@seams/wallet-server 0.6.2 → 0.7.1

package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnAuthService.js

@@ -7,6 +7,7 @@ import { decodeWebAuthnBase64UrlOrBase64, parseWebAuthnAuthenticationCredential,
 import { nonNegativeSafeInteger, optionalNonNegativeInteger, parseD1BoundaryWalletId, parseD1BoundaryWalletIdResult, parseJsonObject } from "../auth/d1RouterApiAuthBoundary.js";
 import { parseWebAuthnAuthenticatorRowDeviceInfo, webAuthnSyncWalletBindingFromCredentialBinding } from "./d1WebAuthnRecords.js";
 import { d1HostIsWithinWebAuthnRpId } from "../wallet/d1WalletAuthMethodBoundary.js";
+import { webAuthnAuthenticationFailure, webAuthnLoginEd25519, webAuthnSyncCredentialBinding } from "../../../../core/authService/webauthnVerificationOutcomes.js";
 //#region src/router/cloudflare/d1/webauthn/d1WebAuthnAuthService.ts
 function errorMessage(error) {
 	return error instanceof Error ? error.message : String(error || "");
@@ -398,41 +399,20 @@ var CloudflareD1WebAuthnAuthService = class {
 				code: "unknown_credential",
 				message: "Credential is not active for this wallet"
 			};
-			const verification = await this.verifyWebAuthnAuthenticationLite({
+			const verificationFailure = webAuthnAuthenticationFailure(await this.verifyWebAuthnAuthenticationLite({
 				userId: challenge.userId,
 				rpId: rpId.value,
 				expectedChallenge: challenge.challengeB64u,
 				webauthn_authentication: credential,
 				expected_origin: expectedOrigin
-			});
-			if (!verification.success || !verification.verified) return {
-				ok: false,
-				verified: false,
-				code: verification.code || "not_verified",
-				message: verification.message || "Authentication verification failed"
-			};
+			}));
+			if (verificationFailure) return verificationFailure;
 			const binding = await this.webAuthnStore.readBindingByCredential({
 				rpId: challenge.rpId,
 				credentialIdB64u: credentialId.credentialIdB64u
 			});
-			const walletBinding = binding ? webAuthnSyncWalletBindingFromCredentialBinding(binding) : null;
-			const firstParticipantId = binding?.participantIds?.[0];
-			const secondParticipantId = binding?.participantIds?.[1];
-			if (!binding) return {
-				ok: false,
-				verified: false,
-				code: "unknown_credential",
-				message: "Credential has no wallet binding"
-			};
-			const ed25519 = walletBinding && binding.publicKey && binding.relayerKeyId && firstParticipantId !== void 0 && secondParticipantId !== void 0 ? {
-				kind: "active",
-				nearAccountId: walletBinding.nearAccountId,
-				nearEd25519SigningKeyId: walletBinding.nearEd25519SigningKeyId,
-				signerSlot: walletBinding.signerSlot,
-				publicKey: binding.publicKey,
-				relayerKeyId: binding.relayerKeyId,
-				participantIds: [firstParticipantId, secondParticipantId]
-			} : { kind: "absent" };
+			const loginSigner = webAuthnLoginEd25519(binding, binding ? webAuthnSyncWalletBindingFromCredentialBinding(binding) : null);
+			if (!loginSigner.ok) return loginSigner;
 			return {
 				ok: true,
 				verified: true,
@@ -441,7 +421,7 @@ var CloudflareD1WebAuthnAuthService = class {
 				credentialIdB64u: credentialId.credentialIdB64u,
 				walletAuthMethodId: activeMethod.walletAuthMethodId,
 				walletAuthorityId: activeMethod.walletAuthorityId,
-				ed25519
+				ed25519: loginSigner.ed25519
 			};
 		} catch (error) {
 			return {
@@ -481,22 +461,12 @@ var CloudflareD1WebAuthnAuthService = class {
 				code: credentialId.code,
 				message: credentialId.message
 			};
-			const binding = await this.webAuthnStore.readBindingByCredential({
+			const syncBinding = webAuthnSyncCredentialBinding(await this.webAuthnStore.readBindingByCredential({
 				rpId: challenge.rpId,
 				credentialIdB64u: credentialId.credentialIdB64u
-			});
-			if (!binding) return {
-				ok: false,
-				verified: false,
-				code: "unknown_credential",
-				message: "Credential is not registered on this relay"
-			};
-			if (challenge.expectedUserId && binding.userId !== challenge.expectedUserId) return {
-				ok: false,
-				verified: false,
-				code: "unknown_credential",
-				message: `Credential is not registered for account ${challenge.expectedUserId}`
-			};
+			}), challenge);
+			if (!syncBinding.ok) return syncBinding;
+			const binding = syncBinding.binding;
 			const activeMethod = await this.walletAuthMethodStore.getPasskeyV2({
 				rpId: challenge.rpId,
 				credentialIdB64u: credentialId.credentialIdB64u
@@ -521,19 +491,14 @@ var CloudflareD1WebAuthnAuthService = class {
 				code: "internal",
 				message: `Stored sync credential binding rpId is invalid: ${rpId.error.message}`
 			};
-			const verification = await this.verifyWebAuthnAuthenticationLite({
+			const verificationFailure = webAuthnAuthenticationFailure(await this.verifyWebAuthnAuthenticationLite({
 				userId: binding.userId,
 				rpId: rpId.value,
 				expectedChallenge: challenge.challengeB64u,
 				webauthn_authentication: credential,
 				expected_origin: expectedOrigin
-			});
-			if (!verification.success || !verification.verified) return {
-				ok: false,
-				verified: false,
-				code: verification.code || "not_verified",
-				message: verification.message || "Authentication verification failed"
-			};
+			}));
+			if (verificationFailure) return verificationFailure;
 			const authenticator = await this.webAuthnStore.readAuthenticator({
 				userId: binding.userId,
 				credentialIdB64u: credentialId.credentialIdB64u

package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnRecords.js

@@ -1,12 +1,12 @@
 import { parsePasskeyEnvelopeId, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWalletRecoveryOperationId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
-import { parseEnvelopeRevision } from "../../../../shared-ts/src/passkey-custody/primitives.js";
-import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
-import { parseWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/registrationIntent.js";
-import { parseWebAuthnAuthenticatorDeviceInfoJson } from "../../../../shared-ts/src/utils/webauthnDeviceInfo.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import "../../../../shared-ts/src/utils/validation.js";
+import { parseEnvelopeRevision } from "../../../../shared-ts/src/passkey-custody/primitives.js";
 import { normalizeRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
+import { parseWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
+import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
+import { parseWebAuthnAuthenticatorDeviceInfoJson } from "../../../../shared-ts/src/utils/webauthnDeviceInfo.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
 import { parseRecoveryCodeReservationId } from "../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
 import { nonNegativeSafeInteger, optionalNonNegativeInteger, positiveInteger } from "../auth/d1RouterApiAuthBoundary.js";

package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnStore.js

@@ -1,83 +1,35 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import "../../../../shared-ts/src/utils/validation.js";
+import { prepareD1TenantStatement } from "../../../../core/d1TenantStore.js";
+import { INSERT_WEBAUTHN_AUTHENTICATOR_SQL, UPSERT_WEBAUTHN_AUTHENTICATOR_SQL, webAuthnAuthenticatorRows, webAuthnChallengeRows, webAuthnCredentialBindingRows } from "../../../../core/webAuthnD1Statements.js";
 import { prepareD1WebAuthnCredentialBindingInsertStatement } from "../../../../core/WebAuthnCredentialBindingStore.js";
 import { parseWebAuthnAuthenticator, parseWebAuthnBinding, parseWebAuthnLoginChallengeRecord, parseWebAuthnRecoveryRegistrationChallengeRecord, parseWebAuthnSyncChallengeRecord } from "./d1WebAuthnRecords.js";
 //#region src/router/cloudflare/d1/webauthn/d1WebAuthnStore.ts
+function prepareAuthenticatorStatement(sql, input) {
+	return input.database.prepare(sql).bind(input.scope.namespace, input.scope.orgId, input.scope.projectId, input.scope.envId, input.userId, input.record.credentialIdB64u, input.record.credentialPublicKeyB64u, input.record.counter, input.record.createdAtMs, input.record.updatedAtMs, JSON.stringify(input.record.deviceInfo));
+}
 function prepareD1WebAuthnAuthenticatorPutStatement(input) {
-	return input.database.prepare(`INSERT INTO webauthn_authenticators (
-        namespace,
-        org_id,
-        project_id,
-        env_id,
-        user_id,
-        credential_id_b64u,
-        credential_public_key_b64u,
-        counter,
-        created_at_ms,
-        updated_at_ms,
-        device_info_json
-      )
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT (namespace, org_id, project_id, env_id, user_id, credential_id_b64u)
-      DO UPDATE SET
-        credential_public_key_b64u = EXCLUDED.credential_public_key_b64u,
-        counter = MAX(webauthn_authenticators.counter, EXCLUDED.counter),
-        created_at_ms = MIN(webauthn_authenticators.created_at_ms, EXCLUDED.created_at_ms),
-        updated_at_ms = MAX(webauthn_authenticators.updated_at_ms, EXCLUDED.updated_at_ms),
-        device_info_json = EXCLUDED.device_info_json`).bind(input.scope.namespace, input.scope.orgId, input.scope.projectId, input.scope.envId, input.userId, input.record.credentialIdB64u, input.record.credentialPublicKeyB64u, input.record.counter, input.record.createdAtMs, input.record.updatedAtMs, JSON.stringify(input.record.deviceInfo));
+	return prepareAuthenticatorStatement(UPSERT_WEBAUTHN_AUTHENTICATOR_SQL, input);
 }
 /** Insert-only variant used by recovery promotion. A credential collision must
 * abort the surrounding envelope/code transaction instead of reassigning an
 * existing authenticator's public key. */
 function prepareD1WebAuthnAuthenticatorInsertStatement(input) {
-	return input.database.prepare(`INSERT INTO webauthn_authenticators (
-        namespace,
-        org_id,
-        project_id,
-        env_id,
-        user_id,
-        credential_id_b64u,
-        credential_public_key_b64u,
-        counter,
-        created_at_ms,
-        updated_at_ms,
-        device_info_json
-      )
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).bind(input.scope.namespace, input.scope.orgId, input.scope.projectId, input.scope.envId, input.userId, input.record.credentialIdB64u, input.record.credentialPublicKeyB64u, input.record.counter, input.record.createdAtMs, input.record.updatedAtMs, JSON.stringify(input.record.deviceInfo));
+	return prepareAuthenticatorStatement(INSERT_WEBAUTHN_AUTHENTICATOR_SQL, input);
 }
 var CloudflareD1WebAuthnStore = class {
 	constructor(input) {
+		this.prepare = (sql, values) => prepareD1TenantStatement(this.database, this.scope, sql, values);
 		this.database = input.database;
-		this.namespace = input.namespace;
-		this.orgId = input.orgId;
-		this.projectId = input.projectId;
-		this.envId = input.envId;
+		this.scope = {
+			namespace: input.namespace,
+			orgId: input.orgId,
+			projectId: input.projectId,
+			envId: input.envId
+		};
 	}
 	async writeChallenge(input) {
-		await this.prepare(`INSERT INTO webauthn_challenges (
-        namespace,
-        org_id,
-        project_id,
-        env_id,
-        challenge_id,
-        challenge_kind,
-        record_json,
-        created_at_ms,
-        expires_at_ms
-      )
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT (namespace, org_id, project_id, env_id, challenge_id)
-      DO UPDATE SET
-        challenge_kind = EXCLUDED.challenge_kind,
-        record_json = EXCLUDED.record_json,
-        created_at_ms = EXCLUDED.created_at_ms,
-        expires_at_ms = EXCLUDED.expires_at_ms`, [
-			input.challengeId,
-			input.challengeKind,
-			JSON.stringify(input.record),
-			input.createdAtMs,
-			input.expiresAtMs
-		]).run();
+		await webAuthnChallengeRows.upsert(this.prepare, input).run();
 	}
 	async consumeLoginChallenge(challengeId) {
 		return parseWebAuthnLoginChallengeRecord((await this.consumeChallenge({
@@ -120,25 +72,12 @@ var CloudflareD1WebAuthnStore = class {
 		]);
 	}
 	async readAuthenticator(input) {
-		return parseWebAuthnAuthenticator(await this.prepare(`SELECT credential_id_b64u, credential_public_key_b64u, counter, created_at_ms, updated_at_ms, device_info_json
-         FROM webauthn_authenticators
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND user_id = ?
-          AND credential_id_b64u = ?
-        LIMIT 1`, [input.userId, input.credentialIdB64u]).first());
+		return parseWebAuthnAuthenticator(await webAuthnAuthenticatorRows.select(this.prepare, input.userId, input.credentialIdB64u).first());
 	}
 	async writeAuthenticator(input) {
 		await prepareD1WebAuthnAuthenticatorPutStatement({
 			database: this.database,
-			scope: {
-				namespace: this.namespace,
-				orgId: this.orgId,
-				projectId: this.projectId,
-				envId: this.envId
-			},
+			scope: this.scope,
 			userId: input.userId,
 			record: input.record
 		}).run();
@@ -146,12 +85,7 @@ var CloudflareD1WebAuthnStore = class {
 	prepareAuthenticatorInsertStatement(input) {
 		return prepareD1WebAuthnAuthenticatorInsertStatement({
 			database: this.database,
-			scope: {
-				namespace: this.namespace,
-				orgId: this.orgId,
-				projectId: this.projectId,
-				envId: this.envId
-			},
+			scope: this.scope,
 			userId: input.userId,
 			record: input.record
 		});
@@ -159,12 +93,7 @@ var CloudflareD1WebAuthnStore = class {
 	prepareCredentialBindingInsertStatement(record) {
 		return prepareD1WebAuthnCredentialBindingInsertStatement({
 			database: this.database,
-			scope: {
-				namespace: this.namespace,
-				orgId: this.orgId,
-				projectId: this.projectId,
-				envId: this.envId
-			},
+			scope: this.scope,
 			record
 		});
 	}
@@ -178,18 +107,10 @@ var CloudflareD1WebAuthnStore = class {
           AND env_id = ?
           AND user_id = ?
           AND credential_id_b64u = ?
-          AND counter < ?`).bind(input.newCounter, input.updatedAtMs, this.namespace, this.orgId, this.projectId, this.envId, input.userId, input.credentialIdB64u, input.newCounter).run();
+          AND counter < ?`).bind(input.newCounter, input.updatedAtMs, this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, input.userId, input.credentialIdB64u, input.newCounter).run();
 	}
 	async readBindingByCredential(input) {
-		return parseWebAuthnBinding(await this.prepare(`SELECT record_json
-         FROM webauthn_credential_bindings
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND rp_id = ?
-          AND credential_id_b64u = ?
-        LIMIT 1`, [input.rpId, input.credentialIdB64u]).first() || {});
+		return parseWebAuthnBinding(await webAuthnCredentialBindingRows.select(this.prepare, input.rpId, input.credentialIdB64u).first() || {});
 	}
 	/** Resolves a credential without trusting a caller-supplied relying party. */
 	async readBindingByCredentialId(credentialIdB64u) {
@@ -240,22 +161,7 @@ var CloudflareD1WebAuthnStore = class {
 		return bindings;
 	}
 	async consumeChallenge(input) {
-		return await this.prepare(`DELETE FROM webauthn_challenges
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND challenge_id = ?
-          AND challenge_kind = ?
-          AND expires_at_ms > ?
-        RETURNING record_json`, [
-			input.challengeId,
-			input.challengeKind,
-			Date.now()
-		]).first();
-	}
-	prepare(sql, values) {
-		return this.database.prepare(sql).bind(this.namespace, this.orgId, this.projectId, this.envId, ...values);
+		return await webAuthnChallengeRows.consume(this.prepare, input.challengeId, input.challengeKind, Date.now()).first();
 	}
 };
 //#endregion

package/dist/esm/router/cloudflare/runtime/createSelfHostedCloudflareSigningWorker.js

@@ -1,4 +1,3 @@
-import "../../../shared-ts/src/utils/validation.js";
 import { coerceRouterLogger } from "../../framework/logger.js";
 import { json, withCors } from "../../framework/http.js";
 import { handleThresholdEcdsa } from "../../transport/fetch/routes/thresholdEcdsa.js";
@@ -45,7 +44,7 @@ function createSelfHostedCloudflareSigningRouter(service, opts = {}) {
 	};
 	if (effectiveOpts.ror) validateRouterApiRorOptions(effectiveOpts.ror);
 	const logger = coerceRouterLogger(effectiveOpts.logger);
-	const handler = async (request, env, cfCtx) => {
+	const handler = async (request, _env, cfCtx) => {
 		if (request.method.toUpperCase() === "OPTIONS") {
 			const res = new Response(null, { status: 204 });
 			withCors(res.headers, effectiveOpts, request);

package/dist/esm/router/cloudflare/runtime/walletConsoleTenantRootLineage.js

@@ -1,5 +1,6 @@
+import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { deriveSigningRootId } from "../../../shared-ts/src/threshold/signingRootScope.js";
-import { buildTenantRootIdentityFromAuthenticatedDeploymentV1 } from "../../../shared-ts/src/tenant-root/tenantRootIdentity.js";
+import { buildTenantRootIdentityFromAuthenticatedDeploymentV1, encodeTenantRootIdentityV1 } from "../../../shared-ts/src/tenant-root/tenantRootIdentity.js";
 import "../../../shared-ts/src/tenant-root/index.js";
 //#region src/router/cloudflare/runtime/walletConsoleTenantRootLineage.ts
 async function resolveRuntimeTenantRootLineage(environments, roots, scope) {
@@ -19,7 +20,15 @@ async function resolveRuntimeTenantRootLineage(environments, roots, scope) {
 		signingRootVersion: scope.signingRootVersion
 	});
 	if (!identity.ok) throw new Error("Resolved tenant-root environment identity is invalid");
-	return roots.resolveActiveLineage(identity.value);
+	const lineage = await roots.resolveActiveLineage(identity.value);
+	if (!lineage) return null;
+	const digest = await crypto.subtle.digest("SHA-256", encodeTenantRootIdentityV1(identity.value));
+	if (lineage.identityDigestB64u !== base64UrlEncode(digest)) throw new Error("Active tenant-root lineage differs from the resolved Console environment");
+	return {
+		...lineage,
+		identity: identity.value,
+		projectEnvironmentId: environment.id
+	};
 }
 function matchesRuntimeEnvironment(scope, environment) {
 	return environment.projectId === scope.projectId && environment.key === scope.envId && environment.signingRootVersion === scope.signingRootVersion && environment.status === "ACTIVE";

package/dist/esm/router/cloudflare/runtime/walletGateway.js

@@ -140,7 +140,7 @@ function createCloudflareWalletGatewayRouterV1(input) {
 		apiKeyUsageMeter: consoleOps.usageMeter,
 		orgProjectEnv: consoleOps.projectEnvironments,
 		routerAbNormalSigningAdmission: createRouterAbNormalSigningAdmissionAdapter(admissionStore),
-		routeExtensions: [createWalletConsoleRelayProxyExtensionV1(input.walletConsole)]
+		routeExtensions: [createWalletConsoleRelayProxyExtensionV1(input.walletConsole), ...input.routeExtensions ?? []]
 	});
 }
 //#endregion

package/dist/esm/router/cloudflare/signingLanes/cloudflareLaneCurveExecution.js

@@ -1,7 +1,6 @@
 import { buildMpcMaterialActivationRef, mpcMaterialActivationRefsEqual, parseMpcSigningWorkerRef } from "../../../shared-ts/src/utils/domainIds.js";
-import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { sha256Bytes } from "../../../shared-ts/src/utils/digests.js";
+import { base64UrlDecode } from "../../../shared-ts/src/utils/base64.js";
+import { parseDigestB64u, sha256DigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { base58Encode } from "../../../shared-ts/src/utils/base58.js";
 import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseEcdsaLifecycleId } from "../../../shared-ts/src/utils/ecdsaCapabilityActivation.js";
@@ -448,7 +447,7 @@ async function identityFromProtocolReceiptV1(job, receipt) {
 		holderRecipientKeyDigestB64u: job.targetHolder.hpkePublicKeyDigestB64u,
 		serverRecipientKeyDigestB64u: job.targetSigningWorker.hpkePublicKeyDigestB64u,
 		transcriptHashB64u: parseDigestB64u(receipt.transcriptHashB64u),
-		protocolCommitReceiptDigestB64u: parseDigestB64u(base64UrlEncode(await sha256Bytes(encodeLaneProtocolCommitReceiptV1(receipt))))
+		protocolCommitReceiptDigestB64u: await sha256DigestB64u(encodeLaneProtocolCommitReceiptV1(receipt))
 	};
 }
 async function buildEd25519ActivationBindingV1(input) {
@@ -471,7 +470,7 @@ async function buildEd25519ActivationBindingV1(input) {
 			holderRecipientKeyDigestB64u: input.job.targetHolder.hpkePublicKeyDigestB64u,
 			serverRecipientKeyDigestB64u: input.job.targetSigningWorker.hpkePublicKeyDigestB64u,
 			transcriptHashB64u: parseDigestB64u(receipt.transcriptHashB64u),
-			protocolCommitReceiptDigestB64u: parseDigestB64u(base64UrlEncode(await sha256Bytes(encodeLaneProtocolCommitReceiptV1(receipt))))
+			protocolCommitReceiptDigestB64u: await sha256DigestB64u(encodeLaneProtocolCommitReceiptV1(receipt))
 		},
 		targetMaterialActivation: buildMpcMaterialActivationRef({
 			activationId: input.job.targetMaterialActivationId,
@@ -513,7 +512,7 @@ async function digestSigningWorkerLaneIdentityV1(identity) {
 		bytes.set(chunk, offset);
 		offset += chunk.length;
 	}
-	return parseDigestB64u(base64UrlEncode(await sha256Bytes(bytes)));
+	return sha256DigestB64u(bytes);
 }
 function u64Length(value) {
 	let remaining = BigInt(value);

package/dist/esm/router/cloudflare/signingLanes/cloudflareLaneProtocolCommitter.js

@@ -1,6 +1,7 @@
 import { mpcMaterialActivationRefsEqual } from "../../../shared-ts/src/utils/domainIds.js";
-import { parseLaneProtocolCommitReceiptV1, parseRotatableSigningLaneJobV1 } from "../../../shared-ts/src/signing-lanes/rotationParsers.js";
+import { parseLaneProtocolCommitReceiptV1 } from "../../../shared-ts/src/signing-lanes/rotationParsers.js";
 import { LaneLifecycleApplicationService } from "../../../core/signingLanes/LaneLifecycleApplicationService.js";
+import { parseRotatableSigningLaneJobV1 } from "../../../shared-ts/src/signing-lanes/rotationProtocolParsers.js";
 //#region src/router/cloudflare/signingLanes/cloudflareLaneProtocolCommitter.ts
 const ROUTER_AB_ED25519_YAO_LANE_EXECUTE_PATH_V1 = "/router-ab/internal/ed25519-yao/lane/execute";
 const INTERNAL_SERVICE_AUTH_HEADER = "x-router-ab-internal-service-auth";

package/dist/esm/router/cloudflare/signingLanes/cloudflareOrdinaryInactiveSignerMaterialReservation.js

@@ -2,34 +2,43 @@ import { mpcMaterialActivationRefsEqual } from "../../../shared-ts/src/utils/dom
 import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { routerAbMpcMaterialActivationRefFromWire, routerAbMpcMaterialActivationRefToWire } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseLinkedDeviceEcdsaSourceContributionBindingV1, parseLinkedDeviceEcdsaSourcePreservingActivationReceiptV1 } from "../../../shared-ts/src/device-linking/sourceContribution.js";
+import { routerAbEd25519YaoTenantRootWireV1 } from "../../domains/ed25519Yao/routerAbEd25519YaoGatewayEnvelope.js";
 import { createOrdinaryInactiveSignerMaterialReservationServiceV1, parseOrdinaryEcdsaSignerMaterialDeactivationResultV1, parseOrdinaryEcdsaSignerMaterialWorkerReservationV1, parseOrdinaryEd25519SignerMaterialDeactivationResultV1, parseOrdinaryEd25519SignerMaterialWorkerReservationV1, validateOrdinaryInactiveSignerMaterialDeactivationRequestV1, validateOrdinaryInactiveSignerMaterialReservationRequestV1 } from "../../../core/signingMaterial/ordinaryInactiveSignerMaterialReservation.js";
 //#region src/router/cloudflare/signingLanes/cloudflareOrdinaryInactiveSignerMaterialReservation.ts
 /** Source-preserving ordinary material paths implemented by the Cloudflare workers. */
 const CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1 = "/router-ab/router/ed25519-yao/execute-source-preserving";
+/** Marks an execution the Router may already have run as its replay. */
+const ROUTER_AB_YAO_REPLAY_HEADER_V1 = "x-seams-yao-replay";
 const CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1 = "/router-ab/signing-worker/ecdsa-derivation/reserve-inactive-source-preserving";
 const CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1 = "/router-ab/signing-worker/ed25519-yao/activate-reservation";
 const CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1 = "/router-ab/signing-worker/ecdsa-derivation/activate-reservation";
 const CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1 = "/router-ab/signing-worker/ed25519-yao/deactivate-reservation";
 const CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1 = "/router-ab/signing-worker/ecdsa-derivation/deactivate-reservation";
+function signingWorkerWalletScopeWireV1(tenant, walletId) {
+	return {
+		org_id: tenant.orgId,
+		project_id: tenant.projectId,
+		project_environment_id: tenant.envId,
+		wallet_id: walletId
+	};
+}
 function createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1(input) {
 	return { executeEd25519SourcePreservingV1: async (request) => {
-		const tenantRoot = await input.resolveTenantRoot(request);
+		const tenantRootWire = await routerAbEd25519YaoTenantRootWireV1(await input.resolveTenantRoot(request));
 		return await postRouterJsonRequestV1(input, CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, {
 			source_binding: request.sourceBinding,
 			target: {
-				tenant_root: {
-					identity_digest_b64u: tenantRoot.identityDigestB64u,
-					custody_lineage_b64u: tenantRoot.custodyLineageB64u
-				},
+				tenant_root: tenantRootWire,
 				application: request.applicationBinding,
 				participant_ids: request.participantIds,
 				target: {
+					operation: "registration",
 					binding: request.targetRequest.binding,
 					deriver_a_input: request.targetRequest.deriver_a_input,
 					deriver_b_input: request.targetRequest.deriver_b_input
 				}
 			}
-		}, "Ed25519 source-preserving Router execution");
+		}, "Ed25519 source-preserving Router execution", "replay");
 	} };
 }
 function createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1(input) {
@@ -38,18 +47,19 @@ function createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1(inp
 			return ed25519ReservationFromSourceContributionV1(request);
 		},
 		reserveInactiveEcdsaSignerMaterialV1: async (request) => {
-			return parseEcdsaReservationResponseV1(request, await postReservationRequestV1(input, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, ecdsaReservationRequestToWireV1(request), "ecdsa_secp256k1"));
+			return parseEcdsaReservationResponseV1(request, await postReservationRequestV1(input, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, ecdsaReservationRequestToWireV1(request, input.tenant), "ecdsa_secp256k1"));
 		}
 	};
 }
 function createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1(input) {
 	return {
-		activateInactiveEd25519SignerMaterialV1: async (request) => await postActivationRequestV1(input, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, ed25519ActivationRequestToWireV1(request), "ed25519"),
-		activateInactiveEcdsaSignerMaterialV1: async (request) => await postActivationRequestV1(input, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, ecdsaActivationRequestToWireV1(request), "ecdsa_secp256k1")
+		activateInactiveEd25519SignerMaterialV1: async (request) => await postActivationRequestV1(input, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, ed25519ActivationRequestToWireV1(request, input.tenant), "ed25519"),
+		activateInactiveEcdsaSignerMaterialV1: async (request) => await postActivationRequestV1(input, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, ecdsaActivationRequestToWireV1(request, input.tenant), "ecdsa_secp256k1")
 	};
 }
-function ecdsaReservationRequestToWireV1(request) {
+function ecdsaReservationRequestToWireV1(request, tenant) {
 	return {
+		scope: signingWorkerWalletScopeWireV1(tenant, String(request.plannedActivationRef.materialOwner)),
 		source_derivation: {
 			application_binding_digest_b64u: request.preparation.sourceDerivation.applicationBindingDigestB64u,
 			client_share_retry_counter: request.preparation.sourceDerivation.clientShareRetryCounter
@@ -75,15 +85,18 @@ function ed25519ReservationFromSourceContributionV1(request) {
 		serverMaterialReservationId: sourceContribution.reservationId
 	};
 }
-function ed25519ActivationRequestToWireV1(input) {
+function ed25519ActivationRequestToWireV1(input, tenant) {
 	return {
+		scope: signingWorkerWalletScopeWireV1(tenant, input.sourceContribution.targetBinding.lifecycle.account_id),
 		binding: input.sourceContribution.targetBinding,
 		reservation_id: input.reservationId
 	};
 }
-function ecdsaActivationRequestToWireV1(input) {
+function ecdsaActivationRequestToWireV1(input, tenant) {
+	const materialActivation = input.preparation.sourceContribution.binding.target.activation;
 	return {
-		material_activation: routerAbMpcMaterialActivationRefToWire(input.preparation.sourceContribution.binding.target.activation),
+		scope: signingWorkerWalletScopeWireV1(tenant, String(materialActivation.materialOwner)),
+		material_activation: routerAbMpcMaterialActivationRefToWire(materialActivation),
 		reservation_id: input.reservationId
 	};
 }
@@ -216,16 +229,27 @@ async function postSigningWorkerJsonRequestV1(input, path, body, operation) {
 		throw new Error(`${operation} returned invalid JSON`);
 	}
 }
-async function postRouterJsonRequestV1(input, path, body, operation) {
-	const response = await input.fetch(new Request(`https://mpc-router.router-ab.internal${path}`, {
+async function postRouterJsonRequestV1(input, path, body, operation, retryAfterTransportFailure = "none") {
+	const send = async (replay) => await input.fetch(new Request(`https://mpc-router.router-ab.internal${path}`, {
 		method: "POST",
 		headers: {
 			"content-type": "application/json",
-			"x-router-ab-internal-service-auth": input.internalServiceAuthSecret
+			"x-router-ab-internal-service-auth": input.internalServiceAuthSecret,
+			...replay ? { [ROUTER_AB_YAO_REPLAY_HEADER_V1]: "1" } : {}
 		},
 		body: JSON.stringify(body)
 	}));
-	if (!response.ok) throw new Error(`${operation} failed with HTTP ${response.status}`);
+	let response;
+	try {
+		response = await send(false);
+	} catch (error) {
+		if (retryAfterTransportFailure === "none") throw error;
+		response = await send(true);
+	}
+	if (!response.ok) {
+		const reason = (await response.text().catch(() => "")).slice(0, 300);
+		throw new Error(`${operation} failed with HTTP ${response.status}: ${reason}`);
+	}
 	try {
 		return await response.json();
 	} catch {
@@ -234,18 +258,21 @@ async function postRouterJsonRequestV1(input, path, body, operation) {
 }
 function createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1(input) {
 	return {
-		deactivateInactiveEd25519SignerMaterialV1: async ({ materialActivation }) => await postDeactivationRequestV1(input, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, materialActivation, "ed25519"),
-		deactivateInactiveEcdsaSignerMaterialV1: async ({ materialActivation }) => await postDeactivationRequestV1(input, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, materialActivation, "ecdsa_secp256k1")
+		deactivateInactiveEd25519SignerMaterialV1: async ({ materialActivation }) => await postDeactivationRequestV1(input, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, materialActivation, "ed25519", signingWorkerWalletScopeWireV1(input.tenant, String(materialActivation.materialOwner))),
+		deactivateInactiveEcdsaSignerMaterialV1: async ({ materialActivation }) => await postDeactivationRequestV1(input, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, materialActivation, "ecdsa_secp256k1", signingWorkerWalletScopeWireV1(input.tenant, String(materialActivation.materialOwner)))
 	};
 }
-async function postDeactivationRequestV1(input, path, materialActivation, keyFamily) {
+async function postDeactivationRequestV1(input, path, materialActivation, keyFamily, scope) {
 	const response = await input.fetch(new Request(`https://signing-worker.router-ab.internal${path}`, {
 		method: "POST",
 		headers: {
 			"content-type": "application/json",
 			"x-router-ab-internal-service-auth": input.internalServiceAuthSecret
 		},
-		body: JSON.stringify({ material_activation: routerAbMpcMaterialActivationRefToWire(materialActivation) })
+		body: JSON.stringify({
+			scope,
+			material_activation: routerAbMpcMaterialActivationRefToWire(materialActivation)
+		})
 	}));
 	if (!response.ok) throw new Error(`ordinary ${keyFamily} material deactivation failed with HTTP ${response.status}`);
 	let raw;