@seams/wallet-server 0.5.0

package/migrations/d1-signer/0009_linked_device_email_otp.sql

@@ -0,0 +1,405 @@
+-- Refactor 103 Phase 6: move the target-factor and linked-owner schema changes
+-- out of the applied initial migration. The target-preparation digest changed
+-- when QR v5 added targetFactor. Pre-v5 target rows cannot be rehashed by SQL,
+-- so only already-canonical rows are carried forward; stale rows are removed
+-- with their deployment descriptors and must be started again.
+
+DROP INDEX linked_device_target_credentials_credential_idx;
+
+DELETE FROM linked_device_target_deployment_descriptors
+ WHERE EXISTS (
+   SELECT 1
+     FROM linked_device_target_credentials AS legacy
+    WHERE legacy.namespace = linked_device_target_deployment_descriptors.namespace
+      AND legacy.org_id = linked_device_target_deployment_descriptors.org_id
+      AND legacy.project_id = linked_device_target_deployment_descriptors.project_id
+      AND legacy.env_id = linked_device_target_deployment_descriptors.env_id
+      AND legacy.link_session_id = linked_device_target_deployment_descriptors.link_session_id
+      AND (
+        COALESCE(json_extract(legacy.preparation_json, '$.targetFactor.kind'), '') <> 'passkey_prf'
+        OR (
+          legacy.state = 'registered'
+          AND COALESCE(json_extract(legacy.registration_json, '$.targetFactor.kind'), '') <> 'passkey_prf'
+        )
+      )
+ );
+
+ALTER TABLE linked_device_target_credentials RENAME TO linked_device_target_credentials_legacy;
+CREATE TABLE linked_device_target_credentials_next (
+  namespace TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  project_id TEXT NOT NULL,
+  env_id TEXT NOT NULL,
+  link_session_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL,
+  enrollment_id TEXT NOT NULL,
+  device_id TEXT NOT NULL,
+  state TEXT NOT NULL,
+  target_factor TEXT NOT NULL,
+  preparation_digest_b64u TEXT NOT NULL,
+  preparation_json TEXT NOT NULL,
+  registration_json TEXT,
+  credential_id_b64u TEXT,
+  credential_public_key_b64u TEXT,
+  credential_counter INTEGER,
+  email_otp_grant_id TEXT,
+  key_manifest_digest_b64u TEXT,
+  prepared_at_ms INTEGER NOT NULL,
+  expires_at_ms INTEGER NOT NULL,
+  registered_at_ms INTEGER,
+  PRIMARY KEY (namespace, org_id, project_id, env_id, link_session_id),
+  FOREIGN KEY (namespace, org_id, project_id, env_id, link_session_id)
+    REFERENCES linked_device_sessions(namespace, org_id, project_id, env_id, link_session_id),
+  CHECK (length(wallet_id) > 0),
+  CHECK (length(enrollment_id) > 0),
+  CHECK (length(device_id) > 0),
+  CHECK (state IN ('prepared', 'registered')),
+  CHECK (target_factor IN ('passkey_prf', 'email_otp')),
+  CHECK (length(preparation_digest_b64u) > 0),
+  CHECK (json_valid(preparation_json)),
+  CHECK (COALESCE(json_extract(preparation_json, '$.targetFactor.kind') = target_factor, 0)),
+  CHECK (expires_at_ms > prepared_at_ms),
+  CHECK (
+    (state = 'prepared'
+      AND registration_json IS NULL
+      AND credential_id_b64u IS NULL
+      AND credential_public_key_b64u IS NULL
+      AND credential_counter IS NULL
+      AND email_otp_grant_id IS NULL
+      AND key_manifest_digest_b64u IS NULL
+      AND registered_at_ms IS NULL)
+    OR
+    (state = 'registered'
+      AND target_factor = 'passkey_prf'
+      AND json_valid(registration_json)
+      AND COALESCE(json_extract(registration_json, '$.targetFactor.kind') = 'passkey_prf', 0)
+      AND length(credential_id_b64u) > 0
+      AND length(credential_public_key_b64u) > 0
+      AND credential_counter >= 0
+      AND email_otp_grant_id IS NULL
+      AND length(key_manifest_digest_b64u) > 0
+      AND registered_at_ms > 0)
+    OR
+    (state = 'registered'
+      AND target_factor = 'email_otp'
+      AND json_valid(registration_json)
+      AND COALESCE(json_extract(registration_json, '$.targetFactor.kind') = 'email_otp', 0)
+      AND credential_id_b64u IS NOT NULL
+      AND length(credential_id_b64u) > 0
+      AND credential_public_key_b64u IS NULL
+      AND credential_counter IS NULL
+      AND email_otp_grant_id IS NOT NULL
+      AND length(email_otp_grant_id) > 0
+      AND length(key_manifest_digest_b64u) > 0
+      AND registered_at_ms > 0)
+  )
+);
+INSERT INTO linked_device_target_credentials_next (
+  namespace, org_id, project_id, env_id, link_session_id,
+  wallet_id, enrollment_id, device_id, state, target_factor,
+  preparation_digest_b64u, preparation_json, registration_json,
+  credential_id_b64u, credential_public_key_b64u, credential_counter,
+  email_otp_grant_id, key_manifest_digest_b64u, prepared_at_ms,
+  expires_at_ms, registered_at_ms
+)
+SELECT namespace, org_id, project_id, env_id, link_session_id,
+       wallet_id, enrollment_id, device_id, state,
+       json_extract(preparation_json, '$.targetFactor.kind'),
+       preparation_digest_b64u, preparation_json, registration_json,
+       credential_id_b64u, credential_public_key_b64u, credential_counter,
+       NULL, key_manifest_digest_b64u, prepared_at_ms, expires_at_ms,
+       registered_at_ms
+  FROM linked_device_target_credentials_legacy
+ WHERE json_extract(preparation_json, '$.targetFactor.kind') = 'passkey_prf'
+   AND (
+     state = 'prepared'
+     OR (
+       state = 'registered'
+       AND json_extract(registration_json, '$.targetFactor.kind') = 'passkey_prf'
+     )
+   );
+DROP TABLE linked_device_target_credentials_legacy;
+ALTER TABLE linked_device_target_credentials_next RENAME TO linked_device_target_credentials;
+CREATE UNIQUE INDEX linked_device_target_credentials_credential_idx
+  ON linked_device_target_credentials(
+    namespace,
+    org_id,
+    project_id,
+    env_id,
+    credential_id_b64u
+  )
+  WHERE credential_id_b64u IS NOT NULL;
+
+DROP INDEX email_otp_challenges_context_idx;
+DROP INDEX email_otp_challenges_expires_idx;
+ALTER TABLE email_otp_challenges RENAME TO email_otp_challenges_legacy;
+CREATE TABLE email_otp_challenges_next (
+  namespace TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  project_id TEXT NOT NULL,
+  env_id TEXT NOT NULL,
+  challenge_id TEXT NOT NULL,
+  challenge_subject_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL,
+  record_org_id TEXT NOT NULL,
+  otp_channel TEXT NOT NULL,
+  owner_proof_binding_digest TEXT NOT NULL,
+  action TEXT NOT NULL,
+  operation TEXT NOT NULL,
+  otp_code TEXT NOT NULL,
+  record_json TEXT NOT NULL,
+  created_at_ms INTEGER NOT NULL,
+  expires_at_ms INTEGER NOT NULL,
+  PRIMARY KEY (namespace, org_id, project_id, env_id, challenge_id),
+  CHECK (length(namespace) > 0),
+  CHECK (length(org_id) > 0),
+  CHECK (length(project_id) > 0),
+  CHECK (length(env_id) > 0),
+  CHECK (length(challenge_id) > 0),
+  CHECK (length(challenge_subject_id) > 0),
+  CHECK (length(wallet_id) > 0),
+  CHECK (length(record_org_id) > 0),
+  CHECK (otp_channel = 'email_otp'),
+  CHECK (length(owner_proof_binding_digest) > 0),
+  CHECK (
+    action IN (
+      'wallet_email_otp_login',
+      'wallet_email_otp_registration',
+      'wallet_email_otp_device_recovery',
+      'wallet_email_otp_device_link'
+    )
+  ),
+  CHECK (operation IN ('wallet_unlock', 'transaction_sign', 'export_key', 'registration', 'device_link')),
+  CHECK (length(otp_code) > 0),
+  CHECK (json_valid(record_json)),
+  CHECK (created_at_ms > 0),
+  CHECK (expires_at_ms > created_at_ms),
+  CHECK (COALESCE(json_extract(record_json, '$.version') = 'email_otp_challenge_v1', 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.challengeId') = challenge_id, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.challengeSubjectId') = challenge_subject_id, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.walletId') = wallet_id, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.orgId') = record_org_id, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.otpChannel') = otp_channel, 0)),
+  CHECK (
+    COALESCE(json_extract(record_json, '$.ownerProofBindingDigest') = owner_proof_binding_digest, 0)
+  ),
+  CHECK (COALESCE(json_extract(record_json, '$.action') = action, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.operation') = operation, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.otpCode') = otp_code, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.createdAtMs') = created_at_ms, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.expiresAtMs') = expires_at_ms, 0))
+);
+INSERT INTO email_otp_challenges_next (
+  namespace, org_id, project_id, env_id, challenge_id, challenge_subject_id,
+  wallet_id, record_org_id, otp_channel, owner_proof_binding_digest, action,
+  operation, otp_code, record_json, created_at_ms, expires_at_ms
+)
+SELECT namespace, org_id, project_id, env_id, challenge_id, challenge_subject_id,
+       wallet_id, record_org_id, otp_channel, owner_proof_binding_digest, action,
+       operation, otp_code, record_json, created_at_ms, expires_at_ms
+  FROM email_otp_challenges_legacy;
+DROP TABLE email_otp_challenges_legacy;
+ALTER TABLE email_otp_challenges_next RENAME TO email_otp_challenges;
+CREATE INDEX email_otp_challenges_context_idx
+  ON email_otp_challenges (
+    namespace, org_id, project_id, env_id, challenge_subject_id, wallet_id,
+    record_org_id, otp_channel, owner_proof_binding_digest, action, operation,
+    expires_at_ms, created_at_ms
+  );
+CREATE INDEX email_otp_challenges_expires_idx
+  ON email_otp_challenges (namespace, org_id, project_id, env_id, expires_at_ms);
+
+DROP INDEX linked_device_owner_auth_bindings_device_idx;
+DROP INDEX linked_device_owner_auth_bindings_method_idx;
+DROP INDEX linked_device_owner_auth_bindings_wallet_idx;
+ALTER TABLE linked_device_owner_auth_bindings RENAME TO linked_device_owner_auth_bindings_legacy;
+CREATE TABLE linked_device_owner_auth_bindings_next (
+  namespace TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  project_id TEXT NOT NULL,
+  env_id TEXT NOT NULL,
+  tenant_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL,
+  enrollment_id TEXT NOT NULL,
+  device_id TEXT NOT NULL,
+  wallet_auth_method_id TEXT NOT NULL,
+  base_wallet_auth_method_id TEXT NOT NULL,
+  factor_kind TEXT NOT NULL,
+  rp_id TEXT,
+  credential_id_b64u TEXT,
+  email_hash_hex TEXT,
+  registration_authority_id TEXT,
+  key_manifest_digest_b64u TEXT NOT NULL,
+  lifecycle_state TEXT NOT NULL,
+  revocation_epoch INTEGER NOT NULL,
+  record_json TEXT NOT NULL,
+  created_at_ms INTEGER NOT NULL,
+  updated_at_ms INTEGER NOT NULL,
+  PRIMARY KEY (namespace, org_id, project_id, env_id, enrollment_id),
+  FOREIGN KEY (namespace, org_id, project_id, env_id, base_wallet_auth_method_id)
+    REFERENCES wallet_auth_methods(namespace, org_id, project_id, env_id, wallet_auth_method_id),
+  CHECK (length(tenant_id) > 0),
+  CHECK (length(wallet_id) > 0),
+  CHECK (length(enrollment_id) > 0),
+  CHECK (length(device_id) > 0),
+  CHECK (length(wallet_auth_method_id) > 0),
+  CHECK (length(base_wallet_auth_method_id) > 0),
+  CHECK (length(key_manifest_digest_b64u) > 0),
+  CHECK (factor_kind IN ('passkey', 'email_otp')),
+  CHECK (lifecycle_state IN ('active', 'paused', 'revoked')),
+  CHECK (revocation_epoch >= 0),
+  CHECK (lifecycle_state <> 'revoked' OR revocation_epoch >= 1),
+  CHECK (json_valid(record_json)),
+  CHECK (created_at_ms > 0),
+  CHECK (updated_at_ms >= created_at_ms),
+  CHECK (COALESCE(json_extract(record_json, '$.kind') = 'linked_device_owner_auth_binding_v1', 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.walletId') = wallet_id, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.enrollmentId') = enrollment_id, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.deviceId') = device_id, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.walletAuthMethodId') = wallet_auth_method_id, 0)),
+  CHECK (
+    (
+      factor_kind = 'passkey'
+      AND rp_id IS NOT NULL
+      AND length(rp_id) > 0
+      AND credential_id_b64u IS NOT NULL
+      AND length(credential_id_b64u) > 0
+      AND email_hash_hex IS NULL
+      AND registration_authority_id IS NULL
+      AND wallet_auth_method_id = 'passkey:' || rp_id || ':' || credential_id_b64u
+      AND base_wallet_auth_method_id = wallet_auth_method_id
+    )
+    OR
+    (
+      factor_kind = 'email_otp'
+      AND rp_id IS NULL
+      AND credential_id_b64u IS NULL
+      AND email_hash_hex IS NOT NULL
+      AND length(email_hash_hex) > 0
+      AND registration_authority_id IS NOT NULL
+      AND length(registration_authority_id) > 0
+      AND wallet_auth_method_id = 'email_otp_linked:' || wallet_id || ':' || enrollment_id
+        || ':' || device_id || ':' || email_hash_hex
+      AND base_wallet_auth_method_id = 'email_otp:' || wallet_id || ':' || email_hash_hex
+      AND COALESCE(
+        json_extract(record_json, '$.factor.baseWalletAuthMethodId')
+          = base_wallet_auth_method_id,
+        0
+      )
+    )
+  )
+);
+INSERT INTO linked_device_owner_auth_bindings_next (
+  namespace, org_id, project_id, env_id, tenant_id, wallet_id,
+  enrollment_id, device_id, wallet_auth_method_id, base_wallet_auth_method_id,
+  factor_kind, rp_id, credential_id_b64u, email_hash_hex,
+  registration_authority_id, key_manifest_digest_b64u, lifecycle_state,
+  revocation_epoch, record_json, created_at_ms, updated_at_ms
+)
+SELECT namespace, org_id, project_id, env_id, tenant_id, wallet_id,
+       enrollment_id, device_id,
+       CASE factor_kind
+         WHEN 'passkey' THEN wallet_auth_method_id
+         ELSE 'email_otp_linked:' || wallet_id || ':' || enrollment_id || ':'
+           || device_id || ':' || email_hash_hex
+       END,
+       wallet_auth_method_id,
+       factor_kind, rp_id, credential_id_b64u, email_hash_hex,
+       registration_authority_id, key_manifest_digest_b64u, lifecycle_state,
+       revocation_epoch,
+       CASE factor_kind
+         WHEN 'passkey' THEN record_json
+         ELSE json_set(
+           record_json,
+           '$.walletAuthMethodId',
+           'email_otp_linked:' || wallet_id || ':' || enrollment_id || ':'
+             || device_id || ':' || email_hash_hex,
+           '$.factor.baseWalletAuthMethodId',
+           wallet_auth_method_id
+         )
+       END,
+       created_at_ms, updated_at_ms
+  FROM linked_device_owner_auth_bindings_legacy;
+DROP TABLE linked_device_owner_auth_bindings_legacy;
+ALTER TABLE linked_device_owner_auth_bindings_next RENAME TO linked_device_owner_auth_bindings;
+CREATE UNIQUE INDEX linked_device_owner_auth_bindings_device_idx
+  ON linked_device_owner_auth_bindings (namespace, org_id, project_id, env_id, wallet_id, device_id);
+CREATE UNIQUE INDEX linked_device_owner_auth_bindings_method_idx
+  ON linked_device_owner_auth_bindings (namespace, org_id, project_id, env_id, wallet_id, wallet_auth_method_id);
+CREATE INDEX linked_device_owner_auth_bindings_wallet_idx
+  ON linked_device_owner_auth_bindings (namespace, org_id, project_id, env_id, wallet_id, lifecycle_state);
+
+CREATE TABLE linked_device_email_otp_grants (
+  namespace TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  project_id TEXT NOT NULL,
+  env_id TEXT NOT NULL,
+  grant_id TEXT NOT NULL,
+  grant_token_digest_b64u TEXT NOT NULL,
+  wallet_id TEXT NOT NULL,
+  link_session_id TEXT NOT NULL,
+  enrollment_id TEXT NOT NULL,
+  device_id TEXT NOT NULL,
+  target_factor TEXT NOT NULL,
+  target_preparation_digest_b64u TEXT NOT NULL,
+  base_wallet_auth_method_id TEXT NOT NULL,
+  linked_owner_auth_method_id TEXT NOT NULL,
+  authority_digest_b64u TEXT NOT NULL,
+  challenge_id TEXT NOT NULL,
+  state TEXT NOT NULL,
+  record_json TEXT NOT NULL,
+  issued_at_ms INTEGER NOT NULL,
+  expires_at_ms INTEGER NOT NULL,
+  consumed_at_ms INTEGER,
+  PRIMARY KEY (namespace, org_id, project_id, env_id, grant_id),
+  FOREIGN KEY (namespace, org_id, project_id, env_id, link_session_id)
+    REFERENCES linked_device_sessions(namespace, org_id, project_id, env_id, link_session_id),
+  FOREIGN KEY (namespace, org_id, project_id, env_id, base_wallet_auth_method_id)
+    REFERENCES wallet_auth_methods(namespace, org_id, project_id, env_id, wallet_auth_method_id),
+  CHECK (length(grant_id) > 0),
+  CHECK (length(grant_token_digest_b64u) > 0),
+  CHECK (length(wallet_id) > 0),
+  CHECK (length(link_session_id) > 0),
+  CHECK (length(enrollment_id) > 0),
+  CHECK (length(device_id) > 0),
+  CHECK (target_factor = 'email_otp'),
+  CHECK (length(target_preparation_digest_b64u) > 0),
+  CHECK (length(base_wallet_auth_method_id) > 0),
+  CHECK (length(linked_owner_auth_method_id) > 0),
+  CHECK (length(authority_digest_b64u) > 0),
+  CHECK (length(challenge_id) > 0),
+  CHECK (state IN ('issued', 'consumed')),
+  CHECK (json_valid(record_json)),
+  CHECK (issued_at_ms > 0),
+  CHECK (expires_at_ms > issued_at_ms),
+  CHECK (
+    (state = 'issued' AND consumed_at_ms IS NULL)
+    OR (state = 'consumed' AND consumed_at_ms >= issued_at_ms)
+  ),
+  CHECK (COALESCE(json_extract(record_json, '$.kind') = 'linked_device_email_otp_grant_record_v1', 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.grantId') = grant_id, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.grantTokenDigestB64u') = grant_token_digest_b64u, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.walletId') = wallet_id, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.linkSessionId') = link_session_id, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.enrollmentId') = enrollment_id, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.deviceId') = device_id, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.targetFactor.kind') = target_factor, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.targetPreparationDigestB64u') = target_preparation_digest_b64u, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.baseWalletAuthMethodId') = base_wallet_auth_method_id, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.linkedOwnerAuthMethodId') = linked_owner_auth_method_id, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.authorityDigestB64u') = authority_digest_b64u, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.challengeId') = challenge_id, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.state.kind') = state, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.issuedAtMs') = issued_at_ms, 0)),
+  CHECK (COALESCE(json_extract(record_json, '$.expiresAtMs') = expires_at_ms, 0)),
+  CHECK (
+    consumed_at_ms IS NULL
+    OR COALESCE(json_extract(record_json, '$.state.consumedAtMs') = consumed_at_ms, 0)
+  )
+);
+CREATE INDEX linked_device_email_otp_grants_session_idx
+  ON linked_device_email_otp_grants (
+    namespace, org_id, project_id, env_id, link_session_id, state, expires_at_ms
+  );
+CREATE INDEX linked_device_email_otp_grants_expiry_idx
+  ON linked_device_email_otp_grants (namespace, org_id, project_id, env_id, expires_at_ms);

package/migrations/d1-signer/0010_linked_device_session_target_factor.sql

@@ -0,0 +1,78 @@
+-- Replace the applied pre-QR-v5 session state constraint. Existing sessions
+-- used the Passkey-specific state name; the current protocol records the
+-- selected target factor inside the state payload.
+
+PRAGMA defer_foreign_keys = ON;
+
+DROP INDEX linked_device_sessions_state_idx;
+
+CREATE TABLE linked_device_sessions_next (
+  namespace TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  project_id TEXT NOT NULL,
+  env_id TEXT NOT NULL,
+  link_session_id TEXT NOT NULL,
+  link_public_key_b64u TEXT NOT NULL,
+  device_public_key_b64u TEXT NOT NULL,
+  state TEXT NOT NULL,
+  record_json TEXT NOT NULL,
+  revision INTEGER NOT NULL,
+  expires_at_ms INTEGER NOT NULL,
+  claim_expires_at_ms INTEGER,
+  claim_digest_b64u TEXT,
+  approval_digest_b64u TEXT,
+  created_at_ms INTEGER NOT NULL,
+  updated_at_ms INTEGER NOT NULL,
+  PRIMARY KEY (namespace, org_id, project_id, env_id, link_session_id),
+  CHECK (length(link_session_id) > 0),
+  CHECK (length(link_public_key_b64u) > 0),
+  CHECK (length(device_public_key_b64u) > 0),
+  CHECK (state IN (
+    'displaying_qr',
+    'claimed_by_owner',
+    'awaiting_target_factor',
+    'provisioning',
+    'active',
+    'expired_unclaimed',
+    'expired_claimed',
+    'cancelled_unclaimed',
+    'cancelled_claimed_precommit',
+    'committed_completion_required'
+  )),
+  CHECK (json_valid(record_json)),
+  CHECK (revision > 0),
+  CHECK (expires_at_ms > 0),
+  CHECK (claim_expires_at_ms IS NULL OR claim_expires_at_ms > 0),
+  CHECK (claim_digest_b64u IS NULL OR length(claim_digest_b64u) > 0),
+  CHECK (approval_digest_b64u IS NULL OR length(approval_digest_b64u) > 0),
+  CHECK (created_at_ms > 0 AND updated_at_ms >= created_at_ms)
+);
+
+INSERT INTO linked_device_sessions_next (
+  namespace, org_id, project_id, env_id, link_session_id,
+  link_public_key_b64u, device_public_key_b64u, state, record_json,
+  revision, expires_at_ms, claim_expires_at_ms, claim_digest_b64u,
+  approval_digest_b64u, created_at_ms, updated_at_ms
+)
+SELECT namespace, org_id, project_id, env_id, link_session_id,
+       link_public_key_b64u, device_public_key_b64u,
+       CASE state
+         WHEN 'awaiting_target_passkey' THEN 'awaiting_target_factor'
+         ELSE state
+       END,
+       CASE state
+         WHEN 'awaiting_target_passkey'
+           THEN json_set(record_json, '$.state.state', 'awaiting_target_factor')
+         ELSE record_json
+       END,
+       revision, expires_at_ms, claim_expires_at_ms, claim_digest_b64u,
+       approval_digest_b64u, created_at_ms, updated_at_ms
+  FROM linked_device_sessions;
+
+DROP TABLE linked_device_sessions;
+ALTER TABLE linked_device_sessions_next RENAME TO linked_device_sessions;
+
+CREATE INDEX linked_device_sessions_state_idx
+  ON linked_device_sessions(namespace, org_id, project_id, env_id, state, updated_at_ms);
+
+PRAGMA defer_foreign_keys = OFF;

package/migrations/d1-signer/0011_linked_device_ed25519_export_root.sql

@@ -0,0 +1,9 @@
+ALTER TABLE linked_device_custody_transfers
+  RENAME TO linked_device_ed25519_export_root_transfers;
+
+DROP INDEX linked_device_custody_transfers_enrollment_idx;
+
+CREATE UNIQUE INDEX linked_device_ed25519_export_root_transfers_enrollment_idx
+  ON linked_device_ed25519_export_root_transfers (
+    namespace, org_id, project_id, env_id, wallet_id, enrollment_id, device_id
+  );

package/migrations/d1-signer/0012_versioned_json_cas_guard.sql

@@ -0,0 +1,3 @@
+-- Guarded D1 batches abort by colliding with this immutable singleton when a
+-- preceding compare-and-swap statement changes no row.
+INSERT OR IGNORE INTO router_ab_yao_versioned_json_cas_guard (guard_id) VALUES (1);

package/migrations/d1-signer/0013_linked_device_export_authorization.sql

@@ -0,0 +1,133 @@
+DROP TRIGGER authorized_operation_linked_grant_claim_atomic;
+
+CREATE TRIGGER authorized_operation_linked_grant_claim_atomic
+AFTER INSERT ON authorized_operations
+WHEN NEW.lifecycle_kind = 'claimed'
+  AND NEW.authorization_source_kind = 'authorization_grant'
+  AND NEW.authorization_grant_kind = 'linked_device_wallet_session_authorization_v1'
+BEGIN
+  SELECT CASE
+    WHEN (
+        (NEW.operation_kind IN ('near.export_key', 'evm.export_key')
+          AND NEW.quota_kind != 'quota_neutral')
+        OR (NEW.operation_kind NOT IN ('near.export_key', 'evm.export_key')
+          AND NEW.quota_kind != 'consume_reusable_wallet_session')
+      )
+      OR NEW.capability_kind NOT IN ('near_ed25519_mpc_signing', 'evm_ecdsa_mpc_signing')
+      OR NOT EXISTS (
+        SELECT 1
+          FROM linked_device_wallet_session_authorizations AS grant_record
+          JOIN lane_enrollments AS enrollment
+            ON enrollment.namespace = grant_record.namespace
+           AND enrollment.org_id = grant_record.org_id
+           AND enrollment.project_id = grant_record.project_id
+           AND enrollment.env_id = grant_record.env_id
+           AND enrollment.org_id = NEW.linked_scope_org_id
+           AND enrollment.project_id = NEW.linked_scope_project_id
+           AND enrollment.env_id = NEW.linked_scope_env_id
+           AND enrollment.enrollment_id = grant_record.enrollment_id
+           AND enrollment.wallet_id = grant_record.wallet_id
+           AND json_extract(enrollment.lifecycle_json, '$.state') = 'active'
+           AND json_extract(enrollment.lifecycle_json, '$.manifestDigestB64u') = grant_record.key_manifest_digest_b64u
+         JOIN lane_product_epochs AS product
+            ON product.namespace = grant_record.namespace
+           AND product.org_id = grant_record.org_id
+           AND product.project_id = grant_record.project_id
+           AND product.env_id = grant_record.env_id
+           AND product.org_id = NEW.linked_scope_org_id
+           AND product.project_id = NEW.linked_scope_project_id
+           AND product.env_id = NEW.linked_scope_env_id
+           AND product.enrollment_id = grant_record.enrollment_id
+           AND product.wallet_id = grant_record.wallet_id
+           AND product.wallet_id = NEW.linked_wallet_id
+           AND product.enrollment_id = NEW.linked_enrollment_id
+           AND product.wallet_key_id = NEW.linked_wallet_key_id
+           AND product.lane_id = NEW.linked_lane_id
+           AND product.lane_share_epoch = NEW.linked_lane_share_epoch
+           AND product.target_material_activation_id = NEW.material_activation_id
+           AND product.revocation_epoch = NEW.linked_revocation_epoch
+           AND product.state = 'active'
+           AND product.lane_kind = 'linked_device'
+           AND (
+             (NEW.capability_kind = 'near_ed25519_mpc_signing' AND product.key_family = 'ed25519')
+             OR (NEW.capability_kind = 'evm_ecdsa_mpc_signing' AND product.key_family = 'ecdsa_secp256k1')
+           )
+           AND json_extract(product.material_activation_json, '$.activationId') = NEW.material_activation_id
+           AND json_extract(product.material_activation_json, '$.capability') = NEW.material_activation_capability
+           AND json_extract(product.material_activation_json, '$.materialOwner') = NEW.material_activation_owner
+           AND json_extract(product.material_activation_json, '$.keyBinding') = NEW.material_activation_key_binding
+           AND json_extract(product.material_activation_json, '$.lifecycleBinding') = NEW.material_activation_lifecycle_binding
+           AND json_extract(product.material_activation_json, '$.signingWorker') = NEW.material_activation_signing_worker
+         JOIN lane_protocol_operations AS protocol
+          ON protocol.namespace = product.namespace
+          AND protocol.org_id = product.org_id
+          AND protocol.project_id = product.project_id
+          AND protocol.env_id = product.env_id
+          AND protocol.org_id = NEW.linked_scope_org_id
+          AND protocol.project_id = NEW.linked_scope_project_id
+          AND protocol.env_id = NEW.linked_scope_env_id
+          AND protocol.operation_id = product.operation_id
+          AND protocol.enrollment_id = product.enrollment_id
+          AND protocol.enrollment_id = NEW.linked_enrollment_id
+          AND protocol.wallet_id = NEW.linked_wallet_id
+          AND protocol.wallet_key_id = NEW.linked_wallet_key_id
+          AND protocol.target_lane_id = NEW.linked_lane_id
+          AND protocol.target_lane_share_epoch = NEW.linked_lane_share_epoch
+          AND protocol.target_material_activation_id = product.target_material_activation_id
+          AND protocol.target_material_activation_id = NEW.material_activation_id
+          AND json_extract(protocol.lifecycle_json, '$.state') = 'active'
+         WHERE grant_record.namespace = NEW.namespace
+           AND grant_record.org_id = NEW.linked_scope_org_id
+           AND grant_record.project_id = NEW.linked_scope_project_id
+           AND grant_record.env_id = NEW.linked_scope_env_id
+           AND grant_record.org_id = product.org_id
+           AND grant_record.project_id = product.project_id
+           AND grant_record.env_id = product.env_id
+           AND grant_record.tenant_id = NEW.tenant_id
+           AND grant_record.authorization_id = NEW.authorization_id
+           AND grant_record.principal_id = NEW.principal_id
+           AND (
+             NEW.quota_kind = 'quota_neutral'
+             OR grant_record.quota_id = NEW.quota_id
+           )
+           AND grant_record.wallet_id = NEW.linked_wallet_id
+           AND grant_record.enrollment_id = NEW.linked_enrollment_id
+           AND grant_record.device_id = NEW.linked_device_id
+           AND grant_record.lifecycle_kind = 'active'
+           AND grant_record.expires_at_ms > NEW.claimed_at_ms
+           AND json_extract(grant_record.permission_json, '$.kind') = 'delegated_wallet_authority_v1'
+           AND json_type(grant_record.permission_json, '$.permissions') = 'array'
+           AND EXISTS (
+             SELECT 1
+               FROM json_each(grant_record.permission_json, '$.permissions') AS permission
+              WHERE permission.value = CASE
+                WHEN NEW.operation_kind IN ('near.export_key', 'evm.export_key')
+                THEN 'export_keys'
+                ELSE 'sign'
+              END
+           )
+      )
+    THEN RAISE(ABORT, 'authorization_linked_device_rejected')
+  END;
+
+  UPDATE linked_device_wallet_session_quotas
+     SET remaining_uses = remaining_uses - 1,
+         lifecycle_kind = CASE WHEN remaining_uses = 1 THEN 'exhausted' ELSE 'active' END
+   WHERE NEW.quota_kind = 'consume_reusable_wallet_session'
+     AND namespace = NEW.namespace
+     AND org_id = NEW.linked_scope_org_id
+     AND project_id = NEW.linked_scope_project_id
+     AND env_id = NEW.linked_scope_env_id
+     AND tenant_id = NEW.tenant_id
+     AND quota_id = NEW.quota_id
+     AND authorization_id = NEW.authorization_id
+     AND principal_id = NEW.principal_id
+     AND lifecycle_kind = 'active'
+     AND remaining_uses > 0
+     AND expires_at_ms > NEW.claimed_at_ms;
+
+  SELECT CASE
+    WHEN NEW.quota_kind = 'consume_reusable_wallet_session' AND changes() != 1
+    THEN RAISE(ABORT, 'authorization_wallet_session_quota_rejected')
+  END;
+END;

package/migrations/d1-signer/0014_wallet_recovery_code_locators.sql

@@ -0,0 +1,19 @@
+CREATE TABLE wallet_recovery_code_locators (
+  namespace TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  project_id TEXT NOT NULL,
+  env_id TEXT NOT NULL,
+  locator_b64u TEXT NOT NULL,
+  wallet_id TEXT NOT NULL,
+  recovery_key_id TEXT NOT NULL,
+  PRIMARY KEY (namespace, org_id, project_id, env_id, locator_b64u),
+  UNIQUE (namespace, org_id, project_id, env_id, wallet_id, recovery_key_id),
+  CHECK (length(locator_b64u) > 0),
+  CHECK (length(wallet_id) > 0),
+  CHECK (length(recovery_key_id) > 0)
+);
+
+CREATE INDEX idx_wallet_recovery_code_locators_wallet
+  ON wallet_recovery_code_locators (
+    namespace, org_id, project_id, env_id, wallet_id
+  );