@seams/wallet-server 0.7.3 → 0.9.0

package/cloudflare-router-ab/scripts/prepare-local-runtime-config.mjs

@@ -7,10 +7,6 @@ import { fileURLToPath } from 'node:url';
 const require = createRequire(import.meta.url);
 const runtimeRoot = fileURLToPath(new URL('../', import.meta.url));
 const walletServerRoot = path.dirname(require.resolve('@seams/wallet-server/package.json'));
-export { localPeerVerifyingKeyHex } from './local-key-material.mjs';
-
-import { localPeerSigningKeyBase64Url, localPeerVerifyingKeyHex } from './local-key-material.mjs';
-
 const localPortOffset = Number(process.env.SEAMS_LOCAL_PORT_OFFSET || 0);
 const STRICT_WORKER_ROLES = Object.freeze([
   { role: 'router', port: 4102 + localPortOffset },
@@ -63,8 +59,6 @@ export function prepareLocalHostedWalletGatewayConfig(input) {
   const outputConfigPath = path.join(outputRoot, 'wrangler.local-hosted-wallet-gateway.toml');
   const secretPath = path.join(outputRoot, '.dev.vars.wallet-gateway');
   const routerEnv = readEnvMap(path.join(localEnvRoot, '.env.router-ab.router.local'));
-  const deriverAEnv = readEnvMap(path.join(localEnvRoot, '.env.router-ab.deriver-a.local'));
-  const deriverBEnv = readEnvMap(path.join(localEnvRoot, '.env.router-ab.deriver-b.local'));
   const signingWorkerEnv = readEnvMap(
     path.join(localEnvRoot, '.env.router-ab.signing-worker.local'),
   );
@@ -102,7 +96,6 @@ export function prepareLocalHostedWalletGatewayConfig(input) {
   const gatewayToSigningWorkerPresignAuthSecret =
     readOrCreateLocalGatewayToSigningWorkerPresignAuthSecret(localEnvRoot);
   const secretValues = {
-    ACCOUNT_ID_DERIVATION_SECRET: localSecret(internalAuthSecret, 'account-id-derivation'),
     GOOGLE_OIDC_CLIENT_ID: optionalText(input.googleOidcClientId),
     HOSTED_WALLET_ORIGINS: appOrigins.join(','),
     LINKED_DEVICE_TARGET_DESCRIPTOR_HMAC_SECRET: localSecret(
@@ -123,13 +116,7 @@ export function prepareLocalHostedWalletGatewayConfig(input) {
     ROUTER_AB_GATEWAY_TO_ROUTER_AUTH_SECRET: gatewayToRouterAuthSecret,
     ROUTER_AB_GATEWAY_TO_SIGNING_WORKER_PRESIGN_AUTH_SECRET:
       gatewayToSigningWorkerPresignAuthSecret,
-    ROUTER_AB_NORMAL_SIGNING_WORKER_ID: requiredEnv(routerEnv, 'SIGNING_WORKER_ID'),
-    ROUTER_AB_PUBLIC_KEYSET_JSON: localPublicKeysetJson({
-      routerEnv,
-      deriverAEnv,
-      deriverBEnv,
-      signingWorkerEnv,
-    }),
+    ROUTER_AB_PUBLIC_KEYSET_JSON: localPublicKeysetJson({ routerEnv, signingWorkerEnv }),
     SEAMS_STAGING_ENV_ID: deployment.deployment.environmentId,
     SEAMS_STAGING_ORG_ID: deployment.deployment.orgId,
     SEAMS_STAGING_PROJECT_ID: deployment.deployment.projectId,
@@ -208,20 +195,6 @@ function localPublicKeysetJson(input) {
         },
       },
     },
-    signer_peer_verifying_keys: {
-      deriver_a: {
-        role: 'signer_a',
-        verifying_key_hex: localPeerVerifyingKeyHex(
-          requiredEnv(input.deriverAEnv, 'DERIVER_A_PEER_SIGNING_KEY'),
-        ),
-      },
-      deriver_b: {
-        role: 'signer_b',
-        verifying_key_hex: localPeerVerifyingKeyHex(
-          requiredEnv(input.deriverBEnv, 'DERIVER_B_PEER_SIGNING_KEY'),
-        ),
-      },
-    },
     signing_worker_server_output_hpke: {
       key_epoch: requiredEnv(input.signingWorkerEnv, 'SIGNING_WORKER_KEY_EPOCH'),
       public_key: requiredEnv(
@@ -390,39 +363,6 @@ export function prepareRouterAbStrictLocalRuntimeConfigs(input) {
       .join('/');
     let config = stripBuildSection(readFileSync(sourcePath, 'utf8'));
     config = replaceTomlAssignment(config, 'main', mainPath);
-    if (role === 'deriver-b' && process.env.ROUTER_AB_WALLET_DO_HARNESS === 'enabled') {
-      config = config.replace(
-        '[[services]]',
-        `[[durable_objects.bindings]]
-name = "DERIVER_B_WALLET_DO"
-class_name = "RouterAbDeriverBWalletDurableObject"
-
-[[migrations]]
-tag = "r150-deriver-b-wallet-sqlite-v1"
-new_sqlite_classes = ["RouterAbDeriverBWalletDurableObject"]
-
-[[services]]`,
-      );
-    }
-    if (role === 'signing-worker' && process.env.ROUTER_AB_WALLET_DO_HARNESS === 'enabled') {
-      const presignBinding = '  { name = "SIGNING_WORKER_PRESIGN_SESSION_DO", class_name = "RouterAbSigningWorkerPresignSessionDurableObject" },';
-      if (!config.includes(presignBinding)) {
-        throw new Error('SigningWorker presign object binding is missing');
-      }
-      config = config.replace(
-        presignBinding,
-        `${presignBinding}
-  { name = "SIGNING_WORKER_WALLET_DO", class_name = "RouterAbSigningWorkerWalletDurableObject" },`,
-      );
-      config = config.replace(
-        '[vars]',
-        `[[migrations]]
-tag = "r150-signing-worker-wallet-sqlite-v1"
-new_sqlite_classes = ["RouterAbSigningWorkerWalletDurableObject"]
-
-[vars]`,
-      );
-    }
     config = applyRoleVars(config, role, {
       sdkRouterUrl,
       routerEnv,
@@ -554,18 +494,6 @@ function applyRoleVars(source, role, env) {
         'DERIVER_B_ENVELOPE_HPKE_PUBLIC_KEY',
         requiredEnv(env.routerEnv, 'DERIVER_B_ED25519_YAO_INPUT_PUBLIC_KEY'),
       );
-      config = setTomlSectionAssignment(
-        config,
-        'vars',
-        'DERIVER_A_PEER_VERIFYING_KEY_HEX',
-        localPeerVerifyingKeyHex(requiredEnv(env.deriverAEnv, 'DERIVER_A_PEER_SIGNING_KEY')),
-      );
-      config = setTomlSectionAssignment(
-        config,
-        'vars',
-        'DERIVER_B_PEER_VERIFYING_KEY_HEX',
-        localPeerVerifyingKeyHex(requiredEnv(env.deriverBEnv, 'DERIVER_B_PEER_SIGNING_KEY')),
-      );
       return setTenantRootDeriverVars(
         setPrivateD1Vars(config, 'DERIVER_ROLE_PRIVATE_D1', env.privateD1Keys.deriverA),
         'A',
@@ -584,18 +512,6 @@ function applyRoleVars(source, role, env) {
         'DERIVER_A_ENVELOPE_HPKE_PUBLIC_KEY',
         requiredEnv(env.routerEnv, 'DERIVER_A_ED25519_YAO_INPUT_PUBLIC_KEY'),
       );
-      config = setTomlSectionAssignment(
-        config,
-        'vars',
-        'DERIVER_A_PEER_VERIFYING_KEY_HEX',
-        localPeerVerifyingKeyHex(requiredEnv(env.deriverAEnv, 'DERIVER_A_PEER_SIGNING_KEY')),
-      );
-      config = setTomlSectionAssignment(
-        config,
-        'vars',
-        'DERIVER_B_PEER_VERIFYING_KEY_HEX',
-        localPeerVerifyingKeyHex(requiredEnv(env.deriverBEnv, 'DERIVER_B_PEER_SIGNING_KEY')),
-      );
       return setTenantRootDeriverVars(
         setPrivateD1Vars(config, 'DERIVER_ROLE_PRIVATE_D1', env.privateD1Keys.deriverB),
         'B',
@@ -646,18 +562,6 @@ function applyRoleVars(source, role, env) {
         'DERIVER_B_CUSTODY_AUTHORITY_VERIFYING_KEY_HEX',
         env.tenantRootKeys.deriverBCustodyAuthorityVerifyingKeyHex,
       );
-      config = setTomlSectionAssignment(
-        config,
-        'vars',
-        'DERIVER_A_PEER_VERIFYING_KEY_HEX',
-        localPeerVerifyingKeyHex(requiredEnv(env.deriverAEnv, 'DERIVER_A_PEER_SIGNING_KEY')),
-      );
-      config = setTomlSectionAssignment(
-        config,
-        'vars',
-        'DERIVER_B_PEER_VERIFYING_KEY_HEX',
-        localPeerVerifyingKeyHex(requiredEnv(env.deriverBEnv, 'DERIVER_B_PEER_SIGNING_KEY')),
-      );
       return setTenantRootPublicKeys(config, env);
     default:
       throw new Error(`unsupported strict local worker role ${role}`);
@@ -768,18 +672,6 @@ function replaceTopologyPublicVars(source, env) {
     'DERIVER_B_ENVELOPE_HPKE_PUBLIC_KEY',
     requiredEnv(env.routerEnv, 'DERIVER_B_ED25519_YAO_INPUT_PUBLIC_KEY'),
   );
-  config = setTomlSectionAssignment(
-    config,
-    'vars',
-    'DERIVER_A_PEER_VERIFYING_KEY_HEX',
-    localPeerVerifyingKeyHex(requiredEnv(env.deriverAEnv, 'DERIVER_A_PEER_SIGNING_KEY')),
-  );
-  config = setTomlSectionAssignment(
-    config,
-    'vars',
-    'DERIVER_B_PEER_VERIFYING_KEY_HEX',
-    localPeerVerifyingKeyHex(requiredEnv(env.deriverBEnv, 'DERIVER_B_PEER_SIGNING_KEY')),
-  );
   return setTomlSectionAssignment(
     config,
     'vars',
@@ -809,9 +701,6 @@ function strictRoleSecretFile(role, env) {
           'hpke-x25519-private-v1:',
           'Deriver A envelope HPKE private key',
         )}`,
-        `DERIVER_A_PEER_SIGNING_KEY=${localPeerSigningKeyBase64Url(
-          requiredEnv(env.deriverAEnv, 'DERIVER_A_PEER_SIGNING_KEY'),
-        )}`,
         `DERIVER_A_ROLE_PRIVATE_D1_KEK=hpke-x25519-role-private-d1-private-v1:${env.privateD1Keys.deriverA.privateKeyHex}`,
         `DERIVER_A_TENANT_ROOT_CREATION_SIGNING_KEY=${env.tenantRootKeys.deriverA.creationSigningSeedB64u}`,
         `DERIVER_A_TENANT_ROOT_ONLINE_HPKE_PRIVATE_KEY=hpke-x25519-private-v1:${env.tenantRootKeys.deriverA.onlineKey.privateKeyHex}`,
@@ -831,9 +720,6 @@ function strictRoleSecretFile(role, env) {
           'hpke-x25519-private-v1:',
           'Deriver B envelope HPKE private key',
         )}`,
-        `DERIVER_B_PEER_SIGNING_KEY=${localPeerSigningKeyBase64Url(
-          requiredEnv(env.deriverBEnv, 'DERIVER_B_PEER_SIGNING_KEY'),
-        )}`,
         `DERIVER_B_ROLE_PRIVATE_D1_KEK=hpke-x25519-role-private-d1-private-v1:${env.privateD1Keys.deriverB.privateKeyHex}`,
         `DERIVER_B_TENANT_ROOT_CREATION_SIGNING_KEY=${env.tenantRootKeys.deriverB.creationSigningSeedB64u}`,
         `DERIVER_B_TENANT_ROOT_ONLINE_HPKE_PRIVATE_KEY=hpke-x25519-private-v1:${env.tenantRootKeys.deriverB.onlineKey.privateKeyHex}`,
@@ -968,12 +854,10 @@ export function resolveLocalTenantRootKeyMaterial(input) {
   );
   const deriverA = localTenantRootDeriverKeyMaterial(
     'A',
-    requiredEnv(deriverAEnv, 'DERIVER_A_PEER_SIGNING_KEY'),
     requiredEnv(deriverAEnv, 'DERIVER_A_ENVELOPE_HPKE_PRIVATE_KEY'),
   );
   const deriverB = localTenantRootDeriverKeyMaterial(
     'B',
-    requiredEnv(deriverBEnv, 'DERIVER_B_PEER_SIGNING_KEY'),
     requiredEnv(deriverBEnv, 'DERIVER_B_ENVELOPE_HPKE_PRIVATE_KEY'),
   );
   return Object.freeze({
@@ -1015,9 +899,9 @@ export function resolveLocalTenantRootKeyMaterial(input) {
   });
 }
 
-function localTenantRootDeriverKeyMaterial(suffix, signingSeed, hpkeSeedHex) {
+function localTenantRootDeriverKeyMaterial(suffix, hpkeSeedHex) {
   const lower = suffix.toLowerCase();
-  const creation = deriveLocalEd25519KeyPair(signingSeed, `tenant-root/${lower}/creation-signing`);
+  const creation = deriveLocalEd25519KeyPair(hpkeSeedHex, `tenant-root/${lower}/creation-signing`);
   return Object.freeze({
     creationSigningKeyId: `local-deriver-${lower}-tenant-root-creation-v1`,
     creationSigningSeedB64u: creation.signingSeedB64u,

package/cloudflare-router-ab/scripts/start-local-role-workers.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { generateKeyPairSync } from 'node:crypto';
 import { spawn, spawnSync } from 'node:child_process';
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
 import http from 'node:http';
 import path from 'node:path';
 import { tmpdir } from 'node:os';
@@ -11,9 +11,8 @@ import { prepareRouterAbStrictLocalRuntimeConfigs } from './prepare-local-runtim
 
 const repoRoot = process.cwd();
 const runtimeRoot = fileURLToPath(new URL('../', import.meta.url));
-const workerBuildDirectory = process.env.ROUTER_AB_WORKER_BUILD_PROFILE === 'dev'
-  ? 'build/dev'
-  : 'build';
+const workerBuildDirectory =
+  process.env.ROUTER_AB_WORKER_BUILD_PROFILE === 'dev' ? 'build/dev' : 'build';
 const options = parseArguments(process.argv.slice(2));
 const localRoot = path.resolve(
   options.root || path.join(tmpdir(), `${path.basename(repoRoot)}-wallet-router-ab`),
@@ -29,6 +28,10 @@ const workerEnv = {
   WRANGLER_REGISTRY_PATH: path.join(localRoot, '.local', 'worker-registry'),
 };
 const children = [];
+const workerRoles = new Map();
+const retiringChildren = new Set();
+let generation = 0;
+let restarting = false;
 let stopping = false;
 
 await main().catch(handleFatalError);
@@ -49,7 +52,8 @@ async function main() {
   applyPrivateD1Migrations(runtime);
   startWorkers(runtime);
   await waitForWorkers(runtime);
-  writeFileSync(workersReadyPath, 'ready\n');
+  writeReadyReceipt();
+  process.on('SIGUSR2', requestRestart.bind(undefined, runtime));
   if (process.stdout.isTTY) {
     console.log('Local Wallet role Workers ready.');
   } else {
@@ -94,11 +98,7 @@ function initializeLocalIdentity() {
   runRequired(
     'Router A/B local identity initialization',
     process.execPath,
-    [
-      fileURLToPath(new URL('./initialize-local-wallet.mjs', import.meta.url)),
-      '--root',
-      localRoot,
-    ],
+    [fileURLToPath(new URL('./initialize-local-wallet.mjs', import.meta.url)), '--root', localRoot],
     repoRoot,
   );
 }
@@ -228,7 +228,8 @@ function startWorker(config) {
     },
   );
   children.push(child);
-  child.once('exit', handleChildExit.bind(undefined, config.role));
+  workerRoles.set(child, config.role);
+  child.once('exit', handleChildExit.bind(undefined, config.role, child));
   child.once('error', handleChildError.bind(undefined, config.role));
 }
 
@@ -243,6 +244,59 @@ function describeWorker(config) {
   return { role: config.role, url: config.url };
 }
 
+function writeReadyReceipt() {
+  generation += 1;
+  const temporary = `${workersReadyPath}.tmp`;
+  writeFileSync(
+    temporary,
+    JSON.stringify({
+      root: localRoot,
+      supervisorPid: process.pid,
+      generation,
+      workers: children.map(describeRunningWorker),
+    }) + '\n',
+  );
+  renameSync(temporary, workersReadyPath);
+}
+
+function describeRunningWorker(child) {
+  return { role: workerRoles.get(child), pid: child.pid };
+}
+
+function requestRestart(runtime) {
+  if (stopping || restarting) return;
+  restarting = true;
+  restartWorkers(runtime).catch(handleFatalError);
+}
+
+async function restartWorkers(runtime) {
+  const previous = [...children];
+  for (const child of previous) {
+    retiringChildren.add(child);
+    stopChild(child);
+  }
+  await delay(2_000);
+  for (const child of previous) forceStopChild(child);
+  const deadline = Date.now() + 5_000;
+  while (previous.some(isRunningChild)) {
+    if (Date.now() >= deadline) throw new Error('Role Workers did not stop for restart');
+    await delay(50);
+  }
+  if (stopping) return;
+  children.splice(0, previous.length);
+  for (const child of previous) workerRoles.delete(child);
+  startWorkers(runtime);
+  await waitForWorkers(runtime);
+  if (stopping) return;
+  writeReadyReceipt();
+  restarting = false;
+  console.log(`Local Wallet role Workers restarted (generation ${generation}).`);
+}
+
+function isRunningChild(child) {
+  return child.exitCode === null && child.signalCode === null;
+}
+
 async function waitForHttp(url, timeoutMs, requireOk) {
   const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline) {
@@ -301,7 +355,8 @@ function handleSigterm() {
   shutdown(143);
 }
 
-function handleChildExit(role, code, signal) {
+function handleChildExit(role, child, code, signal) {
+  if (retiringChildren.delete(child)) return;
   if (stopping) return;
   console.error(`${role} stopped (${signal || String(code ?? 'unknown')})`);
   shutdown(typeof code === 'number' && code > 0 ? code : 1);
@@ -339,13 +394,15 @@ function stopChild(child) {
 }
 
 function forceStopChildren(exitCode) {
-  for (const child of children) {
-    // Detached workers can outlive the package-manager process that launched them.
-    if (!child.pid) continue;
-    try {
-      if (process.platform !== 'win32' && child.pid) process.kill(-child.pid, 'SIGKILL');
-      else child.kill('SIGKILL');
-    } catch {}
-  }
+  for (const child of children) forceStopChild(child);
   process.exit(exitCode);
 }
+
+function forceStopChild(child) {
+  // Detached workers can outlive the package-manager process that launched them.
+  if (!child.pid) return;
+  try {
+    if (process.platform !== 'win32') process.kill(-child.pid, 'SIGKILL');
+    else child.kill('SIGKILL');
+  } catch {}
+}

package/cloudflare-router-ab/wrangler.deriver-a.toml

@@ -43,8 +43,6 @@ DERIVER_ROLE_PRIVATE_D1_ROLE = "deriver_a"
 DERIVER_A_ENVELOPE_HPKE_PRIVATE_KEY_BINDING = "DERIVER_A_ENVELOPE_HPKE_PRIVATE_KEY"
 DERIVER_A_ENVELOPE_HPKE_KEY_EPOCH = "epoch-1"
 DERIVER_B_ENVELOPE_HPKE_KEY_EPOCH = "epoch-1"
-DERIVER_A_PEER_SIGNING_KEY_BINDING = "DERIVER_A_PEER_SIGNING_KEY"
-DERIVER_A_PEER_SIGNING_KEY_EPOCH = "epoch-1"
 DERIVER_B_PEER_BINDING = "DERIVER_B"
 
 [env.staging]
@@ -87,10 +85,6 @@ DERIVER_A_ENVELOPE_HPKE_PRIVATE_KEY_BINDING = "DERIVER_A_ENVELOPE_HPKE_PRIVATE_K
 DERIVER_A_ENVELOPE_HPKE_KEY_EPOCH = "epoch-1"
 DERIVER_A_ENVELOPE_HPKE_PUBLIC_KEY = "x25519:2693d0896a85398a7bef705c714590bbd99e0c91be62323d33c421d5be597257"
 DERIVER_B_ENVELOPE_HPKE_KEY_EPOCH = "epoch-1"
-DERIVER_A_PEER_SIGNING_KEY_BINDING = "DERIVER_A_PEER_SIGNING_KEY"
-DERIVER_A_PEER_SIGNING_KEY_EPOCH = "epoch-1"
-DERIVER_A_PEER_VERIFYING_KEY_HEX = "d6d21d388a92e6eb9d85d9fcdbcba81c383d7102717b7160fab5e2b501555907"
-DERIVER_B_PEER_VERIFYING_KEY_HEX = "1a369e342f555305e278312f3b704465e11fadbbab09134ed897402ed65c2d4a"
 DERIVER_B_PEER_BINDING = "DERIVER_B"
 
 [env.production-testnet]
@@ -132,8 +126,6 @@ DERIVER_ROLE_PRIVATE_D1_ROLE = "deriver_a"
 DERIVER_A_ENVELOPE_HPKE_PRIVATE_KEY_BINDING = "DERIVER_A_ENVELOPE_HPKE_PRIVATE_KEY"
 DERIVER_A_ENVELOPE_HPKE_KEY_EPOCH = "epoch-1"
 DERIVER_B_ENVELOPE_HPKE_KEY_EPOCH = "epoch-1"
-DERIVER_A_PEER_SIGNING_KEY_BINDING = "DERIVER_A_PEER_SIGNING_KEY"
-DERIVER_A_PEER_SIGNING_KEY_EPOCH = "epoch-1"
 DERIVER_B_PEER_BINDING = "DERIVER_B"
 
 [observability]

package/cloudflare-router-ab/wrangler.deriver-b.toml

@@ -24,6 +24,14 @@ name = "ROUTER_TENANT_ROOT_CREATION_DO"
 class_name = "RouterAbTenantRootCreationDurableObject"
 script_name = "router-ab-mpc-router"
 
+[[durable_objects.bindings]]
+name = "DERIVER_B_WALLET_DO"
+class_name = "RouterAbDeriverBWalletDurableObject"
+
+[[migrations]]
+tag = "r150-deriver-b-wallet-sqlite-v1"
+new_sqlite_classes = ["RouterAbDeriverBWalletDurableObject"]
+
 [[services]]
 binding = "DERIVER_A"
 service = "router-ab-deriver-a"
@@ -35,8 +43,6 @@ DERIVER_ROLE_PRIVATE_D1_ROLE = "deriver_b"
 DERIVER_B_ENVELOPE_HPKE_PRIVATE_KEY_BINDING = "DERIVER_B_ENVELOPE_HPKE_PRIVATE_KEY"
 DERIVER_B_ENVELOPE_HPKE_KEY_EPOCH = "epoch-1"
 DERIVER_A_ENVELOPE_HPKE_KEY_EPOCH = "epoch-1"
-DERIVER_B_PEER_SIGNING_KEY_BINDING = "DERIVER_B_PEER_SIGNING_KEY"
-DERIVER_B_PEER_SIGNING_KEY_EPOCH = "epoch-1"
 DERIVER_A_PEER_BINDING = "DERIVER_A"
 
 [env.staging]
@@ -59,6 +65,14 @@ name = "ROUTER_TENANT_ROOT_CREATION_DO"
 class_name = "RouterAbTenantRootCreationDurableObject"
 script_name = "router-ab-mpc-router-staging"
 
+[[env.staging.durable_objects.bindings]]
+name = "DERIVER_B_WALLET_DO"
+class_name = "RouterAbDeriverBWalletDurableObject"
+
+[[env.staging.migrations]]
+tag = "r150-deriver-b-wallet-sqlite-v1"
+new_sqlite_classes = ["RouterAbDeriverBWalletDurableObject"]
+
 [[env.staging.services]]
 binding = "DERIVER_A"
 service = "router-ab-deriver-a-staging"
@@ -71,10 +85,6 @@ DERIVER_B_ENVELOPE_HPKE_PRIVATE_KEY_BINDING = "DERIVER_B_ENVELOPE_HPKE_PRIVATE_K
 DERIVER_B_ENVELOPE_HPKE_KEY_EPOCH = "epoch-1"
 DERIVER_B_ENVELOPE_HPKE_PUBLIC_KEY = "x25519:5e2819f555ecfcc996761ca4558551172f06052fb9f80123a88f4e0094c3b13a"
 DERIVER_A_ENVELOPE_HPKE_KEY_EPOCH = "epoch-1"
-DERIVER_B_PEER_SIGNING_KEY_BINDING = "DERIVER_B_PEER_SIGNING_KEY"
-DERIVER_B_PEER_SIGNING_KEY_EPOCH = "epoch-1"
-DERIVER_A_PEER_VERIFYING_KEY_HEX = "d6d21d388a92e6eb9d85d9fcdbcba81c383d7102717b7160fab5e2b501555907"
-DERIVER_B_PEER_VERIFYING_KEY_HEX = "1a369e342f555305e278312f3b704465e11fadbbab09134ed897402ed65c2d4a"
 DERIVER_A_PEER_BINDING = "DERIVER_A"
 
 [env.production-testnet]
@@ -97,6 +107,14 @@ name = "ROUTER_TENANT_ROOT_CREATION_DO"
 class_name = "RouterAbTenantRootCreationDurableObject"
 script_name = "router-ab-mpc-router-testnet"
 
+[[env.production-testnet.durable_objects.bindings]]
+name = "DERIVER_B_WALLET_DO"
+class_name = "RouterAbDeriverBWalletDurableObject"
+
+[[env.production-testnet.migrations]]
+tag = "r150-deriver-b-wallet-sqlite-v1"
+new_sqlite_classes = ["RouterAbDeriverBWalletDurableObject"]
+
 [[env.production-testnet.services]]
 binding = "DERIVER_A"
 service = "router-ab-deriver-a-testnet"
@@ -108,8 +126,6 @@ DERIVER_ROLE_PRIVATE_D1_ROLE = "deriver_b"
 DERIVER_B_ENVELOPE_HPKE_PRIVATE_KEY_BINDING = "DERIVER_B_ENVELOPE_HPKE_PRIVATE_KEY"
 DERIVER_B_ENVELOPE_HPKE_KEY_EPOCH = "epoch-1"
 DERIVER_A_ENVELOPE_HPKE_KEY_EPOCH = "epoch-1"
-DERIVER_B_PEER_SIGNING_KEY_BINDING = "DERIVER_B_PEER_SIGNING_KEY"
-DERIVER_B_PEER_SIGNING_KEY_EPOCH = "epoch-1"
 DERIVER_A_PEER_BINDING = "DERIVER_A"
 
 [observability]

package/cloudflare-router-ab/wrangler.router.toml

@@ -82,8 +82,6 @@ DERIVER_A_ENVELOPE_HPKE_KEY_EPOCH = "epoch-1"
 DERIVER_A_ENVELOPE_HPKE_PUBLIC_KEY = "x25519:2693d0896a85398a7bef705c714590bbd99e0c91be62323d33c421d5be597257"
 DERIVER_B_ENVELOPE_HPKE_KEY_EPOCH = "epoch-1"
 DERIVER_B_ENVELOPE_HPKE_PUBLIC_KEY = "x25519:5e2819f555ecfcc996761ca4558551172f06052fb9f80123a88f4e0094c3b13a"
-DERIVER_A_PEER_VERIFYING_KEY_HEX = "d6d21d388a92e6eb9d85d9fcdbcba81c383d7102717b7160fab5e2b501555907"
-DERIVER_B_PEER_VERIFYING_KEY_HEX = "1a369e342f555305e278312f3b704465e11fadbbab09134ed897402ed65c2d4a"
 SIGNING_WORKER_SERVER_OUTPUT_HPKE_KEY_EPOCH = "epoch-1"
 SIGNING_WORKER_SERVER_OUTPUT_HPKE_PUBLIC_KEY = "x25519:d0a06a6445d78bc87f449dfac2b427ad1857a0b00d91e20f152031ad49c18010"
 DERIVER_A_PEER_BINDING = "DERIVER_A"

package/cloudflare-router-ab/wrangler.signing-worker.toml

@@ -14,12 +14,17 @@ migrations_dir = "migrations/signing-worker"
 [durable_objects]
 bindings = [
   { name = "SIGNING_WORKER_PRESIGN_SESSION_DO", class_name = "RouterAbSigningWorkerPresignSessionDurableObject" },
+  { name = "SIGNING_WORKER_WALLET_DO", class_name = "RouterAbSigningWorkerWalletDurableObject" },
 ]
 
 [[migrations]]
 tag = "router_ab_signing_worker_v4"
 new_sqlite_classes = ["RouterAbSigningWorkerPresignSessionDurableObject"]
 
+[[migrations]]
+tag = "r150-signing-worker-wallet-sqlite-v1"
+new_sqlite_classes = ["RouterAbSigningWorkerWalletDurableObject"]
+
 [vars]
 ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET_BINDING = "ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET"
 SIGNING_WORKER_PRESIGN_SESSION_DO_BINDING = "SIGNING_WORKER_PRESIGN_SESSION_DO"
@@ -43,6 +48,18 @@ migrations_dir = "migrations/signing-worker"
 name = "SIGNING_WORKER_PRESIGN_SESSION_DO"
 class_name = "RouterAbSigningWorkerPresignSessionDurableObject"
 
+[[env.staging.durable_objects.bindings]]
+name = "SIGNING_WORKER_WALLET_DO"
+class_name = "RouterAbSigningWorkerWalletDurableObject"
+
+[[env.staging.migrations]]
+tag = "router_ab_signing_worker_v4"
+new_sqlite_classes = ["RouterAbSigningWorkerPresignSessionDurableObject"]
+
+[[env.staging.migrations]]
+tag = "r150-signing-worker-wallet-sqlite-v1"
+new_sqlite_classes = ["RouterAbSigningWorkerWalletDurableObject"]
+
 [env.staging.vars]
 ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET_BINDING = "ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET"
 SIGNING_WORKER_PRESIGN_SESSION_DO_BINDING = "SIGNING_WORKER_PRESIGN_SESSION_DO"
@@ -67,6 +84,18 @@ migrations_dir = "migrations/signing-worker"
 name = "SIGNING_WORKER_PRESIGN_SESSION_DO"
 class_name = "RouterAbSigningWorkerPresignSessionDurableObject"
 
+[[env.production-testnet.durable_objects.bindings]]
+name = "SIGNING_WORKER_WALLET_DO"
+class_name = "RouterAbSigningWorkerWalletDurableObject"
+
+[[env.production-testnet.migrations]]
+tag = "router_ab_signing_worker_v4"
+new_sqlite_classes = ["RouterAbSigningWorkerPresignSessionDurableObject"]
+
+[[env.production-testnet.migrations]]
+tag = "r150-signing-worker-wallet-sqlite-v1"
+new_sqlite_classes = ["RouterAbSigningWorkerWalletDurableObject"]
+
 [env.production-testnet.vars]
 ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET_BINDING = "ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET"
 SIGNING_WORKER_PRESIGN_SESSION_DO_BINDING = "SIGNING_WORKER_PRESIGN_SESSION_DO"

package/dist/esm/authorization/domain.js

@@ -3,9 +3,9 @@ import { parseMpcWalletSigningQuotaId, parsePrincipalId, parseTenantId, parseWal
 import { base64UrlEncode } from "../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../shared-ts/src/utils/canonicalPrimitives.js";
+import { parseActiveWalletSessionV1, parseWalletSessionHome } from "../shared-ts/src/device-linking/activeWalletSession.js";
 import { computeCapabilityOperationFingerprintDigest } from "../shared-ts/src/authorization/operationFingerprint.js";
 import "../shared-ts/src/utils/encoders.js";
-import { parseActiveWalletSessionV1 } from "../shared-ts/src/device-linking/activeWalletSession.js";
 import "../shared-ts/src/device-linking/index.js";
 //#region src/authorization/domain.ts
 function buildExactWalletSessionQuotaProjectionV1(fields) {
@@ -340,13 +340,14 @@ function parseHostedWalletSessionOperationCredentialV1(raw) {
 	if (!walletSessionId.ok) throw new Error(`walletSessionId is invalid: ${walletSessionId.error.message}`);
 	return {
 		kind: raw.kind,
+		home: parseWalletSessionHome(raw.home),
 		token,
 		walletSessionId: walletSessionId.value
 	};
 }
 function isHostedWalletSessionOperationCredentialRecordV1(value) {
 	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
-	return Object.keys(value).sort().join("|") === "kind|token|walletSessionId";
+	return Object.keys(value).sort().join("|") === "home|kind|token|walletSessionId";
 }
 function parsePrimaryWalletSessionOperationCredentialToken(value) {
 	if (typeof value !== "string" || !/^wst_[A-Za-z0-9_-]{43}$/.test(value)) throw new Error("primary Wallet Session credential is invalid");

package/dist/esm/authorization/lifecycleRouting.js

@@ -0,0 +1,62 @@
+import { parseLinkDeviceSessionId, parseWalletId } from "../shared-ts/src/utils/domainIds.js";
+import { requireRecord } from "../shared-ts/src/utils/validation.js";
+import { requireVisibleIdentifier } from "../shared-ts/src/utils/routerAbEd25519YaoDigests.js";
+//#region src/authorization/lifecycleRouting.ts
+var WalletLifecycleLocator = class WalletLifecycleLocator {
+	#validated = true;
+	constructor(kind, value) {
+		this.kind = kind;
+		this.value = value;
+		Object.freeze(this);
+	}
+	matches(other) {
+		return this.#validated && other.#validated && this.kind === other.kind && this.value === other.value;
+	}
+	static parse(raw) {
+		const record = requireRecord(raw, "lifecycle locator");
+		if (Object.keys(record).length !== 2 || record.kind !== "yao_recovery" && record.kind !== "yao_export" && record.kind !== "passkey_challenge" && record.kind !== "linked_device") throw new Error("Invalid lifecycle locator");
+		if (record.kind === "passkey_challenge" && (typeof record.value !== "string" || !/^[A-Za-z0-9_-]{22}$/u.test(record.value))) throw new Error("Invalid passkey challenge locator");
+		if (record.kind === "linked_device") {
+			const parsed = parseLinkDeviceSessionId(record.value);
+			if (!parsed.ok) throw new Error(parsed.error.message);
+			return new WalletLifecycleLocator("linked_device", parsed.value);
+		}
+		return new WalletLifecycleLocator(record.kind, requireVisibleIdentifier(record.value, "lifecycle ID"));
+	}
+};
+async function publishWalletLifecycleHome(publisher, kind, admission) {
+	if (!publisher) return { ok: true };
+	const wallet = parseWalletId(admission.application_binding.wallet_id);
+	if (!wallet.ok) return {
+		ok: false,
+		status: 409,
+		code: "wallet_home_conflict",
+		message: "Lifecycle wallet identity is invalid"
+	};
+	try {
+		if (!(await publisher.publishLifecycle({
+			walletId: wallet.value,
+			locator: WalletLifecycleLocator.parse({
+				kind,
+				value: admission.scope.lifecycle_id
+			})
+		})).ok) return {
+			ok: false,
+			status: 409,
+			code: "wallet_home_conflict",
+			message: "Lifecycle belongs to another wallet home"
+		};
+		return { ok: true };
+	} catch {
+		return {
+			ok: false,
+			status: 503,
+			code: "wallet_home_unavailable",
+			message: "Lifecycle home publication is unavailable"
+		};
+	}
+}
+//#endregion
+export { WalletLifecycleLocator, publishWalletLifecycleHome };
+
+//# sourceMappingURL=lifecycleRouting.js.map