@seams/wallet-server 0.5.0

package/migrations/d1-signer/0003_r107_wallet_authorization.sql

@@ -0,0 +1,299 @@
+CREATE TABLE verified_wallet_operation_evidence_sets (
+  namespace TEXT NOT NULL,
+  tenant_id TEXT NOT NULL,
+  evidence_set_id TEXT NOT NULL,
+  principal_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL,
+  authority_digest TEXT NOT NULL,
+  request_origin TEXT NOT NULL,
+  audience TEXT NOT NULL,
+  evidence_set_digest TEXT NOT NULL,
+  evidence_json TEXT NOT NULL,
+  capability_kind TEXT NOT NULL,
+  operation_kind TEXT NOT NULL,
+  lane_digest TEXT NOT NULL,
+  intent_digest TEXT NOT NULL,
+  display_digest TEXT NOT NULL,
+  assurance TEXT NOT NULL,
+  verified_at_ms INTEGER NOT NULL,
+  expires_at_ms INTEGER NOT NULL,
+  PRIMARY KEY (namespace, tenant_id, evidence_set_id),
+  UNIQUE (namespace, tenant_id, evidence_set_digest),
+  CHECK (json_valid(evidence_json)),
+  CHECK (assurance = 'step_up'),
+  CHECK (expires_at_ms > verified_at_ms),
+  CHECK (
+    (capability_kind = 'near_ed25519_mpc_signing'
+      AND operation_kind IN (
+        'near.sign_transaction',
+        'near.sign_delegate_action',
+        'near.sign_nep413_message',
+        'near.export_key'
+      ))
+    OR (capability_kind = 'evm_ecdsa_mpc_signing'
+      AND operation_kind IN ('evm.sign_transaction', 'evm.export_key'))
+    OR (capability_kind = 'vault_access'
+      AND operation_kind IN ('vault.proxy_use', 'vault.reveal'))
+  )
+);
+
+CREATE TABLE verified_owner_proof_consumptions (
+  namespace TEXT NOT NULL,
+  tenant_id TEXT NOT NULL,
+  proof_id TEXT NOT NULL,
+  purpose TEXT NOT NULL,
+  method TEXT NOT NULL,
+  principal_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL,
+  authority_digest TEXT NOT NULL,
+  replay_identity TEXT NOT NULL,
+  consumption_scope_id TEXT NOT NULL,
+  consumed_at_ms INTEGER NOT NULL,
+  PRIMARY KEY (namespace, tenant_id, proof_id),
+  UNIQUE (namespace, tenant_id, replay_identity),
+  CHECK (purpose IN ('wallet_session', 'operation')),
+  CHECK (method IN ('passkey', 'email_otp')),
+  CHECK (consumed_at_ms > 0)
+);
+
+CREATE INDEX idx_verified_wallet_operation_evidence_expiry
+  ON verified_wallet_operation_evidence_sets(namespace, tenant_id, expires_at_ms);
+
+CREATE TABLE opaque_wallet_session_tokens (
+  namespace TEXT NOT NULL,
+  tenant_id TEXT NOT NULL,
+  token_hash TEXT NOT NULL,
+  curve TEXT NOT NULL,
+  wallet_session_id TEXT NOT NULL,
+  binding_json TEXT NOT NULL,
+  PRIMARY KEY (namespace, tenant_id, token_hash),
+  UNIQUE (namespace, tenant_id, wallet_session_id, curve),
+  FOREIGN KEY (namespace, tenant_id, wallet_session_id)
+    REFERENCES reusable_wallet_sessions(namespace, tenant_id, wallet_session_id),
+  CHECK (curve IN ('ecdsa', 'ed25519')),
+  CHECK (json_valid(binding_json))
+);
+
+DROP TRIGGER authorized_operation_step_up_claim_atomic;
+
+CREATE TRIGGER authorized_operation_step_up_claim_atomic
+AFTER INSERT ON authorized_operations
+WHEN NEW.lifecycle_kind = 'claimed'
+  AND NEW.authorization_source_kind = 'verified_step_up'
+BEGIN
+  SELECT CASE
+    WHEN NOT EXISTS (
+        SELECT 1
+          FROM verified_wallet_operation_evidence_sets AS evidence
+         WHERE evidence.namespace = NEW.namespace
+           AND evidence.tenant_id = NEW.tenant_id
+           AND evidence.evidence_set_digest = NEW.evidence_set_digest
+           AND evidence.principal_id = NEW.principal_id
+           AND evidence.capability_kind = NEW.capability_kind
+           AND evidence.operation_kind = NEW.operation_kind
+           AND evidence.lane_digest = NEW.lane_digest
+           AND evidence.intent_digest = NEW.intent_digest
+           AND evidence.display_digest = NEW.display_digest
+           AND evidence.assurance = 'step_up'
+           AND evidence.expires_at_ms > NEW.claimed_at_ms
+      )
+    THEN RAISE(ABORT, 'authorization_evidence_claim_rejected')
+  END;
+END;
+
+DROP TRIGGER trg_hosted_wallet_exchange_create_target_session;
+DROP TABLE hosted_wallet_session_exchange_codes;
+
+CREATE TABLE hosted_wallet_session_exchange_codes (
+  namespace TEXT NOT NULL,
+  tenant_id TEXT NOT NULL,
+  exchange_code_id TEXT NOT NULL,
+  wallet_session_id TEXT NOT NULL,
+  code_hash TEXT NOT NULL,
+  nonce_digest TEXT NOT NULL,
+  app_origin TEXT NOT NULL,
+  wallet_origin TEXT NOT NULL,
+  lifecycle_kind TEXT NOT NULL,
+  issued_at_ms INTEGER NOT NULL,
+  expires_at_ms INTEGER NOT NULL,
+  token_hash TEXT,
+  curve TEXT,
+  binding_json TEXT,
+  consumed_at_ms INTEGER,
+  PRIMARY KEY (namespace, tenant_id, exchange_code_id),
+  UNIQUE (namespace, code_hash),
+  FOREIGN KEY (namespace, tenant_id, wallet_session_id)
+    REFERENCES reusable_wallet_sessions(namespace, tenant_id, wallet_session_id),
+  CHECK (lifecycle_kind IN ('issued', 'consumed')),
+  CHECK (curve IN ('ecdsa', 'ed25519')),
+  CHECK (json_valid(binding_json)),
+  CHECK (expires_at_ms > issued_at_ms),
+  CHECK (
+    (lifecycle_kind = 'issued'
+      AND token_hash IS NULL
+      AND curve IS NOT NULL
+      AND binding_json IS NOT NULL
+      AND consumed_at_ms IS NULL)
+    OR (lifecycle_kind = 'consumed'
+      AND token_hash IS NOT NULL
+      AND curve IS NOT NULL
+      AND binding_json IS NOT NULL
+      AND consumed_at_ms IS NOT NULL)
+  )
+);
+
+CREATE INDEX idx_hosted_wallet_session_exchange_expiry
+  ON hosted_wallet_session_exchange_codes(namespace, tenant_id, expires_at_ms);
+
+CREATE TRIGGER hosted_wallet_session_exchange_mint_token
+AFTER UPDATE OF lifecycle_kind ON hosted_wallet_session_exchange_codes
+WHEN OLD.lifecycle_kind = 'issued' AND NEW.lifecycle_kind = 'consumed'
+BEGIN
+  INSERT INTO opaque_wallet_session_tokens (
+    namespace,
+    tenant_id,
+    token_hash,
+    curve,
+    wallet_session_id,
+    binding_json
+  ) VALUES (
+    NEW.namespace,
+    NEW.tenant_id,
+    NEW.token_hash,
+    NEW.curve,
+    NEW.wallet_session_id,
+    NEW.binding_json
+  );
+END;
+
+DROP TABLE verified_grant_evidence_sets;
+DROP TABLE authorization_sessions;
+DROP TABLE IF EXISTS app_session_versions;
+DROP TABLE IF EXISTS google_email_otp_session_exchange_journals;
+DROP TABLE ecdsa_authorization_atomic_guards;
+DROP TABLE email_otp_recovery_wrapped_enrollment_escrows;
+
+ALTER TABLE email_otp_challenges RENAME TO email_otp_challenges_r106;
+
+CREATE TABLE email_otp_challenges (
+  namespace TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  project_id TEXT NOT NULL,
+  env_id TEXT NOT NULL,
+  challenge_id TEXT NOT NULL,
+  challenge_subject_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL,
+  record_org_id TEXT NOT NULL,
+  otp_channel TEXT NOT NULL,
+  owner_proof_binding_digest TEXT NOT NULL,
+  action TEXT NOT NULL,
+  operation TEXT NOT NULL,
+  otp_code TEXT NOT NULL,
+  record_json TEXT NOT NULL,
+  created_at_ms INTEGER NOT NULL,
+  expires_at_ms INTEGER NOT NULL,
+  PRIMARY KEY (namespace, org_id, project_id, env_id, challenge_id),
+  CHECK (length(namespace) > 0),
+  CHECK (length(org_id) > 0),
+  CHECK (length(project_id) > 0),
+  CHECK (length(env_id) > 0),
+  CHECK (length(challenge_id) > 0),
+  CHECK (length(challenge_subject_id) > 0),
+  CHECK (length(wallet_id) > 0),
+  CHECK (length(record_org_id) > 0),
+  CHECK (otp_channel = 'email_otp'),
+  CHECK (length(owner_proof_binding_digest) > 0),
+  CHECK (
+    action IN (
+      'wallet_email_otp_login',
+      'wallet_email_otp_registration',
+      'wallet_email_otp_device_recovery'
+    )
+  ),
+  CHECK (operation IN ('wallet_unlock', 'transaction_sign', 'export_key', 'registration')),
+  CHECK (length(otp_code) > 0),
+  CHECK (json_valid(record_json)),
+  CHECK (created_at_ms > 0),
+  CHECK (expires_at_ms > created_at_ms),
+  CHECK (COALESCE(json_extract(record_json, '$.version') = 'email_otp_challenge_v1', 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.challengeId') = challenge_id, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.challengeSubjectId') = challenge_subject_id, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.walletId') = wallet_id, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.orgId') = record_org_id, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.otpChannel') = otp_channel, 0)),
+  CHECK (
+    COALESCE(json_extract(record_json, '$.ownerProofBindingDigest') = owner_proof_binding_digest, 0)
+  ),
+  CHECK (COALESCE(json_extract(record_json, '$.action') = action, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.operation') = operation, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.otpCode') = otp_code, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.createdAtMs') = created_at_ms, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.expiresAtMs') = expires_at_ms, 0))
+);
+
+DROP TABLE email_otp_challenges_r106;
+
+CREATE INDEX email_otp_challenges_context_idx
+  ON email_otp_challenges (
+    namespace, org_id, project_id, env_id, challenge_subject_id, wallet_id,
+    record_org_id, otp_channel, owner_proof_binding_digest, action, operation,
+    expires_at_ms, created_at_ms
+  );
+CREATE INDEX email_otp_challenges_expires_idx
+  ON email_otp_challenges (namespace, org_id, project_id, env_id, expires_at_ms);
+
+DROP TABLE email_otp_registration_attempts;
+
+CREATE TABLE email_otp_registration_attempts (
+  namespace TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  project_id TEXT NOT NULL,
+  env_id TEXT NOT NULL,
+  attempt_id TEXT NOT NULL,
+  provider_subject TEXT NOT NULL,
+  email TEXT NOT NULL,
+  wallet_id TEXT NOT NULL,
+  state TEXT NOT NULL,
+  owner_proof_binding_digest TEXT NOT NULL,
+  runtime_org_id TEXT NOT NULL,
+  runtime_policy_key TEXT NOT NULL,
+  offer_wallet_ids_json TEXT NOT NULL,
+  record_json TEXT NOT NULL,
+  created_at_ms INTEGER NOT NULL,
+  updated_at_ms INTEGER NOT NULL,
+  expires_at_ms INTEGER NOT NULL,
+  PRIMARY KEY (namespace, org_id, project_id, env_id, attempt_id),
+  CHECK (length(attempt_id) > 0),
+  CHECK (length(provider_subject) > 0),
+  CHECK (length(email) > 0),
+  CHECK (length(wallet_id) > 0),
+  CHECK (state IN ('started', 'key_finalized', 'active', 'abandoned', 'failed', 'expired')),
+  CHECK (length(owner_proof_binding_digest) > 0),
+  CHECK (json_valid(offer_wallet_ids_json)),
+  CHECK (json_valid(record_json)),
+  CHECK (created_at_ms > 0),
+  CHECK (updated_at_ms >= created_at_ms),
+  CHECK (expires_at_ms > created_at_ms),
+  CHECK (COALESCE(json_extract(record_json, '$.version') = 'google_email_otp_registration_attempt_v1', 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.attemptId') = attempt_id, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.providerSubject') = provider_subject, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.email') = email, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.walletId') = wallet_id, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.state') = state, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.ownerProofBindingDigest') = owner_proof_binding_digest, 0)),
+  CHECK (runtime_org_id = '' OR COALESCE(json_extract(record_json, '$.runtimePolicyScope.orgId') = runtime_org_id, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.createdAtMs') = created_at_ms, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.updatedAtMs') = updated_at_ms, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.expiresAtMs') = expires_at_ms, 0))
+);
+
+CREATE INDEX email_otp_registration_attempts_subject_idx
+  ON email_otp_registration_attempts (
+    namespace, org_id, project_id, env_id, provider_subject, email, state,
+    expires_at_ms, owner_proof_binding_digest, runtime_org_id, runtime_policy_key,
+    updated_at_ms
+  );
+CREATE INDEX email_otp_registration_attempts_wallet_idx
+  ON email_otp_registration_attempts (
+    namespace, org_id, project_id, env_id, wallet_id, state, expires_at_ms
+  );

package/migrations/d1-signer/0004_remove_legacy_email_recovery.sql

@@ -0,0 +1,14 @@
+-- Refactor 130A: remove the retired DKIM/Outlayer recovery state.
+-- Historical migrations remain immutable; this forward migration removes only
+-- tables that no supported runtime path reads or writes.
+DROP INDEX IF EXISTS email_recovery_preparations_account_idx;
+DROP INDEX IF EXISTS email_recovery_preparations_expires_idx;
+DROP TABLE IF EXISTS email_recovery_preparations;
+
+DROP INDEX IF EXISTS recovery_executions_session_idx;
+DROP INDEX IF EXISTS recovery_executions_status_idx;
+DROP TABLE IF EXISTS recovery_executions;
+
+DROP INDEX IF EXISTS recovery_sessions_expiry_idx;
+DROP INDEX IF EXISTS recovery_sessions_near_account_idx;
+DROP TABLE IF EXISTS recovery_sessions;

package/migrations/d1-signer/0005_r103p8_linked_owner_auth_bindings.sql

@@ -0,0 +1,92 @@
+-- Refactor 103 Phase 8: bind each linked-device enrollment to the canonical
+-- owner auth method it created.
+--
+-- Device 2 becomes an ordinary owner credential, so device management, unlock,
+-- Wallet Session issuance, and revocation all need to resolve one exact
+-- `wallet_auth_methods` row from one exact enrollment. The foreign key makes
+-- that resolution a schema guarantee rather than a nearest-match join, and the
+-- unique indexes make "one device, one owner credential, one enrollment"
+-- unrepresentable in the other direction too.
+--
+-- The identity CHECKs mirror `wallet_auth_methods` exactly: the same derived
+-- `wallet_auth_method_id` format, the same mutually exclusive Passkey and
+-- Email OTP columns. A row that names one credential and points at another
+-- cannot be written.
+CREATE TABLE linked_device_owner_auth_bindings (
+  namespace TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  project_id TEXT NOT NULL,
+  env_id TEXT NOT NULL,
+  tenant_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL,
+  enrollment_id TEXT NOT NULL,
+  device_id TEXT NOT NULL,
+  wallet_auth_method_id TEXT NOT NULL,
+  factor_kind TEXT NOT NULL,
+  rp_id TEXT,
+  credential_id_b64u TEXT,
+  email_hash_hex TEXT,
+  registration_authority_id TEXT,
+  key_manifest_digest_b64u TEXT NOT NULL,
+  lifecycle_state TEXT NOT NULL,
+  revocation_epoch INTEGER NOT NULL,
+  record_json TEXT NOT NULL,
+  created_at_ms INTEGER NOT NULL,
+  updated_at_ms INTEGER NOT NULL,
+  PRIMARY KEY (namespace, org_id, project_id, env_id, enrollment_id),
+  FOREIGN KEY (namespace, org_id, project_id, env_id, wallet_auth_method_id)
+    REFERENCES wallet_auth_methods(namespace, org_id, project_id, env_id, wallet_auth_method_id),
+  CHECK (length(tenant_id) > 0),
+  CHECK (length(wallet_id) > 0),
+  CHECK (length(enrollment_id) > 0),
+  CHECK (length(device_id) > 0),
+  CHECK (length(wallet_auth_method_id) > 0),
+  CHECK (length(key_manifest_digest_b64u) > 0),
+  CHECK (factor_kind IN ('passkey', 'email_otp')),
+  CHECK (lifecycle_state IN ('active', 'paused', 'revoked')),
+  CHECK (revocation_epoch >= 0),
+  CHECK (lifecycle_state <> 'revoked' OR revocation_epoch >= 1),
+  CHECK (json_valid(record_json)),
+  CHECK (created_at_ms > 0),
+  CHECK (updated_at_ms >= created_at_ms),
+  CHECK (COALESCE(json_extract(record_json, '$.kind') = 'linked_device_owner_auth_binding_v1', 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.walletId') = wallet_id, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.enrollmentId') = enrollment_id, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.deviceId') = device_id, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.walletAuthMethodId') = wallet_auth_method_id, 0)),
+  CHECK (
+    (
+      factor_kind = 'passkey'
+      AND rp_id IS NOT NULL
+      AND length(rp_id) > 0
+      AND credential_id_b64u IS NOT NULL
+      AND length(credential_id_b64u) > 0
+      AND email_hash_hex IS NULL
+      AND registration_authority_id IS NULL
+      AND wallet_auth_method_id = 'passkey:' || rp_id || ':' || credential_id_b64u
+    )
+    OR
+    (
+      factor_kind = 'email_otp'
+      AND rp_id IS NULL
+      AND credential_id_b64u IS NULL
+      AND email_hash_hex IS NOT NULL
+      AND length(email_hash_hex) > 0
+      AND registration_authority_id IS NOT NULL
+      AND length(registration_authority_id) > 0
+      AND wallet_auth_method_id = 'email_otp:' || wallet_id || ':' || email_hash_hex
+    )
+  )
+);
+
+-- One owner credential per linked device, and one linked device per owner
+-- credential. Device management fails closed on a duplicate rather than
+-- choosing between two cards that claim the same credential.
+CREATE UNIQUE INDEX linked_device_owner_auth_bindings_device_idx
+  ON linked_device_owner_auth_bindings (namespace, org_id, project_id, env_id, wallet_id, device_id);
+
+CREATE UNIQUE INDEX linked_device_owner_auth_bindings_method_idx
+  ON linked_device_owner_auth_bindings (namespace, org_id, project_id, env_id, wallet_id, wallet_auth_method_id);
+
+CREATE INDEX linked_device_owner_auth_bindings_wallet_idx
+  ON linked_device_owner_auth_bindings (namespace, org_id, project_id, env_id, wallet_id, lifecycle_state);

package/migrations/d1-signer/0006_r103p8_linked_device_custody_transfers.sql

@@ -0,0 +1,77 @@
+-- Refactor 103 Phase 8: the relay row for one cross-device custody transfer.
+--
+-- Device 2 publishes the recipient key it will decapsulate with, and Device 1
+-- returns the seed sealed to that key. Neither half is a secret — the private
+-- half never leaves Device 2's custody module — so this table stores public
+-- routing facts and opaque ciphertext.
+--
+-- One row per link session, matching `linked_device_target_credentials`, with
+-- the same two-state shape: a row is `recipient_registered` until the sealed
+-- package lands, and `sealed` afterwards. The CHECK makes the two column sets
+-- mutually exclusive, so a half-written transfer cannot be read as a complete
+-- one.
+--
+-- The recipient key is immutable once registered. Device 1 seals to whatever
+-- this row says, so allowing it to change after registration would let a later
+-- write redirect a seed that is already in flight.
+CREATE TABLE linked_device_custody_transfers (
+  namespace TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  project_id TEXT NOT NULL,
+  env_id TEXT NOT NULL,
+  link_session_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL,
+  enrollment_id TEXT NOT NULL,
+  device_id TEXT NOT NULL,
+  state TEXT NOT NULL,
+  transfer_alg TEXT NOT NULL,
+  recipient_public_key_b64u TEXT NOT NULL,
+  recipient_json TEXT NOT NULL,
+  package_json TEXT,
+  ephemeral_public_key_b64u TEXT,
+  ciphertext_digest_b64u TEXT,
+  registered_at_ms INTEGER NOT NULL,
+  sealed_at_ms INTEGER,
+  PRIMARY KEY (namespace, org_id, project_id, env_id, link_session_id),
+  FOREIGN KEY (namespace, org_id, project_id, env_id, link_session_id)
+    REFERENCES linked_device_sessions(namespace, org_id, project_id, env_id, link_session_id),
+  CHECK (length(wallet_id) > 0),
+  CHECK (length(enrollment_id) > 0),
+  CHECK (length(device_id) > 0),
+  CHECK (state IN ('recipient_registered', 'sealed')),
+  CHECK (transfer_alg = 'x25519-hkdf-sha256-chacha20poly1305-v1'),
+  CHECK (length(recipient_public_key_b64u) > 0),
+  CHECK (json_valid(recipient_json)),
+  CHECK (registered_at_ms > 0),
+  CHECK (
+    COALESCE(json_extract(recipient_json, '$.recipientPublicKeyB64u')
+      = recipient_public_key_b64u, 0)
+  ),
+  CHECK (
+    (state = 'recipient_registered'
+      AND package_json IS NULL
+      AND ephemeral_public_key_b64u IS NULL
+      AND ciphertext_digest_b64u IS NULL
+      AND sealed_at_ms IS NULL)
+    OR
+    (state = 'sealed'
+      AND json_valid(package_json)
+      AND length(ephemeral_public_key_b64u) > 0
+      AND length(ciphertext_digest_b64u) > 0
+      AND sealed_at_ms >= registered_at_ms
+      -- A package that names another recipient key would be addressed to a
+      -- device this row never registered.
+      AND COALESCE(json_extract(package_json, '$.recipientPublicKeyB64u')
+        = recipient_public_key_b64u, 0)
+      -- Republishing the recipient key as the ephemeral key is never a valid
+      -- seal; it means no ephemeral key was generated.
+      AND ephemeral_public_key_b64u <> recipient_public_key_b64u)
+  )
+);
+
+-- Device management and the enrollment flow both resolve a transfer by the
+-- enrollment rather than the link session, so that lookup gets its own index.
+CREATE UNIQUE INDEX linked_device_custody_transfers_enrollment_idx
+  ON linked_device_custody_transfers (
+    namespace, org_id, project_id, env_id, wallet_id, enrollment_id, device_id
+  );

package/migrations/d1-signer/0007_r103p8_wallet_session_auth_method_provenance.sql

@@ -0,0 +1,18 @@
+-- Refactor 103 Phase 8: which wallet auth method issued each Wallet Session.
+--
+-- The session already stores `authority_digest`, which proves what the
+-- authority was. Proving is not addressing: pausing or revoking one credential
+-- has to select every session that credential issued, and a digest can only be
+-- recomputed and compared one candidate auth method at a time.
+--
+-- Carrying the binding id makes that selection an indexed lookup, which is what
+-- lets a linked device be fenced through its own canonical credential instead
+-- of through a separate per-device signing lane.
+--
+-- Nullable because sessions minted before this migration have no recorded
+-- issuer. They are read back as unattributed and cannot be fenced by binding —
+-- they expire on their own clock. Every session minted from here on has one.
+ALTER TABLE reusable_wallet_sessions ADD COLUMN wallet_auth_method_id TEXT;
+
+CREATE INDEX idx_reusable_wallet_sessions_auth_method
+  ON reusable_wallet_sessions(namespace, tenant_id, wallet_id, wallet_auth_method_id);

package/migrations/d1-signer/0008_r103p8_linked_device_session_cas_guard.sql

@@ -0,0 +1,35 @@
+-- Refactor 103 Phase 8: let a link-session CAS abort someone else's batch.
+--
+-- Finalizing Device 2's owner credential and advancing its link session are two
+-- writes that must not be separable. Finalize is irreversible — one transaction
+-- registers the passkey, the custody envelope, and the owner binding — so if a
+-- cancel or an expiry won the session between the two, the wallet was left with
+-- a live owner credential belonging to a session that had already terminated.
+--
+-- Both live in this database, so the two become one D1 batch. What a batch does
+-- not give us is failure on a CAS miss: `UPDATE ... WHERE revision = ?` that
+-- matches no row is a successful statement affecting zero rows, and the
+-- credential would still commit.
+--
+-- This table is how the batch is made to fail. The session CAS is followed by
+-- an insert that only runs when the update changed nothing, and that insert
+-- always collides with the seeded row — so a lost CAS raises a constraint
+-- violation and takes the whole batch, credential included, down with it.
+--
+-- The same shape as `lane_cas_guard` and `registration_ceremony_cas_guard`;
+-- separate from them so the R103 lane teardown cannot remove a table the
+-- linked-device finalize depends on.
+CREATE TABLE IF NOT EXISTS linked_device_session_cas_guard (
+  guard_id INTEGER PRIMARY KEY CHECK (guard_id = 1)
+);
+
+INSERT OR IGNORE INTO linked_device_session_cas_guard (guard_id) VALUES (1);
+
+-- The guard is load-bearing, so it must not be emptied into uselessness: an
+-- absent row would make the guarded insert succeed and silently restore the
+-- split-brain window this migration exists to close.
+CREATE TRIGGER IF NOT EXISTS linked_device_session_cas_guard_no_delete
+BEFORE DELETE ON linked_device_session_cas_guard
+BEGIN
+  SELECT RAISE(ABORT, 'linked_device_session_cas_guard row is required');
+END;