@seams/wallet-server 0.7.3 → 0.8.0

package/dist/esm/router/cloudflare/d1/auth/d1RouterApiAuthService.js

@@ -1,11 +1,7 @@
 import { parseWalletAuthMethodId, parseWalletAuthorityId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseDeviceId, parsePrincipalId, parseTenantId, parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
-import { capabilityPolicyPort } from "../../../../authorization/capabilityPolicy.js";
-import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
-import { alphabetizeStringify, sha256BytesUtf8, sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
-import "../../../../shared-ts/src/utils/encoders.js";
+import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseRouterAbEcdsaRegistrationActivationReceiptV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { AuthorizationService } from "../../../../authorization/service.js";
 import { D1WalletStore } from "../../../../core/d1WalletStore.js";
 import { D1WalletAuthMethodStore } from "../../../../core/d1WalletAuthMethodStore.js";
 import { normalizeLogger } from "../../../../core/logger.js";
@@ -16,39 +12,38 @@ import { resolveActiveOwnerWalletExecutionLane, resolveWalletAuthMethodIdForAuth
 import { DEFAULT_WALLET_SESSION_TTL_MS } from "../../../../shared-ts/src/threshold/sessionPolicy.js";
 import { createDeviceLinkingOwnerRequestAuthenticatorV1 } from "../../../transport/fetch/routes/deviceLinkingOwnerAuthorization.js";
 import { sha256BytesPortable, toRecordValue } from "./d1RouterApiAuthBoundary.js";
-import { CloudflareD1WebAuthnStore } from "../webauthn/d1WebAuthnStore.js";
 import { verifyD1LinkedDeviceFreshRevokeProofV1 } from "../wallet/d1WalletAuthMethodBoundary.js";
-import { CloudflareD1WebAuthnAuthService } from "../webauthn/d1WebAuthnAuthService.js";
 import { D1LinkedDeviceAuthorityInstallServiceV1 } from "../deviceLinking/d1LinkedDeviceAuthorityInstallService.js";
 import { D1WalletAuthorityStore } from "../wallet/d1WalletAuthorityStore.js";
-import { CloudflareD1AuthorizationStore } from "../authorization/d1AuthorizationStore.js";
 import { createCloudflareD1VersionedJsonRecordStore } from "../versionedJson/d1VersionedJsonRecordStore.js";
-import { parseRouterAbEd25519YaoRegistrationSideEffectRecordV2, runRouterAbEd25519YaoRegistrationSideEffectV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
+import { parseRouterAbEd25519YaoRegistrationSideEffectRecordV2 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
 import { createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1 } from "../../signingLanes/cloudflareOrdinaryInactiveSignerMaterialReservation.js";
 import { normalizeD1RouterApiAuthOptions } from "./d1RouterApiAuthConfig.js";
+import { toPublicKeyStringFromSecretKey } from "../../../../core/nearKeys.js";
+import { MinimalNearClient } from "../../../../core/rpcClients/near/NearClient.js";
+import { fundImplicitNearAccountWithRelayer } from "../../../../core/nearRelayerAccountProvisioning.js";
+import { createSponsoredNamedNearAccountForOptions } from "../near/d1SponsoredNearAccount.js";
+import { parseD1EcdsaDerivationServerBootstrapResponse, parseD1WalletRegistrationCommittedInstallationProjection, parseD1WalletRegistrationFinalizeReplayResponse } from "../registration/d1RegistrationCeremonyRecords.js";
+import { parseD1WalletAddSignerFinalizeSideEffectRecord } from "../wallet/d1WalletAddSignerFinalizeRecord.js";
+import { dispatchWalletRegistrationSetup } from "../../../framework/registrationSetupDispatch.js";
 import { readActiveWalletSessionCredential, readExhaustedWalletSessionCredential, readWalletSessionSigningCandidate } from "./walletSessionCredentialReaders.js";
 import { createD1AuthorizedOperationRouteService } from "./d1AuthorizedOperationRouteService.js";
 import { parseRegistrationEstablishedSessionProjectionV2 } from "../../../../shared-ts/src/utils/registrationEstablishedSession.js";
-import { D1IdentityStore } from "../../../../core/d1IdentityStore.js";
-import { toPublicKeyStringFromSecretKey } from "../../../../core/nearKeys.js";
-import { MinimalNearClient } from "../../../../core/rpcClients/near/NearClient.js";
 import { signGasRelayerNearTransactionWithDeps } from "../../../../core/authService/nearTransactions.js";
 import { ensureSignerWasmRuntime } from "../../../../core/authService/wasm.js";
-import { parseD1EcdsaDerivationServerBootstrapResponse, parseD1WalletRegistrationCommittedInstallationProjection, parseD1WalletRegistrationFinalizeReplayResponse } from "../registration/d1RegistrationCeremonyRecords.js";
+import { CloudflareD1PasskeyCustodyEnvelopeStore } from "../passkeyCustody/d1PasskeyCustodyEnvelopeStore.js";
+import { createD1AuthorizationAssembly, createD1EmailOtpRateLimits, createD1GoogleRegistrationAttempts, createD1IdentityStore, createD1WalletCustodyStore, createD1WebAuthnAssembly } from "./d1AuthorizationAssembly.js";
 import { CloudflareD1RegistrationCeremonyIntentStore } from "../registration/d1RegistrationCeremonyStore.js";
-import { CloudflareD1NearPublicKeyStore } from "../near/d1NearPublicKeyStore.js";
 import { CloudflareD1EmailOtpChallengeStore } from "../emailOtp/d1EmailOtpChallengeStore.js";
 import { CloudflareD1EmailOtpDeliveryRuntime } from "../emailOtp/d1EmailOtpDeliveryRuntime.js";
 import { CloudflareD1EmailOtpEnrollmentStore } from "../emailOtp/d1EmailOtpEnrollmentStore.js";
 import { CloudflareD1EmailOtpGrantStore } from "../emailOtp/d1EmailOtpGrantStore.js";
-import { CloudflareD1EmailOtpRateLimitStore } from "../emailOtp/d1EmailOtpRateLimitStore.js";
 import { CloudflareD1EmailOtpServerSealRuntime } from "../emailOtp/d1EmailOtpServerSealRuntime.js";
 import { CloudflareD1EmailOtpRegistrationEnrollmentFinalizer } from "../emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer.js";
 import { CloudflareD1EmailOtpChallengeVerifier } from "../emailOtp/d1EmailOtpChallengeVerifier.js";
 import { CloudflareD1EmailOtpChallengeIssuer } from "../emailOtp/d1EmailOtpChallengeIssuer.js";
 import { CloudflareD1EmailOtpChallengeService } from "../emailOtp/d1EmailOtpChallengeService.js";
 import { CloudflareD1EmailOtpRecoveryService } from "../emailOtp/d1EmailOtpRecoveryService.js";
-import { CloudflareD1GoogleEmailOtpRegistrationAttemptStore } from "../emailOtp/d1GoogleEmailOtpRegistrationAttemptStore.js";
 import { CloudflareD1GoogleEmailOtpSessionResolver } from "../emailOtp/d1GoogleEmailOtpSessionResolver.js";
 import { CloudflareD1IdentityService } from "../identity/d1IdentityService.js";
 import { CloudflareD1OidcVerificationService } from "../oidc/d1OidcVerificationService.js";
@@ -58,14 +53,11 @@ import { parseWalletRegistrationSessionCommitReceiptV2 } from "../registration/w
 import { CloudflareD1WalletRegistrationService } from "../registration/d1WalletRegistrationService.js";
 import { CloudflareD1WalletRegistrationCommitStore } from "../registration/d1WalletRegistrationCommitStore.js";
 import { CloudflareD1Ed25519YaoLifecycleDecisionStoreV1 } from "../ed25519Yao/d1Ed25519YaoLifecycleDecisionStore.js";
-import { CloudflareD1PasskeyCustodyEnvelopeStore } from "../passkeyCustody/d1PasskeyCustodyEnvelopeStore.js";
-import { CloudflareD1WalletCustodyCommitStore } from "../passkeyCustody/d1WalletCustodyCommitStore.js";
 import { createD1PasskeyCustodyRouteService } from "../passkeyCustody/d1PasskeyCustodyRouteService.js";
 import { CloudflareD1WalletRecoveryGoogleEmailOtpAttemptStore } from "../passkeyCustody/d1WalletRecoveryGoogleEmailOtpAttemptStore.js";
 import { CloudflareD1WalletRecoveryGoogleEmailOtpService } from "../passkeyCustody/d1WalletRecoveryGoogleEmailOtpService.js";
-import { CloudflareD1WalletAddSignerService, parseD1WalletAddSignerFinalizeSideEffectRecord, parseD1WalletAddSignerStartSideEffectRecord } from "../wallet/d1WalletAddSignerService.js";
+import { CloudflareD1WalletAddSignerService, parseD1WalletAddSignerStartSideEffectRecord } from "../wallet/d1WalletAddSignerService.js";
 import { CloudflareD1RegistrationIntentService } from "../registration/d1RegistrationIntentService.js";
-import { broadcastPreparedSponsoredNearAccountCreation, fundImplicitNearAccountWithRelayer, prepareSponsoredNearAccountCreationWithRelayer, preparedSponsoredNearAccountCreationArtifactFingerprint } from "../../../../core/nearRelayerAccountProvisioning.js";
 import { createD1LinkedDeviceSessionServiceV1 } from "../deviceLinking/d1LinkedDeviceSessionService.js";
 import { D1LinkedDeviceSessionStoreV1 } from "../deviceLinking/d1LinkedDeviceSessionStore.js";
 import { createD1LinkedDeviceRouteServiceV1 } from "../deviceLinking/d1LinkedDeviceRouteService.js";
@@ -199,6 +191,7 @@ function createD1LinkedDeviceComposition(input) {
 			});
 		}
 		const sessionStore = new D1LinkedDeviceSessionStoreV1({
+			bootstrap: input.options.linkedDeviceBootstrap,
 			database: input.options.database,
 			scope,
 			now: nowV1
@@ -228,6 +221,7 @@ function createD1LinkedDeviceComposition(input) {
 		});
 		const verifiedLinkBuilder = { source: verifiedLinkSourceReader };
 		const authorityInstall = new D1LinkedDeviceAuthorityInstallServiceV1({
+			credentialClaims: input.options.credentialClaims,
 			database: input.options.database,
 			scope,
 			authorityStore,
@@ -259,6 +253,8 @@ function createD1LinkedDeviceComposition(input) {
 			acknowledgeLocalAuthorityActivationV1: authorityInstall.acknowledgeLocalAuthorityActivationV1.bind(authorityInstall)
 		};
 		deviceLinking = createD1LinkedDeviceRouteServiceV1({
+			bootstrap: input.options.linkedDeviceBootstrap,
+			proofNonces: input.options.linkedDeviceProofNonces,
 			database: input.options.database,
 			scope,
 			ownerAuthorization: ownerAuthorizationProvider.ownerAuthorization,
@@ -433,48 +429,6 @@ async function fundImplicitNearAccountForOptions(options, input) {
 		fundedAmountYocto
 	});
 }
-/**
-* Validates a persisted claim before it is trusted to skip a broadcast or to be
-* replayed. An invalid record makes the D1 read fail, which leaves the effect
-* uncertain and prevents any network action on unvalidated bytes.
-*/
-function parseSponsoredNearAccountSideEffectRecord(raw) {
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
-	if (Reflect.get(raw, "operation") !== "finalize") return null;
-	const requestFingerprint = parseSideEffectFingerprint(Reflect.get(raw, "requestFingerprint"));
-	const preparedArtifactFingerprint = parseSideEffectFingerprint(Reflect.get(raw, "preparedArtifactFingerprint"));
-	if (requestFingerprint === null || preparedArtifactFingerprint === null) return null;
-	const claimedAtMs = Reflect.get(raw, "claimedAtMs");
-	if (!isNonNegativeSafeInteger(claimedAtMs)) return null;
-	const prepared = parsePreparedSponsoredNearAccountCreation(Reflect.get(raw, "prepared"));
-	if (prepared === null) return null;
-	const kind = Reflect.get(raw, "kind");
-	if (kind === "router_ab_ed25519_yao_registration_side_effect_claim_v1") return {
-		kind: "router_ab_ed25519_yao_registration_side_effect_claim_v1",
-		operation: "finalize",
-		requestFingerprint,
-		preparedArtifactFingerprint,
-		claimedAtMs,
-		prepared
-	};
-	if (kind === "router_ab_ed25519_yao_registration_side_effect_completion_v1") {
-		const completedAtMs = Reflect.get(raw, "completedAtMs");
-		if (!isNonNegativeSafeInteger(completedAtMs)) return null;
-		const response = parseAccountCreationResult(Reflect.get(raw, "response"));
-		if (response === null) return null;
-		return {
-			kind: "router_ab_ed25519_yao_registration_side_effect_completion_v1",
-			operation: "finalize",
-			requestFingerprint,
-			preparedArtifactFingerprint,
-			claimedAtMs,
-			completedAtMs,
-			prepared,
-			response
-		};
-	}
-	return null;
-}
 function parseWalletRegistrationOperationPrepared(raw) {
 	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
 	if (Reflect.get(raw, "kind") !== "d1_wallet_registration_operation_prepared_v1") return null;
@@ -667,86 +621,9 @@ function registrationReceiptMatchesJournal(record) {
 	if (receipt.committed.kind === "near_pending") return true;
 	return "foundingAuthority" in receipt && receipt.foundingAuthority.authorityId === record.prepared.walletAuthorityId;
 }
-function parsePreparedSponsoredNearAccountCreation(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	if (Reflect.get(value, "kind") !== "prepared_sponsored_near_account_creation_v1") return null;
-	const accountId = parseNonEmptyString(Reflect.get(value, "accountId"));
-	const publicKey = parseNonEmptyString(Reflect.get(value, "publicKey"));
-	const relayerAccountId = parseNonEmptyString(Reflect.get(value, "relayerAccountId"));
-	const relayerPublicKey = parseNonEmptyString(Reflect.get(value, "relayerPublicKey"));
-	const initialBalanceYocto = parseNonEmptyString(Reflect.get(value, "initialBalanceYocto"));
-	const transactionHash = parseNonEmptyString(Reflect.get(value, "transactionHash"));
-	const nextNonce = parseNonEmptyString(Reflect.get(value, "nextNonce"));
-	const blockHash = parseNonEmptyString(Reflect.get(value, "blockHash"));
-	const signedTransactionBorshB64u = parseBoundedBase64Url(Reflect.get(value, "signedTransactionBorshB64u"));
-	if (accountId === null || publicKey === null || relayerAccountId === null || relayerPublicKey === null || initialBalanceYocto === null || transactionHash === null || nextNonce === null || blockHash === null || signedTransactionBorshB64u === null) return null;
-	return {
-		kind: "prepared_sponsored_near_account_creation_v1",
-		accountId,
-		publicKey,
-		relayerAccountId,
-		relayerPublicKey,
-		initialBalanceYocto,
-		transactionHash,
-		nextNonce,
-		blockHash,
-		signedTransactionBorshB64u
-	};
-}
-function parseAccountCreationResult(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	const success = Reflect.get(value, "success");
-	if (typeof success !== "boolean") return null;
-	const accountId = parseOptionalString(Reflect.get(value, "accountId"));
-	const transactionHash = parseOptionalString(Reflect.get(value, "transactionHash"));
-	const error = parseOptionalString(Reflect.get(value, "error"));
-	const message = parseOptionalString(Reflect.get(value, "message"));
-	if ("accountId" in value && accountId === null || "transactionHash" in value && transactionHash === null || "error" in value && error === null || "message" in value && message === null) return null;
-	if (success && (accountId === void 0 || transactionHash === void 0)) return null;
-	const normalizedAccountId = accountId ?? void 0;
-	const normalizedTransactionHash = transactionHash ?? void 0;
-	const normalizedError = error ?? void 0;
-	const normalizedMessage = message ?? void 0;
-	return {
-		success,
-		...normalizedAccountId === void 0 ? {} : { accountId: normalizedAccountId },
-		...normalizedTransactionHash === void 0 ? {} : { transactionHash: normalizedTransactionHash },
-		...normalizedError === void 0 ? {} : { error: normalizedError },
-		...normalizedMessage === void 0 ? {} : { message: normalizedMessage }
-	};
-}
-function parseNonEmptyString(value) {
-	return typeof value === "string" && value.trim() ? value : null;
-}
-function parseSideEffectFingerprint(value) {
-	return typeof value === "string" && /^[a-zA-Z0-9:_-]{32,192}$/u.test(value) ? value : null;
-}
-function parseBoundedBase64Url(value) {
-	return typeof value === "string" && value.length > 0 && value.length <= 8192 && /^[\w-]+$/u.test(value) ? value : null;
-}
-function parseOptionalString(value) {
-	return value === void 0 ? void 0 : parseNonEmptyString(value);
-}
-function isNonNegativeSafeInteger(value) {
-	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
-}
 function resolveEd25519YaoProductRegistration(options) {
 	return options.ed25519YaoProductRegistration || null;
 }
-function sponsoredNearAccountSideEffectStore(options) {
-	return createCloudflareD1VersionedJsonRecordStore({
-		database: options.database,
-		scope: {
-			namespace: options.namespace,
-			orgId: options.orgId,
-			projectId: options.projectId,
-			envId: options.envId
-		},
-		keyPrefix: "router-ab-yao-sponsored-account:",
-		encode: (value) => value,
-		parse: parseSponsoredNearAccountSideEffectRecord
-	});
-}
 function walletRegistrationActivateSideEffectStore(options) {
 	return createCloudflareD1VersionedJsonRecordStore({
 		database: options.database,
@@ -803,87 +680,6 @@ function walletAddSignerFinalizeSideEffectStore(options) {
 		parse: parseD1WalletAddSignerFinalizeSideEffectRecord
 	});
 }
-/**
-* Creates the sponsored account through a durable claim. The signed transaction
-* and its hash are persisted before the broadcast, so a lost response replays
-* those exact bytes instead of building a second transaction under a fresh
-* nonce. Rebroadcasting an identical signed transaction reuses its hash, so the
-* network treats the retry as the same transaction.
-*/
-async function createSponsoredNamedNearAccountForOptions(options, input) {
-	const relayerAccount = options.relayerAccount;
-	const relayerPrivateKey = options.relayerPrivateKey;
-	const nearRpcUrl = options.nearRpcUrl;
-	const initialBalanceYocto = options.accountInitialBalance;
-	if (!relayerAccount || !relayerPrivateKey || !nearRpcUrl || !initialBalanceYocto) return {
-		kind: "rejected",
-		message: "Sponsored NEAR account creation is not configured on this server"
-	};
-	const relayerInput = {
-		accountId: input.accountId,
-		publicKey: input.publicKey,
-		relayerAccount,
-		relayerPrivateKey,
-		relayerPublicKey: options.relayerPublicKey,
-		nearRpcUrl,
-		initialBalanceYocto
-	};
-	const requestFingerprint = base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
-		kind: "sponsored_near_account_creation_v1",
-		accountId: input.accountId,
-		publicKey: input.publicKey,
-		relayerAccountId: relayerAccount,
-		initialBalanceYocto
-	})));
-	const outcome = await runRouterAbEd25519YaoRegistrationSideEffectV1(sponsoredNearAccountSideEffectStore(options), {
-		kind: "prepared_resumable",
-		resumeAfterMs: 3e4,
-		operation: "finalize",
-		key: `sponsored-account:${input.idempotencyKey}`,
-		requestFingerprint,
-		nowMs: () => Date.now(),
-		prepare: async () => {
-			const prepared = await prepareSponsoredNearAccountCreationWithRelayer(relayerInput);
-			if (!prepared.ok) throw new Error(prepared.message);
-			return prepared.prepared;
-		},
-		derivePreparedArtifactFingerprint: preparedSponsoredNearAccountCreationArtifactFingerprint,
-		execute: async (prepared, attempt) => {
-			if (!prepared) throw new Error("Sponsored NEAR account transaction was not prepared");
-			const broadcast = await broadcastPreparedSponsoredNearAccountCreation({
-				prepared,
-				nearRpcUrl,
-				relayerAccountId: relayerAccount,
-				reconcileFirst: attempt === "resumed"
-			});
-			if (broadcast.kind === "uncertain") throw new Error(broadcast.message);
-			return broadcast.result;
-		}
-	});
-	switch (outcome.kind) {
-		case "executed":
-		case "exact_replay":
-			if (outcome.value.success && outcome.value.accountId && outcome.value.transactionHash) return {
-				kind: "created",
-				accountId: outcome.value.accountId,
-				transactionHash: outcome.value.transactionHash
-			};
-			return {
-				kind: "rejected",
-				message: outcome.value.message || outcome.value.error || "Sponsored NEAR account creation was rejected"
-			};
-		case "in_progress":
-		case "uncertain": return {
-			kind: "retryable",
-			message: outcome.kind === "uncertain" ? outcome.message : "Sponsored NEAR account creation is already in progress for this registration",
-			retryAfterMs: 3e4
-		};
-		case "request_conflict": return {
-			kind: "rejected",
-			message: "Sponsored NEAR account creation idempotency key conflicts with another request"
-		};
-	}
-}
 async function readD1Ed25519KeyManifestBySlot(walletStore, input) {
 	const signer = await walletStore.getEd25519SignerBySlot(input);
 	return signer ? { custodyKeyManifestDigestB64u: signer.custodyKeyManifestDigestB64u } : null;
@@ -898,18 +694,11 @@ function createCloudflareD1RouterApiAuthAssembly(input) {
 	const walletAuthMethodStore = getWalletAuthMethodStore();
 	const walletStore = getWalletStore();
 	const createSponsoredNamedNearAccount = createSponsoredNamedNearAccountForOptions.bind(void 0, options);
-	const identityStore = new D1IdentityStore({
-		database: options.database,
-		namespace: options.namespace,
-		orgId: options.orgId,
-		projectId: options.projectId,
-		envId: options.envId,
-		ensureSchema: false
-	});
+	const identityStore = createD1IdentityStore(options);
 	const linkIdentity = linkD1Identity.bind(void 0, identityStore);
 	const linkedDeviceEd25519AuthorityReaderSlot = { current: null };
 	const getLinkedDeviceEd25519AuthorityReader = linkedDeviceEd25519AuthorityReaderFromSlot.bind(void 0, linkedDeviceEd25519AuthorityReaderSlot);
-	const authorizationStore = new CloudflareD1AuthorizationStore({
+	const { authorizationStore, authorizationService } = createD1AuthorizationAssembly({
 		database: options.database,
 		namespace: options.namespace,
 		walletSignerScope: {
@@ -919,32 +708,9 @@ function createCloudflareD1RouterApiAuthAssembly(input) {
 			envId: options.envId
 		},
 		getLinkedDeviceAuthorityReader: getLinkedDeviceEd25519AuthorityReader
-	});
-	const authorizationService = new AuthorizationService({
-		policy: capabilityPolicyPort,
-		sessions: authorizationStore,
-		evidence: authorizationStore,
-		grants: authorizationStore,
-		authorizedOperations: authorizationStore,
-		audit: authorizationStore
-	});
-	const googleEmailOtpRegistrationAttempts = new CloudflareD1GoogleEmailOtpRegistrationAttemptStore({
-		prepare,
-		orgId: options.orgId
-	});
-	const nearPublicKeys = new CloudflareD1NearPublicKeyStore({ prepare });
-	const webAuthnStore = new CloudflareD1WebAuthnStore({
-		database: options.database,
-		namespace: options.namespace,
-		orgId: options.orgId,
-		projectId: options.projectId,
-		envId: options.envId
-	});
-	const webAuthnAuthService = new CloudflareD1WebAuthnAuthService({
-		webAuthnStore,
-		walletAuthMethodStore,
-		walletManifestSource: { getEd25519KeyManifestBySlot: readD1Ed25519KeyManifestBySlot.bind(void 0, walletStore) }
-	});
+	}, options.sessionRouting);
+	const googleEmailOtpRegistrationAttempts = createD1GoogleRegistrationAttempts(options, prepare);
+	const { webAuthnStore, webAuthnAuthService } = createD1WebAuthnAssembly(options, walletAuthMethodStore, { getEd25519KeyManifestBySlot: readD1Ed25519KeyManifestBySlot.bind(void 0, walletStore) });
 	const emailOtpChallenges = new CloudflareD1EmailOtpChallengeStore({
 		database: options.database,
 		namespace: options.namespace,
@@ -955,10 +721,7 @@ function createCloudflareD1RouterApiAuthAssembly(input) {
 	const emailOtpDelivery = new CloudflareD1EmailOtpDeliveryRuntime(options.emailOtp);
 	const emailOtpEnrollments = new CloudflareD1EmailOtpEnrollmentStore({ prepare });
 	const emailOtpGrants = new CloudflareD1EmailOtpGrantStore({ prepare });
-	const emailOtpRateLimits = new CloudflareD1EmailOtpRateLimitStore({
-		prepare,
-		rateLimits: options.emailOtp.rateLimits
-	});
+	const emailOtpRateLimits = createD1EmailOtpRateLimits(options, prepare);
 	const emailOtpServerSeal = new CloudflareD1EmailOtpServerSealRuntime(options.emailOtpServerSeal);
 	const googleEmailOtpSessions = new CloudflareD1GoogleEmailOtpSessionResolver({
 		emailOtpEnrollments,
@@ -968,12 +731,7 @@ function createCloudflareD1RouterApiAuthAssembly(input) {
 		production: options.emailOtp.production,
 		registrationAttempts: googleEmailOtpRegistrationAttempts
 	});
-	const identityService = new CloudflareD1IdentityService({
-		accountIdDerivationSecret: options.accountIdDerivationSecret,
-		identityStore,
-		relayerAccount: options.relayerAccount,
-		resolveGoogleEmailOtpSession: googleEmailOtpSessions.resolve.bind(googleEmailOtpSessions)
-	});
+	const identityService = new CloudflareD1IdentityService({ identityStore });
 	const oidcVerification = new CloudflareD1OidcVerificationService({
 		googleOidcClientId: options.googleOidcClientId,
 		githubOAuth: options.githubOAuth,
@@ -1061,23 +819,17 @@ function createCloudflareD1RouterApiAuthAssembly(input) {
 		envId: options.envId
 	});
 	const walletRegistrationCommitStore = new CloudflareD1WalletRegistrationCommitStore({
+		credentialClaims: options.credentialClaims,
 		database: options.database,
 		namespace: options.namespace,
 		orgId: options.orgId,
 		projectId: options.projectId,
 		envId: options.envId
 	});
-	const walletCustodyCommitStore = new CloudflareD1WalletCustodyCommitStore({
-		database: options.database,
-		scope: {
-			namespace: options.namespace,
-			orgId: options.orgId,
-			projectId: options.projectId,
-			envId: options.envId
-		}
-	});
+	const walletCustodyCommitStore = createD1WalletCustodyStore(options);
 	const signedDelegateExecutor = new CloudflareD1SignedDelegateExecutor(options);
 	const walletRegistrations = new CloudflareD1WalletRegistrationService({
+		registrationAuthority: options.registrationAuthority ?? null,
 		authorizationService,
 		authorizationTenantId: authorizationTenantId.value,
 		createSponsoredNamedNearAccount,
@@ -1168,6 +920,7 @@ function createCloudflareD1RouterApiAuthAssembly(input) {
 		authorizationService,
 		authorizationStore,
 		walletRegistration: createD1WalletRegistrationRouteService({
+			options,
 			emailOtpRecoveryService,
 			registrationIntents,
 			walletAuthMethodStore,
@@ -1198,7 +951,6 @@ function createCloudflareD1RouterApiAuthAssembly(input) {
 		authorizationService,
 		authorizationStore,
 		googleEmailOtpSessions,
-		nearPublicKeys,
 		webAuthnAuthService,
 		walletAuthMethods,
 		walletRegistrations,
@@ -1267,7 +1019,10 @@ function createD1WalletRegistrationRouteService(assembly) {
 		resolveActiveEcdsaTenantRoot: assembly.walletRegistrations.resolveActiveEcdsaTenantRoot.bind(assembly.walletRegistrations),
 		listWalletEcdsaKeyFactsInventory: assembly.walletRegistrations.listWalletEcdsaKeyFactsInventory.bind(assembly.walletRegistrations),
 		readActiveEmailOtpEnrollment: assembly.emailOtpRecoveryService.readActiveEmailOtpEnrollment.bind(assembly.emailOtpRecoveryService),
-		setupWalletRegistration: assembly.walletRegistrations.setupWalletRegistration.bind(assembly.walletRegistrations),
+		setupWalletRegistration: dispatchWalletRegistrationSetup.bind(void 0, {
+			dispatcher: assembly.options.registrationSetupDispatcher ?? null,
+			local: assembly.walletRegistrations
+		}),
 		respondWalletRegistration: assembly.walletRegistrations.respondWalletRegistration.bind(assembly.walletRegistrations),
 		authorizeWalletRegistrationNearAdmission: assembly.walletRegistrations.authorizeWalletRegistrationNearAdmission.bind(assembly.walletRegistrations),
 		activateWalletRegistration: assembly.walletRegistrations.activateWalletRegistration.bind(assembly.walletRegistrations),
@@ -1485,7 +1240,6 @@ function createD1IdentityRouteService(assembly) {
 		linkIdentity: assembly.identityService.linkIdentity.bind(assembly.identityService),
 		listIdentities: assembly.identityService.listIdentities.bind(assembly.identityService),
 		resolveGoogleEmailOtpSession: assembly.googleEmailOtpSessions.resolve.bind(assembly.googleEmailOtpSessions),
-		resolveOidcWalletId: assembly.identityService.resolveOidcWalletId.bind(assembly.identityService),
 		unlinkIdentity: assembly.identityService.unlinkIdentity.bind(assembly.identityService),
 		verifyGoogleLogin: assembly.oidcVerification.verifyGoogleLogin.bind(assembly.oidcVerification),
 		verifyGithubOAuthCode: assembly.oidcVerification.verifyGithubOAuthCode.bind(assembly.oidcVerification)
@@ -1527,10 +1281,7 @@ function createD1ThresholdRuntimeRouteService(assembly) {
 	return { getRouterAbEcdsaPresignRuntime: () => assembly.options.routerAbEcdsaPresignRuntime || null };
 }
 function createD1NearFundingRouteService(assembly) {
-	return {
-		fundImplicitNearAccount: fundImplicitNearAccountForOptions.bind(void 0, assembly.options),
-		listNearPublicKeysForUser: assembly.nearPublicKeys.listForRelayUser.bind(assembly.nearPublicKeys)
-	};
+	return { fundImplicitNearAccount: fundImplicitNearAccountForOptions.bind(void 0, assembly.options) };
 }
 function createD1RouterAccountRouteService(assembly) {
 	const accountId = assembly.options.relayerAccount || DEFAULT_D1_THRESHOLD_RELAYER_ACCOUNT;

package/dist/esm/router/cloudflare/d1/authorization/authorizedOperationStatements.js

@@ -38,16 +38,25 @@ function ecdsaSignerMatchBindings(walletSignerScope, material) {
 	];
 }
 const PINNED_OWNER_WALLET = `
-  (SELECT session.wallet_id
+  CASE operation.authorization_source_kind
+  WHEN 'verified_step_up' THEN (
+    SELECT evidence.wallet_id
+      FROM verified_wallet_operation_evidence_sets AS evidence
+     WHERE evidence.namespace = operation.namespace
+       AND evidence.tenant_id = operation.tenant_id
+       AND evidence.evidence_set_digest = operation.evidence_set_digest
+     LIMIT 1)
+  WHEN 'authorization_grant' THEN (
+    SELECT session.wallet_id
      FROM wallet_session_authorizations_v2 AS session
     WHERE session.namespace = operation.namespace
       AND session.tenant_id = operation.tenant_id
       AND session.authorization_id = operation.authorization_id
-      AND session.org_id = operation.linked_scope_org_id
-      AND session.project_id = operation.linked_scope_project_id
-      AND session.env_id = operation.linked_scope_env_id
-      AND operation.authorization_source_kind = 'authorization_grant'
-    LIMIT 1) AS pinned_owner_wallet_id`;
+      AND session.org_id = operation.owner_scope_org_id
+      AND session.project_id = operation.owner_scope_project_id
+      AND session.env_id = operation.owner_scope_env_id
+    LIMIT 1)
+  END AS pinned_owner_wallet_id`;
 function prepareAuthorizedOperationCommittedRead(database, namespace, input) {
 	return database.prepare(`SELECT operation.*, ${PINNED_OWNER_WALLET}
        FROM authorized_operations AS operation
@@ -86,9 +95,9 @@ function prepareAuthorizedOperationAdmissionRead(input) {
                    AND auth_method.wallet_id = session.wallet_id
                    AND auth_method.wallet_authority_id = session.authority_id
                  WHERE session.namespace = operation.namespace
-                   AND session.org_id = operation.linked_scope_org_id
-                   AND session.project_id = operation.linked_scope_project_id
-                   AND session.env_id = operation.linked_scope_env_id
+                   AND session.org_id = operation.owner_scope_org_id
+                   AND session.project_id = operation.owner_scope_project_id
+                   AND session.env_id = operation.owner_scope_env_id
                    AND session.org_id = ? AND session.project_id = ? AND session.env_id = ?
                    AND session.tenant_id = operation.tenant_id
                    AND session.authorization_id = operation.authorization_id
@@ -114,7 +123,9 @@ function prepareAuthorizedOperationAdmissionRead(input) {
                    AND evidence.intent_digest = operation.intent_digest
                    AND evidence.display_digest = operation.display_digest
                    AND evidence.assurance = 'step_up'
-                   AND evidence.expires_at_ms > ?
+                   AND evidence.expires_at_ms > MAX(
+                     ?, CAST(round(unixepoch('subsec') * 1000) AS INTEGER)
+                   )
               )
               ELSE 0
             END AS authorization_source_active
@@ -158,13 +169,6 @@ function prepareAuthorizedOperationInsert(input) {
 		material?.materialActivation.key_binding ?? null,
 		material?.materialActivation.lifecycle_binding ?? null,
 		material?.materialActivation.signing_worker ?? null,
-		null,
-		null,
-		null,
-		null,
-		null,
-		null,
-		null,
 		source.kind === "authorization_grant" ? walletSignerScope.orgId : null,
 		source.kind === "authorization_grant" ? walletSignerScope.projectId : null,
 		source.kind === "authorization_grant" ? walletSignerScope.envId : null
@@ -200,13 +204,11 @@ function prepareAuthorizedOperationInsert(input) {
           material_activation_id, material_activation_capability,
           material_activation_owner, material_activation_key_binding,
           material_activation_lifecycle_binding, material_activation_signing_worker,
-          linked_wallet_id, linked_enrollment_id, linked_device_id,
-          linked_wallet_key_id, linked_lane_id, linked_lane_share_epoch,
-          linked_revocation_epoch, linked_scope_org_id, linked_scope_project_id,
-          linked_scope_env_id
+          owner_scope_org_id, owner_scope_project_id,
+          owner_scope_env_id
         ) SELECT ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?,
                   'claimed', 'pending', NULL, NULL, NULL, NULL, ?, NULL, ?,
-                  ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?
+                  ?, ?, ?, ?, ?, ?, ?, ?
            WHERE (${condition.sql}) AND (${absence.sql})`).bind(...values, ...condition.bindings, ...absence.bindings);
 }
 //#endregion

package/dist/esm/router/cloudflare/d1/authorization/d1AuthorizationStore.js

@@ -319,11 +319,12 @@ var CloudflareD1AuthorizationStore = class {
            AND quota.expires_at_ms >= ?
            AND ${ACTIVE_V2_HOSTED_PARENT_PROVENANCE_SQL}`).bind(this.namespace, this.walletSignerScope.orgId, this.walletSignerScope.projectId, this.walletSignerScope.envId, exchange.tenantId, exchange.exchangeCodeId, exchange.authorizationId, exchange.walletSessionId, exchange.quotaId, exchange.principalId, exchange.walletId, exchange.authorityId, exchange.walletAuthMethodId, exchange.codeHash, exchange.nonceDigest, exchange.appOrigin, exchange.walletOrigin, requirePositiveInteger(exchange.issuedAtMs, "exchange.issuedAtMs"), requirePositiveInteger(exchange.expiresAtMs, "exchange.expiresAtMs"), this.namespace, this.walletSignerScope.orgId, this.walletSignerScope.projectId, this.walletSignerScope.envId, exchange.tenantId, exchange.authorizationId, exchange.walletSessionId, exchange.quotaId, exchange.principalId, exchange.walletId, exchange.authorityId, exchange.walletAuthMethodId, exchange.expiresAtMs, exchange.expiresAtMs).run(), "hosted-wallet Seams session exchange code");
 	}
-	async redeemHostedWalletSeamsSessionExchange(input) {
+	async redeemHostedWalletSeamsSessionExchange(input, publishCredentialLocator) {
 		const current = await this.readHostedWalletExchangeV2(input.codeHash);
 		const rejected = classifyHostedWalletExchangeV2(current, input);
 		if (rejected) return rejected;
 		if (!current) throw new Error("hosted-wallet exchange disappeared");
+		await publishCredentialLocator?.();
 		try {
 			const insertCredential = this.database.prepare(`INSERT INTO wallet_session_hosted_credentials_v2 (
             namespace,
@@ -1035,6 +1036,7 @@ var CloudflareD1AuthorizationStore = class {
 			lookupValue: input.tokenHash
 		});
 		if (!row) return null;
+		if (row.session_retired_at_ms !== null && row.session_retired_at_ms !== void 0 || integerColumn(row.session_expires_at_ms, "session.expiresAtMs") <= input.nowMs) return null;
 		const session = parseLiveWalletSessionAuthorizationV2Row(row, {
 			operationCredentialHash: input.tokenHash,
 			tenantId: input.tenantId,
@@ -1354,7 +1356,7 @@ var CloudflareD1AuthorizationStore = class {
 		const row = await prepareAuthorizedOperationCommittedRead(this.database, this.namespace, operation).first();
 		if (!row || row.authorized_operation_id !== operation.authorizedOperationId || row.authorization_source_kind !== operation.authorization.kind) throw new Error("Pinned owner operation is not claimed");
 		if (operation.authorization.kind === "verified_step_up") {
-			if (row.evidence_set_digest !== operation.authorization.evidenceSetDigest) throw new Error("Verified step-up operation is not claimed");
+			if (row.evidence_set_digest !== operation.authorization.evidenceSetDigest || row.pinned_owner_wallet_id !== walletId) throw new Error("Verified step-up operation is not claimed");
 			return {
 				orgId: this.walletSignerScope.orgId,
 				projectId: this.walletSignerScope.projectId,
@@ -1367,9 +1369,9 @@ var CloudflareD1AuthorizationStore = class {
 	pinnedWalletSessionOwnerScope(row, walletId) {
 		if (row.pinned_owner_wallet_id !== walletId) throw new Error("Pinned owner Wallet Session scope is unavailable");
 		return {
-			orgId: requireString(row.linked_scope_org_id, "operation.ownerScope.orgId"),
-			projectId: requireString(row.linked_scope_project_id, "operation.ownerScope.projectId"),
-			projectEnvironmentId: requireString(row.linked_scope_env_id, "operation.ownerScope.projectEnvironmentId")
+			orgId: requireString(row.owner_scope_org_id, "operation.ownerScope.orgId"),
+			projectId: requireString(row.owner_scope_project_id, "operation.ownerScope.projectId"),
+			projectEnvironmentId: requireString(row.owner_scope_env_id, "operation.ownerScope.projectEnvironmentId")
 		};
 	}
 	async readAuthorizedOperationForAdmission(input) {
@@ -1646,7 +1648,7 @@ function classifyAuthorizedOperationAdmissionError(error) {
 function authorizedOperationReplayMismatch(input) {
 	if (requireString(input.existing.authorization_source_kind, "operation.authorization.kind") !== input.incoming.authorization.kind) return authorizationSourceRejected(input.incoming.authorization);
 	if (input.incoming.authorization.kind === "authorization_grant") {
-		if (input.existing.linked_scope_org_id !== input.scope.orgId || input.existing.linked_scope_project_id !== input.scope.projectId || input.existing.linked_scope_env_id !== input.scope.envId) return { kind: "authorization_grant_rejected" };
+		if (input.existing.owner_scope_org_id !== input.scope.orgId || input.existing.owner_scope_project_id !== input.scope.projectId || input.existing.owner_scope_env_id !== input.scope.envId) return { kind: "authorization_grant_rejected" };
 		const expectedGrantKind = input.incoming.authorization.authorizationGrantRef.kind;
 		if (input.existing.authorization_grant_kind !== expectedGrantKind) return { kind: "authorization_grant_rejected" };
 		if (input.existing.authorization_id !== input.incoming.authorization.authorizationGrantRef.authorizationId) return { kind: "authorization_grant_rejected" };