@seams/wallet-server 0.7.1 → 0.8.0

package/dist/esm/localIntendedMaterialAdmissionFault.js

@@ -0,0 +1,176 @@
+import { isPlainObject } from "./shared-ts/src/utils/validation.js";
+import { isLocalIntendedYaoFaultTokenV1 } from "./localIntendedYaoFault.js";
+//#region src/localIntendedMaterialAdmissionFault.ts
+const MODE_HEADER = "x-seams-intended-material-admission-fault-v1";
+const TOKEN_HEADER = "x-seams-intended-material-admission-token-v1";
+const PROOF_HEADER = "x-seams-intended-material-admission-proof-v1";
+const SCOPE_PREDICATE = "namespace = ? AND org_id = ? AND project_id = ? AND env_id = ? AND wallet_id = ?";
+function localMaterialAdmissionFault(request, database) {
+	const raw = request.headers.get(MODE_HEADER);
+	const token = request.headers.get(TOKEN_HEADER);
+	if (raw === null && token === null) return null;
+	const url = new URL(request.url);
+	if (url.protocol !== "http:" || url.hostname !== "127.0.0.1" || request.method !== "POST" || !["/router-ab/ecdsa-derivation/sign/prepare", "/router-ab/ecdsa-derivation/sign"].includes(url.pathname) || !isLocalIntendedYaoFaultTokenV1(token) || raw !== "canonical_claim" && raw !== "canonical_existing" && raw !== "linked_claim" && raw !== "linked_existing") return Response.json({ code: "invalid_intended_material_admission_fault" }, { status: 400 });
+	const headers = new Headers(request.headers);
+	headers.delete(MODE_HEADER);
+	headers.delete(TOKEN_HEADER);
+	return {
+		database: new LocalMaterialAdmissionFaultDatabase(database, raw),
+		request: new Request(request, { headers }),
+		token
+	};
+}
+/** Retire material after resolution and before one admission statement, then restore it. */
+var LocalMaterialAdmissionFaultDatabase = class {
+	constructor(base, mode) {
+		this.base = base;
+		this.mode = mode;
+		this.scope = null;
+		this.state = { kind: "armed" };
+	}
+	prepare(query) {
+		const inner = this.base.prepare(query);
+		if (/^\s*INSERT INTO authorized_operations/.test(query)) return new FaultStatement(this, inner, "claim");
+		if (query.includes("AS material_snapshot_active")) return new FaultStatement(this, inner, "existing");
+		if (query.includes("AS ecdsa_material_records_json")) return new FaultStatement(this, inner, "material");
+		return inner;
+	}
+	captureScope(values) {
+		const scope = values.slice(0, 5);
+		const strings = [];
+		for (const value of scope) {
+			if (typeof value !== "string" || value.length === 0) throw new Error("Invalid material fault scope");
+			strings.push(value);
+		}
+		if (strings.length !== 5) throw new Error("Material fault did not observe a scoped material read");
+		this.scope = strings;
+	}
+	async batch(statements) {
+		const roles = statements.filter(isFaultStatement).map(statementRole);
+		const boundary = this.mode.endsWith("_claim") ? "claim" : "existing";
+		return this.execute(statements.map(unwrap), roles.includes(boundary) ? boundary : "material");
+	}
+	exec(query) {
+		return this.base.exec(query);
+	}
+	async first(statement, columnName) {
+		if (statement.role === "material") {
+			const row = await statement.inner.first(columnName);
+			if (isPlainObject(row)) this.captureScope([
+				row.session_namespace,
+				row.session_org_id,
+				row.session_project_id,
+				row.session_env_id,
+				row.session_wallet_id
+			]);
+			return row;
+		}
+		if (!this.shouldRetire(statement.role)) return statement.inner.first(columnName);
+		if (columnName !== void 0) throw new Error("Material admission reads must return a row");
+		const [result] = await this.execute([statement.inner], statement.role);
+		return result?.results?.[0] ?? null;
+	}
+	shouldRetire(role) {
+		return role === (this.mode.endsWith("_claim") ? "claim" : "existing") && this.state.kind === "armed";
+	}
+	async execute(statements, role) {
+		if (!this.shouldRetire(role)) return this.base.batch(statements);
+		if (!this.scope) throw new Error("Material fault has no scoped read");
+		const { table, key, column } = this.target();
+		const predicate = this.mode.startsWith("canonical") ? `${SCOPE_PREDICATE} AND signer_family = 'ecdsa'` : SCOPE_PREDICATE;
+		const result = await this.base.prepare(`SELECT ${key} AS record_key, ${column} AS record_value FROM ${table} WHERE ${predicate}`).bind(...this.scope).all();
+		const records = [];
+		for (const row of result.results ?? []) {
+			const value = row.record_value;
+			if (typeof row.record_key !== "string" || value !== null && typeof value !== "number" && typeof value !== "string") throw new Error("Invalid material fault backup");
+			records.push({
+				key: row.record_key,
+				value
+			});
+		}
+		if (records.length === 0) throw new Error("Material fault did not find custody records");
+		const replacement = this.mode.startsWith("canonical") ? "json_set(record_json, '$.walletKey.publicCapability.material_activation.lifecycle_binding', 'retired-by-intended-test')" : "NULL";
+		const retire = this.base.prepare(`UPDATE ${table} SET ${column} = ${replacement} WHERE ${predicate}`).bind(...this.scope);
+		const restore = [];
+		for (const record of records) restore.push(this.base.prepare(`UPDATE ${table} SET ${column} = ? WHERE ${predicate} AND ${key} = ?`).bind(record.value, ...this.scope, record.key));
+		const quota = this.base.prepare(`SELECT COALESCE(SUM(quota.remaining_uses), 0) AS remaining
+         FROM authorization_wallet_session_quotas AS quota
+         JOIN wallet_session_authorizations_v2 AS session
+           ON session.namespace = quota.namespace AND session.tenant_id = quota.tenant_id
+          AND session.quota_id = quota.quota_id
+        WHERE session.namespace = ? AND session.org_id = ? AND session.project_id = ?
+          AND session.env_id = ? AND session.wallet_id = ?`).bind(...this.scope);
+		const results = await this.base.batch([
+			quota,
+			retire,
+			...statements,
+			...restore,
+			quota
+		]);
+		this.state = {
+			kind: "restored",
+			rows: records.length,
+			quotaBefore: quotaTotal(results[0]),
+			quotaAfter: quotaTotal(results.at(-1))
+		};
+		return results.slice(2, 2 + statements.length);
+	}
+	response(response, token) {
+		const headers = new Headers(response.headers);
+		headers.set(PROOF_HEADER, this.state.kind === "restored" ? `${token}:${this.mode}:${this.state.rows}:${this.state.quotaBefore}:${this.state.quotaAfter}` : `${token}:not_observed`);
+		return new Response(response.body, {
+			status: response.status,
+			statusText: response.statusText,
+			headers
+		});
+	}
+	target() {
+		return this.mode.startsWith("canonical") ? {
+			table: "wallet_signers",
+			key: "signer_id",
+			column: "record_json"
+		} : {
+			table: "linked_device_authority_installations",
+			key: "link_session_id",
+			column: "activated_at_ms"
+		};
+	}
+};
+var FaultStatement = class FaultStatement {
+	constructor(database, inner, role) {
+		this.database = database;
+		this.inner = inner;
+		this.role = role;
+	}
+	bind(...values) {
+		return new FaultStatement(this.database, this.inner.bind(...values), this.role);
+	}
+	async first(columnName) {
+		return this.database.first(this, columnName);
+	}
+	all() {
+		return this.inner.all();
+	}
+	run() {
+		return this.inner.run();
+	}
+};
+function unwrap(statement) {
+	return statement instanceof FaultStatement ? statement.inner : statement;
+}
+function isFaultStatement(statement) {
+	return statement instanceof FaultStatement;
+}
+function statementRole(statement) {
+	return statement.role;
+}
+function quotaTotal(result) {
+	if (!isPlainObject(result) || !Array.isArray(result.results)) throw new Error("Material fault quota result is unavailable");
+	const row = result.results[0];
+	if (!isPlainObject(row) || typeof row.remaining !== "number" || !Number.isSafeInteger(row.remaining)) throw new Error("Material fault quota total is invalid");
+	return row.remaining;
+}
+//#endregion
+export { localMaterialAdmissionFault };
+
+//# sourceMappingURL=localIntendedMaterialAdmissionFault.js.map

package/dist/esm/localIntendedPresignCancellation.js

@@ -0,0 +1,44 @@
+import { handleSplitGatewayRequest } from "./hosted-wallet-gateway.js";
+//#region src/localIntendedPresignCancellation.ts
+const held = /* @__PURE__ */ new Set();
+const header = "x-seams-intended-presign-cancellation";
+const initPath = "/router-ab/ecdsa-derivation/presignature-pool/fill/init";
+var HeldPresignProxy = class {
+	constructor(token) {
+		this.token = token;
+	}
+	async fetch() {
+		held.add(this.token);
+		await new Promise(resolveHeldPresign);
+		held.delete(this.token);
+		return Response.json({
+			ok: false,
+			code: "temporarily_unavailable"
+		}, { status: 503 });
+	}
+};
+function resolveHeldPresign(resolve) {
+	setTimeout(resolve, 3e4);
+}
+async function localPresignCancellationProbe(request, env, ctx, dependencies) {
+	const token = request.headers.get(header);
+	if (token === null) return null;
+	const url = new URL(request.url);
+	if (url.protocol !== "http:" || url.hostname !== "127.0.0.1" || url.pathname !== initPath || !/^[0-9a-f-]{36}$/u.test(token)) return Response.json({ code: "invalid_presign_cancellation_probe" }, { status: 400 });
+	if (request.method === "GET") return Response.json({ held: held.has(token) });
+	if (request.method === "DELETE") {
+		held.delete(token);
+		return new Response(null, { status: 204 });
+	}
+	if (request.method !== "POST") return new Response(null, { status: 405 });
+	const headers = new Headers(request.headers);
+	headers.delete(header);
+	return handleSplitGatewayRequest(new Request(request, { headers }), {
+		...env,
+		SIGNING_WORKER: new HeldPresignProxy(token)
+	}, ctx, dependencies);
+}
+//#endregion
+export { localPresignCancellationProbe };
+
+//# sourceMappingURL=localIntendedPresignCancellation.js.map

package/dist/esm/localRegistrationSetupAuthority.js

@@ -0,0 +1,89 @@
+import { D1RegistrationCeremonyRecordStore } from "./router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore.js";
+import { parseWalletRegistrationSetupReservation, proposeWalletRegistrationSetup, walletRegistrationSetupRequestDigest } from "./router/domains/walletRegistration/walletRegistrationReservation.js";
+//#region src/localRegistrationSetupAuthority.ts
+var LocalRegistrationSetupAuthority = class {
+	constructor(database, scope) {
+		this.scope = scope;
+		this.storage = new D1RegistrationCeremonyRecordStore({
+			database,
+			scope,
+			keyPrefix: "local-registration-authority:"
+		});
+	}
+	async reserve(input) {
+		const scope = input.runtimePolicyScope;
+		if (!scope || input.orgId !== this.scope.orgId || scope.orgId !== this.scope.orgId || scope.projectId !== this.scope.projectId || scope.envId !== this.scope.envId) return {
+			ok: false,
+			code: "scope_conflict",
+			message: "Registration scope differs from the local authority"
+		};
+		const requestDigest = await walletRegistrationSetupRequestDigest(this.scope.namespace, input);
+		const stored = await this.storage.insertOrRead({
+			scope: "setup-reservation",
+			id: input.request.registrationOperationId,
+			value: {
+				requestDigest,
+				reservation: proposeWalletRegistrationSetup(input)
+			},
+			expiresAtMs: Number.MAX_SAFE_INTEGER
+		});
+		if (stored.value.requestDigest !== requestDigest) return {
+			ok: false,
+			code: "request_conflict",
+			message: "Registration operation was already used for another request"
+		};
+		const reservation = parseWalletRegistrationSetupReservation(stored.value.reservation);
+		await this.storage.putExact({
+			scope: "setup-ceremony-index",
+			id: reservation.ceremonyId,
+			value: { walletId: reservation.walletId },
+			expiresAtMs: Number.MAX_SAFE_INTEGER
+		});
+		const terminal = await this.storage.get("setup-terminal", reservation.ceremonyId);
+		if (terminal?.value.outcome === "cancelled") return {
+			ok: false,
+			code: "registration_cancelled",
+			message: "Registration was cancelled"
+		};
+		return {
+			ok: true,
+			reservation,
+			lifecycle: terminal?.value.outcome === "established" ? "established" : "reserved"
+		};
+	}
+	async admitHome(input) {
+		const identity = await this.storage.get("setup-ceremony-index", input.ceremonyId);
+		const terminal = await this.storage.get("setup-terminal", input.ceremonyId);
+		if (!identity || identity.value.walletId !== input.walletId || terminal?.value.outcome === "cancelled") return {
+			ok: false,
+			code: "wallet_home_unavailable",
+			message: "Registration home is unavailable"
+		};
+		return { ok: true };
+	}
+	async complete(input) {
+		const identity = await this.storage.get("setup-ceremony-index", input.ceremonyId);
+		if (!identity || identity.value.walletId !== input.walletId) return {
+			ok: false,
+			code: "home_conflict",
+			message: "Registration completion does not match its reservation"
+		};
+		return (await this.storage.insertOrRead({
+			scope: "setup-terminal",
+			id: input.ceremonyId,
+			value: {
+				walletId: input.walletId,
+				outcome: input.outcome
+			},
+			expiresAtMs: Number.MAX_SAFE_INTEGER
+		})).value.outcome === input.outcome ? { ok: true } : {
+			ok: false,
+			code: "registration_conflict",
+			message: "Registration terminal outcome conflicts with its reservation"
+		};
+	}
+};
+//#endregion
+export { LocalRegistrationSetupAuthority };
+
+//# sourceMappingURL=localRegistrationSetupAuthority.js.map

package/dist/esm/router/auth/authRequestValidation.js

@@ -76,23 +76,15 @@ function parseOptionalPositiveInteger(raw, fieldName) {
 		value: Math.floor(value)
 	};
 }
-function parseAuthProviderAction(input) {
-	const provider = normalizeOptionalTrimmedString(input.provider);
-	const action = normalizeOptionalTrimmedString(input.action);
-	if (provider === "passkey" && action === "options") return { kind: "passkey_options" };
-	if (provider === "passkey" && action === "verify") return { kind: "passkey_verify" };
-	if (provider === "google" && action === "options") return { kind: "google_options" };
-	if (provider === "google" && action === "verify") return { kind: "google_verify" };
-	if (provider === "github" && action === "options") return { kind: "github_options" };
-	return null;
-}
 function parseAuthProviderActionPath(pathname) {
-	const parts = String(pathname || "").split("/").filter(Boolean);
-	if (parts.length !== 3 || parts[0] !== "auth") return null;
-	return parseAuthProviderAction({
-		provider: parts[1],
-		action: parts[2]
-	});
+	switch (pathname) {
+		case "/auth/passkey/options": return { kind: "passkey_options" };
+		case "/auth/passkey/verify": return { kind: "passkey_verify" };
+		case "/auth/google/options": return { kind: "google_options" };
+		case "/auth/google/verify": return { kind: "google_verify" };
+		case "/auth/github/options": return { kind: "github_options" };
+		default: return null;
+	}
 }
 function parsePasskeyLoginOptionsRequest(raw) {
 	const body = requireJsonObject(raw);

package/dist/esm/router/auth/commonRouterUtils.js

@@ -191,32 +191,46 @@ async function validateRouterAbEcdsaDerivationWalletSessionInputs(input) {
 	const token = extractBearerCredential(input.headers);
 	if (!token) return walletSessionFailure("wallet_session_missing");
 	const nowMs = input.nowMs || Date.now;
-	let resolution;
+	let candidate;
 	try {
-		resolution = await resolveWalletSessionOperationCredentialAdmission({
-			authorizationSessions,
+		candidate = await authorizationSessions.readWalletSessionSigningCandidateByOperationCredential({
+			tenantId: authorizationSessions.tenantId,
 			token,
 			nowMs: nowMs(),
-			operation: {
-				keyFamily: "ecdsa_secp256k1",
-				operationKind: input.operationKind
-			}
+			materialActivation: input.materialActivation
 		});
 	} catch {
 		return walletSessionFailure("wallet_session_unavailable");
 	}
-	if (resolution.kind === "rejected") return walletSessionFailure("wallet_session_scope_mismatch");
-	if (resolution.kind === "not_found") return {
+	if (!candidate) return {
 		ok: false,
 		code: "wallet_session_invalid",
 		message: walletSessionFailureMessage("wallet_session_invalid")
 	};
+	if (candidate.kind === "exhausted") return {
+		ok: true,
+		kind: "wallet_session_operation_credential_exhausted_candidate_v1",
+		candidate: candidate.candidate,
+		materialRead: candidate.materialRead,
+		policyRead: candidate.policyRead
+	};
+	const resolution = resolveWalletSessionOperationCredentialAdmissionFromContext({
+		context: candidate.context,
+		nowMs: nowMs(),
+		operation: {
+			keyFamily: "ecdsa_secp256k1",
+			operationKind: input.operationKind
+		}
+	});
+	if (resolution.kind === "rejected") return walletSessionFailure("wallet_session_scope_mismatch");
 	if (resolution.admission.curve !== "ecdsa") return walletSessionFailure("wallet_session_scope_mismatch");
 	return {
 		ok: true,
 		kind: "wallet_session_operation_credential_v1",
 		admission: resolution.admission,
-		context: resolution.admission.context
+		context: resolution.admission.context,
+		materialRead: candidate.materialRead,
+		policyRead: candidate.policyRead
 	};
 }
 async function resolveThresholdRuntimePolicyScope(input) {

package/dist/esm/router/auth/walletSessionFailure.js

@@ -1,3 +1,4 @@
+import { failure } from "../../shared-ts/src/utils/failure.js";
 //#region src/router/auth/walletSessionFailure.ts
 function walletSessionFailureMessage(code) {
 	switch (code) {
@@ -24,11 +25,7 @@ function walletSessionFailureStatus(code) {
 	}
 }
 function walletSessionFailure(code) {
-	return {
-		ok: false,
-		code,
-		message: walletSessionFailureMessage(code)
-	};
+	return failure(code, walletSessionFailureMessage(code));
 }
 //#endregion
 export { walletSessionFailure, walletSessionFailureMessage, walletSessionFailureStatus };

package/dist/esm/router/auth/webAuthnCredentialCodecs.js

@@ -1,7 +1,7 @@
 import { base64Decode, base64UrlDecode, base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
 import "../../shared-ts/src/utils/encoders.js";
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import "../../shared-ts/src/utils/validation.js";
+import { failure } from "../../shared-ts/src/utils/failure.js";
 import { errorMessage } from "../../shared-ts/src/utils/errors.js";
 //#region src/router/auth/webAuthnCredentialCodecs.ts
 function decodeWebAuthnBase64UrlOrBase64(input, fieldName) {
@@ -45,30 +45,18 @@ function webAuthnOriginHostnameOrEmpty(origin) {
 	}
 }
 function webAuthnCredentialIdB64uFromCredential(input) {
-	if (input === null || typeof input !== "object" || Array.isArray(input)) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Missing webauthn_authentication.id/rawId"
-	};
+	if (input === null || typeof input !== "object" || Array.isArray(input)) return failure("invalid_body", "Missing webauthn_authentication.id/rawId");
 	const rawId = normalizeOptionalTrimmedString(Reflect.get(input, "rawId"));
 	const id = normalizeOptionalTrimmedString(Reflect.get(input, "id"));
 	const selected = rawId || id;
-	if (!selected) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Missing webauthn_authentication.id/rawId"
-	};
+	if (!selected) return failure("invalid_body", "Missing webauthn_authentication.id/rawId");
 	try {
 		return {
 			ok: true,
 			credentialIdB64u: base64UrlEncode(decodeWebAuthnBase64UrlOrBase64(selected, "webauthn_authentication.rawId"))
 		};
 	} catch (error) {
-		return {
-			ok: false,
-			code: "invalid_body",
-			message: errorMessage(error) || "Invalid credential rawId"
-		};
+		return failure("invalid_body", errorMessage(error) || "Invalid credential rawId");
 	}
 }
 function parseWebAuthnAuthenticationCredential(input) {

package/dist/esm/router/cloudflare/d1/auth/d1AuthorizationAssembly.js

@@ -0,0 +1,87 @@
+import { capabilityPolicyPort } from "../../../../authorization/capabilityPolicy.js";
+import { AuthorizationService } from "../../../../authorization/service.js";
+import { CloudflareD1WebAuthnStore } from "../webauthn/d1WebAuthnStore.js";
+import { CloudflareD1WebAuthnAuthService } from "../webauthn/d1WebAuthnAuthService.js";
+import { CloudflareD1AuthorizationStore } from "../authorization/d1AuthorizationStore.js";
+import { CloudflareD1EmailOtpRateLimitStore } from "../emailOtp/d1EmailOtpRateLimitStore.js";
+import { CloudflareD1GoogleEmailOtpRegistrationAttemptStore } from "../emailOtp/d1GoogleEmailOtpRegistrationAttemptStore.js";
+import { D1IdentityStore } from "../../../../core/d1IdentityStore.js";
+import { CloudflareD1WalletCustodyCommitStore } from "../passkeyCustody/d1WalletCustodyCommitStore.js";
+//#region src/router/cloudflare/d1/auth/d1AuthorizationAssembly.ts
+function createD1AuthorizationAssembly(options, sessionRouting) {
+	const authorizationStore = new CloudflareD1AuthorizationStore(options);
+	return {
+		authorizationStore,
+		authorizationService: new AuthorizationService({
+			policy: capabilityPolicyPort,
+			sessions: authorizationStore,
+			evidence: authorizationStore,
+			grants: authorizationStore,
+			authorizedOperations: authorizationStore,
+			audit: authorizationStore,
+			sessionRouting
+		})
+	};
+}
+function createD1WalletCustodyStore(options) {
+	return new CloudflareD1WalletCustodyCommitStore({
+		credentialClaims: options.credentialClaims,
+		database: options.database,
+		scope: {
+			namespace: options.namespace,
+			orgId: options.orgId,
+			projectId: options.projectId,
+			envId: options.envId
+		},
+		recoveryRouting: options.recoveryRouting
+	});
+}
+function createD1WebAuthnAssembly(options, walletAuthMethodStore, walletManifestSource) {
+	const webAuthnStore = new CloudflareD1WebAuthnStore({
+		syncChallenges: options.syncChallenges,
+		credentialClaims: options.credentialClaims,
+		database: options.database,
+		namespace: options.namespace,
+		orgId: options.orgId,
+		projectId: options.projectId,
+		envId: options.envId
+	});
+	return {
+		webAuthnStore,
+		webAuthnAuthService: new CloudflareD1WebAuthnAuthService({
+			webAuthnStore,
+			walletAuthMethodStore,
+			walletManifestSource,
+			lifecycleRouting: options.lifecycleRouting
+		})
+	};
+}
+function createD1IdentityStore(options) {
+	if (options.identityStore) return options.identityStore;
+	return new D1IdentityStore({
+		database: options.database,
+		namespace: options.namespace,
+		orgId: options.orgId,
+		projectId: options.projectId,
+		envId: options.envId,
+		ensureSchema: false
+	});
+}
+function createD1GoogleRegistrationAttempts(options, prepare) {
+	return options.googleRegistrationAttempts ?? new CloudflareD1GoogleEmailOtpRegistrationAttemptStore({
+		prepare,
+		batch: options.database.batch.bind(options.database),
+		orgId: options.orgId
+	});
+}
+function createD1EmailOtpRateLimits(options, prepare) {
+	return new CloudflareD1EmailOtpRateLimitStore({
+		prepare,
+		rateLimits: options.emailOtp.rateLimits,
+		counter: options.emailOtpRateLimitCounter
+	});
+}
+//#endregion
+export { createD1AuthorizationAssembly, createD1EmailOtpRateLimits, createD1GoogleRegistrationAttempts, createD1IdentityStore, createD1WalletCustodyStore, createD1WebAuthnAssembly };
+
+//# sourceMappingURL=d1AuthorizationAssembly.js.map

package/dist/esm/router/cloudflare/d1/auth/d1AuthorizedOperationRouteService.js

@@ -5,6 +5,7 @@ function createD1AuthorizedOperationRouteService(assembly) {
 	if (!tenantId.ok) throw new Error(`orgId cannot identify an authorization tenant: ${tenantId.error.message}`);
 	return {
 		tenantId: tenantId.value,
+		resolveEcdsaWalletSessionOperation: assembly.authorizationStore.resolveEcdsaWalletSessionOperation.bind(assembly.authorizationStore),
 		admitEcdsaWalletSessionOperation: assembly.authorizationStore.admitEcdsaWalletSessionOperation.bind(assembly.authorizationStore),
 		readPinnedOwnerWalletScope: assembly.authorizationStore.readPinnedOwnerWalletScope.bind(assembly.authorizationStore),
 		buildVerifiedOwnerProof: assembly.authorizationService.buildVerifiedOwnerProof.bind(assembly.authorizationService),

package/dist/esm/router/cloudflare/d1/auth/d1RouterApiAuthBoundary.js

@@ -1,4 +1,5 @@
 import { hasWhitespaceOrControlCharacters, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { toArrayBufferCopy } from "../../../../core/authService/portableCrypto.js";
 //#region src/router/cloudflare/d1/auth/d1RouterApiAuthBoundary.ts
 function parseD1BoundaryWalletIdResult(raw) {
 	const parsed = parseWalletId(raw);
@@ -64,11 +65,6 @@ function d1MutationChanges(result) {
 	const meta = result.meta;
 	return parseD1NonNegativeCount(meta?.changes ?? meta?.rows_written);
 }
-function toArrayBufferCopy(bytes) {
-	const out = new ArrayBuffer(bytes.byteLength);
-	new Uint8Array(out).set(bytes);
-	return out;
-}
 async function sha256BytesPortable(input) {
 	const subtle = globalThis.crypto?.subtle;
 	if (subtle && typeof subtle.digest === "function") return new Uint8Array(await subtle.digest("SHA-256", toArrayBufferCopy(input)));
@@ -79,6 +75,6 @@ async function sha256BytesPortable(input) {
 	throw new Error("SHA-256 digest is unavailable in this runtime");
 }
 //#endregion
-export { d1MutationChanges, isB64uString, nonNegativeSafeInteger, optionalNonNegativeInteger, parseD1BoundaryWalletId, parseD1BoundaryWalletIdResult, parseD1NonNegativeCount, parseJsonObject, positiveInteger, positiveSafeInteger, sha256BytesPortable, toArrayBufferCopy, toRecordValue };
+export { d1MutationChanges, isB64uString, nonNegativeSafeInteger, optionalNonNegativeInteger, parseD1BoundaryWalletId, parseD1BoundaryWalletIdResult, parseD1NonNegativeCount, parseJsonObject, positiveInteger, positiveSafeInteger, sha256BytesPortable, toRecordValue };
 
 //# sourceMappingURL=d1RouterApiAuthBoundary.js.map

package/dist/esm/router/cloudflare/d1/auth/d1RouterApiAuthConfig.js

@@ -1,6 +1,5 @@
 import { parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { normalizeCorsOrigin } from "../../../../core/SessionService.js";
 import "../../../../core/authService/emailOtpConfig.js";
 import { parseSigningSessionSealRootConfig } from "../../../../threshold/session/signingSessionSeal/options.js";
@@ -50,6 +49,18 @@ function normalizeD1RouterApiAuthOptions(input) {
 	if (input.githubOAuth && !githubOAuth) throw new Error("githubOAuth requires clientId, clientSecret, and callbackUrl");
 	return {
 		database: input.database,
+		identityStore: input.identityStore,
+		emailOtpRateLimitCounter: input.emailOtpRateLimitCounter,
+		credentialClaims: input.credentialClaims,
+		syncChallenges: input.syncChallenges,
+		linkedDeviceProofNonces: input.linkedDeviceProofNonces,
+		linkedDeviceBootstrap: input.linkedDeviceBootstrap,
+		googleRegistrationAttempts: input.googleRegistrationAttempts,
+		sessionRouting: input.sessionRouting,
+		recoveryRouting: input.recoveryRouting,
+		lifecycleRouting: input.lifecycleRouting,
+		registrationAuthority: input.registrationAuthority,
+		registrationSetupDispatcher: input.registrationSetupDispatcher,
 		namespace: requireD1RouterApiAuthScopeString(input.namespace, "namespace"),
 		orgId: requireD1RouterApiAuthScopeString(input.orgId, "orgId"),
 		projectId: requireD1RouterApiAuthScopeString(input.projectId, "projectId"),
@@ -63,7 +74,6 @@ function normalizeD1RouterApiAuthOptions(input) {
 		implicitNearAccountTestFundingEnabled: parseBooleanFlag(input.implicitNearAccountTestFundingEnabled, false, "implicitNearAccountTestFundingEnabled"),
 		googleOidcClientId: normalizeOptionalTrimmedString(input.googleOidcClientId),
 		githubOAuth,
-		accountIdDerivationSecret: normalizeOptionalTrimmedString(input.accountIdDerivationSecret),
 		emailOtp: normalizeEmailOtpConfig(input),
 		emailOtpServerSeal: normalizeEmailOtpServerSealConfig(input),
 		routerAbEcdsaPresignRuntime: input.routerAbEcdsaPresignRuntime,