@seams/wallet-server 0.7.3 → 0.8.0

package/dist/esm/hosted-wallet-gateway.js

@@ -58,13 +58,6 @@ const RELAY_SIGNER_READY_TABLES = Object.freeze([
 	"router_ab_normal_signing_admission_records",
 	"registration_ceremony_records",
 	"registration_ceremony_cas_guard",
-	"lane_enrollments",
-	"lane_protocol_operations",
-	"lane_product_epochs",
-	"lane_receipts",
-	"lane_effect_journal",
-	"lane_locks",
-	"lane_cas_guard",
 	"linked_device_sessions",
 	"linked_device_session_cas_guard",
 	"linked_device_session_transcripts",
@@ -204,6 +197,18 @@ async function createStagingRouterApiAuthComposition(env, scope, yaoRuntime, ten
 	return {
 		service: createCloudflareD1RouterApiAuthService({
 			database: env.SIGNER_DB,
+			identityStore: dependencies.identityStore,
+			emailOtpRateLimitCounter: dependencies.emailOtpRateLimitCounter,
+			googleRegistrationAttempts: dependencies.googleRegistrationAttempts,
+			sessionRouting: dependencies.sessionRouting,
+			recoveryRouting: dependencies.recoveryRouting,
+			lifecycleRouting: dependencies.lifecycleRouting,
+			registrationAuthority: dependencies.registrationAuthority,
+			credentialClaims: dependencies.credentialClaims,
+			syncChallenges: dependencies.syncChallenges,
+			linkedDeviceProofNonces: dependencies.linkedDeviceProofNonces,
+			linkedDeviceBootstrap: dependencies.linkedDeviceBootstrap,
+			registrationSetupDispatcher: dependencies.registrationSetupDispatcher,
 			namespace: scope.namespace,
 			orgId: scope.orgId,
 			projectId: scope.projectId,
@@ -217,7 +222,6 @@ async function createStagingRouterApiAuthComposition(env, scope, yaoRuntime, ten
 			implicitNearAccountTestFundingEnabled: readEnvironmentString(env, "ENABLE_IMPLICIT_NEAR_ACCOUNT_TEST_FUNDING"),
 			googleOidcClientId: readEnvironmentString(env, "GOOGLE_OIDC_CLIENT_ID"),
 			githubOAuth: stagingGithubOAuthConfig(env),
-			accountIdDerivationSecret: requireEnvironmentString(env, "ACCOUNT_ID_DERIVATION_SECRET"),
 			emailOtpServerSeal: stagingEmailOtpServerSealConfig(env),
 			emailOtpDeliveryMode: readEnvironmentString(env, "EMAIL_OTP_DELIVERY_MODE"),
 			emailOtpRuntimeProfile: readEnvironmentString(env, "EMAIL_OTP_RUNTIME_PROFILE"),
@@ -392,36 +396,45 @@ async function createSplitGatewayRouterHandler(env, dependencies = {}) {
 async function handleSplitGatewayWalletRuntimeRequest(request, env, dependencies = {}) {
 	const controlResponse = await handleWalletControlRequest(request, env);
 	if (controlResponse) return controlResponse;
-	return await createWalletRuntimeOpsHandler(async () => {
-		const scope = stagingTenantScope(env);
-		const tenantRootCustodyLineage = createStagingTenantRootCustodyLineage(createWalletConsoleOpsClient(env.WALLET_CONSOLE));
-		const { service } = await createStagingRouterApiAuthComposition(env, scope, createStagingYaoRequestScopedRuntime(env, createStagingRegistrationTenantRootResolver(scope, tenantRootCustodyLineage)), tenantRootCustodyLineage, dependencies);
-		return {
-			executeSignedDelegate: service.executeSignedDelegate.bind(service),
-			getRelayerAccount: service.router.getRelayerAccount.bind(service.router),
-			getWalletIdentities: (input) => readWalletRuntimeIdentities(env, input)
-		};
-	})(request);
+	return await createWalletRuntimeOpsHandler(async () => ({
+		async executeSignedDelegate(input) {
+			return await (await resolveWalletExecutionService(env, dependencies)).executeSignedDelegate(input);
+		},
+		async getRelayerAccount() {
+			return (await resolveWalletExecutionService(env, dependencies)).router.getRelayerAccount();
+		},
+		getWalletIdentities: readWalletRuntimeIdentities.bind(void 0, env)
+	}))(request);
+}
+async function resolveWalletExecutionService(env, dependencies) {
+	const scope = stagingTenantScope(env);
+	const tenantRootCustodyLineage = createStagingTenantRootCustodyLineage(createWalletConsoleOpsClient(env.WALLET_CONSOLE));
+	const { service } = await createStagingRouterApiAuthComposition(env, scope, createStagingYaoRequestScopedRuntime(env, createStagingRegistrationTenantRootResolver(scope, tenantRootCustodyLineage)), tenantRootCustodyLineage, dependencies);
+	return service;
 }
 function isJsonRecord(value) {
 	return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
 async function readWalletRuntimeIdentities(env, input) {
-	const placeholders = input.wallets.map(() => "?").join(", ");
-	const rows = await env.SIGNER_DB.prepare(`SELECT project_id, wallet_id, signer_family, record_json
+	const selectors = input.wallets.map(() => "(project_id = ? AND env_id = ? AND wallet_id = ?)");
+	const rows = await env.SIGNER_DB.prepare(`SELECT project_id, env_id, wallet_id, signer_family, record_json
        FROM wallet_signers
-      WHERE namespace = ?
-        AND org_id = ?
-        AND wallet_id IN (${placeholders})`).bind(requireEnvironmentString(env, "SEAMS_TENANT_STORAGE_NAMESPACE"), input.orgId, ...input.wallets.map((wallet) => wallet.walletId)).all();
-	const requestedWallets = new Map(input.wallets.map((wallet) => [wallet.walletId, wallet]));
+      WHERE namespace = ? AND org_id = ?
+        AND (${selectors.join(" OR ")})`).bind(requireEnvironmentString(env, "SEAMS_TENANT_STORAGE_NAMESPACE"), input.orgId, ...input.wallets.flatMap((wallet) => [
+		wallet.projectId,
+		wallet.envId,
+		wallet.walletId
+	])).all();
 	const identities = /* @__PURE__ */ new Map();
 	for (const row of rows.results || []) {
-		const walletId = String(row.wallet_id || "").trim();
-		const requested = requestedWallets.get(walletId);
-		if (!requested || requested.projectId !== String(row.project_id || "").trim()) continue;
+		const key = JSON.stringify([
+			row.project_id,
+			row.env_id,
+			row.wallet_id
+		]);
 		const record = parseD1JsonColumn(row.record_json);
 		if (!isJsonRecord(record)) continue;
-		const current = identities.get(walletId) || {
+		const current = identities.get(key) || {
 			nearAccountId: "",
 			evmAddress: null
 		};
@@ -430,13 +443,24 @@ async function readWalletRuntimeIdentities(env, input) {
 			const address = String(record.walletKey.thresholdOwnerAddress || "").trim().toLowerCase();
 			if (/^0x[0-9a-f]{40}$/.test(address)) current.evmAddress = address;
 		}
-		identities.set(walletId, current);
+		identities.set(key, current);
+	}
+	const result = [];
+	for (const wallet of input.wallets) {
+		const identity = identities.get(JSON.stringify([
+			wallet.projectId,
+			wallet.envId,
+			wallet.walletId
+		]));
+		if (identity?.nearAccountId && identity.evmAddress) result.push({
+			walletId: wallet.walletId,
+			projectId: wallet.projectId,
+			envId: wallet.envId,
+			nearAccountId: identity.nearAccountId,
+			evmAddress: identity.evmAddress
+		});
 	}
-	return { identities: Array.from(identities.entries()).flatMap(([walletId, identity]) => identity.nearAccountId && identity.evmAddress ? [{
-		walletId,
-		nearAccountId: identity.nearAccountId,
-		evmAddress: identity.evmAddress
-	}] : []) };
+	return { identities: result };
 }
 async function handleSplitGatewayRequest(request, env, ctx, dependencies = {}) {
 	if (request.method === "GET" && new URL(request.url).pathname === ROUTER_AB_CEREMONY_JWKS_PATH) return routerAbCeremonyJwksResponse(env);
@@ -512,14 +536,11 @@ function createStagingEcdsaPresignRuntime(env) {
 	const presignAuthSecret = requireEnvironmentString(env, "ROUTER_AB_GATEWAY_TO_SIGNING_WORKER_PRESIGN_AUTH_SECRET");
 	if (presignAuthSecret === requireEnvironmentString(env, "ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET") || presignAuthSecret === requireEnvironmentString(env, "ROUTER_AB_GATEWAY_TO_ROUTER_AUTH_SECRET")) throw new Error("Gateway-to-SigningWorker presign auth secret must be role-specific");
 	return new RouterAbEcdsaPresignRuntime({
-		config: {
-			nodeRole: "coordinator",
-			participantIds: {
-				clientParticipantId: 1,
-				relayerParticipantId: 2,
-				participantIds2p: [1, 2]
-			}
-		},
+		config: { participantIds: {
+			clientParticipantId: 1,
+			relayerParticipantId: 2,
+			participantIds2p: [1, 2]
+		} },
 		signingWorkerTransport: {
 			kind: "configured",
 			signingWorkerBaseUrl: ROUTER_AB_SIGNING_WORKER_ORIGIN,
@@ -614,6 +635,7 @@ async function handlePartitionedD1Operation(env, request, operation, tenantRootC
 		case "recovery_activate":
 		case "recovery_status": return await handleRouterAbEd25519YaoRecoveryRequestScopedCloudflareV1({
 			request,
+			lifecycleRouting: dependencies.lifecycleRouting,
 			...createStagingRecoveryRequestScopedDependencies(env, tenantRootCustodyLineage, dependencies)
 		});
 		case "export_admission":
@@ -622,6 +644,7 @@ async function handlePartitionedD1Operation(env, request, operation, tenantRootC
 			const { service } = await createStagingRouterApiAuthComposition(env, scope, createStagingYaoRequestScopedRuntime(env, createStagingRegistrationTenantRootResolver(scope, tenantRootCustodyLineage)), tenantRootCustodyLineage, dependencies);
 			return await handleRouterAbEd25519YaoExportRequestScopedCloudflareV1({
 				request,
+				lifecycleRouting: dependencies.lifecycleRouting,
 				...createStagingExportRequestScopedDependencies(env, service, tenantRootCustodyLineage)
 			});
 		}
@@ -719,6 +742,6 @@ function stagingWalletStore(env) {
 	});
 }
 //#endregion
-export { createHostedWalletGatewayCompositionV1, createSplitGatewayRouterHandler, createStagingEd25519YaoBackend, createStagingExportRequestScopedDependencies, createStagingRecoveryRequestScopedDependencies, handleSplitGatewayRequest, handleSplitGatewayWalletRuntimeRequest, readStagingHostedWalletOrigins, stagingSigningSessionSealOptions };
+export { createHostedWalletGatewayCompositionV1, createSplitGatewayRouterHandler, createStagingEd25519YaoBackend, createStagingExportRequestScopedDependencies, createStagingRecoveryRequestScopedDependencies, handleSplitGatewayRequest, handleSplitGatewayWalletRuntimeRequest, readStagingHostedWalletOrigins, readWalletRuntimeIdentities, stagingSigningSessionSealOptions };
 
 //# sourceMappingURL=hosted-wallet-gateway.js.map

package/dist/esm/index.js

@@ -5,11 +5,10 @@ import { authorizeSigningSessionSealRequest, buildSigningSessionSealApplyPath, b
 import { LocalWorkerVaultProxyGateway, VaultProxyUseService, buildVaultProxyUseOperation, createVaultProxyUseRouteExtension, parseVaultProxyDestination } from "./authorization/vaultProxyUse.js";
 import { SessionService, buildCorsOrigins, parseCsvList } from "./core/SessionService.js";
 import { computeEip1559TxHash, encodeEip1559SignedTxFromSignature65, ensureEvmCryptoWasm, secp256k1PrivateKey32ToPublicKey33, secp256k1PublicKey33ToEthereumAddress, signSecp256k1Recoverable } from "./core/ThresholdService/evmCryptoWasm.js";
-import { THRESHOLD_DO_OBJECT_NAME_DEFAULT, THRESHOLD_NODE_ROLE_COORDINATOR, THRESHOLD_NODE_ROLE_DEFAULT, THRESHOLD_PREFIX_DEFAULT } from "./core/defaultConfigsServer.js";
-import { formatSigningSessionSealKeyVersionForWire, parseSigningSessionSealKeyVersion } from "./shared-ts/src/threshold/keyMaterialBrands.js";
-import { buildWalletEd25519SignerId, createWalletStore, resolveWalletStoreNamespace } from "./core/WalletStore.js";
+import { buildWalletEd25519SignerId } from "./core/WalletStore.js";
 import { D1WalletStore, WALLET_STORE_D1_SCHEMA_SQL, buildWalletEcdsaSignerRecord, ensureWalletStoreD1Schema } from "./core/d1WalletStore.js";
 import { D1WalletAuthMethodStore, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, ensureWalletAuthMethodStoreD1Schema, normalizeWalletAuthMethod } from "./core/d1WalletAuthMethodStore.js";
+import { formatSigningSessionSealKeyVersionForWire, parseSigningSessionSealKeyVersion } from "./shared-ts/src/threshold/keyMaterialBrands.js";
 import { RouterAbEcdsaPresignRuntime } from "./core/routerAbSigning/RouterAbEcdsaPresignRuntime.js";
 import { registrationPreparationIdFromString } from "./core/types.js";
 import { InMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createRouterAbNormalSigningAdmissionAdapter } from "./router/domains/signingOperations/routerAbNormalSigningAdmissionCore.js";
@@ -18,7 +17,6 @@ import { normalizeRorHost, sanitizeRorOrigins } from "./router/framework/ror/nor
 import { resolveRorRpId, validateRouterApiRorOptions } from "./router/framework/ror/provider.js";
 import { handleSigningSessionSealRoutes } from "./threshold/session/signingSessionSeal/transport/fetch.js";
 import { createRouterApiModule } from "./router/framework/modules.js";
-import { D1WebAuthnCredentialBindingStore, WEBAUTHN_CREDENTIAL_BINDING_STORE_D1_SCHEMA_SQL, createWebAuthnCredentialBindingStore, ensureWebAuthnCredentialBindingStoreD1Schema, resolveWebAuthnCredentialBindingStoreNamespace } from "./core/WebAuthnCredentialBindingStore.js";
 import { StaticCloudflareTenantStorageRouteResolver, createCloudflareTenantStorageRoute, createSignerD1DoStorageTarget, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, tenantStorageRouteBackendFamily, tenantStorageRouteDiagnostic } from "./storage/tenantRoute.js";
 import { OrdinaryInactiveSignerMaterialReservationServiceV1, createOrdinaryInactiveSignerMaterialReservationServiceV1, parseOrdinaryEcdsaSignerMaterialDeactivationResultV1, parseOrdinaryEcdsaSignerMaterialWorkerReservationV1, parseOrdinaryEd25519SignerMaterialDeactivationResultV1, parseOrdinaryEd25519SignerMaterialWorkerReservationV1, validateOrdinaryInactiveSignerMaterialDeactivationRequestV1, validateOrdinaryInactiveSignerMaterialReservationRequestV1 } from "./core/signingMaterial/ordinaryInactiveSignerMaterialReservation.js";
 import { createPassthroughSigningSessionSealCipherAdapter, createSigningSessionSealCipherAdapter, createSigningSessionSealShamir3PassCipherAdapter, encodeSigningSessionSealServerLockContext } from "./threshold/session/signingSessionSeal/crypto/cipher.js";
@@ -28,26 +26,15 @@ import { createSigningSessionSealService } from "./threshold/session/signingSess
 import { createSigningSessionSealRoutesOptions } from "./threshold/session/signingSessionSeal/routesOptions.js";
 import { createSigningSessionSealOptions, parseSigningSessionSealRootConfig } from "./threshold/session/signingSessionSeal/options.js";
 import { D1IdentityStore, IDENTITY_STORE_D1_SCHEMA_SQL, ensureIdentityStoreD1Schema } from "./core/d1IdentityStore.js";
-import { D1NearPublicKeyStore, NEAR_PUBLIC_KEY_STORE_D1_SCHEMA_SQL, createNearPublicKeyStore, ensureNearPublicKeyStoreD1Schema } from "./core/NearPublicKeyStore.js";
-import { AUTH_SERVICE_CONFIG_DEFAULTS, createAuthServiceConfig, parseBool, requireEnvVar, validateConfigs } from "./core/config.js";
-import { createEcdsaWalletSessionStore, createEd25519WalletSessionStore } from "./core/ThresholdService/stores/WalletSessionStore.js";
-import { createRouterAbSigningRuntimes } from "./core/routerAbSigning/createRouterAbSigningRuntimes.js";
+import "./core/IdentityStore.js";
+import "./core/WalletAuthMethodStore.js";
+import { parseBool, requireEnvVar } from "./core/config.js";
 import { createInMemorySigningSessionSealIdempotencyStore } from "./threshold/session/signingSessionSeal/idempotency.js";
 import { createRedisTcpSigningSessionSealRateLimiter, createUpstashSigningSessionSealRateLimiter, resolveSigningSessionSealRateLimitFromEnv } from "./threshold/session/signingSessionSeal/guards/backends.js";
 import { createRedisTcpSigningSessionSealIdempotencyStore, createUpstashSigningSessionSealIdempotencyStore, resolveSigningSessionSealIdempotencyFromEnv } from "./threshold/session/signingSessionSeal/idempotencyBackends.js";
 import { registerSigningSessionSealRoutes } from "./threshold/session/signingSessionSeal/transport/express.js";
 import "./threshold/session/signingSessionSeal/index.js";
-import { createIdentityStore, resolveIdentityStoreNamespace } from "./core/IdentityStore.js";
-import { createWalletAuthMethodStore, resolveWalletAuthMethodStoreNamespace } from "./core/WalletAuthMethodStore.js";
-import { D1WebAuthnAuthenticatorStore, WEBAUTHN_AUTHENTICATOR_STORE_D1_SCHEMA_SQL, createWebAuthnAuthenticatorStore, ensureWebAuthnAuthenticatorStoreD1Schema, resolveWebAuthnAuthenticatorStoreNamespace } from "./core/WebAuthnAuthenticatorStore.js";
-import { D1WebAuthnLoginChallengeStore, WEBAUTHN_LOGIN_CHALLENGE_STORE_D1_SCHEMA_SQL, createWebAuthnLoginChallengeStore, ensureWebAuthnLoginChallengeStoreD1Schema } from "./core/WebAuthnLoginChallengeStore.js";
-import { D1WebAuthnSyncChallengeStore, WEBAUTHN_SYNC_CHALLENGE_STORE_D1_SCHEMA_SQL, createWebAuthnSyncChallengeStore, ensureWebAuthnSyncChallengeStoreD1Schema } from "./core/WebAuthnSyncChallengeStore.js";
-import { AuthService } from "./core/authService/AuthService.js";
-import "./core/AuthService.js";
-import { createThresholdEd25519KeyStore } from "./core/ThresholdService/stores/KeyStore.js";
-import { createThresholdEd25519SessionStore } from "./core/ThresholdService/stores/SessionStore.js";
-import "./core/ThresholdService/index.js";
 import { StaticRorOriginsProvider } from "./router/framework/ror/staticProvider.js";
 import { createRorOptions } from "./router/framework/ror/options.js";
 import "./router/framework/ror/index.js";
-export { AUTHORIZED_OPERATION_REPLAY_BODY_MAX_BYTES, AUTH_SERVICE_CONFIG_DEFAULTS, AuthService, AuthorizationService, CloudflareD1RouterAbNormalSigningAdmissionStore, D1IdentityStore, D1NearPublicKeyStore, D1WalletAuthMethodStore, D1WalletStore, D1WebAuthnAuthenticatorStore, D1WebAuthnCredentialBindingStore, D1WebAuthnLoginChallengeStore, D1WebAuthnSyncChallengeStore, IDENTITY_STORE_D1_SCHEMA_SQL, InMemoryRouterAbNormalSigningAdmissionStore, LocalWorkerVaultProxyGateway, NEAR_PUBLIC_KEY_STORE_D1_SCHEMA_SQL, OrdinaryInactiveSignerMaterialReservationServiceV1, RouterAbEcdsaPresignRuntime, SessionService, StaticCloudflareTenantStorageRouteResolver, StaticRorOriginsProvider, THRESHOLD_DO_OBJECT_NAME_DEFAULT, THRESHOLD_NODE_ROLE_COORDINATOR, THRESHOLD_NODE_ROLE_DEFAULT, THRESHOLD_PREFIX_DEFAULT, VaultProxyUseService, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, WALLET_STORE_D1_SCHEMA_SQL, WEBAUTHN_AUTHENTICATOR_STORE_D1_SCHEMA_SQL, WEBAUTHN_CREDENTIAL_BINDING_STORE_D1_SCHEMA_SQL, WEBAUTHN_LOGIN_CHALLENGE_STORE_D1_SCHEMA_SQL, WEBAUTHN_SYNC_CHALLENGE_STORE_D1_SCHEMA_SQL, authorizeSigningSessionSealRequest, authorizedOperationReplayBodyInit, buildActiveWalletSessionQuota, buildAuthorizedOperation, buildCorsOrigins, buildExactWalletSessionQuotaProjectionV1, buildPersistedActiveWalletSessionAuthorizationV2, buildSigningSessionSealApplyPath, buildSigningSessionSealRemovePath, buildVaultProxyUseOperation, buildWalletEcdsaSignerRecord, buildWalletEd25519SignerId, buildWalletSessionAuthorizationV2, buildWalletSessionCapabilitySubjectsV1, composeSigningSessionSealGuards, computeAuthorizedOperationResultDigest, computeEip1559TxHash, createAuthServiceConfig, createCloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareTenantStorageRoute, createEcdsaWalletSessionStore, createEd25519WalletSessionStore, createIdentityStore, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createInMemorySigningSessionSealIdempotencyStore, createInMemorySigningSessionSealRateLimiter, createNearPublicKeyStore, createOrdinaryInactiveSignerMaterialReservationServiceV1, createPassthroughSigningSessionSealCipherAdapter, createRedisTcpSigningSessionSealIdempotencyStore, createRedisTcpSigningSessionSealRateLimiter, createRorOptions, createRouterAbNormalSigningAdmissionAdapter, createRouterAbSigningRuntimes, createRouterApiModule, createSignerD1DoStorageTarget, createSigningSessionSealAuditLogger, createSigningSessionSealCipherAdapter, createSigningSessionSealOptions, createSigningSessionSealRateLimitGuard, createSigningSessionSealRoutesOptions, createSigningSessionSealService, createSigningSessionSealShamir3PassCipherAdapter, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, createThresholdEd25519KeyStore, createThresholdEd25519SessionStore, createUpstashSigningSessionSealIdempotencyStore, createUpstashSigningSessionSealRateLimiter, createVaultProxyUseRouteExtension, createWalletAuthMethodStore, createWalletStore, createWebAuthnAuthenticatorStore, createWebAuthnCredentialBindingStore, createWebAuthnLoginChallengeStore, createWebAuthnSyncChallengeStore, digestOpaqueValue, encodeEip1559SignedTxFromSignature65, encodeSigningSessionSealServerLockContext, ensureEvmCryptoWasm, ensureIdentityStoreD1Schema, ensureNearPublicKeyStoreD1Schema, ensureWalletAuthMethodStoreD1Schema, ensureWalletStoreD1Schema, ensureWebAuthnAuthenticatorStoreD1Schema, ensureWebAuthnCredentialBindingStoreD1Schema, ensureWebAuthnLoginChallengeStoreD1Schema, ensureWebAuthnSyncChallengeStoreD1Schema, exactWalletSessionCapabilitySubjectsResolveAuthority, formatSigningSessionSealKeyVersionForWire, handleSigningSessionSealRoutes, normalizeRorHost, normalizeWalletAuthMethod, parseAuthorizedOperationReplayResponse, parseBool, parseCsvList, parseHostedWalletSeamsSessionExchangeCode, parseHostedWalletSeamsSessionExchangeNonce, parseHostedWalletSessionCredentialId, parseHostedWalletSessionOperationCredentialToken, parseHostedWalletSessionOperationCredentialV1, parseMpcWalletSigningQuotaId, parseOrdinaryEcdsaSignerMaterialDeactivationResultV1, parseOrdinaryEcdsaSignerMaterialWorkerReservationV1, parseOrdinaryEd25519SignerMaterialDeactivationResultV1, parseOrdinaryEd25519SignerMaterialWorkerReservationV1, parsePrimaryWalletSessionOperationCredentialToken, parseSessionOrigin, parseSigningSessionSealApplyBody, parseSigningSessionSealKeyVersion, parseSigningSessionSealRemoveBody, parseSigningSessionSealRootConfig, parseVaultProxyDestination, parseVerifiedOwnerProofId, parseWalletSessionAuthorizationV2, parseWalletSessionId, projectActiveWalletSession, projectExactWalletSessionAuthorizationV1, registerSigningSessionSealRoutes, registrationPreparationIdFromString, requireEnvVar, resolveIdentityStoreNamespace, resolveRorRpId, resolveSigningSessionSealBasePath, resolveSigningSessionSealIdempotencyFromEnv, resolveSigningSessionSealRateLimitFromEnv, resolveWalletAuthMethodStoreNamespace, resolveWalletStoreNamespace, resolveWebAuthnAuthenticatorStoreNamespace, resolveWebAuthnCredentialBindingStoreNamespace, sanitizeRorOrigins, secp256k1PrivateKey32ToPublicKey33, secp256k1PublicKey33ToEthereumAddress, signSecp256k1Recoverable, signingSessionSealAuthorizeStatusCode, signingSessionSealStatusCode, tenantStorageRouteBackendFamily, tenantStorageRouteDiagnostic, validateConfigs, validateOrdinaryInactiveSignerMaterialDeactivationRequestV1, validateOrdinaryInactiveSignerMaterialReservationRequestV1, validateRouterApiRorOptions, walletSessionAuthorizationV2RecordsEqual, walletSessionCapabilitySubjectsV1Equal };
+export { AUTHORIZED_OPERATION_REPLAY_BODY_MAX_BYTES, AuthorizationService, CloudflareD1RouterAbNormalSigningAdmissionStore, D1IdentityStore, D1WalletAuthMethodStore, D1WalletStore, IDENTITY_STORE_D1_SCHEMA_SQL, InMemoryRouterAbNormalSigningAdmissionStore, LocalWorkerVaultProxyGateway, OrdinaryInactiveSignerMaterialReservationServiceV1, RouterAbEcdsaPresignRuntime, SessionService, StaticCloudflareTenantStorageRouteResolver, StaticRorOriginsProvider, VaultProxyUseService, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, WALLET_STORE_D1_SCHEMA_SQL, authorizeSigningSessionSealRequest, authorizedOperationReplayBodyInit, buildActiveWalletSessionQuota, buildAuthorizedOperation, buildCorsOrigins, buildExactWalletSessionQuotaProjectionV1, buildPersistedActiveWalletSessionAuthorizationV2, buildSigningSessionSealApplyPath, buildSigningSessionSealRemovePath, buildVaultProxyUseOperation, buildWalletEcdsaSignerRecord, buildWalletEd25519SignerId, buildWalletSessionAuthorizationV2, buildWalletSessionCapabilitySubjectsV1, composeSigningSessionSealGuards, computeAuthorizedOperationResultDigest, computeEip1559TxHash, createCloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareTenantStorageRoute, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createInMemorySigningSessionSealIdempotencyStore, createInMemorySigningSessionSealRateLimiter, createOrdinaryInactiveSignerMaterialReservationServiceV1, createPassthroughSigningSessionSealCipherAdapter, createRedisTcpSigningSessionSealIdempotencyStore, createRedisTcpSigningSessionSealRateLimiter, createRorOptions, createRouterAbNormalSigningAdmissionAdapter, createRouterApiModule, createSignerD1DoStorageTarget, createSigningSessionSealAuditLogger, createSigningSessionSealCipherAdapter, createSigningSessionSealOptions, createSigningSessionSealRateLimitGuard, createSigningSessionSealRoutesOptions, createSigningSessionSealService, createSigningSessionSealShamir3PassCipherAdapter, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, createUpstashSigningSessionSealIdempotencyStore, createUpstashSigningSessionSealRateLimiter, createVaultProxyUseRouteExtension, digestOpaqueValue, encodeEip1559SignedTxFromSignature65, encodeSigningSessionSealServerLockContext, ensureEvmCryptoWasm, ensureIdentityStoreD1Schema, ensureWalletAuthMethodStoreD1Schema, ensureWalletStoreD1Schema, exactWalletSessionCapabilitySubjectsResolveAuthority, formatSigningSessionSealKeyVersionForWire, handleSigningSessionSealRoutes, normalizeRorHost, normalizeWalletAuthMethod, parseAuthorizedOperationReplayResponse, parseBool, parseCsvList, parseHostedWalletSeamsSessionExchangeCode, parseHostedWalletSeamsSessionExchangeNonce, parseHostedWalletSessionCredentialId, parseHostedWalletSessionOperationCredentialToken, parseHostedWalletSessionOperationCredentialV1, parseMpcWalletSigningQuotaId, parseOrdinaryEcdsaSignerMaterialDeactivationResultV1, parseOrdinaryEcdsaSignerMaterialWorkerReservationV1, parseOrdinaryEd25519SignerMaterialDeactivationResultV1, parseOrdinaryEd25519SignerMaterialWorkerReservationV1, parsePrimaryWalletSessionOperationCredentialToken, parseSessionOrigin, parseSigningSessionSealApplyBody, parseSigningSessionSealKeyVersion, parseSigningSessionSealRemoveBody, parseSigningSessionSealRootConfig, parseVaultProxyDestination, parseVerifiedOwnerProofId, parseWalletSessionAuthorizationV2, parseWalletSessionId, projectActiveWalletSession, projectExactWalletSessionAuthorizationV1, registerSigningSessionSealRoutes, registrationPreparationIdFromString, requireEnvVar, resolveRorRpId, resolveSigningSessionSealBasePath, resolveSigningSessionSealIdempotencyFromEnv, resolveSigningSessionSealRateLimitFromEnv, sanitizeRorOrigins, secp256k1PrivateKey32ToPublicKey33, secp256k1PublicKey33ToEthereumAddress, signSecp256k1Recoverable, signingSessionSealAuthorizeStatusCode, signingSessionSealStatusCode, tenantStorageRouteBackendFamily, tenantStorageRouteDiagnostic, validateOrdinaryInactiveSignerMaterialDeactivationRequestV1, validateOrdinaryInactiveSignerMaterialReservationRequestV1, validateRouterApiRorOptions, walletSessionAuthorizationV2RecordsEqual, walletSessionCapabilitySubjectsV1Equal };

package/dist/esm/localHostedWalletGatewayHandler.js

@@ -1,7 +1,9 @@
+import { requireCanonicalString } from "./shared-ts/src/utils/validation.js";
 import "./shared-ts/src/utils/routerAbEd25519Yao.js";
 import { WALLET_CONSOLE_OP_PATHS_V1 } from "./router/cloudflare/runtime/walletConsoleOps.js";
 import { createStaticWalletConsoleBindingV1, parseStaticWalletConsoleBindingConfigV1 } from "./router/cloudflare/runtime/staticWalletConsoleBinding.js";
 import { handleSplitGatewayRequest } from "./hosted-wallet-gateway.js";
+import { LocalRegistrationSetupAuthority } from "./localRegistrationSetupAuthority.js";
 import { localPresignCancellationProbe } from "./localIntendedPresignCancellation.js";
 import { LOCAL_INTENDED_YAO_FAULT_HEADER_V1, LOCAL_INTENDED_YAO_FAULT_TOKEN_HEADER_V1, LocalIntendedYaoFaultControllerV1, parseLocalIntendedYaoFaultModeV1, parseLocalIntendedYaoFaultTokenV1, requestWithoutLocalIntendedYaoFaultHeadersV1, responseWithLocalIntendedYaoFaultOutcomeV1 } from "./localIntendedYaoFault.js";
 import { localMaterialAdmissionFault } from "./localIntendedMaterialAdmissionFault.js";
@@ -102,6 +104,16 @@ async function handleEcdsaRespondFault(request, env, ctx, dependencies, fault, e
 */
 async function handleLocalHostedWalletGatewayRequestV1(request, env, ctx, dependencies) {
 	const config = parseStaticWalletConsoleBindingConfigV1(JSON.parse(env.WALLET_LOCAL_DEPLOYMENT_JSON));
+	dependencies = {
+		emailOtpDeliveryProvider: dependencies?.emailOtpDeliveryProvider,
+		signerWasm: dependencies?.signerWasm,
+		registrationAuthority: new LocalRegistrationSetupAuthority(env.SIGNER_DB, {
+			namespace: requireCanonicalString(env.SEAMS_TENANT_STORAGE_NAMESPACE, "Local namespace"),
+			orgId: config.deployment.orgId,
+			projectId: config.deployment.projectId,
+			envId: config.deployment.environmentKey
+		})
+	};
 	const gatewayEnv = {
 		...env,
 		WALLET_CONSOLE: createStaticWalletConsoleBindingV1(config)

package/dist/esm/localRegistrationSetupAuthority.js

@@ -0,0 +1,89 @@
+import { D1RegistrationCeremonyRecordStore } from "./router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore.js";
+import { parseWalletRegistrationSetupReservation, proposeWalletRegistrationSetup, walletRegistrationSetupRequestDigest } from "./router/domains/walletRegistration/walletRegistrationReservation.js";
+//#region src/localRegistrationSetupAuthority.ts
+var LocalRegistrationSetupAuthority = class {
+	constructor(database, scope) {
+		this.scope = scope;
+		this.storage = new D1RegistrationCeremonyRecordStore({
+			database,
+			scope,
+			keyPrefix: "local-registration-authority:"
+		});
+	}
+	async reserve(input) {
+		const scope = input.runtimePolicyScope;
+		if (!scope || input.orgId !== this.scope.orgId || scope.orgId !== this.scope.orgId || scope.projectId !== this.scope.projectId || scope.envId !== this.scope.envId) return {
+			ok: false,
+			code: "scope_conflict",
+			message: "Registration scope differs from the local authority"
+		};
+		const requestDigest = await walletRegistrationSetupRequestDigest(this.scope.namespace, input);
+		const stored = await this.storage.insertOrRead({
+			scope: "setup-reservation",
+			id: input.request.registrationOperationId,
+			value: {
+				requestDigest,
+				reservation: proposeWalletRegistrationSetup(input)
+			},
+			expiresAtMs: Number.MAX_SAFE_INTEGER
+		});
+		if (stored.value.requestDigest !== requestDigest) return {
+			ok: false,
+			code: "request_conflict",
+			message: "Registration operation was already used for another request"
+		};
+		const reservation = parseWalletRegistrationSetupReservation(stored.value.reservation);
+		await this.storage.putExact({
+			scope: "setup-ceremony-index",
+			id: reservation.ceremonyId,
+			value: { walletId: reservation.walletId },
+			expiresAtMs: Number.MAX_SAFE_INTEGER
+		});
+		const terminal = await this.storage.get("setup-terminal", reservation.ceremonyId);
+		if (terminal?.value.outcome === "cancelled") return {
+			ok: false,
+			code: "registration_cancelled",
+			message: "Registration was cancelled"
+		};
+		return {
+			ok: true,
+			reservation,
+			lifecycle: terminal?.value.outcome === "established" ? "established" : "reserved"
+		};
+	}
+	async admitHome(input) {
+		const identity = await this.storage.get("setup-ceremony-index", input.ceremonyId);
+		const terminal = await this.storage.get("setup-terminal", input.ceremonyId);
+		if (!identity || identity.value.walletId !== input.walletId || terminal?.value.outcome === "cancelled") return {
+			ok: false,
+			code: "wallet_home_unavailable",
+			message: "Registration home is unavailable"
+		};
+		return { ok: true };
+	}
+	async complete(input) {
+		const identity = await this.storage.get("setup-ceremony-index", input.ceremonyId);
+		if (!identity || identity.value.walletId !== input.walletId) return {
+			ok: false,
+			code: "home_conflict",
+			message: "Registration completion does not match its reservation"
+		};
+		return (await this.storage.insertOrRead({
+			scope: "setup-terminal",
+			id: input.ceremonyId,
+			value: {
+				walletId: input.walletId,
+				outcome: input.outcome
+			},
+			expiresAtMs: Number.MAX_SAFE_INTEGER
+		})).value.outcome === input.outcome ? { ok: true } : {
+			ok: false,
+			code: "registration_conflict",
+			message: "Registration terminal outcome conflicts with its reservation"
+		};
+	}
+};
+//#endregion
+export { LocalRegistrationSetupAuthority };
+
+//# sourceMappingURL=localRegistrationSetupAuthority.js.map

package/dist/esm/router/auth/authRequestValidation.js

@@ -76,23 +76,15 @@ function parseOptionalPositiveInteger(raw, fieldName) {
 		value: Math.floor(value)
 	};
 }
-function parseAuthProviderAction(input) {
-	const provider = normalizeOptionalTrimmedString(input.provider);
-	const action = normalizeOptionalTrimmedString(input.action);
-	if (provider === "passkey" && action === "options") return { kind: "passkey_options" };
-	if (provider === "passkey" && action === "verify") return { kind: "passkey_verify" };
-	if (provider === "google" && action === "options") return { kind: "google_options" };
-	if (provider === "google" && action === "verify") return { kind: "google_verify" };
-	if (provider === "github" && action === "options") return { kind: "github_options" };
-	return null;
-}
 function parseAuthProviderActionPath(pathname) {
-	const parts = String(pathname || "").split("/").filter(Boolean);
-	if (parts.length !== 3 || parts[0] !== "auth") return null;
-	return parseAuthProviderAction({
-		provider: parts[1],
-		action: parts[2]
-	});
+	switch (pathname) {
+		case "/auth/passkey/options": return { kind: "passkey_options" };
+		case "/auth/passkey/verify": return { kind: "passkey_verify" };
+		case "/auth/google/options": return { kind: "google_options" };
+		case "/auth/google/verify": return { kind: "google_verify" };
+		case "/auth/github/options": return { kind: "github_options" };
+		default: return null;
+	}
 }
 function parsePasskeyLoginOptionsRequest(raw) {
 	const body = requireJsonObject(raw);

package/dist/esm/router/auth/webAuthnCredentialCodecs.js

@@ -1,7 +1,6 @@
 import { base64Decode, base64UrlDecode, base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
 import "../../shared-ts/src/utils/encoders.js";
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import "../../shared-ts/src/utils/validation.js";
 import { failure } from "../../shared-ts/src/utils/failure.js";
 import { errorMessage } from "../../shared-ts/src/utils/errors.js";
 //#region src/router/auth/webAuthnCredentialCodecs.ts

package/dist/esm/router/cloudflare/d1/auth/d1AuthorizationAssembly.js

@@ -0,0 +1,87 @@
+import { capabilityPolicyPort } from "../../../../authorization/capabilityPolicy.js";
+import { AuthorizationService } from "../../../../authorization/service.js";
+import { CloudflareD1WebAuthnStore } from "../webauthn/d1WebAuthnStore.js";
+import { CloudflareD1WebAuthnAuthService } from "../webauthn/d1WebAuthnAuthService.js";
+import { CloudflareD1AuthorizationStore } from "../authorization/d1AuthorizationStore.js";
+import { CloudflareD1EmailOtpRateLimitStore } from "../emailOtp/d1EmailOtpRateLimitStore.js";
+import { CloudflareD1GoogleEmailOtpRegistrationAttemptStore } from "../emailOtp/d1GoogleEmailOtpRegistrationAttemptStore.js";
+import { D1IdentityStore } from "../../../../core/d1IdentityStore.js";
+import { CloudflareD1WalletCustodyCommitStore } from "../passkeyCustody/d1WalletCustodyCommitStore.js";
+//#region src/router/cloudflare/d1/auth/d1AuthorizationAssembly.ts
+function createD1AuthorizationAssembly(options, sessionRouting) {
+	const authorizationStore = new CloudflareD1AuthorizationStore(options);
+	return {
+		authorizationStore,
+		authorizationService: new AuthorizationService({
+			policy: capabilityPolicyPort,
+			sessions: authorizationStore,
+			evidence: authorizationStore,
+			grants: authorizationStore,
+			authorizedOperations: authorizationStore,
+			audit: authorizationStore,
+			sessionRouting
+		})
+	};
+}
+function createD1WalletCustodyStore(options) {
+	return new CloudflareD1WalletCustodyCommitStore({
+		credentialClaims: options.credentialClaims,
+		database: options.database,
+		scope: {
+			namespace: options.namespace,
+			orgId: options.orgId,
+			projectId: options.projectId,
+			envId: options.envId
+		},
+		recoveryRouting: options.recoveryRouting
+	});
+}
+function createD1WebAuthnAssembly(options, walletAuthMethodStore, walletManifestSource) {
+	const webAuthnStore = new CloudflareD1WebAuthnStore({
+		syncChallenges: options.syncChallenges,
+		credentialClaims: options.credentialClaims,
+		database: options.database,
+		namespace: options.namespace,
+		orgId: options.orgId,
+		projectId: options.projectId,
+		envId: options.envId
+	});
+	return {
+		webAuthnStore,
+		webAuthnAuthService: new CloudflareD1WebAuthnAuthService({
+			webAuthnStore,
+			walletAuthMethodStore,
+			walletManifestSource,
+			lifecycleRouting: options.lifecycleRouting
+		})
+	};
+}
+function createD1IdentityStore(options) {
+	if (options.identityStore) return options.identityStore;
+	return new D1IdentityStore({
+		database: options.database,
+		namespace: options.namespace,
+		orgId: options.orgId,
+		projectId: options.projectId,
+		envId: options.envId,
+		ensureSchema: false
+	});
+}
+function createD1GoogleRegistrationAttempts(options, prepare) {
+	return options.googleRegistrationAttempts ?? new CloudflareD1GoogleEmailOtpRegistrationAttemptStore({
+		prepare,
+		batch: options.database.batch.bind(options.database),
+		orgId: options.orgId
+	});
+}
+function createD1EmailOtpRateLimits(options, prepare) {
+	return new CloudflareD1EmailOtpRateLimitStore({
+		prepare,
+		rateLimits: options.emailOtp.rateLimits,
+		counter: options.emailOtpRateLimitCounter
+	});
+}
+//#endregion
+export { createD1AuthorizationAssembly, createD1EmailOtpRateLimits, createD1GoogleRegistrationAttempts, createD1IdentityStore, createD1WalletCustodyStore, createD1WebAuthnAssembly };
+
+//# sourceMappingURL=d1AuthorizationAssembly.js.map

package/dist/esm/router/cloudflare/d1/auth/d1RouterApiAuthConfig.js

@@ -1,6 +1,5 @@
 import { parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { normalizeCorsOrigin } from "../../../../core/SessionService.js";
 import "../../../../core/authService/emailOtpConfig.js";
 import { parseSigningSessionSealRootConfig } from "../../../../threshold/session/signingSessionSeal/options.js";
@@ -50,6 +49,18 @@ function normalizeD1RouterApiAuthOptions(input) {
 	if (input.githubOAuth && !githubOAuth) throw new Error("githubOAuth requires clientId, clientSecret, and callbackUrl");
 	return {
 		database: input.database,
+		identityStore: input.identityStore,
+		emailOtpRateLimitCounter: input.emailOtpRateLimitCounter,
+		credentialClaims: input.credentialClaims,
+		syncChallenges: input.syncChallenges,
+		linkedDeviceProofNonces: input.linkedDeviceProofNonces,
+		linkedDeviceBootstrap: input.linkedDeviceBootstrap,
+		googleRegistrationAttempts: input.googleRegistrationAttempts,
+		sessionRouting: input.sessionRouting,
+		recoveryRouting: input.recoveryRouting,
+		lifecycleRouting: input.lifecycleRouting,
+		registrationAuthority: input.registrationAuthority,
+		registrationSetupDispatcher: input.registrationSetupDispatcher,
 		namespace: requireD1RouterApiAuthScopeString(input.namespace, "namespace"),
 		orgId: requireD1RouterApiAuthScopeString(input.orgId, "orgId"),
 		projectId: requireD1RouterApiAuthScopeString(input.projectId, "projectId"),
@@ -63,7 +74,6 @@ function normalizeD1RouterApiAuthOptions(input) {
 		implicitNearAccountTestFundingEnabled: parseBooleanFlag(input.implicitNearAccountTestFundingEnabled, false, "implicitNearAccountTestFundingEnabled"),
 		googleOidcClientId: normalizeOptionalTrimmedString(input.googleOidcClientId),
 		githubOAuth,
-		accountIdDerivationSecret: normalizeOptionalTrimmedString(input.accountIdDerivationSecret),
 		emailOtp: normalizeEmailOtpConfig(input),
 		emailOtpServerSeal: normalizeEmailOtpServerSealConfig(input),
 		routerAbEcdsaPresignRuntime: input.routerAbEcdsaPresignRuntime,