@seams/wallet-server 0.6.2 → 0.7.3

package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1AuthorizedOperationRouteService.d.ts

@@ -0,0 +1,12 @@
+import type { AuthorizationService } from '../../../../authorization/service';
+import type { RouterApiServiceBag } from '../../../framework/authServicePort';
+import type { CloudflareD1AuthorizationStore } from '../authorization/d1AuthorizationStore';
+import type { NormalizedCloudflareD1RouterApiAuthServiceOptions } from './d1RouterApiAuthConfig';
+type D1AuthorizedOperationRouteServiceAssembly = {
+    readonly authorizationService: AuthorizationService;
+    readonly authorizationStore: CloudflareD1AuthorizationStore;
+    readonly options: Pick<NormalizedCloudflareD1RouterApiAuthServiceOptions, 'orgId'>;
+};
+export declare function createD1AuthorizedOperationRouteService(assembly: D1AuthorizedOperationRouteServiceAssembly): RouterApiServiceBag['authorizedOperations'];
+export {};
+//# sourceMappingURL=d1AuthorizedOperationRouteService.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1RouterApiAuthBoundary.d.ts

@@ -1,5 +1,5 @@
 import { type WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
-export type D1BoundaryWalletIdParseResult = {
+type D1BoundaryWalletIdParseResult = {
     readonly ok: true;
     readonly value: WalletId;
 } | {
@@ -15,7 +15,7 @@ export declare function positiveInteger(input: unknown): number | null;
 export declare function positiveSafeInteger(input: unknown): number | null;
 export declare function nonNegativeSafeInteger(input: unknown): number | null;
 export declare function optionalNonNegativeInteger(input: unknown): number | undefined;
-export type D1MutationResultLike = {
+type D1MutationResultLike = {
     readonly meta?: {
         readonly changes?: unknown;
         readonly rows_written?: unknown;
@@ -23,6 +23,6 @@ export type D1MutationResultLike = {
 };
 export declare function parseD1NonNegativeCount(input: unknown): number;
 export declare function d1MutationChanges(result: D1MutationResultLike): number;
-export declare function toArrayBufferCopy(bytes: Uint8Array): ArrayBuffer;
 export declare function sha256BytesPortable(input: Uint8Array): Promise<Uint8Array>;
+export {};
 //# sourceMappingURL=d1RouterApiAuthBoundary.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1RouterApiAuthConfig.d.ts

@@ -86,8 +86,8 @@ type CloudflareD1LinkedDeviceCompositionDisabledV1 = {
     readonly management?: never;
 };
 /**
- * Optional R103 composition. Each enabled surface requires its complete
- * external boundary; omitted surfaces stay fail-closed at their route.
+ * Optional linked-device composition. Each enabled surface requires its
+ * complete external boundary; omitted surfaces stay fail-closed at their route.
  */
 export type CloudflareD1LinkedDeviceCompositionOptionsV1 = CloudflareD1LinkedDeviceCompositionDisabledV1 | CloudflareD1LinkedDeviceCompositionWithManagementV1 | CloudflareD1LinkedDeviceCompositionWithSessionV1;
 export type CloudflareD1GithubOAuthConfig = {

package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1RouterApiAuthService.d.ts

@@ -8,6 +8,6 @@ export type CloudflareD1RouterApiAuthService = Omit<RouterApiServiceBag, 'thresh
     readonly executeSignedDelegate: (input: ExecuteSignedDelegateRequest) => Promise<ExecuteSignedDelegateResult>;
     readonly linkedDeviceEd25519AuthorityReader?: LinkedDeviceEd25519AuthorityReader;
 };
-type LinkedDeviceEd25519AuthorityReader = Pick<D1LinkedDeviceAuthorityInstallServiceV1, 'readInstalledEd25519AuthorityByIdentityV1' | 'readInstalledEd25519AuthorityByMaterialActivationV1' | 'readInstalledEcdsaAuthorityByMaterialActivationV1'>;
+type LinkedDeviceEd25519AuthorityReader = Pick<D1LinkedDeviceAuthorityInstallServiceV1, 'readInstalledEd25519AuthorityByIdentityV1' | 'readInstalledEd25519AuthorityByMaterialActivationV1' | 'readInstalledEcdsaAuthorityByMaterialActivationV1' | 'readInstalledEcdsaCustodySnapshotV1'>;
 export declare function createCloudflareD1RouterApiAuthService(input: CloudflareD1RouterApiAuthServiceOptions): CloudflareD1RouterApiAuthService;
 //# sourceMappingURL=d1RouterApiAuthService.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/auth/walletSessionCredentialReaders.d.ts

@@ -0,0 +1,9 @@
+import type { AuthorizationService } from '../../../../authorization/service';
+import type { RouterApiWalletSessionAuthorizationV2AdmissionContext, RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext, RouterApiWalletSessionSigningCandidate } from '../../../framework/authServicePort';
+type CredentialInput = Parameters<AuthorizationService['readWalletSessionAdmissionSnapshotByOperationCredential']>[0];
+type AdmissionSnapshotReader = Pick<AuthorizationService, 'readWalletSessionAdmissionSnapshotByOperationCredential'>;
+export declare function readActiveWalletSessionCredential(service: AdmissionSnapshotReader, input: CredentialInput): Promise<RouterApiWalletSessionAuthorizationV2AdmissionContext | null>;
+export declare function readWalletSessionSigningCandidate(service: Pick<AuthorizationService, 'readEcdsaWalletSessionAdmissionSnapshotByOperationCredential'>, input: Parameters<AuthorizationService['readEcdsaWalletSessionAdmissionSnapshotByOperationCredential']>[0]): Promise<RouterApiWalletSessionSigningCandidate | null>;
+export declare function readExhaustedWalletSessionCredential(service: Pick<AuthorizationService, 'readExactWalletSessionStatusSnapshotByOperationCredential'>, input: CredentialInput): Promise<RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext | null>;
+export {};
+//# sourceMappingURL=walletSessionCredentialReaders.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/authorization/authorizedOperationStatements.d.ts

@@ -0,0 +1,34 @@
+import type { EcdsaMaterialReadSnapshot } from '../../../../core/ecdsaMaterialReadSnapshot';
+import type { AuthorizedOperation } from '../../../../authorization/domain';
+import type { AuthorizedOperationMaterialScope } from '../../../../authorization/service';
+import type { D1WalletStoreScope } from '../../../../core/d1WalletStore';
+import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import type { TenantId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
+import type { CapabilityOperationFingerprintDigest } from '../../../../../../shared-ts/src/authorization/operationFingerprint';
+export declare function prepareAuthorizedOperationCommittedRead(database: D1DatabaseLike, namespace: string, input: {
+    readonly tenantId: TenantId;
+    readonly operationFingerprintDigest: CapabilityOperationFingerprintDigest;
+}): D1PreparedStatementLike;
+export declare function prepareAuthorizedOperationRead(database: D1DatabaseLike, namespace: string, input: {
+    readonly tenantId: TenantId;
+    readonly operationFingerprintDigest: CapabilityOperationFingerprintDigest;
+}): D1PreparedStatementLike;
+export declare function prepareAuthorizedOperationAdmissionRead(input: {
+    readonly database: D1DatabaseLike;
+    readonly namespace: string;
+    readonly walletSignerScope: D1WalletStoreScope;
+    readonly tenantId: TenantId;
+    readonly operationFingerprintDigest: CapabilityOperationFingerprintDigest;
+    readonly nowMs: number;
+    readonly materialSnapshot: EcdsaMaterialReadSnapshot | null;
+}): D1PreparedStatementLike;
+export declare function prepareAuthorizedOperationInsert(input: {
+    readonly database: D1DatabaseLike;
+    readonly namespace: string;
+    readonly walletSignerScope: D1WalletStoreScope;
+    readonly operation: AuthorizedOperation;
+    readonly material: AuthorizedOperationMaterialScope | null;
+    readonly materialSnapshot: EcdsaMaterialReadSnapshot | null;
+    readonly existingOperation: 'reject' | 'preserve';
+}): D1PreparedStatementLike;
+//# sourceMappingURL=authorizedOperationStatements.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/authorization/d1AuthorizationStore.d.ts

@@ -1,8 +1,11 @@
+import type { EcdsaWalletSessionAdmissionRead } from '../../../../authorization/service';
+import type { RouterAbMpcMaterialActivationRefWire } from '../../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
+import type { EcdsaWalletSessionAdmissionInput, EcdsaWalletSessionAdmissionResult, EcdsaWalletSessionResolutionResult, PinnedOwnerWalletScope } from '../../../../authorization/ecdsaWalletSessionAdmission';
 import { type MpcMaterialActivationRef, type WalletAuthorityId, type WalletAuthMethodId, type WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
 import { type AuthorizedOperationId, type TenantId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
-import type { AuthorizedOperation, AuthorizedOperationInput, IssuedWalletSessionAuthorizationV2, LiveWalletSessionAuthorizationProjectionV2, WalletSessionAuthorizationV2, ActiveWalletSessionQuota, PersistedActiveWalletSessionAuthorizationV2, DirectV2CommitResult, WalletSessionAuthorizationV2MintLookup, WalletSessionAuthorizationV2MintRead, AuthorizedOperationReplayResponse, CompletedCapabilityOperationResult, IssuedHostedWalletSeamsSessionExchangeV2, RedeemHostedWalletSeamsSessionExchangeV2Input, PersistedHostedWalletSeamsSessionExchangeV2Result, ExactWalletSessionQuotaProjectionV1, ExactWalletSessionStatusV2, WalletSessionExactOperationContext, ResolvedHostedWalletSessionOperationCredentialV2, VerifiedAuthorizationEvidenceSet, VerifiedOwnerProof } from '../../../../authorization/domain';
+import type { AuthorizedOperation, AuthorizedOperationInput, IssuedWalletSessionAuthorizationV2, LiveWalletSessionAuthorizationProjectionV2, WalletSessionAuthorizationV2, ActiveWalletSessionQuota, PersistedActiveWalletSessionAuthorizationV2, DirectV2CommitResult, WalletSessionAuthorizationV2MintLookup, WalletSessionAuthorizationV2MintRead, AuthorizedOperationReplayResponse, CompletedCapabilityOperationResult, IssuedHostedWalletSeamsSessionExchangeV2, RedeemHostedWalletSeamsSessionExchangeV2Input, PersistedHostedWalletSeamsSessionExchangeV2Result, ExactWalletSessionQuotaProjectionV1, ExactWalletSessionStatusV2, ExactWalletSessionStatusSnapshotV2, WalletSessionAdmissionSnapshotV2, WalletSessionExactOperationContext, ResolvedHostedWalletSessionOperationCredentialV2, VerifiedAuthorizationEvidenceSet, VerifiedOwnerProof } from '../../../../authorization/domain';
 import { type CapabilityOperationFingerprintDigest } from '../../../../../../shared-ts/src/authorization/operationFingerprint';
-import type { AuthorizedOperationPort, AuthorizationEvidencePort, AuthorizationGrantPort, AuthorizationSessionPort, AuthorizedOperationMaterialScope } from '../../../../authorization/service';
+import type { AuthorizedOperationAdmissionRejection, AuthorizedOperationPort, AuthorizationEvidencePort, AuthorizationGrantPort, AuthorizationSessionPort, AuthorizedOperationMaterialScope, AuthorizedOperationAdmissionResult, PreparedAuthorizedOperationAdmission } from '../../../../authorization/service';
 import type { D1WalletStoreScope } from '../../../../core/d1WalletStore';
 import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
 /**
@@ -10,7 +13,7 @@ import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storag
  * rather than the wallet signer rows, so the exact-status material check needs
  * this reader to recognize a linked session's capability subjects.
  */
-export type D1AuthorizationLinkedAuthorityMaterialReader = {
+type D1AuthorizationLinkedAuthorityMaterialReader = {
     readInstalledEd25519AuthorityByMaterialActivationV1(input: {
         readonly walletId: WalletId;
         readonly materialActivation: MpcMaterialActivationRef;
@@ -20,7 +23,7 @@ export type D1AuthorizationLinkedAuthorityMaterialReader = {
         readonly materialActivation: MpcMaterialActivationRef;
     }): Promise<D1AuthorizationLinkedAuthorityMaterialProjection | null>;
 };
-export type D1AuthorizationLinkedAuthorityMaterialProjection = {
+type D1AuthorizationLinkedAuthorityMaterialProjection = {
     readonly walletId: string;
     readonly materialActivation: MpcMaterialActivationRef;
 };
@@ -34,7 +37,6 @@ export declare class CloudflareD1AuthorizationStore implements AuthorizationSess
     private readonly database;
     private readonly namespace;
     private readonly walletSignerScope;
-    private readonly walletAuthorityStore;
     private readonly walletStore;
     private readonly getLinkedDeviceAuthorityReader;
     constructor(options: D1AuthorizationStoreOptions);
@@ -96,7 +98,6 @@ export declare class CloudflareD1AuthorizationStore implements AuthorizationSess
         readonly session: WalletSessionAuthorizationV2;
         readonly promotionAtMs: number;
     }): readonly [D1PreparedStatementLike, D1PreparedStatementLike, D1PreparedStatementLike];
-    private existingWalletSessionAuthorizationV2QuotaMatches;
     readWalletSessionAuthorizationV2ByMint(input: WalletSessionAuthorizationV2MintLookup): Promise<WalletSessionAuthorizationV2MintRead | null>;
     readLiveWalletSessionAuthorizationProjectionV2(input: {
         readonly expected: WalletSessionAuthorizationV2;
@@ -125,6 +126,22 @@ export declare class CloudflareD1AuthorizationStore implements AuthorizationSess
         readonly tokenHash: import('../../../../../../shared-ts/src/utils/canonicalPrimitives').DigestB64u;
         readonly nowMs: number;
     }): Promise<IssuedWalletSessionAuthorizationV2 | null>;
+    /**
+     * The live session, its authority and its auth method from one joined read.
+     * A commit between separate reads could pair the session with an authority
+     * it was never bound to; one statement cannot.
+     */
+    readWalletSessionAdmissionSnapshotByOperationCredential(input: {
+        readonly tenantId: WalletSessionAuthorizationV2['tenantId'];
+        readonly tokenHash: import('../../../../../../shared-ts/src/utils/canonicalPrimitives').DigestB64u;
+        readonly nowMs: number;
+    }): Promise<WalletSessionAdmissionSnapshotV2 | null>;
+    readEcdsaWalletSessionAdmissionSnapshotByOperationCredential(input: {
+        readonly tenantId: WalletSessionAuthorizationV2['tenantId'];
+        readonly tokenHash: import('../../../../../../shared-ts/src/utils/canonicalPrimitives').DigestB64u;
+        readonly nowMs: number;
+        readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
+    }): Promise<EcdsaWalletSessionAdmissionRead | null>;
     readWalletSessionExactOperationContextByCredential(input: {
         readonly tenantId: WalletSessionAuthorizationV2['tenantId'];
         readonly tokenHash: import('../../../../../../shared-ts/src/utils/canonicalPrimitives').DigestB64u;
@@ -142,7 +159,15 @@ export declare class CloudflareD1AuthorizationStore implements AuthorizationSess
         readonly tokenHash: import('../../../../../../shared-ts/src/utils/canonicalPrimitives').DigestB64u;
         readonly nowMs: number;
     }): Promise<ExactWalletSessionStatusV2>;
-    private readExactStatusAuthority;
+    /**
+     * The exact status with the authority and auth method it was judged
+     * against, all from the one joined read.
+     */
+    readExactWalletSessionStatusSnapshotByOperationCredential(input: {
+        readonly tenantId: WalletSessionAuthorizationV2['tenantId'];
+        readonly tokenHash: import('../../../../../../shared-ts/src/utils/canonicalPrimitives').DigestB64u;
+        readonly nowMs: number;
+    }): Promise<ExactWalletSessionStatusSnapshotV2>;
     private exactWalletSessionCapabilitySubjectsResolveMaterial;
     private exactWalletSessionMaterialResolves;
     private readLinkedAuthorityMaterial;
@@ -156,23 +181,30 @@ export declare class CloudflareD1AuthorizationStore implements AuthorizationSess
         readonly tenantId: TenantId;
         readonly authorizedOperationId: AuthorizedOperationId;
     }): Promise<AuthorizedOperation | null>;
-    private readAuthorizedOperationRecord;
+    readPinnedOwnerWalletScope(input: {
+        readonly operation: AuthorizedOperation;
+        readonly walletId: WalletId;
+    }): Promise<PinnedOwnerWalletScope>;
+    private pinnedWalletSessionOwnerScope;
+    private readAuthorizedOperationForAdmission;
+    /** How an operation already admitted for this fingerprint answers another admission. */
+    private answerExistingAuthorizedOperation;
+    /**
+     * The admission `admitAuthorizedOperation` would make, prepared for a batch
+     * another store owns, after the same reads. It admits no ECDSA material:
+     * that admission is conditional on the signer row, not a plain insert.
+     */
+    prepareAuthorizedOperationAdmission(input: {
+        readonly operation: AuthorizedOperationInput;
+    }): Promise<PreparedAuthorizedOperationAdmission>;
+    classifyAuthorizedOperationAdmissionFailure(error: unknown): AuthorizedOperationAdmissionRejection | null;
     admitAuthorizedOperation(input: {
         readonly operation: AuthorizedOperationInput;
         readonly material?: AuthorizedOperationMaterialScope;
-    }): Promise<{
-        readonly kind: 'claimed';
-        readonly operation: AuthorizedOperation;
-    } | {
-        readonly kind: 'replayed';
-        readonly operation: AuthorizedOperation;
-    } | {
-        readonly kind: 'operation_in_progress';
-        readonly operation: AuthorizedOperation;
-    } | {
-        readonly kind: 'authorization_grant_rejected' | 'verified_step_up_rejected' | 'wallet_session_quota_exhausted' | 'material_mismatch';
-    }>;
-    private isAuthorizedOperationSourceActive;
+    }): Promise<AuthorizedOperationAdmissionResult>;
+    resolveEcdsaWalletSessionOperation(input: EcdsaWalletSessionAdmissionInput): Promise<EcdsaWalletSessionResolutionResult>;
+    admitEcdsaWalletSessionOperation(input: EcdsaWalletSessionAdmissionInput): Promise<EcdsaWalletSessionAdmissionResult>;
+    private admitAuthorizedOperationRecord;
     completeAuthorizedOperation(input: {
         readonly operation: AuthorizedOperation;
         readonly result: CompletedCapabilityOperationResult;
@@ -181,4 +213,5 @@ export declare class CloudflareD1AuthorizationStore implements AuthorizationSess
     }): Promise<AuthorizedOperation>;
     private readHostedWalletExchangeV2;
 }
+export {};
 //# sourceMappingURL=d1AuthorizationStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/authorization/persistedWalletSessionAuthorization.d.ts

@@ -0,0 +1,3 @@
+import { type WalletSessionAuthorizationV2 } from '../../../../authorization/domain';
+export declare function parsePersistedWalletSessionAuthorizationV2(value: unknown): WalletSessionAuthorizationV2;
+//# sourceMappingURL=persistedWalletSessionAuthorization.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/authorization/walletSessionAuthorityProjection.d.ts

@@ -3,7 +3,7 @@ import type { WalletAuthorityId, WalletId } from '../../../../../../shared-ts/sr
 import type { DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
 import type { D1WalletStoreScope } from '../../../../core/d1WalletStore';
 import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
-export type WalletSessionAuthorityProjectionInput = {
+type WalletSessionAuthorityProjectionInput = {
     readonly walletId: WalletId;
     readonly authorityId: WalletAuthorityId;
     readonly authorityDigestB64u: DigestB64u;
@@ -21,4 +21,5 @@ export declare function prepareD1WalletSessionAuthorityProjectionStatements(inpu
     readonly scope: D1WalletStoreScope;
     readonly projection: WalletSessionAuthorityProjectionInput;
 }): readonly [D1PreparedStatementLike, D1PreparedStatementLike, D1PreparedStatementLike];
+export {};
 //# sourceMappingURL=walletSessionAuthorityProjection.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService.d.ts

@@ -1,13 +1,16 @@
+import { EcdsaMaterialReadSnapshot } from '../../../../core/ecdsaMaterialReadSnapshot';
+import { type EcdsaMaterialReadSource } from '../../../../core/d1EcdsaSignerRead';
+import type { WalletEcdsaSignerRecord } from '../../../../core/WalletStore';
 import type { ActiveWalletAuthorityV1 } from '../../../../../../shared-ts/src/authorization/walletAuthority';
 import { type LinkDeviceSessionId, type MpcMaterialActivationRef, type WalletAuthMethodId, type WalletAuthorityId, type WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
 import { type DeviceId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
 import { type PrincipalId, type TenantId, type WalletSessionAuthorizationId, type WalletSessionId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
 import { type CommittedAuthorityPackagesV1 } from '../../../../../../shared-ts/src/device-linking/committedSignerPackages';
-import { type LinkedDeviceSessionRecordV1 } from '../../../../core/deviceLinking/linkedDeviceSession';
+import { type LinkedDeviceSessionRecordV1 } from '../../../../core/deviceLinking/linkedDeviceSessionRecord';
 import type { LocalAuthorityActivationFinalAckV1, LocalAuthorityInstallationReceiptV1, OrdinarySignerMaterialReservationPreparationV1 as SharedOrdinarySignerMaterialReservationPreparationV1, VerifiedLinkInputV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
 import { type LinkedDeviceWalletSessionCredentialDeliveryBindingV1, type LinkedDeviceWalletSessionCredentialDeliveryV1, type LinkedDeviceActivationCleanupReceiptV1 } from '../../../../../../shared-ts/src/device-linking/walletSessionCredentialDelivery';
 import { type ExactAdministeredSignerV1 } from '../../../../../../shared-ts/src/device-linking/delegatedActivationPlan';
-import { type WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import { type ActiveWalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
 import { OrdinaryInactiveSignerMaterialReservationServiceV1, type OrdinaryEcdsaSignerMaterialReservationPreparationV1, type OrdinaryEd25519SignerMaterialReservationPreparationV1 } from '../../../../core/signingMaterial/ordinaryInactiveSignerMaterialReservation';
 import type { LinkedDeviceEcdsaSourcePreservingActivationReceiptV1 } from '../../../../../../shared-ts/src/device-linking/sourceContribution';
 import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
@@ -20,6 +23,11 @@ import type { AuthorizationService } from '../../../../authorization/service';
 import { type PersistedActiveWalletSessionAuthorizationV2, type IssuedWalletSessionAuthorizationV2 } from '../../../../authorization/domain';
 import { type DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
 import type { CloudflareD1EmailOtpRegistrationEnrollmentFinalizer } from '../emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer';
+export type InstalledEcdsaCustodySnapshotV1 = {
+    readonly readSnapshot: EcdsaMaterialReadSnapshot;
+    readonly chain: readonly InstalledLinkedDeviceEcdsaAuthorityProjectionV1[];
+    readonly signers: readonly WalletEcdsaSignerRecord[];
+};
 type ExactSigner = ExactAdministeredSignerV1;
 type ListWalletEd25519SignersV1 = (walletId: WalletId) => Promise<readonly WalletEd25519SignerRecord[]>;
 type WorkerOrdinarySignerMaterialReservationPreparationV1 = {
@@ -108,9 +116,7 @@ export type ActivateInstalledAuthorityResultV1 = {
     readonly kind: 'active';
     readonly outcome: 'activated' | 'replayed';
     readonly authority: ActiveWalletAuthorityV1;
-    readonly authMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly status: 'active';
-    }>;
+    readonly authMethod: ActiveWalletAuthMethodRecordV2;
     readonly session: LinkedDeviceSessionRecordV1;
     readonly walletSession: IssuedWalletSessionAuthorizationV2;
     readonly deliveryBinding: LinkedDeviceWalletSessionCredentialDeliveryBindingV1;
@@ -141,6 +147,26 @@ export type LocalAuthorityActivationAcknowledgementAuthenticationV1 = {
     readonly walletSessionId: WalletSessionId;
     readonly expiresAtMs: number;
 };
+export type StoredInstallationRow = {
+    readonly linkSessionId: LinkDeviceSessionId;
+    readonly authorityId: WalletAuthorityId;
+    readonly walletId: WalletId;
+    readonly authMethodId: WalletAuthMethodId;
+    readonly deviceId: DeviceId;
+    readonly packageSetDigestB64u: DigestB64u;
+    readonly targetFactorVerificationDigestB64u: DigestB64u;
+    readonly targetFactorVerifiedAtMs: number;
+    readonly sourceManifestDigestB64u: DigestB64u;
+    /** Null is accepted only for legacy rows created before migration 0033. */
+    readonly deliveryRecipientPublicKey65B64u: string | null;
+    readonly packages: CommittedAuthorityPackagesV1;
+    readonly serverReservationIds: Readonly<{
+        readonly ed25519?: ServerReservationRecordV1<'ed25519'>;
+        readonly ecdsa_secp256k1?: ServerReservationRecordV1<'ecdsa_secp256k1'>;
+    }>;
+    readonly installedRecordSetDigestB64u: DigestB64u | null;
+    readonly activatedAtMs: number | null;
+};
 export type InstalledLinkedDeviceEd25519AuthorityProjectionV1 = {
     readonly walletId: WalletId;
     readonly authorityId: WalletAuthorityId;
@@ -170,6 +196,12 @@ export type InstalledLinkedDeviceEcdsaAuthorityProjectionV1 = {
     readonly installedRecordSetDigestB64u: DigestB64u;
     readonly activatedAtMs: number;
 };
+type ServerReservationRecordV1<F extends 'ed25519' | 'ecdsa_secp256k1'> = {
+    readonly reservationId: string;
+    readonly preparation: Extract<WorkerOrdinarySignerMaterialReservationPreparationV1, {
+        readonly keyFamily: F;
+    }>['preparation'];
+};
 export declare class D1LinkedDeviceAuthorityInstallServiceV1 {
     private readonly options;
     private readonly nowV1;
@@ -202,6 +234,12 @@ export declare class D1LinkedDeviceAuthorityInstallServiceV1 {
         readonly walletId: WalletId;
         readonly materialActivation: MpcMaterialActivationRef;
     }): Promise<InstalledLinkedDeviceEcdsaAuthorityProjectionV1 | null>;
+    readInstalledEcdsaCustodySnapshotV1(input: {
+        readonly source: EcdsaMaterialReadSource;
+        readonly walletId: WalletId;
+        readonly materialActivation: MpcMaterialActivationRef;
+    }): Promise<InstalledEcdsaCustodySnapshotV1 | null>;
+    private readVerifiedEcdsaInstallations;
     readActivationCleanupReceiptV1(input: {
         readonly linkSessionId: LinkDeviceSessionId;
         readonly requestedAtMs: number;
@@ -228,7 +266,6 @@ export declare class D1LinkedDeviceAuthorityInstallServiceV1 {
     private readCredentialDelivery;
     private readCredentialDeliveryRow;
     private buildWalletSessionAuthorizationInput;
-    private markInstalled;
     private prepareAuthorityAllocation;
     private prepareEmailOtpEnrollmentStatements;
     private readAuthorityAllocation;
@@ -236,6 +273,37 @@ export declare class D1LinkedDeviceAuthorityInstallServiceV1 {
     private readInstallation;
     private readInstallationByAuthority;
     private readInstallationsByWallet;
+    private prepareInstallationsByWalletRead;
 }
+export declare function parseInstalledEcdsaCustodySnapshotV1(input: {
+    readonly scope: D1LinkedDeviceAuthorityInstallServiceOptionsV1['scope'];
+    readonly walletId: WalletId;
+    readonly materialActivation: MpcMaterialActivationRef;
+    readonly installations: unknown;
+    readonly signers: unknown;
+}): Promise<InstalledEcdsaCustodySnapshotV1 | null>;
+/**
+ * The installed Ed25519 authority of a linked device, read from Gateway SQL
+ * alone: a linked device approving another link names its own binding as the
+ * source. Null when a link did not install the authority. An installation
+ * that does not project refuses.
+ */
+export declare function readD1LinkedDeviceEd25519SourceV1(sql: Pick<D1LinkedDeviceAuthorityInstallServiceOptionsV1, 'database' | 'scope'>, input: {
+    readonly walletId: WalletId;
+    readonly authorityId: WalletAuthorityId;
+    readonly walletAuthMethodId: WalletAuthMethodId;
+}): Promise<InstalledLinkedDeviceEd25519AuthorityProjectionV1 | null>;
+/**
+ * The installed ECDSA authority of a linked device, read from Gateway SQL
+ * alone: a linked device approving another link contributes from it. Null
+ * when a link did not install the authority. An installation that does not
+ * project refuses, so a linked device never falls back to another device's
+ * material.
+ */
+export declare function readD1LinkedDeviceEcdsaSourceV1(sql: Pick<D1LinkedDeviceAuthorityInstallServiceOptionsV1, 'database' | 'scope'>, input: {
+    readonly walletId: WalletId;
+    readonly authorityId: WalletAuthorityId;
+    readonly walletAuthMethodId: WalletAuthMethodId;
+}): Promise<InstalledLinkedDeviceEcdsaAuthorityProjectionV1 | null>;
 export {};
 //# sourceMappingURL=d1LinkedDeviceAuthorityInstallService.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEmailOtpGrantStore.d.ts

@@ -1,6 +1,5 @@
 /**
- * Refactor 103 Phase 6 — D1 persistence for linked-device Email OTP
- * verification grants.
+ * D1 persistence for linked-device Email OTP verification grants.
  *
  * A grant is issued once, after the emailed code verifies against the exact
  * link-session binding, and consumed exactly once. The CAS guard makes a lost
@@ -9,7 +8,7 @@
  */
 import { type LinkedDeviceEmailOtpGrantRecordV1 } from '../../../../core/deviceLinking/linkedDeviceEmailOtpGrant';
 import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
-import type { D1LinkedDeviceSessionScopeV1 } from './d1LinkedDeviceSessionStore';
+import { type D1LinkedDeviceSessionScopeV1 } from './d1LinkedDeviceSessionStore';
 export declare class D1LinkedDeviceEmailOtpGrantStoreV1 {
     private readonly database;
     private readonly scope;

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEmailOtpTargetFactor.d.ts

@@ -1,20 +1,20 @@
 /**
- * Refactor 103 Phase 6.2 — the D1 composition behind the linked-device Email
- * OTP challenge routes and the approval-time base-factor provenance reader.
+ * The D1 composition behind the linked-device Email OTP challenge routes and
+ * the approval-time base-factor provenance reader.
  *
  * Everything identity-bearing is resolved server-side: the destination comes
  * from the wallet's active verified enrollment, the base factor from the
  * canonical wallet auth-method store, and the target authority identity
  * from the enrollment identity. Device 2 supplies only the code it received
- * and its worker's ephemeral recipient key. Challenges reuse the Refactor 100
+ * and its worker's ephemeral recipient key. Challenges reuse the Email OTP
  * issuer, verifier, rate limits, and lockouts under the dedicated
  * `wallet_email_otp_device_link` purpose, bound by a digest over the whole
  * device-link context.
  */
 import type { LinkedDeviceApprovalV1, LinkedDeviceEmailOtpFactorReleaseEnvelopeV1, LinkedDeviceEmailOtpBaseFactorRequestV1, LinkedDeviceEmailOtpBaseFactorResolutionV1, LinkedDeviceEmailOtpVerificationGrantV1, LinkedDeviceTargetPreparationV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
-import type { WalletId, VerifiedEmailAddress } from '../../../../../../shared-ts/src/utils/domainIds';
-import type { WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/registrationIntent';
-import type { LinkedDeviceSessionRecordV1 } from '../../../../core/deviceLinking/linkedDeviceSession';
+import type { WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
+import type { WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
+import type { LinkedDeviceSessionRecordV1 } from '../../../../core/deviceLinking/linkedDeviceSessionRecord';
 import type { D1WalletAuthorityStore } from '../wallet/d1WalletAuthorityStore';
 import type { DeviceLinkingEmailOtpTargetFactorProviderV1 } from '../../../transport/fetch/routes/deviceLinking';
 import type { LinkedDeviceEmailOtpGrantRegistrationPortV1, VerifiedLinkedDeviceEmailOtpGrantV1 } from './d1LinkedDeviceTargetCredentialProvider';
@@ -23,7 +23,7 @@ import type { CloudflareD1EmailOtpChallengeVerifier } from '../emailOtp/d1EmailO
 import type { CloudflareD1EmailOtpEnrollmentStore } from '../emailOtp/d1EmailOtpEnrollmentStore';
 import type { CloudflareD1EmailOtpServerSealRuntime } from '../emailOtp/d1EmailOtpServerSealRuntime';
 import { type D1LinkedDeviceEmailOtpGrantStoreV1 } from './d1LinkedDeviceEmailOtpGrantStore';
-export type D1LinkedDeviceEmailOtpTargetFactorOptionsV1 = {
+type D1LinkedDeviceEmailOtpTargetFactorOptionsV1 = {
     readonly issuer: Pick<CloudflareD1EmailOtpChallengeIssuer, 'create'>;
     readonly verifier: Pick<CloudflareD1EmailOtpChallengeVerifier, 'verifyExisting' | 'verifyRegistration'>;
     readonly enrollments: Pick<CloudflareD1EmailOtpEnrollmentStore, 'readEnrollment'>;
@@ -39,25 +39,11 @@ export type D1LinkedDeviceEmailOtpTargetFactorOptionsV1 = {
     readonly grantTtlMs?: number;
     readonly resendCooldownMs?: number;
 };
-export type LinkedDeviceEmailOtpTargetEnrollmentResolutionV1 = {
-    readonly kind: 'existing_enrollment';
-    readonly targetEmail: VerifiedEmailAddress;
-} | {
-    readonly kind: 'new_enrollment';
-    readonly targetEmail: VerifiedEmailAddress;
-} | {
-    readonly kind: 'conflict';
-    readonly message: string;
-};
 export declare class D1LinkedDeviceEmailOtpTargetFactorV1 implements DeviceLinkingEmailOtpTargetFactorProviderV1 {
     private readonly options;
     private readonly grantTtlMs;
     private readonly resendCooldownMs;
     constructor(options: D1LinkedDeviceEmailOtpTargetFactorOptionsV1);
-    resolveTargetEnrollmentV1(input: {
-        readonly walletId: WalletId;
-        readonly targetEmail: VerifiedEmailAddress;
-    }): Promise<LinkedDeviceEmailOtpTargetEnrollmentResolutionV1>;
     resolveBaseFactorSelectionV1(input: {
         readonly walletId: WalletId;
         readonly request: LinkedDeviceEmailOtpBaseFactorRequestV1;
@@ -115,4 +101,5 @@ export declare class D1LinkedDeviceEmailOtpTargetFactorV1 implements DeviceLinki
     private resolveBaseFactorV1;
 }
 export declare function linkedDeviceEmailOtpGrantRegistrationPortV1(provider: D1LinkedDeviceEmailOtpTargetFactorV1): LinkedDeviceEmailOtpGrantRegistrationPortV1;
+export {};
 //# sourceMappingURL=d1LinkedDeviceEmailOtpTargetFactor.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceOwnerAuthorizationProvider.d.ts

@@ -1,10 +1,13 @@
 import type { LinkedDeviceOwnerAuthorizationSourceV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
 import { type DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
 import type { WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
+import { type WalletAuthMethodId, type WalletAuthorityId } from '../../../../../../shared-ts/src/utils/domainIds';
+import type { InstalledLinkedDeviceEcdsaAuthorityProjectionV1, InstalledLinkedDeviceEd25519AuthorityProjectionV1 } from './d1LinkedDeviceAuthorityInstallService';
 import type { D1WalletStore } from '../../../../core/d1WalletStore';
 import type { D1WalletAuthMethodStore } from '../../../../core/d1WalletAuthMethodStore';
 import type { RouterApiWalletRegistrationService } from '../../../framework/authServicePort';
-import type { LinkedDeviceOwnerAuthorizationPortV1, LinkedDeviceSourceKeyManifestDigestsV1 } from '../../../../core/deviceLinking/linkedDeviceSession';
+import type { LinkedDeviceOwnerAuthorizationPortV1 } from '../../../../core/deviceLinking/linkedDeviceSession';
+import type { LinkedDeviceSourceKeyManifestDigestsV1 } from '../../../../core/deviceLinking/linkedDeviceSessionRecord';
 import type { DeviceLinkingOwnerAuthorizationRouteServiceV1, DeviceLinkingOwnerWalletSessionContextV1 } from '../../../../router/transport/fetch/routes/deviceLinkingOwnerAuthorization';
 import type { LinkedDeviceOwnerSourceChildResolutionRequestV1, LinkedDeviceOwnerSourceChildResolutionV1, LinkedDeviceOwnerSourceChildResolverV1, D1LinkedDeviceTargetPlannerOptionsV1, D1LinkedDeviceTargetPlannerV1 } from './d1LinkedDeviceTargetPlanner';
 import { type VerifiedLinkSourceReadV1 } from './d1LinkedDeviceVerifiedLinkBuilder';
@@ -47,6 +50,15 @@ export type D1LinkedDeviceOwnerSourceChildReaderV1 = Pick<D1LinkedDeviceOwnerAut
 export type D1LinkedDeviceOwnerSourceChildReaderOptionsV1 = {
     readonly walletAuthMethodStore: Pick<D1WalletAuthMethodStore, 'listForWalletV2'>;
     readonly walletStore: Pick<D1WalletStore, 'listEd25519SignersForWallet' | 'listEcdsaSignersForWallet'>;
+    /** A linked device's installed Ed25519 authority; null for one a link did not install. */
+    readonly readLinkedEd25519SourceV1: (input: LinkedDeviceSourceAuthorityIdentityV1) => Promise<InstalledLinkedDeviceEd25519AuthorityProjectionV1 | null>;
+    /** A linked device's installed ECDSA authority; null for one a link did not install. */
+    readonly readLinkedEcdsaSourceV1: (input: LinkedDeviceSourceAuthorityIdentityV1) => Promise<InstalledLinkedDeviceEcdsaAuthorityProjectionV1 | null>;
+};
+type LinkedDeviceSourceAuthorityIdentityV1 = {
+    readonly walletId: WalletId;
+    readonly authorityId: WalletAuthorityId;
+    readonly walletAuthMethodId: WalletAuthMethodId;
 };
 /** Builds authoritative source-child facts directly from the wallet stores. */
 export declare function createD1LinkedDeviceOwnerSourceChildReaderV1(options: D1LinkedDeviceOwnerSourceChildReaderOptionsV1): D1LinkedDeviceOwnerSourceChildReaderV1;
@@ -77,4 +89,5 @@ export type D1LinkedDeviceOwnerAuthorizationProviderV1 = {
     readonly targetPlanner: D1LinkedDeviceTargetPlannerV1;
 };
 export declare function createD1LinkedDeviceOwnerAuthorizationProviderV1(options: D1LinkedDeviceOwnerAuthorizationProviderOptionsV1): D1LinkedDeviceOwnerAuthorizationProviderV1;
+export {};
 //# sourceMappingURL=d1LinkedDeviceOwnerAuthorizationProvider.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRevocation.d.ts

@@ -0,0 +1,49 @@
+import type { LinkedDeviceRevokeRequestV1, LinkedDeviceRevokeResultV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
+import type { DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
+import type { WalletAuthMethodId, WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
+import type { LinkedDeviceManagementServiceV1, LinkedDeviceManagementSourceV1 } from '../../../../core/deviceLinking/linkedDeviceManagement';
+import type { D1WalletAuthMethodStore } from '../../../../core/d1WalletAuthMethodStore';
+import type { DeviceLinkingAuthDeniedV1 } from '../../../transport/fetch/routes/deviceLinking';
+import type { D1LinkedDeviceFreshRevokeProofV1, verifyD1LinkedDeviceFreshRevokeProofV1 } from '../wallet/d1WalletAuthMethodBoundary';
+import type { D1WalletAuthorityStore } from '../wallet/d1WalletAuthorityStore';
+import { type D1WalletAuthMethodRevocationReplayStoreV1 } from '../wallet/d1WalletAuthMethodRevocationReplayStore';
+/** Verifies a fresh proof without spending it; an Email OTP spend rides in the result. */
+type FreshRevokeProofVerifierV1 = (input: {
+    readonly walletId: WalletId;
+    readonly targetWalletAuthMethodId: WalletAuthMethodId;
+    readonly proof: D1LinkedDeviceFreshRevokeProofV1;
+    readonly expectedOrigin: string;
+    readonly verifiedAtMs: number;
+    readonly operationFingerprintDigest: DigestB64u;
+}) => ReturnType<typeof verifyD1LinkedDeviceFreshRevokeProofV1>;
+type D1LinkedDeviceRevocationOutcomeV1 = {
+    readonly kind: 'answered';
+    readonly result: LinkedDeviceRevokeResultV1;
+} | DeviceLinkingAuthDeniedV1;
+/**
+ * Revokes one linked device on a fresh proof from another active full-owner
+ * method, as an auth-method revocation does: the proof is spent, the method
+ * revoked and the answer recorded in one batch.
+ *
+ * The record binds the answer to the operation fingerprint and to a digest
+ * of the proof, never the proof or its code. An exact retry is answered from
+ * the record before its proof is examined again, so a request whose answer
+ * was lost receives what committed although its code is spent. An Email OTP
+ * code is verified without being spent, and spent only in that batch, so a
+ * batch that does not commit leaves it usable for the same request.
+ */
+export declare function createD1LinkedDeviceRevocationV1(deps: {
+    readonly management: Pick<LinkedDeviceManagementServiceV1, 'revokeLinkedDeviceV1' | 'finishLinkedDeviceRevocationV1'>;
+    readonly replays: D1WalletAuthMethodRevocationReplayStoreV1;
+    readonly verifyProofForBatch: FreshRevokeProofVerifierV1;
+    readonly authMethodStore: Pick<D1WalletAuthMethodStore, 'readByIdV2' | 'prepareActiveV2SourceGuardStatements'>;
+    readonly authorityStore: Pick<D1WalletAuthorityStore, 'readById'>;
+    readonly nowV1: () => number;
+}): (input: {
+    readonly request: LinkedDeviceRevokeRequestV1;
+    readonly owner: LinkedDeviceManagementSourceV1;
+    readonly proof: D1LinkedDeviceFreshRevokeProofV1;
+    readonly expectedOrigin: string;
+}) => Promise<D1LinkedDeviceRevocationOutcomeV1>;
+export {};
+//# sourceMappingURL=d1LinkedDeviceRevocation.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionRecords.d.ts

@@ -1,4 +1,4 @@
-import { type LinkedDeviceSessionRecordV1 } from '../../../../core/deviceLinking/linkedDeviceSession';
+import { type LinkedDeviceSessionRecordV1 } from '../../../../core/deviceLinking/linkedDeviceSessionRecord';
 import { type DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
 export type D1LinkedDeviceSessionRowV1 = {
     readonly link_session_id?: unknown;

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionStore.d.ts

@@ -1,24 +1,22 @@
 import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
 import type { LinkedDeviceApprovalV1, LinkedDeviceSessionClaimV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
-import { type LinkedDeviceSessionListCursorV1, type LinkedDeviceSessionListPageV1, type LinkedDeviceSessionMutationResultV1, type LinkedDeviceSessionRecordV1, type LinkedDeviceSessionStoreV1 } from '../../../../core/deviceLinking/linkedDeviceSession';
+import type { LinkedDeviceSessionListCursorV1, LinkedDeviceSessionListPageV1, LinkedDeviceSessionStoreV1 } from '../../../../core/deviceLinking/linkedDeviceSession';
+import { type LinkedDeviceSessionMutationResultV1, type LinkedDeviceSessionRecordV1 } from '../../../../core/deviceLinking/linkedDeviceSessionRecord';
 import { type LinkDeviceSessionId } from '../../../../../../shared-ts/src/signing-lanes/ids';
 import type { DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
 import type { WalletAuthorityId, WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
-export type D1LinkedDeviceSessionScopeV1 = {
-    readonly namespace: string;
-    readonly orgId: string;
-    readonly projectId: string;
-    readonly envId: string;
-};
+import type { D1TenantScope } from '../../../../core/d1TenantStore';
+export type D1LinkedDeviceSessionScopeV1 = D1TenantScope;
 export type D1LinkedDeviceSessionStoreOptionsV1 = {
     readonly database: D1DatabaseLike;
     readonly scope: D1LinkedDeviceSessionScopeV1;
     readonly now?: () => number;
 };
+/** Aborts the batch it is in when the statement just before it changed no row. */
+export declare const SESSION_CAS_GUARD_SQL = "INSERT INTO linked_device_session_cas_guard (guard_id)\nSELECT 1\n WHERE changes() = 0";
 export declare class D1LinkedDeviceSessionStoreV1 implements LinkedDeviceSessionStoreV1 {
     private readonly database;
     private readonly scope;
-    private readonly now;
     constructor(options: D1LinkedDeviceSessionStoreOptionsV1);
     createUnclaimedSessionV1(record: LinkedDeviceSessionRecordV1): Promise<LinkedDeviceSessionMutationResultV1>;
     getSessionV1(linkSessionId: LinkDeviceSessionId): Promise<LinkedDeviceSessionRecordV1 | null>;