@seams/wallet-server 0.7.3 → 0.9.0

package/dist/esm/router/cloudflare/d1/wallet/d1WalletRelocationSessions.js

@@ -0,0 +1,97 @@
+import { parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
+import { parseUnixMs } from "../../../../shared-ts/src/passkey-custody/primitives.js";
+import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
+import { prepareD1TenantStatement } from "../../../../core/d1TenantStore.js";
+//#region src/router/cloudflare/d1/wallet/d1WalletRelocationSessions.ts
+var WalletRelocationSessionSource = class WalletRelocationSessionSource {
+	#validated = true;
+	constructor(walletId, moveId, requestDigestHex, sourceGeneration) {
+		this.walletId = walletId;
+		this.moveId = moveId;
+		this.requestDigestHex = requestDigestHex;
+		this.sourceGeneration = sourceGeneration;
+		Object.freeze(this);
+	}
+	static parse(raw) {
+		if (!isPlainObject(raw) || Object.keys(raw).length !== 4) throw new Error("Invalid session relocation identity");
+		const wallet = parseWalletId(raw.walletId);
+		if (!wallet.ok || typeof raw.moveId !== "string" || !/^wmove_[A-Za-z0-9_-]{43}$/u.test(raw.moveId) || typeof raw.requestDigestHex !== "string" || !/^[a-f0-9]{64}$/u.test(raw.requestDigestHex) || typeof raw.sourceGeneration !== "number" || !Number.isSafeInteger(raw.sourceGeneration) || raw.sourceGeneration < 1 || raw.sourceGeneration >= Number.MAX_SAFE_INTEGER) throw new Error("Invalid session relocation identity");
+		return new WalletRelocationSessionSource(wallet.value, raw.moveId, raw.requestDigestHex, raw.sourceGeneration);
+	}
+	matches(row) {
+		return this.#validated && row.wallet_id === this.walletId && row.move_id === this.moveId && row.request_digest_hex === this.requestDigestHex && row.source_generation === this.sourceGeneration;
+	}
+};
+var D1WalletRelocationSessions = class {
+	constructor(database, scope) {
+		this.database = database;
+		this.scope = scope;
+	}
+	async hasPendingOperations(walletId) {
+		return await prepareD1TenantStatement(this.database, this.scope, `SELECT 1 FROM wallet_pending_operations
+       WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+         AND wallet_id = ?5 LIMIT 1`, [walletId]).first() !== null;
+	}
+	async retire(source, nowMs) {
+		parseUnixMs(nowMs, "session relocation time");
+		const existing = await this.read(source);
+		if (existing !== null) return existing;
+		await this.database.batch(this.retirementStatements(source, nowMs));
+		const retiredAtMs = await this.read(source);
+		if (retiredAtMs === null) throw new Error("Session relocation retirement disappeared");
+		return retiredAtMs;
+	}
+	retirementStatements(source, nowMs) {
+		parseUnixMs(nowMs, "session relocation time");
+		const identity = [
+			source.walletId,
+			source.moveId,
+			source.requestDigestHex,
+			source.sourceGeneration
+		];
+		return [
+			prepareD1TenantStatement(this.database, this.scope, `
+        INSERT INTO wallet_relocation_session_fences
+          (namespace, org_id, project_id, env_id, wallet_id, move_id, request_digest_hex, source_generation, retired_at_ms)
+        VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9)
+        ON CONFLICT (namespace, org_id, project_id, env_id, wallet_id) DO NOTHING`, [...identity, nowMs]),
+			prepareD1TenantStatement(this.database, this.scope, `
+        UPDATE wallet_relocation_session_fences SET retired_at_ms = retired_at_ms
+        WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+          AND wallet_id = ?5 AND move_id = ?6 AND request_digest_hex = ?7 AND source_generation = ?8`, identity),
+			this.database.prepare(D1_BATCH_CAS_GUARD_SQL),
+			prepareD1TenantStatement(this.database, this.scope, `
+        UPDATE authorization_wallet_session_quotas AS quota SET remaining_uses = 0, lifecycle_kind = 'exhausted'
+        WHERE quota.lifecycle_kind = 'active' AND EXISTS (
+          SELECT 1 FROM wallet_session_authorizations_v2 AS session
+          WHERE session.namespace = ?1 AND session.org_id = ?2 AND session.project_id = ?3 AND session.env_id = ?4
+            AND session.wallet_id = ?5 AND session.retired_at_ms IS NULL
+            AND session.namespace = quota.namespace AND session.tenant_id = quota.tenant_id
+            AND session.quota_id = quota.quota_id AND session.wallet_session_id = quota.wallet_session_id
+        )`, [source.walletId]),
+			prepareD1TenantStatement(this.database, this.scope, `
+        UPDATE wallet_session_hosted_credentials_v2 SET lifecycle_kind = 'retired',
+          retired_at_ms = MAX(issued_at_ms, ?6)
+        WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+          AND wallet_id = ?5 AND lifecycle_kind = 'active' AND retired_at_ms IS NULL`, [source.walletId, nowMs]),
+			prepareD1TenantStatement(this.database, this.scope, `
+        UPDATE wallet_session_authorizations_v2 SET retired_at_ms = MAX(issued_at_ms, ?6)
+        WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+          AND wallet_id = ?5 AND retired_at_ms IS NULL`, [source.walletId, nowMs])
+		];
+	}
+	async read(source) {
+		const row = await prepareD1TenantStatement(this.database, this.scope, `
+      SELECT wallet_id, move_id, request_digest_hex, source_generation, retired_at_ms
+      FROM wallet_relocation_session_fences
+      WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4 AND wallet_id = ?5`, [source.walletId]).first();
+		if (!row) return null;
+		if (!source.matches(row)) throw new Error("Session relocation identity conflicts with its source fence");
+		return parseUnixMs(row.retired_at_ms, "stored session relocation time");
+	}
+};
+//#endregion
+export { D1WalletRelocationSessions, WalletRelocationSessionSource };
+
+//# sourceMappingURL=d1WalletRelocationSessions.js.map

package/dist/esm/router/cloudflare/d1/wallet/d1WalletRelocationWriteBlock.js

@@ -0,0 +1,133 @@
+import { parseUnixMs } from "../../../../shared-ts/src/passkey-custody/primitives.js";
+import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
+import { prepareD1TenantStatement } from "../../../../core/d1TenantStore.js";
+import { D1WalletCeremonyActivity } from "../ed25519Yao/d1WalletCeremonyActivity.js";
+import { D1WalletAuthorizationSnapshot } from "./d1WalletAuthorizationSnapshot.js";
+import { D1WalletRelocationSessions } from "./d1WalletRelocationSessions.js";
+import { D1WalletAuthorizationFreeze } from "./d1WalletAuthorizationFreeze.js";
+//#region src/router/cloudflare/d1/wallet/d1WalletRelocationWriteBlock.ts
+const SCOPE = "namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4 AND wallet_id = ?5";
+var D1WalletRelocationWriteBlock = class {
+	constructor(database, scope) {
+		this.database = database;
+		this.scope = scope;
+	}
+	async check(source, nowMs) {
+		const identity = [
+			source.walletId,
+			source.moveId,
+			source.requestDigestHex,
+			source.sourceGeneration
+		];
+		await prepareD1TenantStatement(this.database, this.scope, `
+      INSERT INTO wallet_relocation_write_blocks
+        (namespace, org_id, project_id, env_id, wallet_id, move_id, request_digest_hex,
+         source_generation, state, started_at_ms)
+      SELECT ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, 'draining', ?9
+      FROM wallet_execution_generations WHERE ${SCOPE} AND generation = ?8 AND state = 'active'
+      ON CONFLICT DO NOTHING`, [...identity, nowMs]).run();
+		const state = await this.read(source);
+		if (state === "checked") return "ready";
+		if (state !== "draining") throw new Error("Wallet write block is unavailable");
+		if (await new D1WalletRelocationSessions(this.database, this.scope).hasPendingOperations(source.walletId) || await new D1WalletCeremonyActivity(this.database, this.scope).hasPending(source.walletId)) return "draining";
+		await prepareD1TenantStatement(this.database, this.scope, `
+      INSERT INTO wallet_relocation_authorization_fences
+        (namespace, org_id, project_id, env_id, wallet_id, move_id, request_digest_hex, source_generation, frozen_at_ms)
+      SELECT ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9 FROM wallet_relocation_write_blocks
+      WHERE ${SCOPE} AND move_id = ?6 AND request_digest_hex = ?7 AND source_generation = ?8 AND state = 'draining'
+      ON CONFLICT DO NOTHING`, [...identity, nowMs]).run();
+		await new D1WalletAuthorizationSnapshot(this.database, this.scope).assertCapacity(source.walletId);
+		await this.database.batch([prepareD1TenantStatement(this.database, this.scope, `UPDATE wallet_relocation_write_blocks
+        SET state = 'checked' WHERE ${SCOPE} AND move_id = ?6 AND request_digest_hex = ?7
+          AND source_generation = ?8 AND state IN ('draining', 'checked')
+          AND EXISTS (SELECT 1 FROM wallet_relocation_authorization_fences fence
+            WHERE fence.namespace = ?1 AND fence.org_id = ?2 AND fence.project_id = ?3
+              AND fence.env_id = ?4 AND fence.wallet_id = ?5 AND fence.move_id = ?6
+              AND fence.request_digest_hex = ?7 AND fence.source_generation = ?8)`, identity), this.database.prepare(D1_BATCH_CAS_GUARD_SQL)]);
+		return "ready";
+	}
+	async release(source, nowMs) {
+		const identity = [
+			source.walletId,
+			source.moveId,
+			source.requestDigestHex,
+			source.sourceGeneration
+		];
+		await this.database.batch([
+			prepareD1TenantStatement(this.database, this.scope, `INSERT INTO wallet_relocation_write_blocks
+        (namespace, org_id, project_id, env_id, wallet_id, move_id, request_digest_hex,
+         source_generation, state, started_at_ms)
+        VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, 'released', ?9)
+        ON CONFLICT DO UPDATE SET state = 'released'
+        WHERE request_digest_hex = ?7 AND source_generation = ?8 AND state != 'frozen'`, [...identity, nowMs]),
+			this.database.prepare(D1_BATCH_CAS_GUARD_SQL),
+			prepareD1TenantStatement(this.database, this.scope, `DELETE FROM wallet_relocation_authorization_fences
+        WHERE ${SCOPE} AND move_id = ?6 AND request_digest_hex = ?7 AND source_generation = ?8`, identity)
+		]);
+	}
+	async freeze(source, nowMs) {
+		const sessions = new D1WalletRelocationSessions(this.database, this.scope);
+		const freeze = new D1WalletAuthorizationFreeze(this.database, this.scope);
+		const completed = await prepareD1TenantStatement(this.database, this.scope, `
+      SELECT fence.frozen_at_ms, retired.retired_at_ms FROM wallet_relocation_authorization_fences fence
+      JOIN wallet_relocation_session_fences retired
+        USING (namespace, org_id, project_id, env_id, wallet_id, move_id, request_digest_hex, source_generation)
+      WHERE fence.namespace = ?1 AND fence.org_id = ?2 AND fence.project_id = ?3 AND fence.env_id = ?4
+        AND fence.wallet_id = ?5 AND fence.move_id = ?6 AND fence.request_digest_hex = ?7 AND fence.source_generation = ?8`, [
+			source.walletId,
+			source.moveId,
+			source.requestDigestHex,
+			source.sourceGeneration
+		]).first();
+		if (completed) return {
+			retiredAtMs: parseUnixMs(completed.retired_at_ms, "session retirement"),
+			frozenAtMs: parseUnixMs(completed.frozen_at_ms, "authorization freeze")
+		};
+		const state = await this.read(source);
+		if (state !== "checked" && state !== "frozen") throw new Error("Wallet capacity is not reserved");
+		if (state === "checked") {
+			const identity = [
+				source.walletId,
+				source.moveId,
+				source.requestDigestHex,
+				source.sourceGeneration
+			];
+			try {
+				await this.database.batch([
+					prepareD1TenantStatement(this.database, this.scope, `DELETE FROM wallet_relocation_authorization_fences
+          WHERE ${SCOPE} AND move_id = ?6 AND request_digest_hex = ?7 AND source_generation = ?8`, identity),
+					this.database.prepare(D1_BATCH_CAS_GUARD_SQL),
+					...sessions.retirementStatements(source, nowMs),
+					...freeze.freezeStatements(source, nowMs),
+					prepareD1TenantStatement(this.database, this.scope, `UPDATE wallet_relocation_write_blocks SET state = 'frozen'
+          WHERE ${SCOPE} AND move_id = ?6 AND request_digest_hex = ?7 AND source_generation = ?8
+            AND state = 'checked'`, identity),
+					this.database.prepare(D1_BATCH_CAS_GUARD_SQL)
+				]);
+			} catch (error) {
+				if (await this.read(source) !== "frozen") throw error;
+			}
+		}
+		return {
+			retiredAtMs: await sessions.retire(source, nowMs),
+			frozenAtMs: await freeze.freeze(source, nowMs)
+		};
+	}
+	async read(source) {
+		const row = await prepareD1TenantStatement(this.database, this.scope, `SELECT * FROM wallet_relocation_write_blocks
+      WHERE ${SCOPE} AND move_id = ?6`, [source.walletId, source.moveId]).first();
+		if (!row) return null;
+		if (!source.matches(row)) throw new Error("Wallet write block identity conflicts");
+		switch (row.state) {
+			case "draining":
+			case "checked":
+			case "released":
+			case "frozen": return row.state;
+			default: throw new Error("Wallet write block state is invalid");
+		}
+	}
+};
+//#endregion
+export { D1WalletRelocationWriteBlock };
+
+//# sourceMappingURL=d1WalletRelocationWriteBlock.js.map

package/dist/esm/router/cloudflare/d1/walletObjectAddresses.js

@@ -0,0 +1,47 @@
+import { prepareD1TenantStatement } from "../../../core/d1TenantStore.js";
+import { WalletObjectAddresses } from "../runtime/walletObjectAddresses.js";
+//#region src/router/cloudflare/d1/walletObjectAddresses.ts
+const READ = `SELECT router, deriver_a, deriver_b, signing_worker FROM wallet_object_addresses
+  WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+    AND wallet_id = ?5 AND ownership_generation = ?6`;
+var D1WalletObjectAddresses = class {
+	constructor(database, scope) {
+		this.database = database;
+		this.scope = scope;
+	}
+	async initialize(identity, router, credential) {
+		const existing = await this.read(identity);
+		if (existing !== null) return existing;
+		const response = await router.fetch("https://mpc-router.router-ab.internal/router-ab/router/wallet/allocate", {
+			method: "POST",
+			headers: { "x-router-ab-internal-service-auth": credential },
+			signal: AbortSignal.timeout(1e4)
+		});
+		if (!response.ok) throw new Error("Custody address allocation failed");
+		return this.insert(identity, WalletObjectAddresses.parse(await response.json()));
+	}
+	async read(identity) {
+		const row = await prepareD1TenantStatement(this.database, this.scope, READ, [identity.walletId, identity.ownershipGeneration]).first();
+		return row === null ? null : WalletObjectAddresses.parse(row);
+	}
+	/** Competing allocations return the same persisted winner before either starts work. */
+	async insert(identity, addresses) {
+		const identityValues = [identity.walletId, identity.ownershipGeneration];
+		const row = (await this.database.batch([prepareD1TenantStatement(this.database, this.scope, `INSERT INTO wallet_object_addresses
+        (namespace, org_id, project_id, env_id, wallet_id, ownership_generation,
+         router, deriver_a, deriver_b, signing_worker)
+        VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10)
+        ON CONFLICT (namespace, org_id, project_id, env_id, wallet_id, ownership_generation) DO NOTHING`, [
+			...identityValues,
+			addresses.router,
+			addresses.deriver_a,
+			addresses.deriver_b,
+			addresses.signing_worker
+		]), prepareD1TenantStatement(this.database, this.scope, READ, identityValues)]))[1]?.results?.[0];
+		return WalletObjectAddresses.parse(row);
+	}
+};
+//#endregion
+export { D1WalletObjectAddresses };
+
+//# sourceMappingURL=walletObjectAddresses.js.map

package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnAuthService.js

@@ -1,7 +1,7 @@
 import { parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { WalletLifecycleLocator } from "../../../../authorization/lifecycleRouting.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { failedVerification, failure } from "../../../../shared-ts/src/utils/failure.js";
 import { decodeWebAuthnBase64UrlOrBase64, parseWebAuthnAuthenticationCredential, parseWebAuthnClientDataJsonBase64url, webAuthnCredentialIdB64uFromCredential, webAuthnOriginHostnameOrEmpty } from "../../../auth/webAuthnCredentialCodecs.js";
@@ -15,6 +15,7 @@ function errorMessage(error) {
 }
 var CloudflareD1WebAuthnAuthService = class {
 	constructor(input) {
+		this.lifecycleRouting = input.lifecycleRouting;
 		this.webAuthnStore = input.webAuthnStore;
 		this.walletManifestSource = input.walletManifestSource;
 		this.walletAuthMethodStore = input.walletAuthMethodStore;
@@ -91,6 +92,8 @@ var CloudflareD1WebAuthnAuthService = class {
 				createdAtMs,
 				expiresAtMs
 			};
+			const publication = await publishPasskeyChallengeHome(this.lifecycleRouting, userId.value, challengeId);
+			if (!publication.ok) return publication;
 			await this.webAuthnStore.writeChallenge({
 				challengeId,
 				challengeKind: "login",
@@ -152,13 +155,14 @@ var CloudflareD1WebAuthnAuthService = class {
 				createdAtMs,
 				expiresAtMs
 			};
-			await this.webAuthnStore.writeChallenge({
+			const stored = await this.webAuthnStore.writeChallenge({
 				challengeId,
 				challengeKind: "sync",
 				record,
 				createdAtMs,
 				expiresAtMs
 			});
+			if (!stored.ok) return stored;
 			return {
 				ok: true,
 				challengeId,
@@ -358,12 +362,14 @@ var CloudflareD1WebAuthnAuthService = class {
 		try {
 			const challengeId = normalizeOptionalTrimmedString(input.challengeId ?? input.challenge_id);
 			if (!challengeId) return failure("invalid_body", "Missing challengeId");
-			const challenge = await this.webAuthnStore.consumeSyncChallenge(challengeId);
-			if (!challenge) return failedVerification("challenge_expired_or_invalid", "Sync challenge expired or invalid");
 			const credential = parseWebAuthnAuthenticationCredential(input.webauthn_authentication);
 			if (!credential) return failedVerification("invalid_body", "Missing webauthn_authentication");
 			const credentialId = webAuthnCredentialIdB64uFromCredential(credential);
 			if (!credentialId.ok) return failedVerification(credentialId.code, credentialId.message);
+			const consumed = await this.webAuthnStore.consumeSyncChallenge(challengeId, credentialId.credentialIdB64u);
+			if (!consumed.ok) return failedVerification(consumed.code, consumed.message);
+			const challenge = consumed.record;
+			if (!challenge) return failedVerification("challenge_expired_or_invalid", "Sync challenge expired or invalid");
 			const syncBinding = webAuthnSyncCredentialBinding(await this.webAuthnStore.readBindingByCredential({
 				rpId: challenge.rpId,
 				credentialIdB64u: credentialId.credentialIdB64u
@@ -457,6 +463,21 @@ function webAuthnLoginChallengeTtlMs(input) {
 function compareAuthenticatorSlots(left, right) {
 	return (Number(left.signerSlot || 0) || 0) - (Number(right.signerSlot || 0) || 0);
 }
+async function publishPasskeyChallengeHome(publisher, walletId, challengeId) {
+	if (!publisher) return { ok: true };
+	try {
+		if (!(await publisher.publishLifecycle({
+			walletId,
+			locator: WalletLifecycleLocator.parse({
+				kind: "passkey_challenge",
+				value: challengeId
+			})
+		})).ok) return failure("wallet_home_conflict", "Passkey challenge home conflicts");
+		return { ok: true };
+	} catch {
+		return failure("wallet_home_unavailable", "Passkey challenge home is unavailable");
+	}
+}
 //#endregion
 export { CloudflareD1WebAuthnAuthService };
 

package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnRecords.js

@@ -1,7 +1,6 @@
 import { parsePasskeyEnvelopeId, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWalletRecoveryOperationId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { parseEnvelopeRevision } from "../../../../shared-ts/src/passkey-custody/primitives.js";
 import { normalizeRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { parseWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
@@ -37,18 +36,18 @@ function parseWebAuthnLoginChallengeRecord(input) {
 	])) return null;
 	const version = normalizeOptionalTrimmedString(record.version);
 	const challengeId = normalizeOptionalTrimmedString(record.challengeId);
-	const userId = normalizeOptionalTrimmedString(record.userId);
+	const userId = parseWalletId(record.userId);
 	const rpId = normalizeOptionalTrimmedString(record.rpId);
 	const challengeB64u = normalizeOptionalTrimmedString(record.challengeB64u);
 	const createdAtMs = positiveInteger(record.createdAtMs);
 	const expiresAtMs = positiveInteger(record.expiresAtMs);
 	if (version !== "webauthn_login_challenge_v1") return null;
-	if (!challengeId || !userId || !rpId || !challengeB64u) return null;
+	if (!challengeId || !userId.ok || !rpId || !challengeB64u) return null;
 	if (createdAtMs === null || expiresAtMs === null) return null;
 	return {
 		version: "webauthn_login_challenge_v1",
 		challengeId,
-		userId,
+		userId: userId.value,
 		rpId,
 		challengeB64u,
 		createdAtMs,
@@ -424,39 +423,6 @@ function webAuthnSyncWalletBindingFromCredentialBinding(binding) {
 		signerSlot
 	};
 }
-function parseNearPublicKey(row) {
-	const candidate = parseWebAuthnJsonInput(row.record_json);
-	if (candidate === null || typeof candidate !== "object" || Array.isArray(candidate)) return null;
-	let prototype;
-	try {
-		prototype = Object.getPrototypeOf(candidate);
-	} catch {
-		return null;
-	}
-	if (prototype !== Object.prototype && prototype !== null) return null;
-	const record = candidate;
-	if (Object.keys(record).some((field) => ![
-		"publicKey",
-		"kind",
-		"authBinding",
-		"signerSlot",
-		"createdAtMs",
-		"updatedAtMs"
-	].includes(field))) return null;
-	const publicKey = normalizeOptionalTrimmedString(record.publicKey);
-	const kind = parseNearPublicKeyKind(normalizeOptionalTrimmedString(record.kind));
-	const authBinding = parseNearPublicKeyAuthBinding(record);
-	if (authBinding === null) return null;
-	if (!publicKey || !kind) return null;
-	return {
-		publicKey,
-		kind,
-		signerSlot: optionalNonNegativeInteger(record.signerSlot),
-		...authBinding ? { authBinding } : {},
-		createdAtMs: optionalNonNegativeInteger(record.createdAtMs),
-		updatedAtMs: optionalNonNegativeInteger(record.updatedAtMs)
-	};
-}
 function parseWebAuthnJsonInput(input) {
 	if (typeof input === "string") try {
 		return JSON.parse(input);
@@ -497,39 +463,7 @@ function optionalNumberArray(input) {
 	}
 	return values;
 }
-function parseNearPublicKeyKind(input) {
-	switch (input) {
-		case "threshold":
-		case "local":
-		case "backup":
-		case "ephemeral": return input;
-		default: return null;
-	}
-}
-function parseNearPublicKeyAuthBinding(record) {
-	if (Object.prototype.hasOwnProperty.call(record, "rpId") || Object.prototype.hasOwnProperty.call(record, "credentialIdB64u")) return null;
-	if (record.authBinding === void 0) return void 0;
-	const candidate = record.authBinding;
-	if (candidate === null || typeof candidate !== "object" || Array.isArray(candidate)) return null;
-	let prototype;
-	try {
-		prototype = Object.getPrototypeOf(candidate);
-	} catch {
-		return null;
-	}
-	if (prototype !== Object.prototype && prototype !== null) return null;
-	const authBinding = candidate;
-	const kind = normalizeOptionalTrimmedString(authBinding.kind);
-	const rpId = parseWebAuthnRpId(authBinding.rpId);
-	const credentialIdB64u = normalizeOptionalTrimmedString(authBinding.credentialIdB64u);
-	if (kind !== "passkey" || !rpId.ok || !credentialIdB64u) return null;
-	return {
-		kind: "passkey",
-		rpId: rpId.value,
-		credentialIdB64u
-	};
-}
 //#endregion
-export { buildWebAuthnRecoveryContinuityAnchorRecord, parseNearPublicKey, parseWebAuthnAuthenticator, parseWebAuthnAuthenticatorRowDeviceInfo, parseWebAuthnBinding, parseWebAuthnLoginChallengeRecord, parseWebAuthnRecoveryRegistrationChallengeRecord, parseWebAuthnSyncChallengeRecord, webAuthnSyncWalletBindingFromCredentialBinding };
+export { buildWebAuthnRecoveryContinuityAnchorRecord, parseWebAuthnAuthenticator, parseWebAuthnAuthenticatorRowDeviceInfo, parseWebAuthnBinding, parseWebAuthnLoginChallengeRecord, parseWebAuthnRecoveryRegistrationChallengeRecord, parseWebAuthnSyncChallengeRecord, webAuthnSyncWalletBindingFromCredentialBinding };
 
 //# sourceMappingURL=d1WebAuthnRecords.js.map

package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnStore.js

@@ -1,9 +1,9 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { prepareD1TenantStatement } from "../../../../core/d1TenantStore.js";
-import { INSERT_WEBAUTHN_AUTHENTICATOR_SQL, UPSERT_WEBAUTHN_AUTHENTICATOR_SQL, webAuthnAuthenticatorRows, webAuthnChallengeRows, webAuthnCredentialBindingRows } from "../../../../core/webAuthnD1Statements.js";
+import { reservePasskeyCredential } from "../../../../core/passkeyCredentialClaims.js";
 import { prepareD1WebAuthnCredentialBindingInsertStatement } from "../../../../core/WebAuthnCredentialBindingStore.js";
 import { parseWebAuthnAuthenticator, parseWebAuthnBinding, parseWebAuthnLoginChallengeRecord, parseWebAuthnRecoveryRegistrationChallengeRecord, parseWebAuthnSyncChallengeRecord } from "./d1WebAuthnRecords.js";
+import { INSERT_WEBAUTHN_AUTHENTICATOR_SQL, UPSERT_WEBAUTHN_AUTHENTICATOR_SQL, webAuthnAuthenticatorRows, webAuthnChallengeRows, webAuthnCredentialBindingRows } from "../../../../core/webAuthnD1Statements.js";
 //#region src/router/cloudflare/d1/webauthn/d1WebAuthnStore.ts
 function prepareAuthenticatorStatement(sql, input) {
 	return input.database.prepare(sql).bind(input.scope.namespace, input.scope.orgId, input.scope.projectId, input.scope.envId, input.userId, input.record.credentialIdB64u, input.record.credentialPublicKeyB64u, input.record.counter, input.record.createdAtMs, input.record.updatedAtMs, JSON.stringify(input.record.deviceInfo));
@@ -20,6 +20,8 @@ function prepareD1WebAuthnAuthenticatorInsertStatement(input) {
 var CloudflareD1WebAuthnStore = class {
 	constructor(input) {
 		this.prepare = (sql, values) => prepareD1TenantStatement(this.database, this.scope, sql, values);
+		this.credentialClaims = input.credentialClaims;
+		this.syncChallenges = input.syncChallenges;
 		this.database = input.database;
 		this.scope = {
 			namespace: input.namespace,
@@ -29,7 +31,9 @@ var CloudflareD1WebAuthnStore = class {
 		};
 	}
 	async writeChallenge(input) {
+		if (input.challengeKind === "sync" && this.syncChallenges) return this.syncChallenges.create(input.record);
 		await webAuthnChallengeRows.upsert(this.prepare, input).run();
+		return { ok: true };
 	}
 	async consumeLoginChallenge(challengeId) {
 		return parseWebAuthnLoginChallengeRecord((await this.consumeChallenge({
@@ -37,11 +41,18 @@ var CloudflareD1WebAuthnStore = class {
 			challengeKind: "login"
 		}))?.record_json);
 	}
-	async consumeSyncChallenge(challengeId) {
-		return parseWebAuthnSyncChallengeRecord((await this.consumeChallenge({
+	async consumeSyncChallenge(challengeId, credentialIdB64u) {
+		if (this.syncChallenges) return this.syncChallenges.consume({
 			challengeId,
-			challengeKind: "sync"
-		}))?.record_json);
+			credentialIdB64u
+		});
+		return {
+			ok: true,
+			record: parseWebAuthnSyncChallengeRecord((await this.consumeChallenge({
+				challengeId,
+				challengeKind: "sync"
+			}))?.record_json)
+		};
 	}
 	async readRecoveryRegistrationChallenge(challengeId, nowMs) {
 		return parseWebAuthnRecoveryRegistrationChallengeRecord((await this.prepare(`SELECT record_json
@@ -90,7 +101,12 @@ var CloudflareD1WebAuthnStore = class {
 			record: input.record
 		});
 	}
-	prepareCredentialBindingInsertStatement(record) {
+	async prepareCredentialBindingInsertStatement(record) {
+		await reservePasskeyCredential(this.credentialClaims, {
+			walletId: record.userId,
+			rpId: record.rpId,
+			credentialIdB64u: record.credentialIdB64u
+		});
 		return prepareD1WebAuthnCredentialBindingInsertStatement({
 			database: this.database,
 			scope: this.scope,

package/dist/esm/router/cloudflare/runtime/routerAbServiceBindings.js

@@ -1,4 +1,35 @@
+import { WALLET_OBJECT_ADDRESSES_HEADER, WALLET_OBJECT_IDENTITY_HEADER, readWalletObjectIdentityHeader } from "./walletObjectAddresses.js";
+import { D1WalletObjectAddresses } from "../d1/walletObjectAddresses.js";
 //#region src/router/cloudflare/runtime/routerAbServiceBindings.ts
+/** Apply only after the host admits this request to the wallet's fixed home. */
+var WalletHomeCustodyBinding = class {
+	constructor(binding, home, database, namespace, initialAddresses) {
+		this.binding = binding;
+		this.home = home;
+		this.database = database;
+		this.namespace = namespace;
+		this.initialAddresses = initialAddresses;
+	}
+	async fetch(input, init) {
+		const request = new Request(input, init);
+		request.headers.set("x-seams-wallet-home-region", this.home);
+		request.headers.delete(WALLET_OBJECT_ADDRESSES_HEADER);
+		const identity = readWalletObjectIdentityHeader(request.headers);
+		request.headers.delete(WALLET_OBJECT_IDENTITY_HEADER);
+		if (identity !== null) {
+			const store = new D1WalletObjectAddresses(this.database, {
+				namespace: this.namespace,
+				orgId: identity.orgId,
+				projectId: identity.projectId,
+				envId: identity.envId
+			});
+			const addresses = this.initialAddresses?.resolve(this.namespace, identity) ?? await store.read(identity);
+			if (addresses === null) throw new Error("Wallet object addresses are not initialized");
+			request.headers.set(WALLET_OBJECT_ADDRESSES_HEADER, JSON.stringify(addresses));
+		}
+		return this.binding.fetch(request);
+	}
+};
 const ROUTER_AB_MPC_ROUTER_ORIGIN = "https://mpc-router.router-ab.internal";
 const ROUTER_AB_SIGNING_WORKER_ORIGIN = "https://signing-worker.router-ab.internal";
 var RouterAbServiceBindingDispatcher = class {
@@ -28,6 +59,6 @@ function createRouterAbServiceBindingFetch(env) {
 	return dispatcher.fetch.bind(dispatcher);
 }
 //#endregion
-export { ROUTER_AB_MPC_ROUTER_ORIGIN, ROUTER_AB_SIGNING_WORKER_ORIGIN, createRouterAbServiceBindingFetch };
+export { ROUTER_AB_MPC_ROUTER_ORIGIN, ROUTER_AB_SIGNING_WORKER_ORIGIN, WalletHomeCustodyBinding, createRouterAbServiceBindingFetch };
 
 //# sourceMappingURL=routerAbServiceBindings.js.map

package/dist/esm/router/cloudflare/runtime/staticWalletConsoleBinding.js

@@ -65,6 +65,7 @@ async function handleStaticWalletConsoleRequestV1(config, input, init) {
 	const body = await request.json().catch(() => null);
 	switch (new URL(request.url).pathname) {
 		case WALLET_CONSOLE_OP_PATHS_V1.publishableKeyAuth: return publishableKeyResponse(config, body);
+		case WALLET_CONSOLE_OP_PATHS_V1.registrationContext: return registrationContextResponse(config, body);
 		case WALLET_CONSOLE_OP_PATHS_V1.secretKeyAuth: return secretKeyResponse(config, body);
 		case WALLET_CONSOLE_OP_PATHS_V1.projectEnvironments: return projectEnvironmentsResponse(config, body);
 		case WALLET_CONSOLE_OP_PATHS_V1.tenantRootActiveLineage: return activeLineageResponse(config, body);
@@ -85,6 +86,24 @@ function publishableKeyResponse(config, value) {
 		principal: principal(config)
 	});
 }
+function registrationContextResponse(config, value) {
+	const auth = publishableKeyResponse(config, value);
+	if (!auth.ok) return auth;
+	return json({
+		ok: true,
+		principal: principal(config),
+		environment: projectEnvironment(config)
+	});
+}
+function projectEnvironment(config) {
+	return {
+		id: config.deployment.environmentId,
+		projectId: config.deployment.projectId,
+		key: config.deployment.environmentKey,
+		signingRootVersion: config.deployment.signingRootVersion,
+		status: "ACTIVE"
+	};
+}
 function secretKeyResponse(config, value) {
 	const body = record(value);
 	if (!config.credential.secretKey || !body || body.secret !== config.credential.secretKey) return authFailure("secret_key_invalid", "Secret key is invalid");
@@ -105,13 +124,7 @@ function projectEnvironmentsResponse(config, value) {
 	if (!context || context.orgId !== config.deployment.orgId) return json(failure("environment_not_found", "Environment not found"), 404);
 	return json({
 		ok: true,
-		environments: [{
-			id: config.deployment.environmentId,
-			projectId: config.deployment.projectId,
-			key: config.deployment.environmentKey,
-			signingRootVersion: config.deployment.signingRootVersion,
-			status: "ACTIVE"
-		}]
+		environments: [projectEnvironment(config)]
 	});
 }
 function activeLineageResponse(config, value) {