@seams/wallet-server 0.5.0

package/dist/esm/router/cloudflare/d1/auth/d1RouterApiAuthService.js

@@ -0,0 +1,1581 @@
+import { parseWalletAuthMethodId, parseWalletAuthorityId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { parseDeviceId, parsePrincipalId, parseTenantId, parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { capabilityPolicyPort } from "../../../../authorization/capabilityPolicy.js";
+import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
+import { alphabetizeStringify, sha256BytesUtf8, sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import "../../../../shared-ts/src/utils/encoders.js";
+import { computeWalletAuthMethodRevokeOperationFingerprintV1 } from "../../../../shared-ts/src/utils/registrationIntent.js";
+import { parseRouterAbEcdsaRegistrationActivationReceiptV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { AuthorizationService } from "../../../../authorization/service.js";
+import { D1WalletStore } from "../../../../core/d1WalletStore.js";
+import { D1WalletAuthMethodStore } from "../../../../core/d1WalletAuthMethodStore.js";
+import { normalizeLogger } from "../../../../core/logger.js";
+import { executeSignedDelegateWithRelayer } from "../../../../delegateAction/index.js";
+import { parseWalletUnlockIssuanceRejectionCode } from "../../../framework/authServicePort.js";
+import { parseWebAuthnAuthenticationCredential } from "../../../auth/webAuthnCredentialCodecs.js";
+import { resolveActiveOwnerWalletExecutionLane, resolveWalletAuthMethodIdForAuthority } from "../../../../core/signingLanes/WalletExecutionLaneProjection.js";
+import { DEFAULT_WALLET_SESSION_TTL_MS } from "../../../../shared-ts/src/threshold/sessionPolicy.js";
+import { createDeviceLinkingOwnerRequestAuthenticatorV1 } from "../../../transport/fetch/routes/deviceLinkingOwnerAuthorization.js";
+import { sha256BytesPortable, toRecordValue } from "./d1RouterApiAuthBoundary.js";
+import { CloudflareD1WebAuthnStore } from "../webauthn/d1WebAuthnStore.js";
+import { verifyD1LinkedDeviceFreshRevokeProofV1 } from "../wallet/d1WalletAuthMethodBoundary.js";
+import { CloudflareD1WebAuthnAuthService } from "../webauthn/d1WebAuthnAuthService.js";
+import { D1WalletAuthorityStore } from "../wallet/d1WalletAuthorityStore.js";
+import { CloudflareD1AuthorizationStore } from "../authorization/d1AuthorizationStore.js";
+import { createCloudflareD1VersionedJsonRecordStore } from "../versionedJson/d1VersionedJsonRecordStore.js";
+import { parseRouterAbEd25519YaoRegistrationSideEffectRecordV2, runRouterAbEd25519YaoRegistrationSideEffectV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
+import { createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1 } from "../../signingLanes/cloudflareOrdinaryInactiveSignerMaterialReservation.js";
+import { normalizeD1RouterApiAuthOptions } from "./d1RouterApiAuthConfig.js";
+import { parseRegistrationEstablishedSessionProjectionV2 } from "../../../../shared-ts/src/utils/registrationEstablishedSession.js";
+import { D1IdentityStore } from "../../../../core/d1IdentityStore.js";
+import { toPublicKeyStringFromSecretKey } from "../../../../core/nearKeys.js";
+import { MinimalNearClient } from "../../../../core/rpcClients/near/NearClient.js";
+import { signGasRelayerNearTransactionWithDeps } from "../../../../core/authService/nearTransactions.js";
+import { ensureSignerWasmRuntime } from "../../../../core/authService/wasm.js";
+import { parseD1EcdsaDerivationServerBootstrapResponse, parseD1WalletRegistrationCommittedInstallationProjection, parseD1WalletRegistrationFinalizeReplayResponse } from "../registration/d1RegistrationCeremonyRecords.js";
+import { CloudflareD1RegistrationCeremonyIntentStore } from "../registration/d1RegistrationCeremonyStore.js";
+import { CloudflareD1NearPublicKeyStore } from "../near/d1NearPublicKeyStore.js";
+import { CloudflareD1EmailOtpChallengeStore } from "../emailOtp/d1EmailOtpChallengeStore.js";
+import { CloudflareD1EmailOtpDeliveryRuntime } from "../emailOtp/d1EmailOtpDeliveryRuntime.js";
+import { CloudflareD1EmailOtpEnrollmentStore } from "../emailOtp/d1EmailOtpEnrollmentStore.js";
+import { CloudflareD1EmailOtpGrantStore } from "../emailOtp/d1EmailOtpGrantStore.js";
+import { CloudflareD1EmailOtpRateLimitStore } from "../emailOtp/d1EmailOtpRateLimitStore.js";
+import { CloudflareD1EmailOtpServerSealRuntime } from "../emailOtp/d1EmailOtpServerSealRuntime.js";
+import { CloudflareD1EmailOtpRegistrationEnrollmentFinalizer } from "../emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer.js";
+import { CloudflareD1EmailOtpChallengeVerifier } from "../emailOtp/d1EmailOtpChallengeVerifier.js";
+import { CloudflareD1EmailOtpChallengeIssuer } from "../emailOtp/d1EmailOtpChallengeIssuer.js";
+import { CloudflareD1EmailOtpChallengeService } from "../emailOtp/d1EmailOtpChallengeService.js";
+import { CloudflareD1EmailOtpRecoveryService } from "../emailOtp/d1EmailOtpRecoveryService.js";
+import { CloudflareD1GoogleEmailOtpRegistrationAttemptStore } from "../emailOtp/d1GoogleEmailOtpRegistrationAttemptStore.js";
+import { CloudflareD1GoogleEmailOtpSessionResolver } from "../emailOtp/d1GoogleEmailOtpSessionResolver.js";
+import { CloudflareD1IdentityService } from "../identity/d1IdentityService.js";
+import { CloudflareD1OidcVerificationService } from "../oidc/d1OidcVerificationService.js";
+import { CloudflareD1WalletAuthMethodService } from "../wallet/d1WalletAuthMethodService.js";
+import { parseWalletRegistrationSessionCommitReceiptV2 } from "../registration/walletRegistrationSessionCommitReceipt.js";
+import { CloudflareD1WalletRegistrationService } from "../registration/d1WalletRegistrationService.js";
+import { CloudflareD1WalletRegistrationCommitStore } from "../registration/d1WalletRegistrationCommitStore.js";
+import { CloudflareD1PasskeyCustodyEnvelopeStore } from "../passkeyCustody/d1PasskeyCustodyEnvelopeStore.js";
+import { CloudflareD1WalletCustodyCommitStore } from "../passkeyCustody/d1WalletCustodyCommitStore.js";
+import { createD1PasskeyCustodyRouteService } from "../passkeyCustody/d1PasskeyCustodyRouteService.js";
+import { CloudflareD1WalletRecoveryGoogleEmailOtpAttemptStore } from "../passkeyCustody/d1WalletRecoveryGoogleEmailOtpAttemptStore.js";
+import { CloudflareD1WalletRecoveryGoogleEmailOtpService } from "../passkeyCustody/d1WalletRecoveryGoogleEmailOtpService.js";
+import { CloudflareD1WalletAddSignerService, parseD1WalletAddSignerFinalizeSideEffectRecord, parseD1WalletAddSignerStartSideEffectRecord } from "../wallet/d1WalletAddSignerService.js";
+import { CloudflareD1RegistrationIntentService } from "../registration/d1RegistrationIntentService.js";
+import { broadcastPreparedSponsoredNearAccountCreation, fundImplicitNearAccountWithRelayer, prepareSponsoredNearAccountCreationWithRelayer, preparedSponsoredNearAccountCreationArtifactFingerprint } from "../../../../core/nearRelayerAccountProvisioning.js";
+import { createD1LinkedDeviceSessionServiceV1 } from "../deviceLinking/d1LinkedDeviceSessionService.js";
+import { D1LinkedDeviceSessionStoreV1 } from "../deviceLinking/d1LinkedDeviceSessionStore.js";
+import { createD1LinkedDeviceRouteServiceV1 } from "../deviceLinking/d1LinkedDeviceRouteService.js";
+import { D1LinkedDeviceEmailOtpGrantStoreV1 } from "../deviceLinking/d1LinkedDeviceEmailOtpGrantStore.js";
+import { D1LinkedDeviceAuthorityInstallServiceV1 } from "../deviceLinking/d1LinkedDeviceAuthorityInstallService.js";
+import { createD1LinkedDeviceManagementServiceV1 } from "../deviceLinking/d1LinkedDeviceManagementService.js";
+import { createD1LinkedDeviceVerifiedLinkSourceReaderV1 } from "../deviceLinking/d1LinkedDeviceVerifiedLinkSourceReader.js";
+import { LinkedDeviceWebAuthnRegistrationVerifierV1 } from "../deviceLinking/d1LinkedDeviceTargetCredentialProvider.js";
+import { D1LinkedDeviceEmailOtpTargetFactorV1, linkedDeviceEmailOtpGrantRegistrationPortV1 } from "../deviceLinking/d1LinkedDeviceEmailOtpTargetFactor.js";
+import { createD1LinkedDeviceOwnerAuthorizationMetadataSourceV1, createD1LinkedDeviceOwnerAuthorizationProviderV1 } from "../deviceLinking/d1LinkedDeviceOwnerAuthorizationProvider.js";
+//#region src/router/cloudflare/d1/auth/d1RouterApiAuthService.ts
+const DEFAULT_D1_THRESHOLD_RELAYER_ACCOUNT = "cloudflare-d1-relayer.local";
+const DEFAULT_D1_THRESHOLD_RELAYER_PUBLIC_KEY = "d1-relayer-public-key";
+function linkedDeviceEd25519AuthorityReaderFromSlot(slot) {
+	return slot.current;
+}
+function createD1LinkedDeviceComposition(input) {
+	const config = input.options.linkedDevice;
+	if (!config) return {};
+	const sessionConfig = "session" in config ? config.session : void 0;
+	const managementConfig = "management" in config ? config.management : void 0;
+	if (!sessionConfig && !managementConfig) return {};
+	const scope = {
+		namespace: input.options.namespace,
+		orgId: input.options.orgId,
+		projectId: input.options.projectId,
+		envId: input.options.envId
+	};
+	let deviceLinking;
+	let ownerAuthorizationRoute;
+	let linkedDeviceEd25519AuthorityReader;
+	const nowV1 = sessionConfig?.nowV1 ?? managementConfig?.nowV1 ?? Date.now;
+	const ownerRequestAuthenticator = createDeviceLinkingOwnerRequestAuthenticatorV1({
+		authorizationSessions: input.authorizationSessions,
+		nowV1
+	});
+	const tenantId = parseTenantId(input.options.orgId);
+	if (!tenantId.ok) throw new Error(`orgId cannot identify an authorization tenant: ${tenantId.error.message}`);
+	const authorityStore = new D1WalletAuthorityStore({
+		database: input.options.database,
+		scope
+	});
+	let deactivationEndpoint;
+	if (sessionConfig) deactivationEndpoint = sessionConfig.authorityInstallation.deactivationEndpoint;
+	else if (managementConfig) deactivationEndpoint = managementConfig.deactivationEndpoint;
+	else return {};
+	const deviceManagement = {
+		management: createD1LinkedDeviceManagementServiceV1({
+			scope,
+			tenantId: tenantId.value,
+			authorityStore,
+			authMethodStore: input.walletAuthMethodStore,
+			authorizationService: input.authorizationService,
+			walletSessionAuthorizations: input.authorizationStore,
+			webAuthnStore: input.webAuthnStore,
+			...input.emailOtpLinkedDevice === void 0 ? {} : { emailOtpEnrollments: input.emailOtpLinkedDevice.enrollments },
+			materialDeactivation: createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1({ endpoint: deactivationEndpoint })
+		}),
+		nowV1,
+		authenticateOwnerRequestV1: ownerRequestAuthenticator,
+		verifyFreshRevokeProofV1: async (proofInput) => {
+			const expectedOrigin = String(proofInput.request.headers.get("origin") || "").trim();
+			if (!expectedOrigin) return {
+				kind: "denied",
+				code: "invalid",
+				message: "Fresh revocation proof requires an Origin header"
+			};
+			return await verifyD1LinkedDeviceFreshRevokeProofV1({
+				walletId: proofInput.walletId,
+				orgId: String(input.options.orgId),
+				targetWalletAuthMethodId: proofInput.targetWalletAuthMethodId,
+				proof: proofInput.proof,
+				expectedOrigin,
+				verifiedAtMs: proofInput.requestedAtMs,
+				operationFingerprintDigest: await computeWalletAuthMethodRevokeOperationFingerprintV1({
+					walletId: proofInput.walletId,
+					targetWalletAuthMethodId: proofInput.targetWalletAuthMethodId,
+					requestedAtMs: proofInput.requestedAtMs
+				}),
+				walletAuthMethodStore: input.walletAuthMethodStore,
+				verifyWebAuthnAuthenticationLite: async (verifyInput) => {
+					const credential = parseWebAuthnAuthenticationCredential(verifyInput.webauthn_authentication);
+					if (!credential) return {
+						success: false,
+						verified: false,
+						code: "invalid_body",
+						message: "Invalid WebAuthn authentication credential"
+					};
+					return await input.webAuthnAuthService.verifyWebAuthnAuthenticationLite({
+						...verifyInput,
+						webauthn_authentication: credential
+					});
+				},
+				...input.emailOtpLinkedDevice === void 0 ? {} : {
+					verifyEmailOtpExisting: input.emailOtpLinkedDevice.verifier.verifyExisting.bind(input.emailOtpLinkedDevice.verifier),
+					readEmailOtpEnrollment: input.emailOtpLinkedDevice.enrollments.readEnrollment.bind(input.emailOtpLinkedDevice.enrollments)
+				}
+			});
+		}
+	};
+	if (!sessionConfig) return { deviceManagement };
+	if (sessionConfig) {
+		let emailOtpTargetFactor;
+		if (input.emailOtpLinkedDevice) {
+			const linkedEmailOtpGrants = new D1LinkedDeviceEmailOtpGrantStoreV1({
+				database: input.options.database,
+				scope
+			});
+			emailOtpTargetFactor = new D1LinkedDeviceEmailOtpTargetFactorV1({
+				issuer: input.emailOtpLinkedDevice.issuer,
+				verifier: input.emailOtpLinkedDevice.verifier,
+				enrollments: input.emailOtpLinkedDevice.enrollments,
+				orgId: input.options.orgId,
+				walletAuthMethods: input.emailOtpLinkedDevice.walletAuthMethodStore,
+				walletAuthorities: authorityStore,
+				serverSeal: input.emailOtpLinkedDevice.serverSeal,
+				grants: linkedEmailOtpGrants
+			});
+		}
+		const sessionStore = new D1LinkedDeviceSessionStoreV1({
+			database: input.options.database,
+			scope,
+			now: nowV1
+		});
+		const verifiedLinkSourceReader = createD1LinkedDeviceVerifiedLinkSourceReaderV1({
+			authorizationService: input.authorizationService,
+			authorityStore,
+			authMethodStore: input.walletAuthMethodStore,
+			walletStore: input.walletStore,
+			tenantId: tenantId.value
+		});
+		const ownerAuthorizationProvider = createD1LinkedDeviceOwnerAuthorizationProviderV1({
+			walletRegistration: input.walletRegistration,
+			metadata: createD1LinkedDeviceOwnerAuthorizationMetadataSourceV1({
+				sessionStore,
+				readVerifiedSourceV1: verifiedLinkSourceReader.readVerifiedSourceV1,
+				readOwnerSourceChildV1: sessionConfig.readOwnerSourceChildV1,
+				nowV1
+			}),
+			targetPlanner: { targetPasskeyRpId: sessionConfig.targetPasskeyRpId },
+			nowV1
+		});
+		ownerAuthorizationRoute = ownerAuthorizationProvider.ownerAuthorizationRoute;
+		const sessionComposition = createD1LinkedDeviceSessionServiceV1({
+			sessionStore,
+			ownerAuthorization: ownerAuthorizationProvider.ownerAuthorization
+		});
+		const verifiedLinkBuilder = { source: verifiedLinkSourceReader };
+		const authorityInstall = new D1LinkedDeviceAuthorityInstallServiceV1({
+			database: input.options.database,
+			scope,
+			authorityStore,
+			authMethodStore: input.walletAuthMethodStore,
+			listWalletEd25519Signers: (walletId) => input.walletStore.listEd25519SignersForWallet({ walletId }),
+			sessionStore: sessionComposition.sessionStore,
+			sessionService: sessionComposition.sessionService,
+			reservationService: createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1({ endpoint: sessionConfig.authorityInstallation.reservationEndpoint }),
+			materialActivation: createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1({ endpoint: sessionConfig.authorityInstallation.activationEndpoint }),
+			authorizationService: input.authorizationService,
+			authorizationStore: input.authorizationStore,
+			...input.emailOtpLinkedDevice === void 0 ? {} : { emailOtpEnrollmentFinalizer: input.emailOtpLinkedDevice.enrollmentFinalizer },
+			tenantId: tenantId.value,
+			nowV1
+		});
+		linkedDeviceEd25519AuthorityReader = authorityInstall;
+		const installationReceipt = {
+			commitPendingAuthorityV1: async ({ input: verifiedLinkInput, nowMs, ed25519ExportRootPackage }) => await authorityInstall.commitPendingAuthorityV1({
+				...verifiedLinkInput,
+				nowMs,
+				ed25519ExportRootPackage
+			}),
+			readCommittedAuthorityPackagesV1: authorityInstall.readCommittedAuthorityPackagesV1.bind(authorityInstall),
+			activateInstalledAuthorityV1: async ({ receipt, requestedAtMs }) => await authorityInstall.activateInstalledAuthorityV1({
+				receipt,
+				nowMs: requestedAtMs
+			}),
+			readActivationCleanupReceiptV1: authorityInstall.readActivationCleanupReceiptV1.bind(authorityInstall),
+			acknowledgeLocalAuthorityActivationV1: authorityInstall.acknowledgeLocalAuthorityActivationV1.bind(authorityInstall)
+		};
+		deviceLinking = createD1LinkedDeviceRouteServiceV1({
+			database: input.options.database,
+			scope,
+			ownerAuthorization: ownerAuthorizationProvider.ownerAuthorization,
+			...emailOtpTargetFactor === void 0 ? {} : { emailOtpTargetFactor },
+			authenticateOwnerRequestV1: ownerRequestAuthenticator,
+			targetCredential: sessionConfig.targetCredential({
+				verifiedLinkBuilder,
+				targetCredentialVerification: new LinkedDeviceWebAuthnRegistrationVerifierV1(ownerAuthorizationProvider.targetPlanner.targetPasskeyRpId),
+				targetPlanner: ownerAuthorizationProvider.targetPlanner,
+				resolveOwnerSourceChildV1: ownerAuthorizationProvider.ownerSourceResolver.resolveOwnerSourceChildV1,
+				...emailOtpTargetFactor === void 0 ? {} : { emailOtpGrants: linkedDeviceEmailOtpGrantRegistrationPortV1(emailOtpTargetFactor) }
+			}),
+			installationReceipt,
+			...sessionConfig.sourceContributionRouter === void 0 ? {} : { sourceContributionRouter: sessionConfig.sourceContributionRouter },
+			nowV1
+		});
+	}
+	return {
+		...deviceLinking === void 0 ? {} : { deviceLinking },
+		...deviceManagement === void 0 ? {} : { deviceManagement },
+		...ownerAuthorizationRoute === void 0 ? {} : { deviceLinkingOwnerAuthorization: ownerAuthorizationRoute },
+		...linkedDeviceEd25519AuthorityReader === void 0 ? {} : { linkedDeviceEd25519AuthorityReader }
+	};
+}
+var CloudflareD1SignedDelegateExecutor = class {
+	constructor(options) {
+		this.options = options;
+		this.signerWasmState = { signerWasmReady: false };
+		this.logger = normalizeLogger();
+	}
+	async execute(input) {
+		const relayerAccount = this.options.relayerAccount;
+		const relayerPrivateKey = this.options.relayerPrivateKey;
+		const nearRpcUrl = this.options.nearRpcUrl;
+		if (!relayerAccount || !relayerPrivateKey || !nearRpcUrl) return {
+			ok: false,
+			code: "not_configured",
+			error: "Signed delegate execution is not configured on this server"
+		};
+		try {
+			const relayerPublicKey = this.options.relayerPublicKey || toPublicKeyStringFromSecretKey(relayerPrivateKey);
+			return await executeSignedDelegateWithRelayer({
+				nearClient: new MinimalNearClient(nearRpcUrl),
+				relayerAccount,
+				relayerPublicKey,
+				hash: input.hash,
+				signedDelegate: input.signedDelegate,
+				policy: input.policy,
+				signGasRelayerNearTransaction: this.signGasRelayerNearTransaction.bind(this)
+			});
+		} catch (error) {
+			return {
+				ok: false,
+				code: "delegate_execution_failed",
+				error: error instanceof Error ? error.message : String(error)
+			};
+		}
+	}
+	async ensureSignerWasm() {
+		this.signerWasmState = await ensureSignerWasmRuntime({
+			state: this.signerWasmState,
+			override: this.options.signerWasmModuleOrPath,
+			logger: this.logger
+		});
+	}
+	async signGasRelayerNearTransaction(input) {
+		const relayerAccount = this.options.relayerAccount;
+		const relayerPrivateKey = this.options.relayerPrivateKey;
+		if (!relayerAccount || !relayerPrivateKey) throw new Error("Signed delegate relayer credentials are not configured");
+		return await signGasRelayerNearTransactionWithDeps({
+			...input,
+			ensureSignerWasm: this.ensureSignerWasm.bind(this),
+			relayerAccount,
+			relayerPrivateKey
+		});
+	}
+};
+function d1RouterApiErrorMessage(error) {
+	return error instanceof Error ? error.message : String(error || "");
+}
+async function linkD1Identity(identityStore, input) {
+	try {
+		return await identityStore.linkSubjectToUserId(input);
+	} catch (error) {
+		return {
+			ok: false,
+			code: "internal",
+			message: d1RouterApiErrorMessage(error) || "Failed to link identity"
+		};
+	}
+}
+function createLazyStoreState(options) {
+	return {
+		options,
+		walletStore: null,
+		walletAuthMethodStore: null,
+		registrationCeremonyIntentStore: null
+	};
+}
+function getRegistrationCeremonyIntentStoreForState(state) {
+	if (state.registrationCeremonyIntentStore) return state.registrationCeremonyIntentStore;
+	state.registrationCeremonyIntentStore = new CloudflareD1RegistrationCeremonyIntentStore({
+		kind: "partitioned_d1",
+		database: state.options.database,
+		scope: {
+			namespace: state.options.namespace,
+			orgId: state.options.orgId,
+			projectId: state.options.projectId,
+			envId: state.options.envId
+		},
+		keyPrefix: "gateway-registration:"
+	});
+	return state.registrationCeremonyIntentStore;
+}
+function getWalletAuthMethodStoreForState(state) {
+	if (state.walletAuthMethodStore) return state.walletAuthMethodStore;
+	state.walletAuthMethodStore = new D1WalletAuthMethodStore({
+		database: state.options.database,
+		namespace: state.options.namespace,
+		orgId: state.options.orgId,
+		projectId: state.options.projectId,
+		envId: state.options.envId,
+		ensureSchema: false
+	});
+	return state.walletAuthMethodStore;
+}
+function getWalletStoreForState(state) {
+	if (state.walletStore) return state.walletStore;
+	state.walletStore = new D1WalletStore({
+		database: state.options.database,
+		namespace: state.options.namespace,
+		orgId: state.options.orgId,
+		projectId: state.options.projectId,
+		envId: state.options.envId,
+		ensureSchema: false
+	});
+	return state.walletStore;
+}
+function scopePrepareForOptions(options, sql, values) {
+	return options.database.prepare(sql).bind(...scopeValuesForOptions(options, values));
+}
+function scopeValuesForOptions(options, values) {
+	return [
+		options.namespace,
+		options.orgId,
+		options.projectId,
+		options.envId,
+		...values
+	];
+}
+async function fundImplicitNearAccountForOptions(options, input) {
+	if (!options.implicitNearAccountTestFundingEnabled) return {
+		ok: false,
+		code: "not_configured",
+		message: "Implicit NEAR account test funding is not enabled on this server"
+	};
+	const relayerAccount = options.relayerAccount;
+	const relayerPrivateKey = options.relayerPrivateKey;
+	const nearRpcUrl = options.nearRpcUrl;
+	const fundedAmountYocto = options.accountInitialBalance;
+	if (!relayerAccount || !relayerPrivateKey || !nearRpcUrl || !fundedAmountYocto) return {
+		ok: false,
+		code: "not_configured",
+		message: "Implicit NEAR account funding is not configured on this server"
+	};
+	return await fundImplicitNearAccountWithRelayer({
+		...input,
+		relayerAccount,
+		relayerPrivateKey,
+		relayerPublicKey: options.relayerPublicKey,
+		nearRpcUrl,
+		fundedAmountYocto
+	});
+}
+/**
+* Validates a persisted claim before it is trusted to skip a broadcast or to be
+* replayed. An invalid record makes the D1 read fail, which leaves the effect
+* uncertain and prevents any network action on unvalidated bytes.
+*/
+function parseSponsoredNearAccountSideEffectRecord(raw) {
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
+	if (Reflect.get(raw, "operation") !== "finalize") return null;
+	const requestFingerprint = parseSideEffectFingerprint(Reflect.get(raw, "requestFingerprint"));
+	const preparedArtifactFingerprint = parseSideEffectFingerprint(Reflect.get(raw, "preparedArtifactFingerprint"));
+	if (requestFingerprint === null || preparedArtifactFingerprint === null) return null;
+	const claimedAtMs = Reflect.get(raw, "claimedAtMs");
+	if (!isNonNegativeSafeInteger(claimedAtMs)) return null;
+	const prepared = parsePreparedSponsoredNearAccountCreation(Reflect.get(raw, "prepared"));
+	if (prepared === null) return null;
+	const kind = Reflect.get(raw, "kind");
+	if (kind === "router_ab_ed25519_yao_registration_side_effect_claim_v1") return {
+		kind: "router_ab_ed25519_yao_registration_side_effect_claim_v1",
+		operation: "finalize",
+		requestFingerprint,
+		preparedArtifactFingerprint,
+		claimedAtMs,
+		prepared
+	};
+	if (kind === "router_ab_ed25519_yao_registration_side_effect_completion_v1") {
+		const completedAtMs = Reflect.get(raw, "completedAtMs");
+		if (!isNonNegativeSafeInteger(completedAtMs)) return null;
+		const response = parseAccountCreationResult(Reflect.get(raw, "response"));
+		if (response === null) return null;
+		return {
+			kind: "router_ab_ed25519_yao_registration_side_effect_completion_v1",
+			operation: "finalize",
+			requestFingerprint,
+			preparedArtifactFingerprint,
+			claimedAtMs,
+			completedAtMs,
+			prepared,
+			response
+		};
+	}
+	return null;
+}
+function parseWalletRegistrationOperationPrepared(raw) {
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
+	if (Reflect.get(raw, "kind") !== "d1_wallet_registration_operation_prepared_v1") return null;
+	const keys = [
+		"kind",
+		"walletAuthorityId",
+		"deviceId",
+		"walletAuthMethodId"
+	];
+	if (Object.keys(raw).length !== keys.length || !hasOnlyKeys(raw, keys)) return null;
+	const walletAuthorityId = parseWalletAuthorityId(Reflect.get(raw, "walletAuthorityId"));
+	const deviceId = parseDeviceId(Reflect.get(raw, "deviceId"));
+	const walletAuthMethodId = parseWalletAuthMethodId(Reflect.get(raw, "walletAuthMethodId"));
+	if (!walletAuthorityId.ok || !deviceId.ok || !walletAuthMethodId.ok) return null;
+	return {
+		kind: "d1_wallet_registration_operation_prepared_v1",
+		walletAuthorityId: walletAuthorityId.value,
+		deviceId: deviceId.value,
+		walletAuthMethodId: walletAuthMethodId.value
+	};
+}
+function hasOnlyKeys(record, keys) {
+	const allowed = new Set(keys);
+	return Object.keys(record).every((key) => allowed.has(key));
+}
+function hasExactKeys(record, keys) {
+	return Object.keys(record).length === keys.length && hasOnlyKeys(record, keys);
+}
+function parseWalletRegistrationSessionCommitReceipt(raw) {
+	const record = toRecordValue(raw);
+	if (!record) return null;
+	return parseWalletRegistrationSessionCommitReceiptV2(record, (committed) => parseWalletRegistrationSessionCommitReceiptCommitted(committed, record));
+}
+function parseWalletRegistrationSessionCommitReceiptCommitted(raw, receipt) {
+	const record = toRecordValue(raw);
+	if (!record || typeof record.kind !== "string") return null;
+	if (record.kind === "ecdsa_ready") {
+		if (!hasExactKeys(record, [
+			"kind",
+			"ecdsa",
+			"session"
+		]) && !hasExactKeys(record, [
+			"kind",
+			"ecdsa",
+			"session",
+			"nearProvisioning"
+		]) && !hasExactKeys(record, [
+			"kind",
+			"ecdsa",
+			"session",
+			"nearProvisioning",
+			"installation"
+		])) return null;
+		const ecdsa = parseWalletRegistrationSessionCommitEcdsa(record.ecdsa, receipt);
+		const session = parseRegistrationEstablishedSessionProjectionV2(record.session);
+		if (!ecdsa || !session || session.tokens.kind !== "evm_family_ecdsa") return null;
+		const nearProvisioning = record.nearProvisioning === void 0 ? void 0 : parseNearPendingProjection(record.nearProvisioning);
+		if (record.nearProvisioning !== void 0 && !nearProvisioning) return null;
+		const installation = record.installation === void 0 ? void 0 : parseD1WalletRegistrationCommittedInstallationProjection(record.installation);
+		if (record.installation !== void 0 && !installation || nearProvisioning !== void 0 !== (installation !== void 0)) return null;
+		if (nearProvisioning && installation) return {
+			kind: "ecdsa_ready",
+			ecdsa,
+			session,
+			nearProvisioning,
+			installation
+		};
+		if (nearProvisioning === void 0 && installation === void 0) return {
+			kind: "ecdsa_ready",
+			ecdsa,
+			session
+		};
+		return null;
+	}
+	if (record.kind !== "near_ready") return null;
+	if (!hasExactKeys(record, [
+		"kind",
+		"authorityScope",
+		"accountProvisioning",
+		"resolvedAccount",
+		"ed25519",
+		"session",
+		"nearProvisioning"
+	])) return null;
+	const near = parseWalletRegistrationSessionCommitNear(record, receipt);
+	const session = parseRegistrationEstablishedSessionProjectionV2(record.session);
+	if (!near || !session || session.tokens.kind !== "near_ed25519" && session.tokens.kind !== "near_ed25519_and_evm_family_ecdsa") return null;
+	return {
+		kind: "near_ready",
+		authorityScope: near.authorityScope,
+		accountProvisioning: near.accountProvisioning,
+		resolvedAccount: near.resolvedAccount,
+		ed25519: near.ed25519,
+		session,
+		nearProvisioning: { status: "near_ready" }
+	};
+}
+function parseWalletRegistrationSessionCommitEcdsa(raw, receipt) {
+	const record = toRecordValue(raw);
+	if (!record || !hasExactKeys(record, [
+		"walletKeys",
+		"activation",
+		"bootstrap"
+	])) return null;
+	const response = parseD1WalletRegistrationFinalizeReplayResponse({
+		ok: true,
+		kind: "evm_family_ecdsa",
+		walletId: receipt.walletId,
+		authority: receipt.authority,
+		foundingAuthority: receipt.foundingAuthority,
+		foundingAuthMethod: receipt.foundingAuthMethod,
+		authMethod: receipt.authMethod,
+		...receipt.authority !== null && typeof receipt.authority === "object" && !Array.isArray(receipt.authority) && Reflect.get(receipt.authority, "verifier") !== null && typeof Reflect.get(receipt.authority, "verifier") === "object" && !Array.isArray(Reflect.get(receipt.authority, "verifier")) && Reflect.get(Reflect.get(receipt.authority, "verifier"), "kind") === "webauthn" ? { rpId: Reflect.get(Reflect.get(receipt.authority, "verifier"), "rpId") } : {},
+		custodyKeyManifestDigestB64u: receipt.custodyKeyManifestDigestB64u,
+		ecdsa: { walletKeys: record.walletKeys }
+	});
+	if (!response || !response.ok || response.kind !== "evm_family_ecdsa") return null;
+	let activation;
+	try {
+		activation = parseRouterAbEcdsaRegistrationActivationReceiptV1(record.activation);
+	} catch {
+		return null;
+	}
+	const bootstrap = parseD1EcdsaDerivationServerBootstrapResponse(record.bootstrap);
+	if (!bootstrap) return null;
+	return {
+		walletKeys: response.ecdsa.walletKeys,
+		activation,
+		bootstrap
+	};
+}
+function parseWalletRegistrationSessionCommitNear(record, receipt) {
+	const response = parseD1WalletRegistrationFinalizeReplayResponse({
+		ok: true,
+		kind: "near_ed25519",
+		walletId: receipt.walletId,
+		authority: receipt.authority,
+		foundingAuthority: receipt.foundingAuthority,
+		foundingAuthMethod: receipt.foundingAuthMethod,
+		authMethod: receipt.authMethod,
+		...receipt.authority !== null && typeof receipt.authority === "object" && !Array.isArray(receipt.authority) && Reflect.get(receipt.authority, "verifier") !== null && typeof Reflect.get(receipt.authority, "verifier") === "object" && !Array.isArray(Reflect.get(receipt.authority, "verifier")) && Reflect.get(Reflect.get(receipt.authority, "verifier"), "kind") === "webauthn" ? { rpId: Reflect.get(Reflect.get(receipt.authority, "verifier"), "rpId") } : {},
+		custodyKeyManifestDigestB64u: receipt.custodyKeyManifestDigestB64u,
+		authorityScope: record.authorityScope,
+		accountProvisioning: record.accountProvisioning,
+		resolvedAccount: record.resolvedAccount,
+		ed25519: record.ed25519
+	});
+	if (!response || !response.ok || response.kind !== "near_ed25519") return null;
+	return {
+		authorityScope: response.authorityScope,
+		accountProvisioning: response.accountProvisioning,
+		resolvedAccount: response.resolvedAccount,
+		ed25519: response.ed25519
+	};
+}
+function parseNearPendingProjection(raw) {
+	const record = toRecordValue(raw);
+	return record && hasExactKeys(record, ["status"]) && record.status === "near_pending" ? { status: "near_pending" } : null;
+}
+function parseWalletRegistrationActivateSideEffectRecord(raw) {
+	const record = parseRouterAbEd25519YaoRegistrationSideEffectRecordV2(raw, {
+		operation: "registration_activate",
+		parsePrepared: parseWalletRegistrationOperationPrepared,
+		parseReceipt: parseWalletRegistrationSessionCommitReceipt
+	});
+	if (record === null || !registrationReceiptMatchesJournal(record)) return null;
+	return record;
+}
+/**
+* Deferred NEAR provisioning's own operation row. Same record shape as the
+* finalize journal it replaces for this route, tagged with its own operation
+* so a provisioning row can never be read as an activate or finalize row.
+*/
+function parseWalletRegistrationNearProvisioningSideEffectRecord(raw) {
+	const record = parseRouterAbEd25519YaoRegistrationSideEffectRecordV2(raw, {
+		operation: "near_provisioning",
+		parsePrepared: parseWalletRegistrationOperationPrepared,
+		parseReceipt: parseWalletRegistrationSessionCommitReceipt
+	});
+	if (record === null || !registrationReceiptMatchesJournal(record)) return null;
+	return record;
+}
+function registrationReceiptMatchesJournal(record) {
+	if (record.kind !== "router_ab_ed25519_yao_registration_side_effect_completion_v2") return true;
+	const receipt = record.receipt;
+	if (receipt.operation !== record.operation || receipt.operationFingerprint !== record.requestFingerprint) return false;
+	if (receipt.committed.kind === "error") return true;
+	if (!("walletAuthMethodId" in receipt)) return false;
+	if (receipt.walletAuthMethodId !== record.prepared.walletAuthMethodId) return false;
+	if (receipt.committed.kind === "near_pending") return true;
+	return "foundingAuthority" in receipt && receipt.foundingAuthority.authorityId === record.prepared.walletAuthorityId;
+}
+function parsePreparedSponsoredNearAccountCreation(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+	if (Reflect.get(value, "kind") !== "prepared_sponsored_near_account_creation_v1") return null;
+	const accountId = parseNonEmptyString(Reflect.get(value, "accountId"));
+	const publicKey = parseNonEmptyString(Reflect.get(value, "publicKey"));
+	const relayerAccountId = parseNonEmptyString(Reflect.get(value, "relayerAccountId"));
+	const relayerPublicKey = parseNonEmptyString(Reflect.get(value, "relayerPublicKey"));
+	const initialBalanceYocto = parseNonEmptyString(Reflect.get(value, "initialBalanceYocto"));
+	const transactionHash = parseNonEmptyString(Reflect.get(value, "transactionHash"));
+	const nextNonce = parseNonEmptyString(Reflect.get(value, "nextNonce"));
+	const blockHash = parseNonEmptyString(Reflect.get(value, "blockHash"));
+	const signedTransactionBorshB64u = parseBoundedBase64Url(Reflect.get(value, "signedTransactionBorshB64u"));
+	if (accountId === null || publicKey === null || relayerAccountId === null || relayerPublicKey === null || initialBalanceYocto === null || transactionHash === null || nextNonce === null || blockHash === null || signedTransactionBorshB64u === null) return null;
+	return {
+		kind: "prepared_sponsored_near_account_creation_v1",
+		accountId,
+		publicKey,
+		relayerAccountId,
+		relayerPublicKey,
+		initialBalanceYocto,
+		transactionHash,
+		nextNonce,
+		blockHash,
+		signedTransactionBorshB64u
+	};
+}
+function parseAccountCreationResult(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+	const success = Reflect.get(value, "success");
+	if (typeof success !== "boolean") return null;
+	const accountId = parseOptionalString(Reflect.get(value, "accountId"));
+	const transactionHash = parseOptionalString(Reflect.get(value, "transactionHash"));
+	const error = parseOptionalString(Reflect.get(value, "error"));
+	const message = parseOptionalString(Reflect.get(value, "message"));
+	if ("accountId" in value && accountId === null || "transactionHash" in value && transactionHash === null || "error" in value && error === null || "message" in value && message === null) return null;
+	if (success && (accountId === void 0 || transactionHash === void 0)) return null;
+	const normalizedAccountId = accountId ?? void 0;
+	const normalizedTransactionHash = transactionHash ?? void 0;
+	const normalizedError = error ?? void 0;
+	const normalizedMessage = message ?? void 0;
+	return {
+		success,
+		...normalizedAccountId === void 0 ? {} : { accountId: normalizedAccountId },
+		...normalizedTransactionHash === void 0 ? {} : { transactionHash: normalizedTransactionHash },
+		...normalizedError === void 0 ? {} : { error: normalizedError },
+		...normalizedMessage === void 0 ? {} : { message: normalizedMessage }
+	};
+}
+function parseNonEmptyString(value) {
+	return typeof value === "string" && value.trim() ? value : null;
+}
+function parseSideEffectFingerprint(value) {
+	return typeof value === "string" && /^[a-zA-Z0-9:_-]{32,192}$/u.test(value) ? value : null;
+}
+function parseBoundedBase64Url(value) {
+	return typeof value === "string" && value.length > 0 && value.length <= 8192 && /^[\w-]+$/u.test(value) ? value : null;
+}
+function parseOptionalString(value) {
+	return value === void 0 ? void 0 : parseNonEmptyString(value);
+}
+function isNonNegativeSafeInteger(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+function resolveEd25519YaoProductRegistration(options) {
+	return options.ed25519YaoProductRegistration || null;
+}
+function sponsoredNearAccountSideEffectStore(options) {
+	return createCloudflareD1VersionedJsonRecordStore({
+		database: options.database,
+		scope: {
+			namespace: options.namespace,
+			orgId: options.orgId,
+			projectId: options.projectId,
+			envId: options.envId
+		},
+		keyPrefix: "router-ab-yao-sponsored-account:",
+		encode: (value) => value,
+		parse: parseSponsoredNearAccountSideEffectRecord
+	});
+}
+function walletRegistrationActivateSideEffectStore(options) {
+	return createCloudflareD1VersionedJsonRecordStore({
+		database: options.database,
+		scope: {
+			namespace: options.namespace,
+			orgId: options.orgId,
+			projectId: options.projectId,
+			envId: options.envId
+		},
+		keyPrefix: "wallet-registration-activate:",
+		encode: (value) => value,
+		parse: parseWalletRegistrationActivateSideEffectRecord
+	});
+}
+function walletRegistrationNearProvisioningSideEffectStore(options) {
+	return createCloudflareD1VersionedJsonRecordStore({
+		database: options.database,
+		scope: {
+			namespace: options.namespace,
+			orgId: options.orgId,
+			projectId: options.projectId,
+			envId: options.envId
+		},
+		keyPrefix: "wallet-registration-near-provisioning:",
+		encode: (value) => value,
+		parse: parseWalletRegistrationNearProvisioningSideEffectRecord
+	});
+}
+function walletAddSignerStartSideEffectStore(options) {
+	return createCloudflareD1VersionedJsonRecordStore({
+		database: options.database,
+		scope: {
+			namespace: options.namespace,
+			orgId: options.orgId,
+			projectId: options.projectId,
+			envId: options.envId
+		},
+		keyPrefix: "wallet-add-signer-start:",
+		encode: (value) => value,
+		parse: parseD1WalletAddSignerStartSideEffectRecord
+	});
+}
+function walletAddSignerFinalizeSideEffectStore(options) {
+	return createCloudflareD1VersionedJsonRecordStore({
+		database: options.database,
+		scope: {
+			namespace: options.namespace,
+			orgId: options.orgId,
+			projectId: options.projectId,
+			envId: options.envId
+		},
+		keyPrefix: "wallet-add-signer-finalize:",
+		encode: (value) => value,
+		parse: parseD1WalletAddSignerFinalizeSideEffectRecord
+	});
+}
+/**
+* Creates the sponsored account through a durable claim. The signed transaction
+* and its hash are persisted before the broadcast, so a lost response replays
+* those exact bytes instead of building a second transaction under a fresh
+* nonce. Rebroadcasting an identical signed transaction reuses its hash, so the
+* network treats the retry as the same transaction.
+*/
+async function createSponsoredNamedNearAccountForOptions(options, input) {
+	const relayerAccount = options.relayerAccount;
+	const relayerPrivateKey = options.relayerPrivateKey;
+	const nearRpcUrl = options.nearRpcUrl;
+	const initialBalanceYocto = options.accountInitialBalance;
+	if (!relayerAccount || !relayerPrivateKey || !nearRpcUrl || !initialBalanceYocto) return {
+		kind: "rejected",
+		message: "Sponsored NEAR account creation is not configured on this server"
+	};
+	const relayerInput = {
+		accountId: input.accountId,
+		publicKey: input.publicKey,
+		relayerAccount,
+		relayerPrivateKey,
+		relayerPublicKey: options.relayerPublicKey,
+		nearRpcUrl,
+		initialBalanceYocto
+	};
+	const requestFingerprint = base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
+		kind: "sponsored_near_account_creation_v1",
+		accountId: input.accountId,
+		publicKey: input.publicKey,
+		relayerAccountId: relayerAccount,
+		initialBalanceYocto
+	})));
+	const outcome = await runRouterAbEd25519YaoRegistrationSideEffectV1(sponsoredNearAccountSideEffectStore(options), {
+		kind: "prepared_resumable",
+		resumeAfterMs: 3e4,
+		operation: "finalize",
+		key: `sponsored-account:${input.idempotencyKey}`,
+		requestFingerprint,
+		nowMs: () => Date.now(),
+		prepare: async () => {
+			const prepared = await prepareSponsoredNearAccountCreationWithRelayer(relayerInput);
+			if (!prepared.ok) throw new Error(prepared.message);
+			return prepared.prepared;
+		},
+		derivePreparedArtifactFingerprint: preparedSponsoredNearAccountCreationArtifactFingerprint,
+		execute: async (prepared, attempt) => {
+			if (!prepared) throw new Error("Sponsored NEAR account transaction was not prepared");
+			const broadcast = await broadcastPreparedSponsoredNearAccountCreation({
+				prepared,
+				nearRpcUrl,
+				relayerAccountId: relayerAccount,
+				reconcileFirst: attempt === "resumed"
+			});
+			if (broadcast.kind === "uncertain") throw new Error(broadcast.message);
+			return broadcast.result;
+		}
+	});
+	switch (outcome.kind) {
+		case "executed":
+		case "exact_replay":
+			if (outcome.value.success && outcome.value.accountId && outcome.value.transactionHash) return {
+				kind: "created",
+				accountId: outcome.value.accountId,
+				transactionHash: outcome.value.transactionHash
+			};
+			return {
+				kind: "rejected",
+				message: outcome.value.message || outcome.value.error || "Sponsored NEAR account creation was rejected"
+			};
+		case "in_progress":
+		case "uncertain": return {
+			kind: "retryable",
+			message: outcome.kind === "uncertain" ? outcome.message : "Sponsored NEAR account creation is already in progress for this registration",
+			retryAfterMs: 3e4
+		};
+		case "request_conflict": return {
+			kind: "rejected",
+			message: "Sponsored NEAR account creation idempotency key conflicts with another request"
+		};
+	}
+}
+async function readD1Ed25519KeyManifestBySlot(walletStore, input) {
+	const signer = await walletStore.getEd25519SignerBySlot(input);
+	return signer ? { custodyKeyManifestDigestB64u: signer.custodyKeyManifestDigestB64u } : null;
+}
+function createCloudflareD1RouterApiAuthAssembly(input) {
+	const options = normalizeD1RouterApiAuthOptions(input);
+	const prepare = scopePrepareForOptions.bind(void 0, options);
+	const lazyStores = createLazyStoreState(options);
+	const getRegistrationCeremonyIntentStore = getRegistrationCeremonyIntentStoreForState.bind(void 0, lazyStores);
+	const getWalletAuthMethodStore = getWalletAuthMethodStoreForState.bind(void 0, lazyStores);
+	const getWalletStore = getWalletStoreForState.bind(void 0, lazyStores);
+	const walletAuthMethodStore = getWalletAuthMethodStore();
+	const walletStore = getWalletStore();
+	const createSponsoredNamedNearAccount = createSponsoredNamedNearAccountForOptions.bind(void 0, options);
+	const identityStore = new D1IdentityStore({
+		database: options.database,
+		namespace: options.namespace,
+		orgId: options.orgId,
+		projectId: options.projectId,
+		envId: options.envId,
+		ensureSchema: false
+	});
+	const linkIdentity = linkD1Identity.bind(void 0, identityStore);
+	const linkedDeviceEd25519AuthorityReaderSlot = { current: null };
+	const getLinkedDeviceEd25519AuthorityReader = linkedDeviceEd25519AuthorityReaderFromSlot.bind(void 0, linkedDeviceEd25519AuthorityReaderSlot);
+	const authorizationStore = new CloudflareD1AuthorizationStore({
+		database: options.database,
+		namespace: options.namespace,
+		walletSignerScope: {
+			namespace: options.namespace,
+			orgId: options.orgId,
+			projectId: options.projectId,
+			envId: options.envId
+		},
+		getLinkedDeviceAuthorityReader: getLinkedDeviceEd25519AuthorityReader
+	});
+	const authorizationService = new AuthorizationService({
+		policy: capabilityPolicyPort,
+		sessions: authorizationStore,
+		evidence: authorizationStore,
+		grants: authorizationStore,
+		authorizedOperations: authorizationStore,
+		audit: authorizationStore
+	});
+	const googleEmailOtpRegistrationAttempts = new CloudflareD1GoogleEmailOtpRegistrationAttemptStore({
+		prepare,
+		orgId: options.orgId
+	});
+	const nearPublicKeys = new CloudflareD1NearPublicKeyStore({ prepare });
+	const webAuthnStore = new CloudflareD1WebAuthnStore({
+		database: options.database,
+		namespace: options.namespace,
+		orgId: options.orgId,
+		projectId: options.projectId,
+		envId: options.envId
+	});
+	const webAuthnAuthService = new CloudflareD1WebAuthnAuthService({
+		webAuthnStore,
+		walletAuthMethodStore,
+		walletManifestSource: { getEd25519KeyManifestBySlot: readD1Ed25519KeyManifestBySlot.bind(void 0, walletStore) }
+	});
+	const emailOtpChallenges = new CloudflareD1EmailOtpChallengeStore({
+		database: options.database,
+		namespace: options.namespace,
+		orgId: options.orgId,
+		projectId: options.projectId,
+		envId: options.envId
+	});
+	const emailOtpDelivery = new CloudflareD1EmailOtpDeliveryRuntime(options.emailOtp);
+	const emailOtpEnrollments = new CloudflareD1EmailOtpEnrollmentStore({ prepare });
+	const emailOtpGrants = new CloudflareD1EmailOtpGrantStore({ prepare });
+	const emailOtpRateLimits = new CloudflareD1EmailOtpRateLimitStore({
+		prepare,
+		rateLimits: options.emailOtp.rateLimits
+	});
+	const emailOtpServerSeal = new CloudflareD1EmailOtpServerSealRuntime(options.emailOtpServerSeal);
+	const googleEmailOtpSessions = new CloudflareD1GoogleEmailOtpSessionResolver({
+		emailOtpEnrollments,
+		emailOtpRateLimits,
+		identityStore,
+		linkIdentity,
+		production: options.emailOtp.production,
+		registrationAttempts: googleEmailOtpRegistrationAttempts
+	});
+	const identityService = new CloudflareD1IdentityService({
+		accountIdDerivationSecret: options.accountIdDerivationSecret,
+		identityStore,
+		relayerAccount: options.relayerAccount,
+		resolveGoogleEmailOtpSession: googleEmailOtpSessions.resolve.bind(googleEmailOtpSessions)
+	});
+	const oidcVerification = new CloudflareD1OidcVerificationService({
+		googleOidcClientId: options.googleOidcClientId,
+		githubOAuth: options.githubOAuth,
+		identityStore,
+		linkIdentity
+	});
+	const emailOtpRegistrationEnrollmentFinalizer = new CloudflareD1EmailOtpRegistrationEnrollmentFinalizer({
+		emailOtpEnrollments,
+		googleEmailOtpSessions
+	});
+	const emailOtpChallengeVerifier = new CloudflareD1EmailOtpChallengeVerifier({
+		emailOtpChallenges,
+		emailOtpEnrollments,
+		emailOtpRateLimits,
+		lockoutTtlMs: options.emailOtp.lockoutTtlMs
+	});
+	const passkeyCustodyEnvelopes = new CloudflareD1PasskeyCustodyEnvelopeStore({
+		database: options.database,
+		scope: {
+			namespace: options.namespace,
+			orgId: options.orgId,
+			projectId: options.projectId,
+			envId: options.envId
+		}
+	});
+	const authorizationTenantId = parseTenantId(options.orgId);
+	if (!authorizationTenantId.ok) throw new Error(`orgId cannot identify an authorization tenant: ${authorizationTenantId.error.message}`);
+	const walletAuthorityStore = new D1WalletAuthorityStore({
+		database: options.database,
+		scope: {
+			namespace: options.namespace,
+			orgId: options.orgId,
+			projectId: options.projectId,
+			envId: options.envId
+		}
+	});
+	const walletAuthMethods = new CloudflareD1WalletAuthMethodService({
+		emailOtpChallengeVerifier,
+		emailOtpEnrollmentChallengeIssuer: (challengeInput) => emailOtpChallengeService.createEmailOtpEnrollmentChallenge(challengeInput),
+		emailOtpSourceChallengeIssuer: (challengeInput) => emailOtpChallengeService.createEmailOtpChallenge(challengeInput),
+		emailOtpEnrollmentFinalizer: emailOtpRegistrationEnrollmentFinalizer,
+		getRegistrationCeremonyIntentStore,
+		getWalletAuthMethodStore,
+		googleEmailOtpRegistrationAttempts,
+		prepareOwnerWalletSessionRevocation: (sessionInput) => authorizationStore.prepareRetireWalletSessionAuthorizationsForAuthMethod({
+			tenantId: authorizationTenantId.value,
+			walletId: sessionInput.walletId,
+			walletAuthMethodId: sessionInput.walletAuthMethodId,
+			nowMs: sessionInput.requestedAtMs
+		}),
+		passkeyCustodyEnvelopes,
+		sha256Bytes: sha256BytesPortable,
+		webAuthnStore,
+		listWalletEd25519Signers: (walletId) => walletStore.listEd25519SignersForWallet({ walletId }),
+		walletAuthorityStore,
+		orgId: options.orgId,
+		verifyWebAuthnAuthenticationLite: async (verifyInput) => {
+			const credential = parseWebAuthnAuthenticationCredential(verifyInput.webauthn_authentication);
+			if (!credential) return {
+				success: false,
+				verified: false,
+				code: "invalid_body",
+				message: "Invalid WebAuthn authentication credential"
+			};
+			return await webAuthnAuthService.verifyWebAuthnAuthenticationLite({
+				...verifyInput,
+				webauthn_authentication: credential
+			});
+		}
+	});
+	const walletRegistrationCommitStore = new CloudflareD1WalletRegistrationCommitStore({
+		database: options.database,
+		namespace: options.namespace,
+		orgId: options.orgId,
+		projectId: options.projectId,
+		envId: options.envId
+	});
+	const walletCustodyCommitStore = new CloudflareD1WalletCustodyCommitStore({
+		database: options.database,
+		scope: {
+			namespace: options.namespace,
+			orgId: options.orgId,
+			projectId: options.projectId,
+			envId: options.envId
+		}
+	});
+	const signedDelegateExecutor = new CloudflareD1SignedDelegateExecutor(options);
+	const walletRegistrations = new CloudflareD1WalletRegistrationService({
+		authorizationService,
+		authorizationTenantId: authorizationTenantId.value,
+		createSponsoredNamedNearAccount,
+		emailOtpRegistrationEnrollmentFinalizer,
+		getRegistrationCeremonyIntentStore,
+		getEd25519YaoProductRegistration: () => resolveEd25519YaoProductRegistration(options),
+		ecdsaStrictRegistration: options.ecdsaStrictRegistration,
+		tenantRootCustodyLineage: options.tenantRootCustodyLineage,
+		getWalletStore,
+		activateSideEffects: walletRegistrationActivateSideEffectStore(options),
+		nearProvisioningSideEffects: walletRegistrationNearProvisioningSideEffectStore(options),
+		walletRegistrationCommitStore,
+		walletCustodyCommitStore,
+		walletAuthMethods,
+		getLinkedDeviceEd25519AuthorityReader
+	});
+	const walletAddSigners = new CloudflareD1WalletAddSignerService({
+		getRegistrationCeremonyIntentStore,
+		getEd25519YaoProductRegistration: () => resolveEd25519YaoProductRegistration(options),
+		ecdsaStrictRegistration: options.ecdsaStrictRegistration,
+		tenantRootCustodyLineage: options.tenantRootCustodyLineage,
+		getWalletStore,
+		walletAuthMethods,
+		passkeyCustodyEnvelopes,
+		startSideEffects: walletAddSignerStartSideEffectStore(options),
+		finalizeSideEffects: walletAddSignerFinalizeSideEffectStore(options)
+	});
+	const registrationIntents = new CloudflareD1RegistrationIntentService({ getRegistrationCeremonyIntentStore });
+	const emailOtpChallengeIssuer = new CloudflareD1EmailOtpChallengeIssuer({
+		config: {
+			challengeTtlMs: options.emailOtp.challengeTtlMs,
+			codeLength: options.emailOtp.codeLength,
+			maxActiveChallengesPerContext: options.emailOtp.maxActiveChallengesPerContext,
+			maxAttempts: options.emailOtp.maxAttempts
+		},
+		emailOtpChallenges,
+		emailOtpDelivery,
+		emailOtpEnrollments,
+		emailOtpRateLimits
+	});
+	const emailOtpChallengeService = new CloudflareD1EmailOtpChallengeService({
+		challenges: emailOtpChallenges,
+		devOutboxEnabled: options.emailOtp.devOutboxEnabled,
+		finalizer: emailOtpRegistrationEnrollmentFinalizer,
+		grantTtlMs: options.emailOtp.grantTtlMs,
+		grants: emailOtpGrants,
+		issuer: emailOtpChallengeIssuer,
+		registrationAttempts: googleEmailOtpRegistrationAttempts,
+		verifier: emailOtpChallengeVerifier
+	});
+	const emailOtpRecoveryService = new CloudflareD1EmailOtpRecoveryService({
+		challengeVerifier: emailOtpChallengeVerifier,
+		emailOtpChallenges,
+		emailOtpEnrollments,
+		emailOtpGrants,
+		emailOtpRateLimits,
+		grantTtlMs: options.emailOtp.grantTtlMs
+	});
+	const walletRecoveryGoogleEmailOtp = new CloudflareD1WalletRecoveryGoogleEmailOtpService({
+		attempts: new CloudflareD1WalletRecoveryGoogleEmailOtpAttemptStore({
+			database: options.database,
+			scope: {
+				namespace: options.namespace,
+				orgId: options.orgId,
+				projectId: options.projectId,
+				envId: options.envId
+			}
+		}),
+		google: { verifyGoogleLoginForRecovery: oidcVerification.verifyGoogleLoginForRecovery.bind(oidcVerification) },
+		issuer: emailOtpChallengeIssuer,
+		verifier: emailOtpChallengeVerifier,
+		enrollments: emailOtpEnrollments,
+		serverSeal: emailOtpServerSeal,
+		orgId: options.orgId
+	});
+	const linkedDeviceComposition = createD1LinkedDeviceComposition({
+		emailOtpLinkedDevice: {
+			issuer: emailOtpChallengeIssuer,
+			verifier: emailOtpChallengeVerifier,
+			enrollments: emailOtpEnrollments,
+			walletAuthMethodStore,
+			serverSeal: emailOtpServerSeal,
+			enrollmentFinalizer: emailOtpRegistrationEnrollmentFinalizer
+		},
+		options,
+		authorizationService,
+		authorizationStore,
+		walletRegistration: createD1WalletRegistrationRouteService({
+			emailOtpRecoveryService,
+			registrationIntents,
+			walletAuthMethodStore,
+			walletRegistrations,
+			walletStore
+		}),
+		walletAuthMethodStore,
+		walletStore,
+		webAuthnStore,
+		webAuthnAuthService,
+		authorizationSessions: createD1AuthorizationSessionRouteService({
+			authorizationService,
+			options,
+			walletAuthMethodStore,
+			walletAuthorityStore
+		})
+	});
+	linkedDeviceEd25519AuthorityReaderSlot.current = linkedDeviceComposition.linkedDeviceEd25519AuthorityReader ?? null;
+	return {
+		options,
+		emailOtpServerSeal,
+		emailOtpChallengeService,
+		emailOtpRecoveryService,
+		emailOtpRegistrationEnrollmentFinalizer,
+		walletRecoveryGoogleEmailOtp,
+		identityService,
+		oidcVerification,
+		authorizationService,
+		googleEmailOtpSessions,
+		nearPublicKeys,
+		webAuthnAuthService,
+		walletAuthMethods,
+		walletRegistrations,
+		walletAuthMethodStore,
+		walletAuthorityStore,
+		walletStore,
+		walletAddSigners,
+		registrationIntents,
+		signedDelegateExecutor,
+		passkeyCustodyEnvelopes,
+		walletCustodyCommitStore,
+		webAuthnStore,
+		...linkedDeviceComposition
+	};
+}
+var D1WalletExecutionLaneProjectionSource = class {
+	constructor(walletAuthMethodStore, walletStore) {
+		this.walletAuthMethodStore = walletAuthMethodStore;
+		this.walletStore = walletStore;
+	}
+	async listWalletAuthMethods(input) {
+		return await this.walletAuthMethodStore.listForWalletV2({ walletId: input.walletId });
+	}
+	async listWalletSigners(input) {
+		const [ed25519, ecdsa] = await Promise.all([this.walletStore.listEd25519SignersForWallet({ walletId: input.walletId }), this.walletStore.listEcdsaSignersForWallet({ walletId: input.walletId })]);
+		return [...ed25519, ...ecdsa];
+	}
+};
+async function resolveD1ActiveOwnerWalletExecutionLane(source, input) {
+	let walletAuthMethodId;
+	switch (input.authorization.kind) {
+		case "wallet_auth_method":
+			walletAuthMethodId = input.authorization.walletAuthMethodId;
+			break;
+		case "authority_ref": {
+			const authMethods = await source.listWalletAuthMethods({ walletId: input.walletId });
+			walletAuthMethodId = await resolveWalletAuthMethodIdForAuthority({
+				walletId: input.walletId,
+				authorityRef: input.authorization.authorityRef,
+				authSource: input.authorization.authSource,
+				authMethods
+			});
+			if (!walletAuthMethodId) return {
+				kind: "refused",
+				reason: "auth_method_missing"
+			};
+			break;
+		}
+	}
+	return await resolveActiveOwnerWalletExecutionLane({
+		source,
+		walletId: input.walletId,
+		walletAuthMethodId,
+		expectedMaterialActivation: input.expectedMaterialActivation
+	});
+}
+function createD1WalletRegistrationRouteService(assembly) {
+	const laneProjectionSource = new D1WalletExecutionLaneProjectionSource(assembly.walletAuthMethodStore, assembly.walletStore);
+	return {
+		resolveActiveOwnerWalletExecutionLane: resolveD1ActiveOwnerWalletExecutionLane.bind(void 0, laneProjectionSource),
+		listWalletEcdsaCustodyContinuity: assembly.walletRegistrations.listWalletEcdsaCustodyContinuity.bind(assembly.walletRegistrations),
+		resolveEd25519MaterialActivation: assembly.walletRegistrations.resolveEd25519MaterialActivation.bind(assembly.walletRegistrations),
+		resolveActiveEd25519TenantRoot: assembly.walletRegistrations.resolveActiveEd25519TenantRoot.bind(assembly.walletRegistrations),
+		resolveEcdsaMaterialActivation: assembly.walletRegistrations.resolveEcdsaMaterialActivation.bind(assembly.walletRegistrations),
+		resolveActiveEcdsaTenantRoot: assembly.walletRegistrations.resolveActiveEcdsaTenantRoot.bind(assembly.walletRegistrations),
+		listWalletEcdsaKeyFactsInventory: assembly.walletRegistrations.listWalletEcdsaKeyFactsInventory.bind(assembly.walletRegistrations),
+		readActiveEmailOtpEnrollment: assembly.emailOtpRecoveryService.readActiveEmailOtpEnrollment.bind(assembly.emailOtpRecoveryService),
+		setupWalletRegistration: assembly.walletRegistrations.setupWalletRegistration.bind(assembly.walletRegistrations),
+		respondWalletRegistration: assembly.walletRegistrations.respondWalletRegistration.bind(assembly.walletRegistrations),
+		activateWalletRegistration: assembly.walletRegistrations.activateWalletRegistration.bind(assembly.walletRegistrations),
+		completeWalletRegistrationNearProvisioning: assembly.walletRegistrations.completeWalletRegistrationNearProvisioning.bind(assembly.walletRegistrations),
+		refreshEd25519YaoWalletSession: assembly.walletRegistrations.refreshEd25519YaoWalletSession.bind(assembly.walletRegistrations),
+		provisionEd25519YaoWalletSession: assembly.walletRegistrations.provisionEd25519YaoWalletSession.bind(assembly.walletRegistrations),
+		recordEcdsaPostRegistrationProof: assembly.walletRegistrations.recordEcdsaPostRegistrationProof.bind(assembly.walletRegistrations),
+		activateEcdsaPostRegistrationSession: assembly.walletRegistrations.activateEcdsaPostRegistrationSession.bind(assembly.walletRegistrations)
+	};
+}
+function createD1WalletAuthMethodRouteService(assembly) {
+	return {
+		resolveActiveWalletSessionAuthority: assembly.walletAuthMethods.resolveActiveWalletSessionAuthority.bind(assembly.walletAuthMethods),
+		verifyWalletAuthMethodRevokeProof: assembly.walletAuthMethods.verifyWalletAuthMethodRevokeProof.bind(assembly.walletAuthMethods),
+		verifyActivePasskeyAuthority: assembly.walletAuthMethods.verifyActivePasskeyAuthority.bind(assembly.walletAuthMethods),
+		resolveActivePasskeyAuthorityForVerifiedCredential: assembly.walletAuthMethods.resolveActivePasskeyAuthorityForVerifiedCredential.bind(assembly.walletAuthMethods),
+		verifyActiveEmailOtpAuthority: assembly.walletAuthMethods.verifyActiveEmailOtpAuthority.bind(assembly.walletAuthMethods),
+		resolveActiveEmailOtpAuthorityForVerifiedSubject: assembly.walletAuthMethods.resolveActiveEmailOtpAuthorityForVerifiedSubject.bind(assembly.walletAuthMethods),
+		resolveActiveEmailOtpAuthorityForVerifiedMethod: assembly.walletAuthMethods.resolveActiveEmailOtpAuthorityForVerifiedMethod.bind(assembly.walletAuthMethods),
+		createAddAuthMethodIntent: assembly.registrationIntents.createAddAuthMethodIntent.bind(assembly.registrationIntents),
+		createAddSignerIntent: assembly.registrationIntents.createAddSignerIntent.bind(assembly.registrationIntents),
+		finalizeWalletAddAuthMethod: assembly.walletAuthMethods.finalizeWalletAddAuthMethod.bind(assembly.walletAuthMethods),
+		finalizeWalletAddSigner: assembly.walletAddSigners.finalizeWalletAddSigner.bind(assembly.walletAddSigners),
+		respondWalletAddSignerEcdsaDerivation: assembly.walletAddSigners.respondWalletAddSignerEcdsaDerivation.bind(assembly.walletAddSigners),
+		activateWalletAddSignerEcdsa: assembly.walletAddSigners.activateWalletAddSignerEcdsa.bind(assembly.walletAddSigners),
+		getWalletAddSignerRuntimePolicyScope: assembly.walletAddSigners.getWalletAddSignerRuntimePolicyScope.bind(assembly.walletAddSigners),
+		revokeWalletAuthMethod: assembly.walletAuthMethods.revokeWalletAuthMethod.bind(assembly.walletAuthMethods),
+		createAddAuthMethodEmailOtpChallenge: assembly.walletAuthMethods.createAddAuthMethodEmailOtpChallenge.bind(assembly.walletAuthMethods),
+		verifyAddAuthMethodEmailOtpSourceProof: assembly.walletAuthMethods.verifyAddAuthMethodEmailOtpSourceProof.bind(assembly.walletAuthMethods),
+		startWalletAddAuthMethod: assembly.walletAuthMethods.startWalletAddAuthMethod.bind(assembly.walletAuthMethods),
+		startWalletAddSigner: assembly.walletAddSigners.startWalletAddSigner.bind(assembly.walletAddSigners)
+	};
+}
+const LINKED_DEVICE_WALLET_SESSION_TTL_MS = 900 * 1e3;
+const LINKED_DEVICE_WALLET_SESSION_REMAINING_USES = 100;
+async function resolveEmailOtpAuthorityForUnlock(input) {
+	try {
+		const enrollment = await input.emailOtpRecoveryService.readEmailOtpEnrollment({
+			walletId: input.request.walletId,
+			orgId: input.request.orgId
+		});
+		if (!enrollment.ok) return {
+			kind: "rejected",
+			code: parseWalletUnlockIssuanceRejectionCode(enrollment.code),
+			message: enrollment.message
+		};
+		if (enrollment.enrollment.providerUserId !== input.request.providerUserId) return {
+			kind: "rejected",
+			code: "provider_identity_mismatch",
+			message: "Email OTP enrollment does not match the verified provider identity"
+		};
+		const emailHashHex = await sha256HexUtf8(enrollment.enrollment.verifiedEmail);
+		return await input.walletAuthMethods.resolveActiveEmailOtpAuthorityForUnlock({
+			walletId: input.request.walletId,
+			walletAuthMethodId: input.request.walletAuthMethodId,
+			providerUserId: input.request.providerUserId,
+			emailHashHex
+		});
+	} catch (error) {
+		return {
+			kind: "rejected",
+			code: "internal",
+			message: error instanceof Error ? error.message : "Email OTP authority resolution failed"
+		};
+	}
+}
+async function issueWalletSessionForActiveAuthority(input) {
+	const tenantId = parseTenantId(input.orgId);
+	const principalId = parsePrincipalId("walletAuthAuthority" in input.resolved ? input.resolved.walletAuthAuthority.factor.providerUserId : String(input.resolved.authority.walletId));
+	const mintId = parseWalletSessionMintId(input.verifiedChallengeId);
+	if (!tenantId.ok || !principalId.ok || !mintId.ok) return {
+		kind: "rejected",
+		code: "invalid_state",
+		message: "Wallet Session identity is invalid"
+	};
+	const issuedAtMs = Date.now();
+	const deviceLinked = input.resolved.authority.provenance.kind === "device_link";
+	try {
+		const directIssue = await input.authorizationService.issueDirectWalletSessionAuthorizationV2({
+			tenantId: tenantId.value,
+			principalId: principalId.value,
+			walletId: input.resolved.authority.walletId,
+			authority: input.resolved.authority,
+			walletAuthMethodId: input.resolved.authMethod.walletAuthMethodId,
+			mintId: mintId.value,
+			remainingUses: deviceLinked ? LINKED_DEVICE_WALLET_SESSION_REMAINING_USES : 3,
+			issuedAtMs,
+			expiresAtMs: issuedAtMs + (deviceLinked ? LINKED_DEVICE_WALLET_SESSION_TTL_MS : DEFAULT_WALLET_SESSION_TTL_MS)
+		});
+		const authorityProvenanceKind = input.resolved.authority.provenance.kind;
+		if (directIssue.kind === "already_committed") return {
+			kind: "already_committed",
+			authorityProvenanceKind,
+			committed: directIssue
+		};
+		return {
+			kind: "active_authority",
+			authorityProvenanceKind,
+			walletSession: issuedWalletSessionAuthorizationV2(directIssue),
+			operationCredential: directIssue.operationCredential
+		};
+	} catch (error) {
+		return {
+			kind: "rejected",
+			code: "internal",
+			message: error instanceof Error ? error.message : "Wallet Session issuance failed"
+		};
+	}
+}
+function issuedWalletSessionAuthorizationV2(directIssue) {
+	return {
+		session: directIssue.session,
+		quota: directIssue.quota
+	};
+}
+async function issueWalletSessionForPasskeyUnlock(input) {
+	const resolved = await input.walletAuthMethods.resolveActivePasskeyAuthorityForUnlock(input.request);
+	if (resolved.kind !== "active_authority") return {
+		kind: "rejected",
+		code: resolved.code,
+		message: resolved.message
+	};
+	if (resolved.authority.provenance.kind === "wallet_registration") return { kind: "wallet_registration" };
+	return await issueWalletSessionForActiveAuthority({
+		resolved,
+		authorizationService: input.authorizationService,
+		orgId: input.orgId,
+		verifiedChallengeId: input.request.verifiedChallengeId
+	});
+}
+async function issueWalletSessionForEmailOtpUnlock(input) {
+	const resolved = await resolveEmailOtpAuthorityForUnlock({
+		walletAuthMethods: input.walletAuthMethods,
+		emailOtpRecoveryService: input.emailOtpRecoveryService,
+		request: input.request
+	});
+	if (resolved.kind === "rejected") return {
+		kind: "rejected",
+		code: resolved.code,
+		message: resolved.message
+	};
+	if (resolved.authority.provenance.kind === "wallet_registration") switch (input.request.requestedCapabilities.kind) {
+		case "wallet_session": break;
+		case "ed25519_yao": return { kind: "wallet_registration" };
+	}
+	return await issueWalletSessionForActiveAuthority({
+		resolved,
+		authorizationService: input.authorizationService,
+		orgId: input.request.orgId,
+		verifiedChallengeId: input.request.verifiedChallengeId
+	});
+}
+function createD1WalletUnlockRouteService(assembly) {
+	return {
+		createEmailOtpUnlockChallenge: assembly.emailOtpRecoveryService.createEmailOtpUnlockChallenge.bind(assembly.emailOtpRecoveryService),
+		createWebAuthnLoginOptions: assembly.webAuthnAuthService.createWebAuthnLoginOptions.bind(assembly.webAuthnAuthService),
+		markEmailOtpStrongAuthSatisfied: assembly.emailOtpRecoveryService.markEmailOtpStrongAuthSatisfied.bind(assembly.emailOtpRecoveryService),
+		verifyEmailOtpUnlockProof: assembly.emailOtpRecoveryService.verifyEmailOtpUnlockProof.bind(assembly.emailOtpRecoveryService),
+		verifyWebAuthnLogin: assembly.webAuthnAuthService.verifyWebAuthnLogin.bind(assembly.webAuthnAuthService),
+		resolveActivePasskeyAuthorityForUnlock: assembly.walletAuthMethods.resolveActivePasskeyAuthorityForUnlock.bind(assembly.walletAuthMethods),
+		resolveEmailOtpAuthorityForUnlock: (request) => resolveEmailOtpAuthorityForUnlock({
+			walletAuthMethods: assembly.walletAuthMethods,
+			emailOtpRecoveryService: assembly.emailOtpRecoveryService,
+			request
+		}),
+		issueWalletSessionForPasskeyUnlock: (request) => issueWalletSessionForPasskeyUnlock({
+			walletAuthMethods: assembly.walletAuthMethods,
+			authorizationService: assembly.authorizationService,
+			orgId: assembly.options.orgId,
+			request
+		}),
+		issueWalletSessionForEmailOtpUnlock: (request) => issueWalletSessionForEmailOtpUnlock({
+			walletAuthMethods: assembly.walletAuthMethods,
+			emailOtpRecoveryService: assembly.emailOtpRecoveryService,
+			authorizationService: assembly.authorizationService,
+			request
+		})
+	};
+}
+function createD1EmailOtpRouteService(assembly) {
+	return {
+		applyEmailOtpServerSeal: assembly.emailOtpServerSeal.applyEmailOtpServerSeal.bind(assembly.emailOtpServerSeal),
+		cleanupGoogleEmailOtpDevRegistrationState: assembly.googleEmailOtpSessions.cleanupDevRegistrationState.bind(assembly.googleEmailOtpSessions),
+		consumeEmailOtpGrant: assembly.emailOtpRecoveryService.consumeEmailOtpGrant.bind(assembly.emailOtpRecoveryService),
+		createEmailOtpChallenge: assembly.emailOtpChallengeService.createEmailOtpChallenge.bind(assembly.emailOtpChallengeService),
+		createEmailOtpEnrollmentChallenge: assembly.emailOtpChallengeService.createEmailOtpEnrollmentChallenge.bind(assembly.emailOtpChallengeService),
+		isEmailOtpStrongAuthRequired: assembly.emailOtpRecoveryService.isEmailOtpStrongAuthRequired.bind(assembly.emailOtpRecoveryService),
+		markEmailOtpStrongAuthSatisfied: assembly.emailOtpRecoveryService.markEmailOtpStrongAuthSatisfied.bind(assembly.emailOtpRecoveryService),
+		readActiveEmailOtpEnrollment: assembly.emailOtpRecoveryService.readActiveEmailOtpEnrollment.bind(assembly.emailOtpRecoveryService),
+		readEmailOtpEnrollment: assembly.emailOtpRecoveryService.readEmailOtpEnrollment.bind(assembly.emailOtpRecoveryService),
+		readEmailOtpOutboxEntry: assembly.emailOtpChallengeService.readEmailOtpOutboxEntry.bind(assembly.emailOtpChallengeService),
+		removeEmailOtpServerSeal: assembly.emailOtpServerSeal.removeEmailOtpServerSeal.bind(assembly.emailOtpServerSeal),
+		validateGoogleEmailOtpRegistrationCandidateWallet: assembly.googleEmailOtpSessions.validateRegistrationCandidateWallet.bind(assembly.googleEmailOtpSessions),
+		verifyEmailOtpChallenge: assembly.emailOtpChallengeService.verifyEmailOtpChallenge.bind(assembly.emailOtpChallengeService),
+		verifyEmailOtpWalletRecoveryChallenge: assembly.emailOtpChallengeService.verifyEmailOtpWalletRecoveryChallenge.bind(assembly.emailOtpChallengeService),
+		verifyEmailOtpEnrollment: assembly.emailOtpChallengeService.verifyEmailOtpEnrollment.bind(assembly.emailOtpChallengeService),
+		verifyGoogleLogin: assembly.oidcVerification.verifyGoogleLogin.bind(assembly.oidcVerification)
+	};
+}
+function createD1WebAuthnRouteService(assembly) {
+	return {
+		createWebAuthnLoginOptions: assembly.webAuthnAuthService.createWebAuthnLoginOptions.bind(assembly.webAuthnAuthService),
+		createWebAuthnSyncAccountOptions: assembly.webAuthnAuthService.createWebAuthnSyncAccountOptions.bind(assembly.webAuthnAuthService),
+		listWebAuthnAuthenticatorsForUser: assembly.webAuthnAuthService.listWebAuthnAuthenticatorsForUser.bind(assembly.webAuthnAuthService),
+		verifyWebAuthnAuthenticationLite: assembly.webAuthnAuthService.verifyWebAuthnAuthenticationLite.bind(assembly.webAuthnAuthService),
+		verifyWebAuthnLogin: assembly.webAuthnAuthService.verifyWebAuthnLogin.bind(assembly.webAuthnAuthService),
+		verifyWebAuthnSyncAccount: assembly.webAuthnAuthService.verifyWebAuthnSyncAccount.bind(assembly.webAuthnAuthService)
+	};
+}
+function createD1IdentityRouteService(assembly) {
+	return {
+		consumeGoogleEmailOtpRegistrationAttemptRateLimit: assembly.googleEmailOtpSessions.consumeRegistrationAttemptRateLimit.bind(assembly.googleEmailOtpSessions),
+		getGoogleOidcPublicConfig: assembly.oidcVerification.getGoogleOidcPublicConfig.bind(assembly.oidcVerification),
+		getGithubOAuthPublicConfig: assembly.oidcVerification.getGithubOAuthPublicConfig.bind(assembly.oidcVerification),
+		linkIdentity: assembly.identityService.linkIdentity.bind(assembly.identityService),
+		listIdentities: assembly.identityService.listIdentities.bind(assembly.identityService),
+		resolveGoogleEmailOtpSession: assembly.googleEmailOtpSessions.resolve.bind(assembly.googleEmailOtpSessions),
+		resolveOidcWalletId: assembly.identityService.resolveOidcWalletId.bind(assembly.identityService),
+		unlinkIdentity: assembly.identityService.unlinkIdentity.bind(assembly.identityService),
+		verifyGoogleLogin: assembly.oidcVerification.verifyGoogleLogin.bind(assembly.oidcVerification),
+		verifyGithubOAuthCode: assembly.oidcVerification.verifyGithubOAuthCode.bind(assembly.oidcVerification)
+	};
+}
+function isExhaustedWalletSessionStatus(status) {
+	return status.kind === "exhausted";
+}
+function createD1AuthorizationSessionRouteService(assembly) {
+	const tenantId = parseTenantId(assembly.options.orgId);
+	if (!tenantId.ok) throw new Error(`orgId cannot identify an authorization tenant: ${tenantId.error.message}`);
+	return {
+		tenantId: tenantId.value,
+		issueDirectWalletSessionAuthorizationV2: assembly.authorizationService.issueDirectWalletSessionAuthorizationV2.bind(assembly.authorizationService),
+		readWalletSessionAuthorizationV2ByOperationCredential: async (input) => {
+			const authorization = await assembly.authorizationService.readWalletSessionAuthorizationV2ByOperationCredential(input);
+			if (!authorization) return null;
+			const authority = await assembly.walletAuthorityStore.readById(authorization.session.authorityId);
+			const authMethod = await assembly.walletAuthMethodStore.readByIdV2({ walletAuthMethodId: authorization.session.walletAuthMethodId });
+			if (!authority || authority.state !== "active" || !authMethod || authMethod.status !== "active") return null;
+			return {
+				authorization,
+				authority,
+				authMethod,
+				retiredAtMs: null
+			};
+		},
+		readExhaustedWalletSessionAuthorizationV2CandidateByOperationCredential: async (input) => {
+			const status = await assembly.authorizationService.readExactWalletSessionStatusByOperationCredential(input);
+			if (!isExhaustedWalletSessionStatus(status)) return null;
+			const authority = await assembly.walletAuthorityStore.readById(status.session.authorityId);
+			const authMethod = await assembly.walletAuthMethodStore.readByIdV2({ walletAuthMethodId: status.session.walletAuthMethodId });
+			if (!authority || authority.state !== "active" || !authMethod || authMethod.status !== "active" || authority.walletId !== status.session.walletId || authority.authorityDigestB64u !== status.session.authorityDigestB64u || authority.revocationEpoch !== status.session.authorityRevocationEpoch || authMethod.walletId !== status.session.walletId || authMethod.walletAuthorityId !== status.session.authorityId || authMethod.walletAuthMethodId !== status.session.walletAuthMethodId) return null;
+			return {
+				status,
+				authority,
+				authMethod,
+				retiredAtMs: null
+			};
+		},
+		readExactWalletSessionStatusByOperationCredential: assembly.authorizationService.readExactWalletSessionStatusByOperationCredential.bind(assembly.authorizationService),
+		mintHostedWalletSeamsSessionExchange: assembly.authorizationService.mintHostedWalletSeamsSessionExchange.bind(assembly.authorizationService),
+		redeemHostedWalletSeamsSessionExchange: assembly.authorizationService.redeemHostedWalletSeamsSessionExchange.bind(assembly.authorizationService),
+		readHostedWalletSessionOperationCredentialV2: async (input) => {
+			const resolved = await assembly.authorizationService.readHostedWalletSessionOperationCredentialV2(input);
+			if (!resolved) return null;
+			const authority = await assembly.walletAuthorityStore.readById(resolved.authorization.session.authorityId);
+			const authMethod = await assembly.walletAuthMethodStore.readByIdV2({ walletAuthMethodId: resolved.authorization.session.walletAuthMethodId });
+			if (!authority || authority.state !== "active" || !authMethod || authMethod.status !== "active") return null;
+			return {
+				authorization: resolved.authorization,
+				authority,
+				authMethod,
+				retiredAtMs: null,
+				hostedCredentialId: resolved.hostedCredentialId,
+				appOrigin: resolved.appOrigin,
+				walletOrigin: resolved.walletOrigin,
+				expiresAtMs: resolved.expiresAtMs
+			};
+		}
+	};
+}
+function createD1AuthorizedOperationRouteService(assembly) {
+	const tenantId = parseTenantId(assembly.options.orgId);
+	if (!tenantId.ok) throw new Error(`orgId cannot identify an authorization tenant: ${tenantId.error.message}`);
+	return {
+		tenantId: tenantId.value,
+		buildVerifiedOwnerProof: assembly.authorizationService.buildVerifiedOwnerProof.bind(assembly.authorizationService),
+		recordVerifiedWalletOperationFactorEvidenceSet: assembly.authorizationService.recordVerifiedWalletOperationFactorEvidenceSet.bind(assembly.authorizationService),
+		readAuthorizedOperationById: assembly.authorizationService.readAuthorizedOperationById.bind(assembly.authorizationService),
+		readAuthorizedOperation: assembly.authorizationService.readAuthorizedOperation.bind(assembly.authorizationService),
+		admitAuthorizedOperation: assembly.authorizationService.admitAuthorizedOperation.bind(assembly.authorizationService),
+		completeAuthorizedOperation: assembly.authorizationService.completeAuthorizedOperation.bind(assembly.authorizationService)
+	};
+}
+function createD1ThresholdRuntimeRouteService(assembly) {
+	return { getRouterAbEcdsaPresignRuntime: () => assembly.options.routerAbEcdsaPresignRuntime || null };
+}
+function createD1NearFundingRouteService(assembly) {
+	return {
+		fundImplicitNearAccount: fundImplicitNearAccountForOptions.bind(void 0, assembly.options),
+		listNearPublicKeysForUser: assembly.nearPublicKeys.listForRelayUser.bind(assembly.nearPublicKeys)
+	};
+}
+function createD1RouterAccountRouteService(assembly) {
+	const accountId = assembly.options.relayerAccount || DEFAULT_D1_THRESHOLD_RELAYER_ACCOUNT;
+	const publicKey = assembly.options.relayerPublicKey || DEFAULT_D1_THRESHOLD_RELAYER_PUBLIC_KEY;
+	return {
+		getConfiguredRelayerAccount: () => accountId,
+		getRelayerAccount: async () => ({
+			accountId,
+			publicKey
+		})
+	};
+}
+function createCloudflareD1RouterApiAuthService(input) {
+	const assembly = createCloudflareD1RouterApiAuthAssembly(input);
+	return {
+		walletRegistration: createD1WalletRegistrationRouteService(assembly),
+		walletAuthMethods: createD1WalletAuthMethodRouteService(assembly),
+		walletUnlock: createD1WalletUnlockRouteService(assembly),
+		emailOtp: createD1EmailOtpRouteService(assembly),
+		webAuthn: createD1WebAuthnRouteService(assembly),
+		identity: createD1IdentityRouteService(assembly),
+		authorizationSessions: createD1AuthorizationSessionRouteService(assembly),
+		authorizedOperations: createD1AuthorizedOperationRouteService(assembly),
+		thresholdRuntime: createD1ThresholdRuntimeRouteService(assembly),
+		nearFunding: createD1NearFundingRouteService(assembly),
+		router: createD1RouterAccountRouteService(assembly),
+		passkeyCustody: createD1PasskeyCustodyRouteService({
+			orgId: assembly.options.orgId,
+			passkeyCustodyEnvelopes: assembly.passkeyCustodyEnvelopes,
+			walletCustodyCommits: assembly.walletCustodyCommitStore,
+			walletStore: assembly.walletStore,
+			walletAuthorityStore: assembly.walletAuthorityStore,
+			webAuthnStore: assembly.webAuthnStore,
+			googleRecovery: assembly.walletRecoveryGoogleEmailOtp,
+			emailOtpRegistrationEnrollmentFinalizer: assembly.emailOtpRegistrationEnrollmentFinalizer,
+			logger: normalizeLogger()
+		}),
+		executeSignedDelegate: assembly.signedDelegateExecutor.execute.bind(assembly.signedDelegateExecutor),
+		...assembly.deviceLinking === void 0 ? {} : { deviceLinking: assembly.deviceLinking },
+		...assembly.deviceManagement === void 0 ? {} : { deviceManagement: assembly.deviceManagement },
+		...assembly.deviceLinkingOwnerAuthorization === void 0 ? {} : { deviceLinkingOwnerAuthorization: assembly.deviceLinkingOwnerAuthorization },
+		...assembly.linkedDeviceEd25519AuthorityReader === void 0 ? {} : { linkedDeviceEd25519AuthorityReader: assembly.linkedDeviceEd25519AuthorityReader }
+	};
+}
+//#endregion
+export { createCloudflareD1RouterApiAuthService };
+
+//# sourceMappingURL=d1RouterApiAuthService.js.map