@seams/wallet-server 0.5.0

package/cloudflare-router-ab/scripts/start-local-wallet-system.mjs

@@ -0,0 +1,427 @@
+#!/usr/bin/env node
+
+import { spawn, spawnSync } from 'node:child_process';
+import { randomBytes } from 'node:crypto';
+import { existsSync, mkdirSync } from 'node:fs';
+import http from 'node:http';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import { prepareLocalHostedWalletGatewayConfig } from './prepare-local-runtime-config.mjs';
+
+const repoRoot = process.cwd();
+const gatewayUrl = 'http://127.0.0.1:4100';
+const options = parseArguments(process.argv.slice(2));
+const localRoot = path.resolve(
+  options.root || path.join(tmpdir(), `${path.basename(repoRoot)}-wallet-system`),
+);
+const gatewayStateRoot = path.join(localRoot, '.local', 'cloudflare-state', 'wallet-gateway');
+const ceremonyPrivateJwkPath = path.join(
+  localRoot,
+  '.runtime',
+  'wallet-gateway',
+  'ceremony-private.jwk.json',
+);
+const identity = Object.freeze({
+  orgId: options.orgId,
+  projectId: options.projectId,
+  environmentId: options.environmentId,
+  environmentKey: 'dev',
+  signingRootId: options.signingRootId,
+  signingRootVersion: 'default',
+});
+const children = [];
+let stopping = false;
+
+await main().catch(handleFatalError);
+
+async function main() {
+  if (options.help) {
+    printUsage();
+    return;
+  }
+  installSignalHandlers();
+  mkdirSync(localRoot, { recursive: true });
+  startRoleWorkers();
+  await waitForHttp('http://127.0.0.1:4102/.well-known/router-ab/keyset', 120_000, true);
+  await waitForFile(ceremonyPrivateJwkPath, 10_000);
+  const tenantRoot = bootstrapTenantRoot();
+  const deployment = localDeployment(tenantRoot);
+  const runtime = prepareLocalHostedWalletGatewayConfig({
+    repoRoot,
+    localEnvRoot: localRoot,
+    gatewayUrl,
+    ceremonyPrivateJwkPath,
+    appOrigins: [options.appOrigin, options.walletOrigin],
+    googleOidcClientId: process.env.GOOGLE_OIDC_CLIENT_ID,
+    deployment,
+  });
+  applySignerMigrations(runtime);
+  startGateway(runtime);
+  await waitForHttp(`${runtime.gatewayUrl}/readyz`, 120_000, true);
+  console.log(
+    JSON.stringify({
+      kind: 'wallet_local_system_ready_v1',
+      gatewayUrl: runtime.gatewayUrl,
+      appOrigin: options.appOrigin,
+      walletOrigin: options.walletOrigin,
+      projectEnvironmentId: identity.environmentId,
+      publishableKey: deployment.credential.publishableKey,
+      signingWorkerId: 'local-signing-worker',
+      root: localRoot,
+    }),
+  );
+  await waitUntilStopped();
+}
+
+function parseArguments(args) {
+  const parsed = {
+    help: false,
+    root: '',
+    appOrigin: 'http://localhost:4001',
+    walletOrigin: 'http://localhost:4002',
+    orgId: 'org_local_wallet',
+    projectId: 'local-smoke-project',
+    environmentId: 'local-smoke-project:dev',
+    signingRootId: 'local-smoke-project:dev',
+    publishableKey: 'pk_local',
+  };
+  for (let index = 0; index < args.length; index += 1) {
+    const argument = args[index];
+    if (argument === '--') continue;
+    if (argument === '--help' || argument === '-h') {
+      parsed.help = true;
+      continue;
+    }
+    if (argument === '--root') {
+      parsed.root = requiredArgumentValue(args, ++index, '--root');
+      continue;
+    }
+    if (argument === '--app-origin') {
+      parsed.appOrigin = requiredOrigin(args, ++index, '--app-origin');
+      continue;
+    }
+    if (argument === '--wallet-origin') {
+      parsed.walletOrigin = requiredOrigin(args, ++index, '--wallet-origin');
+      continue;
+    }
+    if (argument === '--org-id') {
+      parsed.orgId = requiredIdentifier(args, ++index, '--org-id');
+      continue;
+    }
+    if (argument === '--project-id') {
+      parsed.projectId = requiredIdentifier(args, ++index, '--project-id');
+      continue;
+    }
+    if (argument === '--environment-id') {
+      parsed.environmentId = requiredIdentifier(args, ++index, '--environment-id');
+      continue;
+    }
+    if (argument === '--signing-root-id') {
+      parsed.signingRootId = requiredIdentifier(args, ++index, '--signing-root-id');
+      continue;
+    }
+    if (argument === '--publishable-key') {
+      parsed.publishableKey = requiredIdentifier(args, ++index, '--publishable-key');
+      continue;
+    }
+    throw new Error(`Unknown argument: ${argument}`);
+  }
+  return parsed;
+}
+
+function requiredIdentifier(args, index, name) {
+  const value = requiredArgumentValue(args, index, name).trim();
+  if (!/^[A-Za-z0-9:_-]{1,160}$/.test(value)) {
+    throw new Error(`${name} must contain only letters, numbers, colon, underscore, or hyphen`);
+  }
+  return value;
+}
+
+function requiredArgumentValue(args, index, name) {
+  const value = args[index];
+  if (!value) throw new Error(`${name} requires a value`);
+  return value;
+}
+
+function requiredOrigin(args, index, name) {
+  const value = requiredArgumentValue(args, index, name);
+  const url = new URL(value);
+  if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+    throw new Error(`${name} must use HTTP or HTTPS`);
+  }
+  return url.origin;
+}
+
+function printUsage() {
+  console.log(
+    'Usage: start-local-wallet-system.mjs [--root <runtime-directory>] [--app-origin <origin>] [--wallet-origin <origin>] [--org-id <id>] [--project-id <id>] [--environment-id <id>] [--signing-root-id <id>] [--publishable-key <key>]',
+  );
+}
+
+function startRoleWorkers() {
+  const child = spawn(
+    process.execPath,
+    [
+      fileURLToPath(new URL('./start-local-role-workers.mjs', import.meta.url)),
+      '--root',
+      localRoot,
+    ],
+    childOptions(),
+  );
+  trackChild('Wallet role Workers', child);
+}
+
+function bootstrapTenantRoot() {
+  const output = runRequiredCapture('local tenant-root bootstrap', process.execPath, [
+    fileURLToPath(new URL('./bootstrap-local-tenant-root.mjs', import.meta.url)),
+    '--root',
+    localRoot,
+    '--org-id',
+    identity.orgId,
+    '--project-id',
+    identity.projectId,
+    '--env-id',
+    identity.environmentId,
+    '--signing-root-id',
+    identity.signingRootId,
+    '--signing-root-version',
+    identity.signingRootVersion,
+    '--router-url',
+    'http://127.0.0.1:4102',
+  ]);
+  const result = JSON.parse(output);
+  if (result.kind !== 'wallet_local_tenant_root_ready_v1') {
+    throw new Error('local tenant-root bootstrap returned an unexpected result');
+  }
+  return result;
+}
+
+function localDeployment(tenantRoot) {
+  return Object.freeze({
+    credential: {
+      apiKeyId: 'local-wallet-publishable-key',
+      publishableKey: options.publishableKey,
+      secretKey: `sk_local_${randomBytes(24).toString('base64url')}`,
+      allowedOrigins: [options.appOrigin, options.walletOrigin],
+      scopes: [
+        'accounts.create',
+        'wallets.read',
+        'wallets.auth_methods.create',
+        'wallets.signers.create',
+      ],
+    },
+    deployment: {
+      orgId: identity.orgId,
+      projectId: identity.projectId,
+      environmentId: identity.environmentId,
+      environmentKey: identity.environmentKey,
+      signingRootVersion: identity.signingRootVersion,
+    },
+    tenantRoot: {
+      identityDigestB64u: tenantRoot.identityDigestB64u,
+      custodyLineageB64u: tenantRoot.custodyLineageB64u,
+      signingRootId: identity.signingRootId,
+    },
+  });
+}
+
+function applySignerMigrations(runtime) {
+  mkdirSync(gatewayStateRoot, { recursive: true });
+  runRequired(
+    'Wallet signer D1 migrations',
+    'pnpm',
+    [
+      'exec',
+      'wrangler',
+      'd1',
+      'migrations',
+      'apply',
+      runtime.signerDatabaseName,
+      '--local',
+      '--persist-to',
+      gatewayStateRoot,
+      '--config',
+      runtime.configPath,
+    ],
+    { ...process.env, CI: 'true' },
+  );
+}
+
+function startGateway(runtime) {
+  const port = String(new URL(runtime.gatewayUrl).port || 80);
+  const child = spawn(
+    'pnpm',
+    [
+      'exec',
+      'wrangler',
+      'dev',
+      '--config',
+      runtime.configPath,
+      '--port',
+      port,
+      '--inspector-port',
+      '4200',
+      '--persist-to',
+      gatewayStateRoot,
+      '--env-file',
+      runtime.secretPath,
+      '--local',
+      '--show-interactive-dev-session=false',
+    ],
+    childOptions(),
+  );
+  trackChild('Wallet Gateway', child);
+}
+
+function childOptions() {
+  return {
+    cwd: repoRoot,
+    env: process.env,
+    stdio: 'inherit',
+    detached: process.platform !== 'win32',
+  };
+}
+
+function trackChild(label, child) {
+  children.push(child);
+  child.once('exit', handleChildExit.bind(undefined, label));
+  child.once('error', handleChildError.bind(undefined, label));
+}
+
+function runRequired(label, command, args, env = process.env) {
+  const result = spawnSync(command, args, { cwd: repoRoot, env, stdio: 'inherit' });
+  requireSuccessfulResult(label, result);
+}
+
+function runRequiredCapture(label, command, args) {
+  const result = spawnSync(command, args, {
+    cwd: repoRoot,
+    env: process.env,
+    encoding: 'utf8',
+  });
+  if (result.stderr) process.stderr.write(result.stderr);
+  requireSuccessfulResult(label, result);
+  return result.stdout.trim();
+}
+
+function requireSuccessfulResult(label, result) {
+  if (result.error) throw new Error(`${label} failed to start: ${result.error.message}`);
+  if (result.status !== 0) {
+    throw new Error(`${label} exited with ${String(result.status ?? 'unknown')}`);
+  }
+}
+
+async function waitForHttp(url, timeoutMs, requireOk) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (stopping) throw new Error('local Wallet system stopped during startup');
+    const status = await requestStatus(url);
+    if (status !== null && (!requireOk || status === 200)) return;
+    await delay(250);
+  }
+  throw new Error(`${url} did not become ready`);
+}
+
+async function waitForFile(filePath, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (stopping) throw new Error('local Wallet system stopped during startup');
+    if (existsSync(filePath)) return;
+    await delay(50);
+  }
+  throw new Error(`${filePath} was not created`);
+}
+
+function requestStatus(url) {
+  return new Promise(requestStatusExecutor.bind(undefined, url));
+}
+
+function requestStatusExecutor(url, resolve) {
+  const request = http.get(url, handleStatusResponse.bind(undefined, resolve));
+  request.setTimeout(750, handleRequestTimeout.bind(undefined, request));
+  request.once('error', resolve.bind(undefined, null));
+}
+
+function handleStatusResponse(resolve, response) {
+  response.resume();
+  resolve(response.statusCode ?? null);
+}
+
+function handleRequestTimeout(request) {
+  request.destroy();
+}
+
+function delay(milliseconds) {
+  return new Promise(resolveDelay.bind(undefined, milliseconds));
+}
+
+function resolveDelay(milliseconds, resolve) {
+  setTimeout(resolve, milliseconds);
+}
+
+function installSignalHandlers() {
+  process.once('SIGINT', handleSigint);
+  process.once('SIGTERM', handleSigterm);
+}
+
+function handleSigint() {
+  shutdown(130);
+}
+
+function handleSigterm() {
+  shutdown(143);
+}
+
+function handleChildExit(label, code, signal) {
+  if (stopping) return;
+  console.error(`${label} stopped (${signal || String(code ?? 'unknown')})`);
+  shutdown(typeof code === 'number' && code > 0 ? code : 1);
+}
+
+function handleChildError(label, error) {
+  if (stopping) return;
+  console.error(`${label} failed: ${error.message}`);
+  shutdown(1);
+}
+
+function handleFatalError(error) {
+  if (stopping) return;
+  console.error(error instanceof Error ? error.message : String(error));
+  shutdown(1);
+}
+
+function waitUntilStopped() {
+  return new Promise(() => {});
+}
+
+function shutdown(exitCode) {
+  if (stopping) return;
+  stopping = true;
+  for (const child of children) stopChild(child);
+  setTimeout(forceStopChildren, 2_000).unref();
+  process.exitCode = exitCode;
+}
+
+function stopChild(child) {
+  if (!child.pid || child.exitCode !== null) return;
+  try {
+    if (process.platform === 'win32') child.kill('SIGTERM');
+    else process.kill(-child.pid, 'SIGTERM');
+  } catch {
+    child.kill('SIGTERM');
+  }
+}
+
+function forceStopChildren() {
+  for (const child of children) {
+    if (!child.pid || child.exitCode !== null) continue;
+    try {
+      if (process.platform === 'win32') child.kill('SIGKILL');
+      else process.kill(-child.pid, 'SIGKILL');
+    } catch {
+      child.kill('SIGKILL');
+    }
+  }
+}

package/cloudflare-router-ab/wrangler.deriver-a.toml

@@ -0,0 +1,123 @@
+name = "router-ab-deriver-a"
+main = "build/deriver-a/worker/shim.mjs"
+compatibility_date = "2026-06-12"
+workers_dev = false
+
+
+[[d1_databases]]
+binding = "DERIVER_ROLE_PRIVATE_DB"
+database_name = "router-ab-deriver-a-private"
+# deploy-backend.mjs replaces this lane placeholder before remote migration and deployment.
+database_id = "__PRODUCTION_MAINNET_DERIVER_A_PRIVATE_D1_ID__"
+migrations_dir = "migrations/deriver-a"
+
+[[r2_buckets]]
+binding = "TENANT_ROOT_MANAGED_BACKUP_BUCKET"
+bucket_name = "router-ab-deriver-a-tenant-root-managed-backup"
+
+# R120: read authoritative tenant-root creation state directly from the
+# Router-owned Durable Object. The class, namespace, migrations and storage
+# stay owned by the Router manifest; this is an external binding, and the
+# object independently verifies every signed command it is given.
+[[durable_objects.bindings]]
+name = "ROUTER_TENANT_ROOT_CREATION_DO"
+class_name = "RouterAbTenantRootCreationDurableObject"
+script_name = "router-ab-mpc-router"
+
+[[services]]
+binding = "DERIVER_B"
+service = "router-ab-deriver-b"
+
+[vars]
+ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET_BINDING = "ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET"
+DERIVER_ROLE_PRIVATE_D1_KEK_BINDING = "DERIVER_A_ROLE_PRIVATE_D1_KEK"
+DERIVER_ROLE_PRIVATE_D1_ROLE = "deriver_a"
+DERIVER_A_ENVELOPE_HPKE_PRIVATE_KEY_BINDING = "DERIVER_A_ENVELOPE_HPKE_PRIVATE_KEY"
+DERIVER_A_ENVELOPE_HPKE_KEY_EPOCH = "epoch-1"
+DERIVER_B_ENVELOPE_HPKE_KEY_EPOCH = "epoch-1"
+DERIVER_A_PEER_SIGNING_KEY_BINDING = "DERIVER_A_PEER_SIGNING_KEY"
+DERIVER_A_PEER_SIGNING_KEY_EPOCH = "epoch-1"
+DERIVER_B_PEER_BINDING = "DERIVER_B"
+
+[env.staging]
+name = "router-ab-deriver-a-staging"
+workers_dev = false
+
+[[env.staging.d1_databases]]
+binding = "DERIVER_ROLE_PRIVATE_DB"
+database_name = "router-ab-deriver-a-staging-private"
+# deploy-backend.mjs replaces this lane placeholder before remote migration and deployment.
+database_id = "__STAGING_TESTNET_DERIVER_A_PRIVATE_D1_ID__"
+migrations_dir = "migrations/deriver-a"
+
+[[env.staging.r2_buckets]]
+binding = "TENANT_ROOT_MANAGED_BACKUP_BUCKET"
+bucket_name = "router-ab-deriver-a-staging-tenant-root-managed-backup"
+
+[[env.staging.durable_objects.bindings]]
+name = "ROUTER_TENANT_ROOT_CREATION_DO"
+class_name = "RouterAbTenantRootCreationDurableObject"
+script_name = "router-ab-mpc-router-staging"
+
+[[env.staging.services]]
+binding = "DERIVER_B"
+service = "router-ab-deriver-b-staging"
+
+[env.staging.vars]
+ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET_BINDING = "ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET"
+DERIVER_ROLE_PRIVATE_D1_KEK_BINDING = "DERIVER_A_ROLE_PRIVATE_D1_KEK"
+DERIVER_ROLE_PRIVATE_D1_ROLE = "deriver_a"
+DERIVER_A_ENVELOPE_HPKE_PRIVATE_KEY_BINDING = "DERIVER_A_ENVELOPE_HPKE_PRIVATE_KEY"
+DERIVER_A_ENVELOPE_HPKE_KEY_EPOCH = "epoch-1"
+DERIVER_A_ENVELOPE_HPKE_PUBLIC_KEY = "x25519:2693d0896a85398a7bef705c714590bbd99e0c91be62323d33c421d5be597257"
+DERIVER_B_ENVELOPE_HPKE_KEY_EPOCH = "epoch-1"
+DERIVER_A_PEER_SIGNING_KEY_BINDING = "DERIVER_A_PEER_SIGNING_KEY"
+DERIVER_A_PEER_SIGNING_KEY_EPOCH = "epoch-1"
+DERIVER_A_PEER_VERIFYING_KEY_HEX = "d6d21d388a92e6eb9d85d9fcdbcba81c383d7102717b7160fab5e2b501555907"
+DERIVER_B_PEER_VERIFYING_KEY_HEX = "1a369e342f555305e278312f3b704465e11fadbbab09134ed897402ed65c2d4a"
+DERIVER_B_PEER_BINDING = "DERIVER_B"
+
+[env.production-testnet]
+name = "router-ab-deriver-a-testnet"
+workers_dev = false
+
+[[env.production-testnet.d1_databases]]
+binding = "DERIVER_ROLE_PRIVATE_DB"
+database_name = "router-ab-deriver-a-testnet-private"
+# deploy-backend.mjs replaces this lane placeholder before remote migration and deployment.
+database_id = "__PRODUCTION_TESTNET_DERIVER_A_PRIVATE_D1_ID__"
+migrations_dir = "migrations/deriver-a"
+
+[[env.production-testnet.r2_buckets]]
+binding = "TENANT_ROOT_MANAGED_BACKUP_BUCKET"
+bucket_name = "router-ab-deriver-a-testnet-tenant-root-managed-backup"
+
+[[env.production-testnet.durable_objects.bindings]]
+name = "ROUTER_TENANT_ROOT_CREATION_DO"
+class_name = "RouterAbTenantRootCreationDurableObject"
+script_name = "router-ab-mpc-router-testnet"
+
+[[env.production-testnet.services]]
+binding = "DERIVER_B"
+service = "router-ab-deriver-b-testnet"
+
+[env.production-testnet.vars]
+ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET_BINDING = "ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET"
+DERIVER_ROLE_PRIVATE_D1_KEK_BINDING = "DERIVER_A_ROLE_PRIVATE_D1_KEK"
+DERIVER_ROLE_PRIVATE_D1_ROLE = "deriver_a"
+DERIVER_A_ENVELOPE_HPKE_PRIVATE_KEY_BINDING = "DERIVER_A_ENVELOPE_HPKE_PRIVATE_KEY"
+DERIVER_A_ENVELOPE_HPKE_KEY_EPOCH = "epoch-1"
+DERIVER_B_ENVELOPE_HPKE_KEY_EPOCH = "epoch-1"
+DERIVER_A_PEER_SIGNING_KEY_BINDING = "DERIVER_A_PEER_SIGNING_KEY"
+DERIVER_A_PEER_SIGNING_KEY_EPOCH = "epoch-1"
+DERIVER_B_PEER_BINDING = "DERIVER_B"
+
+[observability]
+enabled = true
+  [observability.logs]
+  enabled = true
+  head_sampling_rate = 1
+  invocation_logs = true
+  [observability.traces]
+  enabled = true
+  head_sampling_rate = 1

package/cloudflare-router-ab/wrangler.deriver-b.toml

@@ -0,0 +1,123 @@
+name = "router-ab-deriver-b"
+main = "build/deriver-b/worker/shim.mjs"
+compatibility_date = "2026-06-12"
+workers_dev = false
+
+
+[[d1_databases]]
+binding = "DERIVER_ROLE_PRIVATE_DB"
+database_name = "router-ab-deriver-b-private"
+# deploy-backend.mjs replaces this lane placeholder before remote migration and deployment.
+database_id = "__PRODUCTION_MAINNET_DERIVER_B_PRIVATE_D1_ID__"
+migrations_dir = "migrations/deriver-b"
+
+[[r2_buckets]]
+binding = "TENANT_ROOT_MANAGED_BACKUP_BUCKET"
+bucket_name = "router-ab-deriver-b-tenant-root-managed-backup"
+
+# R120: read authoritative tenant-root creation state directly from the
+# Router-owned Durable Object. The class, namespace, migrations and storage
+# stay owned by the Router manifest; this is an external binding, and the
+# object independently verifies every signed command it is given.
+[[durable_objects.bindings]]
+name = "ROUTER_TENANT_ROOT_CREATION_DO"
+class_name = "RouterAbTenantRootCreationDurableObject"
+script_name = "router-ab-mpc-router"
+
+[[services]]
+binding = "DERIVER_A"
+service = "router-ab-deriver-a"
+
+[vars]
+ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET_BINDING = "ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET"
+DERIVER_ROLE_PRIVATE_D1_KEK_BINDING = "DERIVER_B_ROLE_PRIVATE_D1_KEK"
+DERIVER_ROLE_PRIVATE_D1_ROLE = "deriver_b"
+DERIVER_B_ENVELOPE_HPKE_PRIVATE_KEY_BINDING = "DERIVER_B_ENVELOPE_HPKE_PRIVATE_KEY"
+DERIVER_B_ENVELOPE_HPKE_KEY_EPOCH = "epoch-1"
+DERIVER_A_ENVELOPE_HPKE_KEY_EPOCH = "epoch-1"
+DERIVER_B_PEER_SIGNING_KEY_BINDING = "DERIVER_B_PEER_SIGNING_KEY"
+DERIVER_B_PEER_SIGNING_KEY_EPOCH = "epoch-1"
+DERIVER_A_PEER_BINDING = "DERIVER_A"
+
+[env.staging]
+name = "router-ab-deriver-b-staging"
+workers_dev = false
+
+[[env.staging.d1_databases]]
+binding = "DERIVER_ROLE_PRIVATE_DB"
+database_name = "router-ab-deriver-b-staging-private"
+# deploy-backend.mjs replaces this lane placeholder before remote migration and deployment.
+database_id = "__STAGING_TESTNET_DERIVER_B_PRIVATE_D1_ID__"
+migrations_dir = "migrations/deriver-b"
+
+[[env.staging.r2_buckets]]
+binding = "TENANT_ROOT_MANAGED_BACKUP_BUCKET"
+bucket_name = "router-ab-deriver-b-staging-tenant-root-managed-backup"
+
+[[env.staging.durable_objects.bindings]]
+name = "ROUTER_TENANT_ROOT_CREATION_DO"
+class_name = "RouterAbTenantRootCreationDurableObject"
+script_name = "router-ab-mpc-router-staging"
+
+[[env.staging.services]]
+binding = "DERIVER_A"
+service = "router-ab-deriver-a-staging"
+
+[env.staging.vars]
+ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET_BINDING = "ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET"
+DERIVER_ROLE_PRIVATE_D1_KEK_BINDING = "DERIVER_B_ROLE_PRIVATE_D1_KEK"
+DERIVER_ROLE_PRIVATE_D1_ROLE = "deriver_b"
+DERIVER_B_ENVELOPE_HPKE_PRIVATE_KEY_BINDING = "DERIVER_B_ENVELOPE_HPKE_PRIVATE_KEY"
+DERIVER_B_ENVELOPE_HPKE_KEY_EPOCH = "epoch-1"
+DERIVER_B_ENVELOPE_HPKE_PUBLIC_KEY = "x25519:5e2819f555ecfcc996761ca4558551172f06052fb9f80123a88f4e0094c3b13a"
+DERIVER_A_ENVELOPE_HPKE_KEY_EPOCH = "epoch-1"
+DERIVER_B_PEER_SIGNING_KEY_BINDING = "DERIVER_B_PEER_SIGNING_KEY"
+DERIVER_B_PEER_SIGNING_KEY_EPOCH = "epoch-1"
+DERIVER_A_PEER_VERIFYING_KEY_HEX = "d6d21d388a92e6eb9d85d9fcdbcba81c383d7102717b7160fab5e2b501555907"
+DERIVER_B_PEER_VERIFYING_KEY_HEX = "1a369e342f555305e278312f3b704465e11fadbbab09134ed897402ed65c2d4a"
+DERIVER_A_PEER_BINDING = "DERIVER_A"
+
+[env.production-testnet]
+name = "router-ab-deriver-b-testnet"
+workers_dev = false
+
+[[env.production-testnet.d1_databases]]
+binding = "DERIVER_ROLE_PRIVATE_DB"
+database_name = "router-ab-deriver-b-testnet-private"
+# deploy-backend.mjs replaces this lane placeholder before remote migration and deployment.
+database_id = "__PRODUCTION_TESTNET_DERIVER_B_PRIVATE_D1_ID__"
+migrations_dir = "migrations/deriver-b"
+
+[[env.production-testnet.r2_buckets]]
+binding = "TENANT_ROOT_MANAGED_BACKUP_BUCKET"
+bucket_name = "router-ab-deriver-b-testnet-tenant-root-managed-backup"
+
+[[env.production-testnet.durable_objects.bindings]]
+name = "ROUTER_TENANT_ROOT_CREATION_DO"
+class_name = "RouterAbTenantRootCreationDurableObject"
+script_name = "router-ab-mpc-router-testnet"
+
+[[env.production-testnet.services]]
+binding = "DERIVER_A"
+service = "router-ab-deriver-a-testnet"
+
+[env.production-testnet.vars]
+ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET_BINDING = "ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET"
+DERIVER_ROLE_PRIVATE_D1_KEK_BINDING = "DERIVER_B_ROLE_PRIVATE_D1_KEK"
+DERIVER_ROLE_PRIVATE_D1_ROLE = "deriver_b"
+DERIVER_B_ENVELOPE_HPKE_PRIVATE_KEY_BINDING = "DERIVER_B_ENVELOPE_HPKE_PRIVATE_KEY"
+DERIVER_B_ENVELOPE_HPKE_KEY_EPOCH = "epoch-1"
+DERIVER_A_ENVELOPE_HPKE_KEY_EPOCH = "epoch-1"
+DERIVER_B_PEER_SIGNING_KEY_BINDING = "DERIVER_B_PEER_SIGNING_KEY"
+DERIVER_B_PEER_SIGNING_KEY_EPOCH = "epoch-1"
+DERIVER_A_PEER_BINDING = "DERIVER_A"
+
+[observability]
+enabled = true
+  [observability.logs]
+  enabled = true
+  head_sampling_rate = 1
+  invocation_logs = true
+  [observability.traces]
+  enabled = true
+  head_sampling_rate = 1