@seams/wallet-server 0.6.2 → 0.7.1

package/dist/esm/localIntendedYaoSigningFault.js

@@ -0,0 +1,127 @@
+import { isLocalIntendedYaoFaultTokenV1 } from "./localIntendedYaoFault.js";
+//#region src/localIntendedYaoSigningFault.ts
+const LOCAL_INTENDED_YAO_SIGNING_FAULT_HEADER_V1 = "x-seams-intended-yao-signing-fault-v1";
+const LOCAL_INTENDED_YAO_SIGNING_FAULT_TOKEN_HEADER_V1 = "x-seams-intended-yao-signing-fault-token-v1";
+const LOCAL_INTENDED_YAO_FAULT_PROOF_HEADER_V1 = "x-seams-intended-yao-fault-proof-v1";
+const ROUTER_AB_ED25519_SIGNING_FINALIZE_PATH_V1 = "/router-ab/ed25519/sign";
+const SIGNING_WORKER_LOCAL_INTENDED_HOLD_URL_V1 = "https://signing-worker.router-ab.internal/router-ab/signing-worker/local-intended/hold";
+const ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1 = "x-router-ab-internal-service-auth";
+const keptFinalizes = /* @__PURE__ */ new Map();
+function parseLocalIntendedYaoSigningFaultModeV1(value) {
+	switch (value) {
+		case "capture_signing_finalize":
+		case "withhold_signing_finalize":
+		case "release_signing_finalize":
+		case "arm_signing_worker_hold":
+		case "read_signing_worker_hold": return value;
+		default: return null;
+	}
+}
+function parseLocalIntendedYaoSigningFaultTokenV1(value) {
+	return isLocalIntendedYaoFaultTokenV1(value) ? value : null;
+}
+/** The Gateway's Router binding, keeping the first NEAR finalize it carries. */
+var LocalIntendedYaoSigningFaultControllerV1 = class {
+	constructor(baseFetch, mode, token) {
+		this.baseFetch = baseFetch;
+		this.mode = mode;
+		this.token = token;
+		this.kept = false;
+	}
+	async fetch(input, init) {
+		const request = new Request(input, init);
+		if (request.method !== "POST" || new URL(request.url).pathname !== "/router-ab/ed25519/sign") return await this.baseFetch.call(globalThis, request);
+		const kept = {
+			url: request.url,
+			headers: [...request.headers],
+			body: await request.clone().text()
+		};
+		if (this.mode === "withhold_signing_finalize") {
+			this.keep({
+				request: kept,
+				original: null
+			});
+			return Response.json({
+				ok: false,
+				code: "intended_signing_finalize_withheld",
+				message: "Local intended fault withheld this NEAR finalize from the Router"
+			}, { status: 409 });
+		}
+		const response = await this.baseFetch.call(globalThis, request);
+		this.keep({
+			request: kept,
+			original: {
+				status: response.status,
+				body: await response.clone().text()
+			}
+		});
+		return response;
+	}
+	keep(finalize) {
+		this.kept = true;
+		if (!keptFinalizes.has(this.token)) keptFinalizes.set(this.token, finalize);
+	}
+	outcome() {
+		if (!this.kept) return `${this.token}:violated:signing_finalize_not_observed`;
+		return this.mode === "withhold_signing_finalize" ? `${this.token}:signing_finalize_withheld` : `${this.token}:signing_finalize_captured`;
+	}
+};
+/** Sends the finalize kept under `token` to the Router again, exactly. */
+async function releaseLocalIntendedYaoSigningFinalizeV1(router, token) {
+	const kept = keptFinalizes.get(token);
+	if (!kept) return Response.json({ code: "intended_signing_finalize_missing" }, { status: 404 });
+	keptFinalizes.delete(token);
+	const reply = await router.fetch(new Request(kept.request.url, {
+		method: "POST",
+		headers: kept.request.headers.map(([name, value]) => [name, value]),
+		body: kept.request.body
+	}));
+	return Response.json({
+		status: reply.status,
+		body: await reply.text(),
+		original: kept.original
+	});
+}
+/**
+* Arms or reads the SigningWorker's hold on one wallet's next NEAR finalize,
+* with the Gateway's own SigningWorker credential, and answers with the
+* SigningWorker's reply.
+*/
+async function commandLocalIntendedSigningWorkerHoldV1(signingWorker, credential, mode, body) {
+	const walletId = body?.wallet_id;
+	if (!credential || typeof walletId !== "string" || walletId === "") return Response.json({ code: "invalid_intended_signing_worker_hold" }, { status: 400 });
+	const reply = await signingWorker.fetch(new Request(SIGNING_WORKER_LOCAL_INTENDED_HOLD_URL_V1, {
+		method: "POST",
+		headers: {
+			"content-type": "application/json",
+			[ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1]: credential
+		},
+		body: JSON.stringify({
+			command: mode === "arm_signing_worker_hold" ? "arm" : "read",
+			wallet_id: walletId
+		})
+	}));
+	return Response.json({
+		status: reply.status,
+		body: await reply.text()
+	});
+}
+function requestWithoutLocalIntendedYaoSigningFaultHeadersV1(request) {
+	const headers = new Headers(request.headers);
+	headers.delete(LOCAL_INTENDED_YAO_SIGNING_FAULT_HEADER_V1);
+	headers.delete(LOCAL_INTENDED_YAO_SIGNING_FAULT_TOKEN_HEADER_V1);
+	return new Request(request, { headers });
+}
+function responseWithLocalIntendedYaoSigningFaultOutcomeV1(response, outcome) {
+	const headers = new Headers(response.headers);
+	headers.set(LOCAL_INTENDED_YAO_FAULT_PROOF_HEADER_V1, outcome);
+	return new Response(response.body, {
+		status: response.status,
+		statusText: response.statusText,
+		headers
+	});
+}
+//#endregion
+export { LOCAL_INTENDED_YAO_SIGNING_FAULT_HEADER_V1, LOCAL_INTENDED_YAO_SIGNING_FAULT_TOKEN_HEADER_V1, LocalIntendedYaoSigningFaultControllerV1, ROUTER_AB_ED25519_SIGNING_FINALIZE_PATH_V1, commandLocalIntendedSigningWorkerHoldV1, parseLocalIntendedYaoSigningFaultModeV1, parseLocalIntendedYaoSigningFaultTokenV1, releaseLocalIntendedYaoSigningFinalizeV1, requestWithoutLocalIntendedYaoSigningFaultHeadersV1, responseWithLocalIntendedYaoSigningFaultOutcomeV1 };
+
+//# sourceMappingURL=localIntendedYaoSigningFault.js.map

package/dist/esm/router/auth/authRequestValidation.js

@@ -259,6 +259,6 @@ function parseAuthIdentityMutationRequest(input) {
 	}
 }
 //#endregion
-export { parseAuthIdentityMutationRequest, parseAuthLinkIdentityRequest, parseAuthProviderAction, parseAuthProviderActionPath, parseAuthUnlinkIdentityRequest, parseGoogleLoginVerifyRequest, parsePasskeyLoginOptionsRequest, parsePasskeyLoginVerifyRequest };
+export { parseAuthIdentityMutationRequest, parseAuthProviderActionPath, parseGoogleLoginVerifyRequest, parsePasskeyLoginOptionsRequest, parsePasskeyLoginVerifyRequest };
 
 //# sourceMappingURL=authRequestValidation.js.map

package/dist/esm/router/auth/commonRouterUtils.js

@@ -27,7 +27,14 @@ function resolveWalletSessionOperationCredentialAdmissionFromContext(input) {
 		retiredAtMs: context.retiredAtMs,
 		nowMs: input.nowMs
 	});
-	if (!admission.ok || admission.keyFamily !== input.operation.keyFamily) return { kind: "rejected" };
+	if (!admission.ok || admission.keyFamily !== input.operation.keyFamily) {
+		console.warn("[wallet-session] operation credential refused", {
+			keyFamily: input.operation.keyFamily,
+			operationKind: input.operation.operationKind,
+			error: admission.ok ? "key_family_mismatch" : admission.error
+		});
+		return { kind: "rejected" };
+	}
 	if (admission.keyFamily === "ed25519") return {
 		kind: "admitted",
 		admission: {
@@ -166,6 +173,7 @@ async function validateEcdsaPreprocessingSession(input) {
 			ok: true,
 			kind: "ecdsa_preprocessing_session",
 			session,
+			ownerWalletScope: context.ownerWalletScope,
 			signer: admission.signer,
 			materialActivation: admission.materialActivation
 		};
@@ -343,6 +351,6 @@ async function resolveRuntimeProjectEnvironment(input) {
 	}
 }
 //#endregion
-export { resolveActiveRuntimePolicyScopeForEnvironment, resolveActiveRuntimePolicyScopeFromFields, resolveThresholdRuntimePolicyScope, resolveWalletSessionAdministrationAdmission, resolveWalletSessionOperationCredentialAdmission, resolveWalletSessionOperationCredentialAdmissionFromContext, validateEcdsaPreprocessingSession, validateRouterAbEcdsaDerivationWalletSessionInputs, validateRouterAbEd25519WalletSessionInputs };
+export { resolveActiveRuntimePolicyScopeForEnvironment, resolveThresholdRuntimePolicyScope, resolveWalletSessionAdministrationAdmission, resolveWalletSessionOperationCredentialAdmission, resolveWalletSessionOperationCredentialAdmissionFromContext, validateEcdsaPreprocessingSession, validateRouterAbEcdsaDerivationWalletSessionInputs, validateRouterAbEd25519WalletSessionInputs };
 
 //# sourceMappingURL=commonRouterUtils.js.map

package/dist/esm/router/auth/walletSessionFailure.js

@@ -1,14 +1,4 @@
-import { WALLET_SESSION_FAILURE_CODES } from "../../shared-ts/src/utils/walletSessionFailure.js";
 //#region src/router/auth/walletSessionFailure.ts
-function walletSessionFailureCodeFromParseReason(reason) {
-	switch (reason) {
-		case "missing": return WALLET_SESSION_FAILURE_CODES.missing;
-		case "signature_invalid": return WALLET_SESSION_FAILURE_CODES.signatureInvalid;
-		case "claims_invalid":
-		case "not_active": return WALLET_SESSION_FAILURE_CODES.claimsInvalid;
-		case "expired": return WALLET_SESSION_FAILURE_CODES.expired;
-	}
-}
 function walletSessionFailureMessage(code) {
 	switch (code) {
 		case "wallet_session_missing": return "Wallet Session is missing";
@@ -33,9 +23,6 @@ function walletSessionFailureStatus(code) {
 		case "wallet_session_unavailable": return 503;
 	}
 }
-function walletSessionParseFailure(reason) {
-	return walletSessionFailure(walletSessionFailureCodeFromParseReason(reason));
-}
 function walletSessionFailure(code) {
 	return {
 		ok: false,
@@ -44,6 +31,6 @@ function walletSessionFailure(code) {
 	};
 }
 //#endregion
-export { walletSessionFailure, walletSessionFailureCodeFromParseReason, walletSessionFailureMessage, walletSessionFailureStatus, walletSessionParseFailure };
+export { walletSessionFailure, walletSessionFailureMessage, walletSessionFailureStatus };
 
 //# sourceMappingURL=walletSessionFailure.js.map

package/dist/esm/router/cloudflare/d1/auth/d1AuthorizedOperationRouteService.js

@@ -0,0 +1,23 @@
+import { parseTenantId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+//#region src/router/cloudflare/d1/auth/d1AuthorizedOperationRouteService.ts
+function createD1AuthorizedOperationRouteService(assembly) {
+	const tenantId = parseTenantId(assembly.options.orgId);
+	if (!tenantId.ok) throw new Error(`orgId cannot identify an authorization tenant: ${tenantId.error.message}`);
+	return {
+		tenantId: tenantId.value,
+		admitEcdsaWalletSessionOperation: assembly.authorizationStore.admitEcdsaWalletSessionOperation.bind(assembly.authorizationStore),
+		readPinnedOwnerWalletScope: assembly.authorizationStore.readPinnedOwnerWalletScope.bind(assembly.authorizationStore),
+		buildVerifiedOwnerProof: assembly.authorizationService.buildVerifiedOwnerProof.bind(assembly.authorizationService),
+		recordVerifiedWalletOperationFactorEvidenceSet: assembly.authorizationService.recordVerifiedWalletOperationFactorEvidenceSet.bind(assembly.authorizationService),
+		readAuthorizedOperationById: assembly.authorizationService.readAuthorizedOperationById.bind(assembly.authorizationService),
+		readAuthorizedOperation: assembly.authorizationService.readAuthorizedOperation.bind(assembly.authorizationService),
+		admitAuthorizedOperation: assembly.authorizationService.admitAuthorizedOperation.bind(assembly.authorizationService),
+		prepareAuthorizedOperationAdmission: assembly.authorizationService.prepareAuthorizedOperationAdmission.bind(assembly.authorizationService),
+		classifyAuthorizedOperationAdmissionFailure: assembly.authorizationService.classifyAuthorizedOperationAdmissionFailure.bind(assembly.authorizationService),
+		completeAuthorizedOperation: assembly.authorizationService.completeAuthorizedOperation.bind(assembly.authorizationService)
+	};
+}
+//#endregion
+export { createD1AuthorizedOperationRouteService };
+
+//# sourceMappingURL=d1AuthorizedOperationRouteService.js.map

package/dist/esm/router/cloudflare/d1/auth/d1RouterApiAuthService.js

@@ -4,7 +4,6 @@ import { capabilityPolicyPort } from "../../../../authorization/capabilityPolicy
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8, sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import "../../../../shared-ts/src/utils/encoders.js";
-import { computeWalletAuthMethodRevokeOperationFingerprintV1 } from "../../../../shared-ts/src/utils/registrationIntent.js";
 import { parseRouterAbEcdsaRegistrationActivationReceiptV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { AuthorizationService } from "../../../../authorization/service.js";
 import { D1WalletStore } from "../../../../core/d1WalletStore.js";
@@ -26,6 +25,7 @@ import { createCloudflareD1VersionedJsonRecordStore } from "../versionedJson/d1V
 import { parseRouterAbEd25519YaoRegistrationSideEffectRecordV2, runRouterAbEd25519YaoRegistrationSideEffectV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
 import { createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1 } from "../../signingLanes/cloudflareOrdinaryInactiveSignerMaterialReservation.js";
 import { normalizeD1RouterApiAuthOptions } from "./d1RouterApiAuthConfig.js";
+import { createD1AuthorizedOperationRouteService } from "./d1AuthorizedOperationRouteService.js";
 import { parseRegistrationEstablishedSessionProjectionV2 } from "../../../../shared-ts/src/utils/registrationEstablishedSession.js";
 import { D1IdentityStore } from "../../../../core/d1IdentityStore.js";
 import { toPublicKeyStringFromSecretKey } from "../../../../core/nearKeys.js";
@@ -50,10 +50,12 @@ import { CloudflareD1GoogleEmailOtpRegistrationAttemptStore } from "../emailOtp/
 import { CloudflareD1GoogleEmailOtpSessionResolver } from "../emailOtp/d1GoogleEmailOtpSessionResolver.js";
 import { CloudflareD1IdentityService } from "../identity/d1IdentityService.js";
 import { CloudflareD1OidcVerificationService } from "../oidc/d1OidcVerificationService.js";
+import { D1WalletAuthMethodRevocationReplayStoreV1 } from "../wallet/d1WalletAuthMethodRevocationReplayStore.js";
 import { CloudflareD1WalletAuthMethodService } from "../wallet/d1WalletAuthMethodService.js";
 import { parseWalletRegistrationSessionCommitReceiptV2 } from "../registration/walletRegistrationSessionCommitReceipt.js";
 import { CloudflareD1WalletRegistrationService } from "../registration/d1WalletRegistrationService.js";
 import { CloudflareD1WalletRegistrationCommitStore } from "../registration/d1WalletRegistrationCommitStore.js";
+import { CloudflareD1Ed25519YaoLifecycleDecisionStoreV1 } from "../ed25519Yao/d1Ed25519YaoLifecycleDecisionStore.js";
 import { CloudflareD1PasskeyCustodyEnvelopeStore } from "../passkeyCustody/d1PasskeyCustodyEnvelopeStore.js";
 import { CloudflareD1WalletCustodyCommitStore } from "../passkeyCustody/d1WalletCustodyCommitStore.js";
 import { createD1PasskeyCustodyRouteService } from "../passkeyCustody/d1PasskeyCustodyRouteService.js";
@@ -68,6 +70,7 @@ import { createD1LinkedDeviceRouteServiceV1 } from "../deviceLinking/d1LinkedDev
 import { D1LinkedDeviceEmailOtpGrantStoreV1 } from "../deviceLinking/d1LinkedDeviceEmailOtpGrantStore.js";
 import { D1LinkedDeviceAuthorityInstallServiceV1 } from "../deviceLinking/d1LinkedDeviceAuthorityInstallService.js";
 import { createD1LinkedDeviceManagementServiceV1 } from "../deviceLinking/d1LinkedDeviceManagementService.js";
+import { createD1LinkedDeviceRevocationV1 } from "../deviceLinking/d1LinkedDeviceRevocation.js";
 import { createD1LinkedDeviceVerifiedLinkSourceReaderV1 } from "../deviceLinking/d1LinkedDeviceVerifiedLinkSourceReader.js";
 import { LinkedDeviceWebAuthnRegistrationVerifierV1 } from "../deviceLinking/d1LinkedDeviceTargetCredentialProvider.js";
 import { D1LinkedDeviceEmailOtpTargetFactorV1, linkedDeviceEmailOtpGrantRegistrationPortV1 } from "../deviceLinking/d1LinkedDeviceEmailOtpTargetFactor.js";
@@ -108,57 +111,70 @@ function createD1LinkedDeviceComposition(input) {
 	if (sessionConfig) deactivationEndpoint = sessionConfig.authorityInstallation.deactivationEndpoint;
 	else if (managementConfig) deactivationEndpoint = managementConfig.deactivationEndpoint;
 	else return {};
-	const deviceManagement = {
-		management: createD1LinkedDeviceManagementServiceV1({
-			scope,
-			tenantId: tenantId.value,
-			authorityStore,
-			authMethodStore: input.walletAuthMethodStore,
-			authorizationService: input.authorizationService,
-			walletSessionAuthorizations: input.authorizationStore,
-			webAuthnStore: input.webAuthnStore,
-			...input.emailOtpLinkedDevice === void 0 ? {} : { emailOtpEnrollments: input.emailOtpLinkedDevice.enrollments },
-			materialDeactivation: createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1({ endpoint: deactivationEndpoint })
+	const deviceManagementService = createD1LinkedDeviceManagementServiceV1({
+		scope,
+		tenantId: tenantId.value,
+		authorityStore,
+		authMethodStore: input.walletAuthMethodStore,
+		authorizationService: input.authorizationService,
+		walletSessionAuthorizations: input.authorizationStore,
+		webAuthnStore: input.webAuthnStore,
+		...input.emailOtpLinkedDevice === void 0 ? {} : { emailOtpEnrollments: input.emailOtpLinkedDevice.enrollments },
+		materialDeactivation: createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1({ endpoint: deactivationEndpoint })
+	});
+	const revokeLinkedDeviceWithFreshProof = createD1LinkedDeviceRevocationV1({
+		management: deviceManagementService,
+		replays: new D1WalletAuthMethodRevocationReplayStoreV1({
+			database: input.options.database,
+			scope
 		}),
+		authMethodStore: input.walletAuthMethodStore,
+		authorityStore,
+		nowV1,
+		verifyProofForBatch: async (proofInput) => await verifyD1LinkedDeviceFreshRevokeProofV1({
+			walletId: proofInput.walletId,
+			orgId: String(input.options.orgId),
+			targetWalletAuthMethodId: proofInput.targetWalletAuthMethodId,
+			proof: proofInput.proof,
+			expectedOrigin: proofInput.expectedOrigin,
+			verifiedAtMs: proofInput.verifiedAtMs,
+			operationFingerprintDigest: proofInput.operationFingerprintDigest,
+			walletAuthMethodStore: input.walletAuthMethodStore,
+			verifyWebAuthnAuthenticationLite: async (verifyInput) => {
+				const credential = parseWebAuthnAuthenticationCredential(verifyInput.webauthn_authentication);
+				if (!credential) return {
+					success: false,
+					verified: false,
+					code: "invalid_body",
+					message: "Invalid WebAuthn authentication credential"
+				};
+				return await input.webAuthnAuthService.verifyWebAuthnAuthenticationLite({
+					...verifyInput,
+					webauthn_authentication: credential
+				});
+			},
+			...input.emailOtpLinkedDevice === void 0 ? {} : {
+				verifyEmailOtpExistingForBatch: input.emailOtpLinkedDevice.verifier.verifyExistingForBatch.bind(input.emailOtpLinkedDevice.verifier),
+				readEmailOtpEnrollment: input.emailOtpLinkedDevice.enrollments.readEnrollment.bind(input.emailOtpLinkedDevice.enrollments)
+			}
+		})
+	});
+	const deviceManagement = {
+		management: deviceManagementService,
 		nowV1,
 		authenticateOwnerRequestV1: ownerRequestAuthenticator,
-		verifyFreshRevokeProofV1: async (proofInput) => {
-			const expectedOrigin = String(proofInput.request.headers.get("origin") || "").trim();
+		revokeLinkedDeviceWithFreshProofV1: async (revokeInput) => {
+			const expectedOrigin = String(revokeInput.httpRequest.headers.get("origin") || "").trim();
 			if (!expectedOrigin) return {
 				kind: "denied",
 				code: "invalid",
 				message: "Fresh revocation proof requires an Origin header"
 			};
-			return await verifyD1LinkedDeviceFreshRevokeProofV1({
-				walletId: proofInput.walletId,
-				orgId: String(input.options.orgId),
-				targetWalletAuthMethodId: proofInput.targetWalletAuthMethodId,
-				proof: proofInput.proof,
-				expectedOrigin,
-				verifiedAtMs: proofInput.requestedAtMs,
-				operationFingerprintDigest: await computeWalletAuthMethodRevokeOperationFingerprintV1({
-					walletId: proofInput.walletId,
-					targetWalletAuthMethodId: proofInput.targetWalletAuthMethodId,
-					requestedAtMs: proofInput.requestedAtMs
-				}),
-				walletAuthMethodStore: input.walletAuthMethodStore,
-				verifyWebAuthnAuthenticationLite: async (verifyInput) => {
-					const credential = parseWebAuthnAuthenticationCredential(verifyInput.webauthn_authentication);
-					if (!credential) return {
-						success: false,
-						verified: false,
-						code: "invalid_body",
-						message: "Invalid WebAuthn authentication credential"
-					};
-					return await input.webAuthnAuthService.verifyWebAuthnAuthenticationLite({
-						...verifyInput,
-						webauthn_authentication: credential
-					});
-				},
-				...input.emailOtpLinkedDevice === void 0 ? {} : {
-					verifyEmailOtpExisting: input.emailOtpLinkedDevice.verifier.verifyExisting.bind(input.emailOtpLinkedDevice.verifier),
-					readEmailOtpEnrollment: input.emailOtpLinkedDevice.enrollments.readEnrollment.bind(input.emailOtpLinkedDevice.enrollments)
-				}
+			return await revokeLinkedDeviceWithFreshProof({
+				request: revokeInput.request,
+				owner: revokeInput.owner,
+				proof: revokeInput.proof,
+				expectedOrigin
 			});
 		}
 	};
@@ -1012,6 +1028,15 @@ function createCloudflareD1RouterApiAuthAssembly(input) {
 		webAuthnStore,
 		listWalletEd25519Signers: (walletId) => walletStore.listEd25519SignersForWallet({ walletId }),
 		walletAuthorityStore,
+		revocationReplays: new D1WalletAuthMethodRevocationReplayStoreV1({
+			database: options.database,
+			scope: {
+				namespace: options.namespace,
+				orgId: options.orgId,
+				projectId: options.projectId,
+				envId: options.envId
+			}
+		}),
 		orgId: options.orgId,
 		verifyWebAuthnAuthenticationLite: async (verifyInput) => {
 			const credential = parseWebAuthnAuthenticationCredential(verifyInput.webauthn_authentication);
@@ -1027,6 +1052,13 @@ function createCloudflareD1RouterApiAuthAssembly(input) {
 			});
 		}
 	});
+	const yaoLifecycleDecisions = new CloudflareD1Ed25519YaoLifecycleDecisionStoreV1({
+		database: options.database,
+		namespace: options.namespace,
+		orgId: options.orgId,
+		projectId: options.projectId,
+		envId: options.envId
+	});
 	const walletRegistrationCommitStore = new CloudflareD1WalletRegistrationCommitStore({
 		database: options.database,
 		namespace: options.namespace,
@@ -1059,7 +1091,8 @@ function createCloudflareD1RouterApiAuthAssembly(input) {
 		walletRegistrationCommitStore,
 		walletCustodyCommitStore,
 		walletAuthMethods,
-		getLinkedDeviceEd25519AuthorityReader
+		getLinkedDeviceEd25519AuthorityReader,
+		yaoLifecycleDecisions
 	});
 	const walletAddSigners = new CloudflareD1WalletAddSignerService({
 		getRegistrationCeremonyIntentStore,
@@ -1070,7 +1103,8 @@ function createCloudflareD1RouterApiAuthAssembly(input) {
 		walletAuthMethods,
 		passkeyCustodyEnvelopes,
 		startSideEffects: walletAddSignerStartSideEffectStore(options),
-		finalizeSideEffects: walletAddSignerFinalizeSideEffectStore(options)
+		finalizeSideEffects: walletAddSignerFinalizeSideEffectStore(options),
+		yaoLifecycleDecisions
 	});
 	const registrationIntents = new CloudflareD1RegistrationIntentService({ getRegistrationCeremonyIntentStore });
 	const emailOtpChallengeIssuer = new CloudflareD1EmailOtpChallengeIssuer({
@@ -1161,6 +1195,7 @@ function createCloudflareD1RouterApiAuthAssembly(input) {
 		identityService,
 		oidcVerification,
 		authorizationService,
+		authorizationStore,
 		googleEmailOtpSessions,
 		nearPublicKeys,
 		webAuthnAuthService,
@@ -1245,7 +1280,7 @@ function createD1WalletRegistrationRouteService(assembly) {
 function createD1WalletAuthMethodRouteService(assembly) {
 	return {
 		resolveActiveWalletSessionAuthority: assembly.walletAuthMethods.resolveActiveWalletSessionAuthority.bind(assembly.walletAuthMethods),
-		verifyWalletAuthMethodRevokeProof: assembly.walletAuthMethods.verifyWalletAuthMethodRevokeProof.bind(assembly.walletAuthMethods),
+		revokeWalletAuthMethodWithFreshProof: assembly.walletAuthMethods.revokeWalletAuthMethodWithFreshProof.bind(assembly.walletAuthMethods),
 		verifyActivePasskeyAuthority: assembly.walletAuthMethods.verifyActivePasskeyAuthority.bind(assembly.walletAuthMethods),
 		resolveActivePasskeyAuthorityForVerifiedCredential: assembly.walletAuthMethods.resolveActivePasskeyAuthorityForVerifiedCredential.bind(assembly.walletAuthMethods),
 		verifyActiveEmailOtpAuthority: assembly.walletAuthMethods.verifyActiveEmailOtpAuthority.bind(assembly.walletAuthMethods),
@@ -1258,7 +1293,6 @@ function createD1WalletAuthMethodRouteService(assembly) {
 		respondWalletAddSignerEcdsaDerivation: assembly.walletAddSigners.respondWalletAddSignerEcdsaDerivation.bind(assembly.walletAddSigners),
 		activateWalletAddSignerEcdsa: assembly.walletAddSigners.activateWalletAddSignerEcdsa.bind(assembly.walletAddSigners),
 		getWalletAddSignerRuntimePolicyScope: assembly.walletAddSigners.getWalletAddSignerRuntimePolicyScope.bind(assembly.walletAddSigners),
-		revokeWalletAuthMethod: assembly.walletAuthMethods.revokeWalletAuthMethod.bind(assembly.walletAuthMethods),
 		createAddAuthMethodEmailOtpChallenge: assembly.walletAuthMethods.createAddAuthMethodEmailOtpChallenge.bind(assembly.walletAuthMethods),
 		verifyAddAuthMethodEmailOtpSourceProof: assembly.walletAuthMethods.verifyAddAuthMethodEmailOtpSourceProof.bind(assembly.walletAuthMethods),
 		startWalletAddAuthMethod: assembly.walletAuthMethods.startWalletAddAuthMethod.bind(assembly.walletAuthMethods),
@@ -1466,9 +1500,9 @@ function createD1AuthorizationSessionRouteService(assembly) {
 		tenantId: tenantId.value,
 		issueDirectWalletSessionAuthorizationV2: assembly.authorizationService.issueDirectWalletSessionAuthorizationV2.bind(assembly.authorizationService),
 		readWalletSessionAuthorizationV2ByOperationCredential: async (input) => {
-			const authorization = await assembly.authorizationService.readWalletSessionAuthorizationV2ByOperationCredential(input);
-			if (!authorization) return null;
-			const [authority, authMethod] = await Promise.all([assembly.walletAuthorityStore.readById(authorization.session.authorityId), assembly.walletAuthMethodStore.readByIdV2({ walletAuthMethodId: authorization.session.walletAuthMethodId })]);
+			const snapshot = await assembly.authorizationService.readWalletSessionAdmissionSnapshotByOperationCredential(input);
+			if (!snapshot) return null;
+			const { authorization, authority, authMethod } = snapshot;
 			if (!authority || authority.state !== "active" || !authMethod || authMethod.status !== "active") return null;
 			return {
 				authorization,
@@ -1479,9 +1513,8 @@ function createD1AuthorizationSessionRouteService(assembly) {
 		},
 		readWalletSessionExactOperationContextByCredential: assembly.authorizationService.readWalletSessionExactOperationContextByCredential.bind(assembly.authorizationService),
 		readExhaustedWalletSessionAuthorizationV2CandidateByOperationCredential: async (input) => {
-			const status = await assembly.authorizationService.readExactWalletSessionStatusByOperationCredential(input);
+			const { status, authority, authMethod } = await assembly.authorizationService.readExactWalletSessionStatusSnapshotByOperationCredential(input);
 			if (!isExhaustedWalletSessionStatus(status)) return null;
-			const [authority, authMethod] = await Promise.all([assembly.walletAuthorityStore.readById(status.session.authorityId), assembly.walletAuthMethodStore.readByIdV2({ walletAuthMethodId: status.session.walletAuthMethodId })]);
 			if (!authority || authority.state !== "active" || !authMethod || authMethod.status !== "active" || authority.walletId !== status.session.walletId || authority.authorityDigestB64u !== status.session.authorityDigestB64u || authority.revocationEpoch !== status.session.authorityRevocationEpoch || authMethod.walletId !== status.session.walletId || authMethod.walletAuthorityId !== status.session.authorityId || authMethod.walletAuthMethodId !== status.session.walletAuthMethodId) return null;
 			return {
 				status,
@@ -1512,19 +1545,6 @@ function createD1AuthorizationSessionRouteService(assembly) {
 		}
 	};
 }
-function createD1AuthorizedOperationRouteService(assembly) {
-	const tenantId = parseTenantId(assembly.options.orgId);
-	if (!tenantId.ok) throw new Error(`orgId cannot identify an authorization tenant: ${tenantId.error.message}`);
-	return {
-		tenantId: tenantId.value,
-		buildVerifiedOwnerProof: assembly.authorizationService.buildVerifiedOwnerProof.bind(assembly.authorizationService),
-		recordVerifiedWalletOperationFactorEvidenceSet: assembly.authorizationService.recordVerifiedWalletOperationFactorEvidenceSet.bind(assembly.authorizationService),
-		readAuthorizedOperationById: assembly.authorizationService.readAuthorizedOperationById.bind(assembly.authorizationService),
-		readAuthorizedOperation: assembly.authorizationService.readAuthorizedOperation.bind(assembly.authorizationService),
-		admitAuthorizedOperation: assembly.authorizationService.admitAuthorizedOperation.bind(assembly.authorizationService),
-		completeAuthorizedOperation: assembly.authorizationService.completeAuthorizedOperation.bind(assembly.authorizationService)
-	};
-}
 function createD1ThresholdRuntimeRouteService(assembly) {
 	return { getRouterAbEcdsaPresignRuntime: () => assembly.options.routerAbEcdsaPresignRuntime || null };
 }