMs,
+			session: input.session,
 			attempts: 0
 		};
 		return {
 			statements: [...this.prepareState(input.registration, "active"), prepareD1TenantStatement(this.database, this.scope, `INSERT INTO wallet_registration_directory_publications
              (namespace, org_id, project_id, env_id, wallet_id, ceremony_id,
-              session_digest, session_expires_at_ms, next_attempt_at_ms)
-           VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9)
+              session_json, next_attempt_at_ms)
+           VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8)
            ON CONFLICT DO NOTHING`, [
 				publication.walletId,
 				publication.ceremonyId,
-				publication.digest,
-				publication.expiresAtMs,
+				JSON.stringify(publication.session),
 				Date.now() + DIRECTORY_PUBLICATION_FIRST_RETRY_MS
 			])],
 			publish: async () => {
@@ -118,7 +117,7 @@ var D1WalletExecutionAuthority = class {
 	}
 	/** Sends the publications that are due, oldest first, one at a time. */
 	async resumeDirectoryPublications(input) {
-		const due = await prepareD1TenantStatement(this.database, this.scope, `SELECT wallet_id, ceremony_id, session_digest, session_expires_at_ms, attempts
+		const due = await prepareD1TenantStatement(this.database, this.scope, `SELECT wallet_id, ceremony_id, session_json, attempts
        FROM wallet_registration_directory_publications
        WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
          AND state = 'pending' AND next_attempt_at_ms <= ?5
@@ -133,8 +132,7 @@ var D1WalletExecutionAuthority = class {
 			const outcome = await this.deliver({
 				walletId: row.wallet_id,
 				ceremonyId: row.ceremony_id,
-				digest: row.session_digest,
-				expiresAtMs: row.session_expires_at_ms,
+				session: parseRegistrationSessionPublication(JSON.parse(row.session_json), row.wallet_id),
 				attempts: row.attempts
 			});
 			delivered[outcome] += 1;
@@ -148,12 +146,7 @@ var D1WalletExecutionAuthority = class {
 				ceremonyId: publication.ceremonyId,
 				walletId: publication.walletId,
 				outcome: "established",
-				session: {
-					kind: "credential",
-					walletId: publication.walletId,
-					digest: publication.digest,
-					expiresAtMs: publication.expiresAtMs
-				}
+				session: publication.session
 			});
 		} catch (error) {
 			console.warn("[wallet-registration] directory publication deferred", error);
@@ -194,7 +187,7 @@ var D1WalletExecutionAuthority = class {
 	}
 	/** The state update with its guard. The guard reads the row count of the update before it. */
 	prepareState(input, state) {
-		return [prepareD1TenantStatement(this.database, this.scope, `UPDATE wallet_execution_generations SET state = ?7
+		return [prepareD1TenantStatement(this.database, this.scope, `UPDATE wallet_execution_generations SET state = ?7, registration_completion = CASE WHEN ?7 = 'active' THEN 'established' ELSE registration_completion END
          WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
            AND wallet_id = ?5 AND origin = 'registration' AND origin_id = ?6
            AND state IN ('registering', ?7)`, [

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationService.js

@@ -2167,7 +2167,13 @@ var CloudflareD1WalletRegistrationService = class {
 			expectedOrigin: ownerProofContext.expectedOrigin,
 			expiresAtMs: args.input.authorization.kind === "wallet_session" ? args.setupClaims.expiresAtMs : ownerProofContext.expiresAtMs
 		});
-		const initialSessionPlan = sessionPredecessor.kind === "ed25519_only" && !registrationSignerBranchesFromPlan(source.ceremony.signerPlan).evmFamilyEcdsa ? {
+		const completion = source.kind === "stored_ceremony" ? source.ceremony.intent.completion : "wallet_session";
+		if (completion === "owner_operations" && args.input.onSessionCommitted) return unissuedRegistrationCommit({
+			ok: false,
+			code: "invalid_body",
+			message: "Owner-operation registration cannot seal a Wallet Session"
+		});
+		const initialSessionPlan = completion === "wallet_session" && sessionPredecessor.kind === "ed25519_only" && !registrationSignerBranchesFromPlan(source.ceremony.signerPlan).evmFamilyEcdsa ? {
 			kind: "initial_near",
 			store: this.registrationSessionStore,
 			request: {
@@ -2202,6 +2208,31 @@ var CloudflareD1WalletRegistrationService = class {
 				message: "NEAR provisioning committed a non-NEAR branch"
 			});
 		}
+		if (completion === "owner_operations") {
+			if (!this.registrationAuthority) throw new Error("Registration home completion is unavailable");
+			const custody = await execution.custody;
+			return {
+				kind: "owner_registered",
+				expectedOrigin: ownerProofContext.expectedOrigin,
+				response: {
+					...finalized,
+					walletCustody: custody.outcome,
+					registrationEstablishedSession: {
+						kind: "owner_operations",
+						walletId: finalized.walletId
+					}
+				},
+				custodyWrite: custody.kind === "prepared" ? custody.write : null,
+				activation: this.registrationAuthority.prepareEstablished({
+					registration: {
+						ceremonyId: args.input.registrationCeremonyId,
+						walletId: finalized.walletId,
+						state: "registering"
+					},
+					session: { kind: "none" }
+				})
+			};
+		}
 		if (!this.registrationAuthority) throw new Error("Registration home completion is unavailable");
 		const [issuance, custody] = await Promise.allSettled([recordRegistrationPromiseTiming({
 			sink: args.serverTiming,
@@ -2306,6 +2337,16 @@ var CloudflareD1WalletRegistrationService = class {
 	async replayWalletRegistrationNearProvisioningCommit(receipt) {
 		if (receipt.operation !== "near_provisioning") throw new Error("Registration NEAR provisioning receipt operation is invalid");
 		if (receipt.committed.kind === "error") return replayedRegistrationCommit(receipt.committed.error);
+		if (receipt.committed.kind === "near_owner_ready") {
+			const response = receipt.committed.response;
+			return replayedRegistrationCommit({
+				...response,
+				registrationEstablishedSession: {
+					kind: "owner_operations",
+					walletId: response.walletId
+				}
+			});
+		}
 		if (receipt.committed.kind !== "near_ready") throw new Error("Registration NEAR provisioning receipt branch is invalid");
 		if (!isRegistrationNearReadyReceipt(receipt)) throw new Error("Registration NEAR provisioning receipt branch is invalid");
 		const authMethod = registrationReplayAuthMethodFields(receipt);
@@ -2530,6 +2571,7 @@ var CloudflareD1WalletRegistrationService = class {
 						nowMs: Date.now()
 					})
 				}), waitUntil ? void 0 : cleanup]);
+				if (committed.registrationEstablishedSession.kind === "owner_operations") throw new Error("A Wallet Session continuation cannot complete owner-only registration");
 				const tokens = committed.registrationEstablishedSession.session.tokens;
 				if (!current || tokens.kind !== "near_ed25519_and_evm_family_ecdsa") throw new Error("NEAR continuation Wallet Session is no longer active");
 				recordRegistrationServerTiming(serverTiming, "near_finalize_total", totalStartedAtMs);

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationSetup.js

@@ -51,8 +51,20 @@ function normalizeWalletRegistrationSetupRequest(request) {
 		code: "invalid_body",
 		message: "authMethod is required"
 	};
+	const completion = request.completion;
+	if (completion !== "wallet_session" && completion !== "owner_operations") return {
+		ok: false,
+		code: "invalid_body",
+		message: "Registration completion is required"
+	};
+	if (completion === "owner_operations" && (signerSelection.value.signers.length !== 1 || signerSelection.value.signers[0]?.kind !== "near_ed25519" || authMethod.kind !== "passkey")) return {
+		ok: false,
+		code: "invalid_body",
+		message: "Owner-operation onboarding requires a NEAR-only wallet and a wallet-origin passkey"
+	};
 	return {
 		ok: true,
+		completion,
 		signerSelection: signerSelection.value,
 		authMethod
 	};

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationSetupExecution.js

@@ -97,6 +97,7 @@ async function completeReservedRegistrationSetup(input, dependencies, admitted,
 	if (!signingRootId) return walletRegistrationSetupError("invalid_body", "registration requires a signing root");
 	const registrationOperation = reservation;
 	const intent = buildRegistrationIntent({
+		completion: normalized.completion,
 		nonceB64u: registrationCeremonyId.slice(4),
 		walletId: wallet.walletId,
 		authMethod: normalized.authMethod,

package/dist/esm/router/cloudflare/d1/registration/registrationCompletionWrite.js

@@ -4,6 +4,7 @@ function registrationCommitCompletionWrite(execution) {
 	switch (execution.kind) {
 		case "unissued":
 		case "replayed": return null;
+		case "owner_registered":
 		case "session_issued":
 		case "session_issued_with_installation_projection":
 			if (!execution.custodyWrite) return execution.activation;