@seams/wallet-server 0.6.1 → 0.7.1

package/dist/esm/core/signingLanes/ed25519ServerRetirement.js

@@ -29,9 +29,6 @@ async function parseAndVerifyEd25519ServerRetirementEffectV1(input) {
 		retirementReceiptDigestB64u: canonicalDigest
 	};
 }
-function assertEd25519ServerRetirementReceiptMatchesRequestV1(receipt, request) {
-	assertReceiptMatchesRequest(receipt, request);
-}
 function assertIdentityMatchesCommand(identity, command) {
 	if (identity.keyFamily !== "ed25519" || identity.walletId !== command.walletId || identity.walletKeyId !== command.walletKeyId || identity.targetLaneId !== command.laneId || identity.targetLaneShareEpoch !== command.laneShareEpoch) throw new Error("Ed25519 retirement binding identity does not match the authorized command");
 }
@@ -66,6 +63,6 @@ function parseOutcome(value, label) {
 	throw new Error(`${label} is invalid`);
 }
 //#endregion
-export { assertEd25519ServerRetirementReceiptMatchesRequestV1, buildEd25519ServerRetirementRequestV1, parseAndVerifyEd25519ServerRetirementEffectV1 };
+export { buildEd25519ServerRetirementRequestV1, parseAndVerifyEd25519ServerRetirementEffectV1 };
 
 //# sourceMappingURL=ed25519ServerRetirement.js.map

package/dist/esm/core/storeBackends.js

@@ -0,0 +1,208 @@
+import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
+import { isObject, isPlainObject } from "../shared-ts/src/utils/validation.js";
+import { resolveD1DatabaseFromConfig } from "../storage/d1Sql.js";
+import "./defaultConfigsServer.js";
+import { d1TenantScopeFromConfig } from "./d1TenantStore.js";
+import { RedisTcpClient, UpstashRedisRestClient, redisDel, redisGetJson, redisGetdelJson, redisSetJson } from "./ThresholdService/kv.js";
+//#region src/core/storeBackends.ts
+function isDurableObjectNamespaceLike(value) {
+	return isPlainObject(value) && typeof value.idFromName === "function" && typeof value.get === "function";
+}
+/** The first of `namespace`, `durableObjectNamespace` and `THRESHOLD_DO_NAMESPACE` that is one. */
+function resolveDurableObjectNamespace(config) {
+	const direct = config.namespace;
+	if (isDurableObjectNamespaceLike(direct)) return direct;
+	const alt = config.durableObjectNamespace;
+	if (isDurableObjectNamespaceLike(alt)) return alt;
+	const envStyle = config.THRESHOLD_DO_NAMESPACE;
+	if (isDurableObjectNamespaceLike(envStyle)) return envStyle;
+	return null;
+}
+/** The object a store config names: `objectName`, else `name`, else the default. */
+function durableObjectName(config) {
+	return normalizeOptionalTrimmedString(config.objectName) || normalizeOptionalTrimmedString(config.name) || "threshold-store";
+}
+function durableObjectStub(namespace, objectName) {
+	return namespace.get(namespace.idFromName(objectName));
+}
+/** Posts one JSON request to a store's Durable Object. */
+function postDurableObjectRequest(stub, body) {
+	return stub.fetch("https://threshold-store.invalid/", {
+		method: "POST",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify(body)
+	});
+}
+/**
+* Posts a request and parses the object's JSON reply; an empty reply reads as null. An HTTP error
+* or a reply that is not JSON throws, naming the store: `<storeName> DO store …`.
+*/
+async function requestDurableObjectJson(stub, body, storeName) {
+	const resp = await postDurableObjectRequest(stub, body);
+	const text = await resp.text();
+	if (!resp.ok) throw new Error(`${storeName} DO store HTTP ${resp.status}: ${text}`);
+	try {
+		return text ? JSON.parse(text) : null;
+	} catch {
+		throw new Error(`${storeName} DO store returned non-JSON response: ${text.slice(0, 200)}`);
+	}
+}
+async function callDo(stub, req, storeName) {
+	const json = await requestDurableObjectJson(stub, req, storeName);
+	if (!isObject(json)) throw new Error(`${storeName} DO store returned invalid JSON shape`);
+	if (json.ok === true) return json;
+	const code = normalizeOptionalTrimmedString(json.code);
+	const message = normalizeOptionalTrimmedString(json.message);
+	return {
+		ok: false,
+		code: code || "internal",
+		message: message || `${storeName} DO store error`
+	};
+}
+function upstashRecords(client, parse) {
+	return {
+		get: async (key) => parse(await client.getJson(key)),
+		take: async (key) => parse(await client.getdelJson(key)),
+		set: (key, record, ttlMs) => client.setJson(key, record, ttlMs),
+		del: (key) => client.del(key)
+	};
+}
+function redisTcpRecords(client, parse) {
+	return {
+		get: async (key) => parse(await redisGetJson(client, key)),
+		take: async (key) => parse(await redisGetdelJson(client, key)),
+		set: (key, record, ttlMs) => redisSetJson(client, key, record, ttlMs),
+		del: (key) => redisDel(client, key)
+	};
+}
+function durableObjectRecords(stub, parse, storeName) {
+	const read = async (op, key) => {
+		const resp = await callDo(stub, {
+			op,
+			key
+		}, storeName);
+		return parse(resp.ok ? resp.value : null);
+	};
+	const write = async (req) => {
+		const resp = await callDo(stub, req, storeName);
+		if (!resp.ok) throw new Error(resp.message);
+	};
+	return {
+		get: (key) => read("get", key),
+		take: (key) => read("getdel", key),
+		set: (key, record, ttlMs) => write({
+			op: "set",
+			key,
+			value: record,
+			ttlMs
+		}),
+		del: (key) => write({
+			op: "del",
+			key
+		})
+	};
+}
+/**
+* Selects a key-value store's backend: the config's explicit `kind`, else Upstash or Redis from
+* env-shaped config, else in memory. The store type `S` comes from the caller's return type.
+*/
+function createKeyValueStore(input, spec, build) {
+	const { tag, label, connectionErrorSubject, parse } = spec;
+	const config = isObject(input.config) ? input.config : {};
+	const prefix = spec.resolvePrefix(config);
+	const inMemory = () => build.inMemory(prefix);
+	const upstash = (url, token) => build.keyValue(upstashRecords(new UpstashRedisRestClient({
+		url,
+		token
+	}), parse), prefix);
+	const redisTcp = (redisUrl) => build.keyValue(redisTcpRecords(new RedisTcpClient(redisUrl), parse), prefix);
+	const kind = normalizeOptionalTrimmedString(config.kind);
+	if (kind === "d1") {
+		const database = resolveD1DatabaseFromConfig(config);
+		if (!database) throw new Error(`[${tag}] D1 ${label} store selected but no D1 database was provided`);
+		input.logger.info(`[${tag}] Using D1 ${label} store`);
+		const scope = d1TenantScopeFromConfig(config, prefix, spec.d1StoreName);
+		return build.d1({
+			database,
+			...scope
+		});
+	}
+	if (kind === "cloudflare-do") {
+		const namespace = resolveDurableObjectNamespace(config);
+		if (!namespace) throw new Error(`cloudflare-do ${tag} store selected but no Durable Object namespace was provided (expected config.namespace)`);
+		const objectName = durableObjectName(config);
+		input.logger.info(`[${tag}] Using Cloudflare Durable Object ${spec.durableObjectLog}`);
+		const stub = durableObjectStub(namespace, objectName);
+		return build.keyValue(durableObjectRecords(stub, parse, spec.durableObjectErrorName), prefix);
+	}
+	if (kind === "in-memory") {
+		input.logger.info(`[${tag}] Using in-memory ${label} store (non-persistent)`);
+		return inMemory();
+	}
+	if (kind === "upstash-redis-rest") {
+		const url = normalizeOptionalTrimmedString(config.url) || normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_URL);
+		const token = normalizeOptionalTrimmedString(config.token) || normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_TOKEN);
+		if (!url || !token) throw new Error(`Upstash ${connectionErrorSubject} enabled but url/token are not both set`);
+		input.logger.info(`[${tag}] Using Upstash REST ${label} store`);
+		return upstash(url, token);
+	}
+	if (kind === "redis-tcp") {
+		if (!input.isNode) {
+			input.logger.warn(`[${tag}] redis-tcp ${label} store is not supported in this runtime; falling back to in-memory`);
+			return inMemory();
+		}
+		const redisUrl = normalizeOptionalTrimmedString(config.redisUrl) || normalizeOptionalTrimmedString(config.REDIS_URL);
+		if (!redisUrl) throw new Error(`redis-tcp ${connectionErrorSubject} enabled but redisUrl is not set`);
+		input.logger.info(`[${tag}] Using redis-tcp ${label} store`);
+		return redisTcp(redisUrl);
+	}
+	if (kind) throw new Error(`[${tag}] Unknown ${label} store kind: ${kind}`);
+	const upstashUrl = normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_URL);
+	const upstashToken = normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_TOKEN);
+	if (upstashUrl || upstashToken) {
+		if (!upstashUrl || !upstashToken) throw new Error(`Upstash ${connectionErrorSubject} enabled but UPSTASH_REDIS_REST_URL / UPSTASH_REDIS_REST_TOKEN are not both set`);
+		input.logger.info(`[${tag}] Using Upstash REST ${label} store`);
+		return upstash(upstashUrl, upstashToken);
+	}
+	const redisUrl = normalizeOptionalTrimmedString(config.REDIS_URL);
+	if (redisUrl) {
+		if (!input.isNode) {
+			input.logger.warn(`[${tag}] REDIS_URL is set but TCP Redis is not supported in this runtime; falling back to in-memory`);
+			return inMemory();
+		}
+		input.logger.info(`[${tag}] Using redis-tcp ${label} store`);
+		return redisTcp(redisUrl);
+	}
+	input.logger.info(`[${tag}] Using in-memory ${label} store (${spec.unconfiguredNote})`);
+	return inMemory();
+}
+/** Selects the backend the config's `kind` names: D1, a Durable Object, or else memory. */
+function createDurableObjectStore(input, spec, build) {
+	const { tag } = spec;
+	const config = isPlainObject(input.config) ? input.config : {};
+	const prefix = spec.resolvePrefix(config);
+	const kind = normalizeOptionalTrimmedString(config.kind);
+	if (kind === "d1") {
+		const database = resolveD1DatabaseFromConfig(config);
+		if (!database) throw new Error(`[${tag}] D1 store selected but no D1 database was provided`);
+		input.logger.info(`[${tag}] Using D1 store`);
+		return build.d1({
+			database,
+			...d1TenantScopeFromConfig(config, prefix, spec.d1StoreName)
+		});
+	}
+	if (kind === "cloudflare-do") {
+		const namespace = resolveDurableObjectNamespace(config);
+		if (!namespace) throw new Error(`cloudflare-do ${spec.name} store selected but no Durable Object namespace was provided`);
+		const objectName = durableObjectName(config);
+		input.logger.info(`[${tag}] Using Cloudflare Durable Object store`);
+		return build.durableObject(durableObjectStub(namespace, objectName), prefix);
+	}
+	if (kind) throw new Error(`[${tag}] Unknown ${spec.name} store kind: ${kind}`);
+	input.logger.info(`[${tag}] ${spec.inMemoryLog}`);
+	return build.inMemory(prefix);
+}
+//#endregion
+export { createDurableObjectStore, createKeyValueStore, durableObjectName, durableObjectStub, postDurableObjectRequest, requestDurableObjectJson, resolveDurableObjectNamespace };
+
+//# sourceMappingURL=storeBackends.js.map

package/dist/esm/core/thresholdEcdsaChainTarget.js

@@ -37,13 +37,7 @@ function thresholdEcdsaChainTargetKey(target) {
 function thresholdEcdsaChainTargetsEqual(left, right) {
 	return thresholdEcdsaChainTargetKey(left) === thresholdEcdsaChainTargetKey(right);
 }
-function thresholdEcdsaChainTargetsShareEvmFamilyAddress(left, right) {
-	return isEvmFamilyAddressTarget(left) && isEvmFamilyAddressTarget(right);
-}
-function isEvmFamilyAddressTarget(target) {
-	return target.kind === "evm" || target.kind === "tempo";
-}
 //#endregion
-export { thresholdEcdsaChainTargetFromValue, thresholdEcdsaChainTargetKey, thresholdEcdsaChainTargetsEqual, thresholdEcdsaChainTargetsShareEvmFamilyAddress };
+export { thresholdEcdsaChainTargetFromValue, thresholdEcdsaChainTargetKey, thresholdEcdsaChainTargetsEqual };
 
 //# sourceMappingURL=thresholdEcdsaChainTarget.js.map

package/dist/esm/core/webAuthnD1Statements.js

@@ -0,0 +1,92 @@
+//#region src/core/webAuthnD1Statements.ts
+/** Binds the scope, then the user and the record's seven columns. */
+const INSERT_WEBAUTHN_AUTHENTICATOR_SQL = `INSERT INTO webauthn_authenticators (
+        namespace,
+        org_id,
+        project_id,
+        env_id,
+        user_id,
+        credential_id_b64u,
+        credential_public_key_b64u,
+        counter,
+        created_at_ms,
+        updated_at_ms,
+        device_info_json
+      )
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`;
+/**
+* The insert, which on a credential collision keeps the lowest creation time and the highest
+* counter and update time. Binds as the insert does.
+*/
+const UPSERT_WEBAUTHN_AUTHENTICATOR_SQL = `${INSERT_WEBAUTHN_AUTHENTICATOR_SQL}
+      ON CONFLICT (namespace, org_id, project_id, env_id, user_id, credential_id_b64u)
+      DO UPDATE SET
+        credential_public_key_b64u = EXCLUDED.credential_public_key_b64u,
+        counter = MAX(webauthn_authenticators.counter, EXCLUDED.counter),
+        created_at_ms = MIN(webauthn_authenticators.created_at_ms, EXCLUDED.created_at_ms),
+        updated_at_ms = MAX(webauthn_authenticators.updated_at_ms, EXCLUDED.updated_at_ms),
+        device_info_json = EXCLUDED.device_info_json`;
+/** Statements on `webauthn_authenticators`. */
+const webAuthnAuthenticatorRows = { select: (prepare, userId, credentialIdB64u) => prepare(`SELECT credential_id_b64u, credential_public_key_b64u, counter, created_at_ms, updated_at_ms, device_info_json
+         FROM webauthn_authenticators
+        WHERE namespace = ?
+          AND org_id = ?
+          AND project_id = ?
+          AND env_id = ?
+          AND user_id = ?
+          AND credential_id_b64u = ?
+        LIMIT 1`, [userId, credentialIdB64u]) };
+/** Statements on `webauthn_credential_bindings`. */
+const webAuthnCredentialBindingRows = { select: (prepare, rpId, credentialIdB64u) => prepare(`SELECT record_json
+         FROM webauthn_credential_bindings
+        WHERE namespace = ?
+          AND org_id = ?
+          AND project_id = ?
+          AND env_id = ?
+          AND rp_id = ?
+          AND credential_id_b64u = ?
+        LIMIT 1`, [rpId, credentialIdB64u]) };
+/** Statements on `webauthn_challenges`. */
+const webAuthnChallengeRows = {
+	upsert: (prepare, input) => prepare(`INSERT INTO webauthn_challenges (
+        namespace,
+        org_id,
+        project_id,
+        env_id,
+        challenge_id,
+        challenge_kind,
+        record_json,
+        created_at_ms,
+        expires_at_ms
+      )
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT (namespace, org_id, project_id, env_id, challenge_id)
+      DO UPDATE SET
+        challenge_kind = EXCLUDED.challenge_kind,
+        record_json = EXCLUDED.record_json,
+        created_at_ms = EXCLUDED.created_at_ms,
+        expires_at_ms = EXCLUDED.expires_at_ms`, [
+		input.challengeId,
+		input.challengeKind,
+		JSON.stringify(input.record),
+		input.createdAtMs,
+		input.expiresAtMs
+	]),
+	consume: (prepare, challengeId, challengeKind, nowMs) => prepare(`DELETE FROM webauthn_challenges
+        WHERE namespace = ?
+          AND org_id = ?
+          AND project_id = ?
+          AND env_id = ?
+          AND challenge_id = ?
+          AND challenge_kind = ?
+          AND expires_at_ms > ?
+        RETURNING record_json`, [
+		challengeId,
+		challengeKind,
+		nowMs
+	])
+};
+//#endregion
+export { INSERT_WEBAUTHN_AUTHENTICATOR_SQL, UPSERT_WEBAUTHN_AUTHENTICATOR_SQL, webAuthnAuthenticatorRows, webAuthnChallengeRows, webAuthnCredentialBindingRows };
+
+//# sourceMappingURL=webAuthnD1Statements.js.map

package/dist/esm/core/webAuthnStoreBackends.js

@@ -0,0 +1,198 @@
+import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
+import "../shared-ts/src/utils/validation.js";
+import { parseD1JsonColumn } from "../storage/d1Sql.js";
+import { D1TenantTable, ensureD1Schema, resolveStorePrefix } from "./d1TenantStore.js";
+import { createKeyValueStore } from "./storeBackends.js";
+import { webAuthnChallengeRows } from "./webAuthnD1Statements.js";
+//#region src/core/webAuthnStoreBackends.ts
+/**
+* A store's key prefix, which is also its D1 namespace: `config[spec.prefixConfigKey]` when set,
+* else `<THRESHOLD_PREFIX>:webauthn:<spec.prefixName>:`. It always ends with a colon.
+*/
+function resolveWebAuthnStorePrefix(config, spec) {
+	return resolveStorePrefix(config, [spec.prefixConfigKey], `webauthn:${spec.prefixName}:`);
+}
+/**
+* Selects a WebAuthn store's backend: the config's explicit `kind`, else Upstash or Redis from
+* env-shaped config, else in memory. The store type `S` comes from the caller's return type.
+*/
+function createWebAuthnStore(input, spec, build) {
+	return createKeyValueStore(input, {
+		tag: "webauthn",
+		label: spec.label,
+		connectionErrorSubject: spec.connectionErrorSubject,
+		durableObjectLog: `store for ${spec.durableObjectLogSubject}`,
+		durableObjectErrorName: "WebAuthn",
+		unconfiguredNote: spec.unconfiguredNote,
+		d1StoreName: webAuthnD1Store(spec.d1ScopeLabel),
+		resolvePrefix: (config) => resolveWebAuthnStorePrefix(config, spec),
+		parse: spec.parse
+	}, {
+		d1: build.d1,
+		keyValue: build.keyValue,
+		inMemory: (prefix) => build.inMemory(new InMemoryWebAuthnRecords(), prefix)
+	});
+}
+/** Keeps each record as it was put, without expiry; reads return the stored object. */
+var InMemoryWebAuthnRecords = class {
+	constructor() {
+		this.map = /* @__PURE__ */ new Map();
+	}
+	async get(key) {
+		return this.map.get(key) ?? null;
+	}
+	async take(key) {
+		const record = this.map.get(key) ?? null;
+		this.map.delete(key);
+		return record;
+	}
+	async set(key, record) {
+		this.map.set(key, record);
+	}
+	async del(key) {
+		this.map.delete(key);
+	}
+};
+/**
+* Per-credential records under `${prefix}${ownerId}:${credentialIdB64u}`, where the owner is the
+* user for authenticators and the RP ID for credential bindings. A blank id reads as missing.
+*/
+var WebAuthnCredentialRecords = class {
+	constructor(records, prefix) {
+		this.records = records;
+		this.prefix = prefix;
+	}
+	async get(ownerId, credentialIdB64u) {
+		const key = this.trimmedKey(ownerId, credentialIdB64u);
+		return key ? this.records.get(key) : null;
+	}
+	async set(ownerId, credentialIdB64u, record) {
+		await this.records.set(this.key(ownerId, credentialIdB64u), record);
+	}
+	async del(ownerId, credentialIdB64u) {
+		const key = this.trimmedKey(ownerId, credentialIdB64u);
+		if (key) await this.records.del(key);
+	}
+	key(ownerId, credentialIdB64u) {
+		return `${this.prefix}${ownerId}:${credentialIdB64u}`;
+	}
+	trimmedKey(ownerId, credentialIdB64u) {
+		const owner = normalizeOptionalTrimmedString(ownerId);
+		const credential = normalizeOptionalTrimmedString(credentialIdB64u);
+		return owner && credential ? this.key(owner, credential) : null;
+	}
+};
+/** Names a WebAuthn store in D1 scope errors, e.g. `WebAuthn credential store`. */
+function webAuthnD1Store(d1ScopeLabel) {
+	return `WebAuthn ${d1ScopeLabel} store`;
+}
+const WEBAUTHN_CHALLENGE_STORE_D1_SCHEMA_SQL = Object.freeze([`
+    CREATE TABLE IF NOT EXISTS webauthn_challenges (
+      namespace TEXT NOT NULL,
+      org_id TEXT NOT NULL,
+      project_id TEXT NOT NULL,
+      env_id TEXT NOT NULL,
+      challenge_id TEXT NOT NULL,
+      challenge_kind TEXT NOT NULL,
+      record_json TEXT NOT NULL,
+      created_at_ms INTEGER NOT NULL,
+      expires_at_ms INTEGER NOT NULL,
+      PRIMARY KEY (namespace, org_id, project_id, env_id, challenge_id),
+      CHECK (length(challenge_id) > 0),
+      CHECK (challenge_kind IN ('login', 'sync', 'recovery_registration')),
+      CHECK (json_valid(record_json)),
+      CHECK (created_at_ms > 0),
+      CHECK (expires_at_ms > created_at_ms)
+    )
+  `, `
+    CREATE INDEX IF NOT EXISTS webauthn_challenges_expiry_idx
+      ON webauthn_challenges (
+        namespace,
+        org_id,
+        project_id,
+        env_id,
+        challenge_kind,
+        expires_at_ms
+      )
+  `]);
+async function ensureWebAuthnChallengeStoreD1Schema(options) {
+	await ensureD1Schema(options.database, WEBAUTHN_CHALLENGE_STORE_D1_SCHEMA_SQL);
+}
+function createWebAuthnChallengeStore(input, spec, d1) {
+	const keyValue = (records, prefix) => new KeyValueWebAuthnChallengeStore(records, prefix, spec);
+	return createWebAuthnStore(input, spec, {
+		d1,
+		keyValue,
+		inMemory: keyValue
+	});
+}
+var KeyValueWebAuthnChallengeStore = class {
+	constructor(records, prefix, spec) {
+		this.records = records;
+		this.prefix = prefix;
+		this.spec = spec;
+	}
+	async put(record) {
+		const parsed = this.spec.parse(record);
+		if (!parsed) throw new Error(`Invalid ${this.spec.label} record`);
+		const ttlMs = Math.max(1, parsed.expiresAtMs - Date.now());
+		await this.records.set(`${this.prefix}${parsed.challengeId}`, parsed, ttlMs);
+	}
+	async consume(challengeId) {
+		const id = normalizeOptionalTrimmedString(challengeId);
+		if (!id) return null;
+		const record = await this.records.take(`${this.prefix}${id}`);
+		if (!record) return null;
+		if (Date.now() > record.expiresAtMs) return null;
+		return record;
+	}
+	async del(challengeId) {
+		const id = normalizeOptionalTrimmedString(challengeId);
+		if (!id) return;
+		await this.records.del(`${this.prefix}${id}`);
+	}
+};
+var D1WebAuthnChallengeStore = class {
+	constructor(input, spec) {
+		this.spec = spec;
+		this.adapterKind = "d1";
+		this.prepare = (sql, values) => this.table.prepare(sql, values);
+		this.table = new D1TenantTable(input, webAuthnD1Store(spec.d1ScopeLabel), WEBAUTHN_CHALLENGE_STORE_D1_SCHEMA_SQL);
+		this.now = input.now || (() => /* @__PURE__ */ new Date());
+	}
+	async put(record) {
+		await this.table.ensureSchema();
+		const parsed = this.spec.parse(record);
+		if (!parsed) throw new Error(`Invalid ${this.spec.label} record`);
+		await webAuthnChallengeRows.upsert(this.prepare, {
+			challengeId: parsed.challengeId,
+			challengeKind: this.spec.challengeKind,
+			record: parsed,
+			createdAtMs: parsed.createdAtMs,
+			expiresAtMs: parsed.expiresAtMs
+		}).run();
+	}
+	async consume(challengeId) {
+		await this.table.ensureSchema();
+		const id = normalizeOptionalTrimmedString(challengeId);
+		if (!id) return null;
+		const row = await webAuthnChallengeRows.consume(this.prepare, id, this.spec.challengeKind, this.now().getTime()).first();
+		return this.spec.parse(parseD1JsonColumn(row?.record_json));
+	}
+	async del(challengeId) {
+		await this.table.ensureSchema();
+		const id = normalizeOptionalTrimmedString(challengeId);
+		if (!id) return;
+		await this.table.prepare(`DELETE FROM webauthn_challenges
+          WHERE namespace = ?
+            AND org_id = ?
+            AND project_id = ?
+            AND env_id = ?
+            AND challenge_id = ?
+            AND challenge_kind = ?`, [id, this.spec.challengeKind]).run();
+	}
+};
+//#endregion
+export { D1WebAuthnChallengeStore, InMemoryWebAuthnRecords, WEBAUTHN_CHALLENGE_STORE_D1_SCHEMA_SQL, WebAuthnCredentialRecords, createWebAuthnChallengeStore, createWebAuthnStore, ensureWebAuthnChallengeStoreD1Schema, resolveWebAuthnStorePrefix, webAuthnD1Store };
+
+//# sourceMappingURL=webAuthnStoreBackends.js.map

package/dist/esm/hosted-wallet-gateway.js

@@ -26,6 +26,7 @@ import { CloudflareD1RouterAbEd25519YaoCapabilityPersistence } from "./router/cl
 import { createSigningSessionSealOptions } from "./threshold/session/signingSessionSeal/options.js";
 import { createRouterAbEcdsaEd25519CeremonyTokenIssuer, createRouterAbEcdsaStrictPostRegistrationPort, createRouterAbEcdsaStrictRegistrationPort, parseRouterAbEcdsaEd25519PrivateJwk, parseRouterAbEcdsaStrictRegistrationTopology } from "./router/domains/ecdsa/routerAbEcdsaStrictRegistration.js";
 import { createD1LinkedDeviceSourceContributionPreparationPlannerV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceSourceContributionPreparationPlanner.js";
+import { readD1LinkedDeviceEcdsaSourceV1, readD1LinkedDeviceEd25519SourceV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService.js";
 import { D1LinkedDeviceTargetCredentialProviderV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetCredentialProvider.js";
 import { createD1LinkedDeviceOwnerSourceChildReaderV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceOwnerAuthorizationProvider.js";
 import { createCloudflareD1RouterApiAuthService } from "./router/cloudflare/d1/auth/d1RouterApiAuthService.js";
@@ -83,7 +84,7 @@ function createStagingEd25519YaoBackend(env, resolveTenantRoot) {
 		env: {
 			MPC_ROUTER_URL: ROUTER_AB_MPC_ROUTER_ORIGIN,
 			SIGNING_WORKER_ID: requireEnvironmentString(env, "SIGNING_WORKER_ID"),
-			ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET: requireEnvironmentString(env, "ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET"),
+			ROUTER_AB_GATEWAY_TO_ROUTER_AUTH_SECRET: requireEnvironmentString(env, "ROUTER_AB_GATEWAY_TO_ROUTER_AUTH_SECRET"),
 			DERIVER_A_ED25519_YAO_INPUT_PUBLIC_KEY: keyEnvironment.DERIVER_A_ED25519_YAO_INPUT_PUBLIC_KEY,
 			DERIVER_B_ED25519_YAO_INPUT_PUBLIC_KEY: keyEnvironment.DERIVER_B_ED25519_YAO_INPUT_PUBLIC_KEY,
 			SIGNING_WORKER_SERVER_OUTPUT_HPKE_PUBLIC_KEY: keyEnvironment.SIGNING_WORKER_SERVER_OUTPUT_HPKE_PUBLIC_KEY
@@ -133,7 +134,10 @@ async function resolveStagingDeploymentTenantRoot(scope, tenantRootCustodyLineag
 	const identity = stagingTenantRootIdentity(scope, applicationBinding, signingRootVersion);
 	const tenantRoot = await tenantRootCustodyLineage.resolveActiveLineage(identity);
 	if (!tenantRoot) throw new Error("Ed25519 tenant root is not active");
-	return tenantRoot;
+	return {
+		identity,
+		...tenantRoot
+	};
 }
 async function resolveStagingRegistrationTenantRoot(context, input) {
 	switch (input.operation) {
@@ -208,7 +212,7 @@ async function createStagingRouterApiAuthComposition(env, scope, yaoRuntime, ten
 			relayerPublicKey: readEnvironmentString(env, "RELAYER_PUBLIC_KEY"),
 			relayerPrivateKey: readEnvironmentString(env, "RELAYER_PRIVATE_KEY"),
 			nearRpcUrl: readEnvironmentString(env, "NEAR_RPC_URL"),
-			signerWasmModuleOrPath: loadCloudflareSignerWasmModule,
+			signerWasmModuleOrPath: dependencies.signerWasm ?? loadCloudflareSignerWasmModule,
 			accountInitialBalance: readEnvironmentString(env, "ACCOUNT_INITIAL_BALANCE"),
 			implicitNearAccountTestFundingEnabled: readEnvironmentString(env, "ENABLE_IMPLICIT_NEAR_ACCOUNT_TEST_FUNDING"),
 			googleOidcClientId: readEnvironmentString(env, "GOOGLE_OIDC_CLIENT_ID"),
@@ -278,7 +282,15 @@ function stagingLinkedDeviceSessionComposition(env, scope, tenantRootCustodyLine
 			...scope,
 			ensureSchema: false
 		}),
-		walletStore
+		walletStore,
+		readLinkedEd25519SourceV1: readD1LinkedDeviceEd25519SourceV1.bind(void 0, {
+			database: env.SIGNER_DB,
+			scope
+		}),
+		readLinkedEcdsaSourceV1: readD1LinkedDeviceEcdsaSourceV1.bind(void 0, {
+			database: env.SIGNER_DB,
+			scope
+		})
 	});
 	const serviceFetch = createRouterAbServiceBindingFetch(env);
 	const internalServiceAuthSecret = requireEnvironmentString(env, "ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET");
@@ -306,30 +318,33 @@ function stagingLinkedDeviceSessionComposition(env, scope, tenantRootCustodyLine
 		authorityInstallation: {
 			reservationEndpoint: createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1({
 				fetch: serviceFetch,
-				internalServiceAuthSecret
+				internalServiceAuthSecret,
+				tenant: scope
 			}),
 			activationEndpoint: createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1({
 				fetch: serviceFetch,
-				internalServiceAuthSecret
+				internalServiceAuthSecret,
+				tenant: scope
 			}),
 			deactivationEndpoint: createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1({
 				fetch: serviceFetch,
-				internalServiceAuthSecret
+				internalServiceAuthSecret,
+				tenant: scope
 			})
 		},
 		sourceContributionRouter: createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1({
 			fetch: serviceFetch,
-			internalServiceAuthSecret,
+			internalServiceAuthSecret: requireEnvironmentString(env, "ROUTER_AB_GATEWAY_TO_ROUTER_AUTH_SECRET"),
 			resolveTenantRoot: createStagingLinkedDeviceTenantRootResolver(scope, tenantRootCustodyLineage)
 		})
 	} };
 }
 /**
-* The split Wallet Gateway (R105 Phase 4 cutover target): serves the Wallet
-* runtime only, holds no Console database binding, and reaches the Wallet
-* Console deployment exclusively through the exact service-binding ops.
-* The sponsored-relay route extensions stay on the Wallet Console deployment
-* until policy/sponsorship resolution operations join the binding.
+* The split Wallet Gateway: serves the Wallet runtime only, holds no Console
+* database binding, and reaches the Wallet Console deployment exclusively
+* through the exact service-binding ops. The sponsored-relay route extensions
+* stay on the Wallet Console deployment until policy/sponsorship resolution
+* operations join the binding.
 */
 async function createHostedWalletGatewayCompositionV1(env, dependencies = {}) {
 	const scope = stagingTenantScope(env);
@@ -352,7 +367,7 @@ async function createHostedWalletGatewayCompositionV1(env, dependencies = {}) {
 				sessionCookieName: readEnvironmentString(env, "SESSION_COOKIE_NAME"),
 				routerAbPublicKeyset: requireStagingRouterAbPublicKeyset(env),
 				routerAbNormalSigningRouterProxy: {
-					internalServiceAuthSecret: requireEnvironmentString(env, "ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET"),
+					internalServiceAuthSecret: requireEnvironmentString(env, "ROUTER_AB_GATEWAY_TO_ROUTER_AUTH_SECRET"),
 					fetch: (request) => env.MPC_ROUTER.fetch(request)
 				},
 				routerAbEcdsaStrictPostRegistration: ecdsaStrictPostRegistration,
@@ -494,6 +509,8 @@ function stagingSigningSessionSealOptions(env) {
 	return cachedStagingSigningSessionSealOptions;
 }
 function createStagingEcdsaPresignRuntime(env) {
+	const presignAuthSecret = requireEnvironmentString(env, "ROUTER_AB_GATEWAY_TO_SIGNING_WORKER_PRESIGN_AUTH_SECRET");
+	if (presignAuthSecret === requireEnvironmentString(env, "ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET") || presignAuthSecret === requireEnvironmentString(env, "ROUTER_AB_GATEWAY_TO_ROUTER_AUTH_SECRET")) throw new Error("Gateway-to-SigningWorker presign auth secret must be role-specific");
 	return new RouterAbEcdsaPresignRuntime({
 		config: {
 			nodeRole: "coordinator",
@@ -508,7 +525,7 @@ function createStagingEcdsaPresignRuntime(env) {
 			signingWorkerBaseUrl: ROUTER_AB_SIGNING_WORKER_ORIGIN,
 			auth: {
 				kind: "internal_service_auth_secret",
-				secret: requireEnvironmentString(env, "ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET")
+				secret: presignAuthSecret
 			},
 			fetchImpl: createRouterAbServiceBindingFetch(env)
 		},
@@ -638,7 +655,7 @@ function createStagingYaoRequestScopedRuntime(env, resolveTenantRoot) {
 * This is new composition wiring over the existing authorization classes, not a
 * second authorization implementation: the same adapter the tenant runtime uses
 * is constructed here against request-scoped state instead of runtime-held
-* state, which is the dependency Refactor 93 exists to remove.
+* state, which is the dependency this wiring exists to remove.
 */
 function createStagingRecoveryRequestScopedDependencies(env, tenantRootCustodyLineage, dependencies = {}) {
 	const scope = stagingTenantScope(env);