@seams/wallet-server 0.20.0 → 0.22.0

package/artifact-manifest.json

@@ -1,18 +1,19 @@
 {
   "schemaVersion": "seams_wallet_server_artifact_manifest_v1",
+  "walletSecurityPolicy": "scoped_seals_and_owner_proofs_v1",
   "package": {
     "name": "@seams/wallet-server",
-    "version": "0.20.0"
+    "version": "0.22.0"
   },
   "workers": {
     "router": {
       "entry": "cloudflare-router-ab/build/router/worker/shim.mjs",
-      "fingerprint": "f49233b4fb230aa6e45e9fe850d61d9bbc29472d9c7cebac48b528c652627e18",
+      "fingerprint": "74fd3407337c12574566cad2d68e834cc62384a0afbeedf74c94820e9151b827",
       "files": [
         {
           "path": "cloudflare-router-ab/build/router/build-stamp.json",
           "bytes": 119,
-          "sha256": "8f2c54ccc6ff47d9581a41dbc44b31cd85a46e06dfbdcb22fe4244f68182a2d3"
+          "sha256": "b32b3d7182ed9c00a4d9677c35604e2ece2607a01032d49956df19a89850660f"
         },
         {
           "path": "cloudflare-router-ab/build/router/index.js",
@@ -21,8 +22,8 @@
         },
         {
           "path": "cloudflare-router-ab/build/router/index_bg.wasm",
-          "bytes": 7105252,
-          "sha256": "b7194f2c339ef9ce9b276b3f9b17cdd9dfc37d101011c8676f785ae5e07c35c9"
+          "bytes": 7109033,
+          "sha256": "a791cedbd5df0cb84c0680c08339f58ebdeb76845759437d81f675cf1d92539a"
         },
         {
           "path": "cloudflare-router-ab/build/router/package.json",
@@ -38,12 +39,12 @@
     },
     "deriver-a": {
       "entry": "cloudflare-router-ab/build/deriver-a/worker/shim.mjs",
-      "fingerprint": "26d51766dedd5f959011d096ea205470f94699f7e7ad9725157b5a2bd0d217e6",
+      "fingerprint": "cd913ea58e44a8f91ec9e8bee6bb06372943e9eb519abb366fbf36bdf5b710fe",
       "files": [
         {
           "path": "cloudflare-router-ab/build/deriver-a/build-stamp.json",
           "bytes": 122,
-          "sha256": "93650745aee0bac07d27a59e20bf858a2c71bc01264ca0f5267fbca032f125ab"
+          "sha256": "747923ca2224aa97fd46d6051dc1085a2e8f4f7da54d3b7190d4b674e6dd3c0a"
         },
         {
           "path": "cloudflare-router-ab/build/deriver-a/index.js",
@@ -52,8 +53,8 @@
         },
         {
           "path": "cloudflare-router-ab/build/deriver-a/index_bg.wasm",
-          "bytes": 11184414,
-          "sha256": "ce0be6d5dbe4dd3e6ce2090f68c21b6dcd348b844d270f4bff413e4d2b10fa53"
+          "bytes": 11184432,
+          "sha256": "5e7510c28ca56ca06022f09f1be153aef591c3bdad52cde837294c2974c220a1"
         },
         {
           "path": "cloudflare-router-ab/build/deriver-a/package.json",
@@ -69,12 +70,12 @@
     },
     "deriver-b": {
       "entry": "cloudflare-router-ab/build/deriver-b/worker/shim.mjs",
-      "fingerprint": "a043319fd7b348529679fe5053b2e7dab1fb511ab5f63e3e517dd51fa7d08822",
+      "fingerprint": "92af4092ea8fe179e5fb1f9f945c51df56d7eedef04e14d6b4d629b1234c5246",
       "files": [
         {
           "path": "cloudflare-router-ab/build/deriver-b/build-stamp.json",
           "bytes": 122,
-          "sha256": "00b08f7e90a221885e4466c3fae1084494a6fa9908ee6ec695c2fd28112dc731"
+          "sha256": "bff31f4d458314d638759bc92209b8ceca4a8eb5529f2380fc99456a5c979ef9"
         },
         {
           "path": "cloudflare-router-ab/build/deriver-b/index.js",
@@ -83,8 +84,8 @@
         },
         {
           "path": "cloudflare-router-ab/build/deriver-b/index_bg.wasm",
-          "bytes": 11217095,
-          "sha256": "edcfad6f13f3777ddcb1e4b4fc3e6ba70c4f8030c76cdfa47504386a5d81ad2f"
+          "bytes": 11217121,
+          "sha256": "275f543ea48ab9e16b781cc76f888b0a5e850d42e4fba5e7f95480de38f7b151"
         },
         {
           "path": "cloudflare-router-ab/build/deriver-b/package.json",
@@ -100,12 +101,12 @@
     },
     "signing-worker": {
       "entry": "cloudflare-router-ab/build/signing-worker/worker/shim.mjs",
-      "fingerprint": "b30f7566b3ba99145995cbf06766b950e0a8eb1617c7ef714cbf5ff16f273a08",
+      "fingerprint": "193f7af99585cabd0d9dc5266bd0df3fc0868869d7f9a91662f163a73f05e735",
       "files": [
         {
           "path": "cloudflare-router-ab/build/signing-worker/build-stamp.json",
           "bytes": 127,
-          "sha256": "75879e99bac1ee3008e9b4acfa85137884bd4a5876e9630135daf266a4abde41"
+          "sha256": "8e4ce1fe79a9cdd6c3679d20f288ea37afeaa7c5b3937df936c0abf424e2c145"
         },
         {
           "path": "cloudflare-router-ab/build/signing-worker/index.js",
@@ -114,8 +115,8 @@
         },
         {
           "path": "cloudflare-router-ab/build/signing-worker/index_bg.wasm",
-          "bytes": 6664587,
-          "sha256": "4be982ddafb0546e2884009c0c53e56eb656441cc24f9fd794be148291b4059a"
+          "bytes": 6778203,
+          "sha256": "878a8ae2a4df685eebf0a5445bc57279183f5683b98abf541f31d40591904dab"
         },
         {
           "path": "cloudflare-router-ab/build/signing-worker/package.json",
@@ -131,12 +132,12 @@
     },
     "tenant-root-control-plane": {
       "entry": "cloudflare-router-ab/build/tenant-root-control-plane/worker/shim.mjs",
-      "fingerprint": "02ef927532ddf330fa6744dbc964f6213020a6bc03e3d16560a1a3b38b9eb756",
+      "fingerprint": "bcbca7dead054e5637575fa5935f819cc1eb8d5b9ac21d80d22e646a8f5941ed",
       "files": [
         {
           "path": "cloudflare-router-ab/build/tenant-root-control-plane/build-stamp.json",
           "bytes": 139,
-          "sha256": "f3ce6924af3f43de8ef76af8fe4c088e69be134627423ba8a090cf7327b4cf79"
+          "sha256": "a8b459e0a878d51fade909dbaa4d825b2195a17af0c2e931c75244eef93121e4"
         },
         {
           "path": "cloudflare-router-ab/build/tenant-root-control-plane/index.js",
@@ -145,8 +146,8 @@
         },
         {
           "path": "cloudflare-router-ab/build/tenant-root-control-plane/index_bg.wasm",
-          "bytes": 2041210,
-          "sha256": "095bd8881fe3fa153bdd35e2de1451c2021f9d4b292d5c59180a2a883af63d9a"
+          "bytes": 2041194,
+          "sha256": "a0aca19c356849e5c4b6ae9d6231130341e48222b258e2c4430cd4fc38450c0a"
         },
         {
           "path": "cloudflare-router-ab/build/tenant-root-control-plane/package.json",

package/cloudflare-router-ab/build/deriver-a/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":true,"features":"strict-worker-deriver-a-entrypoint","started_at_ms":1792679818312}
+{"profile":"release","wallet_objects":true,"features":"strict-worker-deriver-a-entrypoint","started_at_ms":1792904733881}

package/cloudflare-router-ab/build/deriver-b/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":true,"features":"strict-worker-deriver-b-entrypoint","started_at_ms":1792680013063}
+{"profile":"release","wallet_objects":true,"features":"strict-worker-deriver-b-entrypoint","started_at_ms":1792904884404}

package/cloudflare-router-ab/build/router/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":true,"features":"strict-worker-router-entrypoint","started_at_ms":1792680188833}
+{"profile":"release","wallet_objects":true,"features":"strict-worker-router-entrypoint","started_at_ms":1792905019915}

package/cloudflare-router-ab/build/signing-worker/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":true,"features":"strict-worker-signing-worker-entrypoint","started_at_ms":1792679536171}
+{"profile":"release","wallet_objects":true,"features":"strict-worker-signing-worker-entrypoint","started_at_ms":1792904505860}

package/cloudflare-router-ab/build/tenant-root-control-plane/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":false,"features":"strict-worker-tenant-root-control-plane-entrypoint","started_at_ms":1792680386474}
+{"profile":"release","wallet_objects":false,"features":"strict-worker-tenant-root-control-plane-entrypoint","started_at_ms":1792905174415}

package/cloudflare-router-ab/scripts/prepare-local-runtime-config.mjs

@@ -120,8 +120,10 @@ export function prepareLocalHostedWalletGatewayConfig(input) {
     SEAMS_STAGING_ENV_ID: deployment.deployment.environmentId,
     SEAMS_STAGING_ORG_ID: deployment.deployment.orgId,
     SEAMS_STAGING_PROJECT_ID: deployment.deployment.projectId,
-    SIGNING_SESSION_SEAL_ACCEPTED_WARM_KEY_VERSIONS: 'signing-session-seal-local-r2',
-    SIGNING_SESSION_SEAL_CURRENT_KEY_VERSION: 'signing-session-seal-local-r2',
+    EMAIL_OTP_SERVER_SEAL_ACCEPTED_WARM_KEY_VERSIONS:
+      'signing-session-seal-local-r2,signing-session-seal-local-r3',
+    SIGNING_SESSION_SEAL_ACCEPTED_WARM_KEY_VERSIONS: 'signing-session-seal-local-r3',
+    SIGNING_SESSION_SEAL_CURRENT_KEY_VERSION: 'signing-session-seal-local-r3',
     SIGNING_SESSION_SEAL_ROOT_SECRET_B64U: localSecret(internalAuthSecret, 'signing-session-seal'),
     SIGNING_WORKER_ID: requiredEnv(routerEnv, 'SIGNING_WORKER_ID'),
     WALLET_LOCAL_DEPLOYMENT_JSON: JSON.stringify(deployment),
@@ -524,6 +526,18 @@ function applyRoleVars(source, role, env) {
         'SIGNING_WORKER_SERVER_OUTPUT_HPKE_PUBLIC_KEY',
         requiredEnv(env.signingWorkerEnv, 'SIGNING_WORKER_SERVER_OUTPUT_HPKE_PUBLIC_KEY'),
       );
+      config = setTomlSectionAssignment(
+        config,
+        'vars',
+        'TENANT_ROOT_CONTROL_PLANE_ISSUER_VERIFYING_KEYS_JSON',
+        env.tenantRootKeys.issuer.verifyingKeysJson,
+      );
+      config = setTomlSectionAssignment(
+        config,
+        'vars',
+        'ROUTER_TENANT_ROOT_CREATION_ROLE_VERIFYING_KEYS_JSON',
+        env.tenantRootKeys.roleVerifyingKeysJson,
+      );
       return setPrivateD1Vars(config, 'SIGNING_WORKER_PRIVATE_D1', env.privateD1Keys.signingWorker);
     case 'tenant-root-control-plane':
       config = setTomlSectionAssignment(

package/dist/esm/core/deviceLinking/linkedDeviceManagement.js

@@ -1,4 +1,4 @@
-import { parseLinkedDeviceId, parseVerifiedEmailAddress, parseWalletAuthorityId } from "../../shared-ts/src/utils/domainIds.js";
+import { parseLinkedDeviceId, parseWalletAuthorityId } from "../../shared-ts/src/utils/domainIds.js";
 import { buildDelegatedWalletAuthorityV1, buildFullOwnerPermissionsV1, hasDelegatedWalletPermissionV1, sameDelegatedWalletAuthorityV1 } from "../../shared-ts/src/authorization/delegatedAuthority.js";
 import { base64UrlDecode, base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
 //#region src/core/deviceLinking/linkedDeviceManagement.ts
@@ -22,14 +22,13 @@ var LinkedDeviceManagementServiceV1 = class {
 		});
 		const devices = [];
 		const ownerDevices = [];
-		const emailOtpAddress = emailOtpAddressOnceV1(this.options.credentials, request.walletId);
 		for (const authority of page.records) {
 			const activeMethods = (await this.options.authMethod.listForAuthorityV1({
 				walletId: authority.walletId,
 				authorityId: authority.authorityId
 			})).filter(isActiveAuthMethod);
-			if (authority.provenance.kind === "device_link") for (const activeMethod of activeMethods) devices.push(await this.buildLinkedDeviceSummaryV1(authority, activeMethod, emailOtpAddress));
-			else if (request.cursor === null) for (const activeMethod of activeMethods) ownerDevices.push(await this.buildOwnerDeviceSummaryV1(authority, activeMethod, emailOtpAddress));
+			if (authority.provenance.kind === "device_link") for (const activeMethod of activeMethods) devices.push(await this.buildLinkedDeviceSummaryV1(authority, activeMethod));
+			else if (request.cursor === null) for (const activeMethod of activeMethods) ownerDevices.push(await this.buildOwnerDeviceSummaryV1(authority, activeMethod));
 		}
 		return {
 			devices,
@@ -42,7 +41,7 @@ var LinkedDeviceManagementServiceV1 = class {
 		if (!resolved || !hasFullOwnerPermissionsV1(resolved.authority)) return { kind: "unauthorized" };
 		if (request.walletId !== resolved.session.walletId) return { kind: "unauthorized" };
 		const freshProof = source.freshProof;
-		if (!freshProof || freshProof.verifiedAtMs > request.requestedAtMs || request.requestedAtMs - freshProof.verifiedAtMs > MAX_FRESH_REVOCATION_PROOF_AGE_MS_V1) return { kind: "unauthorized" };
+		if (!freshProof || freshProof.verifiedAtMs > request.requestedAtMs || request.requestedAtMs - freshProof.verifiedAtMs > 3e5) return { kind: "unauthorized" };
 		const freshSourceMethod = await this.options.authMethod.readByIdV1({ walletAuthMethodId: freshProof.walletAuthMethodId });
 		if (!freshSourceMethod || freshSourceMethod.status !== "active" || freshSourceMethod.walletId !== request.walletId) return { kind: "unauthorized" };
 		const freshSourceAuthority = await this.options.authority.readByIdV1(freshSourceMethod.walletAuthorityId);
@@ -142,13 +141,13 @@ var LinkedDeviceManagementServiceV1 = class {
 			requestedAtMs
 		});
 	}
-	async buildLinkedDeviceSummaryV1(authority, authMethod, emailOtpAddress) {
+	async buildLinkedDeviceSummaryV1(authority, authMethod) {
 		if (authority.provenance.kind !== "device_link") throw new Error("linked authority provenance is invalid");
 		return {
 			deviceId: parseLinkedDeviceIdValue(authority.principal.deviceId),
 			enrollmentId: authority.provenance.enrollmentId,
 			walletId: authority.walletId,
-			credential: await credentialMetadataV1(this.options.credentials, authority.walletId, authMethod, emailOtpAddress),
+			credential: await credentialMetadataV1(this.options.credentials, authority.walletId, authMethod),
 			permission: buildDelegatedWalletAuthorityV1({ permissions: authority.permissions }),
 			keyManifestDigestB64u: authority.signerActivationSetDigestB64u,
 			coveredWalletKeys: walletKeysFromAuthority(authority),
@@ -158,11 +157,11 @@ var LinkedDeviceManagementServiceV1 = class {
 			revocationEpoch: authority.revocationEpoch
 		};
 	}
-	async buildOwnerDeviceSummaryV1(authority, authMethod, emailOtpAddress) {
+	async buildOwnerDeviceSummaryV1(authority, authMethod) {
 		return {
 			walletId: authority.walletId,
 			walletAuthorityId: authority.authorityId,
-			credential: await credentialMetadataV1(this.options.credentials, authority.walletId, authMethod, emailOtpAddress),
+			credential: await credentialMetadataV1(this.options.credentials, authority.walletId, authMethod),
 			createdAtMs: authority.createdAtMs,
 			lastActivityAtMs: Math.max(authority.updatedAtMs, authMethod.updatedAtMs)
 		};
@@ -181,28 +180,10 @@ function hasFullOwnerPermissionsV1(authority) {
 function isActiveAuthMethod(record) {
 	return record.status === "active";
 }
-/**
-* One wallet has one verified Email OTP address (its canonical enrollment), so
-* the list path reads it at most once regardless of how many methods share it.
-*/
-function emailOtpAddressOnceV1(credentials, walletId) {
-	let pending = null;
-	return () => {
-		pending ??= (async () => {
-			const raw = await credentials.readEmailOtpAddressV1({ walletId });
-			if (raw === null) throw new Error("active email OTP enrollment address is missing");
-			const parsed = parseVerifiedEmailAddress(raw);
-			if (!parsed.ok) throw new Error("active email OTP enrollment address is invalid");
-			return parsed.value;
-		})();
-		return pending;
-	};
-}
-async function credentialMetadataV1(credentials, walletId, authMethod, emailOtpAddress) {
+async function credentialMetadataV1(credentials, walletId, authMethod) {
 	if (authMethod.kind === "email_otp") return {
 		kind: "email_otp",
-		walletAuthMethodId: authMethod.walletAuthMethodId,
-		email: await emailOtpAddress()
+		walletAuthMethodId: authMethod.walletAuthMethodId
 	};
 	const device = await credentials.readPasskeyDeviceInfoV1({
 		walletId,
@@ -293,6 +274,6 @@ function isCursorRecordV1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) && Object.keys(value).sort().join(",") === "authorityId,kind,updatedAtMs";
 }
 //#endregion
-export { LinkedDeviceListCursorError, LinkedDeviceManagementServiceV1, MAX_LINKED_DEVICE_LIST_LIMIT_V1 };
+export { LinkedDeviceListCursorError, LinkedDeviceManagementServiceV1, MAX_FRESH_REVOCATION_PROOF_AGE_MS_V1, MAX_LINKED_DEVICE_LIST_LIMIT_V1 };
 
 //# sourceMappingURL=linkedDeviceManagement.js.map

package/dist/esm/core/emailOtpD1Statements.js

@@ -79,13 +79,25 @@ function grantValues(record) {
 /** Statements on `email_otp_grants`. */
 const emailOtpGrantRows = {
 	insert: (prepare, record) => prepare(INSERT_GRANT_SQL, grantValues(record)),
-	consume: (prepare, grantToken) => prepare(`DELETE FROM email_otp_grants
+	read: (prepare, grantToken) => prepare(`SELECT record_json, expires_at_ms FROM email_otp_grants
         WHERE namespace = ?
           AND org_id = ?
           AND project_id = ?
           AND env_id = ?
           AND grant_token = ?
-      RETURNING record_json, expires_at_ms`, [grantToken])
+        LIMIT 1`, [grantToken]),
+	consumeMatching: (prepare, record, nowMs) => prepare(`DELETE FROM email_otp_grants
+        WHERE namespace = ?
+          AND org_id = ?
+          AND project_id = ?
+          AND env_id = ?
+          AND grant_token = ?
+          AND record_json = ?
+          AND expires_at_ms > ?`, [
+		record.grantToken,
+		JSON.stringify(record),
+		nowMs
+	])
 };
 const INSERT_WALLET_ENROLLMENT_SQL = `INSERT INTO email_otp_wallet_enrollments (
         namespace,

package/dist/esm/core/nearRelayerAccountProvisioning.js

@@ -140,16 +140,9 @@ function validateNamedAccountCreationInput(input) {
 	};
 }
 async function fetchRelayerTxContext(input) {
-	let nonce = 0n;
-	try {
-		const accessKey = await input.nearClient.viewAccessKey(input.relayerAccount, input.relayerPublicKey);
-		nonce = BigInt(accessKey?.nonce ?? 0);
-	} catch {
-		nonce = 0n;
-	}
-	const block = await input.nearClient.viewBlock({ finality: "final" });
+	const [accessKey, block] = await Promise.all([input.nearClient.viewAccessKey(input.relayerAccount, input.relayerPublicKey), input.nearClient.viewBlock({ finality: "final" })]);
 	return {
-		nextNonce: (nonce + 1n).toString(),
+		nextNonce: (BigInt(accessKey.nonce) + 1n).toString(),
 		blockHash: block.header.hash
 	};
 }

package/dist/esm/hosted-wallet-gateway.js

@@ -584,12 +584,15 @@ function routerAbCeremonyJwksResponse(env) {
 let cachedStagingSigningSessionSealOptions = null;
 function stagingSigningSessionSealOptions(env) {
 	if (cachedStagingSigningSessionSealOptions) return cachedStagingSigningSessionSealOptions;
-	const seal = stagingEmailOtpServerSealConfig(env);
-	if (!seal) return void 0;
+	const rootSecretB64u = readEnvironmentString(env, "SIGNING_SESSION_SEAL_ROOT_SECRET_B64U");
+	const currentKeyVersion = readEnvironmentString(env, "SIGNING_SESSION_SEAL_CURRENT_KEY_VERSION");
+	const acceptedWarmKeyVersions = readEnvironmentString(env, "SIGNING_SESSION_SEAL_ACCEPTED_WARM_KEY_VERSIONS").split(",").map((value) => value.trim()).filter(Boolean);
+	if (!rootSecretB64u && !currentKeyVersion) return void 0;
+	if (!rootSecretB64u || !currentKeyVersion || acceptedWarmKeyVersions.length === 0) throw new Error("Signing-session seal requires the root secret, current key version, and accepted warm key versions");
 	cachedStagingSigningSessionSealOptions = createSigningSessionSealOptions({
-		rootSecretB64u: seal.rootSecretB64u,
-		currentKeyVersion: seal.currentKeyVersion,
-		acceptedWarmKeyVersions: seal.acceptedWarmKeyVersions
+		rootSecretB64u,
+		currentKeyVersion,
+		acceptedWarmKeyVersions
 	});
 	return cachedStagingSigningSessionSealOptions;
 }
@@ -626,8 +629,8 @@ async function assertD1Tables(input) {
 function stagingEmailOtpServerSealConfig(env) {
 	const rootSecretB64u = readEnvironmentString(env, "SIGNING_SESSION_SEAL_ROOT_SECRET_B64U");
 	const currentKeyVersion = readEnvironmentString(env, "SIGNING_SESSION_SEAL_CURRENT_KEY_VERSION");
-	const acceptedWarmKeyVersions = readEnvironmentString(env, "SIGNING_SESSION_SEAL_ACCEPTED_WARM_KEY_VERSIONS").split(",").map((value) => value.trim()).filter(Boolean);
-	if (!rootSecretB64u && !currentKeyVersion) return;
+	const acceptedWarmKeyVersions = readEnvironmentString(env, "EMAIL_OTP_SERVER_SEAL_ACCEPTED_WARM_KEY_VERSIONS").split(",").map((value) => value.trim()).filter(Boolean);
+	if (!rootSecretB64u && !currentKeyVersion && acceptedWarmKeyVersions.length === 0) return;
 	if (!rootSecretB64u || !currentKeyVersion || acceptedWarmKeyVersions.length === 0) throw new Error("Email OTP server seal requires the root secret, current key version, and accepted warm key versions");
 	return {
 		rootSecretB64u,

package/dist/esm/router/auth/webAuthnCredentialCodecs.js

@@ -1,9 +1,24 @@
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
+import { isPlainObject } from "../../shared-ts/src/utils/validation.js";
 import { base64Decode, base64UrlDecode, base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
 import "../../shared-ts/src/utils/encoders.js";
 import { failure } from "../../shared-ts/src/utils/failure.js";
 import { errorMessage } from "../../shared-ts/src/utils/errors.js";
 //#region src/router/auth/webAuthnCredentialCodecs.ts
+function containsWebAuthnExtensionOutput(value) {
+	if (value == null) return false;
+	if (!isPlainObject(value)) return true;
+	for (const nested of Object.values(value)) if (containsWebAuthnExtensionOutput(nested)) return true;
+	return false;
+}
+function unredactedWebAuthnExtensionField(input) {
+	if (!isPlainObject(input)) return null;
+	if (containsWebAuthnExtensionOutput(input.clientExtensionResults)) return "clientExtensionResults";
+	const response = input.response;
+	if (!isPlainObject(response)) return null;
+	if (containsWebAuthnExtensionOutput(response.clientExtensionResults)) return "response.clientExtensionResults";
+	return null;
+}
 function decodeWebAuthnBase64UrlOrBase64(input, fieldName) {
 	try {
 		return base64UrlDecode(input);
@@ -90,6 +105,6 @@ function parseWebAuthnAuthenticationCredential(input) {
 	};
 }
 //#endregion
-export { decodeWebAuthnBase64UrlOrBase64, parseWebAuthnAuthenticationCredential, parseWebAuthnClientDataJsonBase64url, webAuthnCredentialIdB64uFromCredential, webAuthnOriginHostnameOrEmpty };
+export { decodeWebAuthnBase64UrlOrBase64, parseWebAuthnAuthenticationCredential, parseWebAuthnClientDataJsonBase64url, unredactedWebAuthnExtensionField, webAuthnCredentialIdB64uFromCredential, webAuthnOriginHostnameOrEmpty };
 
 //# sourceMappingURL=webAuthnCredentialCodecs.js.map

package/dist/esm/router/cloudflare/d1/auth/d1AuthorizationAssembly.js

@@ -77,6 +77,7 @@ function createD1GoogleRegistrationAttempts(options, prepare) {
 }
 function createD1EmailOtpRateLimits(options, prepare) {
 	return new CloudflareD1EmailOtpRateLimitStore({
+		database: options.database,
 		prepare,
 		batch: options.database.batch.bind(options.database),
 		rateLimits: options.emailOtp.rateLimits

package/dist/esm/router/cloudflare/d1/auth/d1RouterApiAuthService.js

@@ -115,7 +115,6 @@ function createD1LinkedDeviceComposition(input) {
 		authorizationService: input.authorizationService,
 		walletSessionAuthorizations: input.authorizationStore,
 		webAuthnStore: input.webAuthnStore,
-		...input.emailOtpLinkedDevice === void 0 ? {} : { emailOtpEnrollments: input.emailOtpLinkedDevice.enrollments },
 		materialDeactivation: createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1({ endpoint: deactivationEndpoint })
 	});
 	const revokeLinkedDeviceWithFreshProof = createD1LinkedDeviceRevocationV1({

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEmailOtpTargetFactor.js

@@ -156,7 +156,10 @@ var D1LinkedDeviceEmailOtpTargetFactorV1 = class {
 			issuedAtMs,
 			expiresAtMs
 		});
-		const unsealed = await this.options.serverSeal.removeEmailOtpServerSeal({ wrappedCiphertext: context.resolved.enrollment.serverSealedFactorCiphertextB64u });
+		const unsealed = await this.options.serverSeal.removeEmailOtpServerSeal({
+			wrappedCiphertext: context.resolved.enrollment.serverSealedFactorCiphertextB64u,
+			enrollmentSealKeyVersion: context.resolved.enrollment.enrollmentSealKeyVersion
+		});
 		if (!unsealed.ok) return {
 			kind: "refused",
 			code: unsealed.code,

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceManagementService.js

@@ -11,17 +11,12 @@ function createD1LinkedDeviceManagementServiceV1(input) {
 		}),
 		authMethod: authMethodPortV1(input.authMethodStore),
 		sessions: input.authorizationService,
-		credentials: {
-			readPasskeyDeviceInfoV1: async ({ walletId, credentialIdB64u }) => {
-				return (await input.webAuthnStore.readAuthenticator({
-					userId: String(walletId),
-					credentialIdB64u
-				}))?.deviceInfo ?? null;
-			},
-			readEmailOtpAddressV1: async ({ walletId }) => {
-				return (await input.emailOtpEnrollments?.readEnrollment(String(walletId)))?.verifiedEmail ?? null;
-			}
-		},
+		credentials: { readPasskeyDeviceInfoV1: async ({ walletId, credentialIdB64u }) => {
+			return (await input.webAuthnStore.readAuthenticator({
+				userId: String(walletId),
+				credentialIdB64u
+			}))?.deviceInfo ?? null;
+		} },
 		...input.materialDeactivation === void 0 ? {} : { materialDeactivation: input.materialDeactivation }
 	});
 }

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRevocation.js

@@ -1,4 +1,5 @@
 import { computeWalletAuthMethodRevokeOperationFingerprintV1 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
+import "../../../../core/deviceLinking/linkedDeviceManagement.js";
 import { computeWalletAuthMethodRevocationProofDigestV1 } from "../wallet/d1WalletAuthMethodRevocationReplayStore.js";
 //#region src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRevocation.ts
 /**
@@ -42,6 +43,12 @@ function createD1LinkedDeviceRevocationV1(deps) {
 		};
 		const committed = await answeredFromRecord();
 		if (committed) return committed;
+		const nowMs = deps.nowV1();
+		if (requestedAtMs > nowMs || nowMs - requestedAtMs > 3e5) return {
+			kind: "denied",
+			code: "invalid",
+			message: "Fresh revocation proof request time is invalid"
+		};
 		const verified = await deps.verifyProofForBatch({
 			walletId,
 			targetWalletAuthMethodId: walletAuthMethodId,

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpGrantStore.js

@@ -9,8 +9,11 @@ var CloudflareD1EmailOtpGrantStore = class {
 	async put(record) {
 		await emailOtpGrantRows.insert(this.prepare, record).run();
 	}
-	async consume(grantToken) {
-		return parseEmailOtpGrantRow(await emailOtpGrantRows.consume(this.prepare, grantToken).first());
+	async read(grantToken) {
+		return parseEmailOtpGrantRow(await emailOtpGrantRows.read(this.prepare, grantToken).first());
+	}
+	prepareConsumeMatching(record, nowMs) {
+		return emailOtpGrantRows.consumeMatching(this.prepare, record, nowMs);
 	}
 };
 //#endregion

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRateLimitStore.js

@@ -1,3 +1,4 @@
+import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
 import { emailOtpRateLimitExceeded, emailOtpRateLimitKeys } from "./d1EmailOtpRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpRateLimitStore.ts
 var CloudflareD1EmailOtpRateLimitStore = class {
@@ -20,6 +21,23 @@ var CloudflareD1EmailOtpRateLimitStore = class {
 		}
 		return { ok: true };
 	}
+	async consumeVerifiedGrant(input) {
+		const policy = this.input.rateLimits.grant;
+		const keys = emailOtpRateLimitKeys(input.rateLimit, policy);
+		const statements = [input.grantDelete, this.input.database.prepare(D1_BATCH_CAS_GUARD_SQL)];
+		for (const counter of keys) statements.push(this.prepareConsume(counter, policy, input.nowMs, true), this.input.database.prepare(D1_BATCH_CAS_GUARD_SQL));
+		const results = await this.input.batch(statements);
+		if (results.length !== statements.length) throw new Error("OTP grant counter batch failed");
+		for (const result of results) if (!result.success) throw new Error("OTP grant counter batch failed");
+	}
+	async readExceededGrantRateLimit(input, nowMs) {
+		const policy = this.input.rateLimits.grant;
+		for (const counter of emailOtpRateLimitKeys(input, policy)) {
+			const row = await this.readCounter(counter);
+			if (typeof row?.consumed_count === "number" && Number.isSafeInteger(row.consumed_count) && row.consumed_count >= policy.limit && typeof row.reset_at_ms === "number" && Number.isSafeInteger(row.reset_at_ms) && row.reset_at_ms > nowMs) return emailOtpRateLimitExceeded(row);
+		}
+		return null;
+	}
 	prepareConsume(counter, policy, nowMs, first) {
 		const resetAtMs = nowMs + policy.windowMs;
 		let walletId;

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRecoveryService.js

@@ -232,19 +232,39 @@ var CloudflareD1EmailOtpRecoveryService = class {
 		try {
 			const parsed = normalizeGrantConsumptionInput(input);
 			if (!parsed.ok) return parsed.result;
-			const rateLimit = await this.emailOtpRateLimits.consume({
+			const nowMs = Date.now();
+			const record = await this.emailOtpGrants.read(parsed.value.loginGrant);
+			if (!record || nowMs >= record.expiresAtMs || record.action !== WALLET_EMAIL_OTP_ACTIONS.unseal || emailOtpGrantBindingMismatch(record, parsed.value)) {
+				const invalidGrantRateLimit = await this.emailOtpRateLimits.consume({
+					kind: "regional",
+					scope: "grant",
+					action: "invalid_grant",
+					clientIp: parsed.value.clientIp || "unknown"
+				});
+				if (!invalidGrantRateLimit.ok) return invalidGrantRateLimit;
+				return emailOtpGrantInvalidOrExpired();
+			}
+			const grantRateLimitInput = {
 				kind: "wallet",
 				scope: "grant",
-				userId: parsed.value.userId,
 				walletId: parsed.value.walletId,
+				userId: parsed.value.userId,
 				orgId: parsed.value.orgId,
 				clientIp: parsed.value.clientIp
-			});
-			if (!rateLimit.ok) return rateLimit;
-			const record = await this.emailOtpGrants.consume(parsed.value.loginGrant);
-			if (!record || Date.now() > record.expiresAtMs) return emailOtpGrantInvalidOrExpired();
-			if (record.action !== WALLET_EMAIL_OTP_ACTIONS.unseal) return emailOtpGrantInvalidOrExpired();
-			if (emailOtpGrantBindingMismatch(record, parsed.value)) return emailOtpGrantInvalidOrExpired();
+			};
+			try {
+				await this.emailOtpRateLimits.consumeVerifiedGrant({
+					grantDelete: this.emailOtpGrants.prepareConsumeMatching(record, nowMs),
+					rateLimit: grantRateLimitInput,
+					nowMs
+				});
+			} catch (error) {
+				const current = await this.emailOtpGrants.read(parsed.value.loginGrant);
+				if (!current || Date.now() >= current.expiresAtMs) return emailOtpGrantInvalidOrExpired();
+				const rateLimit = await this.emailOtpRateLimits.readExceededGrantRateLimit(grantRateLimitInput, nowMs);
+				if (rateLimit) return rateLimit;
+				throw error;
+			}
 			return {
 				ok: true,
 				challengeId: record.challengeId,