@seams/wallet-server 0.8.0 → 0.9.0

package/dist/esm/router/auth/routerApiCredentialAuth.js

@@ -8,7 +8,7 @@ function routeAuthNotConfigured(message) {
 		message
 	};
 }
-async function resolvePublishableKeyApiCredentialAuth(input) {
+function parsePublishableKeyRequest(input) {
 	if (input.route.auth.plane !== "api_credentials") return routeAuthNotConfigured(input.routeAuthNotConfiguredMessage);
 	const publishableKey = extractBearerCredential(input.headers);
 	if (!publishableKey) return {
@@ -31,23 +31,42 @@ async function resolvePublishableKeyApiCredentialAuth(input) {
 		code: "forbidden",
 		message: `publishable_key_environment_mismatch: ${input.missingEnvironmentMessage}`
 	};
-	const authResult = await input.publishableKeyAuth.authenticate({
-		secret: publishableKey,
-		origin,
-		environmentId
+	return {
+		ok: true,
+		request: {
+			secret: publishableKey,
+			origin,
+			environmentId
+		}
+	};
+}
+async function resolveWalletRegistrationContext(input) {
+	const parsed = parsePublishableKeyRequest(input);
+	if (!parsed.ok) return parsed;
+	return input.registrationContext.resolve({
+		...parsed.request,
+		registration: input.registration
 	});
+}
+async function resolvePublishableKeyApiCredentialAuth(input) {
+	const parsed = parsePublishableKeyRequest(input);
+	if (!parsed.ok) return parsed;
+	const authResult = await input.publishableKeyAuth.authenticate(parsed.request);
 	if (!authResult.ok) return {
 		ok: false,
 		status: authResult.status,
 		code: authResult.status === 403 ? "forbidden" : "unauthorized",
 		message: `${authResult.code}: ${authResult.message}`
 	};
+	return publishableKeyRoutePrincipal(authResult.principal);
+}
+async function publishableKeyRoutePrincipal(principal) {
 	return {
 		ok: true,
 		principal: {
 			kind: "api_credentials",
 			credentialType: "publishable_key",
-			principal: authResult.principal
+			principal
 		}
 	};
 }
@@ -86,6 +105,6 @@ async function resolveSecretKeyApiCredentialAuth(input) {
 	};
 }
 //#endregion
-export { resolvePublishableKeyApiCredentialAuth, resolveSecretKeyApiCredentialAuth };
+export { publishableKeyRoutePrincipal, resolvePublishableKeyApiCredentialAuth, resolveSecretKeyApiCredentialAuth, resolveWalletRegistrationContext };
 
 //# sourceMappingURL=routerApiCredentialAuth.js.map

package/dist/esm/router/auth/walletRegistrationContext.js

@@ -0,0 +1,49 @@
+//#region src/router/auth/walletRegistrationContext.ts
+function unavailableRegistrationContext() {
+	return {
+		ok: false,
+		status: 500,
+		code: "registration_environment_unavailable",
+		message: "Wallet registration requires the authenticated active environment"
+	};
+}
+/** Join the authenticated credential to its exact active environment at the boundary. */
+function walletRegistrationContext(input, principal, environment) {
+	if (principal.environmentId !== input.environmentId || environment.id !== principal.environmentId || environment.status !== "ACTIVE" || !environment.projectId || !environment.key || !environment.signingRootVersion || principal.projectId !== void 0 && principal.projectId !== environment.projectId || principal.envId !== void 0 && principal.envId !== environment.key) return unavailableRegistrationContext();
+	return {
+		ok: true,
+		principal,
+		environment: {
+			id: environment.id,
+			projectId: environment.projectId,
+			key: environment.key,
+			signingRootVersion: environment.signingRootVersion,
+			status: "ACTIVE"
+		}
+	};
+}
+async function resolveRegistrationContext(auth, environments, input) {
+	try {
+		const result = await auth.authenticate(input);
+		if (!result.ok) return result;
+		const principal = result.principal;
+		const records = await environments.listEnvironments({
+			orgId: principal.orgId,
+			actorUserId: "runtime-scope-bootstrap",
+			roles: ["system"],
+			environmentId: principal.environmentId,
+			...principal.projectId ? { projectId: principal.projectId } : {}
+		}, { status: "ACTIVE" });
+		for (const environment of records) if (environment.id === principal.environmentId) return walletRegistrationContext(input, principal, environment);
+		return unavailableRegistrationContext();
+	} catch {
+		return unavailableRegistrationContext();
+	}
+}
+function createWalletRegistrationContextResolver(auth, environments) {
+	return { resolve: resolveRegistrationContext.bind(void 0, auth, environments) };
+}
+//#endregion
+export { createWalletRegistrationContextResolver, unavailableRegistrationContext, walletRegistrationContext };
+
+//# sourceMappingURL=walletRegistrationContext.js.map

package/dist/esm/router/auth/webAuthnCredentialCodecs.js

@@ -1,6 +1,6 @@
+import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import { base64Decode, base64UrlDecode, base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
 import "../../shared-ts/src/utils/encoders.js";
-import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import { failure } from "../../shared-ts/src/utils/failure.js";
 import { errorMessage } from "../../shared-ts/src/utils/errors.js";
 //#region src/router/auth/webAuthnCredentialCodecs.ts

package/dist/esm/router/cloudflare/d1/auth/d1AuthorizationAssembly.js

@@ -23,8 +23,9 @@ function createD1AuthorizationAssembly(options, sessionRouting) {
 		})
 	};
 }
-function createD1WalletCustodyStore(options) {
+function createD1WalletCustodyStore(options, walletAuthMethodStore) {
 	return new CloudflareD1WalletCustodyCommitStore({
+		walletAuthMethodStore,
 		credentialClaims: options.credentialClaims,
 		database: options.database,
 		scope: {
@@ -77,8 +78,8 @@ function createD1GoogleRegistrationAttempts(options, prepare) {
 function createD1EmailOtpRateLimits(options, prepare) {
 	return new CloudflareD1EmailOtpRateLimitStore({
 		prepare,
-		rateLimits: options.emailOtp.rateLimits,
-		counter: options.emailOtpRateLimitCounter
+		batch: options.database.batch.bind(options.database),
+		rateLimits: options.emailOtp.rateLimits
 	});
 }
 //#endregion

package/dist/esm/router/cloudflare/d1/auth/d1AuthorizedOperationRouteService.js

@@ -7,6 +7,8 @@ function createD1AuthorizedOperationRouteService(assembly) {
 		tenantId: tenantId.value,
 		resolveEcdsaWalletSessionOperation: assembly.authorizationStore.resolveEcdsaWalletSessionOperation.bind(assembly.authorizationStore),
 		admitEcdsaWalletSessionOperation: assembly.authorizationStore.admitEcdsaWalletSessionOperation.bind(assembly.authorizationStore),
+		admitEd25519WalletSessionOperation: assembly.authorizationStore.admitEd25519WalletSessionOperation.bind(assembly.authorizationStore),
+		resolveEd25519WalletSessionOperation: assembly.authorizationStore.resolveEd25519WalletSessionOperation.bind(assembly.authorizationStore),
 		readPinnedOwnerWalletScope: assembly.authorizationStore.readPinnedOwnerWalletScope.bind(assembly.authorizationStore),
 		buildVerifiedOwnerProof: assembly.authorizationService.buildVerifiedOwnerProof.bind(assembly.authorizationService),
 		recordVerifiedWalletOperationFactorEvidenceSet: assembly.authorizationService.recordVerifiedWalletOperationFactorEvidenceSet.bind(assembly.authorizationService),

package/dist/esm/router/cloudflare/d1/auth/d1EmailOtpRouteService.js

@@ -0,0 +1,25 @@
+//#region src/router/cloudflare/d1/auth/d1EmailOtpRouteService.ts
+function createD1EmailOtpRouteService(assembly) {
+	return {
+		applyEmailOtpServerSeal: assembly.emailOtpServerSeal.applyEmailOtpServerSeal.bind(assembly.emailOtpServerSeal),
+		cleanupGoogleEmailOtpDevRegistrationState: assembly.googleEmailOtpSessions.cleanupDevRegistrationState.bind(assembly.googleEmailOtpSessions),
+		consumeEmailOtpGrant: assembly.emailOtpRecoveryService.consumeEmailOtpGrant.bind(assembly.emailOtpRecoveryService),
+		createEmailOtpChallenge: assembly.emailOtpChallengeService.createEmailOtpChallenge.bind(assembly.emailOtpChallengeService),
+		createEmailOtpEnrollmentChallenge: assembly.emailOtpChallengeService.createEmailOtpEnrollmentChallenge.bind(assembly.emailOtpChallengeService),
+		isEmailOtpStrongAuthRequired: assembly.emailOtpRecoveryService.isEmailOtpStrongAuthRequired.bind(assembly.emailOtpRecoveryService),
+		markEmailOtpStrongAuthSatisfied: assembly.emailOtpRecoveryService.markEmailOtpStrongAuthSatisfied.bind(assembly.emailOtpRecoveryService),
+		readActiveEmailOtpEnrollment: assembly.emailOtpRecoveryService.readActiveEmailOtpEnrollment.bind(assembly.emailOtpRecoveryService),
+		readEmailOtpEnrollment: assembly.emailOtpRecoveryService.readEmailOtpEnrollment.bind(assembly.emailOtpRecoveryService),
+		readEmailOtpOutboxEntry: assembly.emailOtpChallengeService.readEmailOtpOutboxEntry.bind(assembly.emailOtpChallengeService),
+		removeEmailOtpServerSeal: assembly.emailOtpServerSeal.removeEmailOtpServerSeal.bind(assembly.emailOtpServerSeal),
+		validateGoogleEmailOtpRegistrationCandidateWallet: assembly.googleEmailOtpSessions.validateRegistrationCandidateWallet.bind(assembly.googleEmailOtpSessions),
+		verifyEmailOtpChallenge: assembly.emailOtpChallengeService.verifyEmailOtpChallenge.bind(assembly.emailOtpChallengeService),
+		verifyEmailOtpWalletRecoveryChallenge: assembly.emailOtpChallengeService.verifyEmailOtpWalletRecoveryChallenge.bind(assembly.emailOtpChallengeService),
+		verifyEmailOtpEnrollment: assembly.emailOtpChallengeService.verifyEmailOtpEnrollment.bind(assembly.emailOtpChallengeService),
+		verifyGoogleLogin: assembly.oidcVerification.verifyGoogleLogin.bind(assembly.oidcVerification)
+	};
+}
+//#endregion
+export { createD1EmailOtpRouteService };
+
+//# sourceMappingURL=d1EmailOtpRouteService.js.map

package/dist/esm/router/cloudflare/d1/auth/d1RouterApiAuthConfig.js

@@ -1,6 +1,7 @@
 import { parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { normalizeCorsOrigin } from "../../../../core/SessionService.js";
+import { D1WalletExecutionAuthority, admitD1EstablishedWalletHome } from "../registration/d1WalletExecutionAuthority.js";
 import "../../../../core/authService/emailOtpConfig.js";
 import { parseSigningSessionSealRootConfig } from "../../../../threshold/session/signingSessionSeal/options.js";
 //#region src/router/cloudflare/d1/auth/d1RouterApiAuthConfig.ts
@@ -38,6 +39,12 @@ function parseBooleanFlag(input, fallback, field) {
 	}
 }
 function normalizeD1RouterApiAuthOptions(input) {
+	const scope = {
+		namespace: requireD1RouterApiAuthScopeString(input.namespace, "namespace"),
+		orgId: requireD1RouterApiAuthScopeString(input.orgId, "orgId"),
+		projectId: requireD1RouterApiAuthScopeString(input.projectId, "projectId"),
+		envId: requireD1RouterApiAuthScopeString(input.envId, "envId")
+	};
 	const githubClientId = normalizeOptionalTrimmedString(input.githubOAuth?.clientId);
 	const githubClientSecret = normalizeOptionalTrimmedString(input.githubOAuth?.clientSecret);
 	const githubCallbackUrl = normalizeOptionalTrimmedString(input.githubOAuth?.callbackUrl);
@@ -49,8 +56,8 @@ function normalizeD1RouterApiAuthOptions(input) {
 	if (input.githubOAuth && !githubOAuth) throw new Error("githubOAuth requires clientId, clientSecret, and callbackUrl");
 	return {
 		database: input.database,
+		walletExecution: { admitEstablishedHome: admitD1EstablishedWalletHome.bind(void 0, input.database, scope) },
 		identityStore: input.identityStore,
-		emailOtpRateLimitCounter: input.emailOtpRateLimitCounter,
 		credentialClaims: input.credentialClaims,
 		syncChallenges: input.syncChallenges,
 		linkedDeviceProofNonces: input.linkedDeviceProofNonces,
@@ -59,12 +66,13 @@ function normalizeD1RouterApiAuthOptions(input) {
 		sessionRouting: input.sessionRouting,
 		recoveryRouting: input.recoveryRouting,
 		lifecycleRouting: input.lifecycleRouting,
-		registrationAuthority: input.registrationAuthority,
+		registrationAuthority: input.registrationAuthority ? new D1WalletExecutionAuthority(input.database, scope, input.registrationAuthority) : void 0,
 		registrationSetupDispatcher: input.registrationSetupDispatcher,
-		namespace: requireD1RouterApiAuthScopeString(input.namespace, "namespace"),
-		orgId: requireD1RouterApiAuthScopeString(input.orgId, "orgId"),
-		projectId: requireD1RouterApiAuthScopeString(input.projectId, "projectId"),
-		envId: requireD1RouterApiAuthScopeString(input.envId, "envId"),
+		startRegistrationWallets: input.startRegistrationWallets,
+		namespace: scope.namespace,
+		orgId: scope.orgId,
+		projectId: scope.projectId,
+		envId: scope.envId,
 		relayerAccount: normalizeOptionalTrimmedString(input.relayerAccount),
 		relayerPublicKey: normalizeOptionalTrimmedString(input.relayerPublicKey),
 		relayerPrivateKey: normalizeOptionalTrimmedString(input.relayerPrivateKey),

package/dist/esm/router/cloudflare/d1/auth/d1RouterApiAuthService.js

@@ -1,4 +1,4 @@
-import { parseWalletAuthMethodId, parseWalletAuthorityId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseDeviceId, parsePrincipalId, parseTenantId, parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseRouterAbEcdsaRegistrationActivationReceiptV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
@@ -15,10 +15,11 @@ import { sha256BytesPortable, toRecordValue } from "./d1RouterApiAuthBoundary.js
 import { verifyD1LinkedDeviceFreshRevokeProofV1 } from "../wallet/d1WalletAuthMethodBoundary.js";
 import { D1LinkedDeviceAuthorityInstallServiceV1 } from "../deviceLinking/d1LinkedDeviceAuthorityInstallService.js";
 import { D1WalletAuthorityStore } from "../wallet/d1WalletAuthorityStore.js";
-import { createCloudflareD1VersionedJsonRecordStore } from "../versionedJson/d1VersionedJsonRecordStore.js";
 import { parseRouterAbEd25519YaoRegistrationSideEffectRecordV2 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
 import { createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1 } from "../../signingLanes/cloudflareOrdinaryInactiveSignerMaterialReservation.js";
 import { normalizeD1RouterApiAuthOptions } from "./d1RouterApiAuthConfig.js";
+import { D1WalletOperationStore } from "../registration/d1WalletOperationStore.js";
+import { createD1EmailOtpRouteService } from "./d1EmailOtpRouteService.js";
 import { toPublicKeyStringFromSecretKey } from "../../../../core/nearKeys.js";
 import { MinimalNearClient } from "../../../../core/rpcClients/near/NearClient.js";
 import { fundImplicitNearAccountWithRelayer } from "../../../../core/nearRelayerAccountProvisioning.js";
@@ -26,7 +27,7 @@ import { createSponsoredNamedNearAccountForOptions } from "../near/d1SponsoredNe
 import { parseD1EcdsaDerivationServerBootstrapResponse, parseD1WalletRegistrationCommittedInstallationProjection, parseD1WalletRegistrationFinalizeReplayResponse } from "../registration/d1RegistrationCeremonyRecords.js";
 import { parseD1WalletAddSignerFinalizeSideEffectRecord } from "../wallet/d1WalletAddSignerFinalizeRecord.js";
 import { dispatchWalletRegistrationSetup } from "../../../framework/registrationSetupDispatch.js";
-import { readActiveWalletSessionCredential, readExhaustedWalletSessionCredential, readWalletSessionSigningCandidate } from "./walletSessionCredentialReaders.js";
+import { readActiveWalletSessionCredential, readEd25519WalletSessionSigningRead, readExhaustedWalletSessionCredential, readWalletSessionSigningCandidate } from "./walletSessionCredentialReaders.js";
 import { createD1AuthorizedOperationRouteService } from "./d1AuthorizedOperationRouteService.js";
 import { parseRegistrationEstablishedSessionProjectionV2 } from "../../../../shared-ts/src/utils/registrationEstablishedSession.js";
 import { signGasRelayerNearTransactionWithDeps } from "../../../../core/authService/nearTransactions.js";
@@ -51,6 +52,7 @@ import { D1WalletAuthMethodRevocationReplayStoreV1 } from "../wallet/d1WalletAut
 import { CloudflareD1WalletAuthMethodService } from "../wallet/d1WalletAuthMethodService.js";
 import { parseWalletRegistrationSessionCommitReceiptV2 } from "../registration/walletRegistrationSessionCommitReceipt.js";
 import { CloudflareD1WalletRegistrationService } from "../registration/d1WalletRegistrationService.js";
+import { D1WalletRegistrationRead } from "../registration/d1WalletRegistrationRead.js";
 import { CloudflareD1WalletRegistrationCommitStore } from "../registration/d1WalletRegistrationCommitStore.js";
 import { CloudflareD1Ed25519YaoLifecycleDecisionStoreV1 } from "../ed25519Yao/d1Ed25519YaoLifecycleDecisionStore.js";
 import { createD1PasskeyCustodyRouteService } from "../passkeyCustody/d1PasskeyCustodyRouteService.js";
@@ -434,17 +436,20 @@ function parseWalletRegistrationOperationPrepared(raw) {
 	if (Reflect.get(raw, "kind") !== "d1_wallet_registration_operation_prepared_v1") return null;
 	const keys = [
 		"kind",
+		"walletId",
 		"walletAuthorityId",
 		"deviceId",
 		"walletAuthMethodId"
 	];
 	if (Object.keys(raw).length !== keys.length || !hasOnlyKeys(raw, keys)) return null;
+	const walletId = parseWalletId(Reflect.get(raw, "walletId"));
 	const walletAuthorityId = parseWalletAuthorityId(Reflect.get(raw, "walletAuthorityId"));
 	const deviceId = parseDeviceId(Reflect.get(raw, "deviceId"));
 	const walletAuthMethodId = parseWalletAuthMethodId(Reflect.get(raw, "walletAuthMethodId"));
-	if (!walletAuthorityId.ok || !deviceId.ok || !walletAuthMethodId.ok) return null;
+	if (!walletId.ok || !walletAuthorityId.ok || !deviceId.ok || !walletAuthMethodId.ok) return null;
 	return {
 		kind: "d1_wallet_registration_operation_prepared_v1",
+		walletId: walletId.value,
 		walletAuthorityId: walletAuthorityId.value,
 		deviceId: deviceId.value,
 		walletAuthMethodId: walletAuthMethodId.value
@@ -617,15 +622,12 @@ function registrationReceiptMatchesJournal(record) {
 	if (receipt.operation !== record.operation || receipt.operationFingerprint !== record.requestFingerprint) return false;
 	if (receipt.committed.kind === "error") return true;
 	if (!("walletAuthMethodId" in receipt)) return false;
+	if (receipt.walletId !== record.prepared.walletId) return false;
 	if (receipt.walletAuthMethodId !== record.prepared.walletAuthMethodId) return false;
-	if (receipt.committed.kind === "near_pending") return true;
 	return "foundingAuthority" in receipt && receipt.foundingAuthority.authorityId === record.prepared.walletAuthorityId;
 }
-function resolveEd25519YaoProductRegistration(options) {
-	return options.ed25519YaoProductRegistration || null;
-}
 function walletRegistrationActivateSideEffectStore(options) {
-	return createCloudflareD1VersionedJsonRecordStore({
+	return new D1WalletOperationStore({
 		database: options.database,
 		scope: {
 			namespace: options.namespace,
@@ -636,10 +638,10 @@ function walletRegistrationActivateSideEffectStore(options) {
 		keyPrefix: "wallet-registration-activate:",
 		encode: (value) => value,
 		parse: parseWalletRegistrationActivateSideEffectRecord
-	});
+	}, registrationOperationWallet);
 }
 function walletRegistrationNearProvisioningSideEffectStore(options) {
-	return createCloudflareD1VersionedJsonRecordStore({
+	return new D1WalletOperationStore({
 		database: options.database,
 		scope: {
 			namespace: options.namespace,
@@ -650,10 +652,10 @@ function walletRegistrationNearProvisioningSideEffectStore(options) {
 		keyPrefix: "wallet-registration-near-provisioning:",
 		encode: (value) => value,
 		parse: parseWalletRegistrationNearProvisioningSideEffectRecord
-	});
+	}, registrationOperationWallet);
 }
 function walletAddSignerStartSideEffectStore(options) {
-	return createCloudflareD1VersionedJsonRecordStore({
+	return new D1WalletOperationStore({
 		database: options.database,
 		scope: {
 			namespace: options.namespace,
@@ -664,10 +666,10 @@ function walletAddSignerStartSideEffectStore(options) {
 		keyPrefix: "wallet-add-signer-start:",
 		encode: (value) => value,
 		parse: parseD1WalletAddSignerStartSideEffectRecord
-	});
+	}, addSignerStartWallet);
 }
 function walletAddSignerFinalizeSideEffectStore(options) {
-	return createCloudflareD1VersionedJsonRecordStore({
+	return new D1WalletOperationStore({
 		database: options.database,
 		scope: {
 			namespace: options.namespace,
@@ -678,7 +680,7 @@ function walletAddSignerFinalizeSideEffectStore(options) {
 		keyPrefix: "wallet-add-signer-finalize:",
 		encode: (value) => value,
 		parse: parseD1WalletAddSignerFinalizeSideEffectRecord
-	});
+	}, addSignerFinalizeWallet);
 }
 async function readD1Ed25519KeyManifestBySlot(walletStore, input) {
 	const signer = await walletStore.getEd25519SignerBySlot(input);
@@ -826,21 +828,25 @@ function createCloudflareD1RouterApiAuthAssembly(input) {
 		projectId: options.projectId,
 		envId: options.envId
 	});
-	const walletCustodyCommitStore = createD1WalletCustodyStore(options);
+	const walletCustodyCommitStore = createD1WalletCustodyStore(options, walletAuthMethodStore);
 	const signedDelegateExecutor = new CloudflareD1SignedDelegateExecutor(options);
 	const walletRegistrations = new CloudflareD1WalletRegistrationService({
+		executionAuthority: options.walletExecution,
+		home: options.sessionRouting?.home() ?? { kind: "direct" },
 		registrationAuthority: options.registrationAuthority ?? null,
+		startRegistrationWallets: options.startRegistrationWallets ?? null,
 		authorizationService,
+		registrationSessionStore: authorizationStore,
 		authorizationTenantId: authorizationTenantId.value,
 		createSponsoredNamedNearAccount,
 		emailOtpRegistrationEnrollmentFinalizer,
 		getRegistrationCeremonyIntentStore,
-		getEd25519YaoProductRegistration: () => resolveEd25519YaoProductRegistration(options),
+		getEd25519YaoProductRegistration: () => options.ed25519YaoProductRegistration ?? null,
 		ecdsaStrictRegistration: options.ecdsaStrictRegistration,
 		tenantRootCustodyLineage: options.tenantRootCustodyLineage,
 		getWalletStore,
 		activateSideEffects: walletRegistrationActivateSideEffectStore(options),
-		nearProvisioningSideEffects: walletRegistrationNearProvisioningSideEffectStore(options),
+		registrationRead: new D1WalletRegistrationRead(options.database, options.registrationAuthority ?? null, walletRegistrationNearProvisioningSideEffectStore(options), getRegistrationCeremonyIntentStore, yaoLifecycleDecisions),
 		walletRegistrationCommitStore,
 		walletCustodyCommitStore,
 		walletAuthMethods,
@@ -848,8 +854,9 @@ function createCloudflareD1RouterApiAuthAssembly(input) {
 		yaoLifecycleDecisions
 	});
 	const walletAddSigners = new CloudflareD1WalletAddSignerService({
+		executionAuthority: options.walletExecution,
 		getRegistrationCeremonyIntentStore,
-		getEd25519YaoProductRegistration: () => resolveEd25519YaoProductRegistration(options),
+		getEd25519YaoProductRegistration: () => options.ed25519YaoProductRegistration ?? null,
 		ecdsaStrictRegistration: options.ecdsaStrictRegistration,
 		tenantRootCustodyLineage: options.tenantRootCustodyLineage,
 		getWalletStore,
@@ -940,6 +947,11 @@ function createCloudflareD1RouterApiAuthAssembly(input) {
 	});
 	linkedDeviceEd25519AuthorityReaderSlot.current = linkedDeviceComposition.linkedDeviceEd25519AuthorityReader ?? null;
 	return {
+		relocationEmailOtp: {
+			verifier: emailOtpChallengeVerifier,
+			emailOtpChallenges,
+			issuer: emailOtpChallengeIssuer
+		},
 		options,
 		emailOtpServerSeal,
 		emailOtpChallengeService,
@@ -1202,26 +1214,6 @@ function createD1WalletUnlockRouteService(assembly) {
 		refreshWalletSessionAuthorityProjection: assembly.authorizationService.refreshWalletSessionAuthorizationV2AuthorityProjection.bind(assembly.authorizationService)
 	};
 }
-function createD1EmailOtpRouteService(assembly) {
-	return {
-		applyEmailOtpServerSeal: assembly.emailOtpServerSeal.applyEmailOtpServerSeal.bind(assembly.emailOtpServerSeal),
-		cleanupGoogleEmailOtpDevRegistrationState: assembly.googleEmailOtpSessions.cleanupDevRegistrationState.bind(assembly.googleEmailOtpSessions),
-		consumeEmailOtpGrant: assembly.emailOtpRecoveryService.consumeEmailOtpGrant.bind(assembly.emailOtpRecoveryService),
-		createEmailOtpChallenge: assembly.emailOtpChallengeService.createEmailOtpChallenge.bind(assembly.emailOtpChallengeService),
-		createEmailOtpEnrollmentChallenge: assembly.emailOtpChallengeService.createEmailOtpEnrollmentChallenge.bind(assembly.emailOtpChallengeService),
-		isEmailOtpStrongAuthRequired: assembly.emailOtpRecoveryService.isEmailOtpStrongAuthRequired.bind(assembly.emailOtpRecoveryService),
-		markEmailOtpStrongAuthSatisfied: assembly.emailOtpRecoveryService.markEmailOtpStrongAuthSatisfied.bind(assembly.emailOtpRecoveryService),
-		readActiveEmailOtpEnrollment: assembly.emailOtpRecoveryService.readActiveEmailOtpEnrollment.bind(assembly.emailOtpRecoveryService),
-		readEmailOtpEnrollment: assembly.emailOtpRecoveryService.readEmailOtpEnrollment.bind(assembly.emailOtpRecoveryService),
-		readEmailOtpOutboxEntry: assembly.emailOtpChallengeService.readEmailOtpOutboxEntry.bind(assembly.emailOtpChallengeService),
-		removeEmailOtpServerSeal: assembly.emailOtpServerSeal.removeEmailOtpServerSeal.bind(assembly.emailOtpServerSeal),
-		validateGoogleEmailOtpRegistrationCandidateWallet: assembly.googleEmailOtpSessions.validateRegistrationCandidateWallet.bind(assembly.googleEmailOtpSessions),
-		verifyEmailOtpChallenge: assembly.emailOtpChallengeService.verifyEmailOtpChallenge.bind(assembly.emailOtpChallengeService),
-		verifyEmailOtpWalletRecoveryChallenge: assembly.emailOtpChallengeService.verifyEmailOtpWalletRecoveryChallenge.bind(assembly.emailOtpChallengeService),
-		verifyEmailOtpEnrollment: assembly.emailOtpChallengeService.verifyEmailOtpEnrollment.bind(assembly.emailOtpChallengeService),
-		verifyGoogleLogin: assembly.oidcVerification.verifyGoogleLogin.bind(assembly.oidcVerification)
-	};
-}
 function createD1WebAuthnRouteService(assembly) {
 	return {
 		createWebAuthnLoginOptions: assembly.webAuthnAuthService.createWebAuthnLoginOptions.bind(assembly.webAuthnAuthService),
@@ -1253,6 +1245,7 @@ function createD1AuthorizationSessionRouteService(assembly) {
 		issueDirectWalletSessionAuthorizationV2: assembly.authorizationService.issueDirectWalletSessionAuthorizationV2.bind(assembly.authorizationService),
 		readWalletSessionAuthorizationV2ByOperationCredential: readActiveWalletSessionCredential.bind(null, assembly.authorizationService),
 		readWalletSessionSigningCandidateByOperationCredential: readWalletSessionSigningCandidate.bind(null, assembly.authorizationService),
+		readEd25519WalletSessionSigningReadByOperationCredential: readEd25519WalletSessionSigningRead.bind(null, assembly.authorizationService),
 		readWalletSessionExactOperationContextByCredential: assembly.authorizationService.readWalletSessionExactOperationContextByCredential.bind(assembly.authorizationService),
 		readExhaustedWalletSessionAuthorizationV2CandidateByOperationCredential: readExhaustedWalletSessionCredential.bind(null, assembly.authorizationService),
 		readExactWalletSessionStatusByOperationCredential: assembly.authorizationService.readExactWalletSessionStatusByOperationCredential.bind(assembly.authorizationService),
@@ -1297,6 +1290,8 @@ function createD1RouterAccountRouteService(assembly) {
 function createCloudflareD1RouterApiAuthService(input) {
 	const assembly = createCloudflareD1RouterApiAuthAssembly(input);
 	return {
+		walletExecution: assembly.options.walletExecution,
+		relocationEmailOtp: assembly.relocationEmailOtp,
 		walletRegistration: createD1WalletRegistrationRouteService(assembly),
 		walletAuthMethods: createD1WalletAuthMethodRouteService(assembly),
 		walletUnlock: createD1WalletUnlockRouteService(assembly),
@@ -1326,6 +1321,15 @@ function createCloudflareD1RouterApiAuthService(input) {
 		...assembly.linkedDeviceEd25519AuthorityReader === void 0 ? {} : { linkedDeviceEd25519AuthorityReader: assembly.linkedDeviceEd25519AuthorityReader }
 	};
 }
+function registrationOperationWallet(record) {
+	return record.prepared.walletId;
+}
+function addSignerStartWallet(record) {
+	return record.prepared.storedIntent.intent.walletId;
+}
+function addSignerFinalizeWallet(record) {
+	return record.prepared.walletId;
+}
 //#endregion
 export { createCloudflareD1RouterApiAuthService };
 

package/dist/esm/router/cloudflare/d1/auth/walletSessionCredentialReaders.js

@@ -29,6 +29,22 @@ async function readActiveWalletSessionCredential(service, input) {
 	if (snapshot.kind === "exhausted") throw new Error("Stored V2 Wallet Session quota is no longer active");
 	return activeContext(snapshot);
 }
+/**
+* The active session with its wallet's Ed25519 signer and policy rows. An
+* exhausted session throws, as the plain credential read does: its caller
+* resolves the exhausted candidate separately.
+*/
+async function readEd25519WalletSessionSigningRead(service, input) {
+	const read = await service.readEd25519WalletSessionAdmissionSnapshotByOperationCredential(input);
+	if (!read) return null;
+	if (read.snapshot.kind === "exhausted") throw new Error("Stored V2 Wallet Session quota is no longer active");
+	const context = activeContext(read.snapshot);
+	return context ? {
+		context,
+		signerRead: read.signerRead,
+		policyRead: read.policyRead
+	} : null;
+}
 async function readWalletSessionSigningCandidate(service, input) {
 	const read = await service.readEcdsaWalletSessionAdmissionSnapshotByOperationCredential(input);
 	if (!read) return null;
@@ -71,6 +87,6 @@ async function readExhaustedWalletSessionCredential(service, input) {
 	});
 }
 //#endregion
-export { readActiveWalletSessionCredential, readExhaustedWalletSessionCredential, readWalletSessionSigningCandidate };
+export { readActiveWalletSessionCredential, readEd25519WalletSessionSigningRead, readExhaustedWalletSessionCredential, readWalletSessionSigningCandidate };
 
 //# sourceMappingURL=walletSessionCredentialReaders.js.map

package/dist/esm/router/cloudflare/d1/authorization/authorizedOperationStatements.js

@@ -58,8 +58,12 @@ const PINNED_OWNER_WALLET = `
     LIMIT 1)
   END AS pinned_owner_wallet_id`;
 function prepareAuthorizedOperationCommittedRead(database, namespace, input) {
-	return database.prepare(`SELECT operation.*, ${PINNED_OWNER_WALLET}
+	return database.prepare(`SELECT operation.*, evidence.org_id AS step_up_org_id, evidence.project_id AS step_up_project_id,
+            evidence.env_id AS step_up_env_id, ${PINNED_OWNER_WALLET}
        FROM authorized_operations AS operation
+       LEFT JOIN verified_wallet_operation_evidence_sets AS evidence
+         ON evidence.namespace = operation.namespace AND evidence.tenant_id = operation.tenant_id
+        AND evidence.evidence_set_digest = operation.evidence_set_digest
       WHERE operation.namespace = ? AND operation.tenant_id = ?
         AND operation.operation_fingerprint_digest = ?
       LIMIT 1`).bind(namespace, input.tenantId, input.operationFingerprintDigest);
@@ -74,7 +78,8 @@ function prepareAuthorizedOperationAdmissionRead(input) {
 		sql: "1",
 		bindings: []
 	};
-	return input.database.prepare(`SELECT operation.*, ${PINNED_OWNER_WALLET}, (${material.sql}) AS material_snapshot_active,
+	return input.database.prepare(`SELECT operation.*, evidence.org_id AS step_up_org_id, evidence.project_id AS step_up_project_id,
+            evidence.env_id AS step_up_env_id, ${PINNED_OWNER_WALLET}, (${material.sql}) AS material_snapshot_active,
             CASE operation.authorization_source_kind
               WHEN 'authorization_grant' THEN EXISTS (
                 SELECT 1
@@ -130,6 +135,9 @@ function prepareAuthorizedOperationAdmissionRead(input) {
               ELSE 0
             END AS authorization_source_active
        FROM authorized_operations AS operation
+       LEFT JOIN verified_wallet_operation_evidence_sets AS evidence
+         ON evidence.namespace = operation.namespace AND evidence.tenant_id = operation.tenant_id
+        AND evidence.evidence_set_digest = operation.evidence_set_digest
       WHERE operation.namespace = ? AND operation.tenant_id = ?
         AND operation.operation_fingerprint_digest = ?
       LIMIT 1`).bind(...material.bindings, input.walletSignerScope.orgId, input.walletSignerScope.projectId, input.walletSignerScope.envId, input.nowMs, input.nowMs, input.namespace, input.tenantId, input.operationFingerprintDigest);
@@ -181,6 +189,22 @@ function prepareAuthorizedOperationInsert(input) {
 		sql: "1",
 		bindings: []
 	};
+	if (source.kind === "verified_step_up") condition = {
+		sql: `(${condition.sql}) AND EXISTS (
+        SELECT 1 FROM verified_wallet_operation_evidence_sets AS evidence
+        WHERE evidence.namespace = ? AND evidence.tenant_id = ? AND evidence.evidence_set_digest = ?
+          AND evidence.org_id = ? AND evidence.project_id = ? AND evidence.env_id = ?
+      )`,
+		bindings: [
+			...condition.bindings,
+			namespace,
+			operation.tenantId,
+			source.evidenceSetDigest,
+			walletSignerScope.orgId,
+			walletSignerScope.projectId,
+			walletSignerScope.envId
+		]
+	};
 	const absence = input.existingOperation === "preserve" ? {
 		sql: `NOT EXISTS (SELECT 1 FROM authorized_operations
                WHERE namespace = ? AND tenant_id = ? AND operation_fingerprint_digest = ?)`,
@@ -205,11 +229,17 @@ function prepareAuthorizedOperationInsert(input) {
           material_activation_owner, material_activation_key_binding,
           material_activation_lifecycle_binding, material_activation_signing_worker,
           owner_scope_org_id, owner_scope_project_id,
-          owner_scope_env_id
+          owner_scope_env_id, ownership_generation
         ) SELECT ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?,
                   'claimed', 'pending', NULL, NULL, NULL, NULL, ?, NULL, ?,
-                  ?, ?, ?, ?, ?, ?, ?, ?
-           WHERE (${condition.sql}) AND (${absence.sql})`).bind(...values, ...condition.bindings, ...absence.bindings);
+                  ?, ?, ?, ?, ?, ?, ?, ?,
+                  (SELECT execution.generation FROM wallet_operation_authorizations AS owner
+                   JOIN wallet_execution_generations AS execution
+                     USING(namespace, org_id, project_id, env_id, wallet_id)
+                   WHERE owner.namespace = ? AND owner.tenant_id = ? AND owner.source_kind = ?
+                     AND owner.source_id = ? AND owner.org_id = ? AND owner.project_id = ?
+                     AND owner.env_id = ? AND execution.state = 'active')
+           WHERE (${condition.sql}) AND (${absence.sql})`).bind(...values, namespace, operation.tenantId, source.kind, source.kind === "authorization_grant" ? source.authorizationGrantRef.authorizationId : source.evidenceSetDigest, walletSignerScope.orgId, walletSignerScope.projectId, walletSignerScope.envId, ...condition.bindings, ...absence.bindings);
 }
 //#endregion
 export { prepareAuthorizedOperationAdmissionRead, prepareAuthorizedOperationCommittedRead, prepareAuthorizedOperationInsert, prepareAuthorizedOperationRead };