@seams/wallet-server 0.6.2 → 0.7.1

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionStore.js

@@ -3,7 +3,7 @@ import { assertNeverLinkSessionStateV1 } from "../../../../shared-ts/src/device-
 import { parseLinkedDeviceApprovalV1, parseLinkedDeviceSessionClaimV1 } from "../../../../shared-ts/src/device-linking/parsers.js";
 import { computeLinkedDeviceApprovalDigestV1, computeLinkedDeviceSessionClaimDigestV1 } from "../../../../shared-ts/src/device-linking/digests.js";
 import { d1ChangedRows, queryD1All } from "../../../../storage/d1Sql.js";
-import { LinkedDeviceRetiredSessionShapeErrorV1, linkedDeviceQrPayloadsEqualV1, parseLinkedDeviceSessionRecordV1 } from "../../../../core/deviceLinking/linkedDeviceSession.js";
+import { LinkedDeviceRetiredSessionShapeErrorV1, approvalTranscriptMatchesDigest, claimTranscriptMatchesDigest, conflictResult, integrityResult, invalidStateResult, isPrecommitState, linkedDeviceEmailOtpChallengesEqualV1, linkedDeviceQrPayloadsEqualV1, parseLinkedDeviceSessionRecordV1, sessionExpiryMsV1, sourceContributionTranscriptMatchesDigest } from "../../../../core/deviceLinking/linkedDeviceSessionRecord.js";
 import { parseD1LinkedDeviceSessionRowV1, parseD1LinkedDeviceSessionTranscriptRowV1 } from "./d1LinkedDeviceSessionRecords.js";
 //#region src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionStore.ts
 const SESSION_TABLE = "linked_device_sessions";
@@ -16,13 +16,21 @@ const SESSION_SCOPED_TABLES = [
 	"linked_device_target_commit_reservations",
 	"linked_device_target_credentials"
 ];
+/** Aborts the batch it is in when the statement just before it changed no row. */
 const SESSION_CAS_GUARD_SQL = `INSERT INTO linked_device_session_cas_guard (guard_id)
-SELECT 1 WHERE changes() = 0`;
+SELECT 1
+ WHERE changes() = 0`;
+const PRECOMMIT_STATES = [
+	"displaying_qr",
+	"claimed",
+	"awaiting_target_factor",
+	"awaiting_source_contribution",
+	"provisioning"
+];
 var D1LinkedDeviceSessionStoreV1 = class {
 	constructor(options) {
 		this.database = options.database;
 		this.scope = normalizeScope(options.scope);
-		this.now = options.now ?? Date.now;
 	}
 	async createUnclaimedSessionV1(record) {
 		const normalized = parseLinkedDeviceSessionRecordV1(record);
@@ -198,10 +206,7 @@ var D1LinkedDeviceSessionStoreV1 = class {
 	}
 	async recordTargetCredentialV1(input) {
 		return this.applyStateCas({
-			linkSessionId: input.linkSessionId,
-			expectedRevision: input.expectedRevision,
-			nextRecord: input.nextRecord,
-			nowMs: input.nowMs,
+			...sessionMutationFieldsV1(input),
 			expectedStates: ["awaiting_target_factor"],
 			nextStates: ["awaiting_source_contribution"],
 			replay: isAwaitingSourceContributionRecord
@@ -229,10 +234,7 @@ var D1LinkedDeviceSessionStoreV1 = class {
 	}
 	async recordEmailOtpChallengeStateV1(input) {
 		return this.applyStateCas({
-			linkSessionId: input.linkSessionId,
-			expectedRevision: input.expectedRevision,
-			nextRecord: input.nextRecord,
-			nowMs: input.nowMs,
+			...sessionMutationFieldsV1(input),
 			expectedStates: ["awaiting_target_factor"],
 			nextStates: ["awaiting_target_factor"],
 			replay: sameEmailOtpChallenge
@@ -260,10 +262,7 @@ var D1LinkedDeviceSessionStoreV1 = class {
 	}
 	async markAuthorityPendingLocalInstallV1(input) {
 		return this.applyStateCas({
-			linkSessionId: input.linkSessionId,
-			expectedRevision: input.expectedRevision,
-			nextRecord: input.nextRecord,
-			nowMs: input.nowMs,
+			...sessionMutationFieldsV1(input),
 			expectedStates: ["provisioning"],
 			nextStates: ["authority_pending_local_install"],
 			replay: (record) => record.state.state === "authority_pending_local_install" && record.state.authorityId === input.authorityId && record.state.packageSetDigestB64u === input.packageSetDigestB64u
@@ -279,10 +278,7 @@ var D1LinkedDeviceSessionStoreV1 = class {
 		if (current.state.state !== "authority_pending_local_install") return invalidStateResult(current);
 		if (current.state.authorityId !== input.authorityId || current.state.packageSetDigestB64u !== input.packageSetDigestB64u) return integrityResult(current, current.state.authorityId !== input.authorityId ? "authority_id_mismatch" : "package_set_digest_mismatch");
 		return this.applyStateCas({
-			linkSessionId: input.linkSessionId,
-			expectedRevision: input.expectedRevision,
-			nextRecord: input.nextRecord,
-			nowMs: input.nowMs,
+			...sessionMutationFieldsV1(input),
 			expectedStates: ["authority_pending_local_install"],
 			nextStates: ["active"],
 			replay: isActiveRecord
@@ -290,34 +286,16 @@ var D1LinkedDeviceSessionStoreV1 = class {
 	}
 	async failBeforeCommitV1(input) {
 		return this.applyTerminalStateCas({
-			linkSessionId: input.linkSessionId,
-			expectedRevision: input.expectedRevision,
-			nextRecord: input.nextRecord,
-			nowMs: input.nowMs,
-			expectedStates: [
-				"displaying_qr",
-				"claimed",
-				"awaiting_target_factor",
-				"awaiting_source_contribution",
-				"provisioning"
-			],
+			...sessionMutationFieldsV1(input),
+			expectedStates: PRECOMMIT_STATES,
 			nextStates: ["failed_before_commit"],
 			replay: isFailedRecord
 		});
 	}
 	async cancelSessionV1(input) {
 		return this.applyTerminalStateCas({
-			linkSessionId: input.linkSessionId,
-			expectedRevision: input.expectedRevision,
-			nextRecord: input.nextRecord,
-			nowMs: input.nowMs,
-			expectedStates: [
-				"displaying_qr",
-				"claimed",
-				"awaiting_target_factor",
-				"awaiting_source_contribution",
-				"provisioning"
-			],
+			...sessionMutationFieldsV1(input),
+			expectedStates: PRECOMMIT_STATES,
 			nextStates: ["cancelled"],
 			replay: isCancelledRecord
 		});
@@ -329,20 +307,11 @@ var D1LinkedDeviceSessionStoreV1 = class {
 			outcome: "replayed",
 			record: current
 		};
-		if (!isExpirableState(current.state)) return invalidStateResult(current);
-		if (input.nowMs < expiryMs(current)) return invalidStateResult(current);
+		if (!isPrecommitState(current.state)) return invalidStateResult(current);
+		if (input.nowMs < sessionExpiryMsV1(current)) return invalidStateResult(current);
 		return this.applyTerminalStateCas({
-			linkSessionId: input.linkSessionId,
-			expectedRevision: input.expectedRevision,
-			nextRecord: input.nextRecord,
-			nowMs: input.nowMs,
-			expectedStates: [
-				"displaying_qr",
-				"claimed",
-				"awaiting_target_factor",
-				"awaiting_source_contribution",
-				"provisioning"
-			],
+			...sessionMutationFieldsV1(input),
+			expectedStates: PRECOMMIT_STATES,
 			nextStates: ["expired"],
 			replay: isExpiredRecord
 		});
@@ -602,6 +571,14 @@ function sessionColumnValues(record) {
 		record.updatedAtMs
 	];
 }
+function sessionMutationFieldsV1(input) {
+	return {
+		linkSessionId: input.linkSessionId,
+		expectedRevision: input.expectedRevision,
+		nextRecord: input.nextRecord,
+		nowMs: input.nowMs
+	};
+}
 function normalizeMutationRecordV1(input) {
 	const record = parseLinkedDeviceSessionRecordV1(input.nextRecord);
 	if (String(record.linkSessionId) !== String(input.linkSessionId)) throw new Error("linked-device mutation session id does not match");
@@ -632,31 +609,15 @@ function minimalTerminalRecordV1(record) {
 		default: return assertNeverLinkSessionStateV1(record.state);
 	}
 }
-function claimTranscriptMatchesDigest(record, digest) {
-	return record.claimTranscript?.digestB64u === digest;
-}
-function approvalTranscriptMatchesDigest(record, digest) {
-	return record.approvalTranscript?.digestB64u === digest;
-}
 function isAwaitingSourceContributionRecord(record) {
 	return record.state.state === "awaiting_source_contribution";
 }
-function sourceContributionTranscriptMatchesDigest(record, digest) {
-	return record.sourceContributionTranscript?.digestB64u === digest;
-}
 function sameEmailOtpChallenge(record, nextRecord) {
 	if (record.state.state !== "awaiting_target_factor" || nextRecord.state.state !== "awaiting_target_factor") return false;
 	const left = record.emailOtpChallenge;
 	const right = nextRecord.emailOtpChallenge;
 	if (left === void 0 || right === void 0) return left === right;
-	switch (left.state) {
-		case "available": return right.state === "available" && left.maskedEmailHint === right.maskedEmailHint;
-		case "sent": return right.state === "sent" && left.challengeId === right.challengeId && left.workerEphemeralPublicKey65B64u === right.workerEphemeralPublicKey65B64u && left.maskedEmailHint === right.maskedEmailHint && left.expiresAtMs === right.expiresAtMs && left.resendAvailableAtMs === right.resendAvailableAtMs;
-		default: return assertNeverLinkedDeviceEmailOtpChallengeV1(left);
-	}
-}
-function assertNeverLinkedDeviceEmailOtpChallengeV1(value) {
-	throw new Error(`unsupported linked-device email OTP challenge: ${String(value)}`);
+	return linkedDeviceEmailOtpChallengesEqualV1(left, right);
 }
 function isActiveRecord(record) {
 	return record.state.state === "active";
@@ -670,63 +631,11 @@ function isCancelledRecord(record) {
 function isExpiredRecord(record) {
 	return record.state.state === "expired";
 }
-function isExpirableState(state) {
-	switch (state.state) {
-		case "displaying_qr":
-		case "claimed":
-		case "awaiting_target_factor":
-		case "awaiting_source_contribution":
-		case "provisioning": return true;
-		case "authority_pending_local_install":
-		case "active":
-		case "failed_before_commit":
-		case "cancelled":
-		case "expired": return false;
-		default: return assertNeverLinkSessionStateV1(state);
-	}
-}
-function expiryMs(record) {
-	switch (record.state.state) {
-		case "displaying_qr": return record.qrPayload.expiresAtMs;
-		case "claimed": return record.claimTranscript?.value.claimExpiresAtMs ?? record.qrPayload.expiresAtMs;
-		case "awaiting_target_factor":
-		case "awaiting_source_contribution":
-		case "provisioning": return record.approvalTranscript?.value.expiresAtMs ?? record.qrPayload.expiresAtMs;
-		case "authority_pending_local_install":
-		case "active":
-		case "failed_before_commit":
-		case "cancelled":
-		case "expired": return Number.POSITIVE_INFINITY;
-		default: return assertNeverLinkSessionStateV1(record.state);
-	}
-}
 function resolveMutationRace(expectedRevision, record) {
 	if (record.revision === expectedRevision) return invalidStateResult(record);
 	return conflictResult(expectedRevision, record);
 }
-function conflictResult(expectedRevision, record) {
-	return {
-		outcome: "conflict",
-		expectedRevision,
-		actualRevision: record?.revision ?? null,
-		record
-	};
-}
-function invalidStateResult(record) {
-	return {
-		outcome: "invalid_state",
-		state: record.state.state,
-		record
-	};
-}
-function integrityResult(record, reason) {
-	return {
-		outcome: "integrity_error",
-		reason,
-		record
-	};
-}
 //#endregion
-export { D1LinkedDeviceSessionStoreV1 };
+export { D1LinkedDeviceSessionStoreV1, SESSION_CAS_GUARD_SQL };
 
 //# sourceMappingURL=d1LinkedDeviceSessionStore.js.map

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSourceContributionPreparationPlanner.js

@@ -87,7 +87,7 @@ function buildEd25519Preparation(input) {
 		walletKeyId: input.signer.walletKeyId,
 		targetDeviceId: targetDeviceId.value,
 		targetFactorVerificationDigestB64u: input.input.targetFactor.verificationDigestB64u,
-		sourceBinding: input.resolution.sourceBinding,
+		sourceBinding: input.resolution.linkedSourceBinding ?? input.resolution.sourceBinding,
 		targetAdmission,
 		applicationBinding: input.resolution.applicationBinding,
 		sourceRevocationEpoch: input.resolution.source.revocationEpoch,
@@ -108,7 +108,7 @@ function buildEcdsaPreparation(input) {
 		enrollmentId: input.input.registration.enrollmentId,
 		sourceAuthorityId: input.input.source.authority.authorityId,
 		source: {
-			activation: input.resolution.source.materialActivation,
+			activation: input.resolution.linkedSourceMaterialActivation ?? input.resolution.source.materialActivation,
 			clientPublicKey33B64u: parseSecp256k1CompressedPublicKeyB64u(input.resolution.sourceHolderVerifyingShare33B64u),
 			relayerPublicKey33B64u: parseSecp256k1CompressedPublicKeyB64u(input.resolution.sourceServerVerifyingShare33B64u),
 			thresholdPublicKey33B64u: parseSecp256k1CompressedPublicKeyB64u(input.resolution.thresholdPublicKey33B64u),

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetCredentialProvider.js

@@ -1,7 +1,8 @@
 import { hasControlCharacter, mpcMaterialActivationRefsEqual, parseWebAuthnCredentialIdB64u } from "../../../../shared-ts/src/utils/domainIds.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
+import { parseDigestB64u, sha256Utf8DigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { requireCanonicalString, requireRecord } from "../../../../shared-ts/src/utils/validation.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1 } from "../../../../shared-ts/src/device-linking/sourceContribution.js";
 import { parseLinkedDeviceTargetCredentialRegistrationResultV1, parseLinkedDeviceTargetCredentialRegistrationV1, parseLinkedDeviceTargetPreparationV1 } from "../../../../shared-ts/src/device-linking/parsers.js";
@@ -10,6 +11,7 @@ import { d1ChangedRows } from "../../../../storage/d1Sql.js";
 import { errorMessage } from "../../../../shared-ts/src/utils/errors.js";
 import { parseClientDataJsonBase64url } from "../../../../core/authService/webauthnOidcHelpers.js";
 import { verifyWebAuthnRegistrationCredentialForIntent } from "../../../../core/authService/webauthn.js";
+import { SESSION_CAS_GUARD_SQL } from "./d1LinkedDeviceSessionStore.js";
 import { linkedDeviceEmailOtpDescriptorCredentialIdV1 } from "../../../../core/deviceLinking/linkedDeviceEmailOtpGrant.js";
 import { linkedDeviceX25519RecipientPublicKeyB64uV1 } from "./d1LinkedDeviceSourceContributionPreparationPlanner.js";
 import { buildVerifiedLinkInputV1, buildVerifiedTargetFactorV1 } from "./d1LinkedDeviceVerifiedLinkBuilder.js";
@@ -349,9 +351,7 @@ var D1LinkedDeviceTargetCredentialProviderV1 = class {
           WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
             AND link_session_id = ? AND state = 'prepared'
             AND preparation_digest_b64u = ?`).bind(JSON.stringify(serializedRegisteredTargetCredentialPayloadV2(payload)), String(input.evidence.grant.descriptorCredentialIdB64u), input.evidence.grant.grantId, input.keyManifestDigestB64u, input.registeredAtMs, ...scopeValues(this.scope), String(input.session.linkSessionId), input.persisted.preparationDigestB64u);
-		const flipGuard = this.database.prepare(`INSERT INTO linked_device_session_cas_guard (guard_id)
-SELECT 1
- WHERE changes() = 0`);
+		const flipGuard = this.database.prepare(SESSION_CAS_GUARD_SQL);
 		const flipResult = (await this.database.batch([
 			flip,
 			flipGuard,
@@ -661,7 +661,7 @@ async function parseTargetCredentialRow(row) {
 	if (payload.registration.registeredAtMs > registeredAtMs) throw new Error("linked-device registration timestamp is in the future of its row");
 	if (payload.registration.targetFactor.kind === "passkey_prf") {
 		const targetFactor = requireVerifiedPasskeyTargetFactor(payload.verifiedTargetFactor);
-		const credentialPublicKeyB64u = requiredString(row.credential_public_key_b64u, "credential_public_key_b64u");
+		const credentialPublicKeyB64u = requireCanonicalString(row.credential_public_key_b64u, "credential_public_key_b64u");
 		const credentialCounter = requiredNonnegativeInteger(row.credential_counter, "credential_counter");
 		if (row.email_otp_grant_id != null) throw new Error("registered linked-device passkey target contains an Email grant");
 		if (!payload.registration.webauthnRegistration || payload.registration.webauthnRegistration.credentialIdB64u !== credentialId.value || targetFactor.authMethod.credentialIdB64u !== credentialId.value || targetFactor.authMethod.credentialPublicKeyB64u !== credentialPublicKeyB64u || targetFactor.authMethod.counter !== credentialCounter) throw new Error("linked-device credential columns differ from its durable payload");
@@ -793,19 +793,11 @@ function parseRegisteredTargetCredentialPayloadV2(raw, keyManifestDigestB64u) {
 	};
 }
 function assertTargetCredentialIdentityColumns(row, preparation) {
-	if (requiredString(row.wallet_id, "wallet_id") !== String(preparation.walletId) || requiredString(row.enrollment_id, "enrollment_id") !== String(preparation.enrollmentId) || requiredString(row.device_id, "device_id") !== String(preparation.deviceId)) throw new Error("linked-device target credential identity columns disagree with preparation");
+	if (requireCanonicalString(row.wallet_id, "wallet_id") !== String(preparation.walletId) || requireCanonicalString(row.enrollment_id, "enrollment_id") !== String(preparation.enrollmentId) || requireCanonicalString(row.device_id, "device_id") !== String(preparation.deviceId)) throw new Error("linked-device target credential identity columns disagree with preparation");
 }
 function requirePayloadField(record, field) {
 	if (!Object.prototype.hasOwnProperty.call(record, field) || record[field] === void 0) throw new Error(`linked-device registered target credential payload is missing ${field}`);
 }
-function requireRecord(raw, field) {
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new Error(`${field} must be an object`);
-	return raw;
-}
-function requiredString(raw, field) {
-	if (typeof raw !== "string" || raw.length === 0 || raw.trim() !== raw) throw new Error(`${field} is invalid`);
-	return raw;
-}
 function requiredNonnegativeInteger(raw, field) {
 	const value = typeof raw === "number" ? raw : typeof raw === "string" && /^\d+$/.test(raw) ? Number(raw) : NaN;
 	if (!Number.isSafeInteger(value) || value < 0) throw new Error(`${field} is invalid`);
@@ -853,10 +845,10 @@ function isCanonicalNonemptyBase64Url(value) {
 	}
 }
 async function digestRegistrationV1(registration) {
-	return parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(`seams/r103/target-credential/v1\u0000${alphabetizeStringify(registration)}`)));
+	return sha256Utf8DigestB64u(`seams/r103/target-credential/v1\u0000${alphabetizeStringify(registration)}`);
 }
 async function digestJsonV1(value) {
-	return parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(value))));
+	return sha256Utf8DigestB64u(alphabetizeStringify(value));
 }
 async function waitForTargetCommitV1(delayMs) {
 	await new Promise((resolve) => setTimeout(resolve, delayMs));

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceVerifiedLinkBuilder.js

@@ -1,12 +1,12 @@
 import { parseWebAuthnCredentialIdB64u } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
-import { buildExactAdministeredSignerManifestV1 } from "../../../../shared-ts/src/device-linking/delegatedActivationPlan.js";
+import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
+import { sha256Utf8DigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { buildDelegatedWalletAuthorityV1, validateDelegatedWalletAuthorityAttenuationV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
+import { buildExactAdministeredSignerManifestV1 } from "../../../../shared-ts/src/device-linking/delegatedActivationPlan.js";
 import { walletAuthorityDigestsMatchV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
-import { sourceKeyManifestDigestForFamilyV1 } from "../../../../core/deviceLinking/linkedDeviceSession.js";
+import { sourceKeyManifestDigestForFamilyV1 } from "../../../../core/deviceLinking/linkedDeviceSessionRecord.js";
 //#region src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceVerifiedLinkBuilder.ts
 const VERIFIED_TARGET_FACTOR_DOMAIN_V1 = "seams/linked-device/verified-target-factor/v1";
 async function buildVerifiedLinkInputV1(input) {
@@ -82,7 +82,7 @@ async function computeVerifiedTargetFactorVerificationDigestV1(input) {
 		authorityDigestB64u: input.evidence.grant.authorityDigestB64u,
 		descriptorCredentialIdB64u: input.evidence.grant.descriptorCredentialIdB64u
 	};
-	return parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(`${VERIFIED_TARGET_FACTOR_DOMAIN_V1}\u0000${alphabetizeStringify({
+	return sha256Utf8DigestB64u(`${VERIFIED_TARGET_FACTOR_DOMAIN_V1}\u0000${alphabetizeStringify({
 		linkSessionId: input.registration.linkSessionId,
 		walletId: input.registration.walletId,
 		enrollmentId: input.registration.enrollmentId,
@@ -91,7 +91,7 @@ async function computeVerifiedTargetFactorVerificationDigestV1(input) {
 		targetPreparationDigestB64u: input.registration.targetPreparationDigestB64u,
 		verifiedAtMs: input.verifiedAtMs,
 		evidence
-	})}`)));
+	})}`);
 }
 async function buildVerifiedTargetFactorV1(input) {
 	const verifiedAtMs = input.registration.registeredAtMs;

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceVerifiedLinkSourceReader.js

@@ -82,7 +82,9 @@ function sourceSignerForFamilyV1(input) {
 		if (signer.walletId !== input.authority.walletId) return false;
 		if (input.keyFamily === "ed25519" && signer.version !== "wallet_signer_ed25519_v1" || input.keyFamily === "ecdsa_secp256k1" && signer.version !== "wallet_signer_ecdsa_v1") return false;
 		try {
-			if (!mpcMaterialActivationRefsEqual(routerAbMpcMaterialActivationRefFromWire(signer.version === "wallet_signer_ed25519_v1" ? signer.activeYaoCapability.activationResult.public_receipt.material_activation : signer.walletKey.publicCapability.material_activation), activation.materialActivation)) return false;
+			if (input.authority.provenance.kind !== "device_link") {
+				if (!mpcMaterialActivationRefsEqual(routerAbMpcMaterialActivationRefFromWire(signer.version === "wallet_signer_ed25519_v1" ? signer.activeYaoCapability.activationResult.public_receipt.material_activation : signer.walletKey.publicCapability.material_activation), activation.materialActivation)) return false;
+			}
 			return sourceSignerIdentityMatchesV1(signer, activation.signer);
 		} catch {
 			return false;

package/dist/esm/router/cloudflare/d1/deviceLinking/index.js

@@ -2,14 +2,14 @@ import { D1LinkedDeviceEd25519ExportRootStoreV1 } from "./d1LinkedDeviceEd25519E
 import { D1LinkedDeviceRequestProofNonceStoreV1 } from "./d1LinkedDeviceRequestProofNonceStore.js";
 import { createD1LinkedDeviceSessionServiceV1 } from "./d1LinkedDeviceSessionService.js";
 import { parseD1LinkedDeviceSessionRowV1, parseD1LinkedDeviceSessionTranscriptRowV1 } from "./d1LinkedDeviceSessionRecords.js";
-import { D1LinkedDeviceSessionStoreV1 } from "./d1LinkedDeviceSessionStore.js";
+import { D1LinkedDeviceSessionStoreV1, SESSION_CAS_GUARD_SQL } from "./d1LinkedDeviceSessionStore.js";
 import { createD1LinkedDeviceRouteServiceV1 } from "./d1LinkedDeviceRouteService.js";
 import { D1LinkedDeviceSourceContributionPreparationPlannerV1, createD1LinkedDeviceSourceContributionPreparationPlannerV1, linkedDeviceX25519RecipientPublicKeyB64uV1 } from "./d1LinkedDeviceSourceContributionPreparationPlanner.js";
-import { D1LinkedDeviceAuthorityInstallServiceV1 } from "./d1LinkedDeviceAuthorityInstallService.js";
+import { D1LinkedDeviceAuthorityInstallServiceV1, readD1LinkedDeviceEcdsaSourceV1, readD1LinkedDeviceEd25519SourceV1 } from "./d1LinkedDeviceAuthorityInstallService.js";
 import { LinkedDeviceSourceFamilyUnavailableErrorV1, createD1LinkedDeviceVerifiedLinkSourceReaderV1 } from "./d1LinkedDeviceVerifiedLinkSourceReader.js";
 import { buildVerifiedLinkInputV1, buildVerifiedTargetFactorV1, computeVerifiedTargetFactorVerificationDigestV1, linkedDeviceSignerManifestsEqualV1 } from "./d1LinkedDeviceVerifiedLinkBuilder.js";
 import { D1LinkedDeviceTargetCredentialProviderV1, LinkedDeviceRetiredTargetRegistrationShapeErrorV1, LinkedDeviceWebAuthnRegistrationVerifierV1 } from "./d1LinkedDeviceTargetCredentialProvider.js";
 import { D1LinkedDeviceTargetPlannerV1 } from "./d1LinkedDeviceTargetPlanner.js";
 import { createD1LinkedDeviceOwnerAuthorizationMetadataSourceV1, createD1LinkedDeviceOwnerAuthorizationProviderV1, createD1LinkedDeviceOwnerSourceChildReaderV1 } from "./d1LinkedDeviceOwnerAuthorizationProvider.js";
 import { D1LinkedDeviceTargetAuthenticatorStoreV1 } from "./d1LinkedDeviceTargetAuthenticatorStore.js";
-export { D1LinkedDeviceAuthorityInstallServiceV1, D1LinkedDeviceEd25519ExportRootStoreV1, D1LinkedDeviceRequestProofNonceStoreV1, D1LinkedDeviceSessionStoreV1, D1LinkedDeviceSourceContributionPreparationPlannerV1, D1LinkedDeviceTargetAuthenticatorStoreV1, D1LinkedDeviceTargetCredentialProviderV1, D1LinkedDeviceTargetPlannerV1, LinkedDeviceRetiredTargetRegistrationShapeErrorV1, LinkedDeviceSourceFamilyUnavailableErrorV1, LinkedDeviceWebAuthnRegistrationVerifierV1, buildVerifiedLinkInputV1, buildVerifiedTargetFactorV1, computeVerifiedTargetFactorVerificationDigestV1, createD1LinkedDeviceOwnerAuthorizationMetadataSourceV1, createD1LinkedDeviceOwnerAuthorizationProviderV1, createD1LinkedDeviceOwnerSourceChildReaderV1, createD1LinkedDeviceRouteServiceV1, createD1LinkedDeviceSessionServiceV1, createD1LinkedDeviceSourceContributionPreparationPlannerV1, createD1LinkedDeviceVerifiedLinkSourceReaderV1, linkedDeviceSignerManifestsEqualV1, linkedDeviceX25519RecipientPublicKeyB64uV1, parseD1LinkedDeviceSessionRowV1, parseD1LinkedDeviceSessionTranscriptRowV1 };
+export { D1LinkedDeviceAuthorityInstallServiceV1, D1LinkedDeviceEd25519ExportRootStoreV1, D1LinkedDeviceRequestProofNonceStoreV1, D1LinkedDeviceSessionStoreV1, D1LinkedDeviceSourceContributionPreparationPlannerV1, D1LinkedDeviceTargetAuthenticatorStoreV1, D1LinkedDeviceTargetCredentialProviderV1, D1LinkedDeviceTargetPlannerV1, LinkedDeviceRetiredTargetRegistrationShapeErrorV1, LinkedDeviceSourceFamilyUnavailableErrorV1, LinkedDeviceWebAuthnRegistrationVerifierV1, SESSION_CAS_GUARD_SQL, buildVerifiedLinkInputV1, buildVerifiedTargetFactorV1, computeVerifiedTargetFactorVerificationDigestV1, createD1LinkedDeviceOwnerAuthorizationMetadataSourceV1, createD1LinkedDeviceOwnerAuthorizationProviderV1, createD1LinkedDeviceOwnerSourceChildReaderV1, createD1LinkedDeviceRouteServiceV1, createD1LinkedDeviceSessionServiceV1, createD1LinkedDeviceSourceContributionPreparationPlannerV1, createD1LinkedDeviceVerifiedLinkSourceReaderV1, linkedDeviceSignerManifestsEqualV1, linkedDeviceX25519RecipientPublicKeyB64uV1, parseD1LinkedDeviceSessionRowV1, parseD1LinkedDeviceSessionTranscriptRowV1, readD1LinkedDeviceEcdsaSourceV1, readD1LinkedDeviceEd25519SourceV1 };

package/dist/esm/router/cloudflare/d1/deviceLinking/installedEcdsaAuthority.js

@@ -0,0 +1,69 @@
+import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
+import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
+import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+//#region src/router/cloudflare/d1/deviceLinking/installedEcdsaAuthority.ts
+const LINKED_ECDSA_CUSTODY_CHAIN_MAX_DEPTH = 16;
+function findInstalledEcdsaAuthority(rows, materialActivation) {
+	let match = null;
+	for (const row of rows) {
+		const material = row.packages.signerPackages.ecdsa?.materialActivation;
+		if (!material || !mpcMaterialActivationRefsEqual(material, materialActivation)) continue;
+		if (match) return null;
+		match = row;
+	}
+	return match ? projectInstalledEcdsaAuthority(match) : null;
+}
+/** Every hop observes the same verified installation set from one database read. */
+function installedEcdsaAuthorityChain(rows, materialActivation) {
+	const chain = [];
+	let activation = materialActivation;
+	for (let depth = 0; depth < LINKED_ECDSA_CUSTODY_CHAIN_MAX_DEPTH; depth += 1) {
+		let projection;
+		try {
+			projection = findInstalledEcdsaAuthority(rows, activation);
+		} catch {
+			break;
+		}
+		if (!projection) break;
+		chain.push(projection);
+		activation = projection.activationReceipt.binding.source.activation;
+	}
+	return chain;
+}
+function projectInstalledEcdsaAuthority(stored) {
+	if (stored.activatedAtMs === null || stored.installedRecordSetDigestB64u === null) return null;
+	const packages = stored.packages;
+	if (packages.authority.authorityId !== stored.authorityId || packages.authority.walletId !== stored.walletId || packages.authMethod.walletAuthMethodId !== stored.authMethodId || packages.authMethod.walletId !== stored.walletId || packages.authMethod.walletAuthorityId !== stored.authorityId || packages.authority.provenance.kind !== "device_link" || packages.authority.provenance.linkSessionId !== stored.linkSessionId || packages.authority.principal.deviceId !== stored.deviceId) return null;
+	const signerPackage = packages.signerPackages.ecdsa;
+	const authorityActivation = packages.authority.signerActivations.ecdsa;
+	if (!signerPackage || !authorityActivation) return null;
+	const receipt = signerPackage.activationReceipt;
+	const source = receipt.binding.source;
+	const target = receipt.binding.target;
+	const sourceScope = receipt.sourceDerivation.sourceNormalSigning.scope;
+	const targetScope = receipt.normalSigning.scope;
+	const authorityEthereumAddress = ecdsaAuthorityEvmAddressB64u(authorityActivation.signer.evmAddress);
+	if (authorityEthereumAddress === null || !mpcMaterialActivationRefsEqual(signerPackage.materialActivation, authorityActivation.materialActivation) || !mpcMaterialActivationRefsEqual(signerPackage.materialActivation, target.activation) || !mpcMaterialActivationRefsEqual(signerPackage.materialActivation, routerAbMpcMaterialActivationRefFromWire(targetScope.material_activation)) || String(receipt.binding.linkSessionId) !== String(stored.linkSessionId) || String(receipt.binding.enrollmentId) !== String(packages.authority.provenance.enrollmentId) || String(receipt.binding.sourceAuthorityId) !== String(packages.authority.provenance.sourceAuthorityId) || target.targetDeviceId !== stored.deviceId || target.targetFactorVerificationDigestB64u !== stored.targetFactorVerificationDigestB64u || signerPackage.encryptedTargetClientShare.recipientPublicKeyB64u !== target.clientRecipientPublicKeyB64u || sourceScope.wallet_id !== String(stored.walletId) || targetScope.wallet_id !== String(stored.walletId) || !mpcMaterialActivationRefsEqual(routerAbMpcMaterialActivationRefFromWire(sourceScope.material_activation), source.activation) || sourceScope.public_identity.client_share_retry_counter !== targetScope.public_identity.client_share_retry_counter || sourceScope.public_identity.server_share_retry_counter !== targetScope.public_identity.server_share_retry_counter || targetScope.signing_worker.server_id !== target.activation.signingWorker || targetScope.public_identity.derivation_client_share_public_key33_b64u !== receipt.binding.targetClientPublicKey33B64u || targetScope.public_identity.server_public_key33_b64u !== receipt.targetRelayerPublicKey33B64u || targetScope.public_identity.threshold_public_key33_b64u !== receipt.thresholdPublicKey33B64u || targetScope.public_identity.ethereum_address20_b64u !== receipt.thresholdEthereumAddress20B64u || authorityActivation.signer.walletId !== stored.walletId || authorityActivation.signer.thresholdPublicKey33B64u !== receipt.thresholdPublicKey33B64u || authorityEthereumAddress !== receipt.thresholdEthereumAddress20B64u) return null;
+	return {
+		walletId: stored.walletId,
+		authorityId: stored.authorityId,
+		walletAuthMethodId: stored.authMethodId,
+		linkSessionId: stored.linkSessionId,
+		deviceId: stored.deviceId,
+		materialActivation: signerPackage.materialActivation,
+		signer: authorityActivation.signer,
+		activationReceipt: receipt,
+		installedRecordSetDigestB64u: stored.installedRecordSetDigestB64u,
+		activatedAtMs: stored.activatedAtMs
+	};
+}
+function ecdsaAuthorityEvmAddressB64u(value) {
+	if (!/^0x[0-9a-fA-F]{40}$/.test(value)) return null;
+	const bytes = new Uint8Array(20);
+	for (let index = 0; index < bytes.length; index += 1) bytes[index] = Number.parseInt(value.slice(2 + index * 2, 4 + index * 2), 16);
+	return base64UrlEncode(bytes);
+}
+//#endregion
+export { findInstalledEcdsaAuthority, installedEcdsaAuthorityChain, projectInstalledEcdsaAuthority };
+
+//# sourceMappingURL=installedEcdsaAuthority.js.map