@seams/wallet-server 0.9.4 → 0.10.1

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyRecords.js

@@ -3,6 +3,7 @@ import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilit
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { parseWalletAddAuthMethodRegistrationOptions } from "../../../../shared-ts/src/utils/addAuthMethodRegistration.js";
+import { parseRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationActivationResultV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { deriveEvmFamilySigningKeySlotId } from "../../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";
 import { derivationClientSharePublicKey33B64uFromString, ecdsaClientRootPublicKey33B64uFromString } from "../../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
@@ -23,7 +24,7 @@ import "../../../../shared-ts/src/signing-lanes/index.js";
 import { parsePasskeyCustodyEnvelopeRecord } from "../../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
 import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../../shared-ts/src/utils/near.js";
-import { normalizeAddSignerSelection, normalizeRegistrationSignerPlan, registrationSignerBranchKeyFromString, registrationSignerSetSelectionFromPlan } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
+import { findRegistrationSignerPlanNearEd25519Branch, normalizeAddSignerSelection, normalizeRegistrationSignerPlan, registrationSignerBranchKeyFromString, registrationSignerSetSelectionFromPlan } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
 import { addAuthMethodIntentGrantFromString, addSignerIntentGrantFromString, normalizeAddAuthMethodIntentCaller } from "../../../../shared-ts/src/utils/registrationIntent.js";
 import { parseEcdsaDerivationPublicIdentity, parseThresholdEd25519AuthorityScope, thresholdEd25519AuthorityScopeFromWalletAuthAuthority, thresholdEd25519AuthorityScopesMatch } from "../../../../core/ThresholdService/validation.js";
 import { toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";
@@ -172,7 +173,8 @@ function parseD1StoredWalletRegistrationCeremony(raw) {
 	const signerState = parseD1StoredWalletRegistrationSignerState(record.signerState);
 	const signingRootId = normalizeOptionalTrimmedString(record.signingRootId);
 	const signingRootVersion = normalizeOptionalTrimmedString(record.signingRootVersion);
-	if (!registrationCeremonyId || !intent || !digestB64u || !orgId || !signingRootId || !signingRootVersion || !foundingWalletAuthorityId.ok || !foundingDeviceId.ok || !foundingWalletAuthMethodId.ok || expiresAtMs === null || !authorityState || !signerPlan || !preparedContext || !intentSignerPlan || !storedRegistrationSignerPlansMatch(signerPlan, intentSignerPlan) || signingRootId && preparedContext.signingRootId !== signingRootId || signingRootVersion && preparedContext.signingRootVersion !== signingRootVersion || !signerState) return null;
+	const ed25519YaoMint = parseD1WalletRegistrationEd25519YaoMint(record.ed25519YaoMint);
+	if (!registrationCeremonyId || !intent || !digestB64u || !orgId || !signingRootId || !signingRootVersion || !foundingWalletAuthorityId.ok || !foundingDeviceId.ok || !foundingWalletAuthMethodId.ok || expiresAtMs === null || !authorityState || !signerPlan || !preparedContext || !intentSignerPlan || !storedRegistrationSignerPlansMatch(signerPlan, intentSignerPlan) || signingRootId && preparedContext.signingRootId !== signingRootId || signingRootVersion && preparedContext.signingRootVersion !== signingRootVersion || !signerState || ed25519YaoMint === void 0 || ed25519YaoMint === null !== (findRegistrationSignerPlanNearEd25519Branch(signerPlan) === null)) return null;
 	const ceremony = {
 		registrationCeremonyId,
 		foundingWalletAuthorityId: foundingWalletAuthorityId.value,
@@ -185,6 +187,7 @@ function parseD1StoredWalletRegistrationCeremony(raw) {
 		orgId,
 		expiresAtMs,
 		authorityState,
+		ed25519YaoMint,
 		signerState
 	};
 	const expectedOrigin = normalizeOptionalTrimmedString(record.expectedOrigin);
@@ -193,6 +196,22 @@ function parseD1StoredWalletRegistrationCeremony(raw) {
 	if (expectedOrigin) ceremony.expectedOrigin = expectedOrigin;
 	return ceremony;
 }
+/** `undefined` for a record that is not a mint and not `null`. */
+function parseD1WalletRegistrationEd25519YaoMint(raw) {
+	if (raw === null) return null;
+	const record = toRecordValue(raw);
+	if (!record || !hasExactKeys(record, ["materialActivation", "sessionId"])) return void 0;
+	const sessionId = parseD1Bytes32(record.sessionId);
+	if (!sessionId || sessionId.every((byte) => byte === 0)) return void 0;
+	try {
+		return {
+			materialActivation: parseRouterAbMpcMaterialActivationRef(record.materialActivation),
+			sessionId
+		};
+	} catch {
+		return;
+	}
+}
 /**
 * Setup creates the ceremony before the WebAuthn proof exists, so the stored
 * authority is a two-arm state rather than a required record.

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationSetupRateLimit.js

@@ -0,0 +1,34 @@
+import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import { prepareD1TenantStatement } from "../../../../core/d1TenantStore.js";
+//#region src/router/cloudflare/d1/registration/d1RegistrationSetupRateLimit.ts
+/** Regional counters bound the work that runs before a passkey is verified. */
+async function consumeRegistrationSetupRateLimit(database, namespace, input) {
+	const scope = {
+		namespace,
+		orgId: input.orgId,
+		projectId: input.projectId,
+		envId: input.envId
+	};
+	const key = await sha256HexUtf8(JSON.stringify([input.apiKeyId, input.sourceIp]));
+	const now = Date.now();
+	const results = await database.batch([database.prepare(`DELETE FROM registration_setup_rate_limits WHERE rowid IN (
+      SELECT rowid FROM registration_setup_rate_limits WHERE reset_at_ms <= ? LIMIT 100
+    )`).bind(now), prepareD1TenantStatement(database, scope, `INSERT INTO registration_setup_rate_limits
+      (namespace, org_id, project_id, env_id, rate_key, consumed_count, reset_at_ms)
+      VALUES (?1, ?2, ?3, ?4, ?5, 1, ?7)
+      ON CONFLICT (namespace, org_id, project_id, env_id, rate_key) DO UPDATE SET
+        consumed_count = CASE WHEN reset_at_ms <= ?6 THEN 1 ELSE consumed_count + 1 END,
+        reset_at_ms = CASE WHEN reset_at_ms <= ?6 THEN ?7 ELSE reset_at_ms END
+      WHERE reset_at_ms <= ?6 OR consumed_count < 30
+      RETURNING consumed_count`, [
+		key,
+		now,
+		now + 6e4
+	])]);
+	if (results.length !== 2 || !results[0].success || !results[1].success) throw new Error("Registration setup rate limit is unavailable");
+	return { allowed: results[1].results?.length === 1 };
+}
+//#endregion
+export { consumeRegistrationSetupRateLimit };
+
+//# sourceMappingURL=d1RegistrationSetupRateLimit.js.map

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationCommitStore.js

@@ -1,4 +1,4 @@
-import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
+import { mpcMaterialActivationRefsEqual, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { parseWalletAuthMethodRecordV2, sameWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
@@ -11,8 +11,8 @@ import { prepareD1WebAuthnCredentialBindingPutStatement } from "../../../../core
 import { prepareD1WebAuthnAuthenticatorPutStatement } from "../webauthn/d1WebAuthnStore.js";
 import { prepareD1WalletSessionAuthorityProjectionStatements } from "../authorization/walletSessionAuthorityProjection.js";
 import { prepareD1WalletAuthorityExtensionCasGuard, prepareD1WalletAuthorityExtensionStatement, prepareD1WalletAuthorityPutStatement } from "../wallet/d1WalletAuthorityStore.js";
-import { createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1 } from "../ed25519Yao/d1Ed25519YaoProductRegistrationPartitionedStateStore.js";
-import { commitRouterAbEd25519YaoRegistrationCapability } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoCapabilityCommit.js";
+import { lifecycleWriteFenceStatements } from "../ed25519Yao/d1Ed25519YaoStateWriteFence.js";
+import { validateRouterAbEd25519YaoRegistrationCapability } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoCapabilityCommit.js";
 //#region src/router/cloudflare/d1/registration/d1WalletRegistrationCommitStore.ts
 function requireScopeString(value, field) {
 	const normalized = normalizeOptionalTrimmedString(value);
@@ -261,14 +261,12 @@ var CloudflareD1WalletRegistrationCommitStore = class {
 	}
 	async commit(authority, input, executeBatch) {
 		assertCommitWalletIdentity(input, authority);
+		const fenced = [];
 		const ed25519Signer = input.walletSigners.find(isEd25519Signer);
 		if (ed25519Signer) {
 			const capability = ed25519Signer.activeYaoCapability;
 			if (capability.version !== "wallet_ed25519_yao_registration_capability_v1") throw new Error("A registration commit requires its registration capability");
-			const installed = await commitRouterAbEd25519YaoRegistrationCapability(createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1({
-				database: this.database,
-				scope: this.scope
-			}), {
+			const validated = validateRouterAbEd25519YaoRegistrationCapability({
 				kind: "router_ab_ed25519_yao_registration_finalize_capability_v1",
 				activeCapabilityBinding: capability.activeCapabilityBinding,
 				nearAccountId: capability.nearAccountId,
@@ -276,11 +274,17 @@ var CloudflareD1WalletRegistrationCommitStore = class {
 				registrationAdmissionReceipt: capability.admissionReceipt,
 				registrationResult: capability.activationResult,
 				runtimePolicyScope: capability.runtimePolicyScope
-			}, prepareWalletWrite(this.database, this.scope, authority, input, executeBatch));
-			if (!installed.ok) throw new Error(installed.message);
-			return;
+			});
+			if (!validated.ok) throw new Error(validated.message);
+			const capabilityWallet = parseWalletId(capability.admissionRequest.application_binding.wallet_id);
+			if (!capabilityWallet.ok) throw new Error("Lifecycle wallet owner is invalid");
+			fenced.push(...lifecycleWriteFenceStatements({
+				database: this.database,
+				scope: this.scope
+			}, new Set([capabilityWallet.value, input.wallet.walletId])));
 		}
-		const { statements } = await prepareWalletWrite(this.database, this.scope, authority, input);
+		const prepared = await prepareWalletWrite(this.database, this.scope, authority, input);
+		const statements = [...fenced, ...prepared.statements];
 		const results = executeBatch ? await executeBatch(statements) : await this.database.batch(statements);
 		assertBatchSucceeded({
 			expectedStatementCount: statements.length,
@@ -288,7 +292,7 @@ var CloudflareD1WalletRegistrationCommitStore = class {
 		});
 	}
 };
-async function prepareWalletWrite(database, scope, authority, input, executeBatch) {
+async function prepareWalletWrite(database, scope, authority, input) {
 	const foundingStatements = await prepareFoundingStatements({
 		database,
 		scope,
@@ -316,10 +320,7 @@ async function prepareWalletWrite(database, scope, authority, input, executeBatc
 		foundingStatements,
 		now: input.now
 	}), ...emailOtpCommitStatements(input), ...input.decisionStatements);
-	return {
-		statements,
-		executeBatch
-	};
+	return { statements };
 }
 function isEd25519Signer(signer) {
 	return signer.version === "wallet_signer_ed25519_v1";

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationService.js

@@ -25,12 +25,14 @@ import "../../../../shared-ts/src/passkey-custody/index.js";
 import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../../shared-ts/src/utils/near.js";
 import { registrationNearEd25519BranchKey } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
 import { registrationIntentGrantFromString } from "../../../../shared-ts/src/utils/registrationIntent.js";
+import { createRouterAbTraceContextV1 } from "../../../../shared-ts/src/utils/routerAbTraceContext.js";
 import { buildTenantRootIdentityFromAuthenticatedDeploymentV1 } from "../../../../shared-ts/src/tenant-root/tenantRootIdentity.js";
 import { DEFAULT_WALLET_SESSION_TTL_MS } from "../../../../shared-ts/src/threshold/sessionPolicy.js";
 import { parseEcdsaDerivationPublicIdentity, thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
 import { walletAuthAuthorityFromRegistrationAuthority, walletRegistrationFinalizeAuthMethodFromAuthority } from "../wallet/d1WalletAuthMethodBoundary.js";
 import { buildRouterAbEd25519YaoRegistrationCapabilityRecordV1 } from "../../../domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery.js";
-import { buildRouterAbEd25519YaoProductAdmissionRequestV1, createRouterAbEd25519YaoMaterialActivationRefV1, projectRouterAbEd25519YaoExactWalletSession } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js";
+import { buildRouterAbEd25519YaoProductAdmissionRequestV1, projectRouterAbEd25519YaoExactWalletSession } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js";
+import { routerAbEd25519YaoRegistrationExecutionTimingEntriesV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationRequestScopedCloudflare.js";
 import { runRouterAbEd25519YaoRegistrationSideEffectV2, throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
 import { buildYaoEd25519WalletSignerRecord, ed25519NearPublicKeyFromBytes, implicitNearAccountIdFromEd25519PublicKeyBytes } from "../ed25519Yao/d1Ed25519YaoWalletSigner.js";
 import { buildStoredWalletRegistrationEvmFamilyEcdsaFinalizedBranch, buildStoredWalletRegistrationNearEd25519YaoAuthorizedBranch, findStoredWalletRegistrationEvmFamilyEcdsaBranch, findStoredWalletRegistrationNearEd25519YaoBranch, replaceStoredWalletRegistrationSignerBranch, storedRegistrationAuthoritiesMatch, verifiedRegistrationCeremonyAuthority } from "../../../../core/RegistrationCeremonyStore.js";
@@ -51,7 +53,9 @@ import { commitWalletRegistration } from "./d1WalletRegistrationInitialSession.j
 import { storedRespondEd25519DeferredWork, walletRegistrationRespondResult } from "./d1WalletRegistrationSetup.js";
 import { executeD1WalletRegistrationSetup } from "./d1WalletRegistrationSetupExecution.js";
 //#region src/router/cloudflare/d1/registration/d1WalletRegistrationService.ts
+/** The admission request of a NEAR branch, over the identity that setup minted. */
 async function buildRespondEd25519AdmissionRequest(input) {
+	const mint = requireRegistrationEd25519YaoMint(input.ceremony);
 	return buildRouterAbEd25519YaoProductAdmissionRequestV1({
 		registrationCeremonyId: input.ceremony.registrationCeremonyId,
 		walletId: input.ceremony.intent.walletId,
@@ -60,12 +64,16 @@ async function buildRespondEd25519AdmissionRequest(input) {
 		authorityScope: registrationEd25519AuthorityScopeFromAuthority(input.authority),
 		branch: input.branch,
 		signingWorkerId: input.signingWorkerId,
-		materialActivation: createRouterAbEd25519YaoMaterialActivationRefV1({
-			walletId: input.ceremony.intent.walletId,
-			signingWorkerId: input.signingWorkerId
-		})
+		materialActivation: mint.materialActivation
 	});
 }
+function ignoreRespondExecutionFailure() {
+	return null;
+}
+function requireRegistrationEd25519YaoMint(ceremony) {
+	if (!ceremony.ed25519YaoMint) throw new Error("Registration ceremony has no NEAR branch identity");
+	return ceremony.ed25519YaoMint;
+}
 function sameEd25519ParticipantIds(left, right) {
 	return left[0] === right[0] && left[1] === right[1];
 }
@@ -122,24 +130,6 @@ function linkedEcdsaProjectionMatchesSigner(projection, signer) {
 function sameLinkedEcdsaResolvedSignerIdentity(left, right) {
 	return left.walletId === right.walletId && left.walletKey.keyHandle === right.walletKey.keyHandle && left.walletKey.relayerKeyId === right.walletKey.relayerKeyId && left.walletKey.participantIds[0] === right.walletKey.participantIds[0] && left.walletKey.participantIds[1] === right.walletKey.participantIds[1] && sameRouterAbEcdsaDerivationPublicCapabilityV1(left.walletKey.publicCapability, right.walletKey.publicCapability) && sameWalletRuntimePolicyScope(left.runtimePolicyScope, right.runtimePolicyScope);
 }
-async function ed25519ExportIdentityFromActiveCapability(descriptor) {
-	return {
-		scope: {
-			lifecycle_id: descriptor.lifecycle.lifecycleId,
-			root_share_epoch: descriptor.lifecycle.rootShareEpoch,
-			account_id: descriptor.lifecycle.accountId,
-			threshold_session_id: descriptor.lifecycle.thresholdSessionId,
-			signer_set_id: descriptor.lifecycle.signerSetId,
-			signing_worker_id: descriptor.lifecycle.signingWorkerId,
-			material_activation: descriptor.materialActivation
-		},
-		application_binding: descriptor.applicationBinding,
-		participant_ids: descriptor.participantIds,
-		registered_public_key: descriptor.registeredPublicKey,
-		state_epoch: descriptor.stateEpoch,
-		runtime_policy_binding: await deriveRouterAbEd25519YaoRuntimePolicyBindingV1(descriptor.runtimePolicyScope)
-	};
-}
 async function ed25519ExportIdentityFromPersistedCapability(capability) {
 	const binding = capability.activationResult.binding;
 	return {
@@ -939,45 +929,12 @@ var CloudflareD1WalletRegistrationService = class {
 					exportIdentity: await ed25519ExportIdentityFromLinkedProjection(projection, active.capability)
 				};
 			}
-			const lookup = {
-				kind: "router_ab_ed25519_yao_active_capability_lookup_v1",
-				walletId: input.walletId,
-				nearEd25519SigningKeyId: signer.nearEd25519SigningKeyId,
-				signerSlot: signer.signerSlot,
-				signingWorkerId: signer.signingWorkerId,
-				participantIds: signer.participantIds
-			};
-			const active = input.signerRead?.resolveActiveCapability(lookup) ?? await yaoRuntime.resolveActiveCapability(lookup);
-			if (!active.ok) {
-				if (active.code === "unknown_capability") {
-					if (!sameRouterAbMpcMaterialActivationRef(signer.activeYaoCapability.activationResult.binding.material_activation, input.materialActivation)) return {
-						ok: false,
-						code: "not_found",
-						message: "Ed25519 material activation does not match the persisted capability"
-					};
-					return await activeEd25519MaterialFromPersistedSigner(signer);
-				}
-				return {
-					ok: false,
-					code: "internal",
-					message: active.message
-				};
-			}
-			if (!sameRouterAbMpcMaterialActivationRef(active.capability.materialActivation, input.materialActivation)) return {
+			if (!sameRouterAbMpcMaterialActivationRef(signer.activeYaoCapability.activationResult.binding.material_activation, input.materialActivation)) return {
 				ok: false,
 				code: "not_found",
-				message: "Ed25519 material activation does not match the active capability"
-			};
-			return {
-				ok: true,
-				materialActivation: active.capability.materialActivation,
-				nearAccountId: active.capability.nearAccountId,
-				signerSlot: signer.signerSlot,
-				signingWorkerId: signer.signingWorkerId,
-				participantIds: signer.participantIds,
-				runtimePolicyScope: active.capability.runtimePolicyScope,
-				exportIdentity: await ed25519ExportIdentityFromActiveCapability(active.capability)
+				message: "Ed25519 material activation does not match the persisted capability"
 			};
+			return await activeEd25519MaterialFromPersistedSigner(signer);
 		} catch (error) {
 			return {
 				ok: false,
@@ -1588,6 +1545,7 @@ var CloudflareD1WalletRegistrationService = class {
 			reservation: this.registrationAuthority,
 			store: this.getRegistrationCeremonyIntentStore(),
 			ecdsaStrictRegistration: this.ecdsaStrictRegistration,
+			ed25519Yao: this.getEd25519YaoProductRegistration(),
 			startRegistrationWallets: this.startRegistrationWallets
 		});
 	}
@@ -1768,8 +1726,16 @@ var CloudflareD1WalletRegistrationService = class {
 				startedDispatchRoot,
 				expectedOrigin,
 				waitUntil,
+				ed25519Execution: input.ed25519Execution ?? null,
+				traceContext: traceContext ?? null,
+				serverTiming,
 				...input.userAgent ? { userAgent: input.userAgent } : {}
 			});
+			if (input.ed25519Execution) return {
+				ok: false,
+				code: "invalid_body",
+				message: "only an Ed25519-only respond carries its Yao execution"
+			};
 			if (!ecdsaBranch) return {
 				ok: false,
 				code: "invalid_state",
@@ -2641,7 +2607,7 @@ var CloudflareD1WalletRegistrationService = class {
 		}, stored ? null : (bound) => ceremonyStore.prepareEcdsaClaimCommit({
 			expected: input.snapshot,
 			next: authorizedCeremony(bound)
-		}), input.startedDispatchRoot);
+		}), input.startedDispatchRoot, requireRegistrationEd25519YaoMint(ceremony).sessionId);
 		if (!admitted.ok) return {
 			ok: false,
 			code: admitted.code,
@@ -2661,14 +2627,28 @@ var CloudflareD1WalletRegistrationService = class {
 				reason: errorMessage(error)
 			});
 		}));
+		const admission = {
+			admissionRequest: admitted.admissionRequest,
+			admissionReceipt: admitted.value
+		};
+		const execution = input.ed25519Execution ? await runtime.executeAdmittedRegistration({
+			request: input.ed25519Execution,
+			credential: input.registrationBearerToken,
+			trace: input.traceContext ?? createRouterAbTraceContextV1()
+		}).catch(ignoreRespondExecutionFailure) : null;
+		if (execution) input.serverTiming.push(...routerAbEd25519YaoRegistrationExecutionTimingEntriesV1(execution.timing));
+		const executed = execution?.result ?? null;
 		return {
 			ok: true,
 			registrationCeremonyId: ceremony.registrationCeremonyId,
 			kind: "near_ed25519",
-			ed25519: {
+			ed25519: executed?.ok ? {
+				status: "executed",
+				...admission,
+				activationResult: executed.value
+			} : {
 				status: "admitted",
-				admissionRequest: admitted.admissionRequest,
-				admissionReceipt: admitted.value
+				...admission
 			}
 		};
 	}
@@ -2696,14 +2676,14 @@ var CloudflareD1WalletRegistrationService = class {
 			authority: input.authority,
 			signingWorkerId: yaoRuntime.signingWorkerId
 		});
-		const admitted = await yaoRuntime.bindVerifiedIntent({
+		const admitted = await yaoRuntime.bindAndAdmitVerifiedRegistration({
 			kind: "verified_registration_intent",
 			ownershipGeneration: input.ownershipGeneration,
 			registrationIntentGrant: registrationIntentGrantFromString(input.registrationBearerToken),
 			intent: input.ceremony.intent,
 			admissionRequest,
 			expiresAtMs: input.ceremony.expiresAtMs
-		});
+		}, null, null, requireRegistrationEd25519YaoMint(input.ceremony).sessionId);
 		if (!admitted.ok) return {
 			ok: false,
 			code: admitted.code,

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationSetupExecution.js

@@ -1,11 +1,12 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { deriveSigningRootId } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { registrationPreparationIdFromString } from "../../../../core/types.js";
+import { buildRouterAbEd25519YaoProductAdmissionRequestV1, mintRouterAbEd25519YaoRegistrationIdentityV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js";
 import { buildStoredWalletRegistrationEvmFamilyEcdsaPreparedBranch, findStoredWalletRegistrationEvmFamilyEcdsaBranch } from "../../../../core/RegistrationCeremonyStore.js";
 import { routerAbEcdsaStrictRegistrationFactsBindingJson } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
 import { buildRegistrationIntent, inferRuntimePolicyScopeFromSigningRoot } from "./d1RegistrationCeremonyRecords.js";
 import { isTransientD1Error } from "../../../../storage/d1Retry.js";
-import { errorMessage, registrationIntentSignerBranches, registrationPreparedContextEcdsaChainTargets, resolveRegistrationPreparedContextFromPlan } from "./d1RegistrationSetupSupport.js";
+import { errorMessage, registrationIntentSignerBranches, registrationPreparedContextEcdsaChainTargets, registrationSignerBranchesFromPlan, resolveRegistrationPreparedContextFromPlan } from "./d1RegistrationSetupSupport.js";
 import { buildWalletRegistrationSetupSignature, normalizeWalletRegistrationSetupRequest, walletRegistrationSetupError, walletRegistrationSetupExpiresAtMs, walletRegistrationSetupIntentDigest } from "./d1WalletRegistrationSetup.js";
 import { buildD1EvmFamilyEcdsaRegistrationPrepare } from "./d1EvmFamilyEcdsaRegistrationBranch.js";
 //#region src/router/cloudflare/d1/registration/d1WalletRegistrationSetupExecution.ts
@@ -22,17 +23,48 @@ async function executeD1WalletRegistrationSetup(input, dependencies) {
 		const expiresAtMs = walletRegistrationSetupExpiresAtMs(reservation.reservedAtMs);
 		if (Date.now() >= expiresAtMs) return walletRegistrationSetupError("registration_expired", "Registration setup has expired");
 		const [startup, setup] = await Promise.allSettled([dependencies.startRegistrationWallets?.({
+			kind: "objects",
 			walletId: wallet.walletId,
 			ownershipGeneration: admitted.ownershipGeneration
 		}), completeReservedRegistrationSetup(input, dependencies, admitted, normalized, expiresAtMs)]);
 		if (setup.status === "rejected") throw setup.reason;
 		if (!setup.value.ok) return setup.value;
 		if (startup.status === "rejected") throw startup.reason;
+		if (dependencies.startRegistrationWallets) try {
+			const preparation = await describeCommittedSetupPair(setup.value, dependencies);
+			if (preparation.status === "described") await dependencies.startRegistrationWallets({
+				kind: "pair",
+				walletId: wallet.walletId,
+				ownershipGeneration: admitted.ownershipGeneration,
+				admissionRequest: preparation.admissionRequest,
+				admissionReceipt: preparation.admissionReceipt,
+				expiresAtMs
+			});
+		} catch {
+			console.warn("[wallet-registration] pair preparation unavailable");
+		}
 		return setup.value;
 	} catch (error) {
 		return walletRegistrationSetupError(isTransientD1Error(error) ? "storage_unavailable" : "internal", errorMessage(error) || "Failed to set up wallet registration");
 	}
 }
+async function describeCommittedSetupPair(response, dependencies) {
+	switch (response.kind) {
+		case "near_ed25519": return response.ed25519;
+		case "evm_family_ecdsa": return { status: "after_proof" };
+		case "near_ed25519_and_evm_family_ecdsa": {
+			const ceremony = await dependencies.store.getSetupCeremony(response.registrationCeremonyId);
+			if (!ceremony) throw new Error("Committed mixed registration ceremony is missing");
+			const branches = registrationSignerBranchesFromPlan(ceremony.signerPlan);
+			if (!branches.nearEd25519) throw new Error("Mixed registration has no NEAR branch");
+			return describeSetupEd25519Admission(dependencies.ed25519Yao, ceremony, branches.nearEd25519);
+		}
+		default: return assertNeverSetupResponse(response);
+	}
+}
+function assertNeverSetupResponse(value) {
+	throw new Error(`Unexpected registration setup response: ${String(value)}`);
+}
 async function completeReservedRegistrationSetup(input, dependencies, admitted, normalized, expiresAtMs) {
 	const reservation = admitted.reservation;
 	const wallet = { walletId: reservation.walletId };
@@ -62,12 +94,13 @@ async function completeReservedRegistrationSetup(input, dependencies, admitted,
 	if (existing) {
 		if (existing.digestB64u !== digestB64u || existing.expectedOrigin !== input.expectedOrigin || existing.foundingWalletAuthorityId !== reservation.walletAuthorityId || existing.foundingDeviceId !== reservation.deviceId || existing.foundingWalletAuthMethodId !== reservation.walletAuthMethodId || existing.expiresAtMs !== expiresAtMs) return walletRegistrationSetupError("reservation_conflict", "Registration setup conflicts with its reservation");
 		if (admitted.lifecycle === "reserved") await dependencies.store.reserveSetupCeremony(existing, admitted.ownershipGeneration);
-		return await setupResponseFromCeremony(input, dependencies.home, existing);
+		return await setupResponseFromCeremony(input, dependencies, existing);
 	}
 	if (admitted.lifecycle === "established") return walletRegistrationSetupError("registration_closed", "Completed registration setup snapshot is unavailable");
 	const ecdsaBranch = branches.value.evmFamilyEcdsa;
 	const nearEd25519Branch = branches.value.nearEd25519;
 	if (!ecdsaBranch && !nearEd25519Branch) return walletRegistrationSetupError("invalid_body", "registration signer branch is required");
+	if (nearEd25519Branch && !dependencies.ed25519Yao) return walletRegistrationSetupError("not_configured", "Ed25519 Yao registration is unavailable");
 	const preparedContext = resolveRegistrationPreparedContextFromPlan({
 		signerPlan: branches.value.plan,
 		runtimePolicyScope,
@@ -120,15 +153,70 @@ async function completeReservedRegistrationSetup(input, dependencies, admitted,
 			kind: "awaiting_proof",
 			authMethod: normalized.authMethod
 		},
+		ed25519YaoMint: nearEd25519Branch && dependencies.ed25519Yao ? mintRouterAbEd25519YaoRegistrationIdentityV1({
+			walletId: wallet.walletId,
+			signingWorkerId: dependencies.ed25519Yao.signingWorkerId
+		}) : null,
 		signerState: {
 			kind: "signer_set_registration",
 			branches: storedBranches
 		}
 	};
-	const stored = await dependencies.store.reserveSetupCeremony(ceremony, admitted.ownershipGeneration);
-	return await setupResponseFromCeremony(input, dependencies.home, stored);
+	return await setupResponseFromCeremony(input, dependencies, await dependencies.store.reserveSetupCeremony(ceremony, admitted.ownershipGeneration));
+}
+/**
+* The admission that respond will issue for a passkey plan with a NEAR branch.
+* It follows from the stored ceremony alone, so a setup retry describes the
+* same admission. A failure to describe it withholds the description and
+* nothing else: respond then issues the admission as its first word on it.
+*/
+async function describeSetupEd25519Admission(ed25519Yao, ceremony, branch) {
+	const authMethod = ceremony.intent.authMethod;
+	const mint = ceremony.ed25519YaoMint;
+	const signingRootId = normalizeOptionalTrimmedString(ceremony.signingRootId);
+	const signingRootVersion = normalizeOptionalTrimmedString(ceremony.signingRootVersion);
+	if (authMethod.kind !== "passkey" || !ed25519Yao || !mint || !signingRootId || !signingRootVersion) return { status: "after_proof" };
+	return await describedEd25519Admission({
+		ed25519Yao,
+		ceremony,
+		branch,
+		rpId: authMethod.rpId,
+		mint,
+		signingRootId,
+		signingRootVersion
+	}).catch(withholdEd25519AdmissionDescription) ?? { status: "after_proof" };
+}
+/**
+* Every step that can fail is inside this one promise, so the caller's single
+* catch covers the request as well as the receipt. A wallet id that cannot
+* hold the branch's signing key fails here, and respond reports it as before.
+*/
+async function describedEd25519Admission(input) {
+	const admissionRequest = await buildRouterAbEd25519YaoProductAdmissionRequestV1({
+		registrationCeremonyId: input.ceremony.registrationCeremonyId,
+		walletId: input.ceremony.intent.walletId,
+		signingRootId: input.signingRootId,
+		signingRootVersion: input.signingRootVersion,
+		authorityScope: {
+			kind: "passkey",
+			rpId: input.rpId
+		},
+		branch: input.branch,
+		signingWorkerId: input.ed25519Yao.signingWorkerId,
+		materialActivation: input.mint.materialActivation
+	});
+	const described = await input.ed25519Yao.describeRegistrationAdmission(admissionRequest, input.mint.sessionId);
+	return described.ok ? {
+		status: "described",
+		admissionRequest,
+		admissionReceipt: described.value
+	} : null;
 }
-async function setupResponseFromCeremony(input, home, ceremony) {
+function withholdEd25519AdmissionDescription() {
+	return null;
+}
+async function setupResponseFromCeremony(input, dependencies, ceremony) {
+	const home = dependencies.home;
 	const { signedSetup } = await buildWalletRegistrationSetupSignature({
 		signer: input.signer,
 		ceremony,
@@ -146,10 +234,14 @@ async function setupResponseFromCeremony(input, home, ceremony) {
 		intent: ceremony.intent,
 		signedSetup
 	};
-	if (!branches.value.evmFamilyEcdsa) return {
-		...success,
-		kind: "near_ed25519"
-	};
+	if (!branches.value.evmFamilyEcdsa) {
+		if (!branches.value.nearEd25519) return walletRegistrationSetupError("invalid_state", "Registration setup has no signer");
+		return {
+			...success,
+			kind: "near_ed25519",
+			ed25519: await describeSetupEd25519Admission(dependencies.ed25519Yao, ceremony, branches.value.nearEd25519)
+		};
+	}
 	if (ceremony.signerState.kind !== "signer_set_registration") return walletRegistrationSetupError("invalid_state", "Registration setup signer state is invalid");
 	const ecdsa = findStoredWalletRegistrationEvmFamilyEcdsaBranch(ceremony.signerState);
 	if (!ecdsa || ecdsa.kind !== "evm_family_ecdsa_prepared") return walletRegistrationSetupError("invalid_state", "Registration setup snapshot is not prepared");

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAddSignerService.js

@@ -14,9 +14,9 @@ import { buildWalletEcdsaSignerActivationV1, extendEd25519WalletAuthorityWithEcd
 import { registrationPreparationIdFromString } from "../../../../core/types.js";
 import { addSignerIntentGrantFromString, computeAddSignerIntentDigestB64u, sameAddSignerIntentV1 } from "../../../../shared-ts/src/utils/registrationIntent.js";
 import { buildTenantRootIdentityFromAuthenticatedDeploymentV1 } from "../../../../shared-ts/src/tenant-root/tenantRootIdentity.js";
+import { WalletAuthorityCommitConflictError } from "./d1WalletAuthorityStore.js";
 import { buildRouterAbEd25519YaoRegistrationCapabilityRecordV1 } from "../../../domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery.js";
 import { buildRouterAbEd25519YaoAddSignerAdmissionRequestV1, createRouterAbEd25519YaoMaterialActivationRefV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js";
-import { WalletAuthorityCommitConflictError } from "./d1WalletAuthorityStore.js";
 import { parseRouterAbEd25519YaoRegistrationSideEffectRecordV1, runRouterAbEd25519YaoRegistrationSideEffectV1, throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
 import { buildYaoEd25519WalletSignerRecord, ed25519NearPublicKeyFromBytes, implicitNearAccountIdFromEd25519PublicKeyBytes } from "../ed25519Yao/d1Ed25519YaoWalletSigner.js";
 import { routerAbEcdsaStrictRegistrationRequestMatchesFacts } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";

package/dist/esm/router/cloudflare/runtime/walletGateway.js

@@ -3,6 +3,7 @@ import { createRouterAbNormalSigningAdmissionAdapter } from "../../domains/signi
 import { createCloudflareD1RouterAbNormalSigningAdmissionStore } from "../d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.js";
 import { WALLET_CONSOLE_SERVICE_ORIGIN_V1 } from "./walletConsoleOps.js";
 import { createWalletConsoleOpsClient } from "./walletConsoleOpsClient.js";
+import { consumeRegistrationSetupRateLimit } from "../d1/registration/d1RegistrationSetupRateLimit.js";
 import { createCloudflareRouter } from "./createCloudflareRouter.js";
 //#region src/router/cloudflare/runtime/walletGateway.ts
 const WALLET_CONSOLE_API_WALLET_DETAIL_PREFIX_V1 = "/v1/wallets/";
@@ -137,6 +138,7 @@ function createCloudflareWalletGatewayRouterV1(input) {
 		apiKeyAuth: consoleOps.apiKeyAuth,
 		publishableKeyAuth: consoleOps.publishableKeyAuth,
 		registrationContext: input.registrationContext ?? consoleOps.registrationContext,
+		registrationSetupRateLimit: consumeRegistrationSetupRateLimit.bind(void 0, input.signerDatabase, input.signerStorageNamespace),
 		apiKeyUsageMeter: consoleOps.usageMeter,
 		orgProjectEnv: consoleOps.projectEnvironments,
 		routerAbNormalSigningAdmission: createRouterAbNormalSigningAdmissionAdapter(admissionStore),

package/dist/esm/router/cloudflare-adaptor.js

@@ -20,25 +20,25 @@ import { readEnvironmentCsv, readEnvironmentString, requireEnvironmentString } f
 import { createStaticWalletConsoleBindingV1, handleStaticWalletConsoleRequestV1, parseStaticWalletConsoleBindingConfigV1 } from "./cloudflare/runtime/staticWalletConsoleBinding.js";
 import { CloudflareD1WebAuthnStore } from "./cloudflare/d1/webauthn/d1WebAuthnStore.js";
 import { CloudflareD1WebAuthnAuthService } from "./cloudflare/d1/webauthn/d1WebAuthnAuthService.js";
+import { CloudflareD1AuthorizationStore } from "./cloudflare/d1/authorization/d1AuthorizationStore.js";
+import { CloudflareD1VaultProxyStore } from "./cloudflare/d1/authorization/d1VaultProxyStore.js";
 import { InMemoryRouterAbEd25519YaoRegistrationService, createRouterAbEd25519YaoRegistrationModule } from "./domains/ed25519Yao/registration/routerAbEd25519YaoRegistration.js";
 import { InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter } from "./domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationIntentAuthorization.js";
 import { buildRouterAbEd25519YaoProductAdmissionRequestV1, createRouterAbEd25519YaoProductRegistrationCompositionFromPortsV1, createRouterAbEd25519YaoProductRegistrationRuntimeV1, createRouterAbEd25519YaoProductRegistrationStateV1 } from "./domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js";
-import { createRouterAbEd25519YaoCeremonyStateStoreV1, encodeRouterAbEd25519YaoProductRegistrationStateV1, parseRouterAbEd25519YaoCeremonyKeyV1, parseRouterAbEd25519YaoProductRegistrationStateJsonV1, resolveRouterAbEd25519YaoCeremonyKeyFromRequestV1 } from "./domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPersistence.js";
-import { mergeRouterAbEd25519YaoProductRegistrationStatePartitionV1, partitionRouterAbEd25519YaoProductRegistrationStateV1 } from "./domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitioning.js";
-import { ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1 } from "./domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore.js";
-import { CloudflareD1AuthorizationStore } from "./cloudflare/d1/authorization/d1AuthorizationStore.js";
-import { CloudflareD1VaultProxyStore } from "./cloudflare/d1/authorization/d1VaultProxyStore.js";
 import { RouterAbEd25519YaoHttpRegistrationBackend, createRouterAbEd25519YaoHttpRegistrationBackendFromEnv } from "./domains/ed25519Yao/registration/routerAbEd25519YaoHttpRegistrationBackend.js";
 import { StaticCloudflareTenantStorageRouteResolver, createCloudflareTenantStorageRoute, createSignerD1DoStorageTarget, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings } from "../storage/tenantRoute.js";
 import { createInMemoryRouterApiRuntimeSnapshotConsumer, validateRuntimeSnapshotExpectation } from "./framework/runtimeSnapshotConsumer.js";
 import { createSelfHostedCloudflareSigningRouter, createSelfHostedCloudflareSigningWorker } from "./cloudflare/runtime/createSelfHostedCloudflareSigningWorker.js";
 import { CloudflareDurableObjectVersionedJsonRecordStore, CloudflareVersionedJsonRecordStoreError, createCloudflareDurableObjectVersionedJsonRecordStore } from "./cloudflare/durableObjects/versionedJsonRecordStore.js";
 import { CloudflareD1VersionedJsonRecordStore, CloudflareD1VersionedJsonRecordStoreError, createCloudflareD1VersionedJsonRecordStore } from "./cloudflare/d1/versionedJson/d1VersionedJsonRecordStore.js";
+import { createRouterAbEd25519YaoCeremonyStateStoreV1, encodeRouterAbEd25519YaoProductRegistrationStateV1, parseRouterAbEd25519YaoCeremonyKeyV1, parseRouterAbEd25519YaoProductRegistrationStateJsonV1, resolveRouterAbEd25519YaoCeremonyKeyFromRequestV1 } from "./domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPersistence.js";
+import { mergeRouterAbEd25519YaoProductRegistrationStatePartitionV1, partitionRouterAbEd25519YaoProductRegistrationStateV1 } from "./domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitioning.js";
+import { ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1 } from "./domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore.js";
 import { createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1 } from "./cloudflare/d1/ed25519Yao/d1Ed25519YaoProductRegistrationPartitionedStateStore.js";
 import { runRouterAbEd25519YaoProductRegistrationRequestScopedV1 } from "./domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationRequestScopedRunner.js";
+import { runRouterAbEd25519YaoRegistrationTwoPhaseV1 } from "./domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationTwoPhaseRunner.js";
+import { handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1 } from "./domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationRequestScopedCloudflare.js";
 import { createRouterAbEd25519YaoProductRegistrationRequestScopedRuntimeV1 } from "./domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationRequestScopedRuntime.js";
 import { runRouterAbEd25519YaoRegistrationSideEffectV1 } from "./domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
-import { runRouterAbEd25519YaoRegistrationTwoPhaseV1 } from "./domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationTwoPhaseRunner.js";
 import { CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1, CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1, createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1, createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1 } from "./cloudflare/signingLanes/cloudflareOrdinaryInactiveSignerMaterialReservation.js";
-import { handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1 } from "./domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationRequestScopedCloudflare.js";
 export { CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, CloudflareD1AuthorizationStore, CloudflareD1RouterAbNormalSigningAdmissionStore, CloudflareD1VaultProxyStore, CloudflareD1VersionedJsonRecordStore, CloudflareD1VersionedJsonRecordStoreError, CloudflareD1WebAuthnAuthService, CloudflareD1WebAuthnStore, CloudflareDurableObjectVersionedJsonRecordStore, CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1, CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1, CloudflareVersionedJsonRecordStoreError, DEFAULT_WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_V1, DEFAULT_WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_V1, InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter, InMemoryRouterAbEd25519YaoRegistrationService, InMemoryRouterAbNormalSigningAdmissionStore, ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1, ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, RouterAbEd25519YaoHttpRegistrationBackend, StaticCloudflareTenantStorageRouteResolver, UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, WALLET_CONSOLE_API_WALLET_DETAIL_PREFIX_V1, WALLET_CONSOLE_OPS_BASE_PATH_V1, WALLET_CONSOLE_OP_PATHS_V1, WALLET_CONSOLE_SERVICE_ORIGIN_V1, WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_ID_V1, WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_ID_V1, WALLET_CONTROL_AUTH_MARKER_V1, WALLET_CONTROL_BASE_PATH_V1, WALLET_CONTROL_SERVICE_ORIGIN_V1, WALLET_RUNTIME_OPS_BASE_PATH_V1, WALLET_RUNTIME_OP_PATHS_V1, WALLET_RUNTIME_SERVICE_ORIGIN_V1, buildRouterAbEd25519YaoProductAdmissionRequestV1, coerceRouterLogger, createCloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1VersionedJsonRecordStore, createCloudflareDurableObjectVersionedJsonRecordStore, createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1, createCloudflareRouter, createCloudflareTenantStorageRoute, createCloudflareWalletGatewayRouterV1, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterApiRuntimeSnapshotConsumer, createRouterAbEd25519YaoCeremonyStateStoreV1, createRouterAbEd25519YaoHttpRegistrationBackendFromEnv, createRouterAbEd25519YaoProductRegistrationCompositionFromPortsV1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, createRouterAbEd25519YaoProductRegistrationRequestScopedRuntimeV1, createRouterAbEd25519YaoProductRegistrationRuntimeV1, createRouterAbEd25519YaoProductRegistrationStateV1, createRouterAbEd25519YaoRegistrationModule, createRouterAbNormalSigningAdmissionAdapter, createRouterApiModule, createSelfHostedCloudflareSigningRouter, createSelfHostedCloudflareSigningWorker, createSignerD1DoStorageTarget, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, createStaticWalletConsoleBindingV1, createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1, createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, createWalletConsoleOpsClient, createWalletConsoleRelayProxyExtensionV1, createWalletControlClientBindings, createWalletRuntimeOpsHandler, decodeWalletConsoleTenantRootActiveLineageRequestV1, decodeWalletConsoleTenantRootActiveLineageResponseV1, defineRoute, encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1, encodeRouterAbEd25519YaoProductRegistrationStateV1, extractBearerCredential, extractRouterApiEnvironmentId, getRouterApiRouteExtensionRoutes, handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1, handleStaticWalletConsoleRequestV1, handleWalletControlRequest, matchesRouteDefinitionRequest, mergeRouterAbEd25519YaoProductRegistrationStatePartitionV1, parseRouterAbEd25519YaoCeremonyKeyV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoProductRegistrationStateJsonV1, parseRouterAbPublicKeysetV2, parseStaticWalletConsoleBindingConfigV1, parseWalletRegistrationContextResponse, parseWalletRuntimeExecuteSignedDelegateRequest, parseWalletRuntimeExecuteSignedDelegateResponse, parseWalletRuntimeExecuteSignedDelegateResult, parseWalletRuntimeRelayerAccount, parseWalletRuntimeWalletIdentitiesResult, parseWalletRuntimeWalletIdentityRequest, partitionRouterAbEd25519YaoProductRegistrationStateV1, randomTenantRootCreationGrantBytesV1, readEnvironmentCsv, readEnvironmentString, requireEnvironmentString, resolveRouterAbEd25519YaoCeremonyKeyFromRequestV1, resolveRuntimeTenantRootLineage, resolveSourceIpFromExpressRequest, resolveSourceIpFromFetchHeaders, runRouterAbEd25519YaoProductRegistrationRequestScopedV1, runRouterAbEd25519YaoRegistrationSideEffectV1, runRouterAbEd25519YaoRegistrationTwoPhaseV1, runRouterAbPrewarmScheduledV1, signTenantRootCreationGrantV1, tenantRootIdentityDigestB64uV1, validateRuntimeSnapshotExpectation, walletConsoleApiWalletGetRouteDefinitionV1, walletConsoleApiWalletListRouteDefinitionV1, walletConsoleApiWalletSearchRouteDefinitionV1, walletConsoleRelayRouteDefinitionsV1, walletConsoleSignedDelegateRouteDefinitionV1, walletConsoleSponsoredEvmCallRouteDefinitionV1 };