@seams/wallet-server 0.7.3 → 0.9.0

package/dist/esm/router/cloudflare/d1/auth/d1RouterApiAuthService.js

@@ -1,11 +1,7 @@
-import { parseWalletAuthMethodId, parseWalletAuthorityId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseDeviceId, parsePrincipalId, parseTenantId, parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
-import { capabilityPolicyPort } from "../../../../authorization/capabilityPolicy.js";
-import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
-import { alphabetizeStringify, sha256BytesUtf8, sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
-import "../../../../shared-ts/src/utils/encoders.js";
+import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseRouterAbEcdsaRegistrationActivationReceiptV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { AuthorizationService } from "../../../../authorization/service.js";
 import { D1WalletStore } from "../../../../core/d1WalletStore.js";
 import { D1WalletAuthMethodStore } from "../../../../core/d1WalletAuthMethodStore.js";
 import { normalizeLogger } from "../../../../core/logger.js";
@@ -16,39 +12,39 @@ import { resolveActiveOwnerWalletExecutionLane, resolveWalletAuthMethodIdForAuth
 import { DEFAULT_WALLET_SESSION_TTL_MS } from "../../../../shared-ts/src/threshold/sessionPolicy.js";
 import { createDeviceLinkingOwnerRequestAuthenticatorV1 } from "../../../transport/fetch/routes/deviceLinkingOwnerAuthorization.js";
 import { sha256BytesPortable, toRecordValue } from "./d1RouterApiAuthBoundary.js";
-import { CloudflareD1WebAuthnStore } from "../webauthn/d1WebAuthnStore.js";
 import { verifyD1LinkedDeviceFreshRevokeProofV1 } from "../wallet/d1WalletAuthMethodBoundary.js";
-import { CloudflareD1WebAuthnAuthService } from "../webauthn/d1WebAuthnAuthService.js";
 import { D1LinkedDeviceAuthorityInstallServiceV1 } from "../deviceLinking/d1LinkedDeviceAuthorityInstallService.js";
 import { D1WalletAuthorityStore } from "../wallet/d1WalletAuthorityStore.js";
-import { CloudflareD1AuthorizationStore } from "../authorization/d1AuthorizationStore.js";
-import { createCloudflareD1VersionedJsonRecordStore } from "../versionedJson/d1VersionedJsonRecordStore.js";
-import { parseRouterAbEd25519YaoRegistrationSideEffectRecordV2, runRouterAbEd25519YaoRegistrationSideEffectV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
+import { parseRouterAbEd25519YaoRegistrationSideEffectRecordV2 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
 import { createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1 } from "../../signingLanes/cloudflareOrdinaryInactiveSignerMaterialReservation.js";
 import { normalizeD1RouterApiAuthOptions } from "./d1RouterApiAuthConfig.js";
-import { readActiveWalletSessionCredential, readExhaustedWalletSessionCredential, readWalletSessionSigningCandidate } from "./walletSessionCredentialReaders.js";
-import { createD1AuthorizedOperationRouteService } from "./d1AuthorizedOperationRouteService.js";
-import { parseRegistrationEstablishedSessionProjectionV2 } from "../../../../shared-ts/src/utils/registrationEstablishedSession.js";
-import { D1IdentityStore } from "../../../../core/d1IdentityStore.js";
+import { D1WalletOperationStore } from "../registration/d1WalletOperationStore.js";
+import { createD1EmailOtpRouteService } from "./d1EmailOtpRouteService.js";
 import { toPublicKeyStringFromSecretKey } from "../../../../core/nearKeys.js";
 import { MinimalNearClient } from "../../../../core/rpcClients/near/NearClient.js";
+import { fundImplicitNearAccountWithRelayer } from "../../../../core/nearRelayerAccountProvisioning.js";
+import { createSponsoredNamedNearAccountForOptions } from "../near/d1SponsoredNearAccount.js";
+import { parseD1EcdsaDerivationServerBootstrapResponse, parseD1WalletRegistrationCommittedInstallationProjection, parseD1WalletRegistrationFinalizeReplayResponse } from "../registration/d1RegistrationCeremonyRecords.js";
+import { parseD1WalletAddSignerFinalizeSideEffectRecord } from "../wallet/d1WalletAddSignerFinalizeRecord.js";
+import { dispatchWalletRegistrationSetup } from "../../../framework/registrationSetupDispatch.js";
+import { readActiveWalletSessionCredential, readEd25519WalletSessionSigningRead, readExhaustedWalletSessionCredential, readWalletSessionSigningCandidate } from "./walletSessionCredentialReaders.js";
+import { createD1AuthorizedOperationRouteService } from "./d1AuthorizedOperationRouteService.js";
+import { parseRegistrationEstablishedSessionProjectionV2 } from "../../../../shared-ts/src/utils/registrationEstablishedSession.js";
 import { signGasRelayerNearTransactionWithDeps } from "../../../../core/authService/nearTransactions.js";
 import { ensureSignerWasmRuntime } from "../../../../core/authService/wasm.js";
-import { parseD1EcdsaDerivationServerBootstrapResponse, parseD1WalletRegistrationCommittedInstallationProjection, parseD1WalletRegistrationFinalizeReplayResponse } from "../registration/d1RegistrationCeremonyRecords.js";
+import { CloudflareD1PasskeyCustodyEnvelopeStore } from "../passkeyCustody/d1PasskeyCustodyEnvelopeStore.js";
+import { createD1AuthorizationAssembly, createD1EmailOtpRateLimits, createD1GoogleRegistrationAttempts, createD1IdentityStore, createD1WalletCustodyStore, createD1WebAuthnAssembly } from "./d1AuthorizationAssembly.js";
 import { CloudflareD1RegistrationCeremonyIntentStore } from "../registration/d1RegistrationCeremonyStore.js";
-import { CloudflareD1NearPublicKeyStore } from "../near/d1NearPublicKeyStore.js";
 import { CloudflareD1EmailOtpChallengeStore } from "../emailOtp/d1EmailOtpChallengeStore.js";
 import { CloudflareD1EmailOtpDeliveryRuntime } from "../emailOtp/d1EmailOtpDeliveryRuntime.js";
 import { CloudflareD1EmailOtpEnrollmentStore } from "../emailOtp/d1EmailOtpEnrollmentStore.js";
 import { CloudflareD1EmailOtpGrantStore } from "../emailOtp/d1EmailOtpGrantStore.js";
-import { CloudflareD1EmailOtpRateLimitStore } from "../emailOtp/d1EmailOtpRateLimitStore.js";
 import { CloudflareD1EmailOtpServerSealRuntime } from "../emailOtp/d1EmailOtpServerSealRuntime.js";
 import { CloudflareD1EmailOtpRegistrationEnrollmentFinalizer } from "../emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer.js";
 import { CloudflareD1EmailOtpChallengeVerifier } from "../emailOtp/d1EmailOtpChallengeVerifier.js";
 import { CloudflareD1EmailOtpChallengeIssuer } from "../emailOtp/d1EmailOtpChallengeIssuer.js";
 import { CloudflareD1EmailOtpChallengeService } from "../emailOtp/d1EmailOtpChallengeService.js";
 import { CloudflareD1EmailOtpRecoveryService } from "../emailOtp/d1EmailOtpRecoveryService.js";
-import { CloudflareD1GoogleEmailOtpRegistrationAttemptStore } from "../emailOtp/d1GoogleEmailOtpRegistrationAttemptStore.js";
 import { CloudflareD1GoogleEmailOtpSessionResolver } from "../emailOtp/d1GoogleEmailOtpSessionResolver.js";
 import { CloudflareD1IdentityService } from "../identity/d1IdentityService.js";
 import { CloudflareD1OidcVerificationService } from "../oidc/d1OidcVerificationService.js";
@@ -56,16 +52,14 @@ import { D1WalletAuthMethodRevocationReplayStoreV1 } from "../wallet/d1WalletAut
 import { CloudflareD1WalletAuthMethodService } from "../wallet/d1WalletAuthMethodService.js";
 import { parseWalletRegistrationSessionCommitReceiptV2 } from "../registration/walletRegistrationSessionCommitReceipt.js";
 import { CloudflareD1WalletRegistrationService } from "../registration/d1WalletRegistrationService.js";
+import { D1WalletRegistrationRead } from "../registration/d1WalletRegistrationRead.js";
 import { CloudflareD1WalletRegistrationCommitStore } from "../registration/d1WalletRegistrationCommitStore.js";
 import { CloudflareD1Ed25519YaoLifecycleDecisionStoreV1 } from "../ed25519Yao/d1Ed25519YaoLifecycleDecisionStore.js";
-import { CloudflareD1PasskeyCustodyEnvelopeStore } from "../passkeyCustody/d1PasskeyCustodyEnvelopeStore.js";
-import { CloudflareD1WalletCustodyCommitStore } from "../passkeyCustody/d1WalletCustodyCommitStore.js";
 import { createD1PasskeyCustodyRouteService } from "../passkeyCustody/d1PasskeyCustodyRouteService.js";
 import { CloudflareD1WalletRecoveryGoogleEmailOtpAttemptStore } from "../passkeyCustody/d1WalletRecoveryGoogleEmailOtpAttemptStore.js";
 import { CloudflareD1WalletRecoveryGoogleEmailOtpService } from "../passkeyCustody/d1WalletRecoveryGoogleEmailOtpService.js";
-import { CloudflareD1WalletAddSignerService, parseD1WalletAddSignerFinalizeSideEffectRecord, parseD1WalletAddSignerStartSideEffectRecord } from "../wallet/d1WalletAddSignerService.js";
+import { CloudflareD1WalletAddSignerService, parseD1WalletAddSignerStartSideEffectRecord } from "../wallet/d1WalletAddSignerService.js";
 import { CloudflareD1RegistrationIntentService } from "../registration/d1RegistrationIntentService.js";
-import { broadcastPreparedSponsoredNearAccountCreation, fundImplicitNearAccountWithRelayer, prepareSponsoredNearAccountCreationWithRelayer, preparedSponsoredNearAccountCreationArtifactFingerprint } from "../../../../core/nearRelayerAccountProvisioning.js";
 import { createD1LinkedDeviceSessionServiceV1 } from "../deviceLinking/d1LinkedDeviceSessionService.js";
 import { D1LinkedDeviceSessionStoreV1 } from "../deviceLinking/d1LinkedDeviceSessionStore.js";
 import { createD1LinkedDeviceRouteServiceV1 } from "../deviceLinking/d1LinkedDeviceRouteService.js";
@@ -199,6 +193,7 @@ function createD1LinkedDeviceComposition(input) {
 			});
 		}
 		const sessionStore = new D1LinkedDeviceSessionStoreV1({
+			bootstrap: input.options.linkedDeviceBootstrap,
 			database: input.options.database,
 			scope,
 			now: nowV1
@@ -228,6 +223,7 @@ function createD1LinkedDeviceComposition(input) {
 		});
 		const verifiedLinkBuilder = { source: verifiedLinkSourceReader };
 		const authorityInstall = new D1LinkedDeviceAuthorityInstallServiceV1({
+			credentialClaims: input.options.credentialClaims,
 			database: input.options.database,
 			scope,
 			authorityStore,
@@ -259,6 +255,8 @@ function createD1LinkedDeviceComposition(input) {
 			acknowledgeLocalAuthorityActivationV1: authorityInstall.acknowledgeLocalAuthorityActivationV1.bind(authorityInstall)
 		};
 		deviceLinking = createD1LinkedDeviceRouteServiceV1({
+			bootstrap: input.options.linkedDeviceBootstrap,
+			proofNonces: input.options.linkedDeviceProofNonces,
 			database: input.options.database,
 			scope,
 			ownerAuthorization: ownerAuthorizationProvider.ownerAuthorization,
@@ -433,64 +431,25 @@ async function fundImplicitNearAccountForOptions(options, input) {
 		fundedAmountYocto
 	});
 }
-/**
-* Validates a persisted claim before it is trusted to skip a broadcast or to be
-* replayed. An invalid record makes the D1 read fail, which leaves the effect
-* uncertain and prevents any network action on unvalidated bytes.
-*/
-function parseSponsoredNearAccountSideEffectRecord(raw) {
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
-	if (Reflect.get(raw, "operation") !== "finalize") return null;
-	const requestFingerprint = parseSideEffectFingerprint(Reflect.get(raw, "requestFingerprint"));
-	const preparedArtifactFingerprint = parseSideEffectFingerprint(Reflect.get(raw, "preparedArtifactFingerprint"));
-	if (requestFingerprint === null || preparedArtifactFingerprint === null) return null;
-	const claimedAtMs = Reflect.get(raw, "claimedAtMs");
-	if (!isNonNegativeSafeInteger(claimedAtMs)) return null;
-	const prepared = parsePreparedSponsoredNearAccountCreation(Reflect.get(raw, "prepared"));
-	if (prepared === null) return null;
-	const kind = Reflect.get(raw, "kind");
-	if (kind === "router_ab_ed25519_yao_registration_side_effect_claim_v1") return {
-		kind: "router_ab_ed25519_yao_registration_side_effect_claim_v1",
-		operation: "finalize",
-		requestFingerprint,
-		preparedArtifactFingerprint,
-		claimedAtMs,
-		prepared
-	};
-	if (kind === "router_ab_ed25519_yao_registration_side_effect_completion_v1") {
-		const completedAtMs = Reflect.get(raw, "completedAtMs");
-		if (!isNonNegativeSafeInteger(completedAtMs)) return null;
-		const response = parseAccountCreationResult(Reflect.get(raw, "response"));
-		if (response === null) return null;
-		return {
-			kind: "router_ab_ed25519_yao_registration_side_effect_completion_v1",
-			operation: "finalize",
-			requestFingerprint,
-			preparedArtifactFingerprint,
-			claimedAtMs,
-			completedAtMs,
-			prepared,
-			response
-		};
-	}
-	return null;
-}
 function parseWalletRegistrationOperationPrepared(raw) {
 	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
 	if (Reflect.get(raw, "kind") !== "d1_wallet_registration_operation_prepared_v1") return null;
 	const keys = [
 		"kind",
+		"walletId",
 		"walletAuthorityId",
 		"deviceId",
 		"walletAuthMethodId"
 	];
 	if (Object.keys(raw).length !== keys.length || !hasOnlyKeys(raw, keys)) return null;
+	const walletId = parseWalletId(Reflect.get(raw, "walletId"));
 	const walletAuthorityId = parseWalletAuthorityId(Reflect.get(raw, "walletAuthorityId"));
 	const deviceId = parseDeviceId(Reflect.get(raw, "deviceId"));
 	const walletAuthMethodId = parseWalletAuthMethodId(Reflect.get(raw, "walletAuthMethodId"));
-	if (!walletAuthorityId.ok || !deviceId.ok || !walletAuthMethodId.ok) return null;
+	if (!walletId.ok || !walletAuthorityId.ok || !deviceId.ok || !walletAuthMethodId.ok) return null;
 	return {
 		kind: "d1_wallet_registration_operation_prepared_v1",
+		walletId: walletId.value,
 		walletAuthorityId: walletAuthorityId.value,
 		deviceId: deviceId.value,
 		walletAuthMethodId: walletAuthMethodId.value
@@ -663,92 +622,12 @@ function registrationReceiptMatchesJournal(record) {
 	if (receipt.operation !== record.operation || receipt.operationFingerprint !== record.requestFingerprint) return false;
 	if (receipt.committed.kind === "error") return true;
 	if (!("walletAuthMethodId" in receipt)) return false;
+	if (receipt.walletId !== record.prepared.walletId) return false;
 	if (receipt.walletAuthMethodId !== record.prepared.walletAuthMethodId) return false;
-	if (receipt.committed.kind === "near_pending") return true;
 	return "foundingAuthority" in receipt && receipt.foundingAuthority.authorityId === record.prepared.walletAuthorityId;
 }
-function parsePreparedSponsoredNearAccountCreation(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	if (Reflect.get(value, "kind") !== "prepared_sponsored_near_account_creation_v1") return null;
-	const accountId = parseNonEmptyString(Reflect.get(value, "accountId"));
-	const publicKey = parseNonEmptyString(Reflect.get(value, "publicKey"));
-	const relayerAccountId = parseNonEmptyString(Reflect.get(value, "relayerAccountId"));
-	const relayerPublicKey = parseNonEmptyString(Reflect.get(value, "relayerPublicKey"));
-	const initialBalanceYocto = parseNonEmptyString(Reflect.get(value, "initialBalanceYocto"));
-	const transactionHash = parseNonEmptyString(Reflect.get(value, "transactionHash"));
-	const nextNonce = parseNonEmptyString(Reflect.get(value, "nextNonce"));
-	const blockHash = parseNonEmptyString(Reflect.get(value, "blockHash"));
-	const signedTransactionBorshB64u = parseBoundedBase64Url(Reflect.get(value, "signedTransactionBorshB64u"));
-	if (accountId === null || publicKey === null || relayerAccountId === null || relayerPublicKey === null || initialBalanceYocto === null || transactionHash === null || nextNonce === null || blockHash === null || signedTransactionBorshB64u === null) return null;
-	return {
-		kind: "prepared_sponsored_near_account_creation_v1",
-		accountId,
-		publicKey,
-		relayerAccountId,
-		relayerPublicKey,
-		initialBalanceYocto,
-		transactionHash,
-		nextNonce,
-		blockHash,
-		signedTransactionBorshB64u
-	};
-}
-function parseAccountCreationResult(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	const success = Reflect.get(value, "success");
-	if (typeof success !== "boolean") return null;
-	const accountId = parseOptionalString(Reflect.get(value, "accountId"));
-	const transactionHash = parseOptionalString(Reflect.get(value, "transactionHash"));
-	const error = parseOptionalString(Reflect.get(value, "error"));
-	const message = parseOptionalString(Reflect.get(value, "message"));
-	if ("accountId" in value && accountId === null || "transactionHash" in value && transactionHash === null || "error" in value && error === null || "message" in value && message === null) return null;
-	if (success && (accountId === void 0 || transactionHash === void 0)) return null;
-	const normalizedAccountId = accountId ?? void 0;
-	const normalizedTransactionHash = transactionHash ?? void 0;
-	const normalizedError = error ?? void 0;
-	const normalizedMessage = message ?? void 0;
-	return {
-		success,
-		...normalizedAccountId === void 0 ? {} : { accountId: normalizedAccountId },
-		...normalizedTransactionHash === void 0 ? {} : { transactionHash: normalizedTransactionHash },
-		...normalizedError === void 0 ? {} : { error: normalizedError },
-		...normalizedMessage === void 0 ? {} : { message: normalizedMessage }
-	};
-}
-function parseNonEmptyString(value) {
-	return typeof value === "string" && value.trim() ? value : null;
-}
-function parseSideEffectFingerprint(value) {
-	return typeof value === "string" && /^[a-zA-Z0-9:_-]{32,192}$/u.test(value) ? value : null;
-}
-function parseBoundedBase64Url(value) {
-	return typeof value === "string" && value.length > 0 && value.length <= 8192 && /^[\w-]+$/u.test(value) ? value : null;
-}
-function parseOptionalString(value) {
-	return value === void 0 ? void 0 : parseNonEmptyString(value);
-}
-function isNonNegativeSafeInteger(value) {
-	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
-}
-function resolveEd25519YaoProductRegistration(options) {
-	return options.ed25519YaoProductRegistration || null;
-}
-function sponsoredNearAccountSideEffectStore(options) {
-	return createCloudflareD1VersionedJsonRecordStore({
-		database: options.database,
-		scope: {
-			namespace: options.namespace,
-			orgId: options.orgId,
-			projectId: options.projectId,
-			envId: options.envId
-		},
-		keyPrefix: "router-ab-yao-sponsored-account:",
-		encode: (value) => value,
-		parse: parseSponsoredNearAccountSideEffectRecord
-	});
-}
 function walletRegistrationActivateSideEffectStore(options) {
-	return createCloudflareD1VersionedJsonRecordStore({
+	return new D1WalletOperationStore({
 		database: options.database,
 		scope: {
 			namespace: options.namespace,
@@ -759,10 +638,10 @@ function walletRegistrationActivateSideEffectStore(options) {
 		keyPrefix: "wallet-registration-activate:",
 		encode: (value) => value,
 		parse: parseWalletRegistrationActivateSideEffectRecord
-	});
+	}, registrationOperationWallet);
 }
 function walletRegistrationNearProvisioningSideEffectStore(options) {
-	return createCloudflareD1VersionedJsonRecordStore({
+	return new D1WalletOperationStore({
 		database: options.database,
 		scope: {
 			namespace: options.namespace,
@@ -773,10 +652,10 @@ function walletRegistrationNearProvisioningSideEffectStore(options) {
 		keyPrefix: "wallet-registration-near-provisioning:",
 		encode: (value) => value,
 		parse: parseWalletRegistrationNearProvisioningSideEffectRecord
-	});
+	}, registrationOperationWallet);
 }
 function walletAddSignerStartSideEffectStore(options) {
-	return createCloudflareD1VersionedJsonRecordStore({
+	return new D1WalletOperationStore({
 		database: options.database,
 		scope: {
 			namespace: options.namespace,
@@ -787,10 +666,10 @@ function walletAddSignerStartSideEffectStore(options) {
 		keyPrefix: "wallet-add-signer-start:",
 		encode: (value) => value,
 		parse: parseD1WalletAddSignerStartSideEffectRecord
-	});
+	}, addSignerStartWallet);
 }
 function walletAddSignerFinalizeSideEffectStore(options) {
-	return createCloudflareD1VersionedJsonRecordStore({
+	return new D1WalletOperationStore({
 		database: options.database,
 		scope: {
 			namespace: options.namespace,
@@ -801,88 +680,7 @@ function walletAddSignerFinalizeSideEffectStore(options) {
 		keyPrefix: "wallet-add-signer-finalize:",
 		encode: (value) => value,
 		parse: parseD1WalletAddSignerFinalizeSideEffectRecord
-	});
-}
-/**
-* Creates the sponsored account through a durable claim. The signed transaction
-* and its hash are persisted before the broadcast, so a lost response replays
-* those exact bytes instead of building a second transaction under a fresh
-* nonce. Rebroadcasting an identical signed transaction reuses its hash, so the
-* network treats the retry as the same transaction.
-*/
-async function createSponsoredNamedNearAccountForOptions(options, input) {
-	const relayerAccount = options.relayerAccount;
-	const relayerPrivateKey = options.relayerPrivateKey;
-	const nearRpcUrl = options.nearRpcUrl;
-	const initialBalanceYocto = options.accountInitialBalance;
-	if (!relayerAccount || !relayerPrivateKey || !nearRpcUrl || !initialBalanceYocto) return {
-		kind: "rejected",
-		message: "Sponsored NEAR account creation is not configured on this server"
-	};
-	const relayerInput = {
-		accountId: input.accountId,
-		publicKey: input.publicKey,
-		relayerAccount,
-		relayerPrivateKey,
-		relayerPublicKey: options.relayerPublicKey,
-		nearRpcUrl,
-		initialBalanceYocto
-	};
-	const requestFingerprint = base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
-		kind: "sponsored_near_account_creation_v1",
-		accountId: input.accountId,
-		publicKey: input.publicKey,
-		relayerAccountId: relayerAccount,
-		initialBalanceYocto
-	})));
-	const outcome = await runRouterAbEd25519YaoRegistrationSideEffectV1(sponsoredNearAccountSideEffectStore(options), {
-		kind: "prepared_resumable",
-		resumeAfterMs: 3e4,
-		operation: "finalize",
-		key: `sponsored-account:${input.idempotencyKey}`,
-		requestFingerprint,
-		nowMs: () => Date.now(),
-		prepare: async () => {
-			const prepared = await prepareSponsoredNearAccountCreationWithRelayer(relayerInput);
-			if (!prepared.ok) throw new Error(prepared.message);
-			return prepared.prepared;
-		},
-		derivePreparedArtifactFingerprint: preparedSponsoredNearAccountCreationArtifactFingerprint,
-		execute: async (prepared, attempt) => {
-			if (!prepared) throw new Error("Sponsored NEAR account transaction was not prepared");
-			const broadcast = await broadcastPreparedSponsoredNearAccountCreation({
-				prepared,
-				nearRpcUrl,
-				relayerAccountId: relayerAccount,
-				reconcileFirst: attempt === "resumed"
-			});
-			if (broadcast.kind === "uncertain") throw new Error(broadcast.message);
-			return broadcast.result;
-		}
-	});
-	switch (outcome.kind) {
-		case "executed":
-		case "exact_replay":
-			if (outcome.value.success && outcome.value.accountId && outcome.value.transactionHash) return {
-				kind: "created",
-				accountId: outcome.value.accountId,
-				transactionHash: outcome.value.transactionHash
-			};
-			return {
-				kind: "rejected",
-				message: outcome.value.message || outcome.value.error || "Sponsored NEAR account creation was rejected"
-			};
-		case "in_progress":
-		case "uncertain": return {
-			kind: "retryable",
-			message: outcome.kind === "uncertain" ? outcome.message : "Sponsored NEAR account creation is already in progress for this registration",
-			retryAfterMs: 3e4
-		};
-		case "request_conflict": return {
-			kind: "rejected",
-			message: "Sponsored NEAR account creation idempotency key conflicts with another request"
-		};
-	}
+	}, addSignerFinalizeWallet);
 }
 async function readD1Ed25519KeyManifestBySlot(walletStore, input) {
 	const signer = await walletStore.getEd25519SignerBySlot(input);
@@ -898,18 +696,11 @@ function createCloudflareD1RouterApiAuthAssembly(input) {
 	const walletAuthMethodStore = getWalletAuthMethodStore();
 	const walletStore = getWalletStore();
 	const createSponsoredNamedNearAccount = createSponsoredNamedNearAccountForOptions.bind(void 0, options);
-	const identityStore = new D1IdentityStore({
-		database: options.database,
-		namespace: options.namespace,
-		orgId: options.orgId,
-		projectId: options.projectId,
-		envId: options.envId,
-		ensureSchema: false
-	});
+	const identityStore = createD1IdentityStore(options);
 	const linkIdentity = linkD1Identity.bind(void 0, identityStore);
 	const linkedDeviceEd25519AuthorityReaderSlot = { current: null };
 	const getLinkedDeviceEd25519AuthorityReader = linkedDeviceEd25519AuthorityReaderFromSlot.bind(void 0, linkedDeviceEd25519AuthorityReaderSlot);
-	const authorizationStore = new CloudflareD1AuthorizationStore({
+	const { authorizationStore, authorizationService } = createD1AuthorizationAssembly({
 		database: options.database,
 		namespace: options.namespace,
 		walletSignerScope: {
@@ -919,32 +710,9 @@ function createCloudflareD1RouterApiAuthAssembly(input) {
 			envId: options.envId
 		},
 		getLinkedDeviceAuthorityReader: getLinkedDeviceEd25519AuthorityReader
-	});
-	const authorizationService = new AuthorizationService({
-		policy: capabilityPolicyPort,
-		sessions: authorizationStore,
-		evidence: authorizationStore,
-		grants: authorizationStore,
-		authorizedOperations: authorizationStore,
-		audit: authorizationStore
-	});
-	const googleEmailOtpRegistrationAttempts = new CloudflareD1GoogleEmailOtpRegistrationAttemptStore({
-		prepare,
-		orgId: options.orgId
-	});
-	const nearPublicKeys = new CloudflareD1NearPublicKeyStore({ prepare });
-	const webAuthnStore = new CloudflareD1WebAuthnStore({
-		database: options.database,
-		namespace: options.namespace,
-		orgId: options.orgId,
-		projectId: options.projectId,
-		envId: options.envId
-	});
-	const webAuthnAuthService = new CloudflareD1WebAuthnAuthService({
-		webAuthnStore,
-		walletAuthMethodStore,
-		walletManifestSource: { getEd25519KeyManifestBySlot: readD1Ed25519KeyManifestBySlot.bind(void 0, walletStore) }
-	});
+	}, options.sessionRouting);
+	const googleEmailOtpRegistrationAttempts = createD1GoogleRegistrationAttempts(options, prepare);
+	const { webAuthnStore, webAuthnAuthService } = createD1WebAuthnAssembly(options, walletAuthMethodStore, { getEd25519KeyManifestBySlot: readD1Ed25519KeyManifestBySlot.bind(void 0, walletStore) });
 	const emailOtpChallenges = new CloudflareD1EmailOtpChallengeStore({
 		database: options.database,
 		namespace: options.namespace,
@@ -955,10 +723,7 @@ function createCloudflareD1RouterApiAuthAssembly(input) {
 	const emailOtpDelivery = new CloudflareD1EmailOtpDeliveryRuntime(options.emailOtp);
 	const emailOtpEnrollments = new CloudflareD1EmailOtpEnrollmentStore({ prepare });
 	const emailOtpGrants = new CloudflareD1EmailOtpGrantStore({ prepare });
-	const emailOtpRateLimits = new CloudflareD1EmailOtpRateLimitStore({
-		prepare,
-		rateLimits: options.emailOtp.rateLimits
-	});
+	const emailOtpRateLimits = createD1EmailOtpRateLimits(options, prepare);
 	const emailOtpServerSeal = new CloudflareD1EmailOtpServerSealRuntime(options.emailOtpServerSeal);
 	const googleEmailOtpSessions = new CloudflareD1GoogleEmailOtpSessionResolver({
 		emailOtpEnrollments,
@@ -968,12 +733,7 @@ function createCloudflareD1RouterApiAuthAssembly(input) {
 		production: options.emailOtp.production,
 		registrationAttempts: googleEmailOtpRegistrationAttempts
 	});
-	const identityService = new CloudflareD1IdentityService({
-		accountIdDerivationSecret: options.accountIdDerivationSecret,
-		identityStore,
-		relayerAccount: options.relayerAccount,
-		resolveGoogleEmailOtpSession: googleEmailOtpSessions.resolve.bind(googleEmailOtpSessions)
-	});
+	const identityService = new CloudflareD1IdentityService({ identityStore });
 	const oidcVerification = new CloudflareD1OidcVerificationService({
 		googleOidcClientId: options.googleOidcClientId,
 		githubOAuth: options.githubOAuth,
@@ -1061,34 +821,32 @@ function createCloudflareD1RouterApiAuthAssembly(input) {
 		envId: options.envId
 	});
 	const walletRegistrationCommitStore = new CloudflareD1WalletRegistrationCommitStore({
+		credentialClaims: options.credentialClaims,
 		database: options.database,
 		namespace: options.namespace,
 		orgId: options.orgId,
 		projectId: options.projectId,
 		envId: options.envId
 	});
-	const walletCustodyCommitStore = new CloudflareD1WalletCustodyCommitStore({
-		database: options.database,
-		scope: {
-			namespace: options.namespace,
-			orgId: options.orgId,
-			projectId: options.projectId,
-			envId: options.envId
-		}
-	});
+	const walletCustodyCommitStore = createD1WalletCustodyStore(options, walletAuthMethodStore);
 	const signedDelegateExecutor = new CloudflareD1SignedDelegateExecutor(options);
 	const walletRegistrations = new CloudflareD1WalletRegistrationService({
+		executionAuthority: options.walletExecution,
+		home: options.sessionRouting?.home() ?? { kind: "direct" },
+		registrationAuthority: options.registrationAuthority ?? null,
+		startRegistrationWallets: options.startRegistrationWallets ?? null,
 		authorizationService,
+		registrationSessionStore: authorizationStore,
 		authorizationTenantId: authorizationTenantId.value,
 		createSponsoredNamedNearAccount,
 		emailOtpRegistrationEnrollmentFinalizer,
 		getRegistrationCeremonyIntentStore,
-		getEd25519YaoProductRegistration: () => resolveEd25519YaoProductRegistration(options),
+		getEd25519YaoProductRegistration: () => options.ed25519YaoProductRegistration ?? null,
 		ecdsaStrictRegistration: options.ecdsaStrictRegistration,
 		tenantRootCustodyLineage: options.tenantRootCustodyLineage,
 		getWalletStore,
 		activateSideEffects: walletRegistrationActivateSideEffectStore(options),
-		nearProvisioningSideEffects: walletRegistrationNearProvisioningSideEffectStore(options),
+		registrationRead: new D1WalletRegistrationRead(options.database, options.registrationAuthority ?? null, walletRegistrationNearProvisioningSideEffectStore(options), getRegistrationCeremonyIntentStore, yaoLifecycleDecisions),
 		walletRegistrationCommitStore,
 		walletCustodyCommitStore,
 		walletAuthMethods,
@@ -1096,8 +854,9 @@ function createCloudflareD1RouterApiAuthAssembly(input) {
 		yaoLifecycleDecisions
 	});
 	const walletAddSigners = new CloudflareD1WalletAddSignerService({
+		executionAuthority: options.walletExecution,
 		getRegistrationCeremonyIntentStore,
-		getEd25519YaoProductRegistration: () => resolveEd25519YaoProductRegistration(options),
+		getEd25519YaoProductRegistration: () => options.ed25519YaoProductRegistration ?? null,
 		ecdsaStrictRegistration: options.ecdsaStrictRegistration,
 		tenantRootCustodyLineage: options.tenantRootCustodyLineage,
 		getWalletStore,
@@ -1168,6 +927,7 @@ function createCloudflareD1RouterApiAuthAssembly(input) {
 		authorizationService,
 		authorizationStore,
 		walletRegistration: createD1WalletRegistrationRouteService({
+			options,
 			emailOtpRecoveryService,
 			registrationIntents,
 			walletAuthMethodStore,
@@ -1187,6 +947,11 @@ function createCloudflareD1RouterApiAuthAssembly(input) {
 	});
 	linkedDeviceEd25519AuthorityReaderSlot.current = linkedDeviceComposition.linkedDeviceEd25519AuthorityReader ?? null;
 	return {
+		relocationEmailOtp: {
+			verifier: emailOtpChallengeVerifier,
+			emailOtpChallenges,
+			issuer: emailOtpChallengeIssuer
+		},
 		options,
 		emailOtpServerSeal,
 		emailOtpChallengeService,
@@ -1198,7 +963,6 @@ function createCloudflareD1RouterApiAuthAssembly(input) {
 		authorizationService,
 		authorizationStore,
 		googleEmailOtpSessions,
-		nearPublicKeys,
 		webAuthnAuthService,
 		walletAuthMethods,
 		walletRegistrations,
@@ -1267,7 +1031,10 @@ function createD1WalletRegistrationRouteService(assembly) {
 		resolveActiveEcdsaTenantRoot: assembly.walletRegistrations.resolveActiveEcdsaTenantRoot.bind(assembly.walletRegistrations),
 		listWalletEcdsaKeyFactsInventory: assembly.walletRegistrations.listWalletEcdsaKeyFactsInventory.bind(assembly.walletRegistrations),
 		readActiveEmailOtpEnrollment: assembly.emailOtpRecoveryService.readActiveEmailOtpEnrollment.bind(assembly.emailOtpRecoveryService),
-		setupWalletRegistration: assembly.walletRegistrations.setupWalletRegistration.bind(assembly.walletRegistrations),
+		setupWalletRegistration: dispatchWalletRegistrationSetup.bind(void 0, {
+			dispatcher: assembly.options.registrationSetupDispatcher ?? null,
+			local: assembly.walletRegistrations
+		}),
 		respondWalletRegistration: assembly.walletRegistrations.respondWalletRegistration.bind(assembly.walletRegistrations),
 		authorizeWalletRegistrationNearAdmission: assembly.walletRegistrations.authorizeWalletRegistrationNearAdmission.bind(assembly.walletRegistrations),
 		activateWalletRegistration: assembly.walletRegistrations.activateWalletRegistration.bind(assembly.walletRegistrations),
@@ -1447,26 +1214,6 @@ function createD1WalletUnlockRouteService(assembly) {
 		refreshWalletSessionAuthorityProjection: assembly.authorizationService.refreshWalletSessionAuthorizationV2AuthorityProjection.bind(assembly.authorizationService)
 	};
 }
-function createD1EmailOtpRouteService(assembly) {
-	return {
-		applyEmailOtpServerSeal: assembly.emailOtpServerSeal.applyEmailOtpServerSeal.bind(assembly.emailOtpServerSeal),
-		cleanupGoogleEmailOtpDevRegistrationState: assembly.googleEmailOtpSessions.cleanupDevRegistrationState.bind(assembly.googleEmailOtpSessions),
-		consumeEmailOtpGrant: assembly.emailOtpRecoveryService.consumeEmailOtpGrant.bind(assembly.emailOtpRecoveryService),
-		createEmailOtpChallenge: assembly.emailOtpChallengeService.createEmailOtpChallenge.bind(assembly.emailOtpChallengeService),
-		createEmailOtpEnrollmentChallenge: assembly.emailOtpChallengeService.createEmailOtpEnrollmentChallenge.bind(assembly.emailOtpChallengeService),
-		isEmailOtpStrongAuthRequired: assembly.emailOtpRecoveryService.isEmailOtpStrongAuthRequired.bind(assembly.emailOtpRecoveryService),
-		markEmailOtpStrongAuthSatisfied: assembly.emailOtpRecoveryService.markEmailOtpStrongAuthSatisfied.bind(assembly.emailOtpRecoveryService),
-		readActiveEmailOtpEnrollment: assembly.emailOtpRecoveryService.readActiveEmailOtpEnrollment.bind(assembly.emailOtpRecoveryService),
-		readEmailOtpEnrollment: assembly.emailOtpRecoveryService.readEmailOtpEnrollment.bind(assembly.emailOtpRecoveryService),
-		readEmailOtpOutboxEntry: assembly.emailOtpChallengeService.readEmailOtpOutboxEntry.bind(assembly.emailOtpChallengeService),
-		removeEmailOtpServerSeal: assembly.emailOtpServerSeal.removeEmailOtpServerSeal.bind(assembly.emailOtpServerSeal),
-		validateGoogleEmailOtpRegistrationCandidateWallet: assembly.googleEmailOtpSessions.validateRegistrationCandidateWallet.bind(assembly.googleEmailOtpSessions),
-		verifyEmailOtpChallenge: assembly.emailOtpChallengeService.verifyEmailOtpChallenge.bind(assembly.emailOtpChallengeService),
-		verifyEmailOtpWalletRecoveryChallenge: assembly.emailOtpChallengeService.verifyEmailOtpWalletRecoveryChallenge.bind(assembly.emailOtpChallengeService),
-		verifyEmailOtpEnrollment: assembly.emailOtpChallengeService.verifyEmailOtpEnrollment.bind(assembly.emailOtpChallengeService),
-		verifyGoogleLogin: assembly.oidcVerification.verifyGoogleLogin.bind(assembly.oidcVerification)
-	};
-}
 function createD1WebAuthnRouteService(assembly) {
 	return {
 		createWebAuthnLoginOptions: assembly.webAuthnAuthService.createWebAuthnLoginOptions.bind(assembly.webAuthnAuthService),
@@ -1485,7 +1232,6 @@ function createD1IdentityRouteService(assembly) {
 		linkIdentity: assembly.identityService.linkIdentity.bind(assembly.identityService),
 		listIdentities: assembly.identityService.listIdentities.bind(assembly.identityService),
 		resolveGoogleEmailOtpSession: assembly.googleEmailOtpSessions.resolve.bind(assembly.googleEmailOtpSessions),
-		resolveOidcWalletId: assembly.identityService.resolveOidcWalletId.bind(assembly.identityService),
 		unlinkIdentity: assembly.identityService.unlinkIdentity.bind(assembly.identityService),
 		verifyGoogleLogin: assembly.oidcVerification.verifyGoogleLogin.bind(assembly.oidcVerification),
 		verifyGithubOAuthCode: assembly.oidcVerification.verifyGithubOAuthCode.bind(assembly.oidcVerification)
@@ -1499,6 +1245,7 @@ function createD1AuthorizationSessionRouteService(assembly) {
 		issueDirectWalletSessionAuthorizationV2: assembly.authorizationService.issueDirectWalletSessionAuthorizationV2.bind(assembly.authorizationService),
 		readWalletSessionAuthorizationV2ByOperationCredential: readActiveWalletSessionCredential.bind(null, assembly.authorizationService),
 		readWalletSessionSigningCandidateByOperationCredential: readWalletSessionSigningCandidate.bind(null, assembly.authorizationService),
+		readEd25519WalletSessionSigningReadByOperationCredential: readEd25519WalletSessionSigningRead.bind(null, assembly.authorizationService),
 		readWalletSessionExactOperationContextByCredential: assembly.authorizationService.readWalletSessionExactOperationContextByCredential.bind(assembly.authorizationService),
 		readExhaustedWalletSessionAuthorizationV2CandidateByOperationCredential: readExhaustedWalletSessionCredential.bind(null, assembly.authorizationService),
 		readExactWalletSessionStatusByOperationCredential: assembly.authorizationService.readExactWalletSessionStatusByOperationCredential.bind(assembly.authorizationService),
@@ -1527,10 +1274,7 @@ function createD1ThresholdRuntimeRouteService(assembly) {
 	return { getRouterAbEcdsaPresignRuntime: () => assembly.options.routerAbEcdsaPresignRuntime || null };
 }
 function createD1NearFundingRouteService(assembly) {
-	return {
-		fundImplicitNearAccount: fundImplicitNearAccountForOptions.bind(void 0, assembly.options),
-		listNearPublicKeysForUser: assembly.nearPublicKeys.listForRelayUser.bind(assembly.nearPublicKeys)
-	};
+	return { fundImplicitNearAccount: fundImplicitNearAccountForOptions.bind(void 0, assembly.options) };
 }
 function createD1RouterAccountRouteService(assembly) {
 	const accountId = assembly.options.relayerAccount || DEFAULT_D1_THRESHOLD_RELAYER_ACCOUNT;
@@ -1546,6 +1290,8 @@ function createD1RouterAccountRouteService(assembly) {
 function createCloudflareD1RouterApiAuthService(input) {
 	const assembly = createCloudflareD1RouterApiAuthAssembly(input);
 	return {
+		walletExecution: assembly.options.walletExecution,
+		relocationEmailOtp: assembly.relocationEmailOtp,
 		walletRegistration: createD1WalletRegistrationRouteService(assembly),
 		walletAuthMethods: createD1WalletAuthMethodRouteService(assembly),
 		walletUnlock: createD1WalletUnlockRouteService(assembly),
@@ -1575,6 +1321,15 @@ function createCloudflareD1RouterApiAuthService(input) {
 		...assembly.linkedDeviceEd25519AuthorityReader === void 0 ? {} : { linkedDeviceEd25519AuthorityReader: assembly.linkedDeviceEd25519AuthorityReader }
 	};
 }
+function registrationOperationWallet(record) {
+	return record.prepared.walletId;
+}
+function addSignerStartWallet(record) {
+	return record.prepared.storedIntent.intent.walletId;
+}
+function addSignerFinalizeWallet(record) {
+	return record.prepared.walletId;
+}
 //#endregion
 export { createCloudflareD1RouterApiAuthService };