@seams/wallet-server 0.7.1 → 0.8.0

package/dist/esm/core/nearRelayerAccountProvisioning.js

@@ -2,16 +2,17 @@ import { base64UrlDecode, base64UrlEncode } from "../shared-ts/src/utils/base64.
 import { sha256Bytes } from "../shared-ts/src/utils/digests.js";
 import { base58Encode } from "../shared-ts/src/utils/base58.js";
 import "../shared-ts/src/utils/encoders.js";
-import { deriveImplicitNearAccountIdFromEd25519PublicKey, parseImplicitNearAccountId, parseNamedNearAccountId } from "../shared-ts/src/utils/near.js";
 import { coerceNonEmptyString, requireRecordOrArray } from "../shared-ts/src/utils/validation.js";
+import { failure } from "../shared-ts/src/utils/failure.js";
 import { ActionType, validateActionArgsWasm } from "../shared-ts/src/near/actions.js";
+import { deriveImplicitNearAccountIdFromEd25519PublicKey, parseImplicitNearAccountId, parseNamedNearAccountId } from "../shared-ts/src/utils/near.js";
 import { errorMessage } from "../shared-ts/src/utils/errors.js";
+import { threshold_ed25519_build_near_tx_unsigned_borsh, threshold_ed25519_decode_signed_near_tx_borsh, threshold_ed25519_finalize_near_tx_from_signature } from "../wasm/near_signer/pkg/wasm_signer_worker.js";
 import { toPublicKeyStringFromSecretKey } from "./nearKeys.js";
-import { SignedTransaction } from "../shared-ts/src/near/nearClient.js";
-import { MinimalNearClient, NearRpcError } from "./rpcClients/near/NearClient.js";
 import { requireFinalizeNearTxFromSignatureOutput, requireSingleUnsignedNearTxBorshOutput, signNearDigestWithSecretKey } from "./authService/nearPrivateKeySigning.js";
-import { threshold_ed25519_build_near_tx_unsigned_borsh, threshold_ed25519_decode_signed_near_tx_borsh, threshold_ed25519_finalize_near_tx_from_signature } from "../wasm/near_signer/pkg/wasm_signer_worker.js";
 import { ensureNearSignerWasm } from "./nearSignerWasmRuntime.js";
+import { SignedTransaction } from "../shared-ts/src/near/nearClient.js";
+import { MinimalNearClient, NearRpcError } from "./rpcClients/near/NearClient.js";
 //#region src/core/nearRelayerAccountProvisioning.ts
 /**
 * A plain funding transfer only has to be executed before the client can read
@@ -72,8 +73,7 @@ function requireDecodedSponsoredNearAccountCreation(value, signedTransactionBors
 					permission: "FullAccess"
 				}
 			} }
-		],
-		signedTransactionBorshB64u
+		]
 	};
 }
 function parsePositiveYocto(value, label) {
@@ -265,11 +265,7 @@ async function fundImplicitNearAccountWithRelayer(input) {
 			message: "Implicit NEAR account funding transaction submitted"
 		};
 	} catch (error) {
-		return {
-			ok: false,
-			code: "funding_failed",
-			message: errorMessage(error) || "Failed to fund implicit NEAR account"
-		};
+		return failure("funding_failed", errorMessage(error) || "Failed to fund implicit NEAR account");
 	}
 }
 /**
@@ -313,11 +309,9 @@ async function prepareSponsoredNearAccountCreationWithRelayer(input) {
 			}
 		};
 	} catch (error) {
-		const message = errorMessage(error) || "Failed to prepare NEAR account creation";
 		return {
 			ok: false,
-			error: message,
-			message
+			message: errorMessage(error) || "Failed to prepare NEAR account creation"
 		};
 	}
 }

package/dist/esm/core/passkeyCredentialClaims.js

@@ -0,0 +1,8 @@
+//#region src/core/passkeyCredentialClaims.ts
+async function reservePasskeyCredential(claims, input) {
+	if (claims && !await claims.claim(input)) throw new Error("Passkey credential belongs to another wallet or home");
+}
+//#endregion
+export { reservePasskeyCredential };
+
+//# sourceMappingURL=passkeyCredentialClaims.js.map

package/dist/esm/core/routerAbSigning/RouterAbEcdsaPresignRuntime.js

@@ -1,12 +1,9 @@
-import { coerceThresholdNodeRole, parseThresholdEd25519ParticipantIds2p } from "../ThresholdService/config.js";
+import { parseThresholdEd25519ParticipantIds2p } from "../ThresholdService/config.js";
 import { exportRouterAbLinkedDeviceEcdsaShare, startRouterAbLinkedDeviceEcdsaPresignSession, stepRouterAbLinkedDeviceEcdsaPresignSession } from "../ThresholdService/routerAb/ecdsaDerivationPresignBridge.js";
 import { RouterAbEcdsaDerivationPoolFillHandlers } from "../ThresholdService/routerAb/ecdsaDerivationPoolFillHandlers.js";
 //#region src/core/routerAbSigning/RouterAbEcdsaPresignRuntime.ts
 function parseRouterAbEcdsaPresignRuntimeConfig(input) {
-	return {
-		nodeRole: coerceThresholdNodeRole(input.THRESHOLD_NODE_ROLE),
-		participantIds: parseThresholdEd25519ParticipantIds2p(input)
-	};
+	return { participantIds: parseThresholdEd25519ParticipantIds2p(input) };
 }
 function routerAbEcdsaPresignGlobalFetch(input, init) {
 	return globalThis.fetch(input, init);
@@ -24,7 +21,6 @@ var RouterAbEcdsaPresignRuntime = class {
 	constructor(input) {
 		this.signingWorkerTransport = resolveSigningWorkerTransport(input.signingWorkerTransport);
 		this.handlers = new RouterAbEcdsaDerivationPoolFillHandlers({
-			nodeRole: input.config.nodeRole,
 			participantIds2p: input.config.participantIds.participantIds2p,
 			ensureReady: input.ensureReady,
 			signingWorkerTransport: this.signingWorkerTransport

package/dist/esm/core/routerAbSigning/RouterAbNormalSigningRuntime.js

@@ -1,35 +1,7 @@
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import "../../shared-ts/src/utils/validation.js";
 import { MAX_WALLET_SESSION_REMAINING_USES, MAX_WALLET_SESSION_TTL_MS } from "../../shared-ts/src/threshold/sessionPolicy.js";
-import { parseRouterAbNormalSigningServerPolicy, validateRouterAbNormalSigningServerPolicy } from "../ThresholdService/routerAbNormalSigningPolicy.js";
+import { validateRouterAbNormalSigningServerPolicy } from "../ThresholdService/routerAbNormalSigningPolicy.js";
 //#region src/core/routerAbSigning/RouterAbNormalSigningRuntime.ts
-function requireRouterAbConfiguredSigningWorkerPrivateTransport(transport) {
-	if (transport.kind !== "configured") throw new Error("InvalidLocalServiceConfig: ROUTER_AB_SIGNING_WORKER_URL and ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET are required for Router A/B ECDSA presign");
-	return transport;
-}
-function parseSigningWorkerTransport(config) {
-	const signingWorkerBaseUrl = normalizeOptionalTrimmedString(config.ROUTER_AB_SIGNING_WORKER_URL);
-	const secret = normalizeOptionalTrimmedString(config.ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET);
-	const fetchImpl = typeof config.routerAbSigningWorkerFetch === "function" ? config.routerAbSigningWorkerFetch : void 0;
-	if (!signingWorkerBaseUrl && !secret) return { kind: "unconfigured" };
-	if (!signingWorkerBaseUrl) throw new Error("ROUTER_AB_SIGNING_WORKER_URL is required when Router A/B internal service auth is configured");
-	if (!secret) throw new Error("ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET is required when Router A/B SigningWorker URL is configured");
-	return {
-		kind: "configured",
-		signingWorkerBaseUrl,
-		auth: {
-			kind: "internal_service_auth_secret",
-			secret
-		},
-		...fetchImpl ? { fetchImpl } : {}
-	};
-}
-function parseRouterAbNormalSigningRuntimeConfig(config) {
-	return {
-		policy: parseRouterAbNormalSigningServerPolicy(config),
-		signingWorkerTransport: parseSigningWorkerTransport(config)
-	};
-}
 var RouterAbNormalSigningRuntime = class {
 	constructor(input) {
 		this.walletSessionStore = input.walletSessionStore;
@@ -96,6 +68,6 @@ var RouterAbNormalSigningRuntime = class {
 	}
 };
 //#endregion
-export { RouterAbNormalSigningRuntime, parseRouterAbNormalSigningRuntimeConfig, requireRouterAbConfiguredSigningWorkerPrivateTransport };
+export { RouterAbNormalSigningRuntime };
 
 //# sourceMappingURL=RouterAbNormalSigningRuntime.js.map

package/dist/esm/core/signingLanes/WalletExecutionLaneProjection.js

@@ -1,4 +1,4 @@
-import { parseEmailOtpProviderUserId, parseLaneShareEpoch, parseMpcSigningWorkerRef, parseSigningLaneId, parseWalletKeyId, parseWebAuthnCredentialIdB64u } from "../../shared-ts/src/utils/domainIds.js";
+import { mpcMaterialActivationRefsEqual, parseEmailOtpProviderUserId, parseLaneShareEpoch, parseMpcSigningWorkerRef, parseSigningLaneId, parseWalletKeyId, parseWebAuthnCredentialIdB64u } from "../../shared-ts/src/utils/domainIds.js";
 import { base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify } from "../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u, sha256Utf8DigestB64u } from "../../shared-ts/src/utils/canonicalPrimitives.js";
@@ -218,13 +218,13 @@ function requireOnlyEcdsaSigners(signers) {
 function signerMatchesMaterialActivation(signer, expected) {
 	const wire = signer.version === "wallet_signer_ed25519_v1" ? signer.activeYaoCapability.activationResult.public_receipt.material_activation : signer.walletKey.publicCapability.material_activation;
 	try {
-		return sameMaterialActivation(routerAbMpcMaterialActivationRefFromWire(wire), expected);
+		return mpcMaterialActivationRefsEqual(routerAbMpcMaterialActivationRefFromWire(wire), expected);
 	} catch {
 		return false;
 	}
 }
 function assertExpectedActivation(wire, expected) {
-	if (!sameMaterialActivation(routerAbMpcMaterialActivationRefFromWire(wire), expected)) throw new Error("wallet signer material activation changed");
+	if (!mpcMaterialActivationRefsEqual(routerAbMpcMaterialActivationRefFromWire(wire), expected)) throw new Error("wallet signer material activation changed");
 }
 function assertEcdsaReceiptContinuity(signer) {
 	const capability = signer.walletKey.publicCapability;
@@ -241,9 +241,6 @@ async function digestPublicIdentity(value) {
 async function digestValue(domain, value) {
 	return sha256Utf8DigestB64u(`${domain}\u0000${alphabetizeStringify(value)}`);
 }
-function sameMaterialActivation(left, right) {
-	return left.activationId === right.activationId && left.capability === right.capability && left.materialOwner === right.materialOwner && left.keyBinding === right.keyBinding && left.lifecycleBinding === right.lifecycleBinding && left.signingWorker === right.signingWorker;
-}
 function requireParsed(result) {
 	if (result.ok) return result.value;
 	throw new Error("wallet execution lane identity is invalid");

package/dist/esm/core/signingMaterial/ordinaryInactiveSignerMaterialReservation.js

@@ -1,7 +1,7 @@
 import { hasWhitespaceOrControlCharacters, mpcMaterialActivationRefsEqual, parseMpcMaterialActivationRef } from "../../shared-ts/src/utils/domainIds.js";
 import { parseExactAdministeredSignerManifestV1 } from "../../shared-ts/src/device-linking/delegatedActivationPlan.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { parseRouterAbEd25519YaoActivationPublicReceiptV1, parseRouterAbEd25519YaoCeremonyBindingV1, parseRouterAbEd25519YaoEncryptedPackageV1, parseRouterAbEd25519YaoParticipantIdsV1 } from "../../shared-ts/src/utils/routerAbEd25519Yao.js";
+import { parseRouterAbEd25519YaoActivationPublicReceiptV1, parseRouterAbEd25519YaoCeremonyBindingV1, parseRouterAbEd25519YaoEncryptedPackageV1, parseRouterAbEd25519YaoParticipantIdsV1, sameRouterAbEd25519YaoByteSequence } from "../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { parseLinkedDeviceEcdsaEncryptedSourceContributionV1, parseLinkedDeviceEcdsaSourceContributionPackageV1, parseLinkedDeviceEcdsaSourceDerivationV1, parseLinkedDeviceEcdsaSourcePreservingActivationReceiptV1 } from "../../shared-ts/src/device-linking/sourceContribution.js";
 //#region src/core/signingMaterial/ordinaryInactiveSignerMaterialReservation.ts
 function validateOrdinaryInactiveSignerMaterialDeactivationRequestV1(request) {
@@ -130,7 +130,7 @@ function parseOrdinaryEd25519SignerMaterialWorkerReservationV1(request, raw) {
 	const activationReceipt = parseRouterAbEd25519YaoActivationPublicReceiptV1(reservation.activationReceipt);
 	assertMaterialActivationMatchesV1(request.plannedActivationRef, routerAbMpcMaterialActivationRefFromWire(activationReceipt.material_activation));
 	const clientMaterial = parseEd25519ClientMaterialV1(reservation.clientMaterial);
-	if (!sameBytes(activationReceipt.transcript, clientMaterial.deriver_a_client_package.transcript) || !sameBytes(activationReceipt.transcript, clientMaterial.deriver_b_client_package.transcript)) throw new Error("ordinary Ed25519 worker receipt transcript does not match client packages");
+	if (!sameRouterAbEd25519YaoByteSequence(activationReceipt.transcript, clientMaterial.deriver_a_client_package.transcript) || !sameRouterAbEd25519YaoByteSequence(activationReceipt.transcript, clientMaterial.deriver_b_client_package.transcript)) throw new Error("ordinary Ed25519 worker receipt transcript does not match client packages");
 	return {
 		kind: "ordinary_ed25519_signer_material_worker_reservation_v1",
 		keyFamily: "ed25519",
@@ -247,9 +247,6 @@ function sameEcdsaSourceSigner(left, right) {
 function sameEcdsaTarget(left, right) {
 	return mpcMaterialActivationRefsEqual(left.activation, right.activation) && String(left.targetDeviceId) === String(right.targetDeviceId) && left.targetFactorVerificationDigestB64u === right.targetFactorVerificationDigestB64u && left.clientRecipientPublicKeyB64u === right.clientRecipientPublicKeyB64u && left.signingWorkerRecipientPublicKeyB64u === right.signingWorkerRecipientPublicKeyB64u;
 }
-function sameBytes(left, right) {
-	return left.length === right.length && left.every((value, index) => value === right[index]);
-}
 function parseEd25519ClientPackageV1(raw, label, expectedRole) {
 	const parsed = parseRouterAbEd25519YaoEncryptedPackageV1(raw);
 	if (!parsed.ok) throw new Error(`${label} ${parsed.message}`);

package/dist/esm/core/thresholdEcdsaChainTarget.js

@@ -1,3 +1,4 @@
+import { thresholdEcdsaChainTargetKey } from "../shared-ts/src/utils/thresholdEcdsaChainTarget.js";
 //#region src/core/thresholdEcdsaChainTarget.ts
 function positiveSafeInteger(value) {
 	return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : null;
@@ -31,13 +32,7 @@ function thresholdEcdsaChainTargetFromValue(value) {
 	}
 	return null;
 }
-function thresholdEcdsaChainTargetKey(target) {
-	return target.kind === "evm" ? `evm:eip155:${target.chainId}` : `tempo:${target.chainId}`;
-}
-function thresholdEcdsaChainTargetsEqual(left, right) {
-	return thresholdEcdsaChainTargetKey(left) === thresholdEcdsaChainTargetKey(right);
-}
 //#endregion
-export { thresholdEcdsaChainTargetFromValue, thresholdEcdsaChainTargetKey, thresholdEcdsaChainTargetsEqual };
+export { thresholdEcdsaChainTargetFromValue, thresholdEcdsaChainTargetKey };
 
 //# sourceMappingURL=thresholdEcdsaChainTarget.js.map

package/dist/esm/hosted-wallet-gateway.js

@@ -16,6 +16,8 @@ import { handleWalletControlRequest } from "./router/cloudflare/runtime/walletCo
 import { resolveRuntimeTenantRootLineage } from "./router/cloudflare/runtime/walletConsoleTenantRootLineage.js";
 import { ROUTER_AB_MPC_ROUTER_ORIGIN, ROUTER_AB_SIGNING_WORKER_ORIGIN, createRouterAbServiceBindingFetch } from "./router/cloudflare/runtime/routerAbServiceBindings.js";
 import { readEnvironmentCsv, readEnvironmentString, requireEnvironmentString } from "./router/cloudflare/runtime/environment.js";
+import { createD1LinkedDeviceSourceContributionPreparationPlannerV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceSourceContributionPreparationPlanner.js";
+import { readD1LinkedDeviceEcdsaSourceV1, readD1LinkedDeviceEd25519SourceV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService.js";
 import { RouterAbEd25519YaoExportOwnerProofAuthorizationAdapter } from "./router/domains/ed25519Yao/export/routerAbEd25519YaoExport.js";
 import { createRouterAbEd25519YaoHttpRegistrationBackendFromEnv } from "./router/domains/ed25519Yao/registration/routerAbEd25519YaoHttpRegistrationBackend.js";
 import { createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1 } from "./router/cloudflare/d1/ed25519Yao/d1Ed25519YaoProductRegistrationPartitionedStateStore.js";
@@ -25,8 +27,6 @@ import { handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1 } from ".
 import { CloudflareD1RouterAbEd25519YaoCapabilityPersistence } from "./router/cloudflare/d1/ed25519Yao/d1Ed25519YaoCapabilityPersistence.js";
 import { createSigningSessionSealOptions } from "./threshold/session/signingSessionSeal/options.js";
 import { createRouterAbEcdsaEd25519CeremonyTokenIssuer, createRouterAbEcdsaStrictPostRegistrationPort, createRouterAbEcdsaStrictRegistrationPort, parseRouterAbEcdsaEd25519PrivateJwk, parseRouterAbEcdsaStrictRegistrationTopology } from "./router/domains/ecdsa/routerAbEcdsaStrictRegistration.js";
-import { createD1LinkedDeviceSourceContributionPreparationPlannerV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceSourceContributionPreparationPlanner.js";
-import { readD1LinkedDeviceEcdsaSourceV1, readD1LinkedDeviceEd25519SourceV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService.js";
 import { D1LinkedDeviceTargetCredentialProviderV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetCredentialProvider.js";
 import { createD1LinkedDeviceOwnerSourceChildReaderV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceOwnerAuthorizationProvider.js";
 import { createCloudflareD1RouterApiAuthService } from "./router/cloudflare/d1/auth/d1RouterApiAuthService.js";
@@ -58,13 +58,6 @@ const RELAY_SIGNER_READY_TABLES = Object.freeze([
 	"router_ab_normal_signing_admission_records",
 	"registration_ceremony_records",
 	"registration_ceremony_cas_guard",
-	"lane_enrollments",
-	"lane_protocol_operations",
-	"lane_product_epochs",
-	"lane_receipts",
-	"lane_effect_journal",
-	"lane_locks",
-	"lane_cas_guard",
 	"linked_device_sessions",
 	"linked_device_session_cas_guard",
 	"linked_device_session_transcripts",
@@ -204,6 +197,18 @@ async function createStagingRouterApiAuthComposition(env, scope, yaoRuntime, ten
 	return {
 		service: createCloudflareD1RouterApiAuthService({
 			database: env.SIGNER_DB,
+			identityStore: dependencies.identityStore,
+			emailOtpRateLimitCounter: dependencies.emailOtpRateLimitCounter,
+			googleRegistrationAttempts: dependencies.googleRegistrationAttempts,
+			sessionRouting: dependencies.sessionRouting,
+			recoveryRouting: dependencies.recoveryRouting,
+			lifecycleRouting: dependencies.lifecycleRouting,
+			registrationAuthority: dependencies.registrationAuthority,
+			credentialClaims: dependencies.credentialClaims,
+			syncChallenges: dependencies.syncChallenges,
+			linkedDeviceProofNonces: dependencies.linkedDeviceProofNonces,
+			linkedDeviceBootstrap: dependencies.linkedDeviceBootstrap,
+			registrationSetupDispatcher: dependencies.registrationSetupDispatcher,
 			namespace: scope.namespace,
 			orgId: scope.orgId,
 			projectId: scope.projectId,
@@ -217,7 +222,6 @@ async function createStagingRouterApiAuthComposition(env, scope, yaoRuntime, ten
 			implicitNearAccountTestFundingEnabled: readEnvironmentString(env, "ENABLE_IMPLICIT_NEAR_ACCOUNT_TEST_FUNDING"),
 			googleOidcClientId: readEnvironmentString(env, "GOOGLE_OIDC_CLIENT_ID"),
 			githubOAuth: stagingGithubOAuthConfig(env),
-			accountIdDerivationSecret: requireEnvironmentString(env, "ACCOUNT_ID_DERIVATION_SECRET"),
 			emailOtpServerSeal: stagingEmailOtpServerSealConfig(env),
 			emailOtpDeliveryMode: readEnvironmentString(env, "EMAIL_OTP_DELIVERY_MODE"),
 			emailOtpRuntimeProfile: readEnvironmentString(env, "EMAIL_OTP_RUNTIME_PROFILE"),
@@ -392,36 +396,45 @@ async function createSplitGatewayRouterHandler(env, dependencies = {}) {
 async function handleSplitGatewayWalletRuntimeRequest(request, env, dependencies = {}) {
 	const controlResponse = await handleWalletControlRequest(request, env);
 	if (controlResponse) return controlResponse;
-	return await createWalletRuntimeOpsHandler(async () => {
-		const scope = stagingTenantScope(env);
-		const tenantRootCustodyLineage = createStagingTenantRootCustodyLineage(createWalletConsoleOpsClient(env.WALLET_CONSOLE));
-		const { service } = await createStagingRouterApiAuthComposition(env, scope, createStagingYaoRequestScopedRuntime(env, createStagingRegistrationTenantRootResolver(scope, tenantRootCustodyLineage)), tenantRootCustodyLineage, dependencies);
-		return {
-			executeSignedDelegate: service.executeSignedDelegate.bind(service),
-			getRelayerAccount: service.router.getRelayerAccount.bind(service.router),
-			getWalletIdentities: (input) => readWalletRuntimeIdentities(env, input)
-		};
-	})(request);
+	return await createWalletRuntimeOpsHandler(async () => ({
+		async executeSignedDelegate(input) {
+			return await (await resolveWalletExecutionService(env, dependencies)).executeSignedDelegate(input);
+		},
+		async getRelayerAccount() {
+			return (await resolveWalletExecutionService(env, dependencies)).router.getRelayerAccount();
+		},
+		getWalletIdentities: readWalletRuntimeIdentities.bind(void 0, env)
+	}))(request);
+}
+async function resolveWalletExecutionService(env, dependencies) {
+	const scope = stagingTenantScope(env);
+	const tenantRootCustodyLineage = createStagingTenantRootCustodyLineage(createWalletConsoleOpsClient(env.WALLET_CONSOLE));
+	const { service } = await createStagingRouterApiAuthComposition(env, scope, createStagingYaoRequestScopedRuntime(env, createStagingRegistrationTenantRootResolver(scope, tenantRootCustodyLineage)), tenantRootCustodyLineage, dependencies);
+	return service;
 }
 function isJsonRecord(value) {
 	return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
 async function readWalletRuntimeIdentities(env, input) {
-	const placeholders = input.wallets.map(() => "?").join(", ");
-	const rows = await env.SIGNER_DB.prepare(`SELECT project_id, wallet_id, signer_family, record_json
+	const selectors = input.wallets.map(() => "(project_id = ? AND env_id = ? AND wallet_id = ?)");
+	const rows = await env.SIGNER_DB.prepare(`SELECT project_id, env_id, wallet_id, signer_family, record_json
        FROM wallet_signers
-      WHERE namespace = ?
-        AND org_id = ?
-        AND wallet_id IN (${placeholders})`).bind(requireEnvironmentString(env, "SEAMS_TENANT_STORAGE_NAMESPACE"), input.orgId, ...input.wallets.map((wallet) => wallet.walletId)).all();
-	const requestedWallets = new Map(input.wallets.map((wallet) => [wallet.walletId, wallet]));
+      WHERE namespace = ? AND org_id = ?
+        AND (${selectors.join(" OR ")})`).bind(requireEnvironmentString(env, "SEAMS_TENANT_STORAGE_NAMESPACE"), input.orgId, ...input.wallets.flatMap((wallet) => [
+		wallet.projectId,
+		wallet.envId,
+		wallet.walletId
+	])).all();
 	const identities = /* @__PURE__ */ new Map();
 	for (const row of rows.results || []) {
-		const walletId = String(row.wallet_id || "").trim();
-		const requested = requestedWallets.get(walletId);
-		if (!requested || requested.projectId !== String(row.project_id || "").trim()) continue;
+		const key = JSON.stringify([
+			row.project_id,
+			row.env_id,
+			row.wallet_id
+		]);
 		const record = parseD1JsonColumn(row.record_json);
 		if (!isJsonRecord(record)) continue;
-		const current = identities.get(walletId) || {
+		const current = identities.get(key) || {
 			nearAccountId: "",
 			evmAddress: null
 		};
@@ -430,13 +443,24 @@ async function readWalletRuntimeIdentities(env, input) {
 			const address = String(record.walletKey.thresholdOwnerAddress || "").trim().toLowerCase();
 			if (/^0x[0-9a-f]{40}$/.test(address)) current.evmAddress = address;
 		}
-		identities.set(walletId, current);
+		identities.set(key, current);
 	}
-	return { identities: Array.from(identities.entries()).flatMap(([walletId, identity]) => identity.nearAccountId && identity.evmAddress ? [{
-		walletId,
-		nearAccountId: identity.nearAccountId,
-		evmAddress: identity.evmAddress
-	}] : []) };
+	const result = [];
+	for (const wallet of input.wallets) {
+		const identity = identities.get(JSON.stringify([
+			wallet.projectId,
+			wallet.envId,
+			wallet.walletId
+		]));
+		if (identity?.nearAccountId && identity.evmAddress) result.push({
+			walletId: wallet.walletId,
+			projectId: wallet.projectId,
+			envId: wallet.envId,
+			nearAccountId: identity.nearAccountId,
+			evmAddress: identity.evmAddress
+		});
+	}
+	return { identities: result };
 }
 async function handleSplitGatewayRequest(request, env, ctx, dependencies = {}) {
 	if (request.method === "GET" && new URL(request.url).pathname === ROUTER_AB_CEREMONY_JWKS_PATH) return routerAbCeremonyJwksResponse(env);
@@ -512,14 +536,11 @@ function createStagingEcdsaPresignRuntime(env) {
 	const presignAuthSecret = requireEnvironmentString(env, "ROUTER_AB_GATEWAY_TO_SIGNING_WORKER_PRESIGN_AUTH_SECRET");
 	if (presignAuthSecret === requireEnvironmentString(env, "ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET") || presignAuthSecret === requireEnvironmentString(env, "ROUTER_AB_GATEWAY_TO_ROUTER_AUTH_SECRET")) throw new Error("Gateway-to-SigningWorker presign auth secret must be role-specific");
 	return new RouterAbEcdsaPresignRuntime({
-		config: {
-			nodeRole: "coordinator",
-			participantIds: {
-				clientParticipantId: 1,
-				relayerParticipantId: 2,
-				participantIds2p: [1, 2]
-			}
-		},
+		config: { participantIds: {
+			clientParticipantId: 1,
+			relayerParticipantId: 2,
+			participantIds2p: [1, 2]
+		} },
 		signingWorkerTransport: {
 			kind: "configured",
 			signingWorkerBaseUrl: ROUTER_AB_SIGNING_WORKER_ORIGIN,
@@ -614,6 +635,7 @@ async function handlePartitionedD1Operation(env, request, operation, tenantRootC
 		case "recovery_activate":
 		case "recovery_status": return await handleRouterAbEd25519YaoRecoveryRequestScopedCloudflareV1({
 			request,
+			lifecycleRouting: dependencies.lifecycleRouting,
 			...createStagingRecoveryRequestScopedDependencies(env, tenantRootCustodyLineage, dependencies)
 		});
 		case "export_admission":
@@ -622,6 +644,7 @@ async function handlePartitionedD1Operation(env, request, operation, tenantRootC
 			const { service } = await createStagingRouterApiAuthComposition(env, scope, createStagingYaoRequestScopedRuntime(env, createStagingRegistrationTenantRootResolver(scope, tenantRootCustodyLineage)), tenantRootCustodyLineage, dependencies);
 			return await handleRouterAbEd25519YaoExportRequestScopedCloudflareV1({
 				request,
+				lifecycleRouting: dependencies.lifecycleRouting,
 				...createStagingExportRequestScopedDependencies(env, service, tenantRootCustodyLineage)
 			});
 		}
@@ -719,6 +742,6 @@ function stagingWalletStore(env) {
 	});
 }
 //#endregion
-export { createHostedWalletGatewayCompositionV1, createSplitGatewayRouterHandler, createStagingEd25519YaoBackend, createStagingExportRequestScopedDependencies, createStagingRecoveryRequestScopedDependencies, handleSplitGatewayRequest, handleSplitGatewayWalletRuntimeRequest, readStagingHostedWalletOrigins, stagingSigningSessionSealOptions };
+export { createHostedWalletGatewayCompositionV1, createSplitGatewayRouterHandler, createStagingEd25519YaoBackend, createStagingExportRequestScopedDependencies, createStagingRecoveryRequestScopedDependencies, handleSplitGatewayRequest, handleSplitGatewayWalletRuntimeRequest, readStagingHostedWalletOrigins, readWalletRuntimeIdentities, stagingSigningSessionSealOptions };
 
 //# sourceMappingURL=hosted-wallet-gateway.js.map

package/dist/esm/index.js

@@ -5,11 +5,10 @@ import { authorizeSigningSessionSealRequest, buildSigningSessionSealApplyPath, b
 import { LocalWorkerVaultProxyGateway, VaultProxyUseService, buildVaultProxyUseOperation, createVaultProxyUseRouteExtension, parseVaultProxyDestination } from "./authorization/vaultProxyUse.js";
 import { SessionService, buildCorsOrigins, parseCsvList } from "./core/SessionService.js";
 import { computeEip1559TxHash, encodeEip1559SignedTxFromSignature65, ensureEvmCryptoWasm, secp256k1PrivateKey32ToPublicKey33, secp256k1PublicKey33ToEthereumAddress, signSecp256k1Recoverable } from "./core/ThresholdService/evmCryptoWasm.js";
-import { THRESHOLD_DO_OBJECT_NAME_DEFAULT, THRESHOLD_NODE_ROLE_COORDINATOR, THRESHOLD_NODE_ROLE_DEFAULT, THRESHOLD_PREFIX_DEFAULT } from "./core/defaultConfigsServer.js";
-import { formatSigningSessionSealKeyVersionForWire, parseSigningSessionSealKeyVersion } from "./shared-ts/src/threshold/keyMaterialBrands.js";
-import { buildWalletEd25519SignerId, createWalletStore, resolveWalletStoreNamespace } from "./core/WalletStore.js";
+import { buildWalletEd25519SignerId } from "./core/WalletStore.js";
 import { D1WalletStore, WALLET_STORE_D1_SCHEMA_SQL, buildWalletEcdsaSignerRecord, ensureWalletStoreD1Schema } from "./core/d1WalletStore.js";
 import { D1WalletAuthMethodStore, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, ensureWalletAuthMethodStoreD1Schema, normalizeWalletAuthMethod } from "./core/d1WalletAuthMethodStore.js";
+import { formatSigningSessionSealKeyVersionForWire, parseSigningSessionSealKeyVersion } from "./shared-ts/src/threshold/keyMaterialBrands.js";
 import { RouterAbEcdsaPresignRuntime } from "./core/routerAbSigning/RouterAbEcdsaPresignRuntime.js";
 import { registrationPreparationIdFromString } from "./core/types.js";
 import { InMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createRouterAbNormalSigningAdmissionAdapter } from "./router/domains/signingOperations/routerAbNormalSigningAdmissionCore.js";
@@ -18,7 +17,6 @@ import { normalizeRorHost, sanitizeRorOrigins } from "./router/framework/ror/nor
 import { resolveRorRpId, validateRouterApiRorOptions } from "./router/framework/ror/provider.js";
 import { handleSigningSessionSealRoutes } from "./threshold/session/signingSessionSeal/transport/fetch.js";
 import { createRouterApiModule } from "./router/framework/modules.js";
-import { D1WebAuthnCredentialBindingStore, WEBAUTHN_CREDENTIAL_BINDING_STORE_D1_SCHEMA_SQL, createWebAuthnCredentialBindingStore, ensureWebAuthnCredentialBindingStoreD1Schema, resolveWebAuthnCredentialBindingStoreNamespace } from "./core/WebAuthnCredentialBindingStore.js";
 import { StaticCloudflareTenantStorageRouteResolver, createCloudflareTenantStorageRoute, createSignerD1DoStorageTarget, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, tenantStorageRouteBackendFamily, tenantStorageRouteDiagnostic } from "./storage/tenantRoute.js";
 import { OrdinaryInactiveSignerMaterialReservationServiceV1, createOrdinaryInactiveSignerMaterialReservationServiceV1, parseOrdinaryEcdsaSignerMaterialDeactivationResultV1, parseOrdinaryEcdsaSignerMaterialWorkerReservationV1, parseOrdinaryEd25519SignerMaterialDeactivationResultV1, parseOrdinaryEd25519SignerMaterialWorkerReservationV1, validateOrdinaryInactiveSignerMaterialDeactivationRequestV1, validateOrdinaryInactiveSignerMaterialReservationRequestV1 } from "./core/signingMaterial/ordinaryInactiveSignerMaterialReservation.js";
 import { createPassthroughSigningSessionSealCipherAdapter, createSigningSessionSealCipherAdapter, createSigningSessionSealShamir3PassCipherAdapter, encodeSigningSessionSealServerLockContext } from "./threshold/session/signingSessionSeal/crypto/cipher.js";
@@ -28,26 +26,15 @@ import { createSigningSessionSealService } from "./threshold/session/signingSess
 import { createSigningSessionSealRoutesOptions } from "./threshold/session/signingSessionSeal/routesOptions.js";
 import { createSigningSessionSealOptions, parseSigningSessionSealRootConfig } from "./threshold/session/signingSessionSeal/options.js";
 import { D1IdentityStore, IDENTITY_STORE_D1_SCHEMA_SQL, ensureIdentityStoreD1Schema } from "./core/d1IdentityStore.js";
-import { D1NearPublicKeyStore, NEAR_PUBLIC_KEY_STORE_D1_SCHEMA_SQL, createNearPublicKeyStore, ensureNearPublicKeyStoreD1Schema } from "./core/NearPublicKeyStore.js";
-import { AUTH_SERVICE_CONFIG_DEFAULTS, createAuthServiceConfig, parseBool, requireEnvVar, validateConfigs } from "./core/config.js";
-import { createEcdsaWalletSessionStore, createEd25519WalletSessionStore } from "./core/ThresholdService/stores/WalletSessionStore.js";
-import { createRouterAbSigningRuntimes } from "./core/routerAbSigning/createRouterAbSigningRuntimes.js";
+import "./core/IdentityStore.js";
+import "./core/WalletAuthMethodStore.js";
+import { parseBool, requireEnvVar } from "./core/config.js";
 import { createInMemorySigningSessionSealIdempotencyStore } from "./threshold/session/signingSessionSeal/idempotency.js";
 import { createRedisTcpSigningSessionSealRateLimiter, createUpstashSigningSessionSealRateLimiter, resolveSigningSessionSealRateLimitFromEnv } from "./threshold/session/signingSessionSeal/guards/backends.js";
 import { createRedisTcpSigningSessionSealIdempotencyStore, createUpstashSigningSessionSealIdempotencyStore, resolveSigningSessionSealIdempotencyFromEnv } from "./threshold/session/signingSessionSeal/idempotencyBackends.js";
 import { registerSigningSessionSealRoutes } from "./threshold/session/signingSessionSeal/transport/express.js";
 import "./threshold/session/signingSessionSeal/index.js";
-import { createIdentityStore, resolveIdentityStoreNamespace } from "./core/IdentityStore.js";
-import { createWalletAuthMethodStore, resolveWalletAuthMethodStoreNamespace } from "./core/WalletAuthMethodStore.js";
-import { D1WebAuthnAuthenticatorStore, WEBAUTHN_AUTHENTICATOR_STORE_D1_SCHEMA_SQL, createWebAuthnAuthenticatorStore, ensureWebAuthnAuthenticatorStoreD1Schema, resolveWebAuthnAuthenticatorStoreNamespace } from "./core/WebAuthnAuthenticatorStore.js";
-import { D1WebAuthnLoginChallengeStore, WEBAUTHN_LOGIN_CHALLENGE_STORE_D1_SCHEMA_SQL, createWebAuthnLoginChallengeStore, ensureWebAuthnLoginChallengeStoreD1Schema } from "./core/WebAuthnLoginChallengeStore.js";
-import { D1WebAuthnSyncChallengeStore, WEBAUTHN_SYNC_CHALLENGE_STORE_D1_SCHEMA_SQL, createWebAuthnSyncChallengeStore, ensureWebAuthnSyncChallengeStoreD1Schema } from "./core/WebAuthnSyncChallengeStore.js";
-import { AuthService } from "./core/authService/AuthService.js";
-import "./core/AuthService.js";
-import { createThresholdEd25519KeyStore } from "./core/ThresholdService/stores/KeyStore.js";
-import { createThresholdEd25519SessionStore } from "./core/ThresholdService/stores/SessionStore.js";
-import "./core/ThresholdService/index.js";
 import { StaticRorOriginsProvider } from "./router/framework/ror/staticProvider.js";
 import { createRorOptions } from "./router/framework/ror/options.js";
 import "./router/framework/ror/index.js";
-export { AUTHORIZED_OPERATION_REPLAY_BODY_MAX_BYTES, AUTH_SERVICE_CONFIG_DEFAULTS, AuthService, AuthorizationService, CloudflareD1RouterAbNormalSigningAdmissionStore, D1IdentityStore, D1NearPublicKeyStore, D1WalletAuthMethodStore, D1WalletStore, D1WebAuthnAuthenticatorStore, D1WebAuthnCredentialBindingStore, D1WebAuthnLoginChallengeStore, D1WebAuthnSyncChallengeStore, IDENTITY_STORE_D1_SCHEMA_SQL, InMemoryRouterAbNormalSigningAdmissionStore, LocalWorkerVaultProxyGateway, NEAR_PUBLIC_KEY_STORE_D1_SCHEMA_SQL, OrdinaryInactiveSignerMaterialReservationServiceV1, RouterAbEcdsaPresignRuntime, SessionService, StaticCloudflareTenantStorageRouteResolver, StaticRorOriginsProvider, THRESHOLD_DO_OBJECT_NAME_DEFAULT, THRESHOLD_NODE_ROLE_COORDINATOR, THRESHOLD_NODE_ROLE_DEFAULT, THRESHOLD_PREFIX_DEFAULT, VaultProxyUseService, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, WALLET_STORE_D1_SCHEMA_SQL, WEBAUTHN_AUTHENTICATOR_STORE_D1_SCHEMA_SQL, WEBAUTHN_CREDENTIAL_BINDING_STORE_D1_SCHEMA_SQL, WEBAUTHN_LOGIN_CHALLENGE_STORE_D1_SCHEMA_SQL, WEBAUTHN_SYNC_CHALLENGE_STORE_D1_SCHEMA_SQL, authorizeSigningSessionSealRequest, authorizedOperationReplayBodyInit, buildActiveWalletSessionQuota, buildAuthorizedOperation, buildCorsOrigins, buildExactWalletSessionQuotaProjectionV1, buildPersistedActiveWalletSessionAuthorizationV2, buildSigningSessionSealApplyPath, buildSigningSessionSealRemovePath, buildVaultProxyUseOperation, buildWalletEcdsaSignerRecord, buildWalletEd25519SignerId, buildWalletSessionAuthorizationV2, buildWalletSessionCapabilitySubjectsV1, composeSigningSessionSealGuards, computeAuthorizedOperationResultDigest, computeEip1559TxHash, createAuthServiceConfig, createCloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareTenantStorageRoute, createEcdsaWalletSessionStore, createEd25519WalletSessionStore, createIdentityStore, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createInMemorySigningSessionSealIdempotencyStore, createInMemorySigningSessionSealRateLimiter, createNearPublicKeyStore, createOrdinaryInactiveSignerMaterialReservationServiceV1, createPassthroughSigningSessionSealCipherAdapter, createRedisTcpSigningSessionSealIdempotencyStore, createRedisTcpSigningSessionSealRateLimiter, createRorOptions, createRouterAbNormalSigningAdmissionAdapter, createRouterAbSigningRuntimes, createRouterApiModule, createSignerD1DoStorageTarget, createSigningSessionSealAuditLogger, createSigningSessionSealCipherAdapter, createSigningSessionSealOptions, createSigningSessionSealRateLimitGuard, createSigningSessionSealRoutesOptions, createSigningSessionSealService, createSigningSessionSealShamir3PassCipherAdapter, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, createThresholdEd25519KeyStore, createThresholdEd25519SessionStore, createUpstashSigningSessionSealIdempotencyStore, createUpstashSigningSessionSealRateLimiter, createVaultProxyUseRouteExtension, createWalletAuthMethodStore, createWalletStore, createWebAuthnAuthenticatorStore, createWebAuthnCredentialBindingStore, createWebAuthnLoginChallengeStore, createWebAuthnSyncChallengeStore, digestOpaqueValue, encodeEip1559SignedTxFromSignature65, encodeSigningSessionSealServerLockContext, ensureEvmCryptoWasm, ensureIdentityStoreD1Schema, ensureNearPublicKeyStoreD1Schema, ensureWalletAuthMethodStoreD1Schema, ensureWalletStoreD1Schema, ensureWebAuthnAuthenticatorStoreD1Schema, ensureWebAuthnCredentialBindingStoreD1Schema, ensureWebAuthnLoginChallengeStoreD1Schema, ensureWebAuthnSyncChallengeStoreD1Schema, exactWalletSessionCapabilitySubjectsResolveAuthority, formatSigningSessionSealKeyVersionForWire, handleSigningSessionSealRoutes, normalizeRorHost, normalizeWalletAuthMethod, parseAuthorizedOperationReplayResponse, parseBool, parseCsvList, parseHostedWalletSeamsSessionExchangeCode, parseHostedWalletSeamsSessionExchangeNonce, parseHostedWalletSessionCredentialId, parseHostedWalletSessionOperationCredentialToken, parseHostedWalletSessionOperationCredentialV1, parseMpcWalletSigningQuotaId, parseOrdinaryEcdsaSignerMaterialDeactivationResultV1, parseOrdinaryEcdsaSignerMaterialWorkerReservationV1, parseOrdinaryEd25519SignerMaterialDeactivationResultV1, parseOrdinaryEd25519SignerMaterialWorkerReservationV1, parsePrimaryWalletSessionOperationCredentialToken, parseSessionOrigin, parseSigningSessionSealApplyBody, parseSigningSessionSealKeyVersion, parseSigningSessionSealRemoveBody, parseSigningSessionSealRootConfig, parseVaultProxyDestination, parseVerifiedOwnerProofId, parseWalletSessionAuthorizationV2, parseWalletSessionId, projectActiveWalletSession, projectExactWalletSessionAuthorizationV1, registerSigningSessionSealRoutes, registrationPreparationIdFromString, requireEnvVar, resolveIdentityStoreNamespace, resolveRorRpId, resolveSigningSessionSealBasePath, resolveSigningSessionSealIdempotencyFromEnv, resolveSigningSessionSealRateLimitFromEnv, resolveWalletAuthMethodStoreNamespace, resolveWalletStoreNamespace, resolveWebAuthnAuthenticatorStoreNamespace, resolveWebAuthnCredentialBindingStoreNamespace, sanitizeRorOrigins, secp256k1PrivateKey32ToPublicKey33, secp256k1PublicKey33ToEthereumAddress, signSecp256k1Recoverable, signingSessionSealAuthorizeStatusCode, signingSessionSealStatusCode, tenantStorageRouteBackendFamily, tenantStorageRouteDiagnostic, validateConfigs, validateOrdinaryInactiveSignerMaterialDeactivationRequestV1, validateOrdinaryInactiveSignerMaterialReservationRequestV1, validateRouterApiRorOptions, walletSessionAuthorizationV2RecordsEqual, walletSessionCapabilitySubjectsV1Equal };
+export { AUTHORIZED_OPERATION_REPLAY_BODY_MAX_BYTES, AuthorizationService, CloudflareD1RouterAbNormalSigningAdmissionStore, D1IdentityStore, D1WalletAuthMethodStore, D1WalletStore, IDENTITY_STORE_D1_SCHEMA_SQL, InMemoryRouterAbNormalSigningAdmissionStore, LocalWorkerVaultProxyGateway, OrdinaryInactiveSignerMaterialReservationServiceV1, RouterAbEcdsaPresignRuntime, SessionService, StaticCloudflareTenantStorageRouteResolver, StaticRorOriginsProvider, VaultProxyUseService, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, WALLET_STORE_D1_SCHEMA_SQL, authorizeSigningSessionSealRequest, authorizedOperationReplayBodyInit, buildActiveWalletSessionQuota, buildAuthorizedOperation, buildCorsOrigins, buildExactWalletSessionQuotaProjectionV1, buildPersistedActiveWalletSessionAuthorizationV2, buildSigningSessionSealApplyPath, buildSigningSessionSealRemovePath, buildVaultProxyUseOperation, buildWalletEcdsaSignerRecord, buildWalletEd25519SignerId, buildWalletSessionAuthorizationV2, buildWalletSessionCapabilitySubjectsV1, composeSigningSessionSealGuards, computeAuthorizedOperationResultDigest, computeEip1559TxHash, createCloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareTenantStorageRoute, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createInMemorySigningSessionSealIdempotencyStore, createInMemorySigningSessionSealRateLimiter, createOrdinaryInactiveSignerMaterialReservationServiceV1, createPassthroughSigningSessionSealCipherAdapter, createRedisTcpSigningSessionSealIdempotencyStore, createRedisTcpSigningSessionSealRateLimiter, createRorOptions, createRouterAbNormalSigningAdmissionAdapter, createRouterApiModule, createSignerD1DoStorageTarget, createSigningSessionSealAuditLogger, createSigningSessionSealCipherAdapter, createSigningSessionSealOptions, createSigningSessionSealRateLimitGuard, createSigningSessionSealRoutesOptions, createSigningSessionSealService, createSigningSessionSealShamir3PassCipherAdapter, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, createUpstashSigningSessionSealIdempotencyStore, createUpstashSigningSessionSealRateLimiter, createVaultProxyUseRouteExtension, digestOpaqueValue, encodeEip1559SignedTxFromSignature65, encodeSigningSessionSealServerLockContext, ensureEvmCryptoWasm, ensureIdentityStoreD1Schema, ensureWalletAuthMethodStoreD1Schema, ensureWalletStoreD1Schema, exactWalletSessionCapabilitySubjectsResolveAuthority, formatSigningSessionSealKeyVersionForWire, handleSigningSessionSealRoutes, normalizeRorHost, normalizeWalletAuthMethod, parseAuthorizedOperationReplayResponse, parseBool, parseCsvList, parseHostedWalletSeamsSessionExchangeCode, parseHostedWalletSeamsSessionExchangeNonce, parseHostedWalletSessionCredentialId, parseHostedWalletSessionOperationCredentialToken, parseHostedWalletSessionOperationCredentialV1, parseMpcWalletSigningQuotaId, parseOrdinaryEcdsaSignerMaterialDeactivationResultV1, parseOrdinaryEcdsaSignerMaterialWorkerReservationV1, parseOrdinaryEd25519SignerMaterialDeactivationResultV1, parseOrdinaryEd25519SignerMaterialWorkerReservationV1, parsePrimaryWalletSessionOperationCredentialToken, parseSessionOrigin, parseSigningSessionSealApplyBody, parseSigningSessionSealKeyVersion, parseSigningSessionSealRemoveBody, parseSigningSessionSealRootConfig, parseVaultProxyDestination, parseVerifiedOwnerProofId, parseWalletSessionAuthorizationV2, parseWalletSessionId, projectActiveWalletSession, projectExactWalletSessionAuthorizationV1, registerSigningSessionSealRoutes, registrationPreparationIdFromString, requireEnvVar, resolveRorRpId, resolveSigningSessionSealBasePath, resolveSigningSessionSealIdempotencyFromEnv, resolveSigningSessionSealRateLimitFromEnv, sanitizeRorOrigins, secp256k1PrivateKey32ToPublicKey33, secp256k1PublicKey33ToEthereumAddress, signSecp256k1Recoverable, signingSessionSealAuthorizeStatusCode, signingSessionSealStatusCode, tenantStorageRouteBackendFamily, tenantStorageRouteDiagnostic, validateOrdinaryInactiveSignerMaterialDeactivationRequestV1, validateOrdinaryInactiveSignerMaterialReservationRequestV1, validateRouterApiRorOptions, walletSessionAuthorizationV2RecordsEqual, walletSessionCapabilitySubjectsV1Equal };

package/dist/esm/localHostedWalletGatewayHandler.js

@@ -1,8 +1,12 @@
+import { requireCanonicalString } from "./shared-ts/src/utils/validation.js";
 import "./shared-ts/src/utils/routerAbEd25519Yao.js";
 import { WALLET_CONSOLE_OP_PATHS_V1 } from "./router/cloudflare/runtime/walletConsoleOps.js";
 import { createStaticWalletConsoleBindingV1, parseStaticWalletConsoleBindingConfigV1 } from "./router/cloudflare/runtime/staticWalletConsoleBinding.js";
 import { handleSplitGatewayRequest } from "./hosted-wallet-gateway.js";
+import { LocalRegistrationSetupAuthority } from "./localRegistrationSetupAuthority.js";
+import { localPresignCancellationProbe } from "./localIntendedPresignCancellation.js";
 import { LOCAL_INTENDED_YAO_FAULT_HEADER_V1, LOCAL_INTENDED_YAO_FAULT_TOKEN_HEADER_V1, LocalIntendedYaoFaultControllerV1, parseLocalIntendedYaoFaultModeV1, parseLocalIntendedYaoFaultTokenV1, requestWithoutLocalIntendedYaoFaultHeadersV1, responseWithLocalIntendedYaoFaultOutcomeV1 } from "./localIntendedYaoFault.js";
+import { localMaterialAdmissionFault } from "./localIntendedMaterialAdmissionFault.js";
 import { LOCAL_INTENDED_ECDSA_FINALIZE_FAULT_HEADER_V1, LOCAL_INTENDED_ECDSA_FINALIZE_FAULT_TOKEN_HEADER_V1, LocalIntendedEcdsaFinalizeFaultControllerV1, parseLocalIntendedEcdsaFinalizeFaultModeV1, parseLocalIntendedEcdsaFinalizeFaultTokenV1, requestWithoutLocalIntendedEcdsaFinalizeFaultHeadersV1, responseWithLocalIntendedEcdsaFinalizeFaultOutcomeV1 } from "./localIntendedEcdsaFinalizeFault.js";
 import { LOCAL_INTENDED_YAO_FINALIZE_FAULT_HEADER_V1, LOCAL_INTENDED_YAO_FINALIZE_FAULT_TOKEN_HEADER_V1, LocalIntendedYaoFinalizeFaultDatabaseV1, parseLocalIntendedYaoFinalizeFaultModeV1, parseLocalIntendedYaoFinalizeFaultTokenV1, requestWithoutLocalIntendedYaoFinalizeFaultHeadersV1, responseWithLocalIntendedYaoFinalizeFaultOutcomeV1 } from "./localIntendedYaoFinalizeFault.js";
 import { LOCAL_INTENDED_YAO_RECOVERY_FAULT_HEADER_V1, LOCAL_INTENDED_YAO_RECOVERY_FAULT_TOKEN_HEADER_V1, LocalIntendedYaoRecoveryFaultControllerV1, parseLocalIntendedYaoRecoveryFaultModeV1, parseLocalIntendedYaoRecoveryFaultTokenV1, releaseLocalIntendedYaoRecoveryExecuteV1, requestWithoutLocalIntendedYaoRecoveryFaultHeadersV1, responseWithLocalIntendedYaoRecoveryFaultOutcomeV1 } from "./localIntendedYaoRecoveryFault.js";
@@ -100,10 +104,22 @@ async function handleEcdsaRespondFault(request, env, ctx, dependencies, fault, e
 */
 async function handleLocalHostedWalletGatewayRequestV1(request, env, ctx, dependencies) {
 	const config = parseStaticWalletConsoleBindingConfigV1(JSON.parse(env.WALLET_LOCAL_DEPLOYMENT_JSON));
+	dependencies = {
+		emailOtpDeliveryProvider: dependencies?.emailOtpDeliveryProvider,
+		signerWasm: dependencies?.signerWasm,
+		registrationAuthority: new LocalRegistrationSetupAuthority(env.SIGNER_DB, {
+			namespace: requireCanonicalString(env.SEAMS_TENANT_STORAGE_NAMESPACE, "Local namespace"),
+			orgId: config.deployment.orgId,
+			projectId: config.deployment.projectId,
+			envId: config.deployment.environmentKey
+		})
+	};
 	const gatewayEnv = {
 		...env,
 		WALLET_CONSOLE: createStaticWalletConsoleBindingV1(config)
 	};
+	const canceledPresign = await localPresignCancellationProbe(request, gatewayEnv, ctx, dependencies);
+	if (canceledPresign) return canceledPresign;
 	const ecdsaFault = request.headers.get(ECDSA_RESPOND_FAULT_HEADER);
 	if (ecdsaFault !== null) return await handleEcdsaRespondFault(request, gatewayEnv, ctx, dependencies, ecdsaFault, config.deployment.environmentKey, config.deployment.environmentId);
 	const ecdsaFinalizeMode = request.headers.get(LOCAL_INTENDED_ECDSA_FINALIZE_FAULT_HEADER_V1);
@@ -127,6 +143,15 @@ async function handleLocalHostedWalletGatewayRequestV1(request, env, ctx, depend
 	const revokeMode = request.headers.get(LOCAL_INTENDED_REVOKE_FAULT_HEADER_V1);
 	const revokeToken = request.headers.get(LOCAL_INTENDED_REVOKE_FAULT_TOKEN_HEADER_V1);
 	if (revokeMode !== null || revokeToken !== null) return await handleRevokeFault(request, gatewayEnv, ctx, dependencies, revokeMode, revokeToken);
+	const materialFault = localMaterialAdmissionFault(request, gatewayEnv.SIGNER_DB);
+	if (materialFault instanceof Response) return materialFault;
+	if (materialFault) {
+		const response = await handleSplitGatewayRequest(materialFault.request, {
+			...gatewayEnv,
+			SIGNER_DB: materialFault.database
+		}, ctx, dependencies);
+		return materialFault.database.response(response, materialFault.token);
+	}
 	const admissionMode = request.headers.get(LOCAL_INTENDED_SESSION_ADMISSION_FAULT_HEADER_V1);
 	const admissionToken = request.headers.get(LOCAL_INTENDED_SESSION_ADMISSION_FAULT_TOKEN_HEADER_V1);
 	if (admissionMode !== null || admissionToken !== null) return await handleSessionAdmissionFault(request, gatewayEnv, ctx, dependencies, admissionMode, admissionToken);