@seams/wallet-server 0.5.0

package/dist/esm/hosted-wallet-gateway.js

@@ -0,0 +1,701 @@
+import { parseWalletId } from "./shared-ts/src/utils/domainIds.js";
+import { base64UrlEncode } from "./shared-ts/src/utils/base64.js";
+import { parseRouterAbPublicKeysetV2 } from "./shared-ts/src/utils/routerAbPublicKeyset.js";
+import { ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_STATUS_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1 } from "./shared-ts/src/utils/routerAbEd25519Yao.js";
+import { parseD1JsonColumn } from "./storage/d1Sql.js";
+import { D1WalletStore } from "./core/d1WalletStore.js";
+import { D1WalletAuthMethodStore } from "./core/d1WalletAuthMethodStore.js";
+import { RouterAbEcdsaPresignRuntime } from "./core/routerAbSigning/RouterAbEcdsaPresignRuntime.js";
+import { buildTenantRootIdentityFromAuthenticatedDeploymentV1, decodeTenantRootIdentityWireV1 } from "./shared-ts/src/tenant-root/tenantRootIdentity.js";
+import "./shared-ts/src/tenant-root/index.js";
+import { createWalletConsoleOpsClient } from "./router/cloudflare/runtime/walletConsoleOpsClient.js";
+import { withCors } from "./router/framework/http.js";
+import { createCloudflareWalletGatewayRouterV1 } from "./router/cloudflare/runtime/walletGateway.js";
+import { createWalletRuntimeOpsHandler } from "./router/cloudflare/runtime/walletRuntimeOpsHandler.js";
+import { handleWalletControlRequest } from "./router/cloudflare/runtime/walletControlOps.js";
+import { resolveRuntimeTenantRootLineage } from "./router/cloudflare/runtime/walletConsoleTenantRootLineage.js";
+import { ROUTER_AB_MPC_ROUTER_ORIGIN, ROUTER_AB_SIGNING_WORKER_ORIGIN, createRouterAbServiceBindingFetch } from "./router/cloudflare/runtime/routerAbServiceBindings.js";
+import { readEnvironmentCsv, readEnvironmentString, requireEnvironmentString } from "./router/cloudflare/runtime/environment.js";
+import { RouterAbEd25519YaoExportOwnerProofAuthorizationAdapter } from "./router/domains/ed25519Yao/export/routerAbEd25519YaoExport.js";
+import { createRouterAbEd25519YaoHttpRegistrationBackendFromEnv } from "./router/domains/ed25519Yao/registration/routerAbEd25519YaoHttpRegistrationBackend.js";
+import { createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1 } from "./router/cloudflare/d1/ed25519Yao/d1Ed25519YaoProductRegistrationPartitionedStateStore.js";
+import { createRouterAbEd25519YaoProductRegistrationRequestScopedRuntimeV1 } from "./router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationRequestScopedRuntime.js";
+import { createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1 } from "./router/cloudflare/signingLanes/cloudflareOrdinaryInactiveSignerMaterialReservation.js";
+import { handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1 } from "./router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationRequestScopedCloudflare.js";
+import { CloudflareD1RouterAbEd25519YaoCapabilityPersistence } from "./router/cloudflare/d1/ed25519Yao/d1Ed25519YaoCapabilityPersistence.js";
+import { createSigningSessionSealOptions } from "./threshold/session/signingSessionSeal/options.js";
+import { createRouterAbEcdsaEd25519CeremonyTokenIssuer, createRouterAbEcdsaStrictPostRegistrationPort, createRouterAbEcdsaStrictRegistrationPort, parseRouterAbEcdsaEd25519PrivateJwk, parseRouterAbEcdsaStrictRegistrationTopology } from "./router/domains/ecdsa/routerAbEcdsaStrictRegistration.js";
+import { createD1LinkedDeviceSourceContributionPreparationPlannerV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceSourceContributionPreparationPlanner.js";
+import { D1LinkedDeviceTargetCredentialProviderV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetCredentialProvider.js";
+import { createD1LinkedDeviceOwnerSourceChildReaderV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceOwnerAuthorizationProvider.js";
+import { createCloudflareD1RouterApiAuthService } from "./router/cloudflare/d1/auth/d1RouterApiAuthService.js";
+import { loadCloudflareSignerWasmModule } from "./router/cloudflare/runtime/cloudflareSignerWasm.js";
+import { createEd25519SessionAdapter } from "./router/cloudflare/runtime/ed25519SessionAdapter.js";
+import { handleRouterAbEd25519YaoExportRequestScopedCloudflareV1 } from "./router/domains/ed25519Yao/export/routerAbEd25519YaoExportRequestScopedCloudflare.js";
+import { handleRouterAbEd25519YaoRecoveryRequestScopedCloudflareV1 } from "./router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryRequestScopedCloudflare.js";
+import { RouterAbEd25519YaoRecoveryWalletSessionAuthorizationAdapter } from "./router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryWalletSessionAuthorization.js";
+import "./cloud-host.js";
+//#region src/hosted-wallet-gateway.ts
+function readStagingHostedWalletOrigins(env) {
+	return readEnvironmentCsv(requireEnvironmentString(env, "HOSTED_WALLET_ORIGINS"));
+}
+const RELAY_SIGNER_READY_TABLES = Object.freeze([
+	"wallets",
+	"wallet_auth_methods",
+	"authorization_wallet_session_quotas",
+	"wallet_session_authorizations_v2",
+	"wallet_session_hosted_credentials_v2",
+	"wallet_session_hosted_exchange_codes_v2",
+	"linked_device_wallet_session_credential_deliveries_v1",
+	"verified_wallet_operation_evidence_sets",
+	"verified_owner_proof_consumptions",
+	"email_otp_challenges",
+	"email_otp_grants",
+	"router_ab_yao_versioned_json_records",
+	"router_ab_yao_versioned_json_cas_guard",
+	"router_ab_yao_capability_replacements",
+	"router_ab_normal_signing_admission_records",
+	"registration_ceremony_records",
+	"registration_ceremony_cas_guard",
+	"lane_enrollments",
+	"lane_protocol_operations",
+	"lane_product_epochs",
+	"lane_receipts",
+	"lane_effect_journal",
+	"lane_locks",
+	"lane_cas_guard",
+	"linked_device_sessions",
+	"linked_device_session_cas_guard",
+	"linked_device_session_transcripts",
+	"linked_device_request_proof_nonces",
+	"linked_device_target_credentials",
+	"linked_device_target_commit_reservations",
+	"linked_device_email_otp_grants",
+	"linked_device_ed25519_export_root_transfers"
+]);
+const ROUTER_AB_CEREMONY_JWKS_PATH = "/.well-known/router-ab-ceremony-jwks.json";
+function emitRefactor93GatewaySpan(span) {
+	console.log(JSON.stringify(span));
+}
+function createStagingEd25519YaoBackend(env, resolveTenantRoot) {
+	const keyEnvironment = stagingEd25519YaoKeyEnvironment(env);
+	return createRouterAbEd25519YaoHttpRegistrationBackendFromEnv({
+		env: {
+			MPC_ROUTER_URL: ROUTER_AB_MPC_ROUTER_ORIGIN,
+			SIGNING_WORKER_ID: requireEnvironmentString(env, "SIGNING_WORKER_ID"),
+			ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET: requireEnvironmentString(env, "ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET"),
+			DERIVER_A_ED25519_YAO_INPUT_PUBLIC_KEY: keyEnvironment.DERIVER_A_ED25519_YAO_INPUT_PUBLIC_KEY,
+			DERIVER_B_ED25519_YAO_INPUT_PUBLIC_KEY: keyEnvironment.DERIVER_B_ED25519_YAO_INPUT_PUBLIC_KEY,
+			SIGNING_WORKER_SERVER_OUTPUT_HPKE_PUBLIC_KEY: keyEnvironment.SIGNING_WORKER_SERVER_OUTPUT_HPKE_PUBLIC_KEY
+		},
+		resolveTenantRoot,
+		onSpan: emitRefactor93GatewaySpan,
+		fetch: createRouterAbServiceBindingFetch(env)
+	});
+}
+function stagingTenantScope(env) {
+	return {
+		namespace: requireEnvironmentString(env, "SEAMS_TENANT_STORAGE_NAMESPACE"),
+		orgId: requireEnvironmentString(env, "SEAMS_STAGING_ORG_ID"),
+		projectId: requireEnvironmentString(env, "SEAMS_STAGING_PROJECT_ID"),
+		envId: requireEnvironmentString(env, "SEAMS_STAGING_ENV_ID")
+	};
+}
+function createStagingTenantRootCustodyLineage(ops) {
+	return {
+		resolveActiveLineageForRuntimeScope: resolveRuntimeTenantRootLineage.bind(null, ops.projectEnvironments, ops.tenantRootActiveLineage),
+		resolveActiveLineage: resolveStagingTenantRootActiveLineage.bind(null, ops.tenantRootActiveLineage)
+	};
+}
+async function resolveStagingTenantRootActiveLineage(resolver, identity) {
+	const decoded = decodeTenantRootIdentityWireV1({
+		orgId: identity.orgId,
+		projectId: identity.projectId,
+		envId: identity.envId,
+		signingRootId: identity.signingRootId,
+		signingRootVersion: identity.signingRootVersion
+	});
+	if (!decoded.ok) throw new Error("Staging tenant-root identity is not canonical");
+	return resolver.resolveActiveLineage(decoded.value);
+}
+function stagingTenantRootIdentity(scope, applicationBinding, signingRootVersion) {
+	const identity = buildTenantRootIdentityFromAuthenticatedDeploymentV1({
+		orgId: scope.orgId,
+		projectId: scope.projectId,
+		envId: scope.envId,
+		signingRootId: applicationBinding.signing_root_id,
+		signingRootVersion
+	});
+	if (!identity.ok) throw new Error("Staging tenant-root identity is not canonical");
+	return identity.value;
+}
+async function resolveStagingDeploymentTenantRoot(scope, tenantRootCustodyLineage, applicationBinding, signingRootVersion) {
+	const identity = stagingTenantRootIdentity(scope, applicationBinding, signingRootVersion);
+	const tenantRoot = await tenantRootCustodyLineage.resolveActiveLineage(identity);
+	if (!tenantRoot) throw new Error("Ed25519 tenant root is not active");
+	return tenantRoot;
+}
+async function resolveStagingRegistrationTenantRoot(context, input) {
+	switch (input.operation) {
+		case "registration": return await resolveStagingDeploymentTenantRoot(context.scope, context.tenantRootCustodyLineage, input.admissionRequest.application_binding, input.admissionRequest.scope.root_share_epoch);
+		case "recovery":
+		case "export": throw new Error("Ed25519 active-material tenant-root resolver is unavailable");
+	}
+}
+async function resolveStagingTenantRoot(context, input) {
+	switch (input.operation) {
+		case "registration": return await resolveStagingDeploymentTenantRoot(context.scope, context.tenantRootCustodyLineage, input.admissionRequest.application_binding, input.admissionRequest.scope.root_share_epoch);
+		case "recovery": return await context.resolveActiveTenantRoot({
+			walletId: input.admissionRequest.application_binding.wallet_id,
+			materialActivation: input.admissionRequest.active_material_activation
+		});
+		case "export": return await context.resolveActiveTenantRoot({
+			walletId: input.admissionRequest.application_binding.wallet_id,
+			materialActivation: input.admissionRequest.scope.material_activation
+		});
+	}
+}
+async function resolveStagingLinkedDeviceTenantRoot(context, input) {
+	return await resolveStagingDeploymentTenantRoot(context.scope, context.tenantRootCustodyLineage, input.applicationBinding, input.targetAdmission.binding.lifecycle.root_share_epoch);
+}
+function createStagingRegistrationTenantRootResolver(scope, tenantRootCustodyLineage) {
+	return resolveStagingRegistrationTenantRoot.bind(void 0, {
+		scope,
+		tenantRootCustodyLineage
+	});
+}
+function createStagingTenantRootResolver(scope, tenantRootCustodyLineage, resolveActiveTenantRoot) {
+	return resolveStagingTenantRoot.bind(void 0, {
+		scope,
+		tenantRootCustodyLineage,
+		resolveActiveTenantRoot
+	});
+}
+function createStagingLinkedDeviceTenantRootResolver(scope, tenantRootCustodyLineage) {
+	return resolveStagingLinkedDeviceTenantRoot.bind(void 0, {
+		scope,
+		tenantRootCustodyLineage
+	});
+}
+async function createStagingRouterApiAuthComposition(env, scope, yaoRuntime, tenantRootCustodyLineage, dependencies) {
+	const ecdsaCeremonyTokenIssuer = createStagingEcdsaCeremonyTokenIssuer(env);
+	const topology = requireStagingEcdsaRegistrationTopology(env);
+	const tokenScope = {
+		orgId: scope.orgId,
+		projectId: scope.projectId,
+		environment: scope.envId
+	};
+	const ecdsaStrictRegistration = createRouterAbEcdsaStrictRegistrationPort({
+		router: env.MPC_ROUTER,
+		tokenIssuer: ecdsaCeremonyTokenIssuer,
+		tokenScope,
+		topology
+	});
+	const ecdsaStrictPostRegistration = createRouterAbEcdsaStrictPostRegistrationPort({
+		router: env.MPC_ROUTER,
+		tokenIssuer: ecdsaCeremonyTokenIssuer,
+		tokenScope,
+		topology
+	});
+	return {
+		service: createCloudflareD1RouterApiAuthService({
+			database: env.SIGNER_DB,
+			namespace: scope.namespace,
+			orgId: scope.orgId,
+			projectId: scope.projectId,
+			envId: scope.envId,
+			relayerAccount: readEnvironmentString(env, "RELAYER_ACCOUNT_ID"),
+			relayerPublicKey: readEnvironmentString(env, "RELAYER_PUBLIC_KEY"),
+			relayerPrivateKey: readEnvironmentString(env, "RELAYER_PRIVATE_KEY"),
+			nearRpcUrl: readEnvironmentString(env, "NEAR_RPC_URL"),
+			signerWasmModuleOrPath: loadCloudflareSignerWasmModule,
+			accountInitialBalance: readEnvironmentString(env, "ACCOUNT_INITIAL_BALANCE"),
+			implicitNearAccountTestFundingEnabled: readEnvironmentString(env, "ENABLE_IMPLICIT_NEAR_ACCOUNT_TEST_FUNDING"),
+			googleOidcClientId: readEnvironmentString(env, "GOOGLE_OIDC_CLIENT_ID"),
+			githubOAuth: stagingGithubOAuthConfig(env),
+			accountIdDerivationSecret: requireEnvironmentString(env, "ACCOUNT_ID_DERIVATION_SECRET"),
+			emailOtpServerSeal: stagingEmailOtpServerSealConfig(env),
+			emailOtpDeliveryMode: readEnvironmentString(env, "EMAIL_OTP_DELIVERY_MODE"),
+			emailOtpRuntimeProfile: readEnvironmentString(env, "EMAIL_OTP_RUNTIME_PROFILE"),
+			emailOtpDeliveryProvider: dependencies.emailOtpDeliveryProvider,
+			emailOtpDemoAllowedOrigins: readEnvironmentString(env, "EMAIL_OTP_DEMO_ALLOWED_ORIGINS"),
+			emailOtpProduction: readEnvironmentString(env, "EMAIL_OTP_PRODUCTION"),
+			emailOtpDevOutboxEnabled: readEnvironmentString(env, "EMAIL_OTP_DEV_OUTBOX_ENABLED"),
+			emailOtpChallengeRateLimitMax: readEnvironmentString(env, "EMAIL_OTP_CHALLENGE_RATE_LIMIT_MAX"),
+			emailOtpChallengeRateLimitWindowMs: readEnvironmentString(env, "EMAIL_OTP_CHALLENGE_RATE_LIMIT_WINDOW_MS"),
+			emailOtpVerifyRateLimitMax: readEnvironmentString(env, "EMAIL_OTP_VERIFY_RATE_LIMIT_MAX"),
+			emailOtpVerifyRateLimitWindowMs: readEnvironmentString(env, "EMAIL_OTP_VERIFY_RATE_LIMIT_WINDOW_MS"),
+			emailOtpGrantRateLimitMax: readEnvironmentString(env, "EMAIL_OTP_GRANT_RATE_LIMIT_MAX"),
+			emailOtpGrantRateLimitWindowMs: readEnvironmentString(env, "EMAIL_OTP_GRANT_RATE_LIMIT_WINDOW_MS"),
+			emailOtpMaxAttempts: readEnvironmentString(env, "EMAIL_OTP_MAX_ATTEMPTS"),
+			emailOtpLockoutTtlMs: readEnvironmentString(env, "EMAIL_OTP_LOCKOUT_TTL_MS"),
+			emailOtpGoogleRegistrationAttemptRateLimitMax: readEnvironmentString(env, "EMAIL_OTP_GOOGLE_REGISTRATION_ATTEMPT_RATE_LIMIT_MAX"),
+			emailOtpGoogleRegistrationAttemptRateLimitWindowMs: readEnvironmentString(env, "EMAIL_OTP_GOOGLE_REGISTRATION_ATTEMPT_RATE_LIMIT_WINDOW_MS"),
+			routerAbEcdsaPresignRuntime: createStagingEcdsaPresignRuntime(env),
+			ed25519YaoProductRegistration: yaoRuntime,
+			ecdsaStrictRegistration,
+			tenantRootCustodyLineage,
+			linkedDevice: stagingLinkedDeviceSessionComposition(env, scope, tenantRootCustodyLineage)
+		}),
+		ecdsaStrictPostRegistration
+	};
+}
+async function loadStagingRouterApiAuthComposition(context) {
+	context.promise ??= createStagingRouterApiAuthComposition(context.env, context.scope, context.yaoRuntime, context.tenantRootCustodyLineage, context.dependencies);
+	return await context.promise;
+}
+async function resolveStagingActiveTenantRootFromService(service, input) {
+	const resolved = await service.walletRegistration.resolveActiveEd25519TenantRoot(input);
+	if (!resolved.ok) throw new Error(resolved.message);
+	return resolved;
+}
+async function resolveStagingActiveTenantRootFromLoader(context, input) {
+	const { service } = await loadStagingRouterApiAuthComposition(context);
+	return await resolveStagingActiveTenantRootFromService(service, input);
+}
+async function resolveStagingRecoveryAuthorizationServices(context) {
+	const { service } = await loadStagingRouterApiAuthComposition(context);
+	return {
+		authorizationSessions: service.authorizationSessions,
+		preparedRecoveryAdmission: service.passkeyCustody,
+		resolveEd25519MaterialActivation: service.walletRegistration.resolveEd25519MaterialActivation.bind(service.walletRegistration)
+	};
+}
+async function readStagingLinkedAuthority(context, input) {
+	const { service } = await loadStagingRouterApiAuthComposition(context);
+	const reader = service.linkedDeviceEd25519AuthorityReader;
+	return reader ? await reader.readInstalledEd25519AuthorityByMaterialActivationV1(input) : null;
+}
+function stagingLinkedDeviceSessionComposition(env, scope, tenantRootCustodyLineage) {
+	const walletStore = new D1WalletStore({
+		database: env.SIGNER_DB,
+		...scope,
+		ensureSchema: false
+	});
+	const sourceChildReader = createD1LinkedDeviceOwnerSourceChildReaderV1({
+		walletAuthMethodStore: new D1WalletAuthMethodStore({
+			database: env.SIGNER_DB,
+			...scope,
+			ensureSchema: false
+		}),
+		walletStore
+	});
+	const serviceFetch = createRouterAbServiceBindingFetch(env);
+	const internalServiceAuthSecret = requireEnvironmentString(env, "ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET");
+	const keyEnvironment = stagingEd25519YaoKeyEnvironment(env);
+	const deriverAInputPublicKeyB64u = x25519PublicKeyB64u(keyEnvironment.DERIVER_A_ED25519_YAO_INPUT_PUBLIC_KEY);
+	const deriverBInputPublicKeyB64u = x25519PublicKeyB64u(keyEnvironment.DERIVER_B_ED25519_YAO_INPUT_PUBLIC_KEY);
+	const signingWorkerRecipientPublicKeyB64u = x25519PublicKeyB64u(keyEnvironment.SIGNING_WORKER_SERVER_OUTPUT_HPKE_PUBLIC_KEY);
+	return { session: {
+		readOwnerSourceChildV1: sourceChildReader.readOwnerSourceChildV1,
+		targetPasskeyRpId: requireEnvironmentString(env, "LINKED_DEVICE_WEBAUTHN_RP_ID"),
+		targetCredential: ({ verifiedLinkBuilder, targetCredentialVerification, targetPlanner, resolveOwnerSourceChildV1, emailOtpGrants }) => new D1LinkedDeviceTargetCredentialProviderV1({
+			database: env.SIGNER_DB,
+			scope,
+			verifier: targetCredentialVerification,
+			...emailOtpGrants === void 0 ? {} : { emailOtpGrants },
+			planner: targetPlanner,
+			sourceContributionPreparationPlanner: createD1LinkedDeviceSourceContributionPreparationPlannerV1({
+				resolveOwnerSourceChildV1,
+				deriverAInputPublicKeyB64u,
+				deriverBInputPublicKeyB64u,
+				signingWorkerRecipientPublicKeyB64u
+			}),
+			verifiedLinkBuilder
+		}),
+		authorityInstallation: {
+			reservationEndpoint: createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1({
+				fetch: serviceFetch,
+				internalServiceAuthSecret
+			}),
+			activationEndpoint: createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1({
+				fetch: serviceFetch,
+				internalServiceAuthSecret
+			}),
+			deactivationEndpoint: createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1({
+				fetch: serviceFetch,
+				internalServiceAuthSecret
+			})
+		},
+		sourceContributionRouter: createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1({
+			fetch: serviceFetch,
+			internalServiceAuthSecret,
+			resolveTenantRoot: createStagingLinkedDeviceTenantRootResolver(scope, tenantRootCustodyLineage)
+		})
+	} };
+}
+/**
+* The split Wallet Gateway (R105 Phase 4 cutover target): serves the Wallet
+* runtime only, holds no Console database binding, and reaches the Wallet
+* Console deployment exclusively through the exact service-binding ops.
+* The sponsored-relay route extensions stay on the Wallet Console deployment
+* until policy/sponsorship resolution operations join the binding.
+*/
+async function createHostedWalletGatewayCompositionV1(env, dependencies = {}) {
+	const scope = stagingTenantScope(env);
+	const session = stagingSessionAdapter(env);
+	const tenantRootCustodyLineage = createStagingTenantRootCustodyLineage(createWalletConsoleOpsClient(env.WALLET_CONSOLE));
+	const yaoRuntime = createStagingYaoRequestScopedRuntime(env, createStagingRegistrationTenantRootResolver(scope, tenantRootCustodyLineage));
+	const { service, ecdsaStrictPostRegistration } = await createStagingRouterApiAuthComposition(env, scope, yaoRuntime, tenantRootCustodyLineage, dependencies);
+	return {
+		handler: createCloudflareWalletGatewayRouterV1({
+			service,
+			walletConsole: env.WALLET_CONSOLE,
+			signerDatabase: env.SIGNER_DB,
+			signerStorageNamespace: scope.namespace,
+			router: {
+				healthz: true,
+				readyz: true,
+				corsOrigins: readEnvironmentCsv(env.RELAY_CORS_ORIGINS),
+				hostedWalletOrigins: readStagingHostedWalletOrigins(env),
+				session,
+				sessionCookieName: readEnvironmentString(env, "SESSION_COOKIE_NAME"),
+				routerAbPublicKeyset: requireStagingRouterAbPublicKeyset(env),
+				routerAbNormalSigningRouterProxy: {
+					internalServiceAuthSecret: requireEnvironmentString(env, "ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET"),
+					fetch: (request) => env.MPC_ROUTER.fetch(request)
+				},
+				routerAbEcdsaStrictPostRegistration: ecdsaStrictPostRegistration,
+				readyCheck: async () => {
+					await assertD1Tables({
+						database: env.SIGNER_DB,
+						label: "SIGNER_DB",
+						tables: RELAY_SIGNER_READY_TABLES
+					});
+				},
+				signingSessionSeal: stagingSigningSessionSealOptions(env),
+				routerAbEd25519YaoProduct: yaoRuntime
+			}
+		}),
+		service,
+		session
+	};
+}
+async function createSplitGatewayRouterHandler(env, dependencies = {}) {
+	return (await createHostedWalletGatewayCompositionV1(env, dependencies)).handler;
+}
+async function handleSplitGatewayWalletRuntimeRequest(request, env, dependencies = {}) {
+	const controlResponse = await handleWalletControlRequest(request, env);
+	if (controlResponse) return controlResponse;
+	return await createWalletRuntimeOpsHandler(async () => {
+		const scope = stagingTenantScope(env);
+		const tenantRootCustodyLineage = createStagingTenantRootCustodyLineage(createWalletConsoleOpsClient(env.WALLET_CONSOLE));
+		const { service } = await createStagingRouterApiAuthComposition(env, scope, createStagingYaoRequestScopedRuntime(env, createStagingRegistrationTenantRootResolver(scope, tenantRootCustodyLineage)), tenantRootCustodyLineage, dependencies);
+		return {
+			executeSignedDelegate: service.executeSignedDelegate.bind(service),
+			getRelayerAccount: service.router.getRelayerAccount.bind(service.router),
+			getWalletIdentities: (input) => readWalletRuntimeIdentities(env, input)
+		};
+	})(request);
+}
+function isJsonRecord(value) {
+	return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+async function readWalletRuntimeIdentities(env, input) {
+	const placeholders = input.wallets.map(() => "?").join(", ");
+	const rows = await env.SIGNER_DB.prepare(`SELECT project_id, wallet_id, signer_family, record_json
+       FROM wallet_signers
+      WHERE namespace = ?
+        AND org_id = ?
+        AND wallet_id IN (${placeholders})`).bind(requireEnvironmentString(env, "SEAMS_TENANT_STORAGE_NAMESPACE"), input.orgId, ...input.wallets.map((wallet) => wallet.walletId)).all();
+	const requestedWallets = new Map(input.wallets.map((wallet) => [wallet.walletId, wallet]));
+	const identities = /* @__PURE__ */ new Map();
+	for (const row of rows.results || []) {
+		const walletId = String(row.wallet_id || "").trim();
+		const requested = requestedWallets.get(walletId);
+		if (!requested || requested.projectId !== String(row.project_id || "").trim()) continue;
+		const record = parseD1JsonColumn(row.record_json);
+		if (!isJsonRecord(record)) continue;
+		const current = identities.get(walletId) || {
+			nearAccountId: "",
+			evmAddress: null
+		};
+		if (String(row.signer_family || "").trim() === "ed25519") current.nearAccountId = String(record.nearAccountId || "").trim();
+		if (String(row.signer_family || "").trim() === "ecdsa" && isJsonRecord(record.walletKey)) {
+			const address = String(record.walletKey.thresholdOwnerAddress || "").trim().toLowerCase();
+			if (/^0x[0-9a-f]{40}$/.test(address)) current.evmAddress = address;
+		}
+		identities.set(walletId, current);
+	}
+	return { identities: Array.from(identities.entries()).flatMap(([walletId, identity]) => identity.nearAccountId && identity.evmAddress ? [{
+		walletId,
+		nearAccountId: identity.nearAccountId,
+		evmAddress: identity.evmAddress
+	}] : []) };
+}
+async function handleSplitGatewayRequest(request, env, ctx, dependencies = {}) {
+	if (request.method === "GET" && new URL(request.url).pathname === ROUTER_AB_CEREMONY_JWKS_PATH) return routerAbCeremonyJwksResponse(env);
+	const operation = yaoDirectOperationForRequest(request);
+	if (operation !== null) {
+		const response = await handlePartitionedD1Operation(env, request, operation, createStagingTenantRootCustodyLineage(createWalletConsoleOpsClient(env.WALLET_CONSOLE)), dependencies);
+		withCors(response.headers, { corsOrigins: readEnvironmentCsv(env.RELAY_CORS_ORIGINS) }, request);
+		return response;
+	}
+	return await (await createSplitGatewayRouterHandler(env, dependencies))(request, env, ctx);
+}
+function requireStagingRouterAbPublicKeyset(env) {
+	const parsed = parseJsonValue(requireEnvironmentString(env, "ROUTER_AB_PUBLIC_KEYSET_JSON"));
+	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed) || Object.getPrototypeOf(parsed) !== Object.prototype && Object.getPrototypeOf(parsed) !== null) throw new Error("ROUTER_AB_PUBLIC_KEYSET_JSON must contain a JSON object");
+	return parseRouterAbPublicKeysetV2(parsed);
+}
+function stagingEd25519YaoKeyEnvironment(env) {
+	const keyset = requireStagingRouterAbPublicKeyset(env);
+	return {
+		DERIVER_A_ED25519_YAO_INPUT_PUBLIC_KEY: keyset.signer_envelope_hpke.current.deriver_a.public_key,
+		DERIVER_B_ED25519_YAO_INPUT_PUBLIC_KEY: keyset.signer_envelope_hpke.current.deriver_b.public_key,
+		SIGNING_WORKER_SERVER_OUTPUT_HPKE_PUBLIC_KEY: keyset.signing_worker_server_output_hpke.public_key
+	};
+}
+function x25519PublicKeyB64u(value) {
+	if (!/^x25519:[0-9a-f]{64}$/.test(value)) throw new Error("signing worker server output HPKE public key must use x25519:<64 lowercase hex chars> encoding");
+	const hex = value.slice(7);
+	const bytes = new Uint8Array(32);
+	for (let index = 0; index < bytes.length; index += 1) bytes[index] = Number.parseInt(hex.slice(index * 2, index * 2 + 2), 16);
+	return base64UrlEncode(bytes);
+}
+function createStagingEcdsaCeremonyTokenIssuer(env) {
+	return createRouterAbEcdsaEd25519CeremonyTokenIssuer({
+		issuer: requireEnvironmentString(env, "ROUTER_AB_CEREMONY_JWT_ISSUER"),
+		audience: requireEnvironmentString(env, "ROUTER_AB_CEREMONY_JWT_AUDIENCE"),
+		keyId: requireEnvironmentString(env, "ROUTER_AB_CEREMONY_JWT_KEY_ID"),
+		privateJwk: requireStagingEcdsaCeremonyPrivateJwk(env)
+	});
+}
+function requireStagingEcdsaCeremonyPrivateJwk(env) {
+	const privateJwk = parseRouterAbEcdsaEd25519PrivateJwk(parseJsonValue(requireEnvironmentString(env, "ROUTER_AB_CEREMONY_JWT_PRIVATE_JWK")));
+	if (!privateJwk) throw new Error("ROUTER_AB_CEREMONY_JWT_PRIVATE_JWK must be an Ed25519 private JWK");
+	return privateJwk;
+}
+function requireStagingEcdsaRegistrationTopology(env) {
+	const topology = parseRouterAbEcdsaStrictRegistrationTopology(parseJsonValue(requireEnvironmentString(env, "ROUTER_AB_ECDSA_REGISTRATION_TOPOLOGY_JSON")));
+	if (!topology) throw new Error("ROUTER_AB_ECDSA_REGISTRATION_TOPOLOGY_JSON must contain the MPCRouter topology");
+	return topology;
+}
+function routerAbCeremonyJwksResponse(env) {
+	const issuer = createStagingEcdsaCeremonyTokenIssuer(env);
+	return new Response(JSON.stringify(issuer.publicJwks()), {
+		status: 200,
+		headers: {
+			"cache-control": "public, max-age=300",
+			"content-type": "application/json; charset=utf-8"
+		}
+	});
+}
+let cachedStagingSigningSessionSealOptions = null;
+function stagingSigningSessionSealOptions(env) {
+	if (cachedStagingSigningSessionSealOptions) return cachedStagingSigningSessionSealOptions;
+	const seal = stagingEmailOtpServerSealConfig(env);
+	if (!seal) return void 0;
+	cachedStagingSigningSessionSealOptions = createSigningSessionSealOptions({
+		rootSecretB64u: seal.rootSecretB64u,
+		currentKeyVersion: seal.currentKeyVersion,
+		acceptedWarmKeyVersions: seal.acceptedWarmKeyVersions
+	});
+	return cachedStagingSigningSessionSealOptions;
+}
+function createStagingEcdsaPresignRuntime(env) {
+	return new RouterAbEcdsaPresignRuntime({
+		config: {
+			nodeRole: "coordinator",
+			participantIds: {
+				clientParticipantId: 1,
+				relayerParticipantId: 2,
+				participantIds2p: [1, 2]
+			}
+		},
+		signingWorkerTransport: {
+			kind: "configured",
+			signingWorkerBaseUrl: ROUTER_AB_SIGNING_WORKER_ORIGIN,
+			auth: {
+				kind: "internal_service_auth_secret",
+				secret: requireEnvironmentString(env, "ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET")
+			},
+			fetchImpl: createRouterAbServiceBindingFetch(env)
+		},
+		ensureReady: readyStagingEcdsaPresignRuntime
+	});
+}
+async function readyStagingEcdsaPresignRuntime() {}
+async function assertD1Tables(input) {
+	const row = await input.database.prepare(`SELECT COUNT(*) AS table_count
+         FROM sqlite_master
+        WHERE type = 'table'
+          AND name IN (${d1StringList(input.tables)})`).first();
+	const count = Number(row?.table_count || 0);
+	if (count !== input.tables.length) throw new Error(`${input.label} migration has created ${count} of ${input.tables.length} staging-ready tables`);
+}
+function stagingEmailOtpServerSealConfig(env) {
+	const rootSecretB64u = readEnvironmentString(env, "SIGNING_SESSION_SEAL_ROOT_SECRET_B64U");
+	const currentKeyVersion = readEnvironmentString(env, "SIGNING_SESSION_SEAL_CURRENT_KEY_VERSION");
+	const acceptedWarmKeyVersions = readEnvironmentString(env, "SIGNING_SESSION_SEAL_ACCEPTED_WARM_KEY_VERSIONS").split(",").map((value) => value.trim()).filter(Boolean);
+	if (!rootSecretB64u && !currentKeyVersion) return;
+	if (!rootSecretB64u || !currentKeyVersion || acceptedWarmKeyVersions.length === 0) throw new Error("Email OTP server seal requires the root secret, current key version, and accepted warm key versions");
+	return {
+		rootSecretB64u,
+		currentKeyVersion,
+		acceptedWarmKeyVersions
+	};
+}
+function stagingGithubOAuthConfig(env) {
+	const clientId = readEnvironmentString(env, "GITHUB_OAUTH_CLIENT_ID");
+	const clientSecret = readEnvironmentString(env, "GITHUB_OAUTH_CLIENT_SECRET");
+	const callbackUrl = readEnvironmentString(env, "GITHUB_OAUTH_CALLBACK_URL");
+	if (!clientId && !clientSecret && !callbackUrl) return void 0;
+	if (!clientId || !clientSecret || !callbackUrl) throw new Error("GitHub OAuth requires GITHUB_OAUTH_CLIENT_ID, GITHUB_OAUTH_CLIENT_SECRET, and GITHUB_OAUTH_CALLBACK_URL");
+	return {
+		clientId,
+		clientSecret,
+		callbackUrl
+	};
+}
+function parseJsonValue(text) {
+	try {
+		return JSON.parse(text);
+	} catch {
+		return null;
+	}
+}
+function d1StringList(values) {
+	return values.map(d1StringLiteral).join(", ");
+}
+function d1StringLiteral(value) {
+	if (!/^[a-z0-9_]+$/.test(value)) throw new Error(`invalid D1 table name ${value}`);
+	return `'${value}'`;
+}
+function yaoDirectOperationForRequest(request) {
+	if (request.method !== "POST") return null;
+	switch (new URL(request.url).pathname) {
+		case ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1: return "registration_admission";
+		case ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1: return "registration_execute";
+		case ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1: return "recovery_bootstrap";
+		case ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1: return "recovery_admission";
+		case ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1: return "recovery_execute";
+		case ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1: return "recovery_activate";
+		case ROUTER_AB_ED25519_YAO_RECOVERY_STATUS_PATH_V1: return "recovery_status";
+		case ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1: return "export_admission";
+		case ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1: return "export_execute";
+		default: return null;
+	}
+}
+async function handlePartitionedD1Operation(env, request, operation, tenantRootCustodyLineage, dependencies) {
+	switch (operation) {
+		case "registration_admission":
+		case "registration_execute": return await handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1({
+			request,
+			store: createStagingYaoPartitionedStateStore(env),
+			backend: createStagingEd25519YaoBackend(env, createStagingRegistrationTenantRootResolver(stagingTenantScope(env), tenantRootCustodyLineage))
+		});
+		case "recovery_bootstrap":
+		case "recovery_admission":
+		case "recovery_execute":
+		case "recovery_activate":
+		case "recovery_status": return await handleRouterAbEd25519YaoRecoveryRequestScopedCloudflareV1({
+			request,
+			...createStagingRecoveryRequestScopedDependencies(env, tenantRootCustodyLineage, dependencies)
+		});
+		case "export_admission":
+		case "export_execute": {
+			const scope = stagingTenantScope(env);
+			const { service } = await createStagingRouterApiAuthComposition(env, scope, createStagingYaoRequestScopedRuntime(env, createStagingRegistrationTenantRootResolver(scope, tenantRootCustodyLineage)), tenantRootCustodyLineage, dependencies);
+			return await handleRouterAbEd25519YaoExportRequestScopedCloudflareV1({
+				request,
+				...createStagingExportRequestScopedDependencies(env, service, tenantRootCustodyLineage)
+			});
+		}
+	}
+}
+function createStagingYaoPartitionedStateStore(env) {
+	const scope = stagingTenantScope(env);
+	return createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1({
+		database: env.SIGNER_DB,
+		scope
+	});
+}
+async function loadStagingPersistedActiveCapability(env, lookup) {
+	const walletId = parseWalletId(lookup.walletId);
+	if (!walletId.ok) return null;
+	return (await stagingWalletStore(env).getEd25519SignerBySlot({
+		walletId: walletId.value,
+		signerSlot: lookup.signerSlot
+	}))?.activeYaoCapability || null;
+}
+function createStagingYaoRequestScopedRuntime(env, resolveTenantRoot) {
+	return createRouterAbEd25519YaoProductRegistrationRequestScopedRuntimeV1({
+		signingWorkerId: requireEnvironmentString(env, "SIGNING_WORKER_ID"),
+		store: createStagingYaoPartitionedStateStore(env),
+		registrationBackend: createStagingEd25519YaoBackend(env, resolveTenantRoot),
+		loadPersistedActiveCapability: loadStagingPersistedActiveCapability.bind(void 0, env)
+	});
+}
+/**
+* Builds the recovery request-scoped dependencies from the environment alone.
+* This is new composition wiring over the existing authorization classes, not a
+* second authorization implementation: the same adapter the tenant runtime uses
+* is constructed here against request-scoped state instead of runtime-held
+* state, which is the dependency Refactor 93 exists to remove.
+*/
+function createStagingRecoveryRequestScopedDependencies(env, tenantRootCustodyLineage, dependencies = {}) {
+	const scope = stagingTenantScope(env);
+	const store = createStagingYaoPartitionedStateStore(env);
+	const yaoRuntime = createStagingYaoRequestScopedRuntime(env, createStagingRegistrationTenantRootResolver(scope, tenantRootCustodyLineage));
+	const serviceLoader = {
+		env,
+		scope,
+		yaoRuntime,
+		tenantRootCustodyLineage,
+		dependencies,
+		promise: null
+	};
+	return {
+		store,
+		backend: createStagingEd25519YaoBackend(env, createStagingTenantRootResolver(scope, tenantRootCustodyLineage, resolveStagingActiveTenantRootFromLoader.bind(void 0, serviceLoader))),
+		authorization: new RouterAbEd25519YaoRecoveryWalletSessionAuthorizationAdapter(resolveStagingRecoveryAuthorizationServices.bind(void 0, serviceLoader)),
+		capabilityPersistence: new CloudflareD1RouterAbEd25519YaoCapabilityPersistence({
+			database: env.SIGNER_DB,
+			scope,
+			walletStore: stagingWalletStore(env),
+			ensureSchema: false
+		}),
+		capabilities: yaoRuntime,
+		linkedAuthorities: { readInstalledEd25519AuthorityByMaterialActivationV1: readStagingLinkedAuthority.bind(void 0, serviceLoader) }
+	};
+}
+/**
+* Builds export request-scoped state while reusing the request's authoritative
+* Router API factor and owner-proof services.
+*/
+function createStagingExportRequestScopedDependencies(env, service, tenantRootCustodyLineage) {
+	const scope = stagingTenantScope(env);
+	const registrationTenantRootResolver = createStagingRegistrationTenantRootResolver(scope, tenantRootCustodyLineage);
+	const resolveActiveTenantRoot = resolveStagingActiveTenantRootFromService.bind(void 0, service);
+	return {
+		store: createStagingYaoPartitionedStateStore(env),
+		backend: createStagingEd25519YaoBackend(env, createStagingTenantRootResolver(scope, tenantRootCustodyLineage, resolveActiveTenantRoot)),
+		authorization: new RouterAbEd25519YaoExportOwnerProofAuthorizationAdapter(service.webAuthn, service.emailOtp, service.walletAuthMethods, service.authorizedOperations, service.walletRegistration.resolveEd25519MaterialActivation.bind(service.walletRegistration)),
+		capabilities: createStagingYaoRequestScopedRuntime(env, registrationTenantRootResolver)
+	};
+}
+function stagingSessionAdapter(env) {
+	return createEd25519SessionAdapter({
+		privateJwk: requireStagingEcdsaCeremonyPrivateJwk(env),
+		keyId: requireEnvironmentString(env, "ROUTER_AB_CEREMONY_JWT_KEY_ID"),
+		cookieName: readEnvironmentString(env, "SESSION_COOKIE_NAME"),
+		issuer: requireEnvironmentString(env, "ROUTER_AB_CEREMONY_JWT_ISSUER"),
+		audience: requireEnvironmentString(env, "ROUTER_AB_CEREMONY_JWT_AUDIENCE")
+	});
+}
+function stagingWalletStore(env) {
+	const scope = stagingTenantScope(env);
+	return new D1WalletStore({
+		database: env.SIGNER_DB,
+		namespace: scope.namespace,
+		orgId: scope.orgId,
+		projectId: scope.projectId,
+		envId: scope.envId,
+		ensureSchema: false
+	});
+}
+//#endregion
+export { createHostedWalletGatewayCompositionV1, createSplitGatewayRouterHandler, createStagingEd25519YaoBackend, createStagingExportRequestScopedDependencies, createStagingRecoveryRequestScopedDependencies, handleSplitGatewayRequest, handleSplitGatewayWalletRuntimeRequest, readStagingHostedWalletOrigins, stagingSigningSessionSealOptions };
+
+//# sourceMappingURL=hosted-wallet-gateway.js.map