@seams/wallet-server 0.5.0

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceOwnerAuthorizationProvider.js

@@ -0,0 +1,560 @@
+import { mpcMaterialActivationRefsEqual, parseEcdsaRelayerKeyId, parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseProviderSubject } from "../../../../shared-ts/src/utils/domainIds.js";
+import { parseWalletSessionAuthorizationId, parseWalletSessionId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import { parseSecp256k1CompressedPublicKeyB64u } from "../../../../shared-ts/src/passkey-custody/primitives.js";
+import { buildFullOwnerDelegatedWalletAuthorityV1, hasDelegatedWalletPermissionV1, validateDelegatedWalletAuthorityAttenuationV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
+import { walletAuthorityDigestsMatchV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
+import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { deriveRouterAbEd25519YaoApplicationBindingDigestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
+import { buildEmailOtpWalletAuthAuthority, buildPasskeyWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { buildWalletSessionLinkedDeviceOwnerAuthorizationV1, parseQrLinkedDeviceSessionPayloadV5 } from "../../../../shared-ts/src/device-linking/parsers.js";
+import { computeLinkedDevicePublicKeyDigestV1 } from "../../../../shared-ts/src/device-linking/requestProof.js";
+import { resolveActiveOwnerWalletExecutionLane, resolveWalletAuthMethodIdForAuthority } from "../../../../core/signingLanes/WalletExecutionLaneProjection.js";
+import { thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
+import { sourceKeyManifestDigestForFamilyV1 } from "../../../../core/deviceLinking/linkedDeviceSession.js";
+import { LinkedDeviceSourceFamilyUnavailableErrorV1 } from "./d1LinkedDeviceVerifiedLinkSourceReader.js";
+import { linkedDeviceSignerManifestsEqualV1 } from "./d1LinkedDeviceVerifiedLinkBuilder.js";
+import { D1LinkedDeviceTargetPlannerV1 } from "./d1LinkedDeviceTargetPlanner.js";
+//#region src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceOwnerAuthorizationProvider.ts
+const ENROLLMENT_ID_DOMAIN_V1 = "seams/linked-device/enrollment-identity/v1";
+/** Builds authoritative source-child facts directly from the wallet stores. */
+function createD1LinkedDeviceOwnerSourceChildReaderV1(options) {
+	const projectionSource = new D1LinkedDeviceOwnerSourceProjectionSourceV1(options);
+	return { readOwnerSourceChildV1: readD1LinkedDeviceOwnerSourceChildV1.bind(void 0, projectionSource) };
+}
+var D1LinkedDeviceOwnerSourceProjectionSourceV1 = class {
+	constructor(options) {
+		this.options = options;
+	}
+	async listWalletAuthMethods(input) {
+		return await this.options.walletAuthMethodStore.listForWalletV2({ walletId: input.walletId });
+	}
+	async listWalletSigners(input) {
+		const [ed25519, ecdsa] = await Promise.all([this.options.walletStore.listEd25519SignersForWallet({ walletId: input.walletId }), this.options.walletStore.listEcdsaSignersForWallet({ walletId: input.walletId })]);
+		return [...ed25519, ...ecdsa];
+	}
+};
+var WalletExecutionLaneProjectionSnapshotV1 = class {
+	constructor(authMethods, signers) {
+		this.authMethods = authMethods;
+		this.signers = signers;
+	}
+	async listWalletAuthMethods() {
+		return this.authMethods;
+	}
+	async listWalletSigners() {
+		return this.signers;
+	}
+};
+async function readD1LinkedDeviceOwnerSourceChildV1(projectionSource, input) {
+	if (input.owner.walletId !== input.request.approval.walletId) return null;
+	if (input.request.sourceSigner.walletId !== input.owner.walletId) return null;
+	const [authMethods, signers] = await Promise.all([projectionSource.listWalletAuthMethods({ walletId: input.owner.walletId }), projectionSource.listWalletSigners({ walletId: input.owner.walletId })]);
+	const walletAuthMethodId = await ownerWalletAuthMethodIdV1({
+		owner: input.owner,
+		authMethods
+	});
+	if (!walletAuthMethodId) return null;
+	const resolved = await resolveExactSourceSignerProjectionV1({
+		authMethods,
+		signers,
+		walletId: input.owner.walletId,
+		walletAuthMethodId,
+		sourceSigner: input.request.sourceSigner
+	});
+	if (!resolved || resolved.signer.custodyKeyManifestDigestB64u !== input.owner.keyManifestDigestB64u) return null;
+	return await sourceChildResolutionFromSignerV1({
+		signer: resolved.signer,
+		projection: resolved.projection
+	});
+}
+async function resolveExactSourceSignerProjectionV1(input) {
+	for (const signer of input.signers) {
+		if (signer.walletId !== input.walletId) continue;
+		if (input.sourceSigner.keyFamily === "ed25519" && signer.version !== "wallet_signer_ed25519_v1" || input.sourceSigner.keyFamily === "ecdsa_secp256k1" && signer.version !== "wallet_signer_ecdsa_v1") continue;
+		const wire = signer.version === "wallet_signer_ed25519_v1" ? signer.activeYaoCapability.activationResult.public_receipt.material_activation : signer.walletKey.publicCapability.material_activation;
+		let materialActivation;
+		try {
+			materialActivation = routerAbMpcMaterialActivationRefFromWire(wire);
+		} catch {
+			continue;
+		}
+		const projected = await resolveActiveOwnerWalletExecutionLane({
+			source: new WalletExecutionLaneProjectionSnapshotV1(input.authMethods, input.signers),
+			walletId: input.walletId,
+			walletAuthMethodId: input.walletAuthMethodId,
+			expectedMaterialActivation: materialActivation
+		});
+		if (projected.kind === "projected" && projectionMatchesExactSignerV1(projected.projection, input.sourceSigner)) return {
+			signer,
+			projection: projected.projection
+		};
+	}
+	return null;
+}
+function projectionMatchesExactSignerV1(projection, signer) {
+	if (projection.walletKey.walletId !== signer.walletId || projection.walletKey.walletKeyId !== signer.walletKeyId || projection.walletKey.keyFamily !== signer.keyFamily) return false;
+	if (signer.keyFamily === "ed25519") return projection.walletKey.keyFamily === "ed25519" && projection.walletKey.registeredPublicKeyB64u === signer.registeredPublicKeyB64u;
+	return projection.walletKey.keyFamily === "ecdsa_secp256k1" && projection.walletKey.thresholdPublicKey33B64u === signer.thresholdPublicKey33B64u && projection.walletKey.evmAddress === signer.evmAddress;
+}
+async function ownerWalletAuthMethodIdV1(input) {
+	switch (input.owner.curve) {
+		case "ed25519": return input.owner.authority.bindingId;
+		case "ecdsa": return await resolveWalletAuthMethodIdForAuthority({
+			walletId: input.owner.walletId,
+			authorityRef: input.owner.walletAuthAuthorityRef,
+			authSource: input.owner.authSource,
+			authMethods: input.authMethods
+		});
+		default: return assertNeverOwnerCurveV1(input.owner);
+	}
+}
+async function sourceChildResolutionFromSignerV1(input) {
+	const source = ownerLaneProtocolSourceV1(input.projection);
+	if (input.signer.version === "wallet_signer_ed25519_v1") {
+		if (input.projection.walletKey.keyFamily !== "ed25519") return null;
+		if (input.signer.activeYaoCapability.activationResult.binding.operation !== "registration") return null;
+		const capability = input.signer.activeYaoCapability;
+		if (capability.version !== "wallet_ed25519_yao_registration_capability_v1") return null;
+		const application = capability.admissionRequest.application_binding;
+		const applicationBindingDigestB64u = parseDigestB64u(base64UrlEncode(Uint8Array.from(await deriveRouterAbEd25519YaoApplicationBindingDigestV1(application))));
+		const stableContextBindingB64u = parseDigestB64u(base64UrlEncode(Uint8Array.from(capability.activationResult.binding.stable_key_context_binding)));
+		return {
+			walletKeyId: input.projection.walletKey.walletKeyId,
+			source,
+			keyFamily: "ed25519",
+			applicationBindingDigestB64u,
+			registeredPublicKeyB64u: input.projection.walletKey.registeredPublicKeyB64u,
+			nearEd25519SigningKeyId: input.projection.walletKey.nearEd25519SigningKeyId,
+			keyCreationSignerSlot: input.projection.walletKey.keyCreationSignerSlot,
+			stableContextBindingB64u,
+			sourceBinding: capability.activationResult.binding,
+			applicationBinding: application
+		};
+	}
+	if (input.projection.walletKey.keyFamily !== "ecdsa_secp256k1") return null;
+	try {
+		if (!parseEcdsaRelayerKeyId(input.signer.walletKey.relayerKeyId).ok) return null;
+		return {
+			walletKeyId: input.projection.walletKey.walletKeyId,
+			source,
+			keyFamily: "ecdsa_secp256k1",
+			evmFamilySigningKeySlotId: input.projection.walletKey.evmFamilySigningKeySlotId,
+			thresholdPublicKey33B64u: parseSecp256k1CompressedPublicKeyB64u(input.signer.walletKey.thresholdEcdsaPublicKeyB64u),
+			evmAddress: input.signer.walletKey.thresholdOwnerAddress,
+			sourceHolderVerifyingShare33B64u: parseSecp256k1CompressedPublicKeyB64u(input.signer.walletKey.derivationClientSharePublicKey33B64u),
+			sourceServerVerifyingShare33B64u: parseSecp256k1CompressedPublicKeyB64u(input.signer.walletKey.relayerVerifyingShareB64u),
+			applicationBindingDigestB64u: parseDigestB64u(input.signer.activationReceipt.ecdsa_activation.context.application_binding_digest_b64u),
+			clientShareRetryCounter: input.signer.activationReceipt.ecdsa_activation.public_identity.client_share_retry_counter
+		};
+	} catch {
+		return null;
+	}
+}
+function ownerLaneProtocolSourceV1(projection) {
+	return {
+		sourceKind: "owner_registration",
+		laneKind: projection.lane.laneKind,
+		laneId: projection.lane.laneId,
+		laneShareEpoch: projection.lane.laneShareEpoch,
+		revocationEpoch: projection.lane.lifecycle.revocationEpoch,
+		participantBindingDigestB64u: projection.lane.participantBindingDigestB64u,
+		materialActivation: projection.materialActivation,
+		ownerParticipantContinuity: projection.lane.ownerParticipantContinuity
+	};
+}
+function assertNeverOwnerCurveV1(value) {
+	throw new Error(`unsupported owner curve: ${String(value)}`);
+}
+async function readVerifiedOwnerSourceFactsV1(readVerifiedSourceV1, input) {
+	const readFamily = async (keyFamily) => await readVerifiedSourceV1({
+		...input,
+		keyFamily
+	});
+	let first;
+	let firstFamily;
+	try {
+		first = await readFamily("ed25519");
+		firstFamily = "ed25519";
+	} catch (error) {
+		if (!(error instanceof LinkedDeviceSourceFamilyUnavailableErrorV1)) throw error;
+		first = await readFamily("ecdsa_secp256k1");
+		firstFamily = "ecdsa_secp256k1";
+	}
+	const manifest = first.signerManifest;
+	const sourceAuthorityDigestB64u = parseDigestB64u(first.authority.authorityDigestB64u);
+	const digests = { [firstFamily]: first.keyManifestDigestB64u };
+	for (const keyFamily of manifest.keyFamilies) {
+		if (keyFamily === firstFamily) continue;
+		const source = await readFamily(keyFamily);
+		if (source.authority.authorityId !== first.authority.authorityId || source.authority.authorityDigestB64u !== first.authority.authorityDigestB64u || source.authMethod.walletAuthMethodId !== first.authMethod.walletAuthMethodId || !linkedDeviceSignerManifestsEqualV1(source.signerManifest, manifest)) throw new Error("verified owner source facts changed between signer families");
+		digests[keyFamily] = source.keyManifestDigestB64u;
+	}
+	if (manifest.keyFamilies.length === 1 && manifest.keyFamilies[0] === "ed25519") {
+		if (!digests.ed25519) throw new Error("verified Ed25519 source digest is missing");
+		return {
+			signerManifest: manifest,
+			keyManifestDigestsB64u: { ed25519: digests.ed25519 },
+			sourceAuthorityDigestB64u
+		};
+	}
+	if (manifest.keyFamilies.length === 1 && manifest.keyFamilies[0] === "ecdsa_secp256k1") {
+		if (!digests.ecdsa_secp256k1) throw new Error("verified ECDSA source digest is missing");
+		return {
+			signerManifest: manifest,
+			keyManifestDigestsB64u: { ecdsa_secp256k1: digests.ecdsa_secp256k1 },
+			sourceAuthorityDigestB64u
+		};
+	}
+	if (!digests.ed25519 || !digests.ecdsa_secp256k1) throw new Error("verified combined source digests are incomplete");
+	return {
+		signerManifest: manifest,
+		keyManifestDigestsB64u: {
+			ed25519: digests.ed25519,
+			ecdsa_secp256k1: digests.ecdsa_secp256k1
+		},
+		sourceAuthorityDigestB64u
+	};
+}
+/** Rehydrates the request-scoped owner context from link approval and D1. */
+function createD1LinkedDeviceOwnerAuthorizationMetadataSourceV1(options) {
+	const nowV1 = options.nowV1 ?? Date.now;
+	return {
+		readVerifiedOwnerSourceFactsV1: async (input) => await readVerifiedOwnerSourceFactsV1(options.readVerifiedSourceV1, input),
+		readApprovedOwnerContextV1: async (input) => {
+			const linkSessionId = parseLinkDeviceSessionId(input.linkSessionId);
+			if (!linkSessionId.ok) return null;
+			const session = await options.sessionStore.getSessionV1(linkSessionId.value);
+			if (!session?.approvalTranscript || !session.claimTranscript) return null;
+			const approval = session.approvalTranscript.value;
+			if (session.linkSessionId !== linkSessionId.value || approval.linkSessionId !== linkSessionId.value || session.claimTranscript.value.walletId !== input.walletId || approval.walletId !== input.walletId || approval.ownerAuthorization.kind !== "wallet_session") return null;
+			if (!session.approvalTranscript.sourceSignerManifest.keyFamilies.some((family) => family === input.keyFamily)) return null;
+			const nowMs = nowV1();
+			let source;
+			try {
+				source = await options.readVerifiedSourceV1({
+					walletId: input.walletId,
+					walletSessionId: String(approval.ownerAuthorization.walletSessionId),
+					authorizationId: String(approval.ownerAuthorization.authorizationId),
+					keyFamily: input.keyFamily,
+					requestedAtMs: nowMs
+				});
+			} catch {
+				return null;
+			}
+			const approvedSourceDigest = sourceKeyManifestDigestForFamilyV1(session.approvalTranscript.sourceKeyManifestDigestsB64u, input.keyFamily);
+			if (!approvedSourceDigest || approvedSourceDigest !== source.keyManifestDigestB64u) return null;
+			if (session.approvalTranscript.sourceAuthorityDigestB64u !== source.authority.authorityDigestB64u) return null;
+			return await ownerContextFromVerifiedSourceV1({
+				source,
+				walletId: input.walletId,
+				ownerAuthorization: approval.ownerAuthorization,
+				keyManifestDigestB64u: source.keyManifestDigestB64u,
+				curve: input.keyFamily === "ecdsa_secp256k1" ? "ecdsa" : "ed25519",
+				expiresAtMs: Math.min(approval.expiresAtMs, source.expiresAtMs),
+				nowMs
+			});
+		},
+		readOwnerSourceChildV1: options.readOwnerSourceChildV1
+	};
+}
+async function ownerContextFromVerifiedSourceV1(input) {
+	if (!Number.isSafeInteger(input.nowMs) || input.nowMs < 0 || input.expiresAtMs <= input.nowMs || input.source.expiresAtMs <= input.nowMs || input.source.authority.walletId !== input.walletId || input.source.authMethod.walletId !== input.walletId || input.source.authMethod.walletAuthorityId !== input.source.authority.authorityId || !await walletAuthorityDigestsMatchV1(input.source.authority)) return null;
+	const authorityData = walletAuthAuthorityFromVerifiedSourceV1(input.source);
+	if (!authorityData) return null;
+	const base = {
+		walletId: input.walletId,
+		walletSessionId: input.ownerAuthorization.walletSessionId,
+		authorizationId: input.ownerAuthorization.authorizationId,
+		expiresAtMs: input.expiresAtMs,
+		permission: buildFullOwnerDelegatedWalletAuthorityV1(),
+		keyManifestDigestB64u: input.keyManifestDigestB64u
+	};
+	switch (input.curve) {
+		case "ed25519": return {
+			...base,
+			curve: "ed25519",
+			authority: authorityData.authority,
+			authorityScope: thresholdEd25519AuthorityScopeFromWalletAuthAuthority(authorityData.authority)
+		};
+		case "ecdsa": return {
+			...base,
+			curve: "ecdsa",
+			walletAuthAuthorityRef: await walletAuthAuthorityRef({ authority: authorityData.authority }),
+			authSource: authorityData.authSource
+		};
+	}
+}
+function walletAuthAuthorityFromVerifiedSourceV1(source) {
+	if (source.authMethod.kind === "passkey") try {
+		const authority = {
+			...buildPasskeyWalletAuthAuthority({
+				walletId: source.authority.walletId,
+				rpId: source.authMethod.rpId,
+				credentialIdB64u: source.authMethod.credentialIdB64u
+			}),
+			bindingId: source.authMethod.walletAuthMethodId
+		};
+		return {
+			authority,
+			authSource: {
+				kind: "passkey",
+				credentialIdB64u: authority.factor.credentialIdB64u
+			}
+		};
+	} catch {
+		return null;
+	}
+	const providerSubject = parseProviderSubject(String(source.principalId));
+	if (!providerSubject.ok) return null;
+	try {
+		const authority = {
+			...buildEmailOtpWalletAuthAuthority({
+				walletId: source.authority.walletId,
+				provider: String(source.principalId).startsWith("google:") ? "google" : "email",
+				providerUserId: providerSubject.value,
+				emailHashHex: source.authMethod.emailHashHex
+			}),
+			bindingId: source.authMethod.walletAuthMethodId
+		};
+		return {
+			authority,
+			authSource: {
+				kind: "oidc_provider",
+				providerId: authority.factor.provider === "google" ? "google_oidc" : "oidc",
+				providerSubject: providerSubject.value
+			}
+		};
+	} catch {
+		return null;
+	}
+}
+function createD1LinkedDeviceOwnerAuthorizationProviderV1(options) {
+	const nowV1 = options.nowV1 ?? Date.now;
+	const ownerSourceResolver = createD1LinkedDeviceOwnerSourceResolverV1({
+		walletRegistration: options.walletRegistration,
+		metadata: options.metadata,
+		nowV1
+	});
+	const ownerAuthorization = createOwnerAuthorizationPortV1(nowV1, options.metadata);
+	const targetPlanner = new D1LinkedDeviceTargetPlannerV1({
+		preparationTtlMs: options.targetPlanner.preparationTtlMs,
+		targetPasskeyRpId: options.targetPlanner.targetPasskeyRpId,
+		resolveOwnerSourceChildV1: ownerSourceResolver.resolveOwnerSourceChildV1
+	});
+	return {
+		ownerAuthorization,
+		ownerAuthorizationRoute: createOwnerAuthorizationRouteV1({
+			nowV1,
+			metadata: options.metadata
+		}),
+		ownerSourceResolver,
+		targetPlanner
+	};
+}
+function createOwnerAuthorizationPortV1(nowV1, metadata) {
+	return {
+		authorizeOwnerClaimV1: async (input) => {
+			const payload = parseQrLinkedDeviceSessionPayloadV5(input.payload);
+			const ownerError = validateOwnerContext(input.owner, input.requestedAtMs, nowV1);
+			if (ownerError) return ownerError;
+			const attenuationError = requestedAuthorityAttenuationError(input.owner.permission, payload.requestedPermission);
+			if (attenuationError) return denied("unauthorized", attenuationError);
+			if (input.requestedAtMs < payload.issuedAtMs || input.requestedAtMs >= payload.expiresAtMs) return denied("expired", "linked-device QR session is outside its lifetime");
+			const deviceDigestB64u = await computeLinkedDevicePublicKeyDigestV1(payload.devicePublicKeyB64u);
+			const enrollmentId = parseRequired(parseLinkedDeviceEnrollmentId(`linked-enrollment:${parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(`${ENROLLMENT_ID_DOMAIN_V1}\u0000${alphabetizeStringify({
+				walletId: input.owner.walletId,
+				linkSessionId: payload.linkSessionId,
+				linkPublicKeyB64u: payload.linkPublicKeyB64u,
+				devicePublicKeyB64u: payload.devicePublicKeyB64u
+			})}`)))}`), "linked-device enrollment identity");
+			const deviceId = parseRequired(parseLinkedDeviceId(`linked-device:${deviceDigestB64u}`), "linked-device device identity");
+			const claimExpiresAtMs = Math.min(payload.expiresAtMs, input.owner.expiresAtMs);
+			if (claimExpiresAtMs <= input.requestedAtMs) return denied("expired", "owner Wallet Session expires before the link claim");
+			return {
+				kind: "authorized",
+				identity: {
+					walletId: input.owner.walletId,
+					enrollmentId,
+					deviceId,
+					claimExpiresAtMs
+				}
+			};
+		},
+		authorizeOwnerApprovalV1: async (input) => {
+			const ownerError = validateOwnerContext(input.owner, input.requestedAtMs, nowV1);
+			if (ownerError) return ownerError;
+			const attenuationError = requestedAuthorityAttenuationError(input.owner.permission, input.approval.permission);
+			if (attenuationError) return denied("unauthorized", attenuationError);
+			if (!isOwnerApprovalAuthorizationSession(input.session)) return denied("invalid", "linked-device approval session is outside its owner phase");
+			if (input.session.claimTranscript.value.walletId !== input.owner.walletId || input.approval.walletId !== input.owner.walletId || input.approval.linkSessionId !== input.session.linkSessionId || input.approval.enrollmentId !== input.session.claimTranscript.value.enrollmentId || input.approval.deviceId !== input.session.claimTranscript.value.deviceId || input.approval.linkPublicKeyB64u !== input.session.qrPayload.linkPublicKeyB64u || input.approval.devicePublicKeyB64u !== input.session.qrPayload.devicePublicKeyB64u || input.requestedAtMs < input.approval.approvedAtMs || input.requestedAtMs >= input.approval.expiresAtMs || input.approval.expiresAtMs > input.session.qrPayload.expiresAtMs) return denied("invalid", "owner approval identity does not match the claimed session");
+			if (!ownerAuthorizationSourceMatchesContext(input.approval.ownerAuthorization, input.owner)) return denied("unauthorized", "owner approval source does not match the Wallet Session");
+			let sourceFacts;
+			try {
+				sourceFacts = await metadata.readVerifiedOwnerSourceFactsV1({
+					walletId: input.owner.walletId,
+					walletSessionId: String(input.approval.ownerAuthorization.walletSessionId),
+					authorizationId: String(input.approval.ownerAuthorization.authorizationId),
+					requestedAtMs: input.requestedAtMs
+				});
+			} catch {
+				return denied("unauthorized", "owner source key manifest is unavailable or ambiguous");
+			}
+			return {
+				kind: "authorized",
+				sourceSignerManifest: sourceFacts.signerManifest,
+				sourceKeyManifestDigestsB64u: sourceFacts.keyManifestDigestsB64u,
+				sourceAuthorityDigestB64u: sourceFacts.sourceAuthorityDigestB64u
+			};
+		}
+	};
+}
+function createOwnerAuthorizationRouteV1(input) {
+	return { authorizeOwnerForLinkingV1: async (request) => {
+		const ownerError = validateOwnerContext(request.owner, request.requestedAtMs, input.nowV1);
+		if (ownerError) throw new Error(ownerError.message);
+		const payload = parseQrLinkedDeviceSessionPayloadV5(request.payload);
+		const attenuationError = requestedAuthorityAttenuationError(request.owner.permission, payload.requestedPermission);
+		if (attenuationError) throw new Error(attenuationError);
+		const sourceFacts = await input.metadata.readVerifiedOwnerSourceFactsV1({
+			walletId: request.owner.walletId,
+			walletSessionId: String(request.owner.walletSessionId),
+			authorizationId: String(request.owner.authorizationId),
+			requestedAtMs: request.requestedAtMs
+		});
+		const metadata = normalizeOwnerAuthorizationMetadataV1({
+			walletId: request.owner.walletId,
+			ownerAuthorization: ownerAuthorizationSourceForContext(request.owner),
+			expiresAtMs: Math.min(payload.expiresAtMs, request.owner.expiresAtMs)
+		}, request.owner, payload);
+		return {
+			authentication: {
+				kind: "link_session_authenticated_request_v1",
+				source: ownerAuthorizationSourceForContext(request.owner),
+				proofDigestB64u: request.bodyDigestB64u
+			},
+			walletId: metadata.walletId,
+			ownerAuthorization: metadata.ownerAuthorization,
+			sourceSignerManifest: sourceFacts.signerManifest,
+			expiresAtMs: metadata.expiresAtMs
+		};
+	} };
+}
+function createD1LinkedDeviceOwnerSourceResolverV1(input) {
+	return { resolveOwnerSourceChildV1: async (request) => {
+		const owner = await resolveApprovedOwnerContextV1(input.metadata, request);
+		assertApprovedOwnerContext(request, owner, input.nowV1());
+		const resolution = await input.metadata.readOwnerSourceChildV1({
+			owner,
+			request
+		});
+		if (!resolution) throw new Error("authoritative linked-device source facts are unavailable");
+		assertResolutionMatchesOwnerProjectionV1(resolution, await projectOwnerLaneV1(input.walletRegistration, owner, resolution));
+		if (request.sourceSigner.walletKeyId !== resolution.walletKeyId || request.sourceSigner.keyFamily !== resolution.keyFamily) throw new Error("linked-device source signer does not match the active owner projection");
+		return resolution;
+	} };
+}
+async function resolveApprovedOwnerContextV1(metadata, request) {
+	const identity = sourceRequestIdentity(request);
+	const owner = await metadata.readApprovedOwnerContextV1(identity);
+	if (!owner) throw new Error("approved owner Wallet Session context is unavailable");
+	return owner;
+}
+function sourceRequestIdentity(request) {
+	return {
+		walletId: request.approval.walletId,
+		linkSessionId: String(request.approval.linkSessionId),
+		keyFamily: request.sourceSigner.keyFamily
+	};
+}
+function assertApprovedOwnerContext(request, owner, nowMs) {
+	const identity = sourceRequestIdentity(request);
+	if (owner.walletId !== identity.walletId || !Number.isSafeInteger(nowMs) || nowMs >= owner.expiresAtMs) throw new Error("approved owner Wallet Session context is expired or mismatched");
+	if (!hasDelegatedWalletPermissionV1(owner.permission, "link_devices")) throw new Error("approved owner Wallet Session authority does not contain link_devices");
+	if (request.kind === "preparation") {
+		const attenuationError = requestedAuthorityAttenuationError(owner.permission, request.approval.permission);
+		if (attenuationError) throw new Error(attenuationError);
+	}
+	if (request.kind === "preparation" && !ownerAuthorizationSourceMatchesContext(request.approval.ownerAuthorization, owner)) throw new Error("approved owner Wallet Session source does not match the approval");
+}
+async function projectOwnerLaneV1(walletRegistration, owner, resolution) {
+	const authorization = owner.curve === "ed25519" ? {
+		kind: "wallet_auth_method",
+		walletAuthMethodId: owner.authority.bindingId
+	} : {
+		kind: "authority_ref",
+		authorityRef: owner.walletAuthAuthorityRef,
+		authSource: owner.authSource
+	};
+	const result = await walletRegistration.resolveActiveOwnerWalletExecutionLane({
+		walletId: owner.walletId,
+		authorization,
+		expectedMaterialActivation: resolution.source.materialActivation
+	});
+	if (result.kind !== "projected") throw new Error(`active owner source lane projection refused: ${result.reason}`);
+	return result.projection;
+}
+function assertResolutionMatchesOwnerProjectionV1(resolution, projection) {
+	const lane = projection.lane;
+	if (resolution.walletKeyId !== projection.walletKey.walletKeyId || resolution.source.laneId !== lane.laneId || resolution.source.laneKind !== lane.laneKind || resolution.source.laneShareEpoch !== lane.laneShareEpoch || resolution.source.revocationEpoch !== lane.lifecycle.revocationEpoch || resolution.source.participantBindingDigestB64u !== lane.participantBindingDigestB64u || !mpcMaterialActivationRefsEqual(resolution.source.materialActivation, projection.materialActivation)) throw new Error("linked-device source facts do not match the active owner projection");
+	if (resolution.keyFamily !== projection.walletKey.keyFamily) throw new Error("linked-device source key family does not match the owner projection");
+	if (resolution.keyFamily === "ed25519") {
+		if (projection.walletKey.keyFamily !== "ed25519" || resolution.registeredPublicKeyB64u !== projection.walletKey.registeredPublicKeyB64u || resolution.nearEd25519SigningKeyId !== projection.walletKey.nearEd25519SigningKeyId || resolution.keyCreationSignerSlot !== projection.walletKey.keyCreationSignerSlot) throw new Error("Ed25519 linked-device source facts do not match the owner projection");
+	}
+}
+function normalizeOwnerAuthorizationMetadataV1(metadata, owner, payload) {
+	if (metadata.walletId !== owner.walletId) throw new Error("owner authorization metadata walletId does not match the Wallet Session");
+	const ownerAuthorization = metadata.ownerAuthorization;
+	if (!ownerAuthorizationSourceMatchesContext(ownerAuthorization, owner)) throw new Error("owner authorization metadata source does not match the Wallet Session");
+	if (!Number.isSafeInteger(metadata.expiresAtMs) || metadata.expiresAtMs <= 0 || metadata.expiresAtMs > payload.expiresAtMs || metadata.expiresAtMs > owner.expiresAtMs) throw new Error("owner authorization metadata expiry is invalid");
+	return {
+		walletId: owner.walletId,
+		ownerAuthorization,
+		expiresAtMs: metadata.expiresAtMs
+	};
+}
+function ownerAuthorizationSourceForContext(owner) {
+	return buildWalletSessionLinkedDeviceOwnerAuthorizationV1({
+		walletSessionId: owner.walletSessionId,
+		authorizationId: owner.authorizationId
+	});
+}
+function ownerAuthorizationSourceMatchesContext(source, owner) {
+	return source.kind === "wallet_session" && String(source.walletSessionId) === String(owner.walletSessionId) && String(source.authorizationId) === String(owner.authorizationId);
+}
+function validateOwnerContext(owner, requestedAtMs, nowV1) {
+	if (!owner.walletId || !parseWalletSessionId(owner.walletSessionId).ok || !parseWalletSessionAuthorizationId(owner.authorizationId).ok || !Number.isSafeInteger(owner.expiresAtMs) || !Number.isSafeInteger(requestedAtMs) || requestedAtMs < 0 || requestedAtMs >= owner.expiresAtMs || nowV1() >= owner.expiresAtMs || !hasDelegatedWalletPermissionV1(owner.permission, "link_devices")) return denied("invalid", "owner Wallet Session context is invalid or expired");
+	return null;
+}
+function requestedAuthorityAttenuationError(parent, child) {
+	if (!hasDelegatedWalletPermissionV1(parent, "link_devices")) return "owner Wallet Session authority does not contain link_devices";
+	const result = validateDelegatedWalletAuthorityAttenuationV1({
+		parent,
+		child
+	});
+	return result.ok ? null : result.error.message;
+}
+function denied(code, message) {
+	return {
+		kind: "denied",
+		code,
+		message
+	};
+}
+function isOwnerApprovalAuthorizationSession(session) {
+	switch (session.state.state) {
+		case "claimed":
+		case "awaiting_source_contribution": return true;
+		default: return false;
+	}
+}
+function parseRequired(result, label) {
+	if (result.ok) return result.value;
+	throw new Error(`${label}: ${result.error.message}`);
+}
+//#endregion
+export { createD1LinkedDeviceOwnerAuthorizationMetadataSourceV1, createD1LinkedDeviceOwnerAuthorizationProviderV1, createD1LinkedDeviceOwnerSourceChildReaderV1 };
+
+//# sourceMappingURL=d1LinkedDeviceOwnerAuthorizationProvider.js.map