@seams/wallet-server 0.7.1 → 0.8.0

package/dist/esm/router/cloudflare/d1/auth/d1RouterApiAuthService.js

@@ -1,11 +1,7 @@
 import { parseWalletAuthMethodId, parseWalletAuthorityId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseDeviceId, parsePrincipalId, parseTenantId, parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
-import { capabilityPolicyPort } from "../../../../authorization/capabilityPolicy.js";
-import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
-import { alphabetizeStringify, sha256BytesUtf8, sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
-import "../../../../shared-ts/src/utils/encoders.js";
+import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseRouterAbEcdsaRegistrationActivationReceiptV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { AuthorizationService } from "../../../../authorization/service.js";
 import { D1WalletStore } from "../../../../core/d1WalletStore.js";
 import { D1WalletAuthMethodStore } from "../../../../core/d1WalletAuthMethodStore.js";
 import { normalizeLogger } from "../../../../core/logger.js";
@@ -16,37 +12,38 @@ import { resolveActiveOwnerWalletExecutionLane, resolveWalletAuthMethodIdForAuth
 import { DEFAULT_WALLET_SESSION_TTL_MS } from "../../../../shared-ts/src/threshold/sessionPolicy.js";
 import { createDeviceLinkingOwnerRequestAuthenticatorV1 } from "../../../transport/fetch/routes/deviceLinkingOwnerAuthorization.js";
 import { sha256BytesPortable, toRecordValue } from "./d1RouterApiAuthBoundary.js";
-import { CloudflareD1WebAuthnStore } from "../webauthn/d1WebAuthnStore.js";
 import { verifyD1LinkedDeviceFreshRevokeProofV1 } from "../wallet/d1WalletAuthMethodBoundary.js";
-import { CloudflareD1WebAuthnAuthService } from "../webauthn/d1WebAuthnAuthService.js";
+import { D1LinkedDeviceAuthorityInstallServiceV1 } from "../deviceLinking/d1LinkedDeviceAuthorityInstallService.js";
 import { D1WalletAuthorityStore } from "../wallet/d1WalletAuthorityStore.js";
-import { CloudflareD1AuthorizationStore } from "../authorization/d1AuthorizationStore.js";
 import { createCloudflareD1VersionedJsonRecordStore } from "../versionedJson/d1VersionedJsonRecordStore.js";
-import { parseRouterAbEd25519YaoRegistrationSideEffectRecordV2, runRouterAbEd25519YaoRegistrationSideEffectV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
+import { parseRouterAbEd25519YaoRegistrationSideEffectRecordV2 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
 import { createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1 } from "../../signingLanes/cloudflareOrdinaryInactiveSignerMaterialReservation.js";
 import { normalizeD1RouterApiAuthOptions } from "./d1RouterApiAuthConfig.js";
-import { createD1AuthorizedOperationRouteService } from "./d1AuthorizedOperationRouteService.js";
-import { parseRegistrationEstablishedSessionProjectionV2 } from "../../../../shared-ts/src/utils/registrationEstablishedSession.js";
-import { D1IdentityStore } from "../../../../core/d1IdentityStore.js";
 import { toPublicKeyStringFromSecretKey } from "../../../../core/nearKeys.js";
 import { MinimalNearClient } from "../../../../core/rpcClients/near/NearClient.js";
+import { fundImplicitNearAccountWithRelayer } from "../../../../core/nearRelayerAccountProvisioning.js";
+import { createSponsoredNamedNearAccountForOptions } from "../near/d1SponsoredNearAccount.js";
+import { parseD1EcdsaDerivationServerBootstrapResponse, parseD1WalletRegistrationCommittedInstallationProjection, parseD1WalletRegistrationFinalizeReplayResponse } from "../registration/d1RegistrationCeremonyRecords.js";
+import { parseD1WalletAddSignerFinalizeSideEffectRecord } from "../wallet/d1WalletAddSignerFinalizeRecord.js";
+import { dispatchWalletRegistrationSetup } from "../../../framework/registrationSetupDispatch.js";
+import { readActiveWalletSessionCredential, readExhaustedWalletSessionCredential, readWalletSessionSigningCandidate } from "./walletSessionCredentialReaders.js";
+import { createD1AuthorizedOperationRouteService } from "./d1AuthorizedOperationRouteService.js";
+import { parseRegistrationEstablishedSessionProjectionV2 } from "../../../../shared-ts/src/utils/registrationEstablishedSession.js";
 import { signGasRelayerNearTransactionWithDeps } from "../../../../core/authService/nearTransactions.js";
 import { ensureSignerWasmRuntime } from "../../../../core/authService/wasm.js";
-import { parseD1EcdsaDerivationServerBootstrapResponse, parseD1WalletRegistrationCommittedInstallationProjection, parseD1WalletRegistrationFinalizeReplayResponse } from "../registration/d1RegistrationCeremonyRecords.js";
+import { CloudflareD1PasskeyCustodyEnvelopeStore } from "../passkeyCustody/d1PasskeyCustodyEnvelopeStore.js";
+import { createD1AuthorizationAssembly, createD1EmailOtpRateLimits, createD1GoogleRegistrationAttempts, createD1IdentityStore, createD1WalletCustodyStore, createD1WebAuthnAssembly } from "./d1AuthorizationAssembly.js";
 import { CloudflareD1RegistrationCeremonyIntentStore } from "../registration/d1RegistrationCeremonyStore.js";
-import { CloudflareD1NearPublicKeyStore } from "../near/d1NearPublicKeyStore.js";
 import { CloudflareD1EmailOtpChallengeStore } from "../emailOtp/d1EmailOtpChallengeStore.js";
 import { CloudflareD1EmailOtpDeliveryRuntime } from "../emailOtp/d1EmailOtpDeliveryRuntime.js";
 import { CloudflareD1EmailOtpEnrollmentStore } from "../emailOtp/d1EmailOtpEnrollmentStore.js";
 import { CloudflareD1EmailOtpGrantStore } from "../emailOtp/d1EmailOtpGrantStore.js";
-import { CloudflareD1EmailOtpRateLimitStore } from "../emailOtp/d1EmailOtpRateLimitStore.js";
 import { CloudflareD1EmailOtpServerSealRuntime } from "../emailOtp/d1EmailOtpServerSealRuntime.js";
 import { CloudflareD1EmailOtpRegistrationEnrollmentFinalizer } from "../emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer.js";
 import { CloudflareD1EmailOtpChallengeVerifier } from "../emailOtp/d1EmailOtpChallengeVerifier.js";
 import { CloudflareD1EmailOtpChallengeIssuer } from "../emailOtp/d1EmailOtpChallengeIssuer.js";
 import { CloudflareD1EmailOtpChallengeService } from "../emailOtp/d1EmailOtpChallengeService.js";
 import { CloudflareD1EmailOtpRecoveryService } from "../emailOtp/d1EmailOtpRecoveryService.js";
-import { CloudflareD1GoogleEmailOtpRegistrationAttemptStore } from "../emailOtp/d1GoogleEmailOtpRegistrationAttemptStore.js";
 import { CloudflareD1GoogleEmailOtpSessionResolver } from "../emailOtp/d1GoogleEmailOtpSessionResolver.js";
 import { CloudflareD1IdentityService } from "../identity/d1IdentityService.js";
 import { CloudflareD1OidcVerificationService } from "../oidc/d1OidcVerificationService.js";
@@ -56,19 +53,15 @@ import { parseWalletRegistrationSessionCommitReceiptV2 } from "../registration/w
 import { CloudflareD1WalletRegistrationService } from "../registration/d1WalletRegistrationService.js";
 import { CloudflareD1WalletRegistrationCommitStore } from "../registration/d1WalletRegistrationCommitStore.js";
 import { CloudflareD1Ed25519YaoLifecycleDecisionStoreV1 } from "../ed25519Yao/d1Ed25519YaoLifecycleDecisionStore.js";
-import { CloudflareD1PasskeyCustodyEnvelopeStore } from "../passkeyCustody/d1PasskeyCustodyEnvelopeStore.js";
-import { CloudflareD1WalletCustodyCommitStore } from "../passkeyCustody/d1WalletCustodyCommitStore.js";
 import { createD1PasskeyCustodyRouteService } from "../passkeyCustody/d1PasskeyCustodyRouteService.js";
 import { CloudflareD1WalletRecoveryGoogleEmailOtpAttemptStore } from "../passkeyCustody/d1WalletRecoveryGoogleEmailOtpAttemptStore.js";
 import { CloudflareD1WalletRecoveryGoogleEmailOtpService } from "../passkeyCustody/d1WalletRecoveryGoogleEmailOtpService.js";
-import { CloudflareD1WalletAddSignerService, parseD1WalletAddSignerFinalizeSideEffectRecord, parseD1WalletAddSignerStartSideEffectRecord } from "../wallet/d1WalletAddSignerService.js";
+import { CloudflareD1WalletAddSignerService, parseD1WalletAddSignerStartSideEffectRecord } from "../wallet/d1WalletAddSignerService.js";
 import { CloudflareD1RegistrationIntentService } from "../registration/d1RegistrationIntentService.js";
-import { broadcastPreparedSponsoredNearAccountCreation, fundImplicitNearAccountWithRelayer, prepareSponsoredNearAccountCreationWithRelayer, preparedSponsoredNearAccountCreationArtifactFingerprint } from "../../../../core/nearRelayerAccountProvisioning.js";
 import { createD1LinkedDeviceSessionServiceV1 } from "../deviceLinking/d1LinkedDeviceSessionService.js";
 import { D1LinkedDeviceSessionStoreV1 } from "../deviceLinking/d1LinkedDeviceSessionStore.js";
 import { createD1LinkedDeviceRouteServiceV1 } from "../deviceLinking/d1LinkedDeviceRouteService.js";
 import { D1LinkedDeviceEmailOtpGrantStoreV1 } from "../deviceLinking/d1LinkedDeviceEmailOtpGrantStore.js";
-import { D1LinkedDeviceAuthorityInstallServiceV1 } from "../deviceLinking/d1LinkedDeviceAuthorityInstallService.js";
 import { createD1LinkedDeviceManagementServiceV1 } from "../deviceLinking/d1LinkedDeviceManagementService.js";
 import { createD1LinkedDeviceRevocationV1 } from "../deviceLinking/d1LinkedDeviceRevocation.js";
 import { createD1LinkedDeviceVerifiedLinkSourceReaderV1 } from "../deviceLinking/d1LinkedDeviceVerifiedLinkSourceReader.js";
@@ -198,6 +191,7 @@ function createD1LinkedDeviceComposition(input) {
 			});
 		}
 		const sessionStore = new D1LinkedDeviceSessionStoreV1({
+			bootstrap: input.options.linkedDeviceBootstrap,
 			database: input.options.database,
 			scope,
 			now: nowV1
@@ -227,6 +221,7 @@ function createD1LinkedDeviceComposition(input) {
 		});
 		const verifiedLinkBuilder = { source: verifiedLinkSourceReader };
 		const authorityInstall = new D1LinkedDeviceAuthorityInstallServiceV1({
+			credentialClaims: input.options.credentialClaims,
 			database: input.options.database,
 			scope,
 			authorityStore,
@@ -258,6 +253,8 @@ function createD1LinkedDeviceComposition(input) {
 			acknowledgeLocalAuthorityActivationV1: authorityInstall.acknowledgeLocalAuthorityActivationV1.bind(authorityInstall)
 		};
 		deviceLinking = createD1LinkedDeviceRouteServiceV1({
+			bootstrap: input.options.linkedDeviceBootstrap,
+			proofNonces: input.options.linkedDeviceProofNonces,
 			database: input.options.database,
 			scope,
 			ownerAuthorization: ownerAuthorizationProvider.ownerAuthorization,
@@ -432,48 +429,6 @@ async function fundImplicitNearAccountForOptions(options, input) {
 		fundedAmountYocto
 	});
 }
-/**
-* Validates a persisted claim before it is trusted to skip a broadcast or to be
-* replayed. An invalid record makes the D1 read fail, which leaves the effect
-* uncertain and prevents any network action on unvalidated bytes.
-*/
-function parseSponsoredNearAccountSideEffectRecord(raw) {
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
-	if (Reflect.get(raw, "operation") !== "finalize") return null;
-	const requestFingerprint = parseSideEffectFingerprint(Reflect.get(raw, "requestFingerprint"));
-	const preparedArtifactFingerprint = parseSideEffectFingerprint(Reflect.get(raw, "preparedArtifactFingerprint"));
-	if (requestFingerprint === null || preparedArtifactFingerprint === null) return null;
-	const claimedAtMs = Reflect.get(raw, "claimedAtMs");
-	if (!isNonNegativeSafeInteger(claimedAtMs)) return null;
-	const prepared = parsePreparedSponsoredNearAccountCreation(Reflect.get(raw, "prepared"));
-	if (prepared === null) return null;
-	const kind = Reflect.get(raw, "kind");
-	if (kind === "router_ab_ed25519_yao_registration_side_effect_claim_v1") return {
-		kind: "router_ab_ed25519_yao_registration_side_effect_claim_v1",
-		operation: "finalize",
-		requestFingerprint,
-		preparedArtifactFingerprint,
-		claimedAtMs,
-		prepared
-	};
-	if (kind === "router_ab_ed25519_yao_registration_side_effect_completion_v1") {
-		const completedAtMs = Reflect.get(raw, "completedAtMs");
-		if (!isNonNegativeSafeInteger(completedAtMs)) return null;
-		const response = parseAccountCreationResult(Reflect.get(raw, "response"));
-		if (response === null) return null;
-		return {
-			kind: "router_ab_ed25519_yao_registration_side_effect_completion_v1",
-			operation: "finalize",
-			requestFingerprint,
-			preparedArtifactFingerprint,
-			claimedAtMs,
-			completedAtMs,
-			prepared,
-			response
-		};
-	}
-	return null;
-}
 function parseWalletRegistrationOperationPrepared(raw) {
 	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
 	if (Reflect.get(raw, "kind") !== "d1_wallet_registration_operation_prepared_v1") return null;
@@ -666,86 +621,9 @@ function registrationReceiptMatchesJournal(record) {
 	if (receipt.committed.kind === "near_pending") return true;
 	return "foundingAuthority" in receipt && receipt.foundingAuthority.authorityId === record.prepared.walletAuthorityId;
 }
-function parsePreparedSponsoredNearAccountCreation(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	if (Reflect.get(value, "kind") !== "prepared_sponsored_near_account_creation_v1") return null;
-	const accountId = parseNonEmptyString(Reflect.get(value, "accountId"));
-	const publicKey = parseNonEmptyString(Reflect.get(value, "publicKey"));
-	const relayerAccountId = parseNonEmptyString(Reflect.get(value, "relayerAccountId"));
-	const relayerPublicKey = parseNonEmptyString(Reflect.get(value, "relayerPublicKey"));
-	const initialBalanceYocto = parseNonEmptyString(Reflect.get(value, "initialBalanceYocto"));
-	const transactionHash = parseNonEmptyString(Reflect.get(value, "transactionHash"));
-	const nextNonce = parseNonEmptyString(Reflect.get(value, "nextNonce"));
-	const blockHash = parseNonEmptyString(Reflect.get(value, "blockHash"));
-	const signedTransactionBorshB64u = parseBoundedBase64Url(Reflect.get(value, "signedTransactionBorshB64u"));
-	if (accountId === null || publicKey === null || relayerAccountId === null || relayerPublicKey === null || initialBalanceYocto === null || transactionHash === null || nextNonce === null || blockHash === null || signedTransactionBorshB64u === null) return null;
-	return {
-		kind: "prepared_sponsored_near_account_creation_v1",
-		accountId,
-		publicKey,
-		relayerAccountId,
-		relayerPublicKey,
-		initialBalanceYocto,
-		transactionHash,
-		nextNonce,
-		blockHash,
-		signedTransactionBorshB64u
-	};
-}
-function parseAccountCreationResult(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	const success = Reflect.get(value, "success");
-	if (typeof success !== "boolean") return null;
-	const accountId = parseOptionalString(Reflect.get(value, "accountId"));
-	const transactionHash = parseOptionalString(Reflect.get(value, "transactionHash"));
-	const error = parseOptionalString(Reflect.get(value, "error"));
-	const message = parseOptionalString(Reflect.get(value, "message"));
-	if ("accountId" in value && accountId === null || "transactionHash" in value && transactionHash === null || "error" in value && error === null || "message" in value && message === null) return null;
-	if (success && (accountId === void 0 || transactionHash === void 0)) return null;
-	const normalizedAccountId = accountId ?? void 0;
-	const normalizedTransactionHash = transactionHash ?? void 0;
-	const normalizedError = error ?? void 0;
-	const normalizedMessage = message ?? void 0;
-	return {
-		success,
-		...normalizedAccountId === void 0 ? {} : { accountId: normalizedAccountId },
-		...normalizedTransactionHash === void 0 ? {} : { transactionHash: normalizedTransactionHash },
-		...normalizedError === void 0 ? {} : { error: normalizedError },
-		...normalizedMessage === void 0 ? {} : { message: normalizedMessage }
-	};
-}
-function parseNonEmptyString(value) {
-	return typeof value === "string" && value.trim() ? value : null;
-}
-function parseSideEffectFingerprint(value) {
-	return typeof value === "string" && /^[a-zA-Z0-9:_-]{32,192}$/u.test(value) ? value : null;
-}
-function parseBoundedBase64Url(value) {
-	return typeof value === "string" && value.length > 0 && value.length <= 8192 && /^[\w-]+$/u.test(value) ? value : null;
-}
-function parseOptionalString(value) {
-	return value === void 0 ? void 0 : parseNonEmptyString(value);
-}
-function isNonNegativeSafeInteger(value) {
-	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
-}
 function resolveEd25519YaoProductRegistration(options) {
 	return options.ed25519YaoProductRegistration || null;
 }
-function sponsoredNearAccountSideEffectStore(options) {
-	return createCloudflareD1VersionedJsonRecordStore({
-		database: options.database,
-		scope: {
-			namespace: options.namespace,
-			orgId: options.orgId,
-			projectId: options.projectId,
-			envId: options.envId
-		},
-		keyPrefix: "router-ab-yao-sponsored-account:",
-		encode: (value) => value,
-		parse: parseSponsoredNearAccountSideEffectRecord
-	});
-}
 function walletRegistrationActivateSideEffectStore(options) {
 	return createCloudflareD1VersionedJsonRecordStore({
 		database: options.database,
@@ -802,87 +680,6 @@ function walletAddSignerFinalizeSideEffectStore(options) {
 		parse: parseD1WalletAddSignerFinalizeSideEffectRecord
 	});
 }
-/**
-* Creates the sponsored account through a durable claim. The signed transaction
-* and its hash are persisted before the broadcast, so a lost response replays
-* those exact bytes instead of building a second transaction under a fresh
-* nonce. Rebroadcasting an identical signed transaction reuses its hash, so the
-* network treats the retry as the same transaction.
-*/
-async function createSponsoredNamedNearAccountForOptions(options, input) {
-	const relayerAccount = options.relayerAccount;
-	const relayerPrivateKey = options.relayerPrivateKey;
-	const nearRpcUrl = options.nearRpcUrl;
-	const initialBalanceYocto = options.accountInitialBalance;
-	if (!relayerAccount || !relayerPrivateKey || !nearRpcUrl || !initialBalanceYocto) return {
-		kind: "rejected",
-		message: "Sponsored NEAR account creation is not configured on this server"
-	};
-	const relayerInput = {
-		accountId: input.accountId,
-		publicKey: input.publicKey,
-		relayerAccount,
-		relayerPrivateKey,
-		relayerPublicKey: options.relayerPublicKey,
-		nearRpcUrl,
-		initialBalanceYocto
-	};
-	const requestFingerprint = base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
-		kind: "sponsored_near_account_creation_v1",
-		accountId: input.accountId,
-		publicKey: input.publicKey,
-		relayerAccountId: relayerAccount,
-		initialBalanceYocto
-	})));
-	const outcome = await runRouterAbEd25519YaoRegistrationSideEffectV1(sponsoredNearAccountSideEffectStore(options), {
-		kind: "prepared_resumable",
-		resumeAfterMs: 3e4,
-		operation: "finalize",
-		key: `sponsored-account:${input.idempotencyKey}`,
-		requestFingerprint,
-		nowMs: () => Date.now(),
-		prepare: async () => {
-			const prepared = await prepareSponsoredNearAccountCreationWithRelayer(relayerInput);
-			if (!prepared.ok) throw new Error(prepared.message);
-			return prepared.prepared;
-		},
-		derivePreparedArtifactFingerprint: preparedSponsoredNearAccountCreationArtifactFingerprint,
-		execute: async (prepared, attempt) => {
-			if (!prepared) throw new Error("Sponsored NEAR account transaction was not prepared");
-			const broadcast = await broadcastPreparedSponsoredNearAccountCreation({
-				prepared,
-				nearRpcUrl,
-				relayerAccountId: relayerAccount,
-				reconcileFirst: attempt === "resumed"
-			});
-			if (broadcast.kind === "uncertain") throw new Error(broadcast.message);
-			return broadcast.result;
-		}
-	});
-	switch (outcome.kind) {
-		case "executed":
-		case "exact_replay":
-			if (outcome.value.success && outcome.value.accountId && outcome.value.transactionHash) return {
-				kind: "created",
-				accountId: outcome.value.accountId,
-				transactionHash: outcome.value.transactionHash
-			};
-			return {
-				kind: "rejected",
-				message: outcome.value.message || outcome.value.error || "Sponsored NEAR account creation was rejected"
-			};
-		case "in_progress":
-		case "uncertain": return {
-			kind: "retryable",
-			message: outcome.kind === "uncertain" ? outcome.message : "Sponsored NEAR account creation is already in progress for this registration",
-			retryAfterMs: 3e4
-		};
-		case "request_conflict": return {
-			kind: "rejected",
-			message: "Sponsored NEAR account creation idempotency key conflicts with another request"
-		};
-	}
-}
 async function readD1Ed25519KeyManifestBySlot(walletStore, input) {
 	const signer = await walletStore.getEd25519SignerBySlot(input);
 	return signer ? { custodyKeyManifestDigestB64u: signer.custodyKeyManifestDigestB64u } : null;
@@ -897,18 +694,11 @@ function createCloudflareD1RouterApiAuthAssembly(input) {
 	const walletAuthMethodStore = getWalletAuthMethodStore();
 	const walletStore = getWalletStore();
 	const createSponsoredNamedNearAccount = createSponsoredNamedNearAccountForOptions.bind(void 0, options);
-	const identityStore = new D1IdentityStore({
-		database: options.database,
-		namespace: options.namespace,
-		orgId: options.orgId,
-		projectId: options.projectId,
-		envId: options.envId,
-		ensureSchema: false
-	});
+	const identityStore = createD1IdentityStore(options);
 	const linkIdentity = linkD1Identity.bind(void 0, identityStore);
 	const linkedDeviceEd25519AuthorityReaderSlot = { current: null };
 	const getLinkedDeviceEd25519AuthorityReader = linkedDeviceEd25519AuthorityReaderFromSlot.bind(void 0, linkedDeviceEd25519AuthorityReaderSlot);
-	const authorizationStore = new CloudflareD1AuthorizationStore({
+	const { authorizationStore, authorizationService } = createD1AuthorizationAssembly({
 		database: options.database,
 		namespace: options.namespace,
 		walletSignerScope: {
@@ -918,32 +708,9 @@ function createCloudflareD1RouterApiAuthAssembly(input) {
 			envId: options.envId
 		},
 		getLinkedDeviceAuthorityReader: getLinkedDeviceEd25519AuthorityReader
-	});
-	const authorizationService = new AuthorizationService({
-		policy: capabilityPolicyPort,
-		sessions: authorizationStore,
-		evidence: authorizationStore,
-		grants: authorizationStore,
-		authorizedOperations: authorizationStore,
-		audit: authorizationStore
-	});
-	const googleEmailOtpRegistrationAttempts = new CloudflareD1GoogleEmailOtpRegistrationAttemptStore({
-		prepare,
-		orgId: options.orgId
-	});
-	const nearPublicKeys = new CloudflareD1NearPublicKeyStore({ prepare });
-	const webAuthnStore = new CloudflareD1WebAuthnStore({
-		database: options.database,
-		namespace: options.namespace,
-		orgId: options.orgId,
-		projectId: options.projectId,
-		envId: options.envId
-	});
-	const webAuthnAuthService = new CloudflareD1WebAuthnAuthService({
-		webAuthnStore,
-		walletAuthMethodStore,
-		walletManifestSource: { getEd25519KeyManifestBySlot: readD1Ed25519KeyManifestBySlot.bind(void 0, walletStore) }
-	});
+	}, options.sessionRouting);
+	const googleEmailOtpRegistrationAttempts = createD1GoogleRegistrationAttempts(options, prepare);
+	const { webAuthnStore, webAuthnAuthService } = createD1WebAuthnAssembly(options, walletAuthMethodStore, { getEd25519KeyManifestBySlot: readD1Ed25519KeyManifestBySlot.bind(void 0, walletStore) });
 	const emailOtpChallenges = new CloudflareD1EmailOtpChallengeStore({
 		database: options.database,
 		namespace: options.namespace,
@@ -954,10 +721,7 @@ function createCloudflareD1RouterApiAuthAssembly(input) {
 	const emailOtpDelivery = new CloudflareD1EmailOtpDeliveryRuntime(options.emailOtp);
 	const emailOtpEnrollments = new CloudflareD1EmailOtpEnrollmentStore({ prepare });
 	const emailOtpGrants = new CloudflareD1EmailOtpGrantStore({ prepare });
-	const emailOtpRateLimits = new CloudflareD1EmailOtpRateLimitStore({
-		prepare,
-		rateLimits: options.emailOtp.rateLimits
-	});
+	const emailOtpRateLimits = createD1EmailOtpRateLimits(options, prepare);
 	const emailOtpServerSeal = new CloudflareD1EmailOtpServerSealRuntime(options.emailOtpServerSeal);
 	const googleEmailOtpSessions = new CloudflareD1GoogleEmailOtpSessionResolver({
 		emailOtpEnrollments,
@@ -967,12 +731,7 @@ function createCloudflareD1RouterApiAuthAssembly(input) {
 		production: options.emailOtp.production,
 		registrationAttempts: googleEmailOtpRegistrationAttempts
 	});
-	const identityService = new CloudflareD1IdentityService({
-		accountIdDerivationSecret: options.accountIdDerivationSecret,
-		identityStore,
-		relayerAccount: options.relayerAccount,
-		resolveGoogleEmailOtpSession: googleEmailOtpSessions.resolve.bind(googleEmailOtpSessions)
-	});
+	const identityService = new CloudflareD1IdentityService({ identityStore });
 	const oidcVerification = new CloudflareD1OidcVerificationService({
 		googleOidcClientId: options.googleOidcClientId,
 		githubOAuth: options.githubOAuth,
@@ -1060,23 +819,17 @@ function createCloudflareD1RouterApiAuthAssembly(input) {
 		envId: options.envId
 	});
 	const walletRegistrationCommitStore = new CloudflareD1WalletRegistrationCommitStore({
+		credentialClaims: options.credentialClaims,
 		database: options.database,
 		namespace: options.namespace,
 		orgId: options.orgId,
 		projectId: options.projectId,
 		envId: options.envId
 	});
-	const walletCustodyCommitStore = new CloudflareD1WalletCustodyCommitStore({
-		database: options.database,
-		scope: {
-			namespace: options.namespace,
-			orgId: options.orgId,
-			projectId: options.projectId,
-			envId: options.envId
-		}
-	});
+	const walletCustodyCommitStore = createD1WalletCustodyStore(options);
 	const signedDelegateExecutor = new CloudflareD1SignedDelegateExecutor(options);
 	const walletRegistrations = new CloudflareD1WalletRegistrationService({
+		registrationAuthority: options.registrationAuthority ?? null,
 		authorizationService,
 		authorizationTenantId: authorizationTenantId.value,
 		createSponsoredNamedNearAccount,
@@ -1167,6 +920,7 @@ function createCloudflareD1RouterApiAuthAssembly(input) {
 		authorizationService,
 		authorizationStore,
 		walletRegistration: createD1WalletRegistrationRouteService({
+			options,
 			emailOtpRecoveryService,
 			registrationIntents,
 			walletAuthMethodStore,
@@ -1197,7 +951,6 @@ function createCloudflareD1RouterApiAuthAssembly(input) {
 		authorizationService,
 		authorizationStore,
 		googleEmailOtpSessions,
-		nearPublicKeys,
 		webAuthnAuthService,
 		walletAuthMethods,
 		walletRegistrations,
@@ -1266,7 +1019,10 @@ function createD1WalletRegistrationRouteService(assembly) {
 		resolveActiveEcdsaTenantRoot: assembly.walletRegistrations.resolveActiveEcdsaTenantRoot.bind(assembly.walletRegistrations),
 		listWalletEcdsaKeyFactsInventory: assembly.walletRegistrations.listWalletEcdsaKeyFactsInventory.bind(assembly.walletRegistrations),
 		readActiveEmailOtpEnrollment: assembly.emailOtpRecoveryService.readActiveEmailOtpEnrollment.bind(assembly.emailOtpRecoveryService),
-		setupWalletRegistration: assembly.walletRegistrations.setupWalletRegistration.bind(assembly.walletRegistrations),
+		setupWalletRegistration: dispatchWalletRegistrationSetup.bind(void 0, {
+			dispatcher: assembly.options.registrationSetupDispatcher ?? null,
+			local: assembly.walletRegistrations
+		}),
 		respondWalletRegistration: assembly.walletRegistrations.respondWalletRegistration.bind(assembly.walletRegistrations),
 		authorizeWalletRegistrationNearAdmission: assembly.walletRegistrations.authorizeWalletRegistrationNearAdmission.bind(assembly.walletRegistrations),
 		activateWalletRegistration: assembly.walletRegistrations.activateWalletRegistration.bind(assembly.walletRegistrations),
@@ -1484,45 +1240,21 @@ function createD1IdentityRouteService(assembly) {
 		linkIdentity: assembly.identityService.linkIdentity.bind(assembly.identityService),
 		listIdentities: assembly.identityService.listIdentities.bind(assembly.identityService),
 		resolveGoogleEmailOtpSession: assembly.googleEmailOtpSessions.resolve.bind(assembly.googleEmailOtpSessions),
-		resolveOidcWalletId: assembly.identityService.resolveOidcWalletId.bind(assembly.identityService),
 		unlinkIdentity: assembly.identityService.unlinkIdentity.bind(assembly.identityService),
 		verifyGoogleLogin: assembly.oidcVerification.verifyGoogleLogin.bind(assembly.oidcVerification),
 		verifyGithubOAuthCode: assembly.oidcVerification.verifyGithubOAuthCode.bind(assembly.oidcVerification)
 	};
 }
-function isExhaustedWalletSessionStatus(status) {
-	return status.kind === "exhausted";
-}
 function createD1AuthorizationSessionRouteService(assembly) {
 	const tenantId = parseTenantId(assembly.options.orgId);
 	if (!tenantId.ok) throw new Error(`orgId cannot identify an authorization tenant: ${tenantId.error.message}`);
 	return {
 		tenantId: tenantId.value,
 		issueDirectWalletSessionAuthorizationV2: assembly.authorizationService.issueDirectWalletSessionAuthorizationV2.bind(assembly.authorizationService),
-		readWalletSessionAuthorizationV2ByOperationCredential: async (input) => {
-			const snapshot = await assembly.authorizationService.readWalletSessionAdmissionSnapshotByOperationCredential(input);
-			if (!snapshot) return null;
-			const { authorization, authority, authMethod } = snapshot;
-			if (!authority || authority.state !== "active" || !authMethod || authMethod.status !== "active") return null;
-			return {
-				authorization,
-				authority,
-				authMethod,
-				retiredAtMs: null
-			};
-		},
+		readWalletSessionAuthorizationV2ByOperationCredential: readActiveWalletSessionCredential.bind(null, assembly.authorizationService),
+		readWalletSessionSigningCandidateByOperationCredential: readWalletSessionSigningCandidate.bind(null, assembly.authorizationService),
 		readWalletSessionExactOperationContextByCredential: assembly.authorizationService.readWalletSessionExactOperationContextByCredential.bind(assembly.authorizationService),
-		readExhaustedWalletSessionAuthorizationV2CandidateByOperationCredential: async (input) => {
-			const { status, authority, authMethod } = await assembly.authorizationService.readExactWalletSessionStatusSnapshotByOperationCredential(input);
-			if (!isExhaustedWalletSessionStatus(status)) return null;
-			if (!authority || authority.state !== "active" || !authMethod || authMethod.status !== "active" || authority.walletId !== status.session.walletId || authority.authorityDigestB64u !== status.session.authorityDigestB64u || authority.revocationEpoch !== status.session.authorityRevocationEpoch || authMethod.walletId !== status.session.walletId || authMethod.walletAuthorityId !== status.session.authorityId || authMethod.walletAuthMethodId !== status.session.walletAuthMethodId) return null;
-			return {
-				status,
-				authority,
-				authMethod,
-				retiredAtMs: null
-			};
-		},
+		readExhaustedWalletSessionAuthorizationV2CandidateByOperationCredential: readExhaustedWalletSessionCredential.bind(null, assembly.authorizationService),
 		readExactWalletSessionStatusByOperationCredential: assembly.authorizationService.readExactWalletSessionStatusByOperationCredential.bind(assembly.authorizationService),
 		mintHostedWalletSeamsSessionExchange: assembly.authorizationService.mintHostedWalletSeamsSessionExchange.bind(assembly.authorizationService),
 		redeemHostedWalletSeamsSessionExchange: assembly.authorizationService.redeemHostedWalletSeamsSessionExchange.bind(assembly.authorizationService),
@@ -1549,10 +1281,7 @@ function createD1ThresholdRuntimeRouteService(assembly) {
 	return { getRouterAbEcdsaPresignRuntime: () => assembly.options.routerAbEcdsaPresignRuntime || null };
 }
 function createD1NearFundingRouteService(assembly) {
-	return {
-		fundImplicitNearAccount: fundImplicitNearAccountForOptions.bind(void 0, assembly.options),
-		listNearPublicKeysForUser: assembly.nearPublicKeys.listForRelayUser.bind(assembly.nearPublicKeys)
-	};
+	return { fundImplicitNearAccount: fundImplicitNearAccountForOptions.bind(void 0, assembly.options) };
 }
 function createD1RouterAccountRouteService(assembly) {
 	const accountId = assembly.options.relayerAccount || DEFAULT_D1_THRESHOLD_RELAYER_ACCOUNT;

package/dist/esm/router/cloudflare/d1/auth/walletSessionCredentialReaders.js

@@ -0,0 +1,76 @@
+//#region src/router/cloudflare/d1/auth/walletSessionCredentialReaders.ts
+function activeContext(snapshot) {
+	const { authorization, authority, authMethod } = snapshot;
+	if (!authority || authority.state !== "active" || !authMethod || authMethod.status !== "active") return null;
+	return {
+		authorization,
+		authority,
+		authMethod,
+		retiredAtMs: null
+	};
+}
+function exhaustedContext(snapshot) {
+	const { session, quota, authority, authMethod } = snapshot;
+	if (!authority || authority.state !== "active" || !authMethod || authMethod.status !== "active" || authority.walletId !== session.walletId || authority.authorityDigestB64u !== session.authorityDigestB64u || authority.revocationEpoch !== session.authorityRevocationEpoch || authMethod.walletId !== session.walletId || authMethod.walletAuthorityId !== session.authorityId || authMethod.walletAuthMethodId !== session.walletAuthMethodId) return null;
+	return {
+		status: {
+			kind: "exhausted",
+			session,
+			quota
+		},
+		authority,
+		authMethod,
+		retiredAtMs: null
+	};
+}
+async function readActiveWalletSessionCredential(service, input) {
+	const snapshot = await service.readWalletSessionAdmissionSnapshotByOperationCredential(input);
+	if (!snapshot) return null;
+	if (snapshot.kind === "exhausted") throw new Error("Stored V2 Wallet Session quota is no longer active");
+	return activeContext(snapshot);
+}
+async function readWalletSessionSigningCandidate(service, input) {
+	const read = await service.readEcdsaWalletSessionAdmissionSnapshotByOperationCredential(input);
+	if (!read) return null;
+	const { snapshot, materialRead, policyRead } = read;
+	switch (snapshot.kind) {
+		case "active": {
+			const context = activeContext(snapshot);
+			return context ? {
+				kind: "active",
+				context,
+				materialRead,
+				policyRead
+			} : null;
+		}
+		case "exhausted": {
+			const candidate = exhaustedContext(snapshot);
+			if (!candidate) throw new Error("Exhausted Wallet Session authority is unavailable");
+			return {
+				kind: "exhausted",
+				candidate,
+				materialRead,
+				policyRead
+			};
+		}
+		default: {
+			const unexpected = snapshot;
+			throw new Error(`Unsupported Wallet Session snapshot: ${unexpected}`);
+		}
+	}
+}
+async function readExhaustedWalletSessionCredential(service, input) {
+	const { status, authority, authMethod } = await service.readExactWalletSessionStatusSnapshotByOperationCredential(input);
+	if (status.kind !== "exhausted") return null;
+	return exhaustedContext({
+		kind: "exhausted",
+		session: status.session,
+		quota: status.quota,
+		authority,
+		authMethod
+	});
+}
+//#endregion
+export { readActiveWalletSessionCredential, readExhaustedWalletSessionCredential, readWalletSessionSigningCandidate };
+
+//# sourceMappingURL=walletSessionCredentialReaders.js.map