@seams/wallet-server 0.5.0

package/dist/esm/router/cloudflare/d1/registration/walletRegistrationSessionCommitReceipt.js

@@ -0,0 +1,486 @@
+import { parseWalletAuthMethodId, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
+import { parseWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/registrationIntent.js";
+import { parseWalletAuthAuthority } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { parseSessionOrigin } from "../../../../authorization/domain.js";
+import { parseWalletCustodyRegistrationOutcome } from "../../../../shared-ts/src/passkey-custody/ceremonyCommitPayload.js";
+import "../../../../shared-ts/src/passkey-custody/index.js";
+//#region src/router/cloudflare/d1/registration/walletRegistrationSessionCommitReceipt.ts
+function unissuedRegistrationCommit(response) {
+	return {
+		kind: "unissued",
+		response
+	};
+}
+function replayedRegistrationCommit(response) {
+	return {
+		kind: "replayed",
+		response
+	};
+}
+function projectRegistrationEstablishedSessionV2(session) {
+	return {
+		kind: "registration_established_wallet_session_projection_v2",
+		walletId: session.walletId,
+		authorizationId: session.authorizationId,
+		walletSessionId: session.walletSessionId,
+		quotaId: session.quotaId,
+		expiresAtMs: session.expiresAtMs,
+		remainingUses: session.remainingUses,
+		walletSession: session.walletSession,
+		tokens: session.tokens
+	};
+}
+function projectRegistrationEstablishedSessionResultV2(result) {
+	switch (result.kind) {
+		case "issued": return projectRegistrationEstablishedSessionV2(result.session);
+		case "already_committed": return result.session;
+		default: return assertNeverRegistrationSessionResult(result);
+	}
+}
+function assertNeverRegistrationSessionResult(value) {
+	throw new Error(`Unsupported registration session result: ${String(value)}`);
+}
+function projectWalletRegistrationSessionCommitReceiptV2(input) {
+	const response = input.execution.response;
+	if (!response.ok) {
+		if (input.execution.kind !== "unissued") throw new Error("Registration error receipt has an issued-session marker");
+		return {
+			kind: "wallet_registration_session_commit_receipt_v2",
+			operation: input.operation,
+			operationFingerprint: input.operationFingerprint,
+			registrationCeremonyId: input.registrationCeremonyId,
+			committed: {
+				kind: "error",
+				error: response
+			}
+		};
+	}
+	if (input.execution.kind === "unissued" || input.execution.kind === "replayed") throw new Error("Registration commit receipt requires an issued or pending response");
+	const expectedOrigin = input.execution.expectedOrigin;
+	const metadata = {
+		kind: "wallet_registration_session_commit_receipt_v2",
+		operation: input.operation,
+		operationFingerprint: input.operationFingerprint,
+		registrationCeremonyId: input.registrationCeremonyId,
+		walletId: response.walletId,
+		authority: response.authority,
+		authMethod: response.authMethod,
+		expectedOrigin,
+		..."registrationDiagnostics" in response && response.registrationDiagnostics ? { registrationDiagnostics: response.registrationDiagnostics } : {}
+	};
+	if (response.kind === "near_ed25519" && !("registrationEstablishedSession" in response)) {
+		if (input.execution.kind !== "near_pending") throw new Error("Pending registration commit receipt has an issued-session marker");
+		return {
+			...metadata,
+			walletAuthMethodId: response.authority.bindingId,
+			committed: {
+				kind: "near_pending",
+				nearProvisioning: { status: "near_pending" }
+			}
+		};
+	}
+	if (response.kind === "evm_family_ecdsa") {
+		if (!("registrationEstablishedSession" in response)) throw new Error("ECDSA registration commit receipt is missing its session");
+		if (input.execution.kind !== "session_issued" && input.execution.kind !== "session_issued_with_installation_projection") throw new Error("ECDSA registration commit receipt is missing its issue identity");
+		if (response.foundingAuthMethod.walletAuthMethodId !== response.authority.bindingId) throw new Error("ECDSA registration commit receipt has mismatched auth-method identity");
+		const installation = input.execution.kind === "session_issued_with_installation_projection" ? input.execution.installationProjection : void 0;
+		if (installation && (installation.registrationCeremonyId !== input.registrationCeremonyId || installation.walletId !== response.walletId || installation.registrationAuthority.walletId !== response.walletId || response.nearProvisioning?.status !== "near_pending")) throw new Error("ECDSA registration commit receipt has an invalid installation projection");
+		const establishedSessionProjection = projectRegistrationEstablishedSessionResultV2(response.registrationEstablishedSession);
+		assertRegistrationCommitSessionTiming(establishedSessionProjection, input.execution.issuedAtMs);
+		const readyMetadata = {
+			...metadata,
+			walletAuthMethodId: response.foundingAuthMethod.walletAuthMethodId,
+			foundingAuthority: response.foundingAuthority,
+			foundingAuthMethod: response.foundingAuthMethod,
+			mintId: registrationEstablishedMintId(input.registrationCeremonyId),
+			issuedAtMs: input.execution.issuedAtMs,
+			expiresAtMs: establishedSessionProjection.expiresAtMs,
+			custodyKeyManifestDigestB64u: response.custodyKeyManifestDigestB64u,
+			...response.walletCustody ? { walletCustody: response.walletCustody } : {}
+		};
+		if (response.nearProvisioning && installation) return {
+			...readyMetadata,
+			committed: {
+				kind: "ecdsa_ready",
+				ecdsa: response.ecdsa,
+				session: establishedSessionProjection,
+				nearProvisioning: response.nearProvisioning,
+				installation
+			}
+		};
+		if (response.nearProvisioning === void 0 && installation === void 0) return {
+			...readyMetadata,
+			committed: {
+				kind: "ecdsa_ready",
+				ecdsa: response.ecdsa,
+				session: establishedSessionProjection
+			}
+		};
+		throw new Error("ECDSA registration commit receipt has an incomplete installation projection");
+	}
+	if (response.kind !== "near_ed25519" || !("registrationEstablishedSession" in response)) throw new Error("Registration commit receipt has an unsupported success branch");
+	if (input.execution.kind !== "session_issued") throw new Error("NEAR registration commit receipt is missing its issue identity");
+	if (response.foundingAuthMethod.walletAuthMethodId !== response.authority.bindingId) throw new Error("NEAR registration commit receipt has mismatched auth-method identity");
+	const establishedSessionProjection = projectRegistrationEstablishedSessionResultV2(response.registrationEstablishedSession);
+	assertRegistrationCommitSessionTiming(establishedSessionProjection, input.execution.issuedAtMs);
+	return {
+		...metadata,
+		walletAuthMethodId: response.foundingAuthMethod.walletAuthMethodId,
+		foundingAuthority: response.foundingAuthority,
+		foundingAuthMethod: response.foundingAuthMethod,
+		mintId: registrationEstablishedMintId(input.registrationCeremonyId),
+		issuedAtMs: input.execution.issuedAtMs,
+		expiresAtMs: establishedSessionProjection.expiresAtMs,
+		custodyKeyManifestDigestB64u: response.custodyKeyManifestDigestB64u,
+		...response.walletCustody ? { walletCustody: response.walletCustody } : {},
+		committed: {
+			kind: "near_ready",
+			authorityScope: response.authorityScope,
+			accountProvisioning: response.accountProvisioning,
+			resolvedAccount: response.resolvedAccount,
+			ed25519: response.ed25519,
+			session: establishedSessionProjection,
+			nearProvisioning: { status: "near_ready" }
+		}
+	};
+}
+function registrationReplayAuthMethodFields(receipt) {
+	switch (receipt.authMethod.kind) {
+		case "passkey":
+			if (receipt.authority.factor.kind !== "passkey") throw new Error("Registration commit receipt has mismatched passkey authority");
+			if (receipt.authority.factor.credentialIdB64u !== receipt.authMethod.credentialIdB64u) throw new Error("Registration commit receipt has mismatched passkey credential");
+			if (receipt.authority.verifier.kind !== "webauthn") throw new Error("Registration commit receipt has mismatched WebAuthn verifier");
+			return {
+				kind: "passkey",
+				authMethod: receipt.authMethod,
+				rpId: receipt.authority.verifier.rpId
+			};
+		case "email_otp":
+			if (receipt.authority.factor.kind !== "email_otp") throw new Error("Registration commit receipt has mismatched Email OTP authority");
+			return {
+				kind: "email_otp",
+				authMethod: receipt.authMethod
+			};
+		default: return assertNeverRegistrationReplayAuthMethod(receipt.authMethod);
+	}
+}
+function assertNeverRegistrationReplayAuthMethod(value) {
+	throw new Error(`Unsupported registration replay auth method: ${String(value)}`);
+}
+function registrationEstablishedMintId(registrationCeremonyId) {
+	const parsed = parseWalletSessionMintId(`registration-established:${registrationCeremonyId}`);
+	if (!parsed.ok) throw new Error(parsed.error.message);
+	return parsed.value;
+}
+/**
+* Parses the one durable registration receipt shape. Nested signer payloads
+* are parsed by the caller's branch parser; this boundary owns the envelope,
+* identity checks, exact keys, and the credential deny-list.
+*/
+function parseWalletRegistrationSessionCommitReceiptV2(raw, parseCommitted) {
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
+	const record = raw;
+	if (record.kind !== "wallet_registration_session_commit_receipt_v2" || containsPersistedRegistrationCredential(record)) return null;
+	const operation = parseRegistrationOperation(record.operation);
+	const operationFingerprint = parseNonEmptyString(record.operationFingerprint);
+	const registrationCeremonyId = parseNonEmptyString(record.registrationCeremonyId);
+	if (operation === null || operationFingerprint === null || registrationCeremonyId === null || record.committed === null || typeof record.committed !== "object" || Array.isArray(record.committed) || typeof record.committed.kind !== "string") return null;
+	const committedRecord = record.committed;
+	if (committedRecord.kind === "error") {
+		const error = parseRegistrationRouteError(committedRecord.error);
+		if (error === null || !hasExactKeys(record, [
+			"kind",
+			"operation",
+			"operationFingerprint",
+			"registrationCeremonyId",
+			"committed"
+		]) || !hasExactKeys(committedRecord, ["kind", "error"])) return null;
+		return {
+			kind: "wallet_registration_session_commit_receipt_v2",
+			operation,
+			operationFingerprint,
+			registrationCeremonyId,
+			committed: {
+				kind: "error",
+				error
+			}
+		};
+	}
+	const walletId = parseWalletId(record.walletId);
+	const walletAuthMethodId = parseWalletAuthMethodId(record.walletAuthMethodId);
+	const authority = parseWalletAuthAuthority(record.authority);
+	const authMethod = parseWalletRegistrationFinalizeAuthMethod(record.authMethod);
+	let expectedOrigin;
+	try {
+		expectedOrigin = parseSessionOrigin(record.expectedOrigin);
+	} catch {
+		return null;
+	}
+	if (!walletId.ok || !walletAuthMethodId.ok || authority === null || authMethod === null || authority.walletId !== walletId.value || authority.bindingId !== walletAuthMethodId.value || !registrationAuthMethodMatchesAuthority(authMethod, authority)) return null;
+	const registrationDiagnostics = parseRegistrationDiagnostics(record.registrationDiagnostics);
+	if (record.registrationDiagnostics !== void 0 && registrationDiagnostics === null) return null;
+	const common = {
+		kind: "wallet_registration_session_commit_receipt_v2",
+		operation,
+		operationFingerprint,
+		registrationCeremonyId,
+		walletId: walletId.value,
+		walletAuthMethodId: walletAuthMethodId.value,
+		authority,
+		authMethod,
+		expectedOrigin,
+		...registrationDiagnostics ? { registrationDiagnostics } : {}
+	};
+	if (committedRecord.kind === "near_pending") {
+		if (operation !== "registration_activate" || !hasExactKeys(record, [
+			"kind",
+			"operation",
+			"operationFingerprint",
+			"registrationCeremonyId",
+			"walletId",
+			"walletAuthMethodId",
+			"authority",
+			"authMethod",
+			"expectedOrigin",
+			...registrationDiagnostics ? ["registrationDiagnostics"] : [],
+			"committed"
+		]) || !hasExactKeys(committedRecord, ["kind", "nearProvisioning"]) || committedRecord.nearProvisioning === null || typeof committedRecord.nearProvisioning !== "object" || Array.isArray(committedRecord.nearProvisioning) || !hasExactKeys(committedRecord.nearProvisioning, ["status"]) || committedRecord.nearProvisioning.status !== "near_pending") return null;
+		return {
+			...common,
+			committed: {
+				kind: "near_pending",
+				nearProvisioning: { status: "near_pending" }
+			}
+		};
+	}
+	if (committedRecord.kind !== "ecdsa_ready" && committedRecord.kind !== "near_ready") return null;
+	if (committedRecord.kind === "ecdsa_ready" && operation !== "registration_activate" || committedRecord.kind === "near_ready" && operation !== "near_provisioning") return null;
+	const foundingAuthority = parseWalletAuthorityV1(record.foundingAuthority);
+	const foundingAuthMethod = parseWalletAuthMethodRecordV2(record.foundingAuthMethod);
+	const mintId = parseWalletSessionMintId(record.mintId);
+	const issuedAtMs = parsePositiveSafeInteger(record.issuedAtMs);
+	const expiresAtMs = parsePositiveSafeInteger(record.expiresAtMs);
+	let custodyKeyManifestDigestB64u;
+	try {
+		custodyKeyManifestDigestB64u = parseDigestB64u(record.custodyKeyManifestDigestB64u);
+	} catch {
+		return null;
+	}
+	let walletCustody;
+	if (record.walletCustody !== void 0) try {
+		walletCustody = parseWalletCustodyRegistrationOutcome(record.walletCustody, "registration receipt");
+	} catch {
+		return null;
+	}
+	if (!hasExactKeys(record, [
+		"kind",
+		"operation",
+		"operationFingerprint",
+		"registrationCeremonyId",
+		"walletId",
+		"walletAuthMethodId",
+		"authority",
+		"authMethod",
+		"expectedOrigin",
+		"foundingAuthority",
+		"foundingAuthMethod",
+		"mintId",
+		"issuedAtMs",
+		"expiresAtMs",
+		"custodyKeyManifestDigestB64u",
+		...registrationDiagnostics ? ["registrationDiagnostics"] : [],
+		...walletCustody ? ["walletCustody"] : [],
+		"committed"
+	]) || !foundingAuthority.ok || foundingAuthority.value.state !== "active" || !foundingAuthMethod || foundingAuthMethod.status !== "active" || !mintId.ok || mintId.value !== registrationEstablishedMintId(registrationCeremonyId) || issuedAtMs === null || expiresAtMs === null || expiresAtMs <= issuedAtMs || foundingAuthority.value.walletId !== walletId.value || foundingAuthMethod.walletId !== walletId.value || foundingAuthMethod.walletAuthorityId !== foundingAuthority.value.authorityId || foundingAuthMethod.walletAuthMethodId !== walletAuthMethodId.value) return null;
+	const committed = parseCommitted(record.committed);
+	if (!committed || committed.kind !== committedRecord.kind) return null;
+	if ("session" in committed && (committed.session.walletId !== walletId.value || committed.session.expiresAtMs !== expiresAtMs || committed.session.remainingUses <= 0)) return null;
+	switch (committed.kind) {
+		case "ecdsa_ready": return {
+			...common,
+			foundingAuthority: foundingAuthority.value,
+			foundingAuthMethod,
+			mintId: mintId.value,
+			issuedAtMs,
+			expiresAtMs,
+			custodyKeyManifestDigestB64u,
+			...walletCustody ? { walletCustody } : {},
+			committed
+		};
+		case "near_ready": return {
+			...common,
+			foundingAuthority: foundingAuthority.value,
+			foundingAuthMethod,
+			mintId: mintId.value,
+			issuedAtMs,
+			expiresAtMs,
+			custodyKeyManifestDigestB64u,
+			...walletCustody ? { walletCustody } : {},
+			committed
+		};
+		default: return assertNeverCommittedReceipt(committed);
+	}
+}
+function registrationAuthMethodMatchesAuthority(authMethod, authority) {
+	if (authMethod.kind === "passkey") return authority.factor.kind === "passkey" && authority.factor.credentialIdB64u === authMethod.credentialIdB64u;
+	return authority.factor.kind === "email_otp";
+}
+function assertNeverCommittedReceipt(value) {
+	throw new Error(`Unsupported registration commit receipt: ${String(value)}`);
+}
+function assertRegistrationCommitSessionTiming(session, issuedAtMs) {
+	if (!Number.isSafeInteger(issuedAtMs) || issuedAtMs <= 0 || !Number.isSafeInteger(session.expiresAtMs) || session.expiresAtMs <= issuedAtMs || !Number.isSafeInteger(session.remainingUses) || session.remainingUses <= 0) throw new Error("Registration commit receipt has invalid session timing");
+}
+function parseRegistrationOperation(value) {
+	return value === "registration_activate" || value === "near_provisioning" ? value : null;
+}
+function parseWalletRegistrationFinalizeAuthMethod(raw) {
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
+	const record = raw;
+	if (typeof record.kind !== "string") return null;
+	if (record.kind === "passkey") {
+		if (!hasExactKeys(record, [
+			"kind",
+			"credentialIdB64u",
+			"credentialPublicKeyB64u"
+		])) return null;
+		const credentialIdB64u = parseNonEmptyString(record.credentialIdB64u);
+		const credentialPublicKeyB64u = parseNonEmptyString(record.credentialPublicKeyB64u);
+		return credentialIdB64u && credentialPublicKeyB64u ? {
+			kind: "passkey",
+			credentialIdB64u,
+			credentialPublicKeyB64u
+		} : null;
+	}
+	if (record.kind === "email_otp") {
+		if (!hasExactKeys(record, ["kind", "registrationAuthorityId"])) return null;
+		const registrationAuthorityId = parseNonEmptyString(record.registrationAuthorityId);
+		return registrationAuthorityId ? {
+			kind: "email_otp",
+			registrationAuthorityId
+		} : null;
+	}
+	return null;
+}
+function parseRegistrationDiagnostics(raw) {
+	if (raw === void 0) return void 0;
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
+	const record = raw;
+	if (!hasExactKeys(record, [
+		"kind",
+		"route",
+		"entries"
+	]) || record.kind !== "wallet_registration_route_diagnostics_v1") return null;
+	if (record.route !== "wallets_register_finalize" || !Array.isArray(record.entries)) return null;
+	const entries = [];
+	for (const entryRaw of record.entries) {
+		if (entryRaw === null || typeof entryRaw !== "object" || Array.isArray(entryRaw)) return null;
+		const entry = entryRaw;
+		if (!hasExactKeys(entry, ["name", "durationMs"])) return null;
+		if (typeof entry.name !== "string") return null;
+		const durationMs = entry.durationMs;
+		if (typeof durationMs !== "number" || !Number.isFinite(durationMs) || durationMs < 0) return null;
+		const name = parseRegistrationRouteTimingName(entry.name);
+		if (name === null) return null;
+		entries.push({
+			name,
+			durationMs
+		});
+	}
+	return {
+		kind: "wallet_registration_route_diagnostics_v1",
+		route: "wallets_register_finalize",
+		entries
+	};
+}
+function parseRegistrationRouteError(raw) {
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
+	const record = raw;
+	const code = parseNonEmptyString(record.code);
+	const message = parseNonEmptyString(record.message);
+	if (record.ok !== false || code === null || message === null) return null;
+	if (record.retryAfterMs === void 0) return hasExactKeys(record, [
+		"ok",
+		"code",
+		"message"
+	]) ? {
+		ok: false,
+		code,
+		message
+	} : null;
+	const retryAfterMs = parseNonNegativeSafeInteger(record.retryAfterMs);
+	if (retryAfterMs === null || !hasExactKeys(record, [
+		"ok",
+		"code",
+		"message",
+		"retryAfterMs"
+	])) return null;
+	return {
+		ok: false,
+		code,
+		message,
+		retryAfterMs
+	};
+}
+function parseRegistrationRouteTimingName(value) {
+	switch (value) {
+		case "registrationIntentLoadMs":
+		case "registrationIntentDigestMs":
+		case "registrationIntentConsumeMs":
+		case "registrationAttemptGateMs":
+		case "registrationPreparationPersistMs":
+		case "registrationPreparationLoadMs":
+		case "registrationPreparationConsumeMs":
+		case "registrationPreparationScopeCheckMs":
+		case "registrationAuthorityVerifyMs":
+		case "registrationEcdsaPrepareMs":
+		case "registrationCeremonyPersistMs":
+		case "registerPrepareTotalMs":
+		case "registerStartTotalMs":
+		case "registrationEcdsaRespondMs":
+		case "registrationFinalizeReplayLoadMs":
+		case "registrationCeremonyLoadMs":
+		case "registrationEcdsaBootstrapVerifyMs":
+		case "sponsoredNearAccountCreateMs":
+		case "registrationKeygenMs":
+		case "registrationEmailOtpEnrollmentPlanMs":
+		case "relaySessionMintMs":
+		case "relayGoogleEmailOtpActivationPlanMs":
+		case "relayPersistenceMs":
+		case "registrationFinalizeReplayCacheMs":
+		case "registerFinalizeTotalMs":
+		case "registrationCeremonyInsertMs":
+		case "registerSetupTotalMs": return value;
+		default: return null;
+	}
+}
+function parseNonEmptyString(value) {
+	return typeof value === "string" && value.trim() ? value.trim() : null;
+}
+function parsePositiveSafeInteger(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : null;
+}
+function parseNonNegativeSafeInteger(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : null;
+}
+function hasExactKeys(record, expected) {
+	const actual = Object.keys(record);
+	return actual.length === expected.length && expected.every((key) => actual.includes(key));
+}
+function containsPersistedRegistrationCredential(value) {
+	if (Array.isArray(value)) return value.some(containsPersistedRegistrationCredential);
+	if (value === null || typeof value !== "object") return false;
+	const record = value;
+	for (const [key, child] of Object.entries(record)) {
+		if (key === "walletSessionToken" || key === "primaryOperationCredential" || key === "childOperationCredential" || key === "operationCredential" || key === "clientRootProof" || key === "passkeyBootstrapAuthorization" || key === "response") return true;
+		if (containsPersistedRegistrationCredential(child)) return true;
+	}
+	return false;
+}
+//#endregion
+export { parseWalletRegistrationSessionCommitReceiptV2, projectRegistrationEstablishedSessionV2, projectWalletRegistrationSessionCommitReceiptV2, registrationEstablishedMintId, registrationReplayAuthMethodFields, replayedRegistrationCommit, unissuedRegistrationCommit };
+
+//# sourceMappingURL=walletRegistrationSessionCommitReceipt.js.map

package/dist/esm/router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.js

@@ -0,0 +1,146 @@
+import { isD1DatabaseLike } from "../../../../storage/d1Sql.js";
+import { abusePrincipalKey, runtimePolicyScopeKey } from "../../../domains/signingOperations/routerAbNormalSigningAdmissionCore.js";
+//#region src/router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.ts
+const ROUTER_AB_NORMAL_SIGNING_ADMISSION_TABLE = "router_ab_normal_signing_admission_records";
+var CloudflareD1RouterAbNormalSigningAdmissionStore = class {
+	constructor(options) {
+		if (!isD1DatabaseLike(options.database)) throw new Error("Router A/B normal-signing admission D1 database is required");
+		this.database = options.database;
+		this.storageNamespace = requireNonEmptyString("storageNamespace", options.storageNamespace);
+		this.now = options.now || Date.now;
+	}
+	async evaluateProjectPolicy(input) {
+		const row = await this.readDecision(input.runtimePolicyScope, "project_policy", runtimePolicyScopeKey(input.runtimePolicyScope));
+		return row === null ? { kind: "allowed" } : parseProjectPolicyDecision(row);
+	}
+	async evaluateAbuse(input) {
+		const row = await this.readDecision(input.runtimePolicyScope, "abuse", abusePrincipalKey(input));
+		return row === null ? { kind: "allowed" } : parseAbuseDecision(row);
+	}
+	async setProjectPolicy(scope, decision) {
+		const normalized = normalizeProjectPolicyDecision(decision);
+		await this.putDecision(scope, "project_policy", runtimePolicyScopeKey(scope), normalized.kind, normalized.kind === "rejected" ? normalized.retryAfterMs : null);
+	}
+	async clearProjectPolicy(scope) {
+		await this.deleteRecord(scope, "project_policy", runtimePolicyScopeKey(scope));
+	}
+	async setAbuseDecision(input, decision) {
+		const normalized = normalizeAbuseDecision(decision);
+		await this.putDecision(input.runtimePolicyScope, "abuse", abusePrincipalKey(input), normalized.kind, normalized.kind === "allowed" ? null : normalized.retryAfterMs);
+	}
+	async clearAbuseDecision(input) {
+		await this.deleteRecord(input.runtimePolicyScope, "abuse", abusePrincipalKey(input));
+	}
+	async readDecision(scope, kind, key) {
+		return await this.database.prepare(`SELECT decision, retry_after_ms
+           FROM ${ROUTER_AB_NORMAL_SIGNING_ADMISSION_TABLE}
+          WHERE namespace = ?1
+            AND org_id = ?2
+            AND project_id = ?3
+            AND env_id = ?4
+            AND signing_root_version = ?5
+            AND record_kind = ?6
+            AND record_key = ?7`).bind(this.storageNamespace, scope.orgId, scope.projectId, scope.envId, scope.signingRootVersion, kind, key).first();
+	}
+	async putDecision(scope, kind, key, decision, retryAfterMs) {
+		await requireSuccessfulD1Write(this.database.prepare(`INSERT INTO ${ROUTER_AB_NORMAL_SIGNING_ADMISSION_TABLE} (
+             namespace, org_id, project_id, env_id, signing_root_version,
+             record_kind, record_key, decision, retry_after_ms, updated_at_ms
+           ) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10)
+           ON CONFLICT (
+             namespace, org_id, project_id, env_id, signing_root_version, record_kind, record_key
+           ) DO UPDATE SET
+             decision = excluded.decision,
+             retry_after_ms = excluded.retry_after_ms,
+             updated_at_ms = excluded.updated_at_ms`).bind(this.storageNamespace, scope.orgId, scope.projectId, scope.envId, scope.signingRootVersion, kind, key, decision, retryAfterMs, this.now()));
+	}
+	async deleteRecord(scope, kind, key) {
+		await requireSuccessfulD1Write(this.database.prepare(`DELETE FROM ${ROUTER_AB_NORMAL_SIGNING_ADMISSION_TABLE}
+            WHERE namespace = ?1
+              AND org_id = ?2
+              AND project_id = ?3
+              AND env_id = ?4
+              AND signing_root_version = ?5
+              AND record_kind = ?6
+              AND record_key = ?7`).bind(this.storageNamespace, scope.orgId, scope.projectId, scope.envId, scope.signingRootVersion, kind, key));
+	}
+};
+function createCloudflareD1RouterAbNormalSigningAdmissionStore(options) {
+	return new CloudflareD1RouterAbNormalSigningAdmissionStore(options);
+}
+function normalizeProjectPolicyDecision(decision) {
+	switch (decision.kind) {
+		case "allowed": return { kind: "allowed" };
+		case "rejected": return {
+			kind: "rejected",
+			retryAfterMs: requirePositiveInteger("retryAfterMs", decision.retryAfterMs)
+		};
+		default: return assertNever(decision);
+	}
+}
+function normalizeAbuseDecision(decision) {
+	switch (decision.kind) {
+		case "allowed": return { kind: "allowed" };
+		case "rate_limited": return {
+			kind: "rate_limited",
+			retryAfterMs: requirePositiveInteger("retryAfterMs", decision.retryAfterMs)
+		};
+		case "rejected": return {
+			kind: "rejected",
+			retryAfterMs: requirePositiveInteger("retryAfterMs", decision.retryAfterMs)
+		};
+		default: return assertNever(decision);
+	}
+}
+function parseProjectPolicyDecision(row) {
+	const decision = requireNonEmptyString("decision", row.decision);
+	switch (decision) {
+		case "allowed": return { kind: "allowed" };
+		case "rejected": return {
+			kind: "rejected",
+			retryAfterMs: requirePositiveInteger("retry_after_ms", row.retry_after_ms)
+		};
+		default: throw new Error(`Unsupported Router A/B project-policy decision ${decision}`);
+	}
+}
+function parseAbuseDecision(row) {
+	const decision = requireNonEmptyString("decision", row.decision);
+	switch (decision) {
+		case "allowed": return { kind: "allowed" };
+		case "rate_limited": return {
+			kind: "rate_limited",
+			retryAfterMs: requirePositiveInteger("retry_after_ms", row.retry_after_ms)
+		};
+		case "rejected": return {
+			kind: "rejected",
+			retryAfterMs: requirePositiveInteger("retry_after_ms", row.retry_after_ms)
+		};
+		default: throw new Error(`Unsupported Router A/B abuse decision ${decision}`);
+	}
+}
+async function requireSuccessfulD1Write(statement) {
+	if (!isSuccessfulD1Result(await statement.run())) throw new Error("Router A/B normal-signing admission D1 write failed");
+}
+function isSuccessfulD1Result(result) {
+	return result.success === true;
+}
+function requireNonEmptyString(label, value) {
+	if (typeof value === "string" && value.trim().length > 0) return value.trim();
+	throw new Error(`${label} must be a non-empty string`);
+}
+function requirePositiveInteger(label, value) {
+	const numeric = typeof value === "bigint" ? Number(value) : value;
+	if (typeof numeric === "number" && Number.isSafeInteger(numeric) && numeric > 0) return numeric;
+	if (typeof numeric === "string") {
+		const parsed = Number(numeric);
+		if (Number.isSafeInteger(parsed) && parsed > 0) return parsed;
+	}
+	throw new Error(`${label} must be a positive integer`);
+}
+function assertNever(value) {
+	throw new Error(`Unexpected Router A/B normal-signing admission branch: ${String(value)}`);
+}
+//#endregion
+export { CloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1RouterAbNormalSigningAdmissionStore };
+
+//# sourceMappingURL=d1RouterAbNormalSigningAdmissionStore.js.map

package/dist/esm/router/cloudflare/d1/signingLanes/d1EcdsaLanePrivateBindingResolver.js

@@ -0,0 +1,10 @@
+import { CloudflareD1LaneLifecycleStore } from "./d1LaneLifecycleStore.js";
+import { LaneLifecycleStoreEcdsaLanePrivateBindingResolverV1 } from "../../signingLanes/cloudflareLaneCurveExecution.js";
+//#region src/router/cloudflare/d1/signingLanes/d1EcdsaLanePrivateBindingResolver.ts
+function createCloudflareD1EcdsaLanePrivateBindingResolverV1(options) {
+	return new LaneLifecycleStoreEcdsaLanePrivateBindingResolverV1(new CloudflareD1LaneLifecycleStore(options), options);
+}
+//#endregion
+export { createCloudflareD1EcdsaLanePrivateBindingResolverV1 };
+
+//# sourceMappingURL=d1EcdsaLanePrivateBindingResolver.js.map

package/dist/esm/router/cloudflare/d1/signingLanes/d1LaneAggregateRevocationApplicationService.js

@@ -0,0 +1,22 @@
+import { LaneLifecycleApplicationService } from "../../../../core/signingLanes/LaneLifecycleApplicationService.js";
+import { CloudflareD1LaneLifecycleStore } from "./d1LaneLifecycleStore.js";
+import { LaneEnrollmentRevocation } from "../../../../core/signingLanes/LaneEnrollmentRevocation.js";
+import { CloudflareD1LaneEnrollmentGateway } from "./d1LaneEnrollmentGateway.js";
+import { LaneAggregateRevocationApplicationService } from "../../../../core/signingLanes/LaneAggregateRevocationApplicationService.js";
+//#region src/router/cloudflare/d1/signingLanes/d1LaneAggregateRevocationApplicationService.ts
+function createCloudflareD1LaneAggregateRevocationApplicationService(options) {
+	const lifecycleStore = new CloudflareD1LaneLifecycleStore(options);
+	return new LaneAggregateRevocationApplicationService({
+		lifecycleStore,
+		laneLifecycle: new LaneLifecycleApplicationService({
+			gateway: new CloudflareD1LaneEnrollmentGateway({ lifecycleStore }),
+			authorization: options.authorization,
+			execution: options.execution
+		}),
+		enrollmentRevocation: new LaneEnrollmentRevocation(lifecycleStore)
+	});
+}
+//#endregion
+export { createCloudflareD1LaneAggregateRevocationApplicationService };
+
+//# sourceMappingURL=d1LaneAggregateRevocationApplicationService.js.map