@seams/wallet-server 0.7.3 → 0.8.0

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthorityStore.js

@@ -5,136 +5,11 @@ import { parseDelegatedWalletPermissionSetV1 } from "../../../../shared-ts/src/a
 import { parseWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { buildRevokedWalletAuthorityV1, computeWalletAuthorityDigestB64u, parseWalletAuthorityV1, parseWalletSignerActivationSetV1, walletAuthorityDigestsMatchV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { buildWalletSessionCapabilitySubjectsV1 } from "../../../../authorization/domain.js";
-import { d1ChangedRows, formatD1ExecStatement, parseD1JsonColumn } from "../../../../storage/d1Sql.js";
+import { d1ChangedRows, parseD1JsonColumn } from "../../../../storage/d1Sql.js";
 import { prepareD1WalletPutSignerStatement } from "../../../../core/d1WalletStore.js";
-import { ensureWalletAuthMethodStoreD1SchemaV2, prepareD1WalletAuthMethodV2PutStatement } from "../../../../core/d1WalletAuthMethodStore.js";
+import { prepareD1WalletAuthMethodV2PutStatement } from "../../../../core/d1WalletAuthMethodStore.js";
 import { prepareD1WalletSessionAuthorityProjectionStatements } from "../authorization/walletSessionAuthorityProjection.js";
 //#region src/router/cloudflare/d1/wallet/d1WalletAuthorityStore.ts
-const WALLET_AUTHORITY_STORE_D1_SCHEMA_SQL = Object.freeze([
-	`
-    CREATE TABLE IF NOT EXISTS wallet_authorities (
-      namespace TEXT NOT NULL,
-      org_id TEXT NOT NULL,
-      project_id TEXT NOT NULL,
-      env_id TEXT NOT NULL,
-      authority_id TEXT NOT NULL,
-      wallet_id TEXT NOT NULL,
-      device_id TEXT NOT NULL,
-      provenance_kind TEXT NOT NULL,
-      enrollment_id TEXT,
-      source_authority_id TEXT,
-      link_session_id TEXT,
-      recovery_operation_id TEXT,
-      continuity_authority_id TEXT,
-      lifecycle_state TEXT NOT NULL,
-      permissions_json TEXT NOT NULL,
-      signer_activations_json TEXT NOT NULL,
-      local_install_package_set_digest_b64u TEXT,
-      signer_activation_set_digest_b64u TEXT NOT NULL,
-      authority_digest_b64u TEXT NOT NULL,
-      revocation_epoch INTEGER NOT NULL,
-      record_json TEXT NOT NULL,
-      created_at_ms INTEGER NOT NULL,
-      updated_at_ms INTEGER NOT NULL,
-      activated_at_ms INTEGER,
-      revoked_at_ms INTEGER,
-      PRIMARY KEY (namespace, org_id, project_id, env_id, authority_id),
-      CHECK (length(authority_id) > 0),
-      CHECK (length(wallet_id) > 0),
-      CHECK (length(device_id) > 0),
-      CHECK (provenance_kind IN ('wallet_registration', 'device_link', 'wallet_recovery')),
-      CHECK (lifecycle_state IN ('pending_local_install', 'active', 'revoked')),
-      CHECK (length(permissions_json) > 0 AND json_valid(permissions_json)),
-      CHECK (length(signer_activations_json) > 0 AND json_valid(signer_activations_json)),
-      CHECK (length(record_json) > 0 AND json_valid(record_json)),
-      CHECK (length(signer_activation_set_digest_b64u) > 0),
-      CHECK (length(authority_digest_b64u) > 0),
-      CHECK (revocation_epoch >= 0),
-      CHECK (created_at_ms >= 0),
-      CHECK (updated_at_ms >= created_at_ms),
-      CHECK (
-        (provenance_kind = 'wallet_registration'
-          AND enrollment_id IS NULL
-          AND source_authority_id IS NULL
-          AND link_session_id IS NULL
-          AND recovery_operation_id IS NULL
-          AND continuity_authority_id IS NULL)
-        OR
-        (provenance_kind = 'device_link'
-          AND enrollment_id IS NOT NULL AND length(enrollment_id) > 0
-          AND source_authority_id IS NOT NULL AND length(source_authority_id) > 0
-          AND link_session_id IS NOT NULL AND length(link_session_id) > 0
-          AND recovery_operation_id IS NULL
-          AND continuity_authority_id IS NULL)
-        OR
-        (provenance_kind = 'wallet_recovery'
-          AND enrollment_id IS NULL
-          AND source_authority_id IS NULL
-          AND link_session_id IS NULL
-          AND recovery_operation_id IS NOT NULL
-          AND length(recovery_operation_id) > 0
-          AND continuity_authority_id IS NOT NULL
-          AND length(continuity_authority_id) > 0)
-      ),
-      CHECK (
-        (lifecycle_state = 'pending_local_install'
-          AND local_install_package_set_digest_b64u IS NOT NULL
-          AND length(local_install_package_set_digest_b64u) > 0
-          AND activated_at_ms IS NULL
-          AND revoked_at_ms IS NULL
-          AND revocation_epoch = 0)
-        OR
-        (lifecycle_state = 'active'
-          AND local_install_package_set_digest_b64u IS NULL
-          AND activated_at_ms IS NOT NULL
-          AND revoked_at_ms IS NULL)
-        OR
-        (lifecycle_state = 'revoked'
-          AND local_install_package_set_digest_b64u IS NULL
-          AND activated_at_ms IS NOT NULL
-          AND revoked_at_ms IS NOT NULL)
-      ),
-      CHECK (json_extract(record_json, '$.authorityId') = authority_id),
-      CHECK (json_extract(record_json, '$.walletId') = wallet_id),
-      CHECK (json_extract(record_json, '$.state') = lifecycle_state),
-      CHECK (json_extract(record_json, '$.revocationEpoch') = revocation_epoch),
-      CHECK (json_extract(record_json, '$.authorityDigestB64u') = authority_digest_b64u),
-      CHECK (
-        json_extract(record_json, '$.signerActivationSetDigestB64u')
-          = signer_activation_set_digest_b64u
-      )
-    )
-  `,
-	`
-    CREATE UNIQUE INDEX IF NOT EXISTS wallet_authorities_active_device_uidx
-      ON wallet_authorities (
-        namespace, org_id, project_id, env_id, wallet_id, device_id
-      )
-      WHERE lifecycle_state <> 'revoked'
-  `,
-	`
-    CREATE UNIQUE INDEX IF NOT EXISTS wallet_authorities_enrollment_uidx
-      ON wallet_authorities (
-        namespace, org_id, project_id, env_id, wallet_id, enrollment_id
-      )
-      WHERE enrollment_id IS NOT NULL
-  `,
-	`
-    CREATE INDEX IF NOT EXISTS wallet_authorities_inventory_idx
-      ON wallet_authorities (
-        namespace, org_id, project_id, env_id, wallet_id, lifecycle_state,
-        updated_at_ms, authority_id
-      )
-  `,
-	`
-    CREATE TABLE IF NOT EXISTS wallet_authority_cas_guard (
-      guard_id INTEGER PRIMARY KEY CHECK (guard_id = 1)
-    )
-  `,
-	`
-    INSERT OR IGNORE INTO wallet_authority_cas_guard (guard_id) VALUES (1)
-  `
-]);
 function normalizeScope(input) {
 	return {
 		namespace: requireScopeString(input.namespace, "namespace"),
@@ -385,7 +260,6 @@ var WalletAuthorityCommitConflictError = class extends Error {
 };
 var D1WalletAuthorityStore = class {
 	constructor(input) {
-		this.schemaReady = false;
 		this.database = input.database;
 		this.scope = normalizeScope(input.scope ?? {
 			namespace: input.namespace ?? "",
@@ -393,13 +267,6 @@ var D1WalletAuthorityStore = class {
 			projectId: input.projectId ?? "",
 			envId: input.envId ?? ""
 		});
-		this.ensureSchemaOnUse = input.ensureSchema !== false;
-	}
-	async ensureSchema() {
-		if (!this.ensureSchemaOnUse || this.schemaReady) return;
-		for (const statement of WALLET_AUTHORITY_STORE_D1_SCHEMA_SQL) await this.database.exec(formatD1ExecStatement(statement));
-		await ensureWalletAuthMethodStoreD1SchemaV2({ database: this.database });
-		this.schemaReady = true;
 	}
 	/**
 	* Commits an added signer: its signer records, the authority extended with
@@ -409,7 +276,6 @@ var D1WalletAuthorityStore = class {
 	* credentials and deletes its unredeemed hosted exchange codes.
 	*/
 	async extendActiveAuthority(input) {
-		await this.ensureSchema();
 		const statements = [
 			...input.walletSigners.map((record) => prepareD1WalletPutSignerStatement({
 				database: this.database,
@@ -447,7 +313,6 @@ var D1WalletAuthorityStore = class {
 		if (results.length !== statements.length || results.some((result) => !result.success)) throw new Error("D1 wallet authority extension returned an incomplete batch result");
 	}
 	async readById(authorityId) {
-		await this.ensureSchema();
 		const row = await this.database.prepare(`SELECT *
            FROM wallet_authorities
           WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
@@ -457,7 +322,6 @@ var D1WalletAuthorityStore = class {
 		return await parseD1WalletAuthorityRow(row);
 	}
 	async readByWalletAndDevice(input) {
-		await this.ensureSchema();
 		const row = await this.database.prepare(`SELECT *
            FROM wallet_authorities
           WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
@@ -476,7 +340,6 @@ var D1WalletAuthorityStore = class {
 	* link-session CAS, keeping the pending transition one atomic batch.
 	*/
 	async commitPendingAuthorityWithStatements(input, additionalStatements) {
-		await this.ensureSchema();
 		assertPendingCommitInput(input);
 		if (!await walletAuthorityDigestsMatchV1(input.authority)) throw new Error("pending wallet authority digest does not match its canonical record");
 		const existing = await this.readById(input.authority.authorityId);
@@ -539,7 +402,6 @@ var D1WalletAuthorityStore = class {
 	* same transaction as authority and auth-method visibility.
 	*/
 	async activatePendingAuthorityWithStatements(input, additionalStatements) {
-		await this.ensureSchema();
 		assertActivationInput(input);
 		if (!await walletAuthorityDigestsMatchV1(input.pendingAuthority)) return {
 			kind: "conflict",
@@ -617,7 +479,6 @@ var D1WalletAuthorityStore = class {
 		};
 	}
 	async listForWallet(input) {
-		await this.ensureSchema();
 		if (!Number.isSafeInteger(input.limit) || input.limit < 1 || input.limit > 1e3) throw new Error("wallet authority page limit is invalid");
 		const state = input.lifecycleState ?? "";
 		const cursorTime = input.cursor?.updatedAtMs ?? 0;
@@ -645,7 +506,6 @@ var D1WalletAuthorityStore = class {
 		};
 	}
 	async revokeWalletAuthMethod(input) {
-		await this.ensureSchema();
 		const expectedEpoch = requireNonNegativeInteger(input.expectedAuthorityRevocationEpoch, "expected authority revocation epoch");
 		const requestedAtMs = requireNonNegativeInteger(input.requestedAtMs, "requestedAtMs");
 		const activeCountRow = await this.database.prepare(`SELECT COUNT(*) AS count

package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnAuthService.js

@@ -1,7 +1,7 @@
 import { parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
+import { WalletLifecycleLocator } from "../../../../authorization/lifecycleRouting.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { failedVerification, failure } from "../../../../shared-ts/src/utils/failure.js";
 import { decodeWebAuthnBase64UrlOrBase64, parseWebAuthnAuthenticationCredential, parseWebAuthnClientDataJsonBase64url, webAuthnCredentialIdB64uFromCredential, webAuthnOriginHostnameOrEmpty } from "../../../auth/webAuthnCredentialCodecs.js";
@@ -15,6 +15,7 @@ function errorMessage(error) {
 }
 var CloudflareD1WebAuthnAuthService = class {
 	constructor(input) {
+		this.lifecycleRouting = input.lifecycleRouting;
 		this.webAuthnStore = input.webAuthnStore;
 		this.walletManifestSource = input.walletManifestSource;
 		this.walletAuthMethodStore = input.walletAuthMethodStore;
@@ -91,6 +92,8 @@ var CloudflareD1WebAuthnAuthService = class {
 				createdAtMs,
 				expiresAtMs
 			};
+			const publication = await publishPasskeyChallengeHome(this.lifecycleRouting, userId.value, challengeId);
+			if (!publication.ok) return publication;
 			await this.webAuthnStore.writeChallenge({
 				challengeId,
 				challengeKind: "login",
@@ -152,13 +155,14 @@ var CloudflareD1WebAuthnAuthService = class {
 				createdAtMs,
 				expiresAtMs
 			};
-			await this.webAuthnStore.writeChallenge({
+			const stored = await this.webAuthnStore.writeChallenge({
 				challengeId,
 				challengeKind: "sync",
 				record,
 				createdAtMs,
 				expiresAtMs
 			});
+			if (!stored.ok) return stored;
 			return {
 				ok: true,
 				challengeId,
@@ -358,12 +362,14 @@ var CloudflareD1WebAuthnAuthService = class {
 		try {
 			const challengeId = normalizeOptionalTrimmedString(input.challengeId ?? input.challenge_id);
 			if (!challengeId) return failure("invalid_body", "Missing challengeId");
-			const challenge = await this.webAuthnStore.consumeSyncChallenge(challengeId);
-			if (!challenge) return failedVerification("challenge_expired_or_invalid", "Sync challenge expired or invalid");
 			const credential = parseWebAuthnAuthenticationCredential(input.webauthn_authentication);
 			if (!credential) return failedVerification("invalid_body", "Missing webauthn_authentication");
 			const credentialId = webAuthnCredentialIdB64uFromCredential(credential);
 			if (!credentialId.ok) return failedVerification(credentialId.code, credentialId.message);
+			const consumed = await this.webAuthnStore.consumeSyncChallenge(challengeId, credentialId.credentialIdB64u);
+			if (!consumed.ok) return failedVerification(consumed.code, consumed.message);
+			const challenge = consumed.record;
+			if (!challenge) return failedVerification("challenge_expired_or_invalid", "Sync challenge expired or invalid");
 			const syncBinding = webAuthnSyncCredentialBinding(await this.webAuthnStore.readBindingByCredential({
 				rpId: challenge.rpId,
 				credentialIdB64u: credentialId.credentialIdB64u
@@ -457,6 +463,21 @@ function webAuthnLoginChallengeTtlMs(input) {
 function compareAuthenticatorSlots(left, right) {
 	return (Number(left.signerSlot || 0) || 0) - (Number(right.signerSlot || 0) || 0);
 }
+async function publishPasskeyChallengeHome(publisher, walletId, challengeId) {
+	if (!publisher) return { ok: true };
+	try {
+		if (!(await publisher.publishLifecycle({
+			walletId,
+			locator: WalletLifecycleLocator.parse({
+				kind: "passkey_challenge",
+				value: challengeId
+			})
+		})).ok) return failure("wallet_home_conflict", "Passkey challenge home conflicts");
+		return { ok: true };
+	} catch {
+		return failure("wallet_home_unavailable", "Passkey challenge home is unavailable");
+	}
+}
 //#endregion
 export { CloudflareD1WebAuthnAuthService };
 

package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnRecords.js

@@ -1,7 +1,6 @@
 import { parsePasskeyEnvelopeId, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWalletRecoveryOperationId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { parseEnvelopeRevision } from "../../../../shared-ts/src/passkey-custody/primitives.js";
 import { normalizeRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { parseWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
@@ -37,18 +36,18 @@ function parseWebAuthnLoginChallengeRecord(input) {
 	])) return null;
 	const version = normalizeOptionalTrimmedString(record.version);
 	const challengeId = normalizeOptionalTrimmedString(record.challengeId);
-	const userId = normalizeOptionalTrimmedString(record.userId);
+	const userId = parseWalletId(record.userId);
 	const rpId = normalizeOptionalTrimmedString(record.rpId);
 	const challengeB64u = normalizeOptionalTrimmedString(record.challengeB64u);
 	const createdAtMs = positiveInteger(record.createdAtMs);
 	const expiresAtMs = positiveInteger(record.expiresAtMs);
 	if (version !== "webauthn_login_challenge_v1") return null;
-	if (!challengeId || !userId || !rpId || !challengeB64u) return null;
+	if (!challengeId || !userId.ok || !rpId || !challengeB64u) return null;
 	if (createdAtMs === null || expiresAtMs === null) return null;
 	return {
 		version: "webauthn_login_challenge_v1",
 		challengeId,
-		userId,
+		userId: userId.value,
 		rpId,
 		challengeB64u,
 		createdAtMs,
@@ -424,39 +423,6 @@ function webAuthnSyncWalletBindingFromCredentialBinding(binding) {
 		signerSlot
 	};
 }
-function parseNearPublicKey(row) {
-	const candidate = parseWebAuthnJsonInput(row.record_json);
-	if (candidate === null || typeof candidate !== "object" || Array.isArray(candidate)) return null;
-	let prototype;
-	try {
-		prototype = Object.getPrototypeOf(candidate);
-	} catch {
-		return null;
-	}
-	if (prototype !== Object.prototype && prototype !== null) return null;
-	const record = candidate;
-	if (Object.keys(record).some((field) => ![
-		"publicKey",
-		"kind",
-		"authBinding",
-		"signerSlot",
-		"createdAtMs",
-		"updatedAtMs"
-	].includes(field))) return null;
-	const publicKey = normalizeOptionalTrimmedString(record.publicKey);
-	const kind = parseNearPublicKeyKind(normalizeOptionalTrimmedString(record.kind));
-	const authBinding = parseNearPublicKeyAuthBinding(record);
-	if (authBinding === null) return null;
-	if (!publicKey || !kind) return null;
-	return {
-		publicKey,
-		kind,
-		signerSlot: optionalNonNegativeInteger(record.signerSlot),
-		...authBinding ? { authBinding } : {},
-		createdAtMs: optionalNonNegativeInteger(record.createdAtMs),
-		updatedAtMs: optionalNonNegativeInteger(record.updatedAtMs)
-	};
-}
 function parseWebAuthnJsonInput(input) {
 	if (typeof input === "string") try {
 		return JSON.parse(input);
@@ -497,39 +463,7 @@ function optionalNumberArray(input) {
 	}
 	return values;
 }
-function parseNearPublicKeyKind(input) {
-	switch (input) {
-		case "threshold":
-		case "local":
-		case "backup":
-		case "ephemeral": return input;
-		default: return null;
-	}
-}
-function parseNearPublicKeyAuthBinding(record) {
-	if (Object.prototype.hasOwnProperty.call(record, "rpId") || Object.prototype.hasOwnProperty.call(record, "credentialIdB64u")) return null;
-	if (record.authBinding === void 0) return void 0;
-	const candidate = record.authBinding;
-	if (candidate === null || typeof candidate !== "object" || Array.isArray(candidate)) return null;
-	let prototype;
-	try {
-		prototype = Object.getPrototypeOf(candidate);
-	} catch {
-		return null;
-	}
-	if (prototype !== Object.prototype && prototype !== null) return null;
-	const authBinding = candidate;
-	const kind = normalizeOptionalTrimmedString(authBinding.kind);
-	const rpId = parseWebAuthnRpId(authBinding.rpId);
-	const credentialIdB64u = normalizeOptionalTrimmedString(authBinding.credentialIdB64u);
-	if (kind !== "passkey" || !rpId.ok || !credentialIdB64u) return null;
-	return {
-		kind: "passkey",
-		rpId: rpId.value,
-		credentialIdB64u
-	};
-}
 //#endregion
-export { buildWebAuthnRecoveryContinuityAnchorRecord, parseNearPublicKey, parseWebAuthnAuthenticator, parseWebAuthnAuthenticatorRowDeviceInfo, parseWebAuthnBinding, parseWebAuthnLoginChallengeRecord, parseWebAuthnRecoveryRegistrationChallengeRecord, parseWebAuthnSyncChallengeRecord, webAuthnSyncWalletBindingFromCredentialBinding };
+export { buildWebAuthnRecoveryContinuityAnchorRecord, parseWebAuthnAuthenticator, parseWebAuthnAuthenticatorRowDeviceInfo, parseWebAuthnBinding, parseWebAuthnLoginChallengeRecord, parseWebAuthnRecoveryRegistrationChallengeRecord, parseWebAuthnSyncChallengeRecord, webAuthnSyncWalletBindingFromCredentialBinding };
 
 //# sourceMappingURL=d1WebAuthnRecords.js.map

package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnStore.js

@@ -1,9 +1,9 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { prepareD1TenantStatement } from "../../../../core/d1TenantStore.js";
-import { INSERT_WEBAUTHN_AUTHENTICATOR_SQL, UPSERT_WEBAUTHN_AUTHENTICATOR_SQL, webAuthnAuthenticatorRows, webAuthnChallengeRows, webAuthnCredentialBindingRows } from "../../../../core/webAuthnD1Statements.js";
+import { reservePasskeyCredential } from "../../../../core/passkeyCredentialClaims.js";
 import { prepareD1WebAuthnCredentialBindingInsertStatement } from "../../../../core/WebAuthnCredentialBindingStore.js";
 import { parseWebAuthnAuthenticator, parseWebAuthnBinding, parseWebAuthnLoginChallengeRecord, parseWebAuthnRecoveryRegistrationChallengeRecord, parseWebAuthnSyncChallengeRecord } from "./d1WebAuthnRecords.js";
+import { INSERT_WEBAUTHN_AUTHENTICATOR_SQL, UPSERT_WEBAUTHN_AUTHENTICATOR_SQL, webAuthnAuthenticatorRows, webAuthnChallengeRows, webAuthnCredentialBindingRows } from "../../../../core/webAuthnD1Statements.js";
 //#region src/router/cloudflare/d1/webauthn/d1WebAuthnStore.ts
 function prepareAuthenticatorStatement(sql, input) {
 	return input.database.prepare(sql).bind(input.scope.namespace, input.scope.orgId, input.scope.projectId, input.scope.envId, input.userId, input.record.credentialIdB64u, input.record.credentialPublicKeyB64u, input.record.counter, input.record.createdAtMs, input.record.updatedAtMs, JSON.stringify(input.record.deviceInfo));
@@ -20,6 +20,8 @@ function prepareD1WebAuthnAuthenticatorInsertStatement(input) {
 var CloudflareD1WebAuthnStore = class {
 	constructor(input) {
 		this.prepare = (sql, values) => prepareD1TenantStatement(this.database, this.scope, sql, values);
+		this.credentialClaims = input.credentialClaims;
+		this.syncChallenges = input.syncChallenges;
 		this.database = input.database;
 		this.scope = {
 			namespace: input.namespace,
@@ -29,7 +31,9 @@ var CloudflareD1WebAuthnStore = class {
 		};
 	}
 	async writeChallenge(input) {
+		if (input.challengeKind === "sync" && this.syncChallenges) return this.syncChallenges.create(input.record);
 		await webAuthnChallengeRows.upsert(this.prepare, input).run();
+		return { ok: true };
 	}
 	async consumeLoginChallenge(challengeId) {
 		return parseWebAuthnLoginChallengeRecord((await this.consumeChallenge({
@@ -37,11 +41,18 @@ var CloudflareD1WebAuthnStore = class {
 			challengeKind: "login"
 		}))?.record_json);
 	}
-	async consumeSyncChallenge(challengeId) {
-		return parseWebAuthnSyncChallengeRecord((await this.consumeChallenge({
+	async consumeSyncChallenge(challengeId, credentialIdB64u) {
+		if (this.syncChallenges) return this.syncChallenges.consume({
 			challengeId,
-			challengeKind: "sync"
-		}))?.record_json);
+			credentialIdB64u
+		});
+		return {
+			ok: true,
+			record: parseWebAuthnSyncChallengeRecord((await this.consumeChallenge({
+				challengeId,
+				challengeKind: "sync"
+			}))?.record_json)
+		};
 	}
 	async readRecoveryRegistrationChallenge(challengeId, nowMs) {
 		return parseWebAuthnRecoveryRegistrationChallengeRecord((await this.prepare(`SELECT record_json
@@ -90,7 +101,12 @@ var CloudflareD1WebAuthnStore = class {
 			record: input.record
 		});
 	}
-	prepareCredentialBindingInsertStatement(record) {
+	async prepareCredentialBindingInsertStatement(record) {
+		await reservePasskeyCredential(this.credentialClaims, {
+			walletId: record.userId,
+			rpId: record.rpId,
+			credentialIdB64u: record.credentialIdB64u
+		});
 		return prepareD1WebAuthnCredentialBindingInsertStatement({
 			database: this.database,
 			scope: this.scope,

package/dist/esm/router/cloudflare/runtime/staticWalletConsoleBinding.js

@@ -68,6 +68,7 @@ async function handleStaticWalletConsoleRequestV1(config, input, init) {
 		case WALLET_CONSOLE_OP_PATHS_V1.secretKeyAuth: return secretKeyResponse(config, body);
 		case WALLET_CONSOLE_OP_PATHS_V1.projectEnvironments: return projectEnvironmentsResponse(config, body);
 		case WALLET_CONSOLE_OP_PATHS_V1.tenantRootActiveLineage: return activeLineageResponse(config, body);
+		case WALLET_CONSOLE_OP_PATHS_V1.walletProjection:
 		case WALLET_CONSOLE_OP_PATHS_V1.usageEvents: return json({ ok: true });
 		default: return json({
 			ok: false,

package/dist/esm/router/cloudflare/runtime/walletConsoleOps.js

@@ -7,6 +7,7 @@ const WALLET_CONSOLE_OP_PATHS_V1 = {
 	secretKeyAuth: `${WALLET_CONSOLE_OPS_BASE_PATH_V1}/secret-key-auth`,
 	publishableKeyAuth: `${WALLET_CONSOLE_OPS_BASE_PATH_V1}/publishable-key-auth`,
 	usageEvents: `${WALLET_CONSOLE_OPS_BASE_PATH_V1}/usage-events`,
+	walletProjection: `${WALLET_CONSOLE_OPS_BASE_PATH_V1}/wallet-projections`,
 	projectEnvironments: `${WALLET_CONSOLE_OPS_BASE_PATH_V1}/project-environments`,
 	tenantRootActiveLineage: `${WALLET_CONSOLE_OPS_BASE_PATH_V1}/tenant-root/active-lineage`
 };

package/dist/esm/router/cloudflare/runtime/walletConsoleOpsClient.js

@@ -215,12 +215,17 @@ function createWalletConsoleOpsClient(service) {
 				custodyLineageB64u: decoded.value.custodyLineageB64u
 			};
 		} },
+		walletProjection: { recordCreatedWallet: recordCreatedWallet.bind(void 0, service) },
 		usageMeter: { async recordEvent(input) {
 			const { status, body } = await postJson(service, WALLET_CONSOLE_OP_PATHS_V1.usageEvents, input);
 			if (!isUsageEventsSuccessResponse(body)) throw new Error(`Wallet Console usage ingestion failed (HTTP ${status}): invalid response`);
 		} }
 	};
 }
+async function recordCreatedWallet(service, input) {
+	const { status, body } = await postJson(service, WALLET_CONSOLE_OP_PATHS_V1.walletProjection, input);
+	if (status !== 200 || !isUsageEventsSuccessResponse(body)) throw new Error(`Wallet Console projection failed (HTTP ${status})`);
+}
 //#endregion
 export { createWalletConsoleOpsClient };
 

package/dist/esm/router/cloudflare/runtime/walletGateway.js

@@ -1,5 +1,4 @@
 import { ensureLeadingSlash } from "../../../shared-ts/src/utils/normalize.js";
-import "../../../shared-ts/src/utils/validation.js";
 import { createRouterAbNormalSigningAdmissionAdapter } from "../../domains/signingOperations/routerAbNormalSigningAdmissionCore.js";
 import { createCloudflareD1RouterAbNormalSigningAdmissionStore } from "../d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.js";
 import { WALLET_CONSOLE_SERVICE_ORIGIN_V1 } from "./walletConsoleOps.js";
@@ -138,6 +137,7 @@ function createCloudflareWalletGatewayRouterV1(input) {
 		apiKeyAuth: consoleOps.apiKeyAuth,
 		publishableKeyAuth: consoleOps.publishableKeyAuth,
 		apiKeyUsageMeter: consoleOps.usageMeter,
+		walletProjection: consoleOps.walletProjection,
 		orgProjectEnv: consoleOps.projectEnvironments,
 		routerAbNormalSigningAdmission: createRouterAbNormalSigningAdmissionAdapter(admissionStore),
 		routeExtensions: [createWalletConsoleRelayProxyExtensionV1(input.walletConsole), ...input.routeExtensions ?? []]

package/dist/esm/router/cloudflare/runtime/walletRuntimeOps.js

@@ -270,13 +270,19 @@ function parseWalletRuntimeWalletIdentityRequest(value) {
 	const wallets = [];
 	for (const rawWallet of rawWallets) {
 		const wallet = inspectRawObject(rawWallet);
-		if (!wallet || !hasExactKeys(wallet, ["walletId", "projectId"])) return null;
+		if (!wallet || !hasExactKeys(wallet, [
+			"walletId",
+			"projectId",
+			"envId"
+		])) return null;
 		const walletId = parseNonEmptyText(readRawField(wallet, "walletId"));
 		const projectId = parseNonEmptyText(readRawField(wallet, "projectId"));
-		if (!walletId || !projectId) return null;
+		const envId = parseNonEmptyText(readRawField(wallet, "envId"));
+		if (!walletId || !projectId || !envId) return null;
 		wallets.push({
 			walletId,
-			projectId
+			projectId,
+			envId
 		});
 	}
 	return {
@@ -294,15 +300,21 @@ function parseWalletRuntimeWalletIdentitiesResult(value) {
 		const identity = inspectRawObject(rawIdentity);
 		if (!identity || !hasExactKeys(identity, [
 			"walletId",
+			"projectId",
+			"envId",
 			"nearAccountId",
 			"evmAddress"
 		])) return null;
 		const walletId = parseNonEmptyText(readRawField(identity, "walletId"));
+		const projectId = parseNonEmptyText(readRawField(identity, "projectId"));
+		const envId = parseNonEmptyText(readRawField(identity, "envId"));
 		const nearAccountId = parseNonEmptyText(readRawField(identity, "nearAccountId"));
 		const evmAddress = parseEvmAddress(readRawField(identity, "evmAddress"));
-		if (!walletId || !nearAccountId || !evmAddress) return null;
+		if (!walletId || !projectId || !envId || !nearAccountId || !evmAddress) return null;
 		identities.push({
 			walletId,
+			projectId,
+			envId,
 			nearAccountId,
 			evmAddress
 		});

package/dist/esm/router/cloudflare-adaptor.js

@@ -29,7 +29,6 @@ import { RouterAbEd25519YaoHttpRegistrationBackend, createRouterAbEd25519YaoHttp
 import { StaticCloudflareTenantStorageRouteResolver, createCloudflareTenantStorageRoute, createSignerD1DoStorageTarget, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings } from "../storage/tenantRoute.js";
 import { createInMemoryRouterApiRuntimeSnapshotConsumer, validateRuntimeSnapshotExpectation } from "./framework/runtimeSnapshotConsumer.js";
 import { createSelfHostedCloudflareSigningRouter, createSelfHostedCloudflareSigningWorker } from "./cloudflare/runtime/createSelfHostedCloudflareSigningWorker.js";
-import { ThresholdStoreDurableObject } from "./cloudflare/durableObjects/thresholdStore.js";
 import { CloudflareDurableObjectVersionedJsonRecordStore, CloudflareVersionedJsonRecordStoreError, createCloudflareDurableObjectVersionedJsonRecordStore } from "./cloudflare/durableObjects/versionedJsonRecordStore.js";
 import { CloudflareD1VersionedJsonRecordStore, CloudflareD1VersionedJsonRecordStoreError, createCloudflareD1VersionedJsonRecordStore } from "./cloudflare/d1/versionedJson/d1VersionedJsonRecordStore.js";
 import { createRouterAbEd25519YaoCeremonyStateStoreV1, encodeRouterAbEd25519YaoProductRegistrationStateV1, parseRouterAbEd25519YaoCeremonyKeyV1, parseRouterAbEd25519YaoProductRegistrationStateJsonV1, resolveRouterAbEd25519YaoCeremonyKeyFromRequestV1 } from "./domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPersistence.js";
@@ -42,4 +41,4 @@ import { runRouterAbEd25519YaoRegistrationSideEffectV1 } from "./domains/ed25519
 import { runRouterAbEd25519YaoRegistrationTwoPhaseV1 } from "./domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationTwoPhaseRunner.js";
 import { CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1, CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1, createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1, createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1 } from "./cloudflare/signingLanes/cloudflareOrdinaryInactiveSignerMaterialReservation.js";
 import { handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1 } from "./domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationRequestScopedCloudflare.js";
-export { CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, CloudflareD1AuthorizationStore, CloudflareD1RouterAbNormalSigningAdmissionStore, CloudflareD1VaultProxyStore, CloudflareD1VersionedJsonRecordStore, CloudflareD1VersionedJsonRecordStoreError, CloudflareD1WebAuthnAuthService, CloudflareD1WebAuthnStore, CloudflareDurableObjectVersionedJsonRecordStore, CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1, CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1, CloudflareVersionedJsonRecordStoreError, DEFAULT_WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_V1, DEFAULT_WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_V1, InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter, InMemoryRouterAbEd25519YaoRegistrationService, InMemoryRouterAbNormalSigningAdmissionStore, ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1, ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, RouterAbEd25519YaoHttpRegistrationBackend, StaticCloudflareTenantStorageRouteResolver, ThresholdStoreDurableObject, UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, WALLET_CONSOLE_API_WALLET_DETAIL_PREFIX_V1, WALLET_CONSOLE_OPS_BASE_PATH_V1, WALLET_CONSOLE_OP_PATHS_V1, WALLET_CONSOLE_SERVICE_ORIGIN_V1, WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_ID_V1, WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_ID_V1, WALLET_CONTROL_AUTH_MARKER_V1, WALLET_CONTROL_BASE_PATH_V1, WALLET_CONTROL_SERVICE_ORIGIN_V1, WALLET_RUNTIME_OPS_BASE_PATH_V1, WALLET_RUNTIME_OP_PATHS_V1, WALLET_RUNTIME_SERVICE_ORIGIN_V1, buildRouterAbEd25519YaoProductAdmissionRequestV1, coerceRouterLogger, createCloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1VersionedJsonRecordStore, createCloudflareDurableObjectVersionedJsonRecordStore, createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1, createCloudflareRouter, createCloudflareTenantStorageRoute, createCloudflareWalletGatewayRouterV1, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterApiRuntimeSnapshotConsumer, createRouterAbEd25519YaoCeremonyStateStoreV1, createRouterAbEd25519YaoHttpRegistrationBackendFromEnv, createRouterAbEd25519YaoProductRegistrationCompositionFromPortsV1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, createRouterAbEd25519YaoProductRegistrationRequestScopedRuntimeV1, createRouterAbEd25519YaoProductRegistrationRuntimeV1, createRouterAbEd25519YaoProductRegistrationStateV1, createRouterAbEd25519YaoRegistrationModule, createRouterAbNormalSigningAdmissionAdapter, createRouterApiModule, createSelfHostedCloudflareSigningRouter, createSelfHostedCloudflareSigningWorker, createSignerD1DoStorageTarget, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, createStaticWalletConsoleBindingV1, createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1, createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, createWalletConsoleOpsClient, createWalletConsoleRelayProxyExtensionV1, createWalletControlClientBindings, createWalletRuntimeOpsHandler, decodeWalletConsoleTenantRootActiveLineageRequestV1, decodeWalletConsoleTenantRootActiveLineageResponseV1, defineRoute, encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1, encodeRouterAbEd25519YaoProductRegistrationStateV1, extractBearerCredential, extractRouterApiEnvironmentId, getRouterApiRouteExtensionRoutes, handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1, handleStaticWalletConsoleRequestV1, handleWalletControlRequest, matchesRouteDefinitionRequest, mergeRouterAbEd25519YaoProductRegistrationStatePartitionV1, parseRouterAbEd25519YaoCeremonyKeyV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoProductRegistrationStateJsonV1, parseRouterAbPublicKeysetV2, parseStaticWalletConsoleBindingConfigV1, parseWalletRuntimeExecuteSignedDelegateRequest, parseWalletRuntimeExecuteSignedDelegateResponse, parseWalletRuntimeExecuteSignedDelegateResult, parseWalletRuntimeRelayerAccount, parseWalletRuntimeWalletIdentitiesResult, parseWalletRuntimeWalletIdentityRequest, partitionRouterAbEd25519YaoProductRegistrationStateV1, randomTenantRootCreationGrantBytesV1, readEnvironmentCsv, readEnvironmentString, requireEnvironmentString, resolveRouterAbEd25519YaoCeremonyKeyFromRequestV1, resolveRuntimeTenantRootLineage, resolveSourceIpFromExpressRequest, resolveSourceIpFromFetchHeaders, runRouterAbEd25519YaoProductRegistrationRequestScopedV1, runRouterAbEd25519YaoRegistrationSideEffectV1, runRouterAbEd25519YaoRegistrationTwoPhaseV1, runRouterAbPrewarmScheduledV1, signTenantRootCreationGrantV1, tenantRootIdentityDigestB64uV1, validateRuntimeSnapshotExpectation, walletConsoleApiWalletGetRouteDefinitionV1, walletConsoleApiWalletListRouteDefinitionV1, walletConsoleApiWalletSearchRouteDefinitionV1, walletConsoleRelayRouteDefinitionsV1, walletConsoleSignedDelegateRouteDefinitionV1, walletConsoleSponsoredEvmCallRouteDefinitionV1 };
+export { CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, CloudflareD1AuthorizationStore, CloudflareD1RouterAbNormalSigningAdmissionStore, CloudflareD1VaultProxyStore, CloudflareD1VersionedJsonRecordStore, CloudflareD1VersionedJsonRecordStoreError, CloudflareD1WebAuthnAuthService, CloudflareD1WebAuthnStore, CloudflareDurableObjectVersionedJsonRecordStore, CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1, CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1, CloudflareVersionedJsonRecordStoreError, DEFAULT_WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_V1, DEFAULT_WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_V1, InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter, InMemoryRouterAbEd25519YaoRegistrationService, InMemoryRouterAbNormalSigningAdmissionStore, ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1, ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, RouterAbEd25519YaoHttpRegistrationBackend, StaticCloudflareTenantStorageRouteResolver, UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, WALLET_CONSOLE_API_WALLET_DETAIL_PREFIX_V1, WALLET_CONSOLE_OPS_BASE_PATH_V1, WALLET_CONSOLE_OP_PATHS_V1, WALLET_CONSOLE_SERVICE_ORIGIN_V1, WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_ID_V1, WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_ID_V1, WALLET_CONTROL_AUTH_MARKER_V1, WALLET_CONTROL_BASE_PATH_V1, WALLET_CONTROL_SERVICE_ORIGIN_V1, WALLET_RUNTIME_OPS_BASE_PATH_V1, WALLET_RUNTIME_OP_PATHS_V1, WALLET_RUNTIME_SERVICE_ORIGIN_V1, buildRouterAbEd25519YaoProductAdmissionRequestV1, coerceRouterLogger, createCloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1VersionedJsonRecordStore, createCloudflareDurableObjectVersionedJsonRecordStore, createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1, createCloudflareRouter, createCloudflareTenantStorageRoute, createCloudflareWalletGatewayRouterV1, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterApiRuntimeSnapshotConsumer, createRouterAbEd25519YaoCeremonyStateStoreV1, createRouterAbEd25519YaoHttpRegistrationBackendFromEnv, createRouterAbEd25519YaoProductRegistrationCompositionFromPortsV1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, createRouterAbEd25519YaoProductRegistrationRequestScopedRuntimeV1, createRouterAbEd25519YaoProductRegistrationRuntimeV1, createRouterAbEd25519YaoProductRegistrationStateV1, createRouterAbEd25519YaoRegistrationModule, createRouterAbNormalSigningAdmissionAdapter, createRouterApiModule, createSelfHostedCloudflareSigningRouter, createSelfHostedCloudflareSigningWorker, createSignerD1DoStorageTarget, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, createStaticWalletConsoleBindingV1, createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1, createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, createWalletConsoleOpsClient, createWalletConsoleRelayProxyExtensionV1, createWalletControlClientBindings, createWalletRuntimeOpsHandler, decodeWalletConsoleTenantRootActiveLineageRequestV1, decodeWalletConsoleTenantRootActiveLineageResponseV1, defineRoute, encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1, encodeRouterAbEd25519YaoProductRegistrationStateV1, extractBearerCredential, extractRouterApiEnvironmentId, getRouterApiRouteExtensionRoutes, handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1, handleStaticWalletConsoleRequestV1, handleWalletControlRequest, matchesRouteDefinitionRequest, mergeRouterAbEd25519YaoProductRegistrationStatePartitionV1, parseRouterAbEd25519YaoCeremonyKeyV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoProductRegistrationStateJsonV1, parseRouterAbPublicKeysetV2, parseStaticWalletConsoleBindingConfigV1, parseWalletRuntimeExecuteSignedDelegateRequest, parseWalletRuntimeExecuteSignedDelegateResponse, parseWalletRuntimeExecuteSignedDelegateResult, parseWalletRuntimeRelayerAccount, parseWalletRuntimeWalletIdentitiesResult, parseWalletRuntimeWalletIdentityRequest, partitionRouterAbEd25519YaoProductRegistrationStateV1, randomTenantRootCreationGrantBytesV1, readEnvironmentCsv, readEnvironmentString, requireEnvironmentString, resolveRouterAbEd25519YaoCeremonyKeyFromRequestV1, resolveRuntimeTenantRootLineage, resolveSourceIpFromExpressRequest, resolveSourceIpFromFetchHeaders, runRouterAbEd25519YaoProductRegistrationRequestScopedV1, runRouterAbEd25519YaoRegistrationSideEffectV1, runRouterAbEd25519YaoRegistrationTwoPhaseV1, runRouterAbPrewarmScheduledV1, signTenantRootCreationGrantV1, tenantRootIdentityDigestB64uV1, validateRuntimeSnapshotExpectation, walletConsoleApiWalletGetRouteDefinitionV1, walletConsoleApiWalletListRouteDefinitionV1, walletConsoleApiWalletSearchRouteDefinitionV1, walletConsoleRelayRouteDefinitionsV1, walletConsoleSignedDelegateRouteDefinitionV1, walletConsoleSponsoredEvmCallRouteDefinitionV1 };