@seams/wallet-server 0.5.0

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService.d.ts

@@ -0,0 +1,241 @@
+import type { ActiveWalletAuthorityV1 } from '../../../../../../shared-ts/src/authorization/walletAuthority';
+import { type LinkDeviceSessionId, type MpcMaterialActivationRef, type WalletAuthMethodId, type WalletAuthorityId, type WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
+import { type DeviceId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
+import { type PrincipalId, type TenantId, type WalletSessionAuthorizationId, type WalletSessionId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
+import { type CommittedAuthorityPackagesV1 } from '../../../../../../shared-ts/src/device-linking/committedSignerPackages';
+import { type LinkedDeviceSessionRecordV1 } from '../../../../core/deviceLinking/linkedDeviceSession';
+import type { LocalAuthorityActivationFinalAckV1, LocalAuthorityInstallationReceiptV1, OrdinarySignerMaterialReservationPreparationV1 as SharedOrdinarySignerMaterialReservationPreparationV1, VerifiedLinkInputV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
+import { type LinkedDeviceWalletSessionCredentialDeliveryBindingV1, type LinkedDeviceWalletSessionCredentialDeliveryV1, type LinkedDeviceActivationCleanupReceiptV1 } from '../../../../../../shared-ts/src/device-linking/walletSessionCredentialDelivery';
+import { type ExactAdministeredSignerV1 } from '../../../../../../shared-ts/src/device-linking/delegatedActivationPlan';
+import { type WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import { OrdinaryInactiveSignerMaterialReservationServiceV1, type OrdinaryEcdsaSignerMaterialReservationPreparationV1, type OrdinaryEd25519SignerMaterialReservationPreparationV1 } from '../../../../core/signingMaterial/ordinaryInactiveSignerMaterialReservation';
+import type { LinkedDeviceEcdsaSourcePreservingActivationReceiptV1 } from '../../../../../../shared-ts/src/device-linking/sourceContribution';
+import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import { type RouterAbEd25519YaoActivationPublicReceiptV1, type RouterAbEd25519YaoApplicationBindingFactsV1, type RouterAbEd25519YaoCeremonyBindingV1 } from '../../../../../../shared-ts/src/utils/routerAbEd25519Yao';
+import { D1WalletAuthorityStore, type D1WalletAuthorityStoreScope } from '../wallet/d1WalletAuthorityStore';
+import type { D1LinkedDeviceSessionStoreV1 } from './d1LinkedDeviceSessionStore';
+import type { D1WalletAuthMethodStore } from '../../../../core/d1WalletAuthMethodStore';
+import type { WalletEd25519SignerRecord } from '../../../../core/WalletStore';
+import type { AuthorizationService } from '../../../../authorization/service';
+import { type PersistedActiveWalletSessionAuthorizationV2, type IssuedWalletSessionAuthorizationV2 } from '../../../../authorization/domain';
+import { type DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
+import type { CloudflareD1EmailOtpRegistrationEnrollmentFinalizer } from '../emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer';
+type ExactSigner = ExactAdministeredSignerV1;
+type ListWalletEd25519SignersV1 = (walletId: WalletId) => Promise<readonly WalletEd25519SignerRecord[]>;
+type WorkerOrdinarySignerMaterialReservationPreparationV1 = {
+    readonly keyFamily: 'ed25519';
+    readonly preparation: OrdinaryEd25519SignerMaterialReservationPreparationV1;
+} | {
+    readonly keyFamily: 'ecdsa_secp256k1';
+    readonly preparation: OrdinaryEcdsaSignerMaterialReservationPreparationV1;
+};
+/** The only worker authority mutation accepted by the linked-device cutover. */
+export type OrdinaryInactiveSignerMaterialActivationPortV1 = {
+    activateOrdinaryInactiveSignerMaterialV1(input: {
+        readonly keyFamily: 'ed25519' | 'ecdsa_secp256k1';
+        readonly reservationId: string;
+        readonly materialActivation: MpcMaterialActivationRef;
+        readonly activatedAtMs: number;
+        readonly preparation: WorkerOrdinarySignerMaterialReservationPreparationV1;
+    }): Promise<void>;
+};
+export type D1LinkedDeviceAuthorityInstallServiceOptionsV1 = {
+    readonly database: D1DatabaseLike;
+    readonly scope: D1WalletAuthorityStoreScope;
+    readonly authorityStore: D1WalletAuthorityStore;
+    readonly authMethodStore: Pick<D1WalletAuthMethodStore, 'readByIdV2'>;
+    /** The wallet's ordinary Ed25519 signer rows are the source of NEAR identity facts. */
+    readonly listWalletEd25519Signers: ListWalletEd25519SignersV1;
+    readonly sessionStore: Pick<D1LinkedDeviceSessionStoreV1, 'getSessionV1' | 'buildAuthorityPendingLocalInstallCasStatementsV1' | 'buildAuthorityActivationCasStatementsV1' | 'deleteActiveSessionWithStatementsV1'>;
+    readonly sessionService: {
+        getSessionV1(input: {
+            readonly linkSessionId: LinkDeviceSessionId;
+            readonly nowMs: number;
+        }): Promise<LinkedDeviceSessionRecordV1 | null>;
+        deleteActiveSessionV1(input: {
+            readonly linkSessionId: LinkDeviceSessionId;
+            readonly expectedRevision: number;
+            readonly authorityId: WalletAuthorityId;
+            readonly packageSetDigestB64u: DigestB64u;
+            readonly nowMs: number;
+        }): Promise<{
+            readonly outcome: 'applied' | 'replayed' | 'deleted';
+        } | {
+            readonly outcome: string;
+            readonly message?: string;
+        }>;
+    };
+    readonly reservationService: OrdinaryInactiveSignerMaterialReservationServiceV1;
+    readonly materialActivation: OrdinaryInactiveSignerMaterialActivationPortV1;
+    readonly authorizationService: Pick<AuthorizationService, 'prepareWalletSessionAuthorizationV2' | 'readWalletSessionAuthorizationV2ByMint'>;
+    readonly authorizationStore: {
+        prepareDirectWalletSessionAuthorizationV2Statements(persisted: PersistedActiveWalletSessionAuthorizationV2): readonly [
+            D1PreparedStatementLike,
+            D1PreparedStatementLike,
+            D1PreparedStatementLike,
+            D1PreparedStatementLike,
+            D1PreparedStatementLike,
+            D1PreparedStatementLike
+        ];
+    };
+    /** Supplies first-Email enrollment statements for the new linked target branch. */
+    readonly emailOtpEnrollmentFinalizer?: Pick<CloudflareD1EmailOtpRegistrationEnrollmentFinalizer, 'prepareLinkedDeviceEnrollment'>;
+    readonly tenantId: TenantId;
+    readonly walletSessionTtlMs?: number;
+    readonly walletSessionRemainingUses?: number;
+    readonly nowV1?: () => number;
+};
+export type CommitPendingAuthorityInputV1 = VerifiedLinkInputV1 & {
+    readonly nowMs: number;
+    readonly ed25519ExportRootPackage: CommittedAuthorityPackagesV1['ed25519ExportRootPackage'];
+};
+export type CommitPendingAuthorityResultV1 = {
+    readonly kind: 'committed' | 'replayed';
+    readonly packages: CommittedAuthorityPackagesV1;
+    readonly ordinarySignerMaterialPreparations: readonly [
+        SharedOrdinarySignerMaterialReservationPreparationV1,
+        ...SharedOrdinarySignerMaterialReservationPreparationV1[]
+    ];
+    readonly session: LinkedDeviceSessionRecordV1;
+} | {
+    readonly kind: 'conflict';
+    readonly message: string;
+} | {
+    readonly kind: 'invalid_input';
+    readonly message: string;
+};
+export type ActivateInstalledAuthorityResultV1 = {
+    readonly kind: 'active';
+    readonly outcome: 'activated' | 'replayed';
+    readonly authority: ActiveWalletAuthorityV1;
+    readonly authMethod: Extract<WalletAuthMethodRecordV2, {
+        readonly status: 'active';
+    }>;
+    readonly session: LinkedDeviceSessionRecordV1;
+    readonly walletSession: IssuedWalletSessionAuthorizationV2;
+    readonly deliveryBinding: LinkedDeviceWalletSessionCredentialDeliveryBindingV1;
+    readonly sealedDelivery: LinkedDeviceWalletSessionCredentialDeliveryV1;
+} | {
+    readonly kind: 'pending_local_install';
+    readonly authorityId: WalletAuthorityId;
+    readonly reason: 'server_worker_activation_pending' | 'wallet_session_issuance_pending';
+} | {
+    readonly kind: 'integrity_error';
+    readonly message: string;
+};
+export type LocalAuthorityActivationAcknowledgementAuthenticationV1 = {
+    readonly kind: 'live';
+    readonly session: LinkedDeviceSessionRecordV1;
+} | {
+    readonly kind: 'cleanup_receipt';
+    readonly receipt: LinkedDeviceActivationCleanupReceiptV1;
+} | {
+    /** Exact-method unlock can replay after the QR session is gone. */
+    readonly kind: 'exact_wallet_session';
+    readonly tenantId: TenantId;
+    readonly principalId: PrincipalId;
+    readonly walletId: WalletId;
+    readonly authorityId: WalletAuthorityId;
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly authorizationId: WalletSessionAuthorizationId;
+    readonly walletSessionId: WalletSessionId;
+    readonly expiresAtMs: number;
+};
+export type InstalledLinkedDeviceEd25519AuthorityProjectionV1 = {
+    readonly walletId: WalletId;
+    readonly authorityId: WalletAuthorityId;
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly linkSessionId: LinkDeviceSessionId;
+    readonly deviceId: DeviceId;
+    readonly materialActivation: MpcMaterialActivationRef;
+    readonly targetBinding: RouterAbEd25519YaoCeremonyBindingV1;
+    readonly targetSessionId: RouterAbEd25519YaoCeremonyBindingV1['lifecycle']['session_id'];
+    readonly applicationBinding: RouterAbEd25519YaoApplicationBindingFactsV1;
+    readonly participantIds: readonly [number, number];
+    readonly activationReceipt: RouterAbEd25519YaoActivationPublicReceiptV1;
+    readonly installedRecordSetDigestB64u: DigestB64u;
+    readonly activatedAtMs: number;
+};
+export type InstalledLinkedDeviceEcdsaAuthorityProjectionV1 = {
+    readonly walletId: WalletId;
+    readonly authorityId: WalletAuthorityId;
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly linkSessionId: LinkDeviceSessionId;
+    readonly deviceId: DeviceId;
+    readonly materialActivation: MpcMaterialActivationRef;
+    readonly signer: Extract<ExactSigner, {
+        readonly keyFamily: 'ecdsa_secp256k1';
+    }>;
+    readonly activationReceipt: LinkedDeviceEcdsaSourcePreservingActivationReceiptV1;
+    readonly installedRecordSetDigestB64u: DigestB64u;
+    readonly activatedAtMs: number;
+};
+export declare class D1LinkedDeviceAuthorityInstallServiceV1 {
+    private readonly options;
+    private readonly nowV1;
+    constructor(options: D1LinkedDeviceAuthorityInstallServiceOptionsV1);
+    commitPendingAuthorityV1(input: CommitPendingAuthorityInputV1): Promise<CommitPendingAuthorityResultV1>;
+    activateInstalledAuthorityV1(input: {
+        readonly receipt: LocalAuthorityInstallationReceiptV1;
+        readonly nowMs?: number;
+    }): Promise<ActivateInstalledAuthorityResultV1>;
+    private readActivationReplayAfterCasRace;
+    readCommittedAuthorityPackagesV1(input: {
+        readonly session: LinkedDeviceSessionRecordV1;
+        readonly requestedAtMs: number;
+    }): Promise<CommittedAuthorityPackagesV1 | null>;
+    readInstalledEd25519AuthorityByIdentityV1(input: {
+        readonly walletId: WalletId;
+        readonly authorityId: WalletAuthorityId;
+        readonly walletAuthMethodId: WalletAuthMethodId;
+    }): Promise<InstalledLinkedDeviceEd25519AuthorityProjectionV1 | null>;
+    readInstalledEd25519AuthorityByMaterialActivationV1(input: {
+        readonly walletId: WalletId;
+        readonly materialActivation: MpcMaterialActivationRef;
+    }): Promise<InstalledLinkedDeviceEd25519AuthorityProjectionV1 | null>;
+    readInstalledEcdsaAuthorityByIdentityV1(input: {
+        readonly walletId: WalletId;
+        readonly authorityId: WalletAuthorityId;
+        readonly walletAuthMethodId: WalletAuthMethodId;
+    }): Promise<InstalledLinkedDeviceEcdsaAuthorityProjectionV1 | null>;
+    readInstalledEcdsaAuthorityByMaterialActivationV1(input: {
+        readonly walletId: WalletId;
+        readonly materialActivation: MpcMaterialActivationRef;
+    }): Promise<InstalledLinkedDeviceEcdsaAuthorityProjectionV1 | null>;
+    readActivationCleanupReceiptV1(input: {
+        readonly linkSessionId: LinkDeviceSessionId;
+        readonly requestedAtMs: number;
+    }): Promise<LinkedDeviceActivationCleanupReceiptV1 | null>;
+    acknowledgeLocalAuthorityActivationV1(input: {
+        readonly acknowledgement: LocalAuthorityActivationFinalAckV1;
+        readonly authentication: LocalAuthorityActivationAcknowledgementAuthenticationV1;
+        readonly requestedAtMs: number;
+    }): Promise<void>;
+    private commitAcknowledgementCleanupV1;
+    private assertExactAcknowledgementAuthenticationV1;
+    private prepareActivationAcknowledgementV1;
+    private assertCredentialDeliveryMatchesStoredInstallation;
+    private assertCredentialDeliveryMatchesCommittedSession;
+    private buildCredentialDeliveryAcknowledgementStatement;
+    private buildAuthorityAllocationDeleteStatement;
+    private buildCredentialDeliveryCleanupStateStatement;
+    private buildCredentialDeliveryCleanupCompleteStatement;
+    private reserveSignerMaterial;
+    private activateReservations;
+    private readCommittedWalletSession;
+    private buildInstallationActivationStatement;
+    private buildCredentialDeliveryInsertStatement;
+    private readCredentialDelivery;
+    private readCredentialDeliveryRow;
+    private buildWalletSessionAuthorizationInput;
+    private markInstalled;
+    private prepareAuthorityAllocation;
+    private prepareEmailOtpEnrollmentStatements;
+    private readAuthorityAllocation;
+    private buildInstallationInsertStatement;
+    private readInstallation;
+    private readInstallationByAuthority;
+    private readInstallationsByWallet;
+}
+export {};
+//# sourceMappingURL=d1LinkedDeviceAuthorityInstallService.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEd25519ExportRootStore.d.ts

@@ -0,0 +1,23 @@
+import { type LinkedDeviceEd25519ExportRootPackageV1, type LinkedDeviceEd25519ExportRootRecipientV1 } from '../../../../../../shared-ts/src/device-linking/ed25519ExportRoot';
+import type { LinkDeviceSessionId } from '../../../../../../shared-ts/src/signing-lanes/ids';
+import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
+import type { D1LinkedDeviceSessionScopeV1 } from './d1LinkedDeviceSessionStore';
+import type { LinkedDeviceEd25519ExportRootPortV1, LinkedDeviceEd25519ExportRootRecordV1, LinkedDeviceEd25519ExportRootWriteResultV1 } from '../../../../core/deviceLinking/linkedDeviceEd25519ExportRoot';
+export declare class D1LinkedDeviceEd25519ExportRootStoreV1 implements LinkedDeviceEd25519ExportRootPortV1 {
+    private readonly database;
+    private readonly scope;
+    constructor(options: {
+        readonly database: D1DatabaseLike;
+        readonly scope: D1LinkedDeviceSessionScopeV1;
+    });
+    registerRecipientV1(input: {
+        readonly recipient: LinkedDeviceEd25519ExportRootRecipientV1;
+    }): Promise<LinkedDeviceEd25519ExportRootWriteResultV1>;
+    submitPackageV1(input: {
+        readonly linkSessionId: LinkDeviceSessionId;
+        readonly package: LinkedDeviceEd25519ExportRootPackageV1;
+    }): Promise<LinkedDeviceEd25519ExportRootWriteResultV1>;
+    readTransferV1(linkSessionId: LinkDeviceSessionId): Promise<LinkedDeviceEd25519ExportRootRecordV1 | null>;
+    private readRowV1;
+}
+//# sourceMappingURL=d1LinkedDeviceEd25519ExportRootStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEmailOtpGrantStore.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Refactor 103 Phase 6 — D1 persistence for linked-device Email OTP
+ * verification grants.
+ *
+ * A grant is issued once, after the emailed code verifies against the exact
+ * link-session binding, and consumed exactly once. The CAS guard makes a lost
+ * consumption fail that whole batch, so a grant can never authorize two
+ * completions.
+ */
+import { type LinkedDeviceEmailOtpGrantRecordV1 } from '../../../../core/deviceLinking/linkedDeviceEmailOtpGrant';
+import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import type { D1LinkedDeviceSessionScopeV1 } from './d1LinkedDeviceSessionStore';
+export declare class D1LinkedDeviceEmailOtpGrantStoreV1 {
+    private readonly database;
+    private readonly scope;
+    constructor(input: {
+        readonly database: D1DatabaseLike;
+        readonly scope: D1LinkedDeviceSessionScopeV1;
+    });
+    issueV1(record: LinkedDeviceEmailOtpGrantRecordV1): Promise<void>;
+    readByIdV1(grantId: string): Promise<LinkedDeviceEmailOtpGrantRecordV1 | null>;
+    /**
+     * The consumption as statements: a CAS flip from `issued` to `consumed`
+     * followed by the guard, so a batch that includes them either consumed the
+     * grant exactly now or did not commit at all.
+     */
+    buildConsumeStatementsV1(input: {
+        readonly grantId: string;
+        readonly consumedAtMs: number;
+    }): readonly D1PreparedStatementLike[];
+}
+//# sourceMappingURL=d1LinkedDeviceEmailOtpGrantStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEmailOtpTargetFactor.d.ts

@@ -0,0 +1,118 @@
+/**
+ * Refactor 103 Phase 6.2 — the D1 composition behind the linked-device Email
+ * OTP challenge routes and the approval-time base-factor provenance reader.
+ *
+ * Everything identity-bearing is resolved server-side: the destination comes
+ * from the wallet's active verified enrollment, the base factor from the
+ * canonical wallet auth-method store, and the target authority identity
+ * from the enrollment identity. Device 2 supplies only the code it received
+ * and its worker's ephemeral recipient key. Challenges reuse the Refactor 100
+ * issuer, verifier, rate limits, and lockouts under the dedicated
+ * `wallet_email_otp_device_link` purpose, bound by a digest over the whole
+ * device-link context.
+ */
+import type { LinkedDeviceApprovalV1, LinkedDeviceEmailOtpFactorReleaseEnvelopeV1, LinkedDeviceEmailOtpBaseFactorRequestV1, LinkedDeviceEmailOtpBaseFactorResolutionV1, LinkedDeviceEmailOtpVerificationGrantV1, LinkedDeviceTargetPreparationV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
+import type { WalletId, VerifiedEmailAddress } from '../../../../../../shared-ts/src/utils/domainIds';
+import type { WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import type { LinkedDeviceSessionRecordV1 } from '../../../../core/deviceLinking/linkedDeviceSession';
+import type { D1WalletAuthorityStore } from '../wallet/d1WalletAuthorityStore';
+import type { DeviceLinkingEmailOtpTargetFactorProviderV1 } from '../../../transport/fetch/routes/deviceLinking';
+import type { LinkedDeviceEmailOtpGrantRegistrationPortV1, VerifiedLinkedDeviceEmailOtpGrantV1 } from './d1LinkedDeviceTargetCredentialProvider';
+import type { CloudflareD1EmailOtpChallengeIssuer } from '../emailOtp/d1EmailOtpChallengeIssuer';
+import type { CloudflareD1EmailOtpChallengeVerifier } from '../emailOtp/d1EmailOtpChallengeVerifier';
+import type { CloudflareD1EmailOtpEnrollmentStore } from '../emailOtp/d1EmailOtpEnrollmentStore';
+import type { CloudflareD1EmailOtpServerSealRuntime } from '../emailOtp/d1EmailOtpServerSealRuntime';
+import { type D1LinkedDeviceEmailOtpGrantStoreV1 } from './d1LinkedDeviceEmailOtpGrantStore';
+export type D1LinkedDeviceEmailOtpTargetFactorOptionsV1 = {
+    readonly issuer: Pick<CloudflareD1EmailOtpChallengeIssuer, 'create'>;
+    readonly verifier: Pick<CloudflareD1EmailOtpChallengeVerifier, 'verifyExisting' | 'verifyRegistration'>;
+    readonly enrollments: Pick<CloudflareD1EmailOtpEnrollmentStore, 'readEnrollment'>;
+    readonly orgId: string;
+    readonly walletAuthMethods: {
+        listForWalletV2(input: {
+            readonly walletId: string;
+        }): Promise<WalletAuthMethodRecordV2[]>;
+    };
+    readonly walletAuthorities: Pick<D1WalletAuthorityStore, 'readById'>;
+    readonly serverSeal: Pick<CloudflareD1EmailOtpServerSealRuntime, 'removeEmailOtpServerSeal'>;
+    readonly grants: Pick<D1LinkedDeviceEmailOtpGrantStoreV1, 'issueV1' | 'readByIdV1' | 'buildConsumeStatementsV1'>;
+    readonly grantTtlMs?: number;
+    readonly resendCooldownMs?: number;
+};
+export type LinkedDeviceEmailOtpTargetEnrollmentResolutionV1 = {
+    readonly kind: 'existing_enrollment';
+    readonly targetEmail: VerifiedEmailAddress;
+} | {
+    readonly kind: 'new_enrollment';
+    readonly targetEmail: VerifiedEmailAddress;
+} | {
+    readonly kind: 'conflict';
+    readonly message: string;
+};
+export declare class D1LinkedDeviceEmailOtpTargetFactorV1 implements DeviceLinkingEmailOtpTargetFactorProviderV1 {
+    private readonly options;
+    private readonly grantTtlMs;
+    private readonly resendCooldownMs;
+    constructor(options: D1LinkedDeviceEmailOtpTargetFactorOptionsV1);
+    resolveTargetEnrollmentV1(input: {
+        readonly walletId: WalletId;
+        readonly targetEmail: VerifiedEmailAddress;
+    }): Promise<LinkedDeviceEmailOtpTargetEnrollmentResolutionV1>;
+    resolveBaseFactorSelectionV1(input: {
+        readonly walletId: WalletId;
+        readonly request: LinkedDeviceEmailOtpBaseFactorRequestV1;
+    }): Promise<LinkedDeviceEmailOtpBaseFactorResolutionV1>;
+    startChallengeV1(input: {
+        readonly session: LinkedDeviceSessionRecordV1;
+        readonly approval: LinkedDeviceApprovalV1;
+        readonly preparation: LinkedDeviceTargetPreparationV1;
+        readonly resend: false;
+        readonly requestedAtMs: number;
+    } | {
+        readonly session: LinkedDeviceSessionRecordV1;
+        readonly approval: LinkedDeviceApprovalV1;
+        readonly preparation: LinkedDeviceTargetPreparationV1;
+        readonly resend: true;
+        readonly requestedAtMs: number;
+    }): Promise<{
+        readonly kind: 'sent';
+        readonly challengeId: string;
+        readonly maskedEmailHint: string;
+        readonly expiresAtMs: number;
+        readonly resendAvailableAtMs: number;
+    } | {
+        readonly kind: 'refused';
+        readonly code: string;
+        readonly message: string;
+    }>;
+    verifyChallengeV1(input: {
+        readonly session: LinkedDeviceSessionRecordV1;
+        readonly approval: LinkedDeviceApprovalV1;
+        readonly preparation: LinkedDeviceTargetPreparationV1;
+        readonly challengeId: string;
+        readonly otpCode: string;
+        readonly requestedAtMs: number;
+    }): Promise<{
+        readonly kind: 'verified';
+        readonly grant: LinkedDeviceEmailOtpVerificationGrantV1;
+        readonly factorRelease: LinkedDeviceEmailOtpFactorReleaseEnvelopeV1 | null;
+    } | {
+        readonly kind: 'refused';
+        readonly code: string;
+        readonly message: string;
+    }>;
+    private verifyNewEnrollmentChallengeV1;
+    verifyRegistrationGrantV1(input: Parameters<LinkedDeviceEmailOtpGrantRegistrationPortV1['verifyRegistrationGrantV1']>[0]): Promise<{
+        readonly kind: 'verified';
+        readonly grant: VerifiedLinkedDeviceEmailOtpGrantV1;
+    } | {
+        readonly kind: 'rejected';
+        readonly message: string;
+    }>;
+    buildCompletionStatementsV1(input: Parameters<LinkedDeviceEmailOtpGrantRegistrationPortV1['buildCompletionStatementsV1']>[0]): Promise<readonly import("../../../cloudflare-adaptor").D1PreparedStatementLike[]>;
+    private resolveChallengeContextV1;
+    private listEligibleBaseFactorsV1;
+    private resolveBaseFactorV1;
+}
+export declare function linkedDeviceEmailOtpGrantRegistrationPortV1(provider: D1LinkedDeviceEmailOtpTargetFactorV1): LinkedDeviceEmailOtpGrantRegistrationPortV1;
+//# sourceMappingURL=d1LinkedDeviceEmailOtpTargetFactor.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceManagementService.d.ts

@@ -0,0 +1,22 @@
+import type { TenantId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
+import type { AuthorizationService } from '../../../../authorization/service';
+import type { D1WalletAuthMethodStore } from '../../../../core/d1WalletAuthMethodStore';
+import { LinkedDeviceManagementServiceV1 } from '../../../../core/deviceLinking/linkedDeviceManagement';
+import type { OrdinaryInactiveSignerMaterialDeactivationPortV1 } from '../../../../core/signingMaterial/ordinaryInactiveSignerMaterialReservation';
+import { D1WalletAuthorityStore, type D1WalletAuthorityStoreScope } from '../wallet/d1WalletAuthorityStore';
+import { CloudflareD1WebAuthnStore } from '../webauthn/d1WebAuthnStore';
+import type { CloudflareD1AuthorizationStore } from '../authorization/d1AuthorizationStore';
+import type { CloudflareD1EmailOtpEnrollmentStore } from '../emailOtp/d1EmailOtpEnrollmentStore';
+export declare function createD1LinkedDeviceManagementServiceV1(input: {
+    readonly scope: D1WalletAuthorityStoreScope;
+    readonly tenantId: TenantId;
+    readonly authorityStore: D1WalletAuthorityStore;
+    readonly authMethodStore: D1WalletAuthMethodStore;
+    readonly authorizationService: AuthorizationService;
+    readonly walletSessionAuthorizations: Pick<CloudflareD1AuthorizationStore, 'readActiveWalletSessionAuthorizationV2ByIdentity' | 'prepareRetireWalletSessionAuthorizationsV2ForAuthority'>;
+    readonly webAuthnStore: CloudflareD1WebAuthnStore;
+    /** Absent when Email OTP is not deployed; an email_otp method then fails closed. */
+    readonly emailOtpEnrollments?: Pick<CloudflareD1EmailOtpEnrollmentStore, 'readEnrollment'>;
+    readonly materialDeactivation?: OrdinaryInactiveSignerMaterialDeactivationPortV1;
+}): LinkedDeviceManagementServiceV1;
+//# sourceMappingURL=d1LinkedDeviceManagementService.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceOwnerAuthorizationProvider.d.ts

@@ -0,0 +1,80 @@
+import type { LinkedDeviceOwnerAuthorizationSourceV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
+import { type DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
+import type { WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
+import type { D1WalletStore } from '../../../../core/d1WalletStore';
+import type { D1WalletAuthMethodStore } from '../../../../core/d1WalletAuthMethodStore';
+import type { RouterApiWalletRegistrationService } from '../../../framework/authServicePort';
+import type { LinkedDeviceOwnerAuthorizationPortV1, LinkedDeviceSourceKeyManifestDigestsV1 } from '../../../../core/deviceLinking/linkedDeviceSession';
+import type { DeviceLinkingOwnerAuthorizationRouteServiceV1, DeviceLinkingOwnerWalletSessionContextV1 } from '../../../../router/transport/fetch/routes/deviceLinkingOwnerAuthorization';
+import type { LinkedDeviceOwnerSourceChildResolutionRequestV1, LinkedDeviceOwnerSourceChildResolutionV1, LinkedDeviceOwnerSourceChildResolverV1, D1LinkedDeviceTargetPlannerOptionsV1, D1LinkedDeviceTargetPlannerV1 } from './d1LinkedDeviceTargetPlanner';
+import { type VerifiedLinkSourceReadV1 } from './d1LinkedDeviceVerifiedLinkBuilder';
+import type { D1LinkedDeviceSessionStoreV1 } from './d1LinkedDeviceSessionStore';
+import type { ExactAdministeredSignerManifestV1, ExactAdministeredSignerV1 } from '../../../../../../shared-ts/src/device-linking/delegatedActivationPlan';
+export type D1LinkedDeviceOwnerAuthorizationMetadataV1 = {
+    readonly walletId: WalletId;
+    readonly ownerAuthorization: LinkedDeviceOwnerAuthorizationSourceV1;
+    readonly expiresAtMs: number;
+};
+export type D1LinkedDeviceVerifiedOwnerSourceFactsV1 = {
+    readonly signerManifest: ExactAdministeredSignerManifestV1;
+    readonly keyManifestDigestsB64u: LinkedDeviceSourceKeyManifestDigestsV1;
+    /** The authority digest at read time - rotation advances it, identity does not. */
+    readonly sourceAuthorityDigestB64u: DigestB64u;
+};
+/**
+ * D1 supplies the authenticated session and exact source-lane projection. The
+ * provider validates those facts against the active V2 authority and signers;
+ * no link-specific planning record is created.
+ */
+export type D1LinkedDeviceOwnerAuthorizationMetadataSourceV1 = {
+    readVerifiedOwnerSourceFactsV1(input: {
+        readonly walletId: WalletId;
+        readonly walletSessionId: string;
+        readonly authorizationId: string;
+        readonly requestedAtMs: number;
+    }): Promise<D1LinkedDeviceVerifiedOwnerSourceFactsV1>;
+    readApprovedOwnerContextV1(input: {
+        readonly walletId: WalletId;
+        readonly linkSessionId: string;
+        readonly keyFamily: ExactAdministeredSignerV1['keyFamily'];
+    }): Promise<DeviceLinkingOwnerWalletSessionContextV1 | null>;
+    readOwnerSourceChildV1(input: {
+        readonly owner: DeviceLinkingOwnerWalletSessionContextV1;
+        readonly request: LinkedDeviceOwnerSourceChildResolutionRequestV1;
+    }): Promise<LinkedDeviceOwnerSourceChildResolutionV1 | null>;
+};
+export type D1LinkedDeviceOwnerSourceChildReaderV1 = Pick<D1LinkedDeviceOwnerAuthorizationMetadataSourceV1, 'readOwnerSourceChildV1'>;
+export type D1LinkedDeviceOwnerSourceChildReaderOptionsV1 = {
+    readonly walletAuthMethodStore: Pick<D1WalletAuthMethodStore, 'listForWalletV2'>;
+    readonly walletStore: Pick<D1WalletStore, 'listEd25519SignersForWallet' | 'listEcdsaSignersForWallet'>;
+};
+/** Builds authoritative source-child facts directly from the wallet stores. */
+export declare function createD1LinkedDeviceOwnerSourceChildReaderV1(options: D1LinkedDeviceOwnerSourceChildReaderOptionsV1): D1LinkedDeviceOwnerSourceChildReaderV1;
+export type D1LinkedDeviceOwnerAuthorizationMetadataSourceOptionsV1 = {
+    readonly sessionStore: Pick<D1LinkedDeviceSessionStoreV1, 'getSessionV1'>;
+    readonly readVerifiedSourceV1: (input: {
+        readonly walletId: WalletId;
+        readonly walletSessionId: string;
+        readonly authorizationId: string;
+        readonly keyFamily: ExactAdministeredSignerV1['keyFamily'];
+        readonly requestedAtMs: number;
+    }) => Promise<VerifiedLinkSourceReadV1>;
+    readonly readOwnerSourceChildV1: D1LinkedDeviceOwnerAuthorizationMetadataSourceV1['readOwnerSourceChildV1'];
+    readonly nowV1?: () => number;
+};
+/** Rehydrates the request-scoped owner context from link approval and D1. */
+export declare function createD1LinkedDeviceOwnerAuthorizationMetadataSourceV1(options: D1LinkedDeviceOwnerAuthorizationMetadataSourceOptionsV1): D1LinkedDeviceOwnerAuthorizationMetadataSourceV1;
+export type D1LinkedDeviceOwnerAuthorizationProviderOptionsV1 = {
+    readonly walletRegistration: Pick<RouterApiWalletRegistrationService, 'resolveActiveOwnerWalletExecutionLane'>;
+    readonly metadata: D1LinkedDeviceOwnerAuthorizationMetadataSourceV1;
+    readonly targetPlanner: Pick<D1LinkedDeviceTargetPlannerOptionsV1, 'preparationTtlMs' | 'targetPasskeyRpId'>;
+    readonly nowV1?: () => number;
+};
+export type D1LinkedDeviceOwnerAuthorizationProviderV1 = {
+    readonly ownerAuthorization: LinkedDeviceOwnerAuthorizationPortV1;
+    readonly ownerAuthorizationRoute: DeviceLinkingOwnerAuthorizationRouteServiceV1;
+    readonly ownerSourceResolver: LinkedDeviceOwnerSourceChildResolverV1;
+    readonly targetPlanner: D1LinkedDeviceTargetPlannerV1;
+};
+export declare function createD1LinkedDeviceOwnerAuthorizationProviderV1(options: D1LinkedDeviceOwnerAuthorizationProviderOptionsV1): D1LinkedDeviceOwnerAuthorizationProviderV1;
+//# sourceMappingURL=d1LinkedDeviceOwnerAuthorizationProvider.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRequestProofNonceStore.d.ts

@@ -0,0 +1,29 @@
+import { type LinkDeviceSessionId } from '../../../../../../shared-ts/src/signing-lanes/ids';
+import { type DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
+import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
+import type { LinkedDeviceRequestProofNonceStoreV1 } from '../../../../core/deviceLinking/requestProof';
+import type { D1LinkedDeviceSessionScopeV1 } from './d1LinkedDeviceSessionStore';
+export type D1LinkedDeviceRequestProofNonceStoreOptionsV1 = {
+    readonly database: D1DatabaseLike;
+    readonly scope: D1LinkedDeviceSessionScopeV1;
+};
+export declare class D1LinkedDeviceRequestProofNonceStoreV1 implements LinkedDeviceRequestProofNonceStoreV1 {
+    private readonly database;
+    private readonly scope;
+    constructor(options: D1LinkedDeviceRequestProofNonceStoreOptionsV1);
+    consumeRequestProofNonceV1(input: {
+        readonly linkSessionId: LinkDeviceSessionId;
+        readonly requestNonceB64u: string;
+        readonly proofDigestB64u: DigestB64u;
+        readonly issuedAtMs: number;
+        readonly expiresAtMs: number;
+        readonly consumedAtMs: number;
+    }): Promise<{
+        readonly outcome: 'consumed';
+    } | {
+        readonly outcome: 'already_used';
+    }>;
+    private pruneExpiredNoncesV1;
+    private readNonceV1;
+}
+//# sourceMappingURL=d1LinkedDeviceRequestProofNonceStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRouteService.d.ts

@@ -0,0 +1,17 @@
+import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
+import type { DeviceLinkingAuthDeniedV1, DeviceLinkingAuthenticatedRequestV1, DeviceLinkingOwnerRequestInputV1, DeviceLinkingRouteServiceV1 } from '../../../../router/transport/fetch/routes/deviceLinking';
+import type { LinkedDeviceOwnerAuthorizationPortV1 } from '../../../../core/deviceLinking/linkedDeviceSession';
+import { type D1LinkedDeviceSessionScopeV1 } from './d1LinkedDeviceSessionStore';
+export type D1LinkedDeviceRouteServiceOptionsV1 = {
+    readonly database: D1DatabaseLike;
+    readonly scope: D1LinkedDeviceSessionScopeV1;
+    readonly ownerAuthorization: LinkedDeviceOwnerAuthorizationPortV1;
+    readonly emailOtpTargetFactor?: DeviceLinkingRouteServiceV1['emailOtpTargetFactor'];
+    readonly authenticateOwnerRequestV1: (input: DeviceLinkingOwnerRequestInputV1) => Promise<DeviceLinkingAuthenticatedRequestV1 | DeviceLinkingAuthDeniedV1>;
+    readonly targetCredential: DeviceLinkingRouteServiceV1['targetCredential'];
+    readonly installationReceipt?: DeviceLinkingRouteServiceV1['installationReceipt'];
+    readonly sourceContributionRouter?: DeviceLinkingRouteServiceV1['sourceContributionRouter'];
+    readonly nowV1?: () => number;
+};
+export declare function createD1LinkedDeviceRouteServiceV1(options: D1LinkedDeviceRouteServiceOptionsV1): DeviceLinkingRouteServiceV1;
+//# sourceMappingURL=d1LinkedDeviceRouteService.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionRecords.d.ts

@@ -0,0 +1,37 @@
+import { type LinkedDeviceSessionRecordV1 } from '../../../../core/deviceLinking/linkedDeviceSession';
+import { type DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
+export type D1LinkedDeviceSessionRowV1 = {
+    readonly link_session_id?: unknown;
+    readonly link_public_key_b64u?: unknown;
+    readonly device_public_key_b64u?: unknown;
+    readonly state?: unknown;
+    readonly record_json?: unknown;
+    readonly revision?: unknown;
+    readonly expires_at_ms?: unknown;
+    readonly claim_expires_at_ms?: unknown;
+    readonly claim_digest_b64u?: unknown;
+    readonly approval_digest_b64u?: unknown;
+    readonly authority_id?: unknown;
+    readonly package_set_digest_b64u?: unknown;
+    readonly created_at_ms?: unknown;
+    readonly updated_at_ms?: unknown;
+};
+export type D1LinkedDeviceSessionTranscriptRowV1 = {
+    readonly transcript_kind?: unknown;
+    readonly digest_b64u?: unknown;
+    readonly transcript_json?: unknown;
+    readonly created_at_ms?: unknown;
+};
+export type ParsedD1LinkedDeviceSessionRowV1 = {
+    readonly record: LinkedDeviceSessionRecordV1;
+    readonly claimDigestB64u: DigestB64u | null;
+    readonly approvalDigestB64u: DigestB64u | null;
+};
+export declare function parseD1LinkedDeviceSessionRowV1(row: D1LinkedDeviceSessionRowV1): ParsedD1LinkedDeviceSessionRowV1;
+export declare function parseD1LinkedDeviceSessionTranscriptRowV1(row: D1LinkedDeviceSessionTranscriptRowV1): {
+    readonly kind: 'claim' | 'approval' | 'source_contribution';
+    readonly digestB64u: DigestB64u;
+    readonly transcriptJson: unknown;
+    readonly createdAtMs: number;
+};
+//# sourceMappingURL=d1LinkedDeviceSessionRecords.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionService.d.ts

@@ -0,0 +1,12 @@
+import type { LinkedDeviceOwnerAuthorizationPortV1, LinkedDeviceSessionServiceV1 } from '../../../../core/deviceLinking/linkedDeviceSession';
+import type { D1LinkedDeviceSessionStoreV1 } from './d1LinkedDeviceSessionStore';
+export type D1LinkedDeviceSessionServiceOptionsV1 = {
+    readonly sessionStore: D1LinkedDeviceSessionStoreV1;
+    readonly ownerAuthorization: LinkedDeviceOwnerAuthorizationPortV1;
+};
+export type D1LinkedDeviceSessionServiceCompositionV1 = {
+    readonly sessionService: LinkedDeviceSessionServiceV1;
+    readonly sessionStore: D1LinkedDeviceSessionStoreV1;
+};
+export declare function createD1LinkedDeviceSessionServiceV1(options: D1LinkedDeviceSessionServiceOptionsV1): D1LinkedDeviceSessionServiceCompositionV1;
+//# sourceMappingURL=d1LinkedDeviceSessionService.d.ts.map