@seams/wallet-server 0.8.0 → 0.9.0

package/dist/esm/authorization/service.js

@@ -2,8 +2,8 @@ import { parseHostedWalletSessionExchangeCodeId, parseMpcWalletSigningQuotaId, p
 import { base64UrlEncode } from "../shared-ts/src/utils/base64.js";
 import { sha256BytesUtf8 } from "../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../shared-ts/src/utils/canonicalPrimitives.js";
-import "../shared-ts/src/utils/encoders.js";
 import { parseWalletSessionOperationCredentialV1 } from "../shared-ts/src/device-linking/activeWalletSession.js";
+import "../shared-ts/src/utils/encoders.js";
 import { buildActiveWalletSessionQuota, buildPersistedActiveWalletSessionAuthorizationV2, buildWalletSessionAuthorizationV2, buildWalletSessionCapabilitySubjectsV1, parseHostedWalletSeamsSessionExchangeCode, parseHostedWalletSeamsSessionExchangeNonce, parseHostedWalletSessionCredentialId, parseHostedWalletSessionOperationCredentialV1, parsePrimaryWalletSessionOperationCredentialToken, walletSessionCapabilitySubjectsV1Equal } from "./domain.js";
 import { buildVerifiedOwnerProof, buildVerifiedWalletOperationFactorEvidenceSet } from "./factorEvidence.js";
 import { secureRandomBase64Url } from "../shared-ts/src/utils/secureRandomId.js";
@@ -48,6 +48,7 @@ var AuthorizationService = class {
 		});
 		return {
 			kind: "hosted_wallet_session_exchange_delivery_v2",
+			home: this.ports.sessionRouting?.home() ?? { kind: "direct" },
 			exchangeCode,
 			nonce,
 			appOrigin: input.appOrigin,
@@ -76,6 +77,7 @@ var AuthorizationService = class {
 		if (persisted.kind !== "redeemed") return persisted;
 		const operationCredential = parseHostedWalletSessionOperationCredentialV1({
 			kind: "opaque_hosted_wallet_session_operation_credential_v1",
+			home: this.ports.sessionRouting?.home() ?? { kind: "direct" },
 			token: hostedCredentialToken,
 			walletSessionId: persisted.walletSessionId
 		});
@@ -118,58 +120,68 @@ var AuthorizationService = class {
 	* committed digest cannot reproduce plaintext.
 	*/
 	async issueDirectWalletSessionAuthorizationV2(input) {
-		return await this.issueDirectWalletSessionAuthorizationV2WithReplayMode(input, { kind: "strict" });
+		const committed = await this.commitDirectWalletSessionAuthorizationV2(input, { kind: "strict" }, { kind: "ordinary" });
+		await this.ports.sessionRouting?.publish(committed.publication);
+		return committed.result;
 	}
-	/** The Ed25519 registration caller validates current authority and owner proof first. */
-	async issueDirectRegistrationPromotedWalletSessionAuthorizationV2(input) {
-		return await this.issueDirectWalletSessionAuthorizationV2WithReplayMode(input, { kind: "validated_registration_authority_projection" });
-	}
-	async issueDirectWalletSessionAuthorizationV2WithReplayMode(input, replayMode) {
+	/** Commits locally. Registration publishes the locator with home completion. */
+	async commitDirectWalletSessionAuthorizationV2(input, replayMode, purpose, commitSession = this.ports.grants.commitDirectReplayableWalletSessionAuthorizationV2.bind(this.ports.grants)) {
 		if (input.authority.walletId !== input.walletId) throw new Error("Wallet Session authorization authority does not identify the wallet");
-		const lookup = {
-			tenantId: input.tenantId,
-			principalId: input.principalId,
-			walletId: input.walletId,
-			authorityId: input.authority.authorityId,
-			walletAuthMethodId: input.walletAuthMethodId,
-			mintId: input.mintId
-		};
 		const prepared = await this.prepareWalletSessionAuthorizationV2(input);
-		const alreadyCommitted = await this.ports.grants.readWalletSessionAuthorizationV2ByMint(lookup);
-		if (alreadyCommitted) return directV2AlreadyCommitted(prepared.session, alreadyCommitted.session, replayMode);
-		const { persisted, operationCredential } = await this.prepareDirectWalletSessionCredential(prepared);
-		const commit = await this.ports.grants.commitDirectReplayableWalletSessionAuthorizationV2({ persisted });
-		if (commit.kind === "already_committed") return directV2AlreadyCommitted(prepared.session, commit.committed.session, replayMode);
+		const { persisted, token } = await this.prepareDirectWalletSessionIssuance(prepared);
+		const commit = await commitSession({
+			persisted,
+			purpose
+		});
+		if (commit.kind === "already_committed") return {
+			result: directV2AlreadyCommitted(prepared.session, commit.committed.session, replayMode),
+			publication: committedSessionPublication(commit.committed),
+			registration: commit.registration
+		};
 		return {
-			kind: "issued",
-			session: prepared.session,
-			quota: prepared.quota,
-			operationCredential
+			result: {
+				kind: "issued",
+				session: prepared.session,
+				quota: prepared.quota,
+				operationCredential: parseWalletSessionOperationCredentialV1({
+					kind: "opaque_wallet_session_operation_credential_v1",
+					ownershipGeneration: commit.ownershipGeneration,
+					home: this.ports.sessionRouting?.home() ?? { kind: "direct" },
+					token,
+					walletSessionId: prepared.session.walletSessionId
+				})
+			},
+			publication: committedSessionPublication(persisted),
+			registration: commit.registration
 		};
 	}
 	async prepareDirectWalletSessionCredential(prepared) {
-		const token = `wst_${secureRandomBase64Url(32, "direct V2 Wallet Session operation credentials")}`;
+		const ownershipGeneration = await this.ports.grants.readWalletSessionIssuanceGeneration(prepared.session.walletId);
+		const { persisted, token } = await this.prepareDirectWalletSessionIssuance(prepared);
 		const operationCredential = parseWalletSessionOperationCredentialV1({
 			kind: "opaque_wallet_session_operation_credential_v1",
+			ownershipGeneration,
+			home: this.ports.sessionRouting?.home() ?? { kind: "direct" },
 			token,
 			walletSessionId: prepared.session.walletSessionId
 		});
-		const persisted = buildPersistedActiveWalletSessionAuthorizationV2({
-			session: prepared.session,
-			quota: prepared.quota,
-			primaryOperationCredentialDigestB64u: await digestOpaqueValue(token)
-		});
-		await this.ports.sessionRouting?.publish({
-			kind: "credential",
-			digest: persisted.primaryOperationCredentialDigestB64u,
-			walletId: prepared.session.walletId,
-			expiresAtMs: prepared.session.expiresAtMs
-		});
+		await this.ports.sessionRouting?.publish(committedSessionPublication(persisted));
 		return {
 			persisted,
 			operationCredential
 		};
 	}
+	async prepareDirectWalletSessionIssuance(prepared) {
+		const token = `wst_${secureRandomBase64Url(32, "direct V2 Wallet Session operation credentials")}`;
+		return {
+			persisted: buildPersistedActiveWalletSessionAuthorizationV2({
+				session: prepared.session,
+				quota: prepared.quota,
+				primaryOperationCredentialDigestB64u: await digestOpaqueValue(token)
+			}),
+			token
+		};
+	}
 	async refreshWalletSessionAuthorizationV2AuthorityProjection(input) {
 		const current = input.existing.session;
 		if (current.walletId !== input.authority.walletId || current.authorityId !== input.authority.authorityId || current.walletAuthMethodId !== input.walletAuthMethodId) throw new Error("Direct V2 Wallet Session authority projection identity does not match");
@@ -268,6 +280,14 @@ var AuthorizationService = class {
 			materialActivation: input.materialActivation
 		});
 	}
+	async readEd25519WalletSessionAdmissionSnapshotByOperationCredential(input) {
+		return this.ports.grants.readEd25519WalletSessionAdmissionSnapshotByOperationCredential({
+			tenantId: input.tenantId,
+			tokenHash: await digestOpaqueValue(input.token),
+			nowMs: input.nowMs,
+			materialActivation: input.materialActivation
+		});
+	}
 	async readLiveWalletSessionAuthorizationProjectionByCredential(input) {
 		const status = await this.readExactWalletSessionStatusByOperationCredential(input);
 		if (status.kind !== "active" && status.kind !== "exhausted") return null;
@@ -395,6 +415,14 @@ function parseRequired(value, parser) {
 	if (!parsed.ok) throw new Error("generated authorization identifier was invalid");
 	return parsed.value;
 }
+function committedSessionPublication(committed) {
+	return {
+		kind: "credential",
+		digest: committed.primaryOperationCredentialDigestB64u,
+		walletId: committed.session.walletId,
+		expiresAtMs: committed.session.expiresAtMs
+	};
+}
 //#endregion
 export { AuthorizationService, digestOpaqueValue };
 

package/dist/esm/cloud-host.js

@@ -1,9 +1,9 @@
 import { parseOrgId, parseWalletId, parseWalletRecoveryOperationId, parseWebAuthnRpId } from "./shared-ts/src/utils/domainIds.js";
+import { ensureLeadingSlash, normalizeBoundedPositiveInteger, normalizeLowercaseString, normalizeOptionalTrimmedString, normalizeTrimmedString } from "./shared-ts/src/utils/normalize.js";
+import { isObject, isPlainObject } from "./shared-ts/src/utils/validation.js";
 import { base64UrlDecode, base64UrlEncode } from "./shared-ts/src/utils/base64.js";
 import { sha256Bytes } from "./shared-ts/src/utils/digests.js";
 import "./shared-ts/src/utils/encoders.js";
-import { ensureLeadingSlash, normalizeBoundedPositiveInteger, normalizeLowercaseString, normalizeOptionalTrimmedString, normalizeTrimmedString } from "./shared-ts/src/utils/normalize.js";
-import { isObject, isPlainObject } from "./shared-ts/src/utils/validation.js";
 import { ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, parseRouterAbPublicKeysetV2 } from "./shared-ts/src/utils/routerAbPublicKeyset.js";
 import { ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_STATUS_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1 } from "./shared-ts/src/utils/routerAbEd25519Yao.js";
 import { computeLinkedDeviceSessionClaimDigestV1 } from "./shared-ts/src/device-linking/digests.js";
@@ -17,14 +17,22 @@ import { createRouterApiRouteDefinitions, defineRoute, defineRouteExtension, fin
 import { SessionService, buildCorsOrigins, normalizeCorsOrigin, parseCsvList } from "./core/SessionService.js";
 import { addSecp256k1PublicKeys33, computeEip1559TxHash, encodeEip1559SignedTxFromSignature65, ensureEvmCryptoWasm, secp256k1PrivateKey32ToPublicKey33, secp256k1PublicKey33ToEthereumAddress, sha256BytesSync, signSecp256k1Recoverable, validateSecp256k1PublicKey33, verifySecp256k1Bip340SignatureAgainstPublicKey33, verifySecp256k1RecoverableSignatureAgainstPublicKey33 } from "./core/ThresholdService/evmCryptoWasm.js";
 import { D1_BATCH_CAS_GUARD_SQL, d1ChangedRows, d1Integer, d1Number, formatD1ExecStatement, isD1DatabaseLike, parseD1JsonArrayColumn, parseD1JsonColumn, parseD1JsonObjectColumn, queryD1All, queryD1One } from "./storage/d1Sql.js";
-import { D1WalletStore, WALLET_STORE_D1_SCHEMA_SQL, buildWalletEcdsaSignerRecord, ensureWalletStoreD1Schema, parseWalletEd25519SignerRecord, prepareD1WalletPutSignerStatement, prepareD1WalletPutSubjectStatement } from "./core/d1WalletStore.js";
+import { D1WalletStore, ED25519_SIGNER_ACTIVATION_ID_PATH, WALLET_STORE_D1_SCHEMA_SQL, buildWalletEcdsaSignerRecord, ensureWalletStoreD1Schema, parseWalletEd25519SignerRecord, prepareD1WalletPutSignerStatement, prepareD1WalletPutSubjectStatement, selectWalletEd25519Signer } from "./core/d1WalletStore.js";
 import { prepareD1TenantStatement } from "./core/d1TenantStore.js";
 import { D1WalletAuthMethodStore, WALLET_AUTH_METHOD_D1_STORE, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL, bindWalletAuthMethodIdentity, bindWalletAuthMethodIdentityV2, ensureWalletAuthMethodStoreD1Schema, normalizeWalletAuthMethod, normalizeWalletAuthMethodV2, prepareD1WalletAuthMethodInsertStatement, prepareD1WalletAuthMethodPutStatement, prepareD1WalletAuthMethodV2PutStatement, walletAuthMethodId, walletAuthMethodV2Id } from "./core/d1WalletAuthMethodStore.js";
 import { coerceLogger, normalizeLogger } from "./core/logger.js";
+import { WalletObjectAddressSnapshot, walletObjectIdentity } from "./router/cloudflare/runtime/walletObjectAddresses.js";
 import { RouterAbEcdsaPresignRuntime, parseRouterAbEcdsaPresignRuntimeConfig } from "./core/routerAbSigning/RouterAbEcdsaPresignRuntime.js";
 import { registrationPreparationIdFromString } from "./core/types.js";
 import { ActionType } from "./shared-ts/src/near/actions.js";
 import { enforceDelegatePolicy, executeSignedDelegateWithRelayer, normalizeHashToBytes, validateDelegateExpiryAndNonce } from "./delegateAction/index.js";
+import { createWalletRegistrationContextResolver, unavailableRegistrationContext, walletRegistrationContext } from "./router/auth/walletRegistrationContext.js";
+import { extractBearerCredential, extractRouterApiEnvironmentId, normalizeSourceIp, resolveRequestOriginRateLimitKeyFromExpressRequest, resolveRequestOriginRateLimitKeyFromFetchHeaders, resolveSourceIpFromExpressRequest, resolveSourceIpFromFetchHeaders } from "./router/auth/routerApiKeyAuth.js";
+import { publishableKeyRoutePrincipal, resolvePublishableKeyApiCredentialAuth, resolveSecretKeyApiCredentialAuth, resolveWalletRegistrationContext } from "./router/auth/routerApiCredentialAuth.js";
+import { enforceRoutePolicy } from "./router/framework/enforceRoutePolicy.js";
+import { routeError, routeJson, sendExpressRouteResponse, toFetchRouteResponse } from "./router/framework/routeResponses.js";
+import { ROUTER_AB_TRACE_ID_HEADER_V1 } from "./shared-ts/src/utils/routerAbTraceContext.js";
+import { parseWalletRegistrationSetupRequest } from "./router/domains/walletRegistration/walletRegistrationRoutes.js";
 import { applyRouteMetering } from "./router/framework/applyRouteMetering.js";
 import { InMemoryRouterAbNormalSigningAdmissionStore, abusePrincipalKey, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createRouterAbNormalSigningAdmissionAdapter, runtimePolicyScopeKey } from "./router/domains/signingOperations/routerAbNormalSigningAdmissionCore.js";
 import { CloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1RouterAbNormalSigningAdmissionStore } from "./router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.js";
@@ -32,16 +40,11 @@ import { assertUniqueRouterApiRouteDefinitions, getRouterApiRouteExtensionDefini
 import { coerceRouterLogger } from "./router/framework/logger.js";
 import { buildTenantRootIdentityFromAuthenticatedDeploymentV1, encodeTenantRootIdentityV1 } from "./shared-ts/src/tenant-root/tenantRootIdentity.js";
 import { WALLET_CONSOLE_OPS_BASE_PATH_V1, WALLET_CONSOLE_OP_PATHS_V1, WALLET_CONSOLE_SERVICE_ORIGIN_V1, decodeWalletConsoleTenantRootActiveLineageRequestV1, decodeWalletConsoleTenantRootActiveLineageResponseV1 } from "./router/cloudflare/runtime/walletConsoleOps.js";
-import { createWalletConsoleOpsClient } from "./router/cloudflare/runtime/walletConsoleOpsClient.js";
-import { ROUTER_AB_TRACE_ID_HEADER_V1 } from "./shared-ts/src/utils/routerAbTraceContext.js";
+import { createWalletConsoleOpsClient, parseWalletRegistrationContextResponse } from "./router/cloudflare/runtime/walletConsoleOpsClient.js";
 import { headersToRecord, json, jsonFailure, readJson, toResponse, withCors } from "./router/framework/http.js";
-import { extractBearerCredential, extractRouterApiEnvironmentId, normalizeSourceIp, resolveRequestOriginRateLimitKeyFromExpressRequest, resolveRequestOriginRateLimitKeyFromFetchHeaders, resolveSourceIpFromExpressRequest, resolveSourceIpFromFetchHeaders } from "./router/auth/routerApiKeyAuth.js";
-import { resolvePublishableKeyApiCredentialAuth, resolveSecretKeyApiCredentialAuth } from "./router/auth/routerApiCredentialAuth.js";
-import { enforceRoutePolicy } from "./router/framework/enforceRoutePolicy.js";
-import { routeError, routeJson, sendExpressRouteResponse, toFetchRouteResponse } from "./router/framework/routeResponses.js";
 import { webAuthnCredentialIdB64uFromCredential } from "./router/auth/webAuthnCredentialCodecs.js";
 import { deriveRecoveryCodeLocatorV1FromBytes, parseRecoveryCodeLocatorV1 } from "./shared-ts/src/wallet-recovery/recoveryCodeLocator.js";
-import { buildRouterAbEcdsaAcceptedAuthorizedOperationV1, buildRouterAbEd25519AcceptedAuthorizedOperationV1, evaluateRouterAbNormalSigningAdmission } from "./router/domains/signingOperations/routerAbNormalSigningAdmission.js";
+import { evaluateRouterAbNormalSigningAdmission } from "./router/domains/signingOperations/routerAbNormalSigningAdmission.js";
 import { authenticateRouterAbWalletOperationStepUpIdentity } from "./router/domains/signingOperations/routerAbOperationStepUp.js";
 import { ROUTER_AB_ECDSA_DERIVATION_PRIVATE_SIGNING_PATHS, ROUTER_AB_ED25519_PRIVATE_SIGNING_PATHS, buildRouterAbEcdsaDerivationPrivateSigningWorkerBody, buildRouterAbEd25519PrivateSigningWorkerBody, computeRouterAbEd25519NormalSigningAdmissionMaterial, parseRouterAbEd25519NormalSigningScopeV2, postRouterAbSigningWorkerJson } from "./router/domains/signingOperations/routerAbPrivateSigningWorker.js";
 import { admitRouterAbEcdsaReusableWalletSessionOperation, authenticateRouterAbEcdsaOperationStepUp, authorizeRouterAbEcdsaDerivationNormalSigningRoute, buildRouterAbEcdsaOwnerOperationStepUpPreparation, claimRouterAbEcdsaOperationStepUp, completeRouterAbEcdsaOperation, decideRouterAbEcdsaOwnerOperationAuthorization, handleRouterAbEcdsaDerivationNormalSigningRouteCore, resolveFreshRouterAbEcdsaMaterialActivation, routerAbEcdsaAtomicAuthorizationConfigured, routerAbEcdsaOperationInProgressResult, routerAbEcdsaOwnerOperationFailureResult, routerAbEcdsaRecordedResponse, routerAbEcdsaReplayHttpResponse, routerAbEcdsaReplayResult, routerAbEcdsaReplayUnavailableResult } from "./router/domains/signingOperations/routerAbEcdsaDerivationNormalSigningRoute.js";
@@ -57,7 +60,8 @@ import { WALLET_RUNTIME_OPS_BASE_PATH_V1, WALLET_RUNTIME_OP_PATHS_V1, WALLET_RUN
 import { createWalletRuntimeOpsHandler } from "./router/cloudflare/runtime/walletRuntimeOpsHandler.js";
 import { WALLET_CONTROL_AUTH_MARKER_V1, WALLET_CONTROL_BASE_PATH_V1, WALLET_CONTROL_SERVICE_ORIGIN_V1, createWalletControlClientBindings, handleWalletControlRequest } from "./router/cloudflare/runtime/walletControlOps.js";
 import { resolveRuntimeTenantRootLineage } from "./router/cloudflare/runtime/walletConsoleTenantRootLineage.js";
-import { ROUTER_AB_MPC_ROUTER_ORIGIN, ROUTER_AB_SIGNING_WORKER_ORIGIN, createRouterAbServiceBindingFetch } from "./router/cloudflare/runtime/routerAbServiceBindings.js";
+import { D1WalletObjectAddresses } from "./router/cloudflare/d1/walletObjectAddresses.js";
+import { ROUTER_AB_MPC_ROUTER_ORIGIN, ROUTER_AB_SIGNING_WORKER_ORIGIN, WalletHomeCustodyBinding, createRouterAbServiceBindingFetch } from "./router/cloudflare/runtime/routerAbServiceBindings.js";
 import { runRouterAbPrewarmScheduledV1 } from "./router/cloudflare/runtime/routerAbPrewarm.js";
 import { randomTenantRootCreationGrantBytesV1, signTenantRootCreationGrantV1, tenantRootIdentityDigestB64uV1 } from "./router/cloudflare/runtime/tenantRootCreationGrant.js";
 import { CrossSiteSessionCookieAdapter, encodeSessionJsonSegment, normalizeSessionString, normalizeSessionTtlSeconds, parseSessionJwt, requireNormalizedSessionString, sessionJwtTimeClaims, toSessionArrayBufferCopy } from "./router/cloudflare/runtime/sessionAdapterRuntime.js";
@@ -66,25 +70,26 @@ import { createStaticWalletConsoleBindingV1, handleStaticWalletConsoleRequestV1,
 import { parseWebAuthnSyncChallengeRecord } from "./router/cloudflare/d1/webauthn/d1WebAuthnRecords.js";
 import { CloudflareD1WebAuthnStore, prepareD1WebAuthnAuthenticatorInsertStatement, prepareD1WebAuthnAuthenticatorPutStatement } from "./router/cloudflare/d1/webauthn/d1WebAuthnStore.js";
 import { CloudflareD1WebAuthnAuthService } from "./router/cloudflare/d1/webauthn/d1WebAuthnAuthService.js";
+import { admitD1EstablishedWalletHome } from "./router/cloudflare/d1/registration/d1WalletExecutionAuthority.js";
 import { parseLinkedDeviceSessionRecordV1 } from "./core/deviceLinking/linkedDeviceSessionRecord.js";
 import { D1LinkedDeviceSourceContributionPreparationPlannerV1, createD1LinkedDeviceSourceContributionPreparationPlannerV1, linkedDeviceX25519RecipientPublicKeyB64uV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceSourceContributionPreparationPlanner.js";
 import { D1LinkedDeviceAuthorityInstallServiceV1, parseInstalledEcdsaCustodySnapshotV1, readD1LinkedDeviceEcdsaSourceV1, readD1LinkedDeviceEd25519SourceV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService.js";
-import { CloudflareD1AuthorizationStore } from "./router/cloudflare/d1/authorization/d1AuthorizationStore.js";
-import { CloudflareD1VaultProxyStore } from "./router/cloudflare/d1/authorization/d1VaultProxyStore.js";
 import { InMemoryRouterAbEd25519YaoRegistrationService, createRouterAbEd25519YaoRegistrationModule } from "./router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistration.js";
 import { InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter } from "./router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationIntentAuthorization.js";
 import { InMemoryRouterAbEd25519YaoExportService, InMemoryRouterAbEd25519YaoExportStateV1, RouterAbEd25519YaoExportOwnerProofAuthorizationAdapter, createRouterAbEd25519YaoExportModule, parseRouterAbEd25519YaoExportAdmissionEnvelopeV1, parseRouterAbEd25519YaoExportExecuteEnvelopeV1 } from "./router/domains/ed25519Yao/export/routerAbEd25519YaoExport.js";
-import { parseRouterAbEd25519YaoTenantRootWireV1, routerAbEd25519YaoTenantRootWireV1 } from "./router/domains/ed25519Yao/routerAbEd25519YaoGatewayEnvelope.js";
+import { parseRouterAbEd25519YaoTenantRootWireV1, routerAbEd25519YaoRegistrationSigningRootIdV1, routerAbEd25519YaoTenantRootWireV1 } from "./router/domains/ed25519Yao/routerAbEd25519YaoGatewayEnvelope.js";
 import { buildRouterAbEd25519YaoAddSignerAdmissionRequestV1, buildRouterAbEd25519YaoProductAdmissionRequestV1, createRouterAbEd25519YaoMaterialActivationRefV1, createRouterAbEd25519YaoProductRegistrationCompositionFromPortsV1, createRouterAbEd25519YaoProductRegistrationRuntimeV1, createRouterAbEd25519YaoProductRegistrationStateFromPartsV1, createRouterAbEd25519YaoProductRegistrationStateV1, parseRouterAbEd25519YaoProductRegistrationStateV1, projectRouterAbEd25519YaoExactWalletSession, routerAbEd25519YaoPersistedCapabilityMatchesLookupV1 } from "./router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js";
+import { createRouterAbEd25519YaoCeremonyStateStoreV1, encodeRouterAbEd25519YaoProductRegistrationStateV1, parseRouterAbEd25519YaoCeremonyKeyV1, parseRouterAbEd25519YaoProductRegistrationStateJsonV1, resolveRouterAbEd25519YaoCeremonyKeyFromRequestV1 } from "./router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPersistence.js";
+import { mergeRouterAbEd25519YaoProductRegistrationStatePartitionV1, partitionRouterAbEd25519YaoProductRegistrationStateV1 } from "./router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitioning.js";
+import { ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordJsonV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1, routerAbEd25519YaoAdmittedRegistrationAuthorityV1, routerAbEd25519YaoPartitionedStateAfterStoredCommitV1, sameRouterAbEd25519YaoSharedStateCanonicalEncodingV1 } from "./router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore.js";
+import { CloudflareD1AuthorizationStore } from "./router/cloudflare/d1/authorization/d1AuthorizationStore.js";
+import { CloudflareD1VaultProxyStore } from "./router/cloudflare/d1/authorization/d1VaultProxyStore.js";
 import { RouterAbEd25519YaoHttpRegistrationBackend, createRouterAbEd25519YaoHttpRegistrationBackendFromEnv, parseRouterAbEd25519YaoActivationKeysetFromEnvV1, parseRouterAbEd25519YaoRegistrationRouterAnswerV1 } from "./router/domains/ed25519Yao/registration/routerAbEd25519YaoHttpRegistrationBackend.js";
 import { StaticCloudflareTenantStorageRouteResolver, createCloudflareTenantStorageRoute, createSignerD1DoStorageTarget, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, tenantStorageRouteBackendFamily, tenantStorageRouteDiagnostic } from "./storage/tenantRoute.js";
 import { createInMemoryRouterApiRuntimeSnapshotConsumer, validateRuntimeSnapshotExpectation } from "./router/framework/runtimeSnapshotConsumer.js";
 import { createSelfHostedCloudflareSigningRouter, createSelfHostedCloudflareSigningWorker } from "./router/cloudflare/runtime/createSelfHostedCloudflareSigningWorker.js";
 import { CloudflareDurableObjectVersionedJsonRecordStore, CloudflareVersionedJsonRecordStoreError, createCloudflareDurableObjectVersionedJsonRecordStore } from "./router/cloudflare/durableObjects/versionedJsonRecordStore.js";
 import { CloudflareD1VersionedJsonRecordStore, CloudflareD1VersionedJsonRecordStoreError, createCloudflareD1VersionedJsonRecordStore } from "./router/cloudflare/d1/versionedJson/d1VersionedJsonRecordStore.js";
-import { createRouterAbEd25519YaoCeremonyStateStoreV1, encodeRouterAbEd25519YaoProductRegistrationStateV1, parseRouterAbEd25519YaoCeremonyKeyV1, parseRouterAbEd25519YaoProductRegistrationStateJsonV1, resolveRouterAbEd25519YaoCeremonyKeyFromRequestV1 } from "./router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPersistence.js";
-import { mergeRouterAbEd25519YaoProductRegistrationStatePartitionV1, partitionRouterAbEd25519YaoProductRegistrationStateV1 } from "./router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitioning.js";
-import { ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordJsonV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1, routerAbEd25519YaoAdmittedRegistrationAuthorityV1, routerAbEd25519YaoPartitionedStateAfterStoredCommitV1, sameRouterAbEd25519YaoSharedStateCanonicalEncodingV1 } from "./router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore.js";
 import { createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1 } from "./router/cloudflare/d1/ed25519Yao/d1Ed25519YaoProductRegistrationPartitionedStateStore.js";
 import { runRouterAbEd25519YaoProductRegistrationRequestScopedV1 } from "./router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationRequestScopedRunner.js";
 import { createRouterAbEd25519YaoProductRegistrationRequestScopedRuntimeV1 } from "./router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationRequestScopedRuntime.js";
@@ -99,7 +104,6 @@ import { createSigningSessionSealOptions, parseSigningSessionSealRootConfig } fr
 import { normalizeD1RouterApiAuthOptions, normalizeLinkedDevicePasskeyTargetConfigurationV1, parseBooleanFlag, requireD1RouterApiAuthScopeString } from "./router/cloudflare/d1/auth/d1RouterApiAuthConfig.js";
 import { decodeJsonRpcEnvelope } from "./shared-ts/src/utils/jsonRpc.js";
 import { createRouterAbEcdsaEd25519CeremonyTokenIssuer, createRouterAbEcdsaStrictPostRegistrationPort, createRouterAbEcdsaStrictRegistrationPort, parseRouterAbEcdsaEd25519PrivateJwk, parseRouterAbEcdsaStrictRegistrationTopology, parseStoredRouterAbEcdsaPendingActivationV1, routerAbEcdsaStrictRegistrationFactsBindingJson, routerAbEcdsaStrictRegistrationRequestBindingJson, routerAbEcdsaStrictRegistrationRequestMatchesFacts } from "./router/domains/ecdsa/routerAbEcdsaStrictRegistration.js";
-import { D1EmailOtpRateLimitCounter } from "./router/cloudflare/d1/emailOtp/d1EmailOtpRateLimitStore.js";
 import { parseGoogleEmailOtpRegistrationAttemptRecord, parseGoogleEmailOtpRegistrationOfferCandidates, requireRuntimePolicyScope } from "./router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationRecords.js";
 import { CloudflareD1GoogleEmailOtpRegistrationAttemptStore } from "./router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationAttemptStore.js";
 import { D1IdentityStore } from "./core/d1IdentityStore.js";
@@ -121,9 +125,10 @@ import { D1LinkedDeviceTargetAuthenticatorStoreV1 } from "./router/cloudflare/d1
 import "./router/cloudflare/d1/deviceLinking/index.js";
 import { loadCloudflareSignerWasmModule } from "./router/cloudflare/runtime/cloudflareSignerWasm.js";
 import { createEd25519SessionAdapter } from "./router/cloudflare/runtime/ed25519SessionAdapter.js";
+import { WalletPlacementRoutes } from "./router/cloudflare/runtime/walletPlacementRoutes.js";
 import { handleRouterAbEd25519YaoExportRequestScopedCloudflareV1 } from "./router/domains/ed25519Yao/export/routerAbEd25519YaoExportRequestScopedCloudflare.js";
 import { handleRouterAbEd25519YaoRecoveryRequestScopedCloudflareV1 } from "./router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryRequestScopedCloudflare.js";
 import { RouterAbEd25519YaoRecoveryWalletSessionAuthorizationAdapter } from "./router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryWalletSessionAuthorization.js";
 import { keccak256Bytes } from "./shared-ts/src/utils/keccak.js";
 import { decodeEvmBlockHeader, decodeEvmTransactionByHash, decodeEvmTransactionCall, decodeEvmTransactionReceipt, parseRpcHexQuantity } from "./shared-ts/src/utils/evmRpcResults.js";
-export { API_CREDENTIAL_ROUTE_SCOPES, API_CREDENTIAL_TYPES, ActionType, CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, CloudflareD1AuthorizationStore, CloudflareD1GoogleEmailOtpRegistrationAttemptStore, CloudflareD1OidcJwksCache, CloudflareD1RouterAbEd25519YaoCapabilityPersistence, CloudflareD1RouterAbNormalSigningAdmissionStore, CloudflareD1VaultProxyStore, CloudflareD1VersionedJsonRecordStore, CloudflareD1VersionedJsonRecordStoreError, CloudflareD1WebAuthnAuthService, CloudflareD1WebAuthnStore, CloudflareDurableObjectVersionedJsonRecordStore, CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1, CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1, CloudflareVersionedJsonRecordStoreError, CrossSiteSessionCookieAdapter, D1EmailOtpRateLimitCounter, D1IdentityStore, D1LinkedDeviceAuthorityInstallServiceV1, D1LinkedDeviceEd25519ExportRootStoreV1, D1LinkedDeviceRequestProofNonceStoreV1, D1LinkedDeviceSessionStoreV1, D1LinkedDeviceSourceContributionPreparationPlannerV1, D1LinkedDeviceTargetAuthenticatorStoreV1, D1LinkedDeviceTargetCredentialProviderV1, D1LinkedDeviceTargetPlannerV1, D1WalletAuthMethodStore, D1WalletStore, D1_BATCH_CAS_GUARD_SQL, DEFAULT_SESSION_COOKIE_NAME, DEFAULT_WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_V1, DEFAULT_WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_V1, DEFAULT_WALLET_SESSION_REMAINING_USES, DEFAULT_WALLET_SESSION_TTL_MS, InMemoryRouterAbEd25519YaoExportService, InMemoryRouterAbEd25519YaoExportStateV1, InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter, InMemoryRouterAbEd25519YaoRegistrationService, InMemoryRouterAbNormalSigningAdmissionStore, LINKED_DEVICE_OWNER_AUTHORIZATION_PATH_V1, LinkedDeviceRetiredTargetRegistrationShapeErrorV1, LinkedDeviceSourceFamilyUnavailableErrorV1, LinkedDeviceWebAuthnRegistrationVerifierV1, MAX_WALLET_SESSION_REMAINING_USES, MAX_WALLET_SESSION_TTL_MS, PUBLIC_PROOF_TYPES, ROUTER_AB_ECDSA_DERIVATION_PRIVATE_SIGNING_PATHS, ROUTER_AB_ED25519_PRIVATE_SIGNING_PATHS, ROUTER_AB_ED25519_YAO_CAPABILITY_REPLACEMENT_TABLE_V1, ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_STATUS_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1, ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, ROUTER_AB_MPC_ROUTER_ORIGIN, ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, ROUTER_AB_SIGNING_WORKER_ORIGIN, ROUTER_AB_TRACE_ID_HEADER_V1, ROUTER_API_CREDENTIAL_SCOPES, ROUTE_SERVICE_KEYS, RouterAbEcdsaPresignRuntime, RouterAbEd25519YaoExportOwnerProofAuthorizationAdapter, RouterAbEd25519YaoHttpRegistrationBackend, RouterAbEd25519YaoRecoveryWalletSessionAuthorizationAdapter, SESSION_CAS_GUARD_SQL, SessionService, StaticCloudflareTenantStorageRouteResolver, UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, WALLET_AUTH_METHOD_D1_STORE, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL, WALLET_CONSOLE_API_WALLET_DETAIL_PREFIX_V1, WALLET_CONSOLE_OPS_BASE_PATH_V1, WALLET_CONSOLE_OP_PATHS_V1, WALLET_CONSOLE_SERVICE_ORIGIN_V1, WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_ID_V1, WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_ID_V1, WALLET_CONTROL_AUTH_MARKER_V1, WALLET_CONTROL_BASE_PATH_V1, WALLET_CONTROL_SERVICE_ORIGIN_V1, WALLET_RUNTIME_OPS_BASE_PATH_V1, WALLET_RUNTIME_OP_PATHS_V1, WALLET_RUNTIME_SERVICE_ORIGIN_V1, WALLET_STORE_D1_SCHEMA_SQL, WalletLifecycleLocator, abusePrincipalKey, addSecp256k1PublicKeys33, admitRouterAbEcdsaReusableWalletSessionOperation, applyRouteMetering, assertUniqueRouterApiRouteDefinitions, authenticateDeviceLinkingOwnerWalletSessionRequestV1, authenticateRouterAbEcdsaOperationStepUp, authenticateRouterAbWalletOperationStepUp, authenticateRouterAbWalletOperationStepUpIdentity, authorizeRouterAbEcdsaDerivationNormalSigningRoute, authorizeRouterAbEd25519NormalSigningRoute, base64UrlDecode, base64UrlEncode, bindWalletAuthMethodIdentity, bindWalletAuthMethodIdentityV2, buildCorsOrigins, buildRouterAbEcdsaAcceptedAuthorizedOperationV1, buildRouterAbEcdsaDerivationPrivateSigningWorkerBody, buildRouterAbEcdsaOwnerOperationStepUpPreparation, buildRouterAbEd25519AcceptedAuthorizedOperationV1, buildRouterAbEd25519OwnerOperationStepUpPreparation, buildRouterAbEd25519PrivateSigningWorkerBody, buildRouterAbEd25519YaoAddSignerAdmissionRequestV1, buildRouterAbEd25519YaoProductAdmissionRequestV1, buildTenantRootIdentityFromAuthenticatedDeploymentV1, buildVerifiedLinkInputV1, buildVerifiedTargetFactorV1, buildWalletEcdsaSignerRecord, claimRouterAbEcdsaOperationStepUp, coerceLogger, coerceRouterLogger, completeRouterAbEcdsaOperation, computeEip1559TxHash, computeLinkedDeviceSessionClaimDigestV1, computeRouterAbEd25519NormalSigningAdmissionMaterial, computeVerifiedTargetFactorVerificationDigestV1, createCloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1RouterApiAuthService, createCloudflareD1VersionedJsonRecordStore, createCloudflareDurableObjectVersionedJsonRecordStore, createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1, createCloudflareRouter, createCloudflareTenantStorageRoute, createCloudflareWalletGatewayRouterV1, createD1LinkedDeviceOwnerAuthorizationMetadataSourceV1, createD1LinkedDeviceOwnerAuthorizationProviderV1, createD1LinkedDeviceOwnerSourceChildReaderV1, createD1LinkedDeviceRouteServiceV1, createD1LinkedDeviceSessionServiceV1, createD1LinkedDeviceSourceContributionPreparationPlannerV1, createD1LinkedDeviceVerifiedLinkSourceReaderV1, createDeviceLinkingOwnerRequestAuthenticatorV1, createEd25519SessionAdapter, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterApiRuntimeSnapshotConsumer, createRouterAbEcdsaEd25519CeremonyTokenIssuer, createRouterAbEcdsaStrictPostRegistrationPort, createRouterAbEcdsaStrictRegistrationPort, createRouterAbEd25519YaoCeremonyStateStoreV1, createRouterAbEd25519YaoExportModule, createRouterAbEd25519YaoHttpRegistrationBackendFromEnv, createRouterAbEd25519YaoMaterialActivationRefV1, createRouterAbEd25519YaoProductRegistrationCompositionFromPortsV1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, createRouterAbEd25519YaoProductRegistrationRequestScopedRuntimeV1, createRouterAbEd25519YaoProductRegistrationRuntimeV1, createRouterAbEd25519YaoProductRegistrationStateFromPartsV1, createRouterAbEd25519YaoProductRegistrationStateV1, createRouterAbEd25519YaoRegistrationModule, createRouterAbNormalSigningAdmissionAdapter, createRouterAbServiceBindingFetch, createRouterApiModule, createRouterApiRouteDefinitions, createSelfHostedCloudflareSigningRouter, createSelfHostedCloudflareSigningWorker, createSignerD1DoStorageTarget, createSigningSessionSealOptions, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, createStaticWalletConsoleBindingV1, createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1, createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, createWalletConsoleOpsClient, createWalletConsoleRelayProxyExtensionV1, createWalletControlClientBindings, createWalletRuntimeOpsHandler, d1ChangedRows, d1Integer, d1Number, decideRouterAbEcdsaOwnerOperationAuthorization, decideRouterAbEd25519OwnerOperationAuthorization, decodeEvmBlockHeader, decodeEvmTransactionByHash, decodeEvmTransactionCall, decodeEvmTransactionReceipt, decodeJsonRpcEnvelope, decodeWalletConsoleTenantRootActiveLineageRequestV1, decodeWalletConsoleTenantRootActiveLineageResponseV1, defineRoute, defineRouteExtension, deriveJwtExpiresAtIso, deriveRecoveryCodeLocatorV1FromBytes, digestOpaqueValue, encodeEip1559SignedTxFromSignature65, encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1, encodeRouterAbEd25519YaoProductRegistrationStateV1, encodeSessionJsonSegment, encodeTenantRootIdentityV1, enforceDelegatePolicy, enforceRoutePolicy, ensureEvmCryptoWasm, ensureLeadingSlash, ensureWalletAuthMethodStoreD1Schema, ensureWalletStoreD1Schema, evaluateRouterAbNormalSigningAdmission, executeSignedDelegateWithRelayer, extractBearerCredential, extractRouterApiEnvironmentId, findRouteDefinitionById, findRouteDefinitionForRequest, formatD1ExecStatement, getRouterApiRouteExtensionDefinitions, getRouterApiRouteExtensionRoutes, getRouterApiRouteExtensionsForTransport, handleRouterAbEcdsaDerivationNormalSigningRouteCore, handleRouterAbEd25519YaoExportRequestScopedCloudflareV1, handleRouterAbEd25519YaoRecoveryRequestScopedCloudflareV1, handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1, handleStaticWalletConsoleRequestV1, handleWalletControlRequest, headersToRecord, isD1DatabaseLike, isObject, isPlainObject, json, jsonFailure, keccak256Bytes, linkedDeviceSignerManifestsEqualV1, linkedDeviceX25519RecipientPublicKeyB64uV1, loadCloudflareSignerWasmModule, matchesRouteDefinitionRequest, mergeRouterAbEd25519YaoProductRegistrationStatePartitionV1, normalizeBoundedPositiveInteger, normalizeCorsOrigin, normalizeD1RouterApiAuthOptions, normalizeHashToBytes, normalizeLinkedDevicePasskeyTargetConfigurationV1, normalizeLogger, normalizeLowercaseString, normalizeSessionString, normalizeSessionTtlSeconds, normalizeSourceIp, normalizeTrimmedString, normalizeWalletAuthMethod, normalizeWalletAuthMethodV2, parseBooleanFlag, parseBooleanJwtClaim, parseCacheControlMaxAgeSec, parseCsvList, parseD1JsonArrayColumn, parseD1JsonColumn, parseD1JsonObjectColumn, parseD1LinkedDeviceSessionRowV1, parseD1LinkedDeviceSessionTranscriptRowV1, parseGoogleEmailOtpRegistrationAttemptRecord, parseGoogleEmailOtpRegistrationOfferCandidates, parseGoogleJwks, parseGoogleLoginVerifyRequest, parseInstalledEcdsaCustodySnapshotV1, parseJwtAud, parseLinkedDeviceSessionRecordV1, parseOrgId, parseRecoveryCodeLocatorV1, parseRouterAbEcdsaEd25519PrivateJwk, parseRouterAbEcdsaPresignRuntimeConfig, parseRouterAbEcdsaStrictRegistrationTopology, parseRouterAbEd25519NormalSigningScopeV2, parseRouterAbEd25519OperationStepUpScope, parseRouterAbEd25519YaoActivationKeysetFromEnvV1, parseRouterAbEd25519YaoCeremonyKeyV1, parseRouterAbEd25519YaoExportAdmissionEnvelopeV1, parseRouterAbEd25519YaoExportExecuteEnvelopeV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordJsonV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoProductRegistrationStateJsonV1, parseRouterAbEd25519YaoProductRegistrationStateV1, parseRouterAbEd25519YaoRegistrationRouterAnswerV1, parseRouterAbEd25519YaoTenantRootWireV1, parseRouterAbOperationStepUpOperation, parseRouterAbPublicKeysetV2, parseRpcHexQuantity, parseRs256JwtForVerification, parseSessionJwt, parseSigningSessionSealRootConfig, parseStaticWalletConsoleBindingConfigV1, parseStoredRouterAbEcdsaPendingActivationV1, parseWalletEd25519SignerRecord, parseWalletId, parseWalletRecoveryOperationId, parseWalletRegistrationSetupReservation, parseWalletRuntimeExecuteSignedDelegateRequest, parseWalletRuntimeExecuteSignedDelegateResponse, parseWalletRuntimeExecuteSignedDelegateResult, parseWalletRuntimeRelayerAccount, parseWalletRuntimeWalletIdentitiesResult, parseWalletRuntimeWalletIdentityRequest, parseWebAuthnRpId, parseWebAuthnSyncChallengeRecord, partitionRouterAbEd25519YaoProductRegistrationStateV1, postRouterAbSigningWorkerJson, prepareD1TenantStatement, prepareD1WalletAuthMethodInsertStatement, prepareD1WalletAuthMethodPutStatement, prepareD1WalletAuthMethodV2PutStatement, prepareD1WalletPutSignerStatement, prepareD1WalletPutSubjectStatement, prepareD1WebAuthnAuthenticatorInsertStatement, prepareD1WebAuthnAuthenticatorPutStatement, projectRouterAbEd25519YaoExactWalletSession, proposeWalletRegistrationSetup, queryD1All, queryD1One, randomTenantRootCreationGrantBytesV1, readD1LinkedDeviceEcdsaSourceV1, readD1LinkedDeviceEd25519SourceV1, readEnvironmentCsv, readEnvironmentString, readJson, registrationPreparationIdFromString, requireD1RouterApiAuthScopeString, requireEnvironmentString, requireNormalizedSessionString, requireRuntimePolicyScope, resolveFreshRouterAbEcdsaMaterialActivation, resolvePublishableKeyApiCredentialAuth, resolveRequestOriginRateLimitKeyFromExpressRequest, resolveRequestOriginRateLimitKeyFromFetchHeaders, resolveRouterAbEd25519YaoCeremonyKeyFromRequestV1, resolveRuntimeTenantRootLineage, resolveSecretKeyApiCredentialAuth, resolveSourceIpFromExpressRequest, resolveSourceIpFromFetchHeaders, routeError, routeJson, routerAbEcdsaAtomicAuthorizationConfigured, routerAbEcdsaOperationInProgressResult, routerAbEcdsaOwnerOperationFailureResult, routerAbEcdsaRecordedResponse, routerAbEcdsaReplayHttpResponse, routerAbEcdsaReplayResult, routerAbEcdsaReplayUnavailableResult, routerAbEcdsaStrictRegistrationFactsBindingJson, routerAbEcdsaStrictRegistrationRequestBindingJson, routerAbEcdsaStrictRegistrationRequestMatchesFacts, routerAbEd25519OwnerOperationFailureResult, routerAbEd25519YaoAdmittedRegistrationAuthorityV1, routerAbEd25519YaoPartitionedStateAfterStoredCommitV1, routerAbEd25519YaoPersistedCapabilityMatchesLookupV1, routerAbEd25519YaoTenantRootWireV1, runRouterAbEd25519YaoProductRegistrationRequestScopedV1, runRouterAbEd25519YaoRegistrationSideEffectV1, runRouterAbEd25519YaoRegistrationTwoPhaseV1, runRouterAbPrewarmScheduledV1, runtimePolicyScopeKey, sameRouterAbEd25519YaoSharedStateCanonicalEncodingV1, secp256k1PrivateKey32ToPublicKey33, secp256k1PublicKey33ToEthereumAddress, secureRandomBase36, secureRandomBase64Url, sendExpressRouteResponse, sessionJwtTimeClaims, sha256Bytes, sha256BytesSync, signSecp256k1Recoverable, signTenantRootCreationGrantV1, tenantRootIdentityDigestB64uV1, tenantStorageRouteBackendFamily, tenantStorageRouteDiagnostic, toFetchRouteResponse, normalizeOptionalTrimmedString as toOptionalTrimmedString, toResponse, toSessionArrayBufferCopy, validateDelegateExpiryAndNonce, validateGoogleIdTokenClaims, validateRuntimeSnapshotExpectation, validateSecp256k1PublicKey33, verifyGoogleOidcToken, verifyRs256JwtSignature, verifySecp256k1Bip340SignatureAgainstPublicKey33, verifySecp256k1RecoverableSignatureAgainstPublicKey33, walletAuthMethodId, walletAuthMethodV2Id, walletConsoleApiWalletGetRouteDefinitionV1, walletConsoleApiWalletListRouteDefinitionV1, walletConsoleApiWalletSearchRouteDefinitionV1, walletConsoleRelayRouteDefinitionsV1, walletConsoleSignedDelegateRouteDefinitionV1, walletConsoleSponsoredEvmCallRouteDefinitionV1, walletRegistrationSetupRequestDigest, webAuthnCredentialIdB64uFromCredential, withCors };
+export { API_CREDENTIAL_ROUTE_SCOPES, API_CREDENTIAL_TYPES, ActionType, CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, CloudflareD1AuthorizationStore, CloudflareD1GoogleEmailOtpRegistrationAttemptStore, CloudflareD1OidcJwksCache, CloudflareD1RouterAbEd25519YaoCapabilityPersistence, CloudflareD1RouterAbNormalSigningAdmissionStore, CloudflareD1VaultProxyStore, CloudflareD1VersionedJsonRecordStore, CloudflareD1VersionedJsonRecordStoreError, CloudflareD1WebAuthnAuthService, CloudflareD1WebAuthnStore, CloudflareDurableObjectVersionedJsonRecordStore, CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1, CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1, CloudflareVersionedJsonRecordStoreError, CrossSiteSessionCookieAdapter, D1IdentityStore, D1LinkedDeviceAuthorityInstallServiceV1, D1LinkedDeviceEd25519ExportRootStoreV1, D1LinkedDeviceRequestProofNonceStoreV1, D1LinkedDeviceSessionStoreV1, D1LinkedDeviceSourceContributionPreparationPlannerV1, D1LinkedDeviceTargetAuthenticatorStoreV1, D1LinkedDeviceTargetCredentialProviderV1, D1LinkedDeviceTargetPlannerV1, D1WalletAuthMethodStore, D1WalletObjectAddresses, D1WalletStore, D1_BATCH_CAS_GUARD_SQL, DEFAULT_SESSION_COOKIE_NAME, DEFAULT_WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_V1, DEFAULT_WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_V1, DEFAULT_WALLET_SESSION_REMAINING_USES, DEFAULT_WALLET_SESSION_TTL_MS, ED25519_SIGNER_ACTIVATION_ID_PATH, InMemoryRouterAbEd25519YaoExportService, InMemoryRouterAbEd25519YaoExportStateV1, InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter, InMemoryRouterAbEd25519YaoRegistrationService, InMemoryRouterAbNormalSigningAdmissionStore, LINKED_DEVICE_OWNER_AUTHORIZATION_PATH_V1, LinkedDeviceRetiredTargetRegistrationShapeErrorV1, LinkedDeviceSourceFamilyUnavailableErrorV1, LinkedDeviceWebAuthnRegistrationVerifierV1, MAX_WALLET_SESSION_REMAINING_USES, MAX_WALLET_SESSION_TTL_MS, PUBLIC_PROOF_TYPES, ROUTER_AB_ECDSA_DERIVATION_PRIVATE_SIGNING_PATHS, ROUTER_AB_ED25519_PRIVATE_SIGNING_PATHS, ROUTER_AB_ED25519_YAO_CAPABILITY_REPLACEMENT_TABLE_V1, ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_STATUS_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1, ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, ROUTER_AB_MPC_ROUTER_ORIGIN, ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, ROUTER_AB_SIGNING_WORKER_ORIGIN, ROUTER_AB_TRACE_ID_HEADER_V1, ROUTER_API_CREDENTIAL_SCOPES, ROUTE_SERVICE_KEYS, RouterAbEcdsaPresignRuntime, RouterAbEd25519YaoExportOwnerProofAuthorizationAdapter, RouterAbEd25519YaoHttpRegistrationBackend, RouterAbEd25519YaoRecoveryWalletSessionAuthorizationAdapter, SESSION_CAS_GUARD_SQL, SessionService, StaticCloudflareTenantStorageRouteResolver, UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, WALLET_AUTH_METHOD_D1_STORE, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL, WALLET_CONSOLE_API_WALLET_DETAIL_PREFIX_V1, WALLET_CONSOLE_OPS_BASE_PATH_V1, WALLET_CONSOLE_OP_PATHS_V1, WALLET_CONSOLE_SERVICE_ORIGIN_V1, WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_ID_V1, WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_ID_V1, WALLET_CONTROL_AUTH_MARKER_V1, WALLET_CONTROL_BASE_PATH_V1, WALLET_CONTROL_SERVICE_ORIGIN_V1, WALLET_RUNTIME_OPS_BASE_PATH_V1, WALLET_RUNTIME_OP_PATHS_V1, WALLET_RUNTIME_SERVICE_ORIGIN_V1, WALLET_STORE_D1_SCHEMA_SQL, WalletHomeCustodyBinding, WalletLifecycleLocator, WalletObjectAddressSnapshot, WalletPlacementRoutes, abusePrincipalKey, addSecp256k1PublicKeys33, admitD1EstablishedWalletHome, admitRouterAbEcdsaReusableWalletSessionOperation, applyRouteMetering, assertUniqueRouterApiRouteDefinitions, authenticateDeviceLinkingOwnerWalletSessionRequestV1, authenticateRouterAbEcdsaOperationStepUp, authenticateRouterAbWalletOperationStepUp, authenticateRouterAbWalletOperationStepUpIdentity, authorizeRouterAbEcdsaDerivationNormalSigningRoute, authorizeRouterAbEd25519NormalSigningRoute, base64UrlDecode, base64UrlEncode, bindWalletAuthMethodIdentity, bindWalletAuthMethodIdentityV2, buildCorsOrigins, buildRouterAbEcdsaDerivationPrivateSigningWorkerBody, buildRouterAbEcdsaOwnerOperationStepUpPreparation, buildRouterAbEd25519OwnerOperationStepUpPreparation, buildRouterAbEd25519PrivateSigningWorkerBody, buildRouterAbEd25519YaoAddSignerAdmissionRequestV1, buildRouterAbEd25519YaoProductAdmissionRequestV1, buildTenantRootIdentityFromAuthenticatedDeploymentV1, buildVerifiedLinkInputV1, buildVerifiedTargetFactorV1, buildWalletEcdsaSignerRecord, claimRouterAbEcdsaOperationStepUp, coerceLogger, coerceRouterLogger, completeRouterAbEcdsaOperation, computeEip1559TxHash, computeLinkedDeviceSessionClaimDigestV1, computeRouterAbEd25519NormalSigningAdmissionMaterial, computeVerifiedTargetFactorVerificationDigestV1, createCloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1RouterApiAuthService, createCloudflareD1VersionedJsonRecordStore, createCloudflareDurableObjectVersionedJsonRecordStore, createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1, createCloudflareRouter, createCloudflareTenantStorageRoute, createCloudflareWalletGatewayRouterV1, createD1LinkedDeviceOwnerAuthorizationMetadataSourceV1, createD1LinkedDeviceOwnerAuthorizationProviderV1, createD1LinkedDeviceOwnerSourceChildReaderV1, createD1LinkedDeviceRouteServiceV1, createD1LinkedDeviceSessionServiceV1, createD1LinkedDeviceSourceContributionPreparationPlannerV1, createD1LinkedDeviceVerifiedLinkSourceReaderV1, createDeviceLinkingOwnerRequestAuthenticatorV1, createEd25519SessionAdapter, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterApiRuntimeSnapshotConsumer, createRouterAbEcdsaEd25519CeremonyTokenIssuer, createRouterAbEcdsaStrictPostRegistrationPort, createRouterAbEcdsaStrictRegistrationPort, createRouterAbEd25519YaoCeremonyStateStoreV1, createRouterAbEd25519YaoExportModule, createRouterAbEd25519YaoHttpRegistrationBackendFromEnv, createRouterAbEd25519YaoMaterialActivationRefV1, createRouterAbEd25519YaoProductRegistrationCompositionFromPortsV1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, createRouterAbEd25519YaoProductRegistrationRequestScopedRuntimeV1, createRouterAbEd25519YaoProductRegistrationRuntimeV1, createRouterAbEd25519YaoProductRegistrationStateFromPartsV1, createRouterAbEd25519YaoProductRegistrationStateV1, createRouterAbEd25519YaoRegistrationModule, createRouterAbNormalSigningAdmissionAdapter, createRouterAbServiceBindingFetch, createRouterApiModule, createRouterApiRouteDefinitions, createSelfHostedCloudflareSigningRouter, createSelfHostedCloudflareSigningWorker, createSignerD1DoStorageTarget, createSigningSessionSealOptions, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, createStaticWalletConsoleBindingV1, createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1, createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, createWalletConsoleOpsClient, createWalletConsoleRelayProxyExtensionV1, createWalletControlClientBindings, createWalletRegistrationContextResolver, createWalletRuntimeOpsHandler, d1ChangedRows, d1Integer, d1Number, decideRouterAbEcdsaOwnerOperationAuthorization, decideRouterAbEd25519OwnerOperationAuthorization, decodeEvmBlockHeader, decodeEvmTransactionByHash, decodeEvmTransactionCall, decodeEvmTransactionReceipt, decodeJsonRpcEnvelope, decodeWalletConsoleTenantRootActiveLineageRequestV1, decodeWalletConsoleTenantRootActiveLineageResponseV1, defineRoute, defineRouteExtension, deriveJwtExpiresAtIso, deriveRecoveryCodeLocatorV1FromBytes, digestOpaqueValue, encodeEip1559SignedTxFromSignature65, encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1, encodeRouterAbEd25519YaoProductRegistrationStateV1, encodeSessionJsonSegment, encodeTenantRootIdentityV1, enforceDelegatePolicy, enforceRoutePolicy, ensureEvmCryptoWasm, ensureLeadingSlash, ensureWalletAuthMethodStoreD1Schema, ensureWalletStoreD1Schema, evaluateRouterAbNormalSigningAdmission, executeSignedDelegateWithRelayer, extractBearerCredential, extractRouterApiEnvironmentId, findRouteDefinitionById, findRouteDefinitionForRequest, formatD1ExecStatement, getRouterApiRouteExtensionDefinitions, getRouterApiRouteExtensionRoutes, getRouterApiRouteExtensionsForTransport, handleRouterAbEcdsaDerivationNormalSigningRouteCore, handleRouterAbEd25519YaoExportRequestScopedCloudflareV1, handleRouterAbEd25519YaoRecoveryRequestScopedCloudflareV1, handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1, handleStaticWalletConsoleRequestV1, handleWalletControlRequest, headersToRecord, isD1DatabaseLike, isObject, isPlainObject, json, jsonFailure, keccak256Bytes, linkedDeviceSignerManifestsEqualV1, linkedDeviceX25519RecipientPublicKeyB64uV1, loadCloudflareSignerWasmModule, matchesRouteDefinitionRequest, mergeRouterAbEd25519YaoProductRegistrationStatePartitionV1, normalizeBoundedPositiveInteger, normalizeCorsOrigin, normalizeD1RouterApiAuthOptions, normalizeHashToBytes, normalizeLinkedDevicePasskeyTargetConfigurationV1, normalizeLogger, normalizeLowercaseString, normalizeSessionString, normalizeSessionTtlSeconds, normalizeSourceIp, normalizeTrimmedString, normalizeWalletAuthMethod, normalizeWalletAuthMethodV2, parseBooleanFlag, parseBooleanJwtClaim, parseCacheControlMaxAgeSec, parseCsvList, parseD1JsonArrayColumn, parseD1JsonColumn, parseD1JsonObjectColumn, parseD1LinkedDeviceSessionRowV1, parseD1LinkedDeviceSessionTranscriptRowV1, parseGoogleEmailOtpRegistrationAttemptRecord, parseGoogleEmailOtpRegistrationOfferCandidates, parseGoogleJwks, parseGoogleLoginVerifyRequest, parseInstalledEcdsaCustodySnapshotV1, parseJwtAud, parseLinkedDeviceSessionRecordV1, parseOrgId, parseRecoveryCodeLocatorV1, parseRouterAbEcdsaEd25519PrivateJwk, parseRouterAbEcdsaPresignRuntimeConfig, parseRouterAbEcdsaStrictRegistrationTopology, parseRouterAbEd25519NormalSigningScopeV2, parseRouterAbEd25519OperationStepUpScope, parseRouterAbEd25519YaoActivationKeysetFromEnvV1, parseRouterAbEd25519YaoCeremonyKeyV1, parseRouterAbEd25519YaoExportAdmissionEnvelopeV1, parseRouterAbEd25519YaoExportExecuteEnvelopeV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordJsonV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoProductRegistrationStateJsonV1, parseRouterAbEd25519YaoProductRegistrationStateV1, parseRouterAbEd25519YaoRegistrationRouterAnswerV1, parseRouterAbEd25519YaoTenantRootWireV1, parseRouterAbOperationStepUpOperation, parseRouterAbPublicKeysetV2, parseRpcHexQuantity, parseRs256JwtForVerification, parseSessionJwt, parseSigningSessionSealRootConfig, parseStaticWalletConsoleBindingConfigV1, parseStoredRouterAbEcdsaPendingActivationV1, parseWalletEd25519SignerRecord, parseWalletId, parseWalletRecoveryOperationId, parseWalletRegistrationContextResponse, parseWalletRegistrationSetupRequest, parseWalletRegistrationSetupReservation, parseWalletRuntimeExecuteSignedDelegateRequest, parseWalletRuntimeExecuteSignedDelegateResponse, parseWalletRuntimeExecuteSignedDelegateResult, parseWalletRuntimeRelayerAccount, parseWalletRuntimeWalletIdentitiesResult, parseWalletRuntimeWalletIdentityRequest, parseWebAuthnRpId, parseWebAuthnSyncChallengeRecord, partitionRouterAbEd25519YaoProductRegistrationStateV1, postRouterAbSigningWorkerJson, prepareD1TenantStatement, prepareD1WalletAuthMethodInsertStatement, prepareD1WalletAuthMethodPutStatement, prepareD1WalletAuthMethodV2PutStatement, prepareD1WalletPutSignerStatement, prepareD1WalletPutSubjectStatement, prepareD1WebAuthnAuthenticatorInsertStatement, prepareD1WebAuthnAuthenticatorPutStatement, projectRouterAbEd25519YaoExactWalletSession, proposeWalletRegistrationSetup, publishableKeyRoutePrincipal, queryD1All, queryD1One, randomTenantRootCreationGrantBytesV1, readD1LinkedDeviceEcdsaSourceV1, readD1LinkedDeviceEd25519SourceV1, readEnvironmentCsv, readEnvironmentString, readJson, registrationPreparationIdFromString, requireD1RouterApiAuthScopeString, requireEnvironmentString, requireNormalizedSessionString, requireRuntimePolicyScope, resolveFreshRouterAbEcdsaMaterialActivation, resolvePublishableKeyApiCredentialAuth, resolveRequestOriginRateLimitKeyFromExpressRequest, resolveRequestOriginRateLimitKeyFromFetchHeaders, resolveRouterAbEd25519YaoCeremonyKeyFromRequestV1, resolveRuntimeTenantRootLineage, resolveSecretKeyApiCredentialAuth, resolveSourceIpFromExpressRequest, resolveSourceIpFromFetchHeaders, resolveWalletRegistrationContext, routeError, routeJson, routerAbEcdsaAtomicAuthorizationConfigured, routerAbEcdsaOperationInProgressResult, routerAbEcdsaOwnerOperationFailureResult, routerAbEcdsaRecordedResponse, routerAbEcdsaReplayHttpResponse, routerAbEcdsaReplayResult, routerAbEcdsaReplayUnavailableResult, routerAbEcdsaStrictRegistrationFactsBindingJson, routerAbEcdsaStrictRegistrationRequestBindingJson, routerAbEcdsaStrictRegistrationRequestMatchesFacts, routerAbEd25519OwnerOperationFailureResult, routerAbEd25519YaoAdmittedRegistrationAuthorityV1, routerAbEd25519YaoPartitionedStateAfterStoredCommitV1, routerAbEd25519YaoPersistedCapabilityMatchesLookupV1, routerAbEd25519YaoRegistrationSigningRootIdV1, routerAbEd25519YaoTenantRootWireV1, runRouterAbEd25519YaoProductRegistrationRequestScopedV1, runRouterAbEd25519YaoRegistrationSideEffectV1, runRouterAbEd25519YaoRegistrationTwoPhaseV1, runRouterAbPrewarmScheduledV1, runtimePolicyScopeKey, sameRouterAbEd25519YaoSharedStateCanonicalEncodingV1, secp256k1PrivateKey32ToPublicKey33, secp256k1PublicKey33ToEthereumAddress, secureRandomBase36, secureRandomBase64Url, selectWalletEd25519Signer, sendExpressRouteResponse, sessionJwtTimeClaims, sha256Bytes, sha256BytesSync, signSecp256k1Recoverable, signTenantRootCreationGrantV1, tenantRootIdentityDigestB64uV1, tenantStorageRouteBackendFamily, tenantStorageRouteDiagnostic, toFetchRouteResponse, normalizeOptionalTrimmedString as toOptionalTrimmedString, toResponse, toSessionArrayBufferCopy, unavailableRegistrationContext, validateDelegateExpiryAndNonce, validateGoogleIdTokenClaims, validateRuntimeSnapshotExpectation, validateSecp256k1PublicKey33, verifyGoogleOidcToken, verifyRs256JwtSignature, verifySecp256k1Bip340SignatureAgainstPublicKey33, verifySecp256k1RecoverableSignatureAgainstPublicKey33, walletAuthMethodId, walletAuthMethodV2Id, walletConsoleApiWalletGetRouteDefinitionV1, walletConsoleApiWalletListRouteDefinitionV1, walletConsoleApiWalletSearchRouteDefinitionV1, walletConsoleRelayRouteDefinitionsV1, walletConsoleSignedDelegateRouteDefinitionV1, walletConsoleSponsoredEvmCallRouteDefinitionV1, walletObjectIdentity, walletRegistrationContext, walletRegistrationSetupRequestDigest, webAuthnCredentialIdB64uFromCredential, withCors };

package/dist/esm/core/EmailOtpRecords.js

@@ -42,9 +42,8 @@ function parseCurrentEmailOtpChallengeRecord(raw) {
 	if (version !== "email_otp_challenge_v1") return null;
 	if (!challengeId || !challengeSubjectId || !walletId || !email || !otpCode || !ownerProofBindingDigest || !action || !operationRaw || !createdAtMs || !expiresAtMs || attemptCount == null || !maxAttempts) return null;
 	if (otpChannel !== "email_otp") return null;
-	if (action !== WALLET_EMAIL_OTP_ACTIONS.login && action !== WALLET_EMAIL_OTP_ACTIONS.registration && action !== WALLET_EMAIL_OTP_ACTIONS.recoveryBootstrap && action !== WALLET_EMAIL_OTP_ACTIONS.deviceLink) return null;
-	const operation = isWalletEmailOtpLoginOperation(operationRaw) || operationRaw === "registration" || operationRaw === "wallet_unlock" || operationRaw === "device_link" ? operationRaw : null;
-	if (!operation) return null;
+	const purpose = parseEmailOtpChallengePurpose(action, operationRaw);
+	if (!purpose) return null;
 	return {
 		version: "email_otp_challenge_v1",
 		challengeId,
@@ -55,14 +54,38 @@ function parseCurrentEmailOtpChallengeRecord(raw) {
 		email,
 		otpCode,
 		ownerProofBindingDigest,
-		action,
-		operation,
+		...purpose,
 		createdAtMs,
 		expiresAtMs,
 		attemptCount,
 		maxAttempts
 	};
 }
+function parseEmailOtpChallengePurpose(action, operation) {
+	switch (action) {
+		case WALLET_EMAIL_OTP_ACTIONS.login: return typeof operation === "string" && isWalletEmailOtpLoginOperation(operation) ? {
+			action,
+			operation
+		} : null;
+		case WALLET_EMAIL_OTP_ACTIONS.registration: return operation === "registration" ? {
+			action,
+			operation
+		} : null;
+		case WALLET_EMAIL_OTP_ACTIONS.recoveryBootstrap: return operation === "wallet_unlock" ? {
+			action,
+			operation
+		} : null;
+		case WALLET_EMAIL_OTP_ACTIONS.deviceLink: return operation === "device_link" ? {
+			action,
+			operation
+		} : null;
+		case WALLET_EMAIL_OTP_ACTIONS.relocation: return operation === "wallet_relocation" ? {
+			action,
+			operation
+		} : null;
+		default: return null;
+	}
+}
 function parseCurrentEmailOtpChallengeRow(input) {
 	const record = parseCurrentEmailOtpChallengeRecord(input.recordJson);
 	const expiresAtMs = toPositiveSafeInt(input.expiresAtMs);
@@ -158,6 +181,6 @@ function registrationAttemptMatchesReplacementScope(record, input) {
 	return record.ownerProofBindingDigest !== input.ownerProofBindingDigest && isLivePendingAttemptInScope(record, input);
 }
 //#endregion
-export { parseCurrentEmailOtpChallengeRow, parseCurrentEmailOtpGrantRow, parseCurrentEmailOtpUnlockChallengeRow, registrationAttemptMatchesReplacementScope, registrationAttemptMatchesStartedScope, runtimePolicyScopeKey };
+export { parseCurrentEmailOtpChallengeRow, parseCurrentEmailOtpGrantRow, parseCurrentEmailOtpUnlockChallengeRow, parseEmailOtpChallengePurpose, registrationAttemptMatchesReplacementScope, registrationAttemptMatchesStartedScope, runtimePolicyScopeKey };
 
 //# sourceMappingURL=EmailOtpRecords.js.map

package/dist/esm/core/ThresholdService/routerAb/ecdsaDerivationPoolFillHandlers.js

@@ -23,9 +23,11 @@ function presignAuthorityForBinding(binding) {
 	};
 	return binding.authorization.kind === "operation_step_up" ? {
 		kind: "operation_step_up",
+		ownership_generation: binding.ownershipGeneration,
 		wallet_scope: walletScope
 	} : {
 		kind: "owner_wallet_session",
+		ownership_generation: binding.ownershipGeneration,
 		wallet_scope: walletScope
 	};
 }

package/dist/esm/core/ThresholdService/routerAb/ecdsaDerivationPresignBridge.js

@@ -1,4 +1,5 @@
 import { parseRouterAbEcdsaDerivationNormalSigningScopeV1, parseRouterAbEcdsaSigningWorkerProtocolExportShareEnvelopeV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { walletObjectIdentityFromWireScope, walletObjectIdentityHeaders } from "../../../router/cloudflare/runtime/walletObjectAddresses.js";
 import { ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1, postRouterAbInternalServiceJson } from "./internalServiceHttp.js";
 //#region src/core/ThresholdService/routerAb/ecdsaDerivationPresignBridge.ts
 const CLOUDFLARE_SIGNING_WORKER_ECDSA_PRESIGN_SESSION_INIT_PATH = "/router-ab/signing-worker/ecdsa-derivation/presignature-session/init";
@@ -112,6 +113,7 @@ async function postStrictPresignSession(input) {
 	const response = await postRouterAbInternalServiceJson({
 		url: `${base}${input.path}`,
 		body: input.body,
+		headers: walletObjectIdentityHeaders(input.walletIdentity),
 		authSecret: input.auth.secret,
 		fetchImpl: input.fetchImpl,
 		onServerTiming: input.onServerTiming
@@ -136,6 +138,7 @@ async function postStrictPresignSession(input) {
 }
 async function startRouterAbEcdsaPresignSession(input) {
 	return postStrictPresignSession({
+		walletIdentity: walletObjectIdentityFromWireScope(input.authority.wallet_scope, input.authority.ownership_generation),
 		signingWorkerBaseUrl: input.signingWorkerBaseUrl,
 		path: CLOUDFLARE_SIGNING_WORKER_ECDSA_PRESIGN_SESSION_INIT_PATH,
 		body: {
@@ -153,6 +156,7 @@ async function startRouterAbEcdsaPresignSession(input) {
 }
 async function stepRouterAbEcdsaPresignSession(input) {
 	return postStrictPresignSession({
+		walletIdentity: walletObjectIdentityFromWireScope(input.authority.wallet_scope, input.authority.ownership_generation),
 		signingWorkerBaseUrl: input.signingWorkerBaseUrl,
 		path: CLOUDFLARE_SIGNING_WORKER_ECDSA_PRESIGN_SESSION_STEP_PATH,
 		body: {
@@ -176,10 +180,13 @@ async function stepRouterAbEcdsaPresignSession(input) {
 */
 async function startRouterAbLinkedDeviceEcdsaPresignSession(input) {
 	return postStrictPresignSession({
+		walletIdentity: walletObjectIdentityFromWireScope(input.walletScope, input.ownershipGeneration),
 		signingWorkerBaseUrl: input.signingWorkerBaseUrl,
 		path: CLOUDFLARE_SIGNING_WORKER_ECDSA_LINKED_PRESIGN_SESSION_INIT_PATH,
 		body: {
 			request: input.request,
+			wallet_scope: input.walletScope,
+			ownership_generation: input.ownershipGeneration,
 			material_source: input.materialSource,
 			presign_session_id: input.presignSessionId,
 			expires_at_ms: input.expiresAtMs
@@ -190,10 +197,13 @@ async function startRouterAbLinkedDeviceEcdsaPresignSession(input) {
 }
 async function stepRouterAbLinkedDeviceEcdsaPresignSession(input) {
 	return postStrictPresignSession({
+		walletIdentity: walletObjectIdentityFromWireScope(input.walletScope, input.ownershipGeneration),
 		signingWorkerBaseUrl: input.signingWorkerBaseUrl,
 		path: CLOUDFLARE_SIGNING_WORKER_ECDSA_LINKED_PRESIGN_SESSION_STEP_PATH,
 		body: {
 			request: input.request,
+			wallet_scope: input.walletScope,
+			ownership_generation: input.ownershipGeneration,
 			material_source: input.materialSource,
 			presign_session_id: input.presignSessionId,
 			requested_stage: input.requestedStage,

package/dist/esm/core/ThresholdService/routerAb/internalServiceHttp.js

@@ -15,6 +15,7 @@ async function postRouterAbInternalServiceJson(input) {
 		response = await input.fetchImpl(input.url, {
 			method: "POST",
 			headers: {
+				...input.headers,
 				"content-type": "application/json",
 				[ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1]: normalizeRouterAbInternalServiceAuthSecret(input.authSecret)
 			},

package/dist/esm/core/ThresholdService/validation.js

@@ -1,8 +1,8 @@
 import { parseWebAuthnRpId } from "../../shared-ts/src/utils/domainIds.js";
-import { base64UrlDecode } from "../../shared-ts/src/utils/base64.js";
-import "../../shared-ts/src/utils/encoders.js";
 import { normalizeOptionalString } from "../../shared-ts/src/utils/normalize.js";
 import { isPlainObject } from "../../shared-ts/src/utils/validation.js";
+import { base64UrlDecode } from "../../shared-ts/src/utils/base64.js";
+import "../../shared-ts/src/utils/encoders.js";
 import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority } from "../../shared-ts/src/utils/walletAuthAuthority.js";
 //#region src/core/ThresholdService/validation.ts
 function decodeFixedB64u(value, expectedLength) {

package/dist/esm/core/authService/nearPrivateKeySigning.js

@@ -1,6 +1,6 @@
+import { coerceNonEmptyString, requireRecordOrArray } from "../../shared-ts/src/utils/validation.js";
 import { base64UrlDecode, base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
 import "../../shared-ts/src/utils/encoders.js";
-import { coerceNonEmptyString, requireRecordOrArray } from "../../shared-ts/src/utils/validation.js";
 import { decodeNearSecretKey, toPublicKeyStringFromSecretKey } from "../nearKeys.js";
 //#region src/core/authService/nearPrivateKeySigning.ts
 const ED25519_PKCS8_SEED_PREFIX = Uint8Array.from([

package/dist/esm/core/authService/webauthn.js

@@ -1,6 +1,6 @@
+import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import { base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
 import "../../shared-ts/src/utils/encoders.js";
-import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import { failure } from "../../shared-ts/src/utils/failure.js";
 import { errorMessage } from "../../shared-ts/src/utils/errors.js";
 import { decodeBase64UrlOrBase64, isHostWithinRpId, loadSimpleWebAuthnServer, originHostnameOrEmpty, parseClientDataJsonBase64url } from "./webauthnOidcHelpers.js";

package/dist/esm/core/d1Ed25519SignerRead.js

@@ -0,0 +1,55 @@
+import { isPlainObject } from "../shared-ts/src/utils/validation.js";
+import { sameRouterAbMpcMaterialActivationRef } from "../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { selectWalletEd25519Signer } from "./d1WalletStore.js";
+import { resolveRouterAbEd25519YaoActiveCapability } from "../router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery.js";
+import { parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1 } from "../router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore.js";
+//#region src/core/d1Ed25519SignerRead.ts
+/** Signer rows read with a Wallet Session; a failure surfaces after session validation. */
+var Ed25519SignerRead = class Ed25519SignerRead {
+	#result;
+	constructor(walletId, activation, result, capabilities) {
+		this.walletId = walletId;
+		this.activation = activation;
+		this.capabilities = capabilities;
+		this.#result = result;
+	}
+	static fromRows(walletId, activation, rows, capabilityPartition) {
+		let result;
+		let capabilities = null;
+		try {
+			if (!Array.isArray(rows) || !rows.every(isPlainObject)) throw new Error("Ed25519 material rows are invalid");
+			result = {
+				ok: true,
+				signer: selectWalletEd25519Signer(rows, walletId, activation)
+			};
+			if (capabilityPartition !== null) {
+				const partition = parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1(capabilityPartition);
+				if (partition?.kind !== "router_ab_ed25519_yao_product_registration_shared_record_v1") throw new Error("Ed25519 capability partition is invalid");
+				capabilities = partition.value.recoveryCapabilities;
+			}
+		} catch (error) {
+			result = {
+				ok: false,
+				message: error instanceof Error ? error.message : "Ed25519 material read failed"
+			};
+		}
+		return new Ed25519SignerRead(walletId, activation, result, capabilities);
+	}
+	resolveActiveCapability(input) {
+		if (input.walletId !== this.walletId) throw new Error("Ed25519 capability read belongs to another wallet");
+		if (!this.#result.ok) throw new Error(this.#result.message);
+		if (!this.capabilities) return null;
+		const result = resolveRouterAbEd25519YaoActiveCapability(this.capabilities, input);
+		return !result.ok && result.code === "unknown_capability" ? null : result;
+	}
+	/** The session wallet's signer for the activation this read selected, or null. */
+	resolve(walletId, activation) {
+		if (walletId !== this.walletId || !sameRouterAbMpcMaterialActivationRef(activation, this.activation)) throw new Error("Ed25519 material read does not match the requested activation");
+		if (!this.#result.ok) throw new Error(this.#result.message);
+		return this.#result.signer;
+	}
+};
+//#endregion
+export { Ed25519SignerRead };
+
+//# sourceMappingURL=d1Ed25519SignerRead.js.map