@seams/wallet-server 0.5.0

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetPlanner.js

@@ -0,0 +1,169 @@
+import { parseWalletAuthMethodId, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
+import { hasDelegatedWalletPermissionV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
+import { buildLinkedDeviceTargetPreparationV1 } from "../../../../shared-ts/src/device-linking/parsers.js";
+import { computeLinkedDevicePasskeyTargetConfigurationDigestV1 } from "../../../../shared-ts/src/device-linking/digests.js";
+import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
+import { PASSKEY_PRF_FIRST_SALT_V1, PASSKEY_PRF_SECOND_SALT_V1 } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
+import { normalizeLinkedDevicePasskeyTargetConfigurationV1 } from "../auth/d1RouterApiAuthConfig.js";
+//#region src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetPlanner.ts
+const DEFAULT_TARGET_PREPARATION_TTL_MS = 300 * 1e3;
+/**
+* Builds the one durable target preparation. Ordinary material activation and
+* reservation identities are derived only after Device 2 verifies its factor.
+*/
+var D1LinkedDeviceTargetPlannerV1 = class {
+	constructor(input) {
+		this.resolveOwnerSourceChildV1 = input.resolveOwnerSourceChildV1;
+		const targetPasskeyRpId = parseWebAuthnRpId(input.targetPasskeyRpId);
+		if (!targetPasskeyRpId.ok) throw new Error(`linked-device target Passkey RP ID: ${targetPasskeyRpId.error.message}`);
+		this.targetPasskeyRpId = targetPasskeyRpId.value;
+		const ttlMs = input.preparationTtlMs ?? DEFAULT_TARGET_PREPARATION_TTL_MS;
+		if (!Number.isSafeInteger(ttlMs) || ttlMs <= 0) throw new Error("linked-device target preparation TTL must be a positive safe integer");
+		this.preparationTtlMs = ttlMs;
+	}
+	async createTargetPreparationV1(input) {
+		assertPreparationInput(input.session, input.approval, input.requestedAtMs);
+		const expiresAtMs = Math.min(input.approval.expiresAtMs, input.requestedAtMs + this.preparationTtlMs);
+		if (expiresAtMs <= input.requestedAtMs) throw new Error("linked-device target preparation has no remaining lifetime");
+		const ordinarySignerMaterialRecipientRequirements = [];
+		let ed25519ExportRoot = null;
+		const sourceSignerManifest = input.session.approvalTranscript?.sourceSignerManifest;
+		if (!sourceSignerManifest) throw new Error("linked-device verified source signer manifest is unavailable");
+		for (let childIndex = 0; childIndex < sourceSignerManifest.signers.length; childIndex += 1) {
+			const sourceSigner = sourceSignerManifest.signers[childIndex];
+			if (!sourceSigner) throw new Error(`linked-device source signer ${childIndex} is missing`);
+			const resolution = await this.resolveOwnerSourceChildV1({
+				kind: "preparation",
+				session: input.session,
+				approval: input.approval,
+				sourceSigner,
+				childIndex
+			});
+			assertResolutionMatchesSourceSigner(resolution, sourceSigner, childIndex);
+			if (resolution.keyFamily === "ed25519" && hasDelegatedWalletPermissionV1(input.approval.permission, "export_keys")) {
+				if (ed25519ExportRoot !== null) throw new Error("linked-device approval contains multiple Ed25519 source children");
+				ed25519ExportRoot = {
+					kind: "linked_device_ed25519_export_root_preparation_v1",
+					walletKeyId: resolution.walletKeyId,
+					applicationBindingDigestB64u: resolution.applicationBindingDigestB64u,
+					registeredPublicKeyB64u: resolution.registeredPublicKeyB64u,
+					revocationEpoch: resolution.source.revocationEpoch
+				};
+			}
+			ordinarySignerMaterialRecipientRequirements.push({
+				kind: "ordinary_signer_material_recipient_requirement_v1",
+				walletKeyId: sourceSigner.walletKeyId,
+				keyFamily: sourceSigner.keyFamily
+			});
+		}
+		const walletAuthMethodId = parseWalletAuthMethodId(`wallet-auth-method:${secureRandomBase64Url(32, "linked-device target wallet auth method")}`);
+		if (!walletAuthMethodId.ok) throw new Error(`linked-device target wallet auth method id: ${walletAuthMethodId.error.message}`);
+		if (input.approval.targetFactor.kind === "passkey_prf") {
+			const targetPasskeyConfiguration = normalizeLinkedDevicePasskeyTargetConfigurationV1({
+				expectedOrigin: input.expectedOrigin,
+				targetPasskeyRpId: this.targetPasskeyRpId
+			});
+			const passkeyTargetConfiguration = {
+				kind: "linked_device_passkey_target_configuration_v1",
+				...targetPasskeyConfiguration,
+				configurationDigestB64u: await computeLinkedDevicePasskeyTargetConfigurationDigestV1(targetPasskeyConfiguration)
+			};
+			return buildLinkedDeviceTargetPreparationV1({
+				linkSessionId: input.approval.linkSessionId,
+				walletId: input.approval.walletId,
+				enrollmentId: input.approval.enrollmentId,
+				deviceId: input.approval.deviceId,
+				deliveryRecipientPublicKey65B64u: input.deliveryRecipientPublicKey65B64u,
+				walletAuthMethodId: walletAuthMethodId.value,
+				ed25519ExportRoot,
+				targetFactor: input.approval.targetFactor,
+				passkeyCreationOptions: buildPasskeyCreationOptionsV1({
+					walletAuthMethodId: walletAuthMethodId.value,
+					walletId: input.approval.walletId,
+					rpId: targetPasskeyConfiguration.rpId
+				}),
+				passkeyConfigurationDigestB64u: passkeyTargetConfiguration.configurationDigestB64u,
+				ordinarySignerMaterialRecipientRequirements: requireNonEmpty(ordinarySignerMaterialRecipientRequirements, "linked-device ordinary signer material recipient requirements"),
+				issuedAtMs: input.requestedAtMs,
+				expiresAtMs
+			});
+		}
+		const target = input.approval.targetFactor;
+		const common = {
+			linkSessionId: input.approval.linkSessionId,
+			walletId: input.approval.walletId,
+			enrollmentId: input.approval.enrollmentId,
+			deviceId: input.approval.deviceId,
+			deliveryRecipientPublicKey65B64u: input.deliveryRecipientPublicKey65B64u,
+			walletAuthMethodId: walletAuthMethodId.value,
+			ed25519ExportRoot,
+			targetFactor: { kind: "email_otp" },
+			targetEmail: target.targetEmail,
+			ordinarySignerMaterialRecipientRequirements: requireNonEmpty(ordinarySignerMaterialRecipientRequirements, "linked-device ordinary signer material recipient requirements"),
+			issuedAtMs: input.requestedAtMs,
+			expiresAtMs
+		};
+		if (target.enrollment.kind === "existing_enrollment") {
+			if (!target.baseWalletAuthMethodId) throw new Error("existing Email OTP target is missing its base factor");
+			return buildLinkedDeviceTargetPreparationV1({
+				...common,
+				enrollment: target.enrollment,
+				baseWalletAuthMethodId: target.baseWalletAuthMethodId
+			});
+		}
+		return buildLinkedDeviceTargetPreparationV1({
+			...common,
+			enrollment: target.enrollment
+		});
+	}
+};
+function buildPasskeyCreationOptionsV1(input) {
+	const challengeId = secureRandomBase64Url(16, "linked-device target passkey challenge id");
+	const challengeB64u = secureRandomBase64Url(32, "linked-device target passkey challenge");
+	return {
+		kind: "webauthn_add_auth_method_registration_v1",
+		walletAuthMethodId: input.walletAuthMethodId,
+		challengeId,
+		challengeB64u,
+		rpId: input.rpId,
+		user: {
+			idB64u: base64UrlEncode(new TextEncoder().encode(String(input.walletId))),
+			name: String(input.walletId),
+			displayName: String(input.walletId)
+		},
+		pubKeyCredParams: [{
+			type: "public-key",
+			alg: -7
+		}, {
+			type: "public-key",
+			alg: -257
+		}],
+		authenticatorSelection: {
+			residentKey: "required",
+			userVerification: "preferred"
+		},
+		timeoutMs: 6e4,
+		attestation: "none",
+		extensions: { prf: { eval: {
+			firstB64u: base64UrlEncode(PASSKEY_PRF_FIRST_SALT_V1),
+			secondB64u: base64UrlEncode(PASSKEY_PRF_SECOND_SALT_V1)
+		} } },
+		excludeCredentials: []
+	};
+}
+function assertPreparationInput(session, approval, requestedAtMs) {
+	if (session.state.state !== "awaiting_target_factor" || session.linkSessionId !== approval.linkSessionId || session.claimTranscript?.value.walletId !== approval.walletId || session.claimTranscript?.value.enrollmentId !== approval.enrollmentId || requestedAtMs < approval.approvedAtMs || requestedAtMs >= approval.expiresAtMs) throw new Error("linked-device target preparation input is not an awaiting approved session");
+}
+function assertResolutionMatchesSourceSigner(resolution, sourceSigner, childIndex) {
+	if (resolution.walletKeyId !== sourceSigner.walletKeyId || resolution.keyFamily !== sourceSigner.keyFamily) throw new Error(`linked-device source resolution ${childIndex} differs from verified signer`);
+}
+function requireNonEmpty(values, label) {
+	const [first, ...rest] = values;
+	if (first === void 0) throw new Error(`${label} must not be empty`);
+	return [first, ...rest];
+}
+//#endregion
+export { D1LinkedDeviceTargetPlannerV1 };
+
+//# sourceMappingURL=d1LinkedDeviceTargetPlanner.js.map

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceVerifiedLinkBuilder.js

@@ -0,0 +1,255 @@
+import { parseWebAuthnCredentialIdB64u } from "../../../../shared-ts/src/utils/domainIds.js";
+import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import { buildExactAdministeredSignerManifestV1 } from "../../../../shared-ts/src/device-linking/delegatedActivationPlan.js";
+import { buildDelegatedWalletAuthorityV1, validateDelegatedWalletAuthorityAttenuationV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
+import { walletAuthorityDigestsMatchV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
+import { sourceKeyManifestDigestForFamilyV1 } from "../../../../core/deviceLinking/linkedDeviceSession.js";
+//#region src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceVerifiedLinkBuilder.ts
+const VERIFIED_TARGET_FACTOR_DOMAIN_V1 = "seams/linked-device/verified-target-factor/v1";
+async function buildVerifiedLinkInputV1(input) {
+	assertRegistrationIdentity(input);
+	const sourceContribution = input.approval.sourceContribution;
+	if (!sourceContribution) throw new Error("linked-device source contribution has not been relayed by Device 1");
+	if (input.approval.ownerAuthorization.kind !== "wallet_session") throw new Error("verified device linking requires an ordinary Wallet Session");
+	const sourceSignerManifest = input.session.approvalTranscript?.sourceSignerManifest;
+	const sourceKeyFamily = sourceSignerManifest?.keyFamilies[0];
+	if (!sourceSignerManifest || !sourceKeyFamily) throw new Error("verified device linking source signer manifest is missing");
+	const source = await input.source.readVerifiedSourceV1({
+		walletId: input.registration.walletId,
+		walletSessionId: String(input.approval.ownerAuthorization.walletSessionId),
+		authorizationId: String(input.approval.ownerAuthorization.authorizationId),
+		keyFamily: sourceKeyFamily,
+		requestedAtMs: input.requestedAtMs
+	});
+	await assertSourceRead(source, input.registration.walletId, input.requestedAtMs);
+	const approvedSourceDigest = input.session.approvalTranscript ? sourceKeyManifestDigestForFamilyV1(input.session.approvalTranscript.sourceKeyManifestDigestsB64u, sourceKeyFamily) : null;
+	if (!approvedSourceDigest || approvedSourceDigest !== source.keyManifestDigestB64u) throw new Error("source custody manifest digest does not match the approved Wallet Session");
+	if (!linkedDeviceSignerManifestsEqualV1(source.signerManifest, sourceSignerManifest)) throw new Error("source signer manifest changed after owner approval");
+	const targetFactor = await buildVerifiedTargetFactorV1({
+		preparation: input.preparation,
+		registration: input.registration,
+		evidence: input.evidence,
+		requestedAtMs: input.requestedAtMs
+	});
+	assertPermissionAttenuation(source.authority, input.approval.permission);
+	assertSourceManifestMatchesAuthority(source.authority, source.signerManifest);
+	const sourceAuthority = {
+		authority: source.authority,
+		authMethodId: source.authMethod.walletAuthMethodId,
+		verifiedRevocationEpoch: source.verifiedRevocationEpoch,
+		authorityDigestB64u: source.authorityDigestB64u,
+		verifiedAtMs: source.verifiedAtMs
+	};
+	return {
+		walletId: input.registration.walletId,
+		linkSessionId: input.registration.linkSessionId,
+		enrollmentId: input.registration.enrollmentId,
+		targetDeviceId: parseTargetDeviceId(input.registration.deviceId),
+		deliveryRecipientPublicKey65B64u: input.preparation.deliveryRecipientPublicKey65B64u,
+		sourceAuthority,
+		targetFactor,
+		permissions: input.approval.permission.permissions,
+		signerManifest: source.signerManifest,
+		sourceContribution,
+		emailOtpEnrollment: targetEmailOtpEnrollmentForRegistration(input.registration),
+		ordinarySignerMaterialRecipientRequests: input.registration.ordinarySignerMaterialRecipientRequests
+	};
+}
+function targetEmailOtpEnrollmentForRegistration(registration) {
+	if (registration.targetFactor.kind !== "email_otp") return null;
+	const grant = registration.emailOtpVerificationGrant;
+	if (!grant || grant.enrollment.kind !== "new_enrollment") return null;
+	const material = registration.emailOtpEnrollment;
+	if (!material) throw new Error("Email OTP target enrollment material is missing");
+	return material;
+}
+async function computeVerifiedTargetFactorVerificationDigestV1(input) {
+	const evidence = input.evidence.kind === "passkey_prf" ? {
+		kind: input.evidence.kind,
+		credentialIdB64u: input.evidence.credential.credentialIdB64u,
+		credentialPublicKeyB64u: input.evidence.credential.credentialPublicKeyB64u,
+		counter: input.evidence.credential.counter
+	} : {
+		kind: input.evidence.kind,
+		grantId: input.evidence.grant.grantId,
+		targetEmail: input.evidence.grant.targetEmail,
+		enrollment: input.evidence.grant.enrollment.kind,
+		providerUserId: input.evidence.grant.providerUserId,
+		...input.evidence.grant.enrollment.kind === "existing_enrollment" ? { baseWalletAuthMethodId: input.evidence.grant.baseWalletAuthMethodId } : {},
+		authorityDigestB64u: input.evidence.grant.authorityDigestB64u,
+		descriptorCredentialIdB64u: input.evidence.grant.descriptorCredentialIdB64u
+	};
+	return parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(`${VERIFIED_TARGET_FACTOR_DOMAIN_V1}\u0000${alphabetizeStringify({
+		linkSessionId: input.registration.linkSessionId,
+		walletId: input.registration.walletId,
+		enrollmentId: input.registration.enrollmentId,
+		deviceId: input.registration.deviceId,
+		walletAuthMethodId: input.registration.walletAuthMethodId,
+		targetPreparationDigestB64u: input.registration.targetPreparationDigestB64u,
+		verifiedAtMs: input.verifiedAtMs,
+		evidence
+	})}`)));
+}
+async function buildVerifiedTargetFactorV1(input) {
+	const verifiedAtMs = input.registration.registeredAtMs;
+	if (!Number.isSafeInteger(verifiedAtMs) || verifiedAtMs < 0 || verifiedAtMs > input.requestedAtMs) throw new Error("target factor verification time is invalid");
+	const verificationDigestB64u = await computeVerifiedTargetFactorVerificationDigestV1({
+		registration: input.registration,
+		evidence: input.evidence,
+		verifiedAtMs
+	});
+	if (input.registration.targetFactor.kind === "passkey_prf") {
+		if (input.evidence.kind !== "passkey_prf" || !input.registration.webauthnRegistration) throw new Error("Passkey target factor evidence is missing");
+		if (input.registration.webauthnRegistration.credentialIdB64u !== input.evidence.credential.credentialIdB64u) throw new Error("Passkey target factor credential identity changed");
+		return {
+			kind: "verified_passkey_target_v1",
+			authMethod: {
+				walletAuthMethodId: input.registration.walletAuthMethodId,
+				walletId: input.registration.walletId,
+				createdAtMs: verifiedAtMs,
+				kind: "passkey",
+				rpId: requirePasskeyRpId(input.preparation),
+				credentialIdB64u: requireCredentialId(input.evidence.credential.credentialIdB64u),
+				credentialPublicKeyB64u: canonicalBase64Url(input.evidence.credential.credentialPublicKeyB64u, "Passkey credential public key"),
+				counter: requireCounter(input.evidence.credential.counter)
+			},
+			verificationDigestB64u,
+			verifiedAtMs
+		};
+	}
+	if (input.evidence.kind !== "email_otp" || !input.registration.emailOtpVerificationGrant) throw new Error("Email OTP target factor evidence is missing");
+	const grant = input.registration.emailOtpVerificationGrant;
+	if (grant.linkSessionId !== input.registration.linkSessionId || grant.walletId !== input.registration.walletId || grant.enrollmentId !== input.registration.enrollmentId || grant.deviceId !== input.registration.deviceId || grant.targetPreparationDigestB64u !== input.registration.targetPreparationDigestB64u || grant.grantId !== input.evidence.grant.grantId || grant.authorityDigestB64u !== input.evidence.grant.authorityDigestB64u) throw new Error("Email OTP target factor grant identity changed");
+	if (grant.targetEmail !== input.registration.targetEmail || grant.targetEmail !== input.preparation.targetEmail || grant.enrollment.kind !== input.evidence.grant.enrollment.kind || grant.providerUserId !== input.evidence.grant.providerUserId) throw new Error("Email OTP target factor enrollment identity changed");
+	if (grant.enrollment.kind === "existing_enrollment") {
+		if (input.evidence.grant.enrollment.kind !== "existing_enrollment" || grant.baseWalletAuthMethodId !== input.evidence.grant.baseWalletAuthMethodId || grant.baseWalletAuthMethodId !== input.preparation.baseWalletAuthMethodId) throw new Error("Email OTP target factor base identity changed");
+	} else if (input.evidence.grant.enrollment.kind !== "new_enrollment" || input.registration.emailOtpEnrollment === void 0) throw new Error("Email OTP target factor enrollment material is missing");
+	const authMethod = {
+		walletAuthMethodId: input.registration.walletAuthMethodId,
+		walletId: input.registration.walletId,
+		createdAtMs: grant.issuedAtMs,
+		kind: "email_otp",
+		emailHashHex: grant.emailHashHex,
+		registrationAuthorityId: grant.registrationAuthorityId
+	};
+	if (grant.enrollment.kind === "existing_enrollment") {
+		const baseWalletAuthMethodId = grant.baseWalletAuthMethodId;
+		if (!baseWalletAuthMethodId) throw new Error("Email OTP existing target factor is missing its base factor");
+		return {
+			kind: "verified_email_otp_target_v1",
+			authMethod,
+			targetEmail: grant.targetEmail,
+			enrollment: grant.enrollment,
+			baseWalletAuthMethodId,
+			providerUserId: grant.providerUserId,
+			verificationDigestB64u,
+			verifiedAtMs
+		};
+	}
+	return {
+		kind: "verified_email_otp_target_v1",
+		authMethod,
+		targetEmail: grant.targetEmail,
+		enrollment: grant.enrollment,
+		providerUserId: grant.providerUserId,
+		verificationDigestB64u,
+		verifiedAtMs
+	};
+}
+async function assertSourceRead(source, walletId, requestedAtMs) {
+	if (source.authority.state !== "active" || source.authority.walletId !== walletId) throw new Error("source authority is not active for the requested wallet");
+	if (source.authMethod.status !== "active" || source.authMethod.walletId !== walletId || source.authMethod.walletAuthorityId !== source.authority.authorityId) throw new Error("source Wallet Auth Method is not active for the source authority");
+	if (source.authorityDigestB64u !== source.authority.authorityDigestB64u) throw new Error("source authority digest claim does not match the authority");
+	if (!await walletAuthorityDigestsMatchV1(source.authority)) throw new Error("source authority digest is invalid");
+	if (source.verifiedRevocationEpoch !== source.authority.revocationEpoch) throw new Error("source authority revocation epoch is stale");
+	if (!Number.isSafeInteger(source.verifiedAtMs) || source.verifiedAtMs < 0 || source.verifiedAtMs > requestedAtMs) throw new Error("source authority verification time is invalid");
+	if (!source.authority.permissions.includes("link_devices")) throw new Error("source authority does not grant link_devices");
+}
+function assertRegistrationIdentity(input) {
+	const { registration, preparation, session, approval } = input;
+	if (registration.linkSessionId !== session.linkSessionId || registration.linkSessionId !== approval.linkSessionId || registration.linkSessionId !== preparation.linkSessionId || registration.walletId !== approval.walletId || registration.walletId !== preparation.walletId || registration.enrollmentId !== approval.enrollmentId || registration.enrollmentId !== preparation.enrollmentId || registration.deviceId !== approval.deviceId || registration.deviceId !== preparation.deviceId || registration.walletAuthMethodId !== preparation.walletAuthMethodId || registration.targetPreparationDigestB64u.length === 0) throw new Error("verified link identities do not match the approved session");
+	if (session.state.state !== "awaiting_target_factor" && session.state.state !== "provisioning") throw new Error(`verified link cannot commit from ${session.state.state}`);
+	if (registration.ordinarySignerMaterialRecipientRequests.length !== preparation.ordinarySignerMaterialRecipientRequirements.length) throw new Error("verified link recipient requests do not match target preparation");
+	for (let index = 0; index < preparation.ordinarySignerMaterialRecipientRequirements.length; index += 1) {
+		const requirement = preparation.ordinarySignerMaterialRecipientRequirements[index];
+		const request = registration.ordinarySignerMaterialRecipientRequests[index];
+		if (!requirement || !request || requirement.keyFamily !== request.keyFamily || requirement.walletKeyId !== request.walletKeyId) throw new Error(`verified link recipient request ${index} differs from target preparation`);
+	}
+}
+function parseTargetDeviceId(value) {
+	const parsed = parseDeviceId(String(value));
+	if (!parsed.ok) throw new Error(`target device id is invalid: ${parsed.error.message}`);
+	return parsed.value;
+}
+function requireCredentialId(value) {
+	const parsed = parseWebAuthnCredentialIdB64u(value);
+	if (!parsed.ok) throw new Error(`Passkey credential id is invalid: ${parsed.error.message}`);
+	return parsed.value;
+}
+function requirePasskeyRpId(preparation) {
+	const options = preparation.passkeyCreationOptions;
+	if (preparation.targetFactor.kind !== "passkey_prf" || !options) throw new Error("Passkey target factor requires Passkey target preparation");
+	return options.rpId;
+}
+function assertPermissionAttenuation(source, requested) {
+	const result = validateDelegatedWalletAuthorityAttenuationV1({
+		parent: buildDelegatedWalletAuthorityV1({ permissions: source.permissions }),
+		child: buildDelegatedWalletAuthorityV1({ permissions: requested.permissions })
+	});
+	if (!result.ok) throw new Error(result.error.message);
+}
+function assertSourceManifestMatchesAuthority(authority, manifest) {
+	if (!linkedDeviceSignerManifestsEqualV1(manifestFromAuthority(authority), manifest)) throw new Error("source signer manifest does not match the active authority");
+}
+function linkedDeviceSignerManifestsEqualV1(left, right) {
+	if (left.kind !== right.kind || left.keyFamilies.length !== right.keyFamilies.length || left.signers.length !== right.signers.length) return false;
+	for (let index = 0; index < left.keyFamilies.length; index += 1) if (left.keyFamilies[index] !== right.keyFamilies[index]) return false;
+	for (let index = 0; index < left.signers.length; index += 1) {
+		const leftSigner = left.signers[index];
+		const rightSigner = right.signers[index];
+		if (!leftSigner || !rightSigner || leftSigner.kind !== rightSigner.kind || leftSigner.keyFamily !== rightSigner.keyFamily || leftSigner.walletId !== rightSigner.walletId || leftSigner.walletKeyId !== rightSigner.walletKeyId) return false;
+		switch (leftSigner.keyFamily) {
+			case "ed25519":
+				if (rightSigner.keyFamily !== "ed25519" || leftSigner.registeredPublicKeyB64u !== rightSigner.registeredPublicKeyB64u) return false;
+				break;
+			case "ecdsa_secp256k1":
+				if (rightSigner.keyFamily !== "ecdsa_secp256k1" || leftSigner.thresholdPublicKey33B64u !== rightSigner.thresholdPublicKey33B64u || leftSigner.evmAddress !== rightSigner.evmAddress) return false;
+				break;
+			default: return assertNeverLinkedDeviceSignerV1(leftSigner);
+		}
+	}
+	return true;
+}
+function assertNeverLinkedDeviceSignerV1(value) {
+	throw new Error(`unsupported linked-device signer family: ${String(value)}`);
+}
+function manifestFromAuthority(authority) {
+	return buildExactAdministeredSignerManifestV1(authority.signerActivations.keyFamilies.map((family) => {
+		if (family === "ed25519") {
+			if (!authority.signerActivations.ed25519) throw new Error("source Ed25519 activation is missing");
+			return authority.signerActivations.ed25519.signer;
+		}
+		if (!authority.signerActivations.ecdsa) throw new Error("source ECDSA activation is missing");
+		return authority.signerActivations.ecdsa.signer;
+	}));
+}
+function canonicalBase64Url(value, label) {
+	try {
+		const bytes = base64UrlDecode(value);
+		if (bytes.length === 0 || base64UrlEncode(bytes) !== value) throw new Error("is not canonical base64url");
+		return value;
+	} catch (error) {
+		throw new Error(`${label} ${error instanceof Error ? error.message : "is invalid"}`);
+	}
+}
+function requireCounter(value) {
+	if (!Number.isSafeInteger(value) || value < 0) throw new Error("Passkey counter is invalid");
+	return value;
+}
+//#endregion
+export { buildVerifiedLinkInputV1, buildVerifiedTargetFactorV1, computeVerifiedTargetFactorVerificationDigestV1, linkedDeviceSignerManifestsEqualV1 };
+
+//# sourceMappingURL=d1LinkedDeviceVerifiedLinkBuilder.js.map

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceVerifiedLinkSourceReader.js

@@ -0,0 +1,128 @@
+import { mpcMaterialActivationRefsEqual, parseWalletKeyId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { parseWalletSessionAuthorizationId, parseWalletSessionId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { buildExactAdministeredSignerManifestV1 } from "../../../../shared-ts/src/device-linking/delegatedActivationPlan.js";
+import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { deriveEvmFamilySigningKeySlotId } from "../../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";
+//#region src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceVerifiedLinkSourceReader.ts
+function createD1LinkedDeviceVerifiedLinkSourceReaderV1(input) {
+	return { readVerifiedSourceV1: async (request) => {
+		const walletSessionId = parseWalletSessionId(request.walletSessionId);
+		const authorizationId = parseWalletSessionAuthorizationId(request.authorizationId);
+		if (!walletSessionId.ok || !authorizationId.ok) throw new Error("source Wallet Session identity is invalid");
+		const sourceSession = await resolveSourceWalletSessionV1({
+			authorizationService: input.authorizationService,
+			tenantId: input.tenantId,
+			walletId: request.walletId,
+			walletSessionId: walletSessionId.value,
+			authorizationId: authorizationId.value,
+			nowMs: request.requestedAtMs
+		});
+		const walletAuthMethodId = sourceSession.walletAuthMethodId;
+		const authMethod = await input.authMethodStore.readByIdV2({ walletAuthMethodId });
+		if (!authMethod || authMethod.status !== "active") throw new Error("source Wallet Auth Method is not active");
+		const authorityId = sourceSession.authorityId;
+		const authority = await input.authorityStore.readById(authorityId);
+		if (!authority || authority.state !== "active") throw new Error("source Wallet Authority is not active");
+		if (authMethod.walletId !== request.walletId || authMethod.walletAuthorityId !== authorityId) throw new Error("source Wallet Auth Method authority provenance is invalid");
+		assertSourceSessionAuthorityV1(sourceSession, authority);
+		const [ed25519Signers, ecdsaSigners] = await Promise.all([input.walletStore.listEd25519SignersForWallet({ walletId: request.walletId }), input.walletStore.listEcdsaSignersForWallet({ walletId: request.walletId })]);
+		const signer = sourceSignerForFamilyV1({
+			authority,
+			keyFamily: request.keyFamily,
+			signers: request.keyFamily === "ed25519" ? ed25519Signers : ecdsaSigners
+		});
+		return {
+			authority,
+			authMethod,
+			signerManifest: signerManifestFromAuthority(authority),
+			keyManifestDigestB64u: parseDigestB64u(signer.custodyKeyManifestDigestB64u),
+			principalId: sourceSession.principalId,
+			expiresAtMs: sourceSession.expiresAtMs,
+			authorityDigestB64u: authority.authorityDigestB64u,
+			verifiedRevocationEpoch: authority.revocationEpoch,
+			verifiedAtMs: request.requestedAtMs
+		};
+	} };
+}
+async function resolveSourceWalletSessionV1(input) {
+	const issued = await input.authorizationService.readWalletSessionAuthorizationV2ByIdentity({
+		tenantId: input.tenantId,
+		walletId: input.walletId,
+		walletSessionId: input.walletSessionId,
+		authorizationId: input.authorizationId,
+		nowMs: input.nowMs
+	});
+	if (issued) {
+		const session = issued.session;
+		if (session.walletId !== input.walletId || session.walletSessionId !== input.walletSessionId || session.authorizationId !== input.authorizationId || session.expiresAtMs <= input.nowMs) throw new Error("source Wallet Session V2 identity changed or expired");
+		return session;
+	}
+	throw new Error("source exact Wallet Session is unavailable");
+}
+function assertSourceSessionAuthorityV1(source, authority) {
+	if (source.authorityId !== authority.authorityId || source.authorityDigestB64u !== authority.authorityDigestB64u || source.authorityRevocationEpoch !== authority.revocationEpoch) throw new Error("source Wallet Session V2 authority provenance is invalid");
+}
+/**
+* The authority genuinely owns no signer of this family. Distinct from every
+* infrastructure or identity failure so a caller probing families can fall
+* back on this alone and let real errors surface.
+*/
+var LinkedDeviceSourceFamilyUnavailableErrorV1 = class extends Error {
+	constructor(keyFamily) {
+		super(`source ${keyFamily} activation is missing`);
+		this.name = "LinkedDeviceSourceFamilyUnavailableErrorV1";
+	}
+};
+function sourceSignerForFamilyV1(input) {
+	const activation = input.keyFamily === "ed25519" ? input.authority.signerActivations.ed25519 : input.authority.signerActivations.ecdsa;
+	if (!activation) throw new LinkedDeviceSourceFamilyUnavailableErrorV1(input.keyFamily);
+	const matches = input.signers.filter((signer) => {
+		if (signer.walletId !== input.authority.walletId) return false;
+		if (input.keyFamily === "ed25519" && signer.version !== "wallet_signer_ed25519_v1" || input.keyFamily === "ecdsa_secp256k1" && signer.version !== "wallet_signer_ecdsa_v1") return false;
+		try {
+			if (!mpcMaterialActivationRefsEqual(routerAbMpcMaterialActivationRefFromWire(signer.version === "wallet_signer_ed25519_v1" ? signer.activeYaoCapability.activationResult.public_receipt.material_activation : signer.walletKey.publicCapability.material_activation), activation.materialActivation)) return false;
+			return sourceSignerIdentityMatchesV1(signer, activation.signer);
+		} catch {
+			return false;
+		}
+	});
+	if (matches.length === 0) throw new Error(`source ${input.keyFamily} signer identity is unavailable or ambiguous`);
+	const signer = matches[0];
+	if (!signer) throw new Error(`source ${input.keyFamily} signer identity is unavailable`);
+	const keyManifestDigestB64u = parseDigestB64u(signer.custodyKeyManifestDigestB64u);
+	for (const duplicate of matches.slice(1)) if (parseDigestB64u(duplicate.custodyKeyManifestDigestB64u) !== keyManifestDigestB64u) throw new Error(`source ${input.keyFamily} signer identity is unavailable or ambiguous`);
+	return signer;
+}
+function sourceSignerIdentityMatchesV1(signer, expected) {
+	if (signer.version === "wallet_signer_ed25519_v1") {
+		if (expected.keyFamily !== "ed25519") return false;
+		const walletKeyId = parseWalletKeyId(`wallet-key:ed25519:${signer.walletId}:${signer.nearEd25519SigningKeyId}`);
+		if (!walletKeyId.ok) return false;
+		return expected.walletKeyId === walletKeyId.value && expected.registeredPublicKeyB64u === base64UrlEncode(Uint8Array.from(signer.activeYaoCapability.activationResult.public_receipt.registered_public_key));
+	}
+	if (expected.keyFamily !== "ecdsa_secp256k1") return false;
+	const evmFamilySigningKeySlotId = deriveEvmFamilySigningKeySlotId({
+		walletId: signer.walletId,
+		signingRootId: signer.walletKey.signingRootId,
+		signingRootVersion: signer.walletKey.signingRootVersion
+	});
+	const walletKeyId = parseWalletKeyId(`wallet-key:ecdsa:${signer.walletId}:${evmFamilySigningKeySlotId}`);
+	if (!walletKeyId.ok) return false;
+	return expected.walletKeyId === walletKeyId.value && expected.thresholdPublicKey33B64u === signer.walletKey.thresholdEcdsaPublicKeyB64u && expected.evmAddress === signer.walletKey.thresholdOwnerAddress;
+}
+function signerManifestFromAuthority(authority) {
+	return buildExactAdministeredSignerManifestV1(authority.signerActivations.keyFamilies.map((family) => {
+		if (family === "ed25519") {
+			if (!authority.signerActivations.ed25519) throw new Error("source Ed25519 activation is missing");
+			return authority.signerActivations.ed25519.signer;
+		}
+		if (!authority.signerActivations.ecdsa) throw new Error("source ECDSA activation is missing");
+		return authority.signerActivations.ecdsa.signer;
+	}));
+}
+//#endregion
+export { LinkedDeviceSourceFamilyUnavailableErrorV1, createD1LinkedDeviceVerifiedLinkSourceReaderV1 };
+
+//# sourceMappingURL=d1LinkedDeviceVerifiedLinkSourceReader.js.map

package/dist/esm/router/cloudflare/d1/deviceLinking/index.js

@@ -0,0 +1,15 @@
+import { D1LinkedDeviceEd25519ExportRootStoreV1 } from "./d1LinkedDeviceEd25519ExportRootStore.js";
+import { D1LinkedDeviceRequestProofNonceStoreV1 } from "./d1LinkedDeviceRequestProofNonceStore.js";
+import { createD1LinkedDeviceSessionServiceV1 } from "./d1LinkedDeviceSessionService.js";
+import { parseD1LinkedDeviceSessionRowV1, parseD1LinkedDeviceSessionTranscriptRowV1 } from "./d1LinkedDeviceSessionRecords.js";
+import { D1LinkedDeviceSessionStoreV1 } from "./d1LinkedDeviceSessionStore.js";
+import { createD1LinkedDeviceRouteServiceV1 } from "./d1LinkedDeviceRouteService.js";
+import { D1LinkedDeviceSourceContributionPreparationPlannerV1, createD1LinkedDeviceSourceContributionPreparationPlannerV1, linkedDeviceX25519RecipientPublicKeyB64uV1 } from "./d1LinkedDeviceSourceContributionPreparationPlanner.js";
+import { D1LinkedDeviceAuthorityInstallServiceV1 } from "./d1LinkedDeviceAuthorityInstallService.js";
+import { LinkedDeviceSourceFamilyUnavailableErrorV1, createD1LinkedDeviceVerifiedLinkSourceReaderV1 } from "./d1LinkedDeviceVerifiedLinkSourceReader.js";
+import { buildVerifiedLinkInputV1, buildVerifiedTargetFactorV1, computeVerifiedTargetFactorVerificationDigestV1, linkedDeviceSignerManifestsEqualV1 } from "./d1LinkedDeviceVerifiedLinkBuilder.js";
+import { D1LinkedDeviceTargetCredentialProviderV1, LinkedDeviceRetiredTargetRegistrationShapeErrorV1, LinkedDeviceWebAuthnRegistrationVerifierV1 } from "./d1LinkedDeviceTargetCredentialProvider.js";
+import { D1LinkedDeviceTargetPlannerV1 } from "./d1LinkedDeviceTargetPlanner.js";
+import { createD1LinkedDeviceOwnerAuthorizationMetadataSourceV1, createD1LinkedDeviceOwnerAuthorizationProviderV1, createD1LinkedDeviceOwnerSourceChildReaderV1 } from "./d1LinkedDeviceOwnerAuthorizationProvider.js";
+import { D1LinkedDeviceTargetAuthenticatorStoreV1 } from "./d1LinkedDeviceTargetAuthenticatorStore.js";
+export { D1LinkedDeviceAuthorityInstallServiceV1, D1LinkedDeviceEd25519ExportRootStoreV1, D1LinkedDeviceRequestProofNonceStoreV1, D1LinkedDeviceSessionStoreV1, D1LinkedDeviceSourceContributionPreparationPlannerV1, D1LinkedDeviceTargetAuthenticatorStoreV1, D1LinkedDeviceTargetCredentialProviderV1, D1LinkedDeviceTargetPlannerV1, LinkedDeviceRetiredTargetRegistrationShapeErrorV1, LinkedDeviceSourceFamilyUnavailableErrorV1, LinkedDeviceWebAuthnRegistrationVerifierV1, buildVerifiedLinkInputV1, buildVerifiedTargetFactorV1, computeVerifiedTargetFactorVerificationDigestV1, createD1LinkedDeviceOwnerAuthorizationMetadataSourceV1, createD1LinkedDeviceOwnerAuthorizationProviderV1, createD1LinkedDeviceOwnerSourceChildReaderV1, createD1LinkedDeviceRouteServiceV1, createD1LinkedDeviceSessionServiceV1, createD1LinkedDeviceSourceContributionPreparationPlannerV1, createD1LinkedDeviceVerifiedLinkSourceReaderV1, linkedDeviceSignerManifestsEqualV1, linkedDeviceX25519RecipientPublicKeyB64uV1, parseD1LinkedDeviceSessionRowV1, parseD1LinkedDeviceSessionTranscriptRowV1 };