@seams/wallet-server 0.7.3 → 0.9.0

package/dist/esm/index.js

@@ -5,11 +5,10 @@ import { authorizeSigningSessionSealRequest, buildSigningSessionSealApplyPath, b
 import { LocalWorkerVaultProxyGateway, VaultProxyUseService, buildVaultProxyUseOperation, createVaultProxyUseRouteExtension, parseVaultProxyDestination } from "./authorization/vaultProxyUse.js";
 import { SessionService, buildCorsOrigins, parseCsvList } from "./core/SessionService.js";
 import { computeEip1559TxHash, encodeEip1559SignedTxFromSignature65, ensureEvmCryptoWasm, secp256k1PrivateKey32ToPublicKey33, secp256k1PublicKey33ToEthereumAddress, signSecp256k1Recoverable } from "./core/ThresholdService/evmCryptoWasm.js";
-import { THRESHOLD_DO_OBJECT_NAME_DEFAULT, THRESHOLD_NODE_ROLE_COORDINATOR, THRESHOLD_NODE_ROLE_DEFAULT, THRESHOLD_PREFIX_DEFAULT } from "./core/defaultConfigsServer.js";
-import { formatSigningSessionSealKeyVersionForWire, parseSigningSessionSealKeyVersion } from "./shared-ts/src/threshold/keyMaterialBrands.js";
-import { buildWalletEd25519SignerId, createWalletStore, resolveWalletStoreNamespace } from "./core/WalletStore.js";
+import { buildWalletEd25519SignerId } from "./core/WalletStore.js";
 import { D1WalletStore, WALLET_STORE_D1_SCHEMA_SQL, buildWalletEcdsaSignerRecord, ensureWalletStoreD1Schema } from "./core/d1WalletStore.js";
 import { D1WalletAuthMethodStore, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, ensureWalletAuthMethodStoreD1Schema, normalizeWalletAuthMethod } from "./core/d1WalletAuthMethodStore.js";
+import { formatSigningSessionSealKeyVersionForWire, parseSigningSessionSealKeyVersion } from "./shared-ts/src/threshold/keyMaterialBrands.js";
 import { RouterAbEcdsaPresignRuntime } from "./core/routerAbSigning/RouterAbEcdsaPresignRuntime.js";
 import { registrationPreparationIdFromString } from "./core/types.js";
 import { InMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createRouterAbNormalSigningAdmissionAdapter } from "./router/domains/signingOperations/routerAbNormalSigningAdmissionCore.js";
@@ -18,7 +17,6 @@ import { normalizeRorHost, sanitizeRorOrigins } from "./router/framework/ror/nor
 import { resolveRorRpId, validateRouterApiRorOptions } from "./router/framework/ror/provider.js";
 import { handleSigningSessionSealRoutes } from "./threshold/session/signingSessionSeal/transport/fetch.js";
 import { createRouterApiModule } from "./router/framework/modules.js";
-import { D1WebAuthnCredentialBindingStore, WEBAUTHN_CREDENTIAL_BINDING_STORE_D1_SCHEMA_SQL, createWebAuthnCredentialBindingStore, ensureWebAuthnCredentialBindingStoreD1Schema, resolveWebAuthnCredentialBindingStoreNamespace } from "./core/WebAuthnCredentialBindingStore.js";
 import { StaticCloudflareTenantStorageRouteResolver, createCloudflareTenantStorageRoute, createSignerD1DoStorageTarget, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, tenantStorageRouteBackendFamily, tenantStorageRouteDiagnostic } from "./storage/tenantRoute.js";
 import { OrdinaryInactiveSignerMaterialReservationServiceV1, createOrdinaryInactiveSignerMaterialReservationServiceV1, parseOrdinaryEcdsaSignerMaterialDeactivationResultV1, parseOrdinaryEcdsaSignerMaterialWorkerReservationV1, parseOrdinaryEd25519SignerMaterialDeactivationResultV1, parseOrdinaryEd25519SignerMaterialWorkerReservationV1, validateOrdinaryInactiveSignerMaterialDeactivationRequestV1, validateOrdinaryInactiveSignerMaterialReservationRequestV1 } from "./core/signingMaterial/ordinaryInactiveSignerMaterialReservation.js";
 import { createPassthroughSigningSessionSealCipherAdapter, createSigningSessionSealCipherAdapter, createSigningSessionSealShamir3PassCipherAdapter, encodeSigningSessionSealServerLockContext } from "./threshold/session/signingSessionSeal/crypto/cipher.js";
@@ -28,26 +26,15 @@ import { createSigningSessionSealService } from "./threshold/session/signingSess
 import { createSigningSessionSealRoutesOptions } from "./threshold/session/signingSessionSeal/routesOptions.js";
 import { createSigningSessionSealOptions, parseSigningSessionSealRootConfig } from "./threshold/session/signingSessionSeal/options.js";
 import { D1IdentityStore, IDENTITY_STORE_D1_SCHEMA_SQL, ensureIdentityStoreD1Schema } from "./core/d1IdentityStore.js";
-import { D1NearPublicKeyStore, NEAR_PUBLIC_KEY_STORE_D1_SCHEMA_SQL, createNearPublicKeyStore, ensureNearPublicKeyStoreD1Schema } from "./core/NearPublicKeyStore.js";
-import { AUTH_SERVICE_CONFIG_DEFAULTS, createAuthServiceConfig, parseBool, requireEnvVar, validateConfigs } from "./core/config.js";
-import { createEcdsaWalletSessionStore, createEd25519WalletSessionStore } from "./core/ThresholdService/stores/WalletSessionStore.js";
-import { createRouterAbSigningRuntimes } from "./core/routerAbSigning/createRouterAbSigningRuntimes.js";
+import "./core/IdentityStore.js";
+import "./core/WalletAuthMethodStore.js";
+import { parseBool, requireEnvVar } from "./core/config.js";
 import { createInMemorySigningSessionSealIdempotencyStore } from "./threshold/session/signingSessionSeal/idempotency.js";
 import { createRedisTcpSigningSessionSealRateLimiter, createUpstashSigningSessionSealRateLimiter, resolveSigningSessionSealRateLimitFromEnv } from "./threshold/session/signingSessionSeal/guards/backends.js";
 import { createRedisTcpSigningSessionSealIdempotencyStore, createUpstashSigningSessionSealIdempotencyStore, resolveSigningSessionSealIdempotencyFromEnv } from "./threshold/session/signingSessionSeal/idempotencyBackends.js";
 import { registerSigningSessionSealRoutes } from "./threshold/session/signingSessionSeal/transport/express.js";
 import "./threshold/session/signingSessionSeal/index.js";
-import { createIdentityStore, resolveIdentityStoreNamespace } from "./core/IdentityStore.js";
-import { createWalletAuthMethodStore, resolveWalletAuthMethodStoreNamespace } from "./core/WalletAuthMethodStore.js";
-import { D1WebAuthnAuthenticatorStore, WEBAUTHN_AUTHENTICATOR_STORE_D1_SCHEMA_SQL, createWebAuthnAuthenticatorStore, ensureWebAuthnAuthenticatorStoreD1Schema, resolveWebAuthnAuthenticatorStoreNamespace } from "./core/WebAuthnAuthenticatorStore.js";
-import { D1WebAuthnLoginChallengeStore, WEBAUTHN_LOGIN_CHALLENGE_STORE_D1_SCHEMA_SQL, createWebAuthnLoginChallengeStore, ensureWebAuthnLoginChallengeStoreD1Schema } from "./core/WebAuthnLoginChallengeStore.js";
-import { D1WebAuthnSyncChallengeStore, WEBAUTHN_SYNC_CHALLENGE_STORE_D1_SCHEMA_SQL, createWebAuthnSyncChallengeStore, ensureWebAuthnSyncChallengeStoreD1Schema } from "./core/WebAuthnSyncChallengeStore.js";
-import { AuthService } from "./core/authService/AuthService.js";
-import "./core/AuthService.js";
-import { createThresholdEd25519KeyStore } from "./core/ThresholdService/stores/KeyStore.js";
-import { createThresholdEd25519SessionStore } from "./core/ThresholdService/stores/SessionStore.js";
-import "./core/ThresholdService/index.js";
 import { StaticRorOriginsProvider } from "./router/framework/ror/staticProvider.js";
 import { createRorOptions } from "./router/framework/ror/options.js";
 import "./router/framework/ror/index.js";
-export { AUTHORIZED_OPERATION_REPLAY_BODY_MAX_BYTES, AUTH_SERVICE_CONFIG_DEFAULTS, AuthService, AuthorizationService, CloudflareD1RouterAbNormalSigningAdmissionStore, D1IdentityStore, D1NearPublicKeyStore, D1WalletAuthMethodStore, D1WalletStore, D1WebAuthnAuthenticatorStore, D1WebAuthnCredentialBindingStore, D1WebAuthnLoginChallengeStore, D1WebAuthnSyncChallengeStore, IDENTITY_STORE_D1_SCHEMA_SQL, InMemoryRouterAbNormalSigningAdmissionStore, LocalWorkerVaultProxyGateway, NEAR_PUBLIC_KEY_STORE_D1_SCHEMA_SQL, OrdinaryInactiveSignerMaterialReservationServiceV1, RouterAbEcdsaPresignRuntime, SessionService, StaticCloudflareTenantStorageRouteResolver, StaticRorOriginsProvider, THRESHOLD_DO_OBJECT_NAME_DEFAULT, THRESHOLD_NODE_ROLE_COORDINATOR, THRESHOLD_NODE_ROLE_DEFAULT, THRESHOLD_PREFIX_DEFAULT, VaultProxyUseService, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, WALLET_STORE_D1_SCHEMA_SQL, WEBAUTHN_AUTHENTICATOR_STORE_D1_SCHEMA_SQL, WEBAUTHN_CREDENTIAL_BINDING_STORE_D1_SCHEMA_SQL, WEBAUTHN_LOGIN_CHALLENGE_STORE_D1_SCHEMA_SQL, WEBAUTHN_SYNC_CHALLENGE_STORE_D1_SCHEMA_SQL, authorizeSigningSessionSealRequest, authorizedOperationReplayBodyInit, buildActiveWalletSessionQuota, buildAuthorizedOperation, buildCorsOrigins, buildExactWalletSessionQuotaProjectionV1, buildPersistedActiveWalletSessionAuthorizationV2, buildSigningSessionSealApplyPath, buildSigningSessionSealRemovePath, buildVaultProxyUseOperation, buildWalletEcdsaSignerRecord, buildWalletEd25519SignerId, buildWalletSessionAuthorizationV2, buildWalletSessionCapabilitySubjectsV1, composeSigningSessionSealGuards, computeAuthorizedOperationResultDigest, computeEip1559TxHash, createAuthServiceConfig, createCloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareTenantStorageRoute, createEcdsaWalletSessionStore, createEd25519WalletSessionStore, createIdentityStore, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createInMemorySigningSessionSealIdempotencyStore, createInMemorySigningSessionSealRateLimiter, createNearPublicKeyStore, createOrdinaryInactiveSignerMaterialReservationServiceV1, createPassthroughSigningSessionSealCipherAdapter, createRedisTcpSigningSessionSealIdempotencyStore, createRedisTcpSigningSessionSealRateLimiter, createRorOptions, createRouterAbNormalSigningAdmissionAdapter, createRouterAbSigningRuntimes, createRouterApiModule, createSignerD1DoStorageTarget, createSigningSessionSealAuditLogger, createSigningSessionSealCipherAdapter, createSigningSessionSealOptions, createSigningSessionSealRateLimitGuard, createSigningSessionSealRoutesOptions, createSigningSessionSealService, createSigningSessionSealShamir3PassCipherAdapter, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, createThresholdEd25519KeyStore, createThresholdEd25519SessionStore, createUpstashSigningSessionSealIdempotencyStore, createUpstashSigningSessionSealRateLimiter, createVaultProxyUseRouteExtension, createWalletAuthMethodStore, createWalletStore, createWebAuthnAuthenticatorStore, createWebAuthnCredentialBindingStore, createWebAuthnLoginChallengeStore, createWebAuthnSyncChallengeStore, digestOpaqueValue, encodeEip1559SignedTxFromSignature65, encodeSigningSessionSealServerLockContext, ensureEvmCryptoWasm, ensureIdentityStoreD1Schema, ensureNearPublicKeyStoreD1Schema, ensureWalletAuthMethodStoreD1Schema, ensureWalletStoreD1Schema, ensureWebAuthnAuthenticatorStoreD1Schema, ensureWebAuthnCredentialBindingStoreD1Schema, ensureWebAuthnLoginChallengeStoreD1Schema, ensureWebAuthnSyncChallengeStoreD1Schema, exactWalletSessionCapabilitySubjectsResolveAuthority, formatSigningSessionSealKeyVersionForWire, handleSigningSessionSealRoutes, normalizeRorHost, normalizeWalletAuthMethod, parseAuthorizedOperationReplayResponse, parseBool, parseCsvList, parseHostedWalletSeamsSessionExchangeCode, parseHostedWalletSeamsSessionExchangeNonce, parseHostedWalletSessionCredentialId, parseHostedWalletSessionOperationCredentialToken, parseHostedWalletSessionOperationCredentialV1, parseMpcWalletSigningQuotaId, parseOrdinaryEcdsaSignerMaterialDeactivationResultV1, parseOrdinaryEcdsaSignerMaterialWorkerReservationV1, parseOrdinaryEd25519SignerMaterialDeactivationResultV1, parseOrdinaryEd25519SignerMaterialWorkerReservationV1, parsePrimaryWalletSessionOperationCredentialToken, parseSessionOrigin, parseSigningSessionSealApplyBody, parseSigningSessionSealKeyVersion, parseSigningSessionSealRemoveBody, parseSigningSessionSealRootConfig, parseVaultProxyDestination, parseVerifiedOwnerProofId, parseWalletSessionAuthorizationV2, parseWalletSessionId, projectActiveWalletSession, projectExactWalletSessionAuthorizationV1, registerSigningSessionSealRoutes, registrationPreparationIdFromString, requireEnvVar, resolveIdentityStoreNamespace, resolveRorRpId, resolveSigningSessionSealBasePath, resolveSigningSessionSealIdempotencyFromEnv, resolveSigningSessionSealRateLimitFromEnv, resolveWalletAuthMethodStoreNamespace, resolveWalletStoreNamespace, resolveWebAuthnAuthenticatorStoreNamespace, resolveWebAuthnCredentialBindingStoreNamespace, sanitizeRorOrigins, secp256k1PrivateKey32ToPublicKey33, secp256k1PublicKey33ToEthereumAddress, signSecp256k1Recoverable, signingSessionSealAuthorizeStatusCode, signingSessionSealStatusCode, tenantStorageRouteBackendFamily, tenantStorageRouteDiagnostic, validateConfigs, validateOrdinaryInactiveSignerMaterialDeactivationRequestV1, validateOrdinaryInactiveSignerMaterialReservationRequestV1, validateRouterApiRorOptions, walletSessionAuthorizationV2RecordsEqual, walletSessionCapabilitySubjectsV1Equal };
+export { AUTHORIZED_OPERATION_REPLAY_BODY_MAX_BYTES, AuthorizationService, CloudflareD1RouterAbNormalSigningAdmissionStore, D1IdentityStore, D1WalletAuthMethodStore, D1WalletStore, IDENTITY_STORE_D1_SCHEMA_SQL, InMemoryRouterAbNormalSigningAdmissionStore, LocalWorkerVaultProxyGateway, OrdinaryInactiveSignerMaterialReservationServiceV1, RouterAbEcdsaPresignRuntime, SessionService, StaticCloudflareTenantStorageRouteResolver, StaticRorOriginsProvider, VaultProxyUseService, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, WALLET_STORE_D1_SCHEMA_SQL, authorizeSigningSessionSealRequest, authorizedOperationReplayBodyInit, buildActiveWalletSessionQuota, buildAuthorizedOperation, buildCorsOrigins, buildExactWalletSessionQuotaProjectionV1, buildPersistedActiveWalletSessionAuthorizationV2, buildSigningSessionSealApplyPath, buildSigningSessionSealRemovePath, buildVaultProxyUseOperation, buildWalletEcdsaSignerRecord, buildWalletEd25519SignerId, buildWalletSessionAuthorizationV2, buildWalletSessionCapabilitySubjectsV1, composeSigningSessionSealGuards, computeAuthorizedOperationResultDigest, computeEip1559TxHash, createCloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareTenantStorageRoute, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createInMemorySigningSessionSealIdempotencyStore, createInMemorySigningSessionSealRateLimiter, createOrdinaryInactiveSignerMaterialReservationServiceV1, createPassthroughSigningSessionSealCipherAdapter, createRedisTcpSigningSessionSealIdempotencyStore, createRedisTcpSigningSessionSealRateLimiter, createRorOptions, createRouterAbNormalSigningAdmissionAdapter, createRouterApiModule, createSignerD1DoStorageTarget, createSigningSessionSealAuditLogger, createSigningSessionSealCipherAdapter, createSigningSessionSealOptions, createSigningSessionSealRateLimitGuard, createSigningSessionSealRoutesOptions, createSigningSessionSealService, createSigningSessionSealShamir3PassCipherAdapter, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, createUpstashSigningSessionSealIdempotencyStore, createUpstashSigningSessionSealRateLimiter, createVaultProxyUseRouteExtension, digestOpaqueValue, encodeEip1559SignedTxFromSignature65, encodeSigningSessionSealServerLockContext, ensureEvmCryptoWasm, ensureIdentityStoreD1Schema, ensureWalletAuthMethodStoreD1Schema, ensureWalletStoreD1Schema, exactWalletSessionCapabilitySubjectsResolveAuthority, formatSigningSessionSealKeyVersionForWire, handleSigningSessionSealRoutes, normalizeRorHost, normalizeWalletAuthMethod, parseAuthorizedOperationReplayResponse, parseBool, parseCsvList, parseHostedWalletSeamsSessionExchangeCode, parseHostedWalletSeamsSessionExchangeNonce, parseHostedWalletSessionCredentialId, parseHostedWalletSessionOperationCredentialToken, parseHostedWalletSessionOperationCredentialV1, parseMpcWalletSigningQuotaId, parseOrdinaryEcdsaSignerMaterialDeactivationResultV1, parseOrdinaryEcdsaSignerMaterialWorkerReservationV1, parseOrdinaryEd25519SignerMaterialDeactivationResultV1, parseOrdinaryEd25519SignerMaterialWorkerReservationV1, parsePrimaryWalletSessionOperationCredentialToken, parseSessionOrigin, parseSigningSessionSealApplyBody, parseSigningSessionSealKeyVersion, parseSigningSessionSealRemoveBody, parseSigningSessionSealRootConfig, parseVaultProxyDestination, parseVerifiedOwnerProofId, parseWalletSessionAuthorizationV2, parseWalletSessionId, projectActiveWalletSession, projectExactWalletSessionAuthorizationV1, registerSigningSessionSealRoutes, registrationPreparationIdFromString, requireEnvVar, resolveRorRpId, resolveSigningSessionSealBasePath, resolveSigningSessionSealIdempotencyFromEnv, resolveSigningSessionSealRateLimitFromEnv, sanitizeRorOrigins, secp256k1PrivateKey32ToPublicKey33, secp256k1PublicKey33ToEthereumAddress, signSecp256k1Recoverable, signingSessionSealAuthorizeStatusCode, signingSessionSealStatusCode, tenantStorageRouteBackendFamily, tenantStorageRouteDiagnostic, validateOrdinaryInactiveSignerMaterialDeactivationRequestV1, validateOrdinaryInactiveSignerMaterialReservationRequestV1, validateRouterApiRorOptions, walletSessionAuthorizationV2RecordsEqual, walletSessionCapabilitySubjectsV1Equal };

package/dist/esm/localHostedWalletGatewayHandler.js

@@ -1,7 +1,10 @@
+import { requireCanonicalString } from "./shared-ts/src/utils/validation.js";
 import "./shared-ts/src/utils/routerAbEd25519Yao.js";
 import { WALLET_CONSOLE_OP_PATHS_V1 } from "./router/cloudflare/runtime/walletConsoleOps.js";
+import { WalletHomeCustodyBinding } from "./router/cloudflare/runtime/routerAbServiceBindings.js";
 import { createStaticWalletConsoleBindingV1, parseStaticWalletConsoleBindingConfigV1 } from "./router/cloudflare/runtime/staticWalletConsoleBinding.js";
 import { handleSplitGatewayRequest } from "./hosted-wallet-gateway.js";
+import { LocalRegistrationSetupAuthority } from "./localRegistrationSetupAuthority.js";
 import { localPresignCancellationProbe } from "./localIntendedPresignCancellation.js";
 import { LOCAL_INTENDED_YAO_FAULT_HEADER_V1, LOCAL_INTENDED_YAO_FAULT_TOKEN_HEADER_V1, LocalIntendedYaoFaultControllerV1, parseLocalIntendedYaoFaultModeV1, parseLocalIntendedYaoFaultTokenV1, requestWithoutLocalIntendedYaoFaultHeadersV1, responseWithLocalIntendedYaoFaultOutcomeV1 } from "./localIntendedYaoFault.js";
 import { localMaterialAdmissionFault } from "./localIntendedMaterialAdmissionFault.js";
@@ -9,7 +12,7 @@ import { LOCAL_INTENDED_ECDSA_FINALIZE_FAULT_HEADER_V1, LOCAL_INTENDED_ECDSA_FIN
 import { LOCAL_INTENDED_YAO_FINALIZE_FAULT_HEADER_V1, LOCAL_INTENDED_YAO_FINALIZE_FAULT_TOKEN_HEADER_V1, LocalIntendedYaoFinalizeFaultDatabaseV1, parseLocalIntendedYaoFinalizeFaultModeV1, parseLocalIntendedYaoFinalizeFaultTokenV1, requestWithoutLocalIntendedYaoFinalizeFaultHeadersV1, responseWithLocalIntendedYaoFinalizeFaultOutcomeV1 } from "./localIntendedYaoFinalizeFault.js";
 import { LOCAL_INTENDED_YAO_RECOVERY_FAULT_HEADER_V1, LOCAL_INTENDED_YAO_RECOVERY_FAULT_TOKEN_HEADER_V1, LocalIntendedYaoRecoveryFaultControllerV1, parseLocalIntendedYaoRecoveryFaultModeV1, parseLocalIntendedYaoRecoveryFaultTokenV1, releaseLocalIntendedYaoRecoveryExecuteV1, requestWithoutLocalIntendedYaoRecoveryFaultHeadersV1, responseWithLocalIntendedYaoRecoveryFaultOutcomeV1 } from "./localIntendedYaoRecoveryFault.js";
 import { LOCAL_INTENDED_YAO_EXPORT_FAULT_HEADER_V1, LOCAL_INTENDED_YAO_EXPORT_FAULT_TOKEN_HEADER_V1, LocalIntendedYaoExportFaultDatabaseV1, parseLocalIntendedYaoExportFaultModeV1, parseLocalIntendedYaoExportFaultTokenV1, requestWithoutLocalIntendedYaoExportFaultHeadersV1, responseWithLocalIntendedYaoExportFaultOutcomeV1 } from "./localIntendedYaoExportFault.js";
-import { LOCAL_INTENDED_YAO_SIGNING_FAULT_HEADER_V1, LOCAL_INTENDED_YAO_SIGNING_FAULT_TOKEN_HEADER_V1, LocalIntendedYaoSigningFaultControllerV1, commandLocalIntendedSigningWorkerHoldV1, parseLocalIntendedYaoSigningFaultModeV1, parseLocalIntendedYaoSigningFaultTokenV1, releaseLocalIntendedYaoSigningFinalizeV1, requestWithoutLocalIntendedYaoSigningFaultHeadersV1, responseWithLocalIntendedYaoSigningFaultOutcomeV1 } from "./localIntendedYaoSigningFault.js";
+import { LOCAL_INTENDED_YAO_SIGNING_FAULT_HEADER_V1, LOCAL_INTENDED_YAO_SIGNING_FAULT_TOKEN_HEADER_V1, LocalIntendedYaoSigningFaultControllerV1, parseLocalIntendedYaoSigningFaultModeV1, parseLocalIntendedYaoSigningFaultTokenV1, releaseLocalIntendedYaoSigningFinalizeV1, requestWithoutLocalIntendedYaoSigningFaultHeadersV1, responseWithLocalIntendedYaoSigningFaultOutcomeV1 } from "./localIntendedYaoSigningFault.js";
 import { LOCAL_INTENDED_LINK_EXECUTE_FAULT_HEADER_V1, LOCAL_INTENDED_LINK_EXECUTE_FAULT_TOKEN_HEADER_V1, LocalIntendedLinkExecuteFaultControllerV1, parseLocalIntendedLinkExecuteFaultModeV1, parseLocalIntendedLinkExecuteFaultTokenV1, requestWithoutLocalIntendedLinkExecuteFaultHeadersV1, responseWithLocalIntendedLinkExecuteFaultOutcomeV1 } from "./localIntendedLinkExecuteFault.js";
 import { LINKED_DEVICE_REVOKE_PATH_PATTERN_V1, LOCAL_INTENDED_REVOKE_FAULT_HEADER_V1, LOCAL_INTENDED_REVOKE_FAULT_TOKEN_HEADER_V1, LocalIntendedRevokeFaultDatabaseV1, WALLET_REVOKE_AUTH_METHOD_PATH_PATTERN_V1, parseLocalIntendedRevokeFaultModeV1, parseLocalIntendedRevokeFaultTokenV1, requestWithoutLocalIntendedRevokeFaultHeadersV1, responseWithLocalIntendedRevokeFaultOutcomeV1 } from "./localIntendedRevokeFault.js";
 import { LOCAL_INTENDED_SESSION_ADMISSION_FAULT_HEADER_V1, LOCAL_INTENDED_SESSION_ADMISSION_FAULT_TOKEN_HEADER_V1, LocalIntendedSessionAdmissionFaultDatabaseV1, parseLocalIntendedSessionAdmissionFaultModeV1, parseLocalIntendedSessionAdmissionFaultTokenV1, requestWithoutLocalIntendedSessionAdmissionFaultHeadersV1, responseWithLocalIntendedSessionAdmissionFaultOutcomeV1 } from "./localIntendedSessionAdmissionFault.js";
@@ -102,8 +105,21 @@ async function handleEcdsaRespondFault(request, env, ctx, dependencies, fault, e
 */
 async function handleLocalHostedWalletGatewayRequestV1(request, env, ctx, dependencies) {
 	const config = parseStaticWalletConsoleBindingConfigV1(JSON.parse(env.WALLET_LOCAL_DEPLOYMENT_JSON));
+	const tenantScope = {
+		namespace: requireCanonicalString(env.SEAMS_TENANT_STORAGE_NAMESPACE, "Local namespace"),
+		orgId: config.deployment.orgId,
+		projectId: config.deployment.projectId,
+		envId: config.deployment.environmentKey
+	};
+	dependencies = {
+		emailOtpDeliveryProvider: dependencies?.emailOtpDeliveryProvider,
+		signerWasm: dependencies?.signerWasm,
+		registrationAuthority: new LocalRegistrationSetupAuthority(env.SIGNER_DB, tenantScope)
+	};
 	const gatewayEnv = {
 		...env,
+		MPC_ROUTER: new WalletHomeCustodyBinding(env.MPC_ROUTER, "US", env.SIGNER_DB, tenantScope.namespace, null),
+		SIGNING_WORKER: new WalletHomeCustodyBinding(env.SIGNING_WORKER, "US", env.SIGNER_DB, tenantScope.namespace, null),
 		WALLET_CONSOLE: createStaticWalletConsoleBindingV1(config)
 	};
 	const canceledPresign = await localPresignCancellationProbe(request, gatewayEnv, ctx, dependencies);
@@ -151,7 +167,7 @@ async function handleLocalHostedWalletGatewayRequestV1(request, env, ctx, depend
 	const token = parseLocalIntendedYaoFaultTokenV1(rawToken);
 	const url = new URL(request.url);
 	if (url.protocol !== "http:" || url.hostname !== "127.0.0.1" || url.pathname !== "/router-ab/ed25519/yao/registration/execute" || request.method !== "POST" || !mode || !token) return Response.json({ code: "invalid_intended_yao_fault" }, { status: 400 });
-	const controller = new LocalIntendedYaoFaultControllerV1(env.MPC_ROUTER.fetch.bind(env.MPC_ROUTER));
+	const controller = new LocalIntendedYaoFaultControllerV1(gatewayEnv.MPC_ROUTER.fetch.bind(gatewayEnv.MPC_ROUTER));
 	controller.arm(mode);
 	return responseWithLocalIntendedYaoFaultOutcomeV1(await handleSplitGatewayRequest(sanitizedRequest, {
 		...gatewayEnv,
@@ -250,7 +266,6 @@ async function handleYaoSigningFault(request, env, ctx, dependencies, rawMode, r
 	const url = new URL(request.url);
 	if (url.protocol !== "http:" || url.hostname !== "127.0.0.1" || url.pathname !== "/router-ab/ed25519/sign" || request.method !== "POST" || !mode || !token) return Response.json({ code: "invalid_intended_yao_signing_fault" }, { status: 400 });
 	if (mode === "release_signing_finalize") return await releaseLocalIntendedYaoSigningFinalizeV1(env.MPC_ROUTER, token);
-	if (mode === "arm_signing_worker_hold" || mode === "read_signing_worker_hold") return await commandLocalIntendedSigningWorkerHoldV1(env.SIGNING_WORKER, env.ROUTER_AB_GATEWAY_TO_SIGNING_WORKER_PRESIGN_AUTH_SECRET, mode, await request.json().catch(() => null));
 	const controller = new LocalIntendedYaoSigningFaultControllerV1(env.MPC_ROUTER.fetch.bind(env.MPC_ROUTER), mode, token);
 	return responseWithLocalIntendedYaoSigningFaultOutcomeV1(await handleSplitGatewayRequest(requestWithoutLocalIntendedYaoSigningFaultHeadersV1(request), {
 		...env,

package/dist/esm/localIntendedYaoSigningFault.js

@@ -4,16 +4,12 @@ const LOCAL_INTENDED_YAO_SIGNING_FAULT_HEADER_V1 = "x-seams-intended-yao-signing
 const LOCAL_INTENDED_YAO_SIGNING_FAULT_TOKEN_HEADER_V1 = "x-seams-intended-yao-signing-fault-token-v1";
 const LOCAL_INTENDED_YAO_FAULT_PROOF_HEADER_V1 = "x-seams-intended-yao-fault-proof-v1";
 const ROUTER_AB_ED25519_SIGNING_FINALIZE_PATH_V1 = "/router-ab/ed25519/sign";
-const SIGNING_WORKER_LOCAL_INTENDED_HOLD_URL_V1 = "https://signing-worker.router-ab.internal/router-ab/signing-worker/local-intended/hold";
-const ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1 = "x-router-ab-internal-service-auth";
 const keptFinalizes = /* @__PURE__ */ new Map();
 function parseLocalIntendedYaoSigningFaultModeV1(value) {
 	switch (value) {
 		case "capture_signing_finalize":
 		case "withhold_signing_finalize":
-		case "release_signing_finalize":
-		case "arm_signing_worker_hold":
-		case "read_signing_worker_hold": return value;
+		case "release_signing_finalize": return value;
 		default: return null;
 	}
 }
@@ -82,30 +78,6 @@ async function releaseLocalIntendedYaoSigningFinalizeV1(router, token) {
 		original: kept.original
 	});
 }
-/**
-* Arms or reads the SigningWorker's hold on one wallet's next NEAR finalize,
-* with the Gateway's own SigningWorker credential, and answers with the
-* SigningWorker's reply.
-*/
-async function commandLocalIntendedSigningWorkerHoldV1(signingWorker, credential, mode, body) {
-	const walletId = body?.wallet_id;
-	if (!credential || typeof walletId !== "string" || walletId === "") return Response.json({ code: "invalid_intended_signing_worker_hold" }, { status: 400 });
-	const reply = await signingWorker.fetch(new Request(SIGNING_WORKER_LOCAL_INTENDED_HOLD_URL_V1, {
-		method: "POST",
-		headers: {
-			"content-type": "application/json",
-			[ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1]: credential
-		},
-		body: JSON.stringify({
-			command: mode === "arm_signing_worker_hold" ? "arm" : "read",
-			wallet_id: walletId
-		})
-	}));
-	return Response.json({
-		status: reply.status,
-		body: await reply.text()
-	});
-}
 function requestWithoutLocalIntendedYaoSigningFaultHeadersV1(request) {
 	const headers = new Headers(request.headers);
 	headers.delete(LOCAL_INTENDED_YAO_SIGNING_FAULT_HEADER_V1);
@@ -122,6 +94,6 @@ function responseWithLocalIntendedYaoSigningFaultOutcomeV1(response, outcome) {
 	});
 }
 //#endregion
-export { LOCAL_INTENDED_YAO_SIGNING_FAULT_HEADER_V1, LOCAL_INTENDED_YAO_SIGNING_FAULT_TOKEN_HEADER_V1, LocalIntendedYaoSigningFaultControllerV1, ROUTER_AB_ED25519_SIGNING_FINALIZE_PATH_V1, commandLocalIntendedSigningWorkerHoldV1, parseLocalIntendedYaoSigningFaultModeV1, parseLocalIntendedYaoSigningFaultTokenV1, releaseLocalIntendedYaoSigningFinalizeV1, requestWithoutLocalIntendedYaoSigningFaultHeadersV1, responseWithLocalIntendedYaoSigningFaultOutcomeV1 };
+export { LOCAL_INTENDED_YAO_SIGNING_FAULT_HEADER_V1, LOCAL_INTENDED_YAO_SIGNING_FAULT_TOKEN_HEADER_V1, LocalIntendedYaoSigningFaultControllerV1, ROUTER_AB_ED25519_SIGNING_FINALIZE_PATH_V1, parseLocalIntendedYaoSigningFaultModeV1, parseLocalIntendedYaoSigningFaultTokenV1, releaseLocalIntendedYaoSigningFinalizeV1, requestWithoutLocalIntendedYaoSigningFaultHeadersV1, responseWithLocalIntendedYaoSigningFaultOutcomeV1 };
 
 //# sourceMappingURL=localIntendedYaoSigningFault.js.map

package/dist/esm/localRegistrationSetupAuthority.js

@@ -0,0 +1,96 @@
+import { D1RegistrationCeremonyRecordStore } from "./router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore.js";
+import { parseWalletRegistrationSetupReservation, proposeWalletRegistrationSetup, walletRegistrationSetupRequestDigest } from "./router/domains/walletRegistration/walletRegistrationReservation.js";
+//#region src/localRegistrationSetupAuthority.ts
+/** The standalone host never relocates a wallet, so every wallet keeps its first generation. */
+const LOCAL_OWNERSHIP_GENERATION = 1;
+var LocalRegistrationSetupAuthority = class {
+	constructor(database, scope) {
+		this.scope = scope;
+		this.storage = new D1RegistrationCeremonyRecordStore({
+			database,
+			scope,
+			keyPrefix: "local-registration-authority:"
+		});
+	}
+	async reserve(input) {
+		const scope = input.runtimePolicyScope;
+		if (!scope || input.orgId !== this.scope.orgId || scope.orgId !== this.scope.orgId || scope.projectId !== this.scope.projectId || scope.envId !== this.scope.envId) return {
+			ok: false,
+			code: "scope_conflict",
+			message: "Registration scope differs from the local authority"
+		};
+		const requestDigest = await walletRegistrationSetupRequestDigest(this.scope.namespace, input);
+		const stored = await this.storage.insertOrRead({
+			scope: "setup-reservation",
+			id: input.request.registrationOperationId,
+			value: {
+				requestDigest,
+				reservation: proposeWalletRegistrationSetup(input)
+			},
+			expiresAtMs: Number.MAX_SAFE_INTEGER
+		});
+		if (stored.value.requestDigest !== requestDigest) return {
+			ok: false,
+			code: "request_conflict",
+			message: "Registration operation was already used for another request"
+		};
+		const reservation = parseWalletRegistrationSetupReservation(stored.value.reservation);
+		await this.storage.putExact({
+			scope: "setup-ceremony-index",
+			id: reservation.ceremonyId,
+			value: { walletId: reservation.walletId },
+			expiresAtMs: Number.MAX_SAFE_INTEGER
+		});
+		const terminal = await this.storage.get("setup-terminal", reservation.ceremonyId);
+		if (terminal?.value.outcome === "cancelled") return {
+			ok: false,
+			code: "registration_cancelled",
+			message: "Registration was cancelled"
+		};
+		return {
+			ok: true,
+			reservation,
+			ownershipGeneration: LOCAL_OWNERSHIP_GENERATION,
+			lifecycle: terminal?.value.outcome === "established" ? "established" : "reserved"
+		};
+	}
+	async admitHome(input) {
+		const identity = await this.storage.get("setup-ceremony-index", input.ceremonyId);
+		const terminal = await this.storage.get("setup-terminal", input.ceremonyId);
+		if (!identity || identity.value.walletId !== input.walletId || terminal?.value.outcome === "cancelled") return {
+			ok: false,
+			code: "wallet_home_unavailable",
+			message: "Registration home is unavailable"
+		};
+		return {
+			ok: true,
+			ownershipGeneration: LOCAL_OWNERSHIP_GENERATION,
+			purpose: terminal?.value.outcome === "established" ? "ordinary" : "registration"
+		};
+	}
+	async complete(input) {
+		const identity = await this.storage.get("setup-ceremony-index", input.ceremonyId);
+		if (!identity || identity.value.walletId !== input.walletId) return {
+			ok: false,
+			code: "home_conflict",
+			message: "Registration completion does not match its reservation"
+		};
+		return (await this.storage.insertOrRead({
+			scope: "setup-terminal",
+			id: input.ceremonyId,
+			value: {
+				walletId: input.walletId,
+				outcome: input.outcome
+			},
+			expiresAtMs: Number.MAX_SAFE_INTEGER
+		})).value.outcome === input.outcome ? { ok: true } : {
+			ok: false,
+			code: "registration_conflict",
+			message: "Registration terminal outcome conflicts with its reservation"
+		};
+	}
+};
+//#endregion
+export { LocalRegistrationSetupAuthority };
+
+//# sourceMappingURL=localRegistrationSetupAuthority.js.map

package/dist/esm/router/auth/authRequestValidation.js

@@ -76,23 +76,15 @@ function parseOptionalPositiveInteger(raw, fieldName) {
 		value: Math.floor(value)
 	};
 }
-function parseAuthProviderAction(input) {
-	const provider = normalizeOptionalTrimmedString(input.provider);
-	const action = normalizeOptionalTrimmedString(input.action);
-	if (provider === "passkey" && action === "options") return { kind: "passkey_options" };
-	if (provider === "passkey" && action === "verify") return { kind: "passkey_verify" };
-	if (provider === "google" && action === "options") return { kind: "google_options" };
-	if (provider === "google" && action === "verify") return { kind: "google_verify" };
-	if (provider === "github" && action === "options") return { kind: "github_options" };
-	return null;
-}
 function parseAuthProviderActionPath(pathname) {
-	const parts = String(pathname || "").split("/").filter(Boolean);
-	if (parts.length !== 3 || parts[0] !== "auth") return null;
-	return parseAuthProviderAction({
-		provider: parts[1],
-		action: parts[2]
-	});
+	switch (pathname) {
+		case "/auth/passkey/options": return { kind: "passkey_options" };
+		case "/auth/passkey/verify": return { kind: "passkey_verify" };
+		case "/auth/google/options": return { kind: "google_options" };
+		case "/auth/google/verify": return { kind: "google_verify" };
+		case "/auth/github/options": return { kind: "github_options" };
+		default: return null;
+	}
 }
 function parsePasskeyLoginOptionsRequest(raw) {
 	const body = requireJsonObject(raw);

package/dist/esm/router/auth/commonRouterUtils.js

@@ -109,12 +109,23 @@ async function validateRouterAbEd25519WalletSessionInputs(input) {
 	const token = extractBearerCredential(input.headers);
 	if (!token) return walletSessionFailure("wallet_session_missing");
 	const nowMs = input.nowMs || Date.now;
+	let read;
 	let resolution;
 	try {
-		resolution = await resolveWalletSessionOperationCredentialAdmission({
-			authorizationSessions,
+		read = await authorizationSessions.readEd25519WalletSessionSigningReadByOperationCredential({
+			tenantId: authorizationSessions.tenantId,
 			token,
 			nowMs: nowMs(),
+			materialActivation: input.materialActivation
+		});
+		if (!read) return {
+			ok: false,
+			code: "wallet_session_invalid",
+			message: walletSessionFailureMessage("wallet_session_invalid")
+		};
+		resolution = resolveWalletSessionOperationCredentialAdmissionFromContext({
+			context: read.context,
+			nowMs: nowMs(),
 			operation: {
 				keyFamily: "ed25519",
 				operationKind: input.operationKind
@@ -123,18 +134,14 @@ async function validateRouterAbEd25519WalletSessionInputs(input) {
 	} catch {
 		return walletSessionFailure("wallet_session_unavailable");
 	}
-	if (resolution.kind === "rejected") return walletSessionFailure("wallet_session_scope_mismatch");
-	if (resolution.kind === "not_found") return {
-		ok: false,
-		code: "wallet_session_invalid",
-		message: walletSessionFailureMessage("wallet_session_invalid")
-	};
-	if (resolution.admission.curve !== "ed25519") return walletSessionFailure("wallet_session_scope_mismatch");
+	if (resolution.kind === "rejected" || resolution.admission.curve !== "ed25519") return walletSessionFailure("wallet_session_scope_mismatch");
 	return {
 		ok: true,
 		kind: "wallet_session_operation_credential_v1",
 		admission: resolution.admission,
-		context: resolution.admission.context
+		context: resolution.admission.context,
+		signerRead: read.signerRead,
+		policyRead: read.policyRead
 	};
 }
 async function validateEcdsaPreprocessingSession(input) {

package/dist/esm/router/auth/routerApiCredentialAuth.js

@@ -8,7 +8,7 @@ function routeAuthNotConfigured(message) {
 		message
 	};
 }
-async function resolvePublishableKeyApiCredentialAuth(input) {
+function parsePublishableKeyRequest(input) {
 	if (input.route.auth.plane !== "api_credentials") return routeAuthNotConfigured(input.routeAuthNotConfiguredMessage);
 	const publishableKey = extractBearerCredential(input.headers);
 	if (!publishableKey) return {
@@ -31,23 +31,42 @@ async function resolvePublishableKeyApiCredentialAuth(input) {
 		code: "forbidden",
 		message: `publishable_key_environment_mismatch: ${input.missingEnvironmentMessage}`
 	};
-	const authResult = await input.publishableKeyAuth.authenticate({
-		secret: publishableKey,
-		origin,
-		environmentId
+	return {
+		ok: true,
+		request: {
+			secret: publishableKey,
+			origin,
+			environmentId
+		}
+	};
+}
+async function resolveWalletRegistrationContext(input) {
+	const parsed = parsePublishableKeyRequest(input);
+	if (!parsed.ok) return parsed;
+	return input.registrationContext.resolve({
+		...parsed.request,
+		registration: input.registration
 	});
+}
+async function resolvePublishableKeyApiCredentialAuth(input) {
+	const parsed = parsePublishableKeyRequest(input);
+	if (!parsed.ok) return parsed;
+	const authResult = await input.publishableKeyAuth.authenticate(parsed.request);
 	if (!authResult.ok) return {
 		ok: false,
 		status: authResult.status,
 		code: authResult.status === 403 ? "forbidden" : "unauthorized",
 		message: `${authResult.code}: ${authResult.message}`
 	};
+	return publishableKeyRoutePrincipal(authResult.principal);
+}
+async function publishableKeyRoutePrincipal(principal) {
 	return {
 		ok: true,
 		principal: {
 			kind: "api_credentials",
 			credentialType: "publishable_key",
-			principal: authResult.principal
+			principal
 		}
 	};
 }
@@ -86,6 +105,6 @@ async function resolveSecretKeyApiCredentialAuth(input) {
 	};
 }
 //#endregion
-export { resolvePublishableKeyApiCredentialAuth, resolveSecretKeyApiCredentialAuth };
+export { publishableKeyRoutePrincipal, resolvePublishableKeyApiCredentialAuth, resolveSecretKeyApiCredentialAuth, resolveWalletRegistrationContext };
 
 //# sourceMappingURL=routerApiCredentialAuth.js.map

package/dist/esm/router/auth/walletRegistrationContext.js

@@ -0,0 +1,49 @@
+//#region src/router/auth/walletRegistrationContext.ts
+function unavailableRegistrationContext() {
+	return {
+		ok: false,
+		status: 500,
+		code: "registration_environment_unavailable",
+		message: "Wallet registration requires the authenticated active environment"
+	};
+}
+/** Join the authenticated credential to its exact active environment at the boundary. */
+function walletRegistrationContext(input, principal, environment) {
+	if (principal.environmentId !== input.environmentId || environment.id !== principal.environmentId || environment.status !== "ACTIVE" || !environment.projectId || !environment.key || !environment.signingRootVersion || principal.projectId !== void 0 && principal.projectId !== environment.projectId || principal.envId !== void 0 && principal.envId !== environment.key) return unavailableRegistrationContext();
+	return {
+		ok: true,
+		principal,
+		environment: {
+			id: environment.id,
+			projectId: environment.projectId,
+			key: environment.key,
+			signingRootVersion: environment.signingRootVersion,
+			status: "ACTIVE"
+		}
+	};
+}
+async function resolveRegistrationContext(auth, environments, input) {
+	try {
+		const result = await auth.authenticate(input);
+		if (!result.ok) return result;
+		const principal = result.principal;
+		const records = await environments.listEnvironments({
+			orgId: principal.orgId,
+			actorUserId: "runtime-scope-bootstrap",
+			roles: ["system"],
+			environmentId: principal.environmentId,
+			...principal.projectId ? { projectId: principal.projectId } : {}
+		}, { status: "ACTIVE" });
+		for (const environment of records) if (environment.id === principal.environmentId) return walletRegistrationContext(input, principal, environment);
+		return unavailableRegistrationContext();
+	} catch {
+		return unavailableRegistrationContext();
+	}
+}
+function createWalletRegistrationContextResolver(auth, environments) {
+	return { resolve: resolveRegistrationContext.bind(void 0, auth, environments) };
+}
+//#endregion
+export { createWalletRegistrationContextResolver, unavailableRegistrationContext, walletRegistrationContext };
+
+//# sourceMappingURL=walletRegistrationContext.js.map

package/dist/esm/router/auth/webAuthnCredentialCodecs.js

@@ -1,7 +1,6 @@
+import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import { base64Decode, base64UrlDecode, base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
 import "../../shared-ts/src/utils/encoders.js";
-import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import "../../shared-ts/src/utils/validation.js";
 import { failure } from "../../shared-ts/src/utils/failure.js";
 import { errorMessage } from "../../shared-ts/src/utils/errors.js";
 //#region src/router/auth/webAuthnCredentialCodecs.ts

package/dist/esm/router/cloudflare/d1/auth/d1AuthorizationAssembly.js

@@ -0,0 +1,88 @@
+import { capabilityPolicyPort } from "../../../../authorization/capabilityPolicy.js";
+import { AuthorizationService } from "../../../../authorization/service.js";
+import { CloudflareD1WebAuthnStore } from "../webauthn/d1WebAuthnStore.js";
+import { CloudflareD1WebAuthnAuthService } from "../webauthn/d1WebAuthnAuthService.js";
+import { CloudflareD1AuthorizationStore } from "../authorization/d1AuthorizationStore.js";
+import { CloudflareD1EmailOtpRateLimitStore } from "../emailOtp/d1EmailOtpRateLimitStore.js";
+import { CloudflareD1GoogleEmailOtpRegistrationAttemptStore } from "../emailOtp/d1GoogleEmailOtpRegistrationAttemptStore.js";
+import { D1IdentityStore } from "../../../../core/d1IdentityStore.js";
+import { CloudflareD1WalletCustodyCommitStore } from "../passkeyCustody/d1WalletCustodyCommitStore.js";
+//#region src/router/cloudflare/d1/auth/d1AuthorizationAssembly.ts
+function createD1AuthorizationAssembly(options, sessionRouting) {
+	const authorizationStore = new CloudflareD1AuthorizationStore(options);
+	return {
+		authorizationStore,
+		authorizationService: new AuthorizationService({
+			policy: capabilityPolicyPort,
+			sessions: authorizationStore,
+			evidence: authorizationStore,
+			grants: authorizationStore,
+			authorizedOperations: authorizationStore,
+			audit: authorizationStore,
+			sessionRouting
+		})
+	};
+}
+function createD1WalletCustodyStore(options, walletAuthMethodStore) {
+	return new CloudflareD1WalletCustodyCommitStore({
+		walletAuthMethodStore,
+		credentialClaims: options.credentialClaims,
+		database: options.database,
+		scope: {
+			namespace: options.namespace,
+			orgId: options.orgId,
+			projectId: options.projectId,
+			envId: options.envId
+		},
+		recoveryRouting: options.recoveryRouting
+	});
+}
+function createD1WebAuthnAssembly(options, walletAuthMethodStore, walletManifestSource) {
+	const webAuthnStore = new CloudflareD1WebAuthnStore({
+		syncChallenges: options.syncChallenges,
+		credentialClaims: options.credentialClaims,
+		database: options.database,
+		namespace: options.namespace,
+		orgId: options.orgId,
+		projectId: options.projectId,
+		envId: options.envId
+	});
+	return {
+		webAuthnStore,
+		webAuthnAuthService: new CloudflareD1WebAuthnAuthService({
+			webAuthnStore,
+			walletAuthMethodStore,
+			walletManifestSource,
+			lifecycleRouting: options.lifecycleRouting
+		})
+	};
+}
+function createD1IdentityStore(options) {
+	if (options.identityStore) return options.identityStore;
+	return new D1IdentityStore({
+		database: options.database,
+		namespace: options.namespace,
+		orgId: options.orgId,
+		projectId: options.projectId,
+		envId: options.envId,
+		ensureSchema: false
+	});
+}
+function createD1GoogleRegistrationAttempts(options, prepare) {
+	return options.googleRegistrationAttempts ?? new CloudflareD1GoogleEmailOtpRegistrationAttemptStore({
+		prepare,
+		batch: options.database.batch.bind(options.database),
+		orgId: options.orgId
+	});
+}
+function createD1EmailOtpRateLimits(options, prepare) {
+	return new CloudflareD1EmailOtpRateLimitStore({
+		prepare,
+		batch: options.database.batch.bind(options.database),
+		rateLimits: options.emailOtp.rateLimits
+	});
+}
+//#endregion
+export { createD1AuthorizationAssembly, createD1EmailOtpRateLimits, createD1GoogleRegistrationAttempts, createD1IdentityStore, createD1WalletCustodyStore, createD1WebAuthnAssembly };
+
+//# sourceMappingURL=d1AuthorizationAssembly.js.map

package/dist/esm/router/cloudflare/d1/auth/d1AuthorizedOperationRouteService.js

@@ -7,6 +7,8 @@ function createD1AuthorizedOperationRouteService(assembly) {
 		tenantId: tenantId.value,
 		resolveEcdsaWalletSessionOperation: assembly.authorizationStore.resolveEcdsaWalletSessionOperation.bind(assembly.authorizationStore),
 		admitEcdsaWalletSessionOperation: assembly.authorizationStore.admitEcdsaWalletSessionOperation.bind(assembly.authorizationStore),
+		admitEd25519WalletSessionOperation: assembly.authorizationStore.admitEd25519WalletSessionOperation.bind(assembly.authorizationStore),
+		resolveEd25519WalletSessionOperation: assembly.authorizationStore.resolveEd25519WalletSessionOperation.bind(assembly.authorizationStore),
 		readPinnedOwnerWalletScope: assembly.authorizationStore.readPinnedOwnerWalletScope.bind(assembly.authorizationStore),
 		buildVerifiedOwnerProof: assembly.authorizationService.buildVerifiedOwnerProof.bind(assembly.authorizationService),
 		recordVerifiedWalletOperationFactorEvidenceSet: assembly.authorizationService.recordVerifiedWalletOperationFactorEvidenceSet.bind(assembly.authorizationService),

package/dist/esm/router/cloudflare/d1/auth/d1EmailOtpRouteService.js

@@ -0,0 +1,25 @@
+//#region src/router/cloudflare/d1/auth/d1EmailOtpRouteService.ts
+function createD1EmailOtpRouteService(assembly) {
+	return {
+		applyEmailOtpServerSeal: assembly.emailOtpServerSeal.applyEmailOtpServerSeal.bind(assembly.emailOtpServerSeal),
+		cleanupGoogleEmailOtpDevRegistrationState: assembly.googleEmailOtpSessions.cleanupDevRegistrationState.bind(assembly.googleEmailOtpSessions),
+		consumeEmailOtpGrant: assembly.emailOtpRecoveryService.consumeEmailOtpGrant.bind(assembly.emailOtpRecoveryService),
+		createEmailOtpChallenge: assembly.emailOtpChallengeService.createEmailOtpChallenge.bind(assembly.emailOtpChallengeService),
+		createEmailOtpEnrollmentChallenge: assembly.emailOtpChallengeService.createEmailOtpEnrollmentChallenge.bind(assembly.emailOtpChallengeService),
+		isEmailOtpStrongAuthRequired: assembly.emailOtpRecoveryService.isEmailOtpStrongAuthRequired.bind(assembly.emailOtpRecoveryService),
+		markEmailOtpStrongAuthSatisfied: assembly.emailOtpRecoveryService.markEmailOtpStrongAuthSatisfied.bind(assembly.emailOtpRecoveryService),
+		readActiveEmailOtpEnrollment: assembly.emailOtpRecoveryService.readActiveEmailOtpEnrollment.bind(assembly.emailOtpRecoveryService),
+		readEmailOtpEnrollment: assembly.emailOtpRecoveryService.readEmailOtpEnrollment.bind(assembly.emailOtpRecoveryService),
+		readEmailOtpOutboxEntry: assembly.emailOtpChallengeService.readEmailOtpOutboxEntry.bind(assembly.emailOtpChallengeService),
+		removeEmailOtpServerSeal: assembly.emailOtpServerSeal.removeEmailOtpServerSeal.bind(assembly.emailOtpServerSeal),
+		validateGoogleEmailOtpRegistrationCandidateWallet: assembly.googleEmailOtpSessions.validateRegistrationCandidateWallet.bind(assembly.googleEmailOtpSessions),
+		verifyEmailOtpChallenge: assembly.emailOtpChallengeService.verifyEmailOtpChallenge.bind(assembly.emailOtpChallengeService),
+		verifyEmailOtpWalletRecoveryChallenge: assembly.emailOtpChallengeService.verifyEmailOtpWalletRecoveryChallenge.bind(assembly.emailOtpChallengeService),
+		verifyEmailOtpEnrollment: assembly.emailOtpChallengeService.verifyEmailOtpEnrollment.bind(assembly.emailOtpChallengeService),
+		verifyGoogleLogin: assembly.oidcVerification.verifyGoogleLogin.bind(assembly.oidcVerification)
+	};
+}
+//#endregion
+export { createD1EmailOtpRouteService };
+
+//# sourceMappingURL=d1EmailOtpRouteService.js.map