@seams/wallet-server 0.5.0

package/dist/esm/router/cloudflare/signingLanes/cloudflareOrdinaryInactiveSignerMaterialReservation.js

@@ -0,0 +1,477 @@
+import { mpcMaterialActivationRefsEqual } from "../../../shared-ts/src/utils/domainIds.js";
+import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
+import { routerAbMpcMaterialActivationRefFromWire, routerAbMpcMaterialActivationRefToWire } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { parseLinkedDeviceEcdsaSourceContributionBindingV1, parseLinkedDeviceEcdsaSourcePreservingActivationReceiptV1 } from "../../../shared-ts/src/device-linking/sourceContribution.js";
+import { createOrdinaryInactiveSignerMaterialReservationServiceV1, parseOrdinaryEcdsaSignerMaterialDeactivationResultV1, parseOrdinaryEcdsaSignerMaterialWorkerReservationV1, parseOrdinaryEd25519SignerMaterialDeactivationResultV1, parseOrdinaryEd25519SignerMaterialWorkerReservationV1, validateOrdinaryInactiveSignerMaterialDeactivationRequestV1, validateOrdinaryInactiveSignerMaterialReservationRequestV1 } from "../../../core/signingMaterial/ordinaryInactiveSignerMaterialReservation.js";
+//#region src/router/cloudflare/signingLanes/cloudflareOrdinaryInactiveSignerMaterialReservation.ts
+/** Source-preserving ordinary material paths implemented by the Cloudflare workers. */
+const CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1 = "/router-ab/router/ed25519-yao/execute-source-preserving";
+const CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1 = "/router-ab/signing-worker/ecdsa-derivation/reserve-inactive-source-preserving";
+const CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1 = "/router-ab/signing-worker/ed25519-yao/activate-reservation";
+const CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1 = "/router-ab/signing-worker/ecdsa-derivation/activate-reservation";
+const CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1 = "/router-ab/signing-worker/ed25519-yao/deactivate-reservation";
+const CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1 = "/router-ab/signing-worker/ecdsa-derivation/deactivate-reservation";
+function createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1(input) {
+	return { executeEd25519SourcePreservingV1: async (request) => {
+		const tenantRoot = await input.resolveTenantRoot(request);
+		return await postRouterJsonRequestV1(input, CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, {
+			source_binding: request.sourceBinding,
+			target: {
+				tenant_root: {
+					identity_digest_b64u: tenantRoot.identityDigestB64u,
+					custody_lineage_b64u: tenantRoot.custodyLineageB64u
+				},
+				application: request.applicationBinding,
+				participant_ids: request.participantIds,
+				target: {
+					binding: request.targetRequest.binding,
+					deriver_a_input: request.targetRequest.deriver_a_input,
+					deriver_b_input: request.targetRequest.deriver_b_input
+				}
+			}
+		}, "Ed25519 source-preserving Router execution");
+	} };
+}
+function createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1(input) {
+	return {
+		reserveInactiveEd25519SignerMaterialV1: async (request) => {
+			return ed25519ReservationFromSourceContributionV1(request);
+		},
+		reserveInactiveEcdsaSignerMaterialV1: async (request) => {
+			return parseEcdsaReservationResponseV1(request, await postReservationRequestV1(input, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, ecdsaReservationRequestToWireV1(request), "ecdsa_secp256k1"));
+		}
+	};
+}
+function createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1(input) {
+	return {
+		activateInactiveEd25519SignerMaterialV1: async (request) => await postActivationRequestV1(input, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, ed25519ActivationRequestToWireV1(request), "ed25519"),
+		activateInactiveEcdsaSignerMaterialV1: async (request) => await postActivationRequestV1(input, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, ecdsaActivationRequestToWireV1(request), "ecdsa_secp256k1")
+	};
+}
+function ecdsaReservationRequestToWireV1(request) {
+	return {
+		source_derivation: {
+			application_binding_digest_b64u: request.preparation.sourceDerivation.applicationBindingDigestB64u,
+			client_share_retry_counter: request.preparation.sourceDerivation.clientShareRetryCounter
+		},
+		source_contribution: request.preparation.sourceContribution
+	};
+}
+function ed25519ReservationFromSourceContributionV1(request) {
+	const sourceContribution = request.preparation.sourceContribution;
+	return {
+		kind: "ordinary_ed25519_signer_material_worker_reservation_v1",
+		keyFamily: "ed25519",
+		state: "inactive",
+		signer: request.signer,
+		materialActivation: request.plannedActivationRef,
+		participantIds: sourceContribution.participantIds,
+		activationReceipt: sourceContribution.activationReceipt,
+		clientMaterial: {
+			kind: "ordinary_ed25519_client_material_v1",
+			deriver_a_client_package: sourceContribution.deriver_a_client_package,
+			deriver_b_client_package: sourceContribution.deriver_b_client_package
+		},
+		serverMaterialReservationId: sourceContribution.reservationId
+	};
+}
+function ed25519ActivationRequestToWireV1(input) {
+	return {
+		binding: input.sourceContribution.targetBinding,
+		reservation_id: input.reservationId
+	};
+}
+function ecdsaActivationRequestToWireV1(input) {
+	return {
+		material_activation: routerAbMpcMaterialActivationRefToWire(input.preparation.sourceContribution.binding.target.activation),
+		reservation_id: input.reservationId
+	};
+}
+function parseEcdsaReservationResponseV1(request, raw) {
+	const reservation = exactResponseRecordV1(raw, [
+		"state",
+		"reservation_id",
+		"material_activation",
+		"binding",
+		"source_derivation",
+		"target_relayer_public_key33_b64u",
+		"threshold_public_key33_b64u",
+		"threshold_ethereum_address20_b64u",
+		"encrypted_target_client_share",
+		"encrypted_target_server_share"
+	], "ordinary ECDSA material reservation");
+	if (reservation.state !== "inactive" || typeof reservation.reservation_id !== "string") throw new Error("ordinary ECDSA material reservation response is invalid");
+	const materialActivation = routerAbMpcMaterialActivationRefFromWire(reservation.material_activation);
+	const sourceDerivation = parseEcdsaSourceDerivationResponseV1(reservation.source_derivation, request.preparation.sourceDerivation);
+	const binding = parseLinkedDeviceEcdsaSourceContributionBindingV1(reservation.binding);
+	const targetRelayerPublicKey33B64u = requireResponseTextV1(reservation.target_relayer_public_key33_b64u, "ordinary ECDSA target relayer public key");
+	const thresholdPublicKey33B64u = requireResponseTextV1(reservation.threshold_public_key33_b64u, "ordinary ECDSA threshold public key");
+	const thresholdEthereumAddress20B64u = requireResponseTextV1(reservation.threshold_ethereum_address20_b64u, "ordinary ECDSA threshold Ethereum address");
+	const activationReceipt = parseLinkedDeviceEcdsaSourcePreservingActivationReceiptV1({
+		state: "inactive",
+		binding,
+		sourceDerivation,
+		targetRelayerPublicKey33B64u,
+		thresholdPublicKey33B64u,
+		thresholdEthereumAddress20B64u,
+		normalSigning: buildEcdsaTargetNormalSigningStateV1({
+			sourceNormalSigning: sourceDerivation.sourceNormalSigning,
+			targetActivation: binding.target.activation,
+			targetClientPublicKey33B64u: binding.targetClientPublicKey33B64u,
+			targetRelayerPublicKey33B64u,
+			thresholdPublicKey33B64u,
+			thresholdEthereumAddress20B64u,
+			targetSigningWorkerRecipientPublicKeyB64u: targetSigningWorkerRecipientKeyV1(binding.target.signingWorkerRecipientPublicKeyB64u)
+		})
+	});
+	return {
+		kind: "ordinary_ecdsa_signer_material_worker_reservation_v1",
+		keyFamily: "ecdsa_secp256k1",
+		state: "inactive",
+		signer: request.signer,
+		materialActivation,
+		activationReceipt,
+		clientMaterial: {
+			kind: "ordinary_ecdsa_client_material_v1",
+			encryptedTargetClientShare: reservation.encrypted_target_client_share
+		},
+		serverMaterial: {
+			kind: "ordinary_ecdsa_inactive_server_material_v1",
+			reservationId: reservation.reservation_id,
+			encryptedTargetServerShare: reservation.encrypted_target_server_share
+		}
+	};
+}
+function parseEcdsaSourceDerivationResponseV1(raw, expected) {
+	const derivation = exactResponseRecordV1(raw, ["application_binding_digest_b64u", "client_share_retry_counter"], "ordinary ECDSA source derivation");
+	if (typeof derivation.application_binding_digest_b64u !== "string" || typeof derivation.client_share_retry_counter !== "number" || !Number.isSafeInteger(derivation.client_share_retry_counter) || derivation.client_share_retry_counter < 0) throw new Error("ordinary ECDSA source derivation response is invalid");
+	if (derivation.application_binding_digest_b64u !== expected.applicationBindingDigestB64u || derivation.client_share_retry_counter !== expected.clientShareRetryCounter) throw new Error("ordinary ECDSA source derivation response differs from the request");
+	return expected;
+}
+function buildEcdsaTargetNormalSigningStateV1(input) {
+	const sourceScope = input.sourceNormalSigning.scope;
+	return {
+		kind: "router_ab_ecdsa_derivation_normal_signing_v1",
+		scope: {
+			wallet_id: sourceScope.wallet_id,
+			ecdsa_threshold_key_id: sourceScope.ecdsa_threshold_key_id,
+			signing_root_id: sourceScope.signing_root_id,
+			signing_root_version: sourceScope.signing_root_version,
+			context: sourceScope.context,
+			public_identity: {
+				context_binding_b64u: sourceScope.public_identity.context_binding_b64u,
+				derivation_client_share_public_key33_b64u: input.targetClientPublicKey33B64u,
+				server_public_key33_b64u: input.targetRelayerPublicKey33B64u,
+				threshold_public_key33_b64u: input.thresholdPublicKey33B64u,
+				ethereum_address20_b64u: input.thresholdEthereumAddress20B64u,
+				client_share_retry_counter: sourceScope.public_identity.client_share_retry_counter,
+				server_share_retry_counter: sourceScope.public_identity.server_share_retry_counter
+			},
+			material_activation: routerAbMpcMaterialActivationRefToWire(input.targetActivation),
+			signing_worker: {
+				server_id: input.targetActivation.signingWorker,
+				key_epoch: sourceScope.signing_worker.key_epoch,
+				recipient_encryption_key: input.targetSigningWorkerRecipientPublicKeyB64u
+			},
+			activation_epoch: sourceScope.activation_epoch
+		}
+	};
+}
+function requireResponseTextV1(raw, label) {
+	if (typeof raw !== "string" || raw.length === 0) throw new Error(`${label} is invalid`);
+	return raw;
+}
+function targetSigningWorkerRecipientKeyV1(value) {
+	const bytes = base64UrlDecode(value);
+	if (bytes.length !== 32 || base64UrlEncode(bytes) !== value) throw new Error("ordinary ECDSA target signing-worker recipient is invalid");
+	let hex = "";
+	for (const byte of bytes) hex += byte.toString(16).padStart(2, "0");
+	return `x25519:${hex}`;
+}
+function exactResponseRecordV1(raw, keys, label) {
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new Error(`${label} response is invalid`);
+	const record = Object.fromEntries(Object.entries(raw));
+	if (!hasExactKeysV1(record, keys)) throw new Error(`${label} response is invalid`);
+	return record;
+}
+async function postReservationRequestV1(input, path, body, keyFamily) {
+	return await postSigningWorkerJsonRequestV1(input, path, body, `ordinary ${keyFamily} material reservation`);
+}
+async function postActivationRequestV1(input, path, body, keyFamily) {
+	return await postSigningWorkerJsonRequestV1(input, path, body, `ordinary ${keyFamily} material activation`);
+}
+async function postSigningWorkerJsonRequestV1(input, path, body, operation) {
+	const response = await input.fetch(new Request(`https://signing-worker.router-ab.internal${path}`, {
+		method: "POST",
+		headers: {
+			"content-type": "application/json",
+			"x-router-ab-internal-service-auth": input.internalServiceAuthSecret
+		},
+		body: JSON.stringify(body)
+	}));
+	if (!response.ok) throw new Error(`${operation} failed with HTTP ${response.status}`);
+	try {
+		return await response.json();
+	} catch {
+		throw new Error(`${operation} returned invalid JSON`);
+	}
+}
+async function postRouterJsonRequestV1(input, path, body, operation) {
+	const response = await input.fetch(new Request(`https://mpc-router.router-ab.internal${path}`, {
+		method: "POST",
+		headers: {
+			"content-type": "application/json",
+			"x-router-ab-internal-service-auth": input.internalServiceAuthSecret
+		},
+		body: JSON.stringify(body)
+	}));
+	if (!response.ok) throw new Error(`${operation} failed with HTTP ${response.status}`);
+	try {
+		return await response.json();
+	} catch {
+		throw new Error(`${operation} returned invalid JSON`);
+	}
+}
+function createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1(input) {
+	return {
+		deactivateInactiveEd25519SignerMaterialV1: async ({ materialActivation }) => await postDeactivationRequestV1(input, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, materialActivation, "ed25519"),
+		deactivateInactiveEcdsaSignerMaterialV1: async ({ materialActivation }) => await postDeactivationRequestV1(input, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, materialActivation, "ecdsa_secp256k1")
+	};
+}
+async function postDeactivationRequestV1(input, path, materialActivation, keyFamily) {
+	const response = await input.fetch(new Request(`https://signing-worker.router-ab.internal${path}`, {
+		method: "POST",
+		headers: {
+			"content-type": "application/json",
+			"x-router-ab-internal-service-auth": input.internalServiceAuthSecret
+		},
+		body: JSON.stringify({ material_activation: routerAbMpcMaterialActivationRefToWire(materialActivation) })
+	}));
+	if (!response.ok) throw new Error(`ordinary ${keyFamily} material deactivation failed with HTTP ${response.status}`);
+	let raw;
+	try {
+		raw = await response.json();
+	} catch {
+		throw new Error(`ordinary ${keyFamily} material deactivation returned invalid JSON`);
+	}
+	return parseDeactivationResponseV1(raw, keyFamily, materialActivation);
+}
+function parseDeactivationResponseV1(raw, keyFamily, expectedMaterialActivation) {
+	const response = exactResponseRecordV1(raw, [
+		"state",
+		"reservation_id",
+		"material_activation",
+		"revoked_at_ms"
+	], `ordinary ${keyFamily} material deactivation`);
+	if (response.state !== "revoked" || typeof response.reservation_id !== "string" || typeof response.revoked_at_ms !== "number") throw new Error(`ordinary ${keyFamily} material deactivation response is invalid`);
+	const materialActivation = routerAbMpcMaterialActivationRefFromWire(response.material_activation);
+	switch (keyFamily) {
+		case "ed25519": return parseOrdinaryEd25519SignerMaterialDeactivationResultV1({
+			keyFamily: "ed25519",
+			materialActivation: expectedMaterialActivation,
+			requestedAtMs: 0
+		}, {
+			kind: "ordinary_ed25519_signer_material_deactivation_v1",
+			keyFamily: "ed25519",
+			state: "revoked",
+			materialActivation,
+			serverMaterialReservationId: response.reservation_id,
+			revokedAtMs: response.revoked_at_ms
+		});
+		case "ecdsa_secp256k1": return parseOrdinaryEcdsaSignerMaterialDeactivationResultV1({
+			keyFamily: "ecdsa_secp256k1",
+			materialActivation: expectedMaterialActivation,
+			requestedAtMs: 0
+		}, {
+			kind: "ordinary_ecdsa_signer_material_deactivation_v1",
+			keyFamily: "ecdsa_secp256k1",
+			state: "revoked",
+			materialActivation,
+			serverMaterialReservationId: response.reservation_id,
+			revokedAtMs: response.revoked_at_ms
+		});
+		default: return assertNever(keyFamily);
+	}
+}
+function hasExactKeysV1(value, keys) {
+	const actual = Object.keys(value).sort();
+	const expected = [...keys].sort();
+	return actual.length === expected.length && actual.every((key, index) => key === expected[index]);
+}
+/**
+* Adapter for the ordinary inactive reservation endpoint. The endpoint owns
+* durable idempotency; this process-local journal prevents a retry from
+* silently changing the request while preserving the endpoint's exact result.
+*/
+var CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1 = class {
+	constructor(endpoint) {
+		this.endpoint = endpoint;
+		this.ed25519Reservations = /* @__PURE__ */ new Map();
+		this.ecdsaReservations = /* @__PURE__ */ new Map();
+	}
+	async reserveInactiveEd25519SignerMaterialV1(input) {
+		validateOrdinaryInactiveSignerMaterialReservationRequestV1(input);
+		const activationKey = materialActivationKeyV1(input.plannedActivationRef);
+		const requestFingerprint = ed25519RequestFingerprintV1(input);
+		const cached = this.ed25519Reservations.get(activationKey);
+		if (cached) {
+			assertSameReservationRequestV1(cached.requestFingerprint, requestFingerprint, "Ed25519");
+			return cached.reservation;
+		}
+		const reservation = parseOrdinaryEd25519SignerMaterialWorkerReservationV1(input, await this.endpoint.reserveInactiveEd25519SignerMaterialV1(input));
+		this.ed25519Reservations.set(activationKey, {
+			requestFingerprint,
+			reservation
+		});
+		return reservation;
+	}
+	async reserveInactiveEcdsaSignerMaterialV1(input) {
+		validateOrdinaryInactiveSignerMaterialReservationRequestV1(input);
+		const activationKey = materialActivationKeyV1(input.plannedActivationRef);
+		const requestFingerprint = ecdsaRequestFingerprintV1(input);
+		const cached = this.ecdsaReservations.get(activationKey);
+		if (cached) {
+			assertSameReservationRequestV1(cached.requestFingerprint, requestFingerprint, "ECDSA");
+			return cached.reservation;
+		}
+		const reservation = parseOrdinaryEcdsaSignerMaterialWorkerReservationV1(input, await this.endpoint.reserveInactiveEcdsaSignerMaterialV1(input));
+		this.ecdsaReservations.set(activationKey, {
+			requestFingerprint,
+			reservation
+		});
+		return reservation;
+	}
+};
+function createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1(input) {
+	return createOrdinaryInactiveSignerMaterialReservationServiceV1({ worker: new CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1(input.endpoint) });
+}
+var CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1 = class {
+	constructor(endpoint) {
+		this.endpoint = endpoint;
+		this.terminalOperations = /* @__PURE__ */ new Map();
+	}
+	async deactivateOrdinarySignerMaterialV1(input) {
+		validateOrdinaryInactiveSignerMaterialDeactivationRequestV1(input);
+		const operationKey = `${input.keyFamily}:${materialActivationKeyV1(input.materialActivation)}`;
+		const existing = this.terminalOperations.get(operationKey);
+		if (existing) return existing;
+		const operation = this.performDeactivationV1(input);
+		this.terminalOperations.set(operationKey, operation);
+		try {
+			await operation;
+		} catch (error) {
+			this.terminalOperations.delete(operationKey);
+			throw error;
+		}
+	}
+	async performDeactivationV1(input) {
+		switch (input.keyFamily) {
+			case "ed25519":
+				parseOrdinaryEd25519SignerMaterialDeactivationResultV1(input, await this.endpoint.deactivateInactiveEd25519SignerMaterialV1({ materialActivation: input.materialActivation }));
+				return;
+			case "ecdsa_secp256k1":
+				parseOrdinaryEcdsaSignerMaterialDeactivationResultV1(input, await this.endpoint.deactivateInactiveEcdsaSignerMaterialV1({ materialActivation: input.materialActivation }));
+				return;
+			default: return assertNever(input);
+		}
+	}
+};
+function createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1(input) {
+	return new CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1(input.endpoint);
+}
+var UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1 = class {
+	async deactivateOrdinarySignerMaterialV1(_input) {
+		throw ordinaryReservationEndpointUnavailableErrorV1();
+	}
+};
+function createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1() {
+	return new UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1();
+}
+function createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1(input) {
+	return new CloudflareOrdinaryInactiveSignerMaterialActivationWorkerV1(input.endpoint);
+}
+/** Explicit fail-closed port for deployments without a configured endpoint. */
+var UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1 = class {
+	async reserveInactiveEd25519SignerMaterialV1(_input) {
+		throw ordinaryReservationEndpointUnavailableErrorV1();
+	}
+	async reserveInactiveEcdsaSignerMaterialV1(_input) {
+		throw ordinaryReservationEndpointUnavailableErrorV1();
+	}
+};
+function createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1() {
+	return new UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1();
+}
+function materialActivationKeyV1(ref) {
+	return JSON.stringify([
+		ref.activationId,
+		ref.capability,
+		ref.materialOwner,
+		ref.keyBinding,
+		ref.lifecycleBinding,
+		ref.signingWorker
+	]);
+}
+function ed25519RequestFingerprintV1(input) {
+	return JSON.stringify([
+		input.kind,
+		input.keyFamily,
+		input.signer.kind,
+		input.signer.walletId,
+		input.signer.walletKeyId,
+		input.signer.registeredPublicKeyB64u,
+		materialActivationKeyV1(input.plannedActivationRef),
+		JSON.stringify(input.preparation)
+	]);
+}
+function ecdsaRequestFingerprintV1(input) {
+	return JSON.stringify([
+		input.kind,
+		input.keyFamily,
+		input.signer.kind,
+		input.signer.walletId,
+		input.signer.walletKeyId,
+		input.signer.thresholdPublicKey33B64u,
+		input.signer.evmAddress,
+		materialActivationKeyV1(input.plannedActivationRef),
+		JSON.stringify(input.preparation)
+	]);
+}
+function assertSameReservationRequestV1(expectedFingerprint, actualFingerprint, family) {
+	if (expectedFingerprint === actualFingerprint) return;
+	throw new Error(`ordinary inactive ${family} signer material reservation conflicts for activation ref`);
+}
+function ordinaryReservationEndpointUnavailableErrorV1() {
+	return /* @__PURE__ */ new Error("ordinary inactive signer material reservation endpoint is unavailable; refusing activation fallback");
+}
+function assertNever(value) {
+	throw new Error(`unsupported ordinary signer material family: ${String(value)}`);
+}
+var CloudflareOrdinaryInactiveSignerMaterialActivationWorkerV1 = class {
+	constructor(endpoint) {
+		this.endpoint = endpoint;
+	}
+	async activateOrdinaryInactiveSignerMaterialV1(input) {
+		if (!Number.isSafeInteger(input.activatedAtMs) || input.activatedAtMs < 0) throw new Error("ordinary signer material activation time is invalid");
+		if (input.keyFamily !== input.preparation.keyFamily) throw new Error("ordinary signer material activation family does not match preparation");
+		if (input.preparation.keyFamily === "ed25519") {
+			const prepared = input.preparation.preparation;
+			if (!mpcMaterialActivationRefsEqual(input.materialActivation, prepared.sourceContribution.targetMaterialActivation)) throw new Error("ordinary Ed25519 activation reference does not match preparation");
+			await this.endpoint.activateInactiveEd25519SignerMaterialV1({
+				sourceContribution: prepared.sourceContribution,
+				reservationId: input.reservationId
+			});
+			return;
+		}
+		const prepared = input.preparation.preparation;
+		if (!mpcMaterialActivationRefsEqual(input.materialActivation, prepared.sourceContribution.binding.target.activation)) throw new Error("ordinary ECDSA activation reference does not match preparation");
+		await this.endpoint.activateInactiveEcdsaSignerMaterialV1({
+			preparation: prepared,
+			reservationId: input.reservationId
+		});
+	}
+};
+//#endregion
+export { CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1, CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1, createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1, createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1 };
+
+//# sourceMappingURL=cloudflareOrdinaryInactiveSignerMaterialReservation.js.map

package/dist/esm/router/cloudflare/signingLanes/index.js

@@ -0,0 +1,4 @@
+import { CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1, CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1, createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1, createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1 } from "./cloudflareOrdinaryInactiveSignerMaterialReservation.js";
+import { CLOUDFLARE_SIGNING_WORKER_ECDSA_LANE_ACTIVATE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_LANE_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_LANE_RETIRE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_LANE_ACTIVATE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_LANE_RETIRE_PATH_V1, CloudflareSigningWorkerEcdsaLaneTransportV1, CloudflareSigningWorkerEcdsaRetirementTransportV1, LaneLifecycleStoreEcdsaLanePrivateBindingResolverV1, LaneLifecycleStoreEd25519LanePrivateBindingResolverV1, LaneLifecycleStoreNormalSigningLaneMaterialResolverV1, createCloudflareLaneCurveExecutionPortsV1, digestSigningWorkerLaneIdentityV1 } from "./cloudflareLaneCurveExecution.js";
+import { CloudflareEd25519LaneProtocolTransportV1, CloudflareLaneProtocolCommitterV1, ROUTER_AB_ED25519_YAO_LANE_EXECUTE_PATH_V1 } from "./cloudflareLaneProtocolCommitter.js";
+export { CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_LANE_ACTIVATE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_LANE_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_LANE_RETIRE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_LANE_ACTIVATE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_LANE_RETIRE_PATH_V1, CloudflareEd25519LaneProtocolTransportV1, CloudflareLaneProtocolCommitterV1, CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1, CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1, CloudflareSigningWorkerEcdsaLaneTransportV1, CloudflareSigningWorkerEcdsaRetirementTransportV1, LaneLifecycleStoreEcdsaLanePrivateBindingResolverV1, LaneLifecycleStoreEd25519LanePrivateBindingResolverV1, LaneLifecycleStoreNormalSigningLaneMaterialResolverV1, ROUTER_AB_ED25519_YAO_LANE_EXECUTE_PATH_V1, UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, createCloudflareLaneCurveExecutionPortsV1, createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1, createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1, createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, digestSigningWorkerLaneIdentityV1 };

package/dist/esm/router/cloudflare/signingLanes/linkedDeviceEd25519CeremonyBinding.js

@@ -0,0 +1,32 @@
+import { base64UrlDecode } from "../../../shared-ts/src/utils/base64.js";
+import { routerAbMpcMaterialActivationRefToWire } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { computeEd25519YaoLaneSessionDigestV1 } from "../../../shared-ts/src/signing-lanes/rotationDigests.js";
+//#region src/router/cloudflare/signingLanes/linkedDeviceEd25519CeremonyBinding.ts
+function createLinkedDeviceEd25519CeremonyBindingResolverV1() {
+	return { async resolveBindingV1({ job }) {
+		return await buildLinkedDeviceEd25519CeremonyBindingV1(job);
+	} };
+}
+async function buildLinkedDeviceEd25519CeremonyBindingV1(job) {
+	const laneProvisioning = job.yaoRequestKind === "lane_provisioning";
+	return {
+		lifecycle: {
+			lifecycle_id: job.operationId,
+			work_kind: laneProvisioning ? "registration_prepare" : "server_share_refresh",
+			primitive_request_kind: laneProvisioning ? "registration" : "refresh",
+			root_share_epoch: job.source.laneShareEpoch,
+			account_id: job.walletId,
+			session_id: job.operationId,
+			signer_set_id: job.source.participantBindingDigestB64u,
+			selected_server_id: job.source.materialActivation.signingWorker
+		},
+		operation: job.yaoRequestKind,
+		session_id: Array.from(base64UrlDecode(await computeEd25519YaoLaneSessionDigestV1(job))),
+		stable_key_context_binding: Array.from(base64UrlDecode(job.stableContextBindingB64u)),
+		material_activation: routerAbMpcMaterialActivationRefToWire(job.source.materialActivation)
+	};
+}
+//#endregion
+export { buildLinkedDeviceEd25519CeremonyBindingV1, createLinkedDeviceEd25519CeremonyBindingResolverV1 };
+
+//# sourceMappingURL=linkedDeviceEd25519CeremonyBinding.js.map

package/dist/esm/router/cloudflare-adaptor.js

@@ -0,0 +1,45 @@
+import { ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, parseRouterAbPublicKeysetV2 } from "../shared-ts/src/utils/routerAbPublicKeyset.js";
+import { defineRoute, matchesRouteDefinitionRequest } from "./framework/routeDefinitions.js";
+import { InMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createRouterAbNormalSigningAdmissionAdapter } from "./domains/signingOperations/routerAbNormalSigningAdmissionCore.js";
+import { CloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1RouterAbNormalSigningAdmissionStore } from "./cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.js";
+import { getRouterApiRouteExtensionRoutes } from "./framework/routeExtensions.js";
+import { coerceRouterLogger } from "./framework/logger.js";
+import { WALLET_CONSOLE_OPS_BASE_PATH_V1, WALLET_CONSOLE_OP_PATHS_V1, WALLET_CONSOLE_SERVICE_ORIGIN_V1, decodeWalletConsoleTenantRootActiveLineageRequestV1, decodeWalletConsoleTenantRootActiveLineageResponseV1 } from "./cloudflare/runtime/walletConsoleOps.js";
+import { createWalletConsoleOpsClient } from "./cloudflare/runtime/walletConsoleOpsClient.js";
+import { extractBearerCredential, extractRouterApiEnvironmentId, resolveSourceIpFromExpressRequest, resolveSourceIpFromFetchHeaders } from "./auth/routerApiKeyAuth.js";
+import { createRouterApiModule } from "./framework/modules.js";
+import { createCloudflareRouter } from "./cloudflare/runtime/createCloudflareRouter.js";
+import { DEFAULT_WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_V1, DEFAULT_WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_V1, WALLET_CONSOLE_API_WALLET_DETAIL_PREFIX_V1, WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_ID_V1, WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_ID_V1, createCloudflareWalletGatewayRouterV1, createWalletConsoleRelayProxyExtensionV1, walletConsoleApiWalletGetRouteDefinitionV1, walletConsoleApiWalletListRouteDefinitionV1, walletConsoleApiWalletSearchRouteDefinitionV1, walletConsoleRelayRouteDefinitionsV1, walletConsoleSignedDelegateRouteDefinitionV1, walletConsoleSponsoredEvmCallRouteDefinitionV1 } from "./cloudflare/runtime/walletGateway.js";
+import { WALLET_RUNTIME_OPS_BASE_PATH_V1, WALLET_RUNTIME_OP_PATHS_V1, WALLET_RUNTIME_SERVICE_ORIGIN_V1, parseWalletRuntimeExecuteSignedDelegateRequest, parseWalletRuntimeExecuteSignedDelegateResponse, parseWalletRuntimeExecuteSignedDelegateResult, parseWalletRuntimeRelayerAccount, parseWalletRuntimeWalletIdentitiesResult, parseWalletRuntimeWalletIdentityRequest } from "./cloudflare/runtime/walletRuntimeOps.js";
+import { createWalletRuntimeOpsHandler } from "./cloudflare/runtime/walletRuntimeOpsHandler.js";
+import { WALLET_CONTROL_AUTH_MARKER_V1, WALLET_CONTROL_BASE_PATH_V1, WALLET_CONTROL_SERVICE_ORIGIN_V1, createWalletControlClientBindings, handleWalletControlRequest } from "./cloudflare/runtime/walletControlOps.js";
+import { resolveRuntimeTenantRootLineage } from "./cloudflare/runtime/walletConsoleTenantRootLineage.js";
+import { runRouterAbPrewarmScheduledV1 } from "./cloudflare/runtime/routerAbPrewarm.js";
+import { randomTenantRootCreationGrantBytesV1, signTenantRootCreationGrantV1, tenantRootIdentityDigestB64uV1 } from "./cloudflare/runtime/tenantRootCreationGrant.js";
+import { readEnvironmentCsv, readEnvironmentString, requireEnvironmentString } from "./cloudflare/runtime/environment.js";
+import { createStaticWalletConsoleBindingV1, handleStaticWalletConsoleRequestV1, parseStaticWalletConsoleBindingConfigV1 } from "./cloudflare/runtime/staticWalletConsoleBinding.js";
+import { CloudflareD1WebAuthnStore } from "./cloudflare/d1/webauthn/d1WebAuthnStore.js";
+import { CloudflareD1WebAuthnAuthService } from "./cloudflare/d1/webauthn/d1WebAuthnAuthService.js";
+import { CloudflareD1AuthorizationStore } from "./cloudflare/d1/authorization/d1AuthorizationStore.js";
+import { CloudflareD1VaultProxyStore } from "./cloudflare/d1/authorization/d1VaultProxyStore.js";
+import { InMemoryRouterAbEd25519YaoRegistrationService, createRouterAbEd25519YaoRegistrationModule } from "./domains/ed25519Yao/registration/routerAbEd25519YaoRegistration.js";
+import { InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter } from "./domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationIntentAuthorization.js";
+import { buildRouterAbEd25519YaoProductAdmissionRequestV1, createRouterAbEd25519YaoProductRegistrationCompositionFromPortsV1, createRouterAbEd25519YaoProductRegistrationRuntimeV1, createRouterAbEd25519YaoProductRegistrationStateV1 } from "./domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js";
+import { RouterAbEd25519YaoHttpRegistrationBackend, createRouterAbEd25519YaoHttpRegistrationBackendFromEnv } from "./domains/ed25519Yao/registration/routerAbEd25519YaoHttpRegistrationBackend.js";
+import { StaticCloudflareTenantStorageRouteResolver, createCloudflareTenantStorageRoute, createSignerD1DoStorageTarget, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings } from "../storage/tenantRoute.js";
+import { createInMemoryRouterApiRuntimeSnapshotConsumer, validateRuntimeSnapshotExpectation } from "./framework/runtimeSnapshotConsumer.js";
+import { createSelfHostedCloudflareSigningRouter, createSelfHostedCloudflareSigningWorker } from "./cloudflare/runtime/createSelfHostedCloudflareSigningWorker.js";
+import { ThresholdStoreDurableObject } from "./cloudflare/durableObjects/thresholdStore.js";
+import { CloudflareDurableObjectVersionedJsonRecordStore, CloudflareVersionedJsonRecordStoreError, createCloudflareDurableObjectVersionedJsonRecordStore } from "./cloudflare/durableObjects/versionedJsonRecordStore.js";
+import { CloudflareD1VersionedJsonRecordStore, CloudflareD1VersionedJsonRecordStoreError, createCloudflareD1VersionedJsonRecordStore } from "./cloudflare/d1/versionedJson/d1VersionedJsonRecordStore.js";
+import { createRouterAbEd25519YaoCeremonyStateStoreV1, encodeRouterAbEd25519YaoProductRegistrationStateV1, parseRouterAbEd25519YaoCeremonyKeyV1, parseRouterAbEd25519YaoProductRegistrationStateJsonV1, resolveRouterAbEd25519YaoCeremonyKeyFromRequestV1 } from "./domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPersistence.js";
+import { mergeRouterAbEd25519YaoProductRegistrationStatePartitionV1, partitionRouterAbEd25519YaoProductRegistrationStateV1 } from "./domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitioning.js";
+import { ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1 } from "./domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore.js";
+import { createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1 } from "./cloudflare/d1/ed25519Yao/d1Ed25519YaoProductRegistrationPartitionedStateStore.js";
+import { runRouterAbEd25519YaoProductRegistrationRequestScopedV1 } from "./domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationRequestScopedRunner.js";
+import { createRouterAbEd25519YaoProductRegistrationRequestScopedRuntimeV1 } from "./domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationRequestScopedRuntime.js";
+import { runRouterAbEd25519YaoRegistrationSideEffectV1 } from "./domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
+import { runRouterAbEd25519YaoRegistrationTwoPhaseV1 } from "./domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationTwoPhaseRunner.js";
+import { CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1, CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1, createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1, createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1 } from "./cloudflare/signingLanes/cloudflareOrdinaryInactiveSignerMaterialReservation.js";
+import { handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1 } from "./domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationRequestScopedCloudflare.js";
+export { CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, CloudflareD1AuthorizationStore, CloudflareD1RouterAbNormalSigningAdmissionStore, CloudflareD1VaultProxyStore, CloudflareD1VersionedJsonRecordStore, CloudflareD1VersionedJsonRecordStoreError, CloudflareD1WebAuthnAuthService, CloudflareD1WebAuthnStore, CloudflareDurableObjectVersionedJsonRecordStore, CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1, CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1, CloudflareVersionedJsonRecordStoreError, DEFAULT_WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_V1, DEFAULT_WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_V1, InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter, InMemoryRouterAbEd25519YaoRegistrationService, InMemoryRouterAbNormalSigningAdmissionStore, ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1, ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, RouterAbEd25519YaoHttpRegistrationBackend, StaticCloudflareTenantStorageRouteResolver, ThresholdStoreDurableObject, UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, WALLET_CONSOLE_API_WALLET_DETAIL_PREFIX_V1, WALLET_CONSOLE_OPS_BASE_PATH_V1, WALLET_CONSOLE_OP_PATHS_V1, WALLET_CONSOLE_SERVICE_ORIGIN_V1, WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_ID_V1, WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_ID_V1, WALLET_CONTROL_AUTH_MARKER_V1, WALLET_CONTROL_BASE_PATH_V1, WALLET_CONTROL_SERVICE_ORIGIN_V1, WALLET_RUNTIME_OPS_BASE_PATH_V1, WALLET_RUNTIME_OP_PATHS_V1, WALLET_RUNTIME_SERVICE_ORIGIN_V1, buildRouterAbEd25519YaoProductAdmissionRequestV1, coerceRouterLogger, createCloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1VersionedJsonRecordStore, createCloudflareDurableObjectVersionedJsonRecordStore, createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1, createCloudflareRouter, createCloudflareTenantStorageRoute, createCloudflareWalletGatewayRouterV1, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterApiRuntimeSnapshotConsumer, createRouterAbEd25519YaoCeremonyStateStoreV1, createRouterAbEd25519YaoHttpRegistrationBackendFromEnv, createRouterAbEd25519YaoProductRegistrationCompositionFromPortsV1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, createRouterAbEd25519YaoProductRegistrationRequestScopedRuntimeV1, createRouterAbEd25519YaoProductRegistrationRuntimeV1, createRouterAbEd25519YaoProductRegistrationStateV1, createRouterAbEd25519YaoRegistrationModule, createRouterAbNormalSigningAdmissionAdapter, createRouterApiModule, createSelfHostedCloudflareSigningRouter, createSelfHostedCloudflareSigningWorker, createSignerD1DoStorageTarget, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, createStaticWalletConsoleBindingV1, createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1, createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, createWalletConsoleOpsClient, createWalletConsoleRelayProxyExtensionV1, createWalletControlClientBindings, createWalletRuntimeOpsHandler, decodeWalletConsoleTenantRootActiveLineageRequestV1, decodeWalletConsoleTenantRootActiveLineageResponseV1, defineRoute, encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1, encodeRouterAbEd25519YaoProductRegistrationStateV1, extractBearerCredential, extractRouterApiEnvironmentId, getRouterApiRouteExtensionRoutes, handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1, handleStaticWalletConsoleRequestV1, handleWalletControlRequest, matchesRouteDefinitionRequest, mergeRouterAbEd25519YaoProductRegistrationStatePartitionV1, parseRouterAbEd25519YaoCeremonyKeyV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoProductRegistrationStateJsonV1, parseRouterAbPublicKeysetV2, parseStaticWalletConsoleBindingConfigV1, parseWalletRuntimeExecuteSignedDelegateRequest, parseWalletRuntimeExecuteSignedDelegateResponse, parseWalletRuntimeExecuteSignedDelegateResult, parseWalletRuntimeRelayerAccount, parseWalletRuntimeWalletIdentitiesResult, parseWalletRuntimeWalletIdentityRequest, partitionRouterAbEd25519YaoProductRegistrationStateV1, randomTenantRootCreationGrantBytesV1, readEnvironmentCsv, readEnvironmentString, requireEnvironmentString, resolveRouterAbEd25519YaoCeremonyKeyFromRequestV1, resolveRuntimeTenantRootLineage, resolveSourceIpFromExpressRequest, resolveSourceIpFromFetchHeaders, runRouterAbEd25519YaoProductRegistrationRequestScopedV1, runRouterAbEd25519YaoRegistrationSideEffectV1, runRouterAbEd25519YaoRegistrationTwoPhaseV1, runRouterAbPrewarmScheduledV1, signTenantRootCreationGrantV1, tenantRootIdentityDigestB64uV1, validateRuntimeSnapshotExpectation, walletConsoleApiWalletGetRouteDefinitionV1, walletConsoleApiWalletListRouteDefinitionV1, walletConsoleApiWalletSearchRouteDefinitionV1, walletConsoleRelayRouteDefinitionsV1, walletConsoleSignedDelegateRouteDefinitionV1, walletConsoleSponsoredEvmCallRouteDefinitionV1 };