@seams/wallet-server 0.7.1 → 0.8.0

package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnRecords.js

@@ -1,12 +1,12 @@
 import { parsePasskeyEnvelopeId, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWalletRecoveryOperationId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { parseEnvelopeRevision } from "../../../../shared-ts/src/passkey-custody/primitives.js";
 import { normalizeRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { parseWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { parseWebAuthnAuthenticatorDeviceInfoJson } from "../../../../shared-ts/src/utils/webauthnDeviceInfo.js";
+import { hasExactKeys } from "../../../../shared-ts/src/utils/exactKeys.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
 import { parseRecoveryCodeReservationId } from "../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
 import { nonNegativeSafeInteger, optionalNonNegativeInteger, positiveInteger } from "../auth/d1RouterApiAuthBoundary.js";
@@ -25,7 +25,7 @@ function parseWebAuthnLoginChallengeRecord(input) {
 	}
 	if (prototype !== Object.prototype && prototype !== null) return null;
 	const record = candidate;
-	if (!hasExactFields(record, [
+	if (!hasExactKeys(record, [
 		"version",
 		"challengeId",
 		"userId",
@@ -36,18 +36,18 @@ function parseWebAuthnLoginChallengeRecord(input) {
 	])) return null;
 	const version = normalizeOptionalTrimmedString(record.version);
 	const challengeId = normalizeOptionalTrimmedString(record.challengeId);
-	const userId = normalizeOptionalTrimmedString(record.userId);
+	const userId = parseWalletId(record.userId);
 	const rpId = normalizeOptionalTrimmedString(record.rpId);
 	const challengeB64u = normalizeOptionalTrimmedString(record.challengeB64u);
 	const createdAtMs = positiveInteger(record.createdAtMs);
 	const expiresAtMs = positiveInteger(record.expiresAtMs);
 	if (version !== "webauthn_login_challenge_v1") return null;
-	if (!challengeId || !userId || !rpId || !challengeB64u) return null;
+	if (!challengeId || !userId.ok || !rpId || !challengeB64u) return null;
 	if (createdAtMs === null || expiresAtMs === null) return null;
 	return {
 		version: "webauthn_login_challenge_v1",
 		challengeId,
-		userId,
+		userId: userId.value,
 		rpId,
 		challengeB64u,
 		createdAtMs,
@@ -65,7 +65,7 @@ function parseWebAuthnSyncChallengeRecord(input) {
 	}
 	if (prototype !== Object.prototype && prototype !== null) return null;
 	const record = candidate;
-	if (!hasExactFields(record, Object.hasOwn(record, "expectedUserId") ? [
+	if (!hasExactKeys(record, Object.hasOwn(record, "expectedUserId") ? [
 		"version",
 		"challengeId",
 		"rpId",
@@ -263,7 +263,7 @@ function parseWebAuthnRecoveryContinuityEnvelopeAnchor(input) {
 	const updatedAtMs = positiveInteger(record.updatedAtMs);
 	if (!kind || !envelopeId.ok || !walletId.ok || !envelopeRevision || updatedAtMs === null || record.bindingKind !== "wallet_custody_seed_v1") return null;
 	if (kind === "passkey") {
-		if (!hasExactFields(record, [
+		if (!hasExactKeys(record, [
 			"kind",
 			"envelopeId",
 			"walletId",
@@ -288,7 +288,7 @@ function parseWebAuthnRecoveryContinuityEnvelopeAnchor(input) {
 		};
 	}
 	if (kind === "email_otp") {
-		if (!hasExactFields(record, [
+		if (!hasExactKeys(record, [
 			"kind",
 			"envelopeId",
 			"walletId",
@@ -321,10 +321,6 @@ function parseRecoveryEnvelopeRevision(input) {
 		return null;
 	}
 }
-function hasExactFields(record, expectedFields) {
-	const fields = Object.keys(record);
-	return fields.length === expectedFields.length && expectedFields.every((field) => fields.includes(field));
-}
 function parseWebAuthnAuthenticator(row) {
 	const credentialIdB64u = normalizeOptionalTrimmedString(row?.credential_id_b64u);
 	const credentialPublicKeyB64u = normalizeOptionalTrimmedString(row?.credential_public_key_b64u);
@@ -427,39 +423,6 @@ function webAuthnSyncWalletBindingFromCredentialBinding(binding) {
 		signerSlot
 	};
 }
-function parseNearPublicKey(row) {
-	const candidate = parseWebAuthnJsonInput(row.record_json);
-	if (candidate === null || typeof candidate !== "object" || Array.isArray(candidate)) return null;
-	let prototype;
-	try {
-		prototype = Object.getPrototypeOf(candidate);
-	} catch {
-		return null;
-	}
-	if (prototype !== Object.prototype && prototype !== null) return null;
-	const record = candidate;
-	if (Object.keys(record).some((field) => ![
-		"publicKey",
-		"kind",
-		"authBinding",
-		"signerSlot",
-		"createdAtMs",
-		"updatedAtMs"
-	].includes(field))) return null;
-	const publicKey = normalizeOptionalTrimmedString(record.publicKey);
-	const kind = parseNearPublicKeyKind(normalizeOptionalTrimmedString(record.kind));
-	const authBinding = parseNearPublicKeyAuthBinding(record);
-	if (authBinding === null) return null;
-	if (!publicKey || !kind) return null;
-	return {
-		publicKey,
-		kind,
-		signerSlot: optionalNonNegativeInteger(record.signerSlot),
-		...authBinding ? { authBinding } : {},
-		createdAtMs: optionalNonNegativeInteger(record.createdAtMs),
-		updatedAtMs: optionalNonNegativeInteger(record.updatedAtMs)
-	};
-}
 function parseWebAuthnJsonInput(input) {
 	if (typeof input === "string") try {
 		return JSON.parse(input);
@@ -478,7 +441,7 @@ function parseWebAuthnRuntimePolicyScope(raw) {
 	}
 	if (prototype !== Object.prototype && prototype !== null) return void 0;
 	const record = raw;
-	if (!hasExactFields(record, [
+	if (!hasExactKeys(record, [
 		"orgId",
 		"projectId",
 		"envId",
@@ -500,39 +463,7 @@ function optionalNumberArray(input) {
 	}
 	return values;
 }
-function parseNearPublicKeyKind(input) {
-	switch (input) {
-		case "threshold":
-		case "local":
-		case "backup":
-		case "ephemeral": return input;
-		default: return null;
-	}
-}
-function parseNearPublicKeyAuthBinding(record) {
-	if (Object.prototype.hasOwnProperty.call(record, "rpId") || Object.prototype.hasOwnProperty.call(record, "credentialIdB64u")) return null;
-	if (record.authBinding === void 0) return void 0;
-	const candidate = record.authBinding;
-	if (candidate === null || typeof candidate !== "object" || Array.isArray(candidate)) return null;
-	let prototype;
-	try {
-		prototype = Object.getPrototypeOf(candidate);
-	} catch {
-		return null;
-	}
-	if (prototype !== Object.prototype && prototype !== null) return null;
-	const authBinding = candidate;
-	const kind = normalizeOptionalTrimmedString(authBinding.kind);
-	const rpId = parseWebAuthnRpId(authBinding.rpId);
-	const credentialIdB64u = normalizeOptionalTrimmedString(authBinding.credentialIdB64u);
-	if (kind !== "passkey" || !rpId.ok || !credentialIdB64u) return null;
-	return {
-		kind: "passkey",
-		rpId: rpId.value,
-		credentialIdB64u
-	};
-}
 //#endregion
-export { buildWebAuthnRecoveryContinuityAnchorRecord, parseNearPublicKey, parseWebAuthnAuthenticator, parseWebAuthnAuthenticatorRowDeviceInfo, parseWebAuthnBinding, parseWebAuthnLoginChallengeRecord, parseWebAuthnRecoveryRegistrationChallengeRecord, parseWebAuthnSyncChallengeRecord, webAuthnSyncWalletBindingFromCredentialBinding };
+export { buildWebAuthnRecoveryContinuityAnchorRecord, parseWebAuthnAuthenticator, parseWebAuthnAuthenticatorRowDeviceInfo, parseWebAuthnBinding, parseWebAuthnLoginChallengeRecord, parseWebAuthnRecoveryRegistrationChallengeRecord, parseWebAuthnSyncChallengeRecord, webAuthnSyncWalletBindingFromCredentialBinding };
 
 //# sourceMappingURL=d1WebAuthnRecords.js.map

package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnStore.js

@@ -1,9 +1,9 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { prepareD1TenantStatement } from "../../../../core/d1TenantStore.js";
-import { INSERT_WEBAUTHN_AUTHENTICATOR_SQL, UPSERT_WEBAUTHN_AUTHENTICATOR_SQL, webAuthnAuthenticatorRows, webAuthnChallengeRows, webAuthnCredentialBindingRows } from "../../../../core/webAuthnD1Statements.js";
+import { reservePasskeyCredential } from "../../../../core/passkeyCredentialClaims.js";
 import { prepareD1WebAuthnCredentialBindingInsertStatement } from "../../../../core/WebAuthnCredentialBindingStore.js";
 import { parseWebAuthnAuthenticator, parseWebAuthnBinding, parseWebAuthnLoginChallengeRecord, parseWebAuthnRecoveryRegistrationChallengeRecord, parseWebAuthnSyncChallengeRecord } from "./d1WebAuthnRecords.js";
+import { INSERT_WEBAUTHN_AUTHENTICATOR_SQL, UPSERT_WEBAUTHN_AUTHENTICATOR_SQL, webAuthnAuthenticatorRows, webAuthnChallengeRows, webAuthnCredentialBindingRows } from "../../../../core/webAuthnD1Statements.js";
 //#region src/router/cloudflare/d1/webauthn/d1WebAuthnStore.ts
 function prepareAuthenticatorStatement(sql, input) {
 	return input.database.prepare(sql).bind(input.scope.namespace, input.scope.orgId, input.scope.projectId, input.scope.envId, input.userId, input.record.credentialIdB64u, input.record.credentialPublicKeyB64u, input.record.counter, input.record.createdAtMs, input.record.updatedAtMs, JSON.stringify(input.record.deviceInfo));
@@ -20,6 +20,8 @@ function prepareD1WebAuthnAuthenticatorInsertStatement(input) {
 var CloudflareD1WebAuthnStore = class {
 	constructor(input) {
 		this.prepare = (sql, values) => prepareD1TenantStatement(this.database, this.scope, sql, values);
+		this.credentialClaims = input.credentialClaims;
+		this.syncChallenges = input.syncChallenges;
 		this.database = input.database;
 		this.scope = {
 			namespace: input.namespace,
@@ -29,7 +31,9 @@ var CloudflareD1WebAuthnStore = class {
 		};
 	}
 	async writeChallenge(input) {
+		if (input.challengeKind === "sync" && this.syncChallenges) return this.syncChallenges.create(input.record);
 		await webAuthnChallengeRows.upsert(this.prepare, input).run();
+		return { ok: true };
 	}
 	async consumeLoginChallenge(challengeId) {
 		return parseWebAuthnLoginChallengeRecord((await this.consumeChallenge({
@@ -37,11 +41,18 @@ var CloudflareD1WebAuthnStore = class {
 			challengeKind: "login"
 		}))?.record_json);
 	}
-	async consumeSyncChallenge(challengeId) {
-		return parseWebAuthnSyncChallengeRecord((await this.consumeChallenge({
+	async consumeSyncChallenge(challengeId, credentialIdB64u) {
+		if (this.syncChallenges) return this.syncChallenges.consume({
 			challengeId,
-			challengeKind: "sync"
-		}))?.record_json);
+			credentialIdB64u
+		});
+		return {
+			ok: true,
+			record: parseWebAuthnSyncChallengeRecord((await this.consumeChallenge({
+				challengeId,
+				challengeKind: "sync"
+			}))?.record_json)
+		};
 	}
 	async readRecoveryRegistrationChallenge(challengeId, nowMs) {
 		return parseWebAuthnRecoveryRegistrationChallengeRecord((await this.prepare(`SELECT record_json
@@ -90,7 +101,12 @@ var CloudflareD1WebAuthnStore = class {
 			record: input.record
 		});
 	}
-	prepareCredentialBindingInsertStatement(record) {
+	async prepareCredentialBindingInsertStatement(record) {
+		await reservePasskeyCredential(this.credentialClaims, {
+			walletId: record.userId,
+			rpId: record.rpId,
+			credentialIdB64u: record.credentialIdB64u
+		});
 		return prepareD1WebAuthnCredentialBindingInsertStatement({
 			database: this.database,
 			scope: this.scope,

package/dist/esm/router/cloudflare/runtime/routerAbPrewarm.js

@@ -1,8 +1,8 @@
+import { ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1 } from "../../../core/ThresholdService/routerAb/internalServiceHttp.js";
 import { ROUTER_AB_MPC_ROUTER_ORIGIN } from "./routerAbServiceBindings.js";
 //#region src/router/cloudflare/runtime/routerAbPrewarm.ts
 const ROUTER_AB_PREWARM_CRON = "* * * * *";
 const ROUTER_AB_PREWARM_PATH = "/internal/prewarm";
-const ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER = "x-router-ab-internal-service-auth";
 function parseRouterAbPrewarmEnabled(value) {
 	if (value === "true") return true;
 	if (value === "false") return false;
@@ -23,7 +23,7 @@ async function runRouterAbPrewarmScheduledV1(event, env) {
 	if (!parseRouterAbPrewarmEnabled(env.ROUTER_AB_PREWARM_ENABLED)) return;
 	const response = await env.MPC_ROUTER.fetch(new Request(`${ROUTER_AB_MPC_ROUTER_ORIGIN}${ROUTER_AB_PREWARM_PATH}`, {
 		method: "POST",
-		headers: { [ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER]: requireRouterAbInternalServiceAuthSecret(env) }
+		headers: { [ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1]: requireRouterAbInternalServiceAuthSecret(env) }
 	}));
 	if (!response.ok) throw new Error(`Router A/B prewarm failed with HTTP ${response.status}`);
 	if (!isSuccessfulRouterAbPrewarmResponse(await response.json())) throw new Error("Router A/B prewarm returned an invalid response");

package/dist/esm/router/cloudflare/runtime/staticWalletConsoleBinding.js

@@ -1,3 +1,4 @@
+import { failure } from "../../../shared-ts/src/utils/failure.js";
 import { ROUTER_API_CREDENTIAL_SCOPES } from "../../framework/apiCredentialPorts.js";
 import { WALLET_CONSOLE_OP_PATHS_V1, decodeWalletConsoleTenantRootActiveLineageRequestV1 } from "./walletConsoleOps.js";
 //#region src/router/cloudflare/runtime/staticWalletConsoleBinding.ts
@@ -67,6 +68,7 @@ async function handleStaticWalletConsoleRequestV1(config, input, init) {
 		case WALLET_CONSOLE_OP_PATHS_V1.secretKeyAuth: return secretKeyResponse(config, body);
 		case WALLET_CONSOLE_OP_PATHS_V1.projectEnvironments: return projectEnvironmentsResponse(config, body);
 		case WALLET_CONSOLE_OP_PATHS_V1.tenantRootActiveLineage: return activeLineageResponse(config, body);
+		case WALLET_CONSOLE_OP_PATHS_V1.walletProjection:
 		case WALLET_CONSOLE_OP_PATHS_V1.usageEvents: return json({ ok: true });
 		default: return json({
 			ok: false,
@@ -101,11 +103,7 @@ function includesScope(scopes, value) {
 }
 function projectEnvironmentsResponse(config, value) {
 	const context = record(record(value)?.context);
-	if (!context || context.orgId !== config.deployment.orgId) return json({
-		ok: false,
-		code: "environment_not_found",
-		message: "Environment not found"
-	}, 404);
+	if (!context || context.orgId !== config.deployment.orgId) return json(failure("environment_not_found", "Environment not found"), 404);
 	return json({
 		ok: true,
 		environments: [{
@@ -119,17 +117,9 @@ function projectEnvironmentsResponse(config, value) {
 }
 function activeLineageResponse(config, value) {
 	const decoded = decodeWalletConsoleTenantRootActiveLineageRequestV1(value);
-	if (!decoded.ok) return json({
-		ok: false,
-		code: "invalid_body",
-		message: "Identity is invalid"
-	}, 400);
+	if (!decoded.ok) return json(failure("invalid_body", "Identity is invalid"), 400);
 	const identity = decoded.value;
-	if (identity.orgId !== config.deployment.orgId || identity.projectId !== config.deployment.projectId || identity.envId !== config.deployment.environmentId || identity.signingRootId !== config.tenantRoot.signingRootId || identity.signingRootVersion !== config.deployment.signingRootVersion) return json({
-		ok: false,
-		code: "tenant_root_active_lineage_not_found",
-		message: "Active tenant-root lineage was not found"
-	}, 404);
+	if (identity.orgId !== config.deployment.orgId || identity.projectId !== config.deployment.projectId || identity.envId !== config.deployment.environmentId || identity.signingRootId !== config.tenantRoot.signingRootId || identity.signingRootVersion !== config.deployment.signingRootVersion) return json(failure("tenant_root_active_lineage_not_found", "Active tenant-root lineage was not found"), 404);
 	return json({
 		ok: true,
 		identityDigestB64u: config.tenantRoot.identityDigestB64u,
@@ -147,11 +137,7 @@ function principal(config) {
 	};
 }
 function authFailure(code, message, status = 401) {
-	return json({
-		ok: false,
-		code,
-		message
-	}, status);
+	return json(failure(code, message), status);
 }
 function record(value) {
 	return value && typeof value === "object" && !Array.isArray(value) ? value : null;

package/dist/esm/router/cloudflare/runtime/tenantRootCreationGrant.js

@@ -1,4 +1,5 @@
 import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
+import { hasControlCharacters } from "../../../shared-ts/src/tenant-root/tenantRootIdentifier.js";
 import { encodeTenantRootIdentityV1 } from "../../../shared-ts/src/tenant-root/tenantRootIdentity.js";
 //#region src/router/cloudflare/runtime/tenantRootCreationGrant.ts
 const GRANT_DOMAIN = new TextEncoder().encode("tenant_root_creation_grant_v1");
@@ -22,7 +23,6 @@ const ED25519_PKCS8_SEED_PREFIX = Uint8Array.from([
 	4,
 	32
 ]);
-const MAX_IDENTIFIER_BYTES = 256;
 const MAX_GRANT_LIFETIME_MS = 3e5;
 function concatBytes(parts) {
 	const length = parts.reduce((sum, part) => sum + part.length, 0);
@@ -47,17 +47,10 @@ function u64(value, label) {
 	new DataView(output.buffer).setBigUint64(0, BigInt(value), false);
 	return output;
 }
-function hasControlCharacters(value) {
-	for (const character of value) {
-		const codePoint = character.codePointAt(0) ?? 0;
-		if (codePoint <= 31 || codePoint >= 127 && codePoint <= 159) return true;
-	}
-	return false;
-}
 function identifierBytes(value, label) {
 	if (!value || value.trim() !== value || hasControlCharacters(value)) throw new Error(`${label} is invalid`);
 	const bytes = new TextEncoder().encode(value);
-	if (bytes.length > MAX_IDENTIFIER_BYTES) throw new Error(`${label} exceeds ${MAX_IDENTIFIER_BYTES} UTF-8 bytes`);
+	if (bytes.length > 256) throw new Error(`${label} exceeds 256 UTF-8 bytes`);
 	return bytes;
 }
 async function tenantRootIdentityDigestB64uV1(identity) {

package/dist/esm/router/cloudflare/runtime/walletConsoleOps.js

@@ -7,6 +7,7 @@ const WALLET_CONSOLE_OP_PATHS_V1 = {
 	secretKeyAuth: `${WALLET_CONSOLE_OPS_BASE_PATH_V1}/secret-key-auth`,
 	publishableKeyAuth: `${WALLET_CONSOLE_OPS_BASE_PATH_V1}/publishable-key-auth`,
 	usageEvents: `${WALLET_CONSOLE_OPS_BASE_PATH_V1}/usage-events`,
+	walletProjection: `${WALLET_CONSOLE_OPS_BASE_PATH_V1}/wallet-projections`,
 	projectEnvironments: `${WALLET_CONSOLE_OPS_BASE_PATH_V1}/project-environments`,
 	tenantRootActiveLineage: `${WALLET_CONSOLE_OPS_BASE_PATH_V1}/tenant-root/active-lineage`
 };

package/dist/esm/router/cloudflare/runtime/walletConsoleOpsClient.js

@@ -215,12 +215,17 @@ function createWalletConsoleOpsClient(service) {
 				custodyLineageB64u: decoded.value.custodyLineageB64u
 			};
 		} },
+		walletProjection: { recordCreatedWallet: recordCreatedWallet.bind(void 0, service) },
 		usageMeter: { async recordEvent(input) {
 			const { status, body } = await postJson(service, WALLET_CONSOLE_OP_PATHS_V1.usageEvents, input);
 			if (!isUsageEventsSuccessResponse(body)) throw new Error(`Wallet Console usage ingestion failed (HTTP ${status}): invalid response`);
 		} }
 	};
 }
+async function recordCreatedWallet(service, input) {
+	const { status, body } = await postJson(service, WALLET_CONSOLE_OP_PATHS_V1.walletProjection, input);
+	if (status !== 200 || !isUsageEventsSuccessResponse(body)) throw new Error(`Wallet Console projection failed (HTTP ${status})`);
+}
 //#endregion
 export { createWalletConsoleOpsClient };
 

package/dist/esm/router/cloudflare/runtime/walletControlOps.js

@@ -1,3 +1,4 @@
+import { ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1 } from "../../../core/ThresholdService/routerAb/internalServiceHttp.js";
 //#region src/router/cloudflare/runtime/walletControlOps.ts
 const WALLET_CONTROL_SERVICE_ORIGIN_V1 = "https://wallet-runtime.internal";
 const WALLET_CONTROL_BASE_PATH_V1 = "/internal/wallet-runtime/v1/tenant-root-control";
@@ -74,7 +75,7 @@ async function handleWalletControlRequest(request, env) {
 		redirect: "manual",
 		headers: {
 			"content-type": contentType,
-			"x-router-ab-internal-service-auth": requireInternalServiceAuth(env)
+			[ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1]: requireInternalServiceAuth(env)
 		},
 		body
 	}));

package/dist/esm/router/cloudflare/runtime/walletGateway.js

@@ -1,5 +1,4 @@
 import { ensureLeadingSlash } from "../../../shared-ts/src/utils/normalize.js";
-import "../../../shared-ts/src/utils/validation.js";
 import { createRouterAbNormalSigningAdmissionAdapter } from "../../domains/signingOperations/routerAbNormalSigningAdmissionCore.js";
 import { createCloudflareD1RouterAbNormalSigningAdmissionStore } from "../d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.js";
 import { WALLET_CONSOLE_SERVICE_ORIGIN_V1 } from "./walletConsoleOps.js";
@@ -138,6 +137,7 @@ function createCloudflareWalletGatewayRouterV1(input) {
 		apiKeyAuth: consoleOps.apiKeyAuth,
 		publishableKeyAuth: consoleOps.publishableKeyAuth,
 		apiKeyUsageMeter: consoleOps.usageMeter,
+		walletProjection: consoleOps.walletProjection,
 		orgProjectEnv: consoleOps.projectEnvironments,
 		routerAbNormalSigningAdmission: createRouterAbNormalSigningAdmissionAdapter(admissionStore),
 		routeExtensions: [createWalletConsoleRelayProxyExtensionV1(input.walletConsole), ...input.routeExtensions ?? []]

package/dist/esm/router/cloudflare/runtime/walletRuntimeOps.js

@@ -270,13 +270,19 @@ function parseWalletRuntimeWalletIdentityRequest(value) {
 	const wallets = [];
 	for (const rawWallet of rawWallets) {
 		const wallet = inspectRawObject(rawWallet);
-		if (!wallet || !hasExactKeys(wallet, ["walletId", "projectId"])) return null;
+		if (!wallet || !hasExactKeys(wallet, [
+			"walletId",
+			"projectId",
+			"envId"
+		])) return null;
 		const walletId = parseNonEmptyText(readRawField(wallet, "walletId"));
 		const projectId = parseNonEmptyText(readRawField(wallet, "projectId"));
-		if (!walletId || !projectId) return null;
+		const envId = parseNonEmptyText(readRawField(wallet, "envId"));
+		if (!walletId || !projectId || !envId) return null;
 		wallets.push({
 			walletId,
-			projectId
+			projectId,
+			envId
 		});
 	}
 	return {
@@ -294,15 +300,21 @@ function parseWalletRuntimeWalletIdentitiesResult(value) {
 		const identity = inspectRawObject(rawIdentity);
 		if (!identity || !hasExactKeys(identity, [
 			"walletId",
+			"projectId",
+			"envId",
 			"nearAccountId",
 			"evmAddress"
 		])) return null;
 		const walletId = parseNonEmptyText(readRawField(identity, "walletId"));
+		const projectId = parseNonEmptyText(readRawField(identity, "projectId"));
+		const envId = parseNonEmptyText(readRawField(identity, "envId"));
 		const nearAccountId = parseNonEmptyText(readRawField(identity, "nearAccountId"));
 		const evmAddress = parseEvmAddress(readRawField(identity, "evmAddress"));
-		if (!walletId || !nearAccountId || !evmAddress) return null;
+		if (!walletId || !projectId || !envId || !nearAccountId || !evmAddress) return null;
 		identities.push({
 			walletId,
+			projectId,
+			envId,
 			nearAccountId,
 			evmAddress
 		});

package/dist/esm/router/cloudflare-adaptor.js

@@ -29,7 +29,6 @@ import { RouterAbEd25519YaoHttpRegistrationBackend, createRouterAbEd25519YaoHttp
 import { StaticCloudflareTenantStorageRouteResolver, createCloudflareTenantStorageRoute, createSignerD1DoStorageTarget, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings } from "../storage/tenantRoute.js";
 import { createInMemoryRouterApiRuntimeSnapshotConsumer, validateRuntimeSnapshotExpectation } from "./framework/runtimeSnapshotConsumer.js";
 import { createSelfHostedCloudflareSigningRouter, createSelfHostedCloudflareSigningWorker } from "./cloudflare/runtime/createSelfHostedCloudflareSigningWorker.js";
-import { ThresholdStoreDurableObject } from "./cloudflare/durableObjects/thresholdStore.js";
 import { CloudflareDurableObjectVersionedJsonRecordStore, CloudflareVersionedJsonRecordStoreError, createCloudflareDurableObjectVersionedJsonRecordStore } from "./cloudflare/durableObjects/versionedJsonRecordStore.js";
 import { CloudflareD1VersionedJsonRecordStore, CloudflareD1VersionedJsonRecordStoreError, createCloudflareD1VersionedJsonRecordStore } from "./cloudflare/d1/versionedJson/d1VersionedJsonRecordStore.js";
 import { createRouterAbEd25519YaoCeremonyStateStoreV1, encodeRouterAbEd25519YaoProductRegistrationStateV1, parseRouterAbEd25519YaoCeremonyKeyV1, parseRouterAbEd25519YaoProductRegistrationStateJsonV1, resolveRouterAbEd25519YaoCeremonyKeyFromRequestV1 } from "./domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPersistence.js";
@@ -42,4 +41,4 @@ import { runRouterAbEd25519YaoRegistrationSideEffectV1 } from "./domains/ed25519
 import { runRouterAbEd25519YaoRegistrationTwoPhaseV1 } from "./domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationTwoPhaseRunner.js";
 import { CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1, CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1, createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1, createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1 } from "./cloudflare/signingLanes/cloudflareOrdinaryInactiveSignerMaterialReservation.js";
 import { handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1 } from "./domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationRequestScopedCloudflare.js";
-export { CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, CloudflareD1AuthorizationStore, CloudflareD1RouterAbNormalSigningAdmissionStore, CloudflareD1VaultProxyStore, CloudflareD1VersionedJsonRecordStore, CloudflareD1VersionedJsonRecordStoreError, CloudflareD1WebAuthnAuthService, CloudflareD1WebAuthnStore, CloudflareDurableObjectVersionedJsonRecordStore, CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1, CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1, CloudflareVersionedJsonRecordStoreError, DEFAULT_WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_V1, DEFAULT_WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_V1, InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter, InMemoryRouterAbEd25519YaoRegistrationService, InMemoryRouterAbNormalSigningAdmissionStore, ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1, ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, RouterAbEd25519YaoHttpRegistrationBackend, StaticCloudflareTenantStorageRouteResolver, ThresholdStoreDurableObject, UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, WALLET_CONSOLE_API_WALLET_DETAIL_PREFIX_V1, WALLET_CONSOLE_OPS_BASE_PATH_V1, WALLET_CONSOLE_OP_PATHS_V1, WALLET_CONSOLE_SERVICE_ORIGIN_V1, WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_ID_V1, WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_ID_V1, WALLET_CONTROL_AUTH_MARKER_V1, WALLET_CONTROL_BASE_PATH_V1, WALLET_CONTROL_SERVICE_ORIGIN_V1, WALLET_RUNTIME_OPS_BASE_PATH_V1, WALLET_RUNTIME_OP_PATHS_V1, WALLET_RUNTIME_SERVICE_ORIGIN_V1, buildRouterAbEd25519YaoProductAdmissionRequestV1, coerceRouterLogger, createCloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1VersionedJsonRecordStore, createCloudflareDurableObjectVersionedJsonRecordStore, createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1, createCloudflareRouter, createCloudflareTenantStorageRoute, createCloudflareWalletGatewayRouterV1, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterApiRuntimeSnapshotConsumer, createRouterAbEd25519YaoCeremonyStateStoreV1, createRouterAbEd25519YaoHttpRegistrationBackendFromEnv, createRouterAbEd25519YaoProductRegistrationCompositionFromPortsV1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, createRouterAbEd25519YaoProductRegistrationRequestScopedRuntimeV1, createRouterAbEd25519YaoProductRegistrationRuntimeV1, createRouterAbEd25519YaoProductRegistrationStateV1, createRouterAbEd25519YaoRegistrationModule, createRouterAbNormalSigningAdmissionAdapter, createRouterApiModule, createSelfHostedCloudflareSigningRouter, createSelfHostedCloudflareSigningWorker, createSignerD1DoStorageTarget, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, createStaticWalletConsoleBindingV1, createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1, createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, createWalletConsoleOpsClient, createWalletConsoleRelayProxyExtensionV1, createWalletControlClientBindings, createWalletRuntimeOpsHandler, decodeWalletConsoleTenantRootActiveLineageRequestV1, decodeWalletConsoleTenantRootActiveLineageResponseV1, defineRoute, encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1, encodeRouterAbEd25519YaoProductRegistrationStateV1, extractBearerCredential, extractRouterApiEnvironmentId, getRouterApiRouteExtensionRoutes, handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1, handleStaticWalletConsoleRequestV1, handleWalletControlRequest, matchesRouteDefinitionRequest, mergeRouterAbEd25519YaoProductRegistrationStatePartitionV1, parseRouterAbEd25519YaoCeremonyKeyV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoProductRegistrationStateJsonV1, parseRouterAbPublicKeysetV2, parseStaticWalletConsoleBindingConfigV1, parseWalletRuntimeExecuteSignedDelegateRequest, parseWalletRuntimeExecuteSignedDelegateResponse, parseWalletRuntimeExecuteSignedDelegateResult, parseWalletRuntimeRelayerAccount, parseWalletRuntimeWalletIdentitiesResult, parseWalletRuntimeWalletIdentityRequest, partitionRouterAbEd25519YaoProductRegistrationStateV1, randomTenantRootCreationGrantBytesV1, readEnvironmentCsv, readEnvironmentString, requireEnvironmentString, resolveRouterAbEd25519YaoCeremonyKeyFromRequestV1, resolveRuntimeTenantRootLineage, resolveSourceIpFromExpressRequest, resolveSourceIpFromFetchHeaders, runRouterAbEd25519YaoProductRegistrationRequestScopedV1, runRouterAbEd25519YaoRegistrationSideEffectV1, runRouterAbEd25519YaoRegistrationTwoPhaseV1, runRouterAbPrewarmScheduledV1, signTenantRootCreationGrantV1, tenantRootIdentityDigestB64uV1, validateRuntimeSnapshotExpectation, walletConsoleApiWalletGetRouteDefinitionV1, walletConsoleApiWalletListRouteDefinitionV1, walletConsoleApiWalletSearchRouteDefinitionV1, walletConsoleRelayRouteDefinitionsV1, walletConsoleSignedDelegateRouteDefinitionV1, walletConsoleSponsoredEvmCallRouteDefinitionV1 };
+export { CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, CloudflareD1AuthorizationStore, CloudflareD1RouterAbNormalSigningAdmissionStore, CloudflareD1VaultProxyStore, CloudflareD1VersionedJsonRecordStore, CloudflareD1VersionedJsonRecordStoreError, CloudflareD1WebAuthnAuthService, CloudflareD1WebAuthnStore, CloudflareDurableObjectVersionedJsonRecordStore, CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1, CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1, CloudflareVersionedJsonRecordStoreError, DEFAULT_WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_V1, DEFAULT_WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_V1, InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter, InMemoryRouterAbEd25519YaoRegistrationService, InMemoryRouterAbNormalSigningAdmissionStore, ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1, ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, RouterAbEd25519YaoHttpRegistrationBackend, StaticCloudflareTenantStorageRouteResolver, UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, WALLET_CONSOLE_API_WALLET_DETAIL_PREFIX_V1, WALLET_CONSOLE_OPS_BASE_PATH_V1, WALLET_CONSOLE_OP_PATHS_V1, WALLET_CONSOLE_SERVICE_ORIGIN_V1, WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_ID_V1, WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_ID_V1, WALLET_CONTROL_AUTH_MARKER_V1, WALLET_CONTROL_BASE_PATH_V1, WALLET_CONTROL_SERVICE_ORIGIN_V1, WALLET_RUNTIME_OPS_BASE_PATH_V1, WALLET_RUNTIME_OP_PATHS_V1, WALLET_RUNTIME_SERVICE_ORIGIN_V1, buildRouterAbEd25519YaoProductAdmissionRequestV1, coerceRouterLogger, createCloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1VersionedJsonRecordStore, createCloudflareDurableObjectVersionedJsonRecordStore, createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1, createCloudflareRouter, createCloudflareTenantStorageRoute, createCloudflareWalletGatewayRouterV1, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterApiRuntimeSnapshotConsumer, createRouterAbEd25519YaoCeremonyStateStoreV1, createRouterAbEd25519YaoHttpRegistrationBackendFromEnv, createRouterAbEd25519YaoProductRegistrationCompositionFromPortsV1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, createRouterAbEd25519YaoProductRegistrationRequestScopedRuntimeV1, createRouterAbEd25519YaoProductRegistrationRuntimeV1, createRouterAbEd25519YaoProductRegistrationStateV1, createRouterAbEd25519YaoRegistrationModule, createRouterAbNormalSigningAdmissionAdapter, createRouterApiModule, createSelfHostedCloudflareSigningRouter, createSelfHostedCloudflareSigningWorker, createSignerD1DoStorageTarget, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, createStaticWalletConsoleBindingV1, createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1, createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, createWalletConsoleOpsClient, createWalletConsoleRelayProxyExtensionV1, createWalletControlClientBindings, createWalletRuntimeOpsHandler, decodeWalletConsoleTenantRootActiveLineageRequestV1, decodeWalletConsoleTenantRootActiveLineageResponseV1, defineRoute, encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1, encodeRouterAbEd25519YaoProductRegistrationStateV1, extractBearerCredential, extractRouterApiEnvironmentId, getRouterApiRouteExtensionRoutes, handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1, handleStaticWalletConsoleRequestV1, handleWalletControlRequest, matchesRouteDefinitionRequest, mergeRouterAbEd25519YaoProductRegistrationStatePartitionV1, parseRouterAbEd25519YaoCeremonyKeyV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoProductRegistrationStateJsonV1, parseRouterAbPublicKeysetV2, parseStaticWalletConsoleBindingConfigV1, parseWalletRuntimeExecuteSignedDelegateRequest, parseWalletRuntimeExecuteSignedDelegateResponse, parseWalletRuntimeExecuteSignedDelegateResult, parseWalletRuntimeRelayerAccount, parseWalletRuntimeWalletIdentitiesResult, parseWalletRuntimeWalletIdentityRequest, partitionRouterAbEd25519YaoProductRegistrationStateV1, randomTenantRootCreationGrantBytesV1, readEnvironmentCsv, readEnvironmentString, requireEnvironmentString, resolveRouterAbEd25519YaoCeremonyKeyFromRequestV1, resolveRuntimeTenantRootLineage, resolveSourceIpFromExpressRequest, resolveSourceIpFromFetchHeaders, runRouterAbEd25519YaoProductRegistrationRequestScopedV1, runRouterAbEd25519YaoRegistrationSideEffectV1, runRouterAbEd25519YaoRegistrationTwoPhaseV1, runRouterAbPrewarmScheduledV1, signTenantRootCreationGrantV1, tenantRootIdentityDigestB64uV1, validateRuntimeSnapshotExpectation, walletConsoleApiWalletGetRouteDefinitionV1, walletConsoleApiWalletListRouteDefinitionV1, walletConsoleApiWalletSearchRouteDefinitionV1, walletConsoleRelayRouteDefinitionsV1, walletConsoleSignedDelegateRouteDefinitionV1, walletConsoleSponsoredEvmCallRouteDefinitionV1 };