@seams/wallet-server 0.6.2 → 0.7.3

package/dist/esm/router/cloudflare/d1/authorization/d1VaultProxyStore.js

@@ -2,6 +2,7 @@ import { parseCapabilityId, parseTenantId, parseVaultId, parseVaultItemId } from
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
 import { parseVaultProxyDestination } from "../../../../authorization/vaultProxyUse.js";
+import { toArrayBufferCopy } from "../../../../core/authService/portableCrypto.js";
 //#region src/router/cloudflare/d1/authorization/d1VaultProxyStore.ts
 const VAULT_PROXY_SECRET_AAD_DOMAIN_V1 = "seams:vault:proxy-secret:v1";
 const AES_GCM_NONCE_BYTES = 12;
@@ -21,10 +22,10 @@ var CloudflareD1VaultProxyStore = class {
 		try {
 			const ciphertext = await crypto.subtle.encrypt({
 				name: "AES-GCM",
-				iv: toArrayBuffer(nonce),
-				additionalData: toArrayBuffer(aad(input)),
+				iv: toArrayBufferCopy(nonce),
+				additionalData: toArrayBufferCopy(aad(input)),
 				tagLength: 128
-			}, await this.key, toArrayBuffer(plaintext));
+			}, await this.key, toArrayBufferCopy(plaintext));
 			await this.database.prepare(`INSERT INTO vault_proxy_secrets (
             namespace,
             tenant_id,
@@ -65,10 +66,10 @@ var CloudflareD1VaultProxyStore = class {
 		try {
 			return new Uint8Array(await crypto.subtle.decrypt({
 				name: "AES-GCM",
-				iv: toArrayBuffer(nonce),
-				additionalData: toArrayBuffer(aad(input)),
+				iv: toArrayBufferCopy(nonce),
+				additionalData: toArrayBufferCopy(aad(input)),
 				tagLength: 128
-			}, await this.key, toArrayBuffer(ciphertext)));
+			}, await this.key, toArrayBufferCopy(ciphertext)));
 		} finally {
 			nonce.fill(0);
 			ciphertext.fill(0);
@@ -77,7 +78,7 @@ var CloudflareD1VaultProxyStore = class {
 };
 async function importEncryptionKey(bytes) {
 	try {
-		return await crypto.subtle.importKey("raw", toArrayBuffer(bytes), { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
+		return await crypto.subtle.importKey("raw", toArrayBufferCopy(bytes), { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
 	} finally {
 		bytes.fill(0);
 	}
@@ -111,11 +112,6 @@ function requireCompactString(value, label) {
 	if (typeof value !== "string" || !value || value.trim() !== value) throw new Error(`vault proxy ${label} is invalid`);
 	return value;
 }
-function toArrayBuffer(bytes) {
-	const copy = new ArrayBuffer(bytes.byteLength);
-	new Uint8Array(copy).set(bytes);
-	return copy;
-}
 //#endregion
 export { CloudflareD1VaultProxyStore };
 

package/dist/esm/router/cloudflare/d1/authorization/persistedWalletSessionAuthorization.js

@@ -0,0 +1,14 @@
+import { parseWalletSessionAuthorizationV2 } from "../../../../authorization/domain.js";
+//#region src/router/cloudflare/d1/authorization/persistedWalletSessionAuthorization.ts
+function isPersistedWalletSessionAuthorizationRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function parsePersistedWalletSessionAuthorizationV2(value) {
+	if (!isPersistedWalletSessionAuthorizationRecord(value) || !("laneContext" in value)) return parseWalletSessionAuthorizationV2(value);
+	const { laneContext: _retiredGeographicLaneContext, ...currentRecord } = value;
+	return parseWalletSessionAuthorizationV2(currentRecord);
+}
+//#endregion
+export { parsePersistedWalletSessionAuthorizationV2 };
+
+//# sourceMappingURL=persistedWalletSessionAuthorization.js.map

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService.js

@@ -1,26 +1,31 @@
 import { mpcMaterialActivationRefsEqual, parseLinkDeviceSessionId, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWalletKeyId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseDeviceId, parsePrincipalId, parseTenantId, parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
 import { buildDelegatedWalletAuthorityV1, parseDelegatedWalletPermissionSetV1, validateDelegatedWalletAuthorityAttenuationV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
-import { assertLinkedDeviceWalletSessionCredentialDeliveryIntegrityV1, buildLinkedDeviceWalletSessionCredentialDeliveryBindingV1, computeLinkedDeviceActivationCleanupReceiptDigestB64u, computeLinkedDeviceWalletSessionCredentialDeliveryAadDigestB64u, computeLinkedDeviceWalletSessionCredentialEnvelopeDigestB64u, encodeLinkedDeviceWalletSessionCredentialDeliveryAadV1, parseLinkedDeviceActivationCleanupReceiptV1, parseLinkedDeviceWalletSessionCredentialDeliveryV1 } from "../../../../shared-ts/src/device-linking/walletSessionCredentialDelivery.js";
-import { buildActiveWalletAuthorityV1, buildPendingWalletAuthorityV1, buildWalletSignerActivationSetV1, computeWalletAuthorityDigestB64u, computeWalletSignerActivationSetDigestB64u, walletAuthorityDigestsMatchV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
-import { buildWalletAuthMethodRecordV2, sameWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/registrationIntent.js";
-import { unknownWebAuthnAuthenticatorDeviceInfo } from "../../../../shared-ts/src/utils/webauthnDeviceInfo.js";
-import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { routerAbMpcMaterialActivationRefFromWire, routerAbMpcMaterialActivationRefToWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseRouterAbEd25519YaoApplicationBindingFactsV1, parseRouterAbEd25519YaoCeremonyBindingV1, sameRouterAbEd25519YaoActivationBindingV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { assertLinkedDeviceOrdinaryMaterialSourceContributionMatchesContextV1, parseLinkedDeviceEcdsaSourceContributionPackageV1, parseLinkedDeviceEcdsaSourceDerivationV1, parseLinkedDeviceOrdinaryMaterialSourceContributionV1 } from "../../../../shared-ts/src/device-linking/sourceContribution.js";
+import { buildWalletAuthMethodRecordV2, sameWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
+import { buildActiveWalletAuthorityV1, buildPendingWalletAuthorityV1, buildWalletSignerActivationSetV1, computeWalletAuthorityDigestB64u, computeWalletSignerActivationSetDigestB64u, walletAuthorityDigestsMatchV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { computeCommittedSignerPackageSetDigestB64u, parseCommittedAuthorityPackagesV1 } from "../../../../shared-ts/src/device-linking/committedSignerPackages.js";
-import { parseLocalAuthorityActivationFinalAckV1 } from "../../../../shared-ts/src/device-linking/parsers.js";
+import { unknownWebAuthnAuthenticatorDeviceInfo } from "../../../../shared-ts/src/utils/webauthnDeviceInfo.js";
+import { assertLinkedDeviceWalletSessionCredentialDeliveryIntegrityV1, buildLinkedDeviceWalletSessionCredentialDeliveryBindingV1, computeLinkedDeviceActivationCleanupReceiptDigestB64u, computeLinkedDeviceWalletSessionCredentialDeliveryAadDigestB64u, computeLinkedDeviceWalletSessionCredentialEnvelopeDigestB64u, encodeLinkedDeviceWalletSessionCredentialDeliveryAadV1, parseLinkedDeviceActivationCleanupReceiptV1, parseLinkedDeviceWalletSessionCredentialDeliveryV1 } from "../../../../shared-ts/src/device-linking/walletSessionCredentialDelivery.js";
+import { parseLocalAuthorityActivationFinalAckV1 } from "../../../../shared-ts/src/device-linking/authorityActivation.js";
 import { computeWalletSessionInstallationReceiptDigestB64u, computeWalletSessionOperationCredentialDigestB64u } from "../../../../shared-ts/src/device-linking/digests.js";
 import { computeLinkedDevicePublicKeyDigestV1 } from "../../../../shared-ts/src/device-linking/requestProof.js";
 import { buildPersistedActiveWalletSessionAuthorizationV2, walletSessionAuthorizationV2RecordsEqual } from "../../../../authorization/domain.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
-import { d1ChangedRows, parseD1JsonColumn } from "../../../../storage/d1Sql.js";
+import { EcdsaMaterialReadSnapshot } from "../../../../core/ecdsaMaterialReadSnapshot.js";
+import { parseD1JsonColumn } from "../../../../storage/d1Sql.js";
+import { parseWalletEcdsaSignerRows, prepareWalletEcdsaSignersRead } from "../../../../core/d1EcdsaSignerRead.js";
+import "../../../../core/deviceLinking/requestProof.js";
 import { prepareD1WebAuthnCredentialBindingInsertStatement } from "../../../../core/WebAuthnCredentialBindingStore.js";
 import { prepareD1WebAuthnAuthenticatorInsertStatement } from "../webauthn/d1WebAuthnStore.js";
-import { buildAuthorityActiveSessionRecordV1, buildAuthorityPendingLocalInstallSessionRecordV1 } from "../../../../core/deviceLinking/linkedDeviceSession.js";
+import { findInstalledEcdsaAuthority, installedEcdsaAuthorityChain, projectInstalledEcdsaAuthority } from "./installedEcdsaAuthority.js";
+import { buildAuthorityActiveSessionRecordV1, buildAuthorityPendingLocalInstallSessionRecordV1 } from "../../../../core/deviceLinking/linkedDeviceSessionRecord.js";
 import { linkedDeviceX25519RecipientPublicKeyB64uV1 } from "./d1LinkedDeviceSourceContributionPreparationPlanner.js";
 //#region src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService.ts
 var LinkedDeviceActivationIntegrityErrorV1 = class extends Error {
@@ -464,18 +469,34 @@ var D1LinkedDeviceAuthorityInstallServiceV1 = class {
 	}
 	async readInstalledEcdsaAuthorityByMaterialActivationV1(input) {
 		try {
-			const walletId = parseWalletId(input.walletId);
-			if (!walletId.ok) return null;
-			const storedRows = await this.readInstallationsByWallet(walletId.value);
-			for (const stored of storedRows) await assertStoredPackageDigest(stored);
-			const candidates = storedRows.filter((stored) => stored.packages.signerPackages.ecdsa !== void 0 && mpcMaterialActivationRefsEqual(stored.packages.signerPackages.ecdsa.materialActivation, input.materialActivation));
-			if (candidates.length !== 1) return null;
-			const stored = candidates[0];
-			return stored ? projectInstalledEcdsaAuthority(stored) : null;
+			return findInstalledEcdsaAuthority(await this.readVerifiedEcdsaInstallations(input.walletId), input.materialActivation);
+		} catch {
+			return null;
+		}
+	}
+	async readInstalledEcdsaCustodySnapshotV1(input) {
+		try {
+			if (input.source.kind === "credential_snapshot") return input.source.materialRead.resolveLinked(this.options.scope, input.walletId, routerAbMpcMaterialActivationRefToWire(input.materialActivation));
+			const [installations, signers] = await this.options.database.batch([this.prepareInstallationsByWalletRead(input.walletId), prepareWalletEcdsaSignersRead(this.options.database, this.options.scope, input.walletId)]);
+			if (!installations?.success || !signers?.success) throw new Error("Linked ECDSA custody snapshot is incomplete");
+			return await parseInstalledEcdsaCustodySnapshotV1({
+				scope: this.options.scope,
+				walletId: input.walletId,
+				materialActivation: input.materialActivation,
+				installations: installations.results ?? [],
+				signers: signers.results ?? []
+			});
 		} catch {
 			return null;
 		}
 	}
+	async readVerifiedEcdsaInstallations(walletId) {
+		const parsed = parseWalletId(walletId);
+		if (!parsed.ok) return [];
+		const rows = await this.readInstallationsByWallet(parsed.value);
+		for (const row of rows) await assertStoredPackageDigest(row);
+		return rows;
+	}
 	async readActivationCleanupReceiptV1(input) {
 		const nowMs = requireTime(input.requestedAtMs, "requestedAtMs");
 		const row = await this.readCredentialDeliveryRow(input.linkSessionId);
@@ -946,15 +967,6 @@ var D1LinkedDeviceAuthorityInstallServiceV1 = class {
 			expiresAtMs: issuedAtMs + ttlMs
 		};
 	}
-	async markInstalled(stored, receipt) {
-		if (d1ChangedRows(await this.options.database.prepare(`UPDATE linked_device_authority_installations
-            SET installed_record_set_digest_b64u = ?, activated_at_ms = ?, updated_at_ms = ?
-          WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
-            AND link_session_id = ? AND package_set_digest_b64u = ?
-            AND (installed_record_set_digest_b64u IS NULL OR installed_record_set_digest_b64u = ?)`).bind(String(receipt.installedRecordSetDigestB64u), receipt.installedAtMs, receipt.installedAtMs, this.options.scope.namespace, this.options.scope.orgId, this.options.scope.projectId, this.options.scope.envId, String(stored.linkSessionId), String(stored.packageSetDigestB64u), String(receipt.installedRecordSetDigestB64u)).run()) !== 1) {
-			if ((await this.readInstallation(stored.linkSessionId))?.installedRecordSetDigestB64u !== receipt.installedRecordSetDigestB64u) throw new Error("installation acknowledgement conflicts with a prior receipt");
-		}
-	}
 	async prepareAuthorityAllocation(input, existing) {
 		const current = await this.readAuthorityAllocation(input.linkSessionId);
 		if (current) {
@@ -1020,18 +1032,80 @@ var D1LinkedDeviceAuthorityInstallServiceV1 = class {
 		return row ? parseStoredInstallationRow(row) : null;
 	}
 	async readInstallationByAuthority(authorityId) {
-		const row = await this.options.database.prepare(`SELECT * FROM linked_device_authority_installations
-          WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
-            AND authority_id = ? LIMIT 1`).bind(this.options.scope.namespace, this.options.scope.orgId, this.options.scope.projectId, this.options.scope.envId, String(authorityId)).first();
-		return row ? parseStoredInstallationRow(row) : null;
+		return await readStoredInstallationByAuthorityV1(this.options, authorityId);
 	}
 	async readInstallationsByWallet(walletId) {
-		return ((await this.options.database.prepare(`SELECT * FROM linked_device_authority_installations
+		return ((await this.prepareInstallationsByWalletRead(walletId).all()).results ?? []).map(parseStoredInstallationRow);
+	}
+	prepareInstallationsByWalletRead(walletId) {
+		return this.options.database.prepare(`SELECT * FROM linked_device_authority_installations
           WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
             AND wallet_id = ?
-          ORDER BY link_session_id ASC`).bind(this.options.scope.namespace, this.options.scope.orgId, this.options.scope.projectId, this.options.scope.envId, String(walletId)).all()).results ?? []).map(parseStoredInstallationRow);
+          ORDER BY link_session_id ASC`).bind(this.options.scope.namespace, this.options.scope.orgId, this.options.scope.projectId, this.options.scope.envId, String(walletId));
 	}
 };
+async function parseInstalledEcdsaCustodySnapshotV1(input) {
+	try {
+		if (!Array.isArray(input.installations) || !Array.isArray(input.signers)) return null;
+		const installations = [];
+		const signers = [];
+		for (const row of input.installations) {
+			if (!isPlainObject(row)) return null;
+			installations.push(row);
+		}
+		for (const row of input.signers) {
+			if (!isPlainObject(row)) return null;
+			signers.push(row);
+		}
+		const rows = installations.map(parseStoredInstallationRow);
+		for (const row of rows) {
+			if (row.walletId !== input.walletId) return null;
+			await assertStoredPackageDigest(row);
+		}
+		return {
+			readSnapshot: EcdsaMaterialReadSnapshot.linked(input.scope, input.walletId, installations, signers),
+			chain: installedEcdsaAuthorityChain(rows, input.materialActivation),
+			signers: parseWalletEcdsaSignerRows(signers, input.walletId)
+		};
+	} catch {
+		return null;
+	}
+}
+async function readStoredInstallationByAuthorityV1(sql, authorityId) {
+	const row = await sql.database.prepare(`SELECT * FROM linked_device_authority_installations
+        WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
+          AND authority_id = ? LIMIT 1`).bind(sql.scope.namespace, sql.scope.orgId, sql.scope.projectId, sql.scope.envId, String(authorityId)).first();
+	return row ? parseStoredInstallationRow(row) : null;
+}
+/**
+* The installed Ed25519 authority of a linked device, read from Gateway SQL
+* alone: a linked device approving another link names its own binding as the
+* source. Null when a link did not install the authority. An installation
+* that does not project refuses.
+*/
+async function readD1LinkedDeviceEd25519SourceV1(sql, input) {
+	const stored = await readStoredInstallationByAuthorityV1(sql, input.authorityId);
+	if (!stored) return null;
+	await assertStoredPackageDigest(stored);
+	const projection = stored.walletId === input.walletId && stored.authMethodId === input.walletAuthMethodId ? projectInstalledEd25519Authority(stored) : null;
+	if (!projection) throw new Error("linked-device Ed25519 source authority does not project its installed material");
+	return projection;
+}
+/**
+* The installed ECDSA authority of a linked device, read from Gateway SQL
+* alone: a linked device approving another link contributes from it. Null
+* when a link did not install the authority. An installation that does not
+* project refuses, so a linked device never falls back to another device's
+* material.
+*/
+async function readD1LinkedDeviceEcdsaSourceV1(sql, input) {
+	const stored = await readStoredInstallationByAuthorityV1(sql, input.authorityId);
+	if (!stored) return null;
+	await assertStoredPackageDigest(stored);
+	const projection = stored.walletId === input.walletId && stored.authMethodId === input.walletAuthMethodId ? projectInstalledEcdsaAuthority(stored) : null;
+	if (!projection) throw new Error("linked-device ECDSA source authority does not project its installed material");
+	return projection;
+}
 function assertRecipientRequestsMatchManifest(input) {
 	if (input.ordinarySignerMaterialRecipientRequests.length !== input.signerManifest.signers.length) throw new Error("ordinary signer material recipient requests do not match the signer manifest");
 	if (input.sourceContribution.length !== input.signerManifest.signers.length) throw new Error("ordinary source contributions do not match the signer manifest");
@@ -1423,39 +1497,6 @@ function projectInstalledEd25519Authority(stored) {
 		activatedAtMs: stored.activatedAtMs
 	};
 }
-function projectInstalledEcdsaAuthority(stored) {
-	if (stored.activatedAtMs === null || stored.installedRecordSetDigestB64u === null) return null;
-	const packages = stored.packages;
-	if (packages.authority.authorityId !== stored.authorityId || packages.authority.walletId !== stored.walletId || packages.authMethod.walletAuthMethodId !== stored.authMethodId || packages.authMethod.walletId !== stored.walletId || packages.authMethod.walletAuthorityId !== stored.authorityId || packages.authority.provenance.kind !== "device_link" || packages.authority.provenance.linkSessionId !== stored.linkSessionId || packages.authority.principal.deviceId !== stored.deviceId) return null;
-	const signerPackage = packages.signerPackages.ecdsa;
-	const authorityActivation = packages.authority.signerActivations.ecdsa;
-	if (!signerPackage || !authorityActivation) return null;
-	const receipt = signerPackage.activationReceipt;
-	const source = receipt.binding.source;
-	const target = receipt.binding.target;
-	const sourceScope = receipt.sourceDerivation.sourceNormalSigning.scope;
-	const targetScope = receipt.normalSigning.scope;
-	const authorityEthereumAddress = ecdsaAuthorityEvmAddressB64u(authorityActivation.signer.evmAddress);
-	if (authorityEthereumAddress === null || !mpcMaterialActivationRefsEqual(signerPackage.materialActivation, authorityActivation.materialActivation) || !mpcMaterialActivationRefsEqual(signerPackage.materialActivation, target.activation) || !mpcMaterialActivationRefsEqual(signerPackage.materialActivation, routerAbMpcMaterialActivationRefFromWire(targetScope.material_activation)) || String(receipt.binding.linkSessionId) !== String(stored.linkSessionId) || String(receipt.binding.enrollmentId) !== String(packages.authority.provenance.enrollmentId) || String(receipt.binding.sourceAuthorityId) !== String(packages.authority.provenance.sourceAuthorityId) || target.targetDeviceId !== stored.deviceId || target.targetFactorVerificationDigestB64u !== stored.targetFactorVerificationDigestB64u || signerPackage.encryptedTargetClientShare.recipientPublicKeyB64u !== target.clientRecipientPublicKeyB64u || sourceScope.wallet_id !== String(stored.walletId) || targetScope.wallet_id !== String(stored.walletId) || !mpcMaterialActivationRefsEqual(routerAbMpcMaterialActivationRefFromWire(sourceScope.material_activation), source.activation) || sourceScope.public_identity.client_share_retry_counter !== targetScope.public_identity.client_share_retry_counter || sourceScope.public_identity.server_share_retry_counter !== targetScope.public_identity.server_share_retry_counter || targetScope.signing_worker.server_id !== target.activation.signingWorker || targetScope.public_identity.derivation_client_share_public_key33_b64u !== receipt.binding.targetClientPublicKey33B64u || targetScope.public_identity.server_public_key33_b64u !== receipt.targetRelayerPublicKey33B64u || targetScope.public_identity.threshold_public_key33_b64u !== receipt.thresholdPublicKey33B64u || targetScope.public_identity.ethereum_address20_b64u !== receipt.thresholdEthereumAddress20B64u || authorityActivation.signer.walletId !== stored.walletId || authorityActivation.signer.thresholdPublicKey33B64u !== receipt.thresholdPublicKey33B64u || authorityEthereumAddress !== receipt.thresholdEthereumAddress20B64u) return null;
-	return {
-		walletId: stored.walletId,
-		authorityId: stored.authorityId,
-		walletAuthMethodId: stored.authMethodId,
-		linkSessionId: stored.linkSessionId,
-		deviceId: stored.deviceId,
-		materialActivation: signerPackage.materialActivation,
-		signer: authorityActivation.signer,
-		activationReceipt: receipt,
-		installedRecordSetDigestB64u: stored.installedRecordSetDigestB64u,
-		activatedAtMs: stored.activatedAtMs
-	};
-}
-function ecdsaAuthorityEvmAddressB64u(value) {
-	if (!/^0x[0-9a-fA-F]{40}$/.test(value)) return null;
-	const bytes = new Uint8Array(20);
-	for (let index = 0; index < bytes.length; index += 1) bytes[index] = Number.parseInt(value.slice(2 + index * 2, 4 + index * 2), 16);
-	return base64UrlEncode(bytes);
-}
 function parseStoredInstallationRow(row) {
 	const packages = parseCommittedAuthorityPackagesV1(parseD1JsonColumn(row.packages_json));
 	const linkSessionId = requireParsed(parseLinkDeviceSessionId(row.link_session_id), "link_session_id");
@@ -1826,6 +1867,6 @@ function errorMessage(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 //#endregion
-export { D1LinkedDeviceAuthorityInstallServiceV1 };
+export { D1LinkedDeviceAuthorityInstallServiceV1, parseInstalledEcdsaCustodySnapshotV1, readD1LinkedDeviceEcdsaSourceV1, readD1LinkedDeviceEd25519SourceV1 };
 
 //# sourceMappingURL=d1LinkedDeviceAuthorityInstallService.js.map

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEmailOtpGrantStore.js

@@ -1,8 +1,8 @@
+import { SESSION_CAS_GUARD_SQL } from "./d1LinkedDeviceSessionStore.js";
 import { parseLinkedDeviceEmailOtpGrantRecordV1 } from "../../../../core/deviceLinking/linkedDeviceEmailOtpGrant.js";
 //#region src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEmailOtpGrantStore.ts
 /**
-* Refactor 103 Phase 6 — D1 persistence for linked-device Email OTP
-* verification grants.
+* D1 persistence for linked-device Email OTP verification grants.
 *
 * A grant is issued once, after the emailed code verifies against the exact
 * link-session binding, and consumed exactly once. The CAS guard makes a lost
@@ -10,9 +10,6 @@ import { parseLinkedDeviceEmailOtpGrantRecordV1 } from "../../../../core/deviceL
 * completions.
 */
 const GRANT_TABLE = "linked_device_email_otp_grants";
-const GRANT_CAS_GUARD_SQL = `INSERT INTO linked_device_session_cas_guard (guard_id)
-SELECT 1
- WHERE changes() = 0`;
 var D1LinkedDeviceEmailOtpGrantStoreV1 = class {
 	constructor(input) {
 		this.database = input.database;
@@ -57,7 +54,7 @@ var D1LinkedDeviceEmailOtpGrantStoreV1 = class {
                     '$.state', json_object('kind', 'consumed', 'consumedAtMs', ?)
                   )
             WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
-              AND grant_id = ? AND state = 'issued' AND expires_at_ms > ?`).bind(input.consumedAtMs, input.consumedAtMs, ...scopeValues(this.scope), input.grantId, input.consumedAtMs), this.database.prepare(GRANT_CAS_GUARD_SQL)];
+              AND grant_id = ? AND state = 'issued' AND expires_at_ms > ?`).bind(input.consumedAtMs, input.consumedAtMs, ...scopeValues(this.scope), input.grantId, input.consumedAtMs), this.database.prepare(SESSION_CAS_GUARD_SQL)];
 	}
 };
 function serializeGrantForD1(record) {

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEmailOtpTargetFactor.js

@@ -1,6 +1,6 @@
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { computeLinkedDeviceTargetPreparationDigestV1 } from "../../../../shared-ts/src/device-linking/digests.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION, WALLET_EMAIL_OTP_REGISTRATION_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { sealEmailOtpFactorSecretForWorker } from "../../../domains/emailOtp/emailOtpRouteHandlers.js";
@@ -20,24 +20,6 @@ var D1LinkedDeviceEmailOtpTargetFactorV1 = class {
 		this.grantTtlMs = requirePositiveMs(options.grantTtlMs ?? DEFAULT_GRANT_TTL_MS, "grantTtlMs");
 		this.resendCooldownMs = requirePositiveMs(options.resendCooldownMs ?? DEFAULT_RESEND_COOLDOWN_MS, "resendCooldownMs");
 	}
-	async resolveTargetEnrollmentV1(input) {
-		const enrollment = await this.options.enrollments.readEnrollment(String(input.walletId));
-		if (!enrollment) return {
-			kind: "new_enrollment",
-			targetEmail: input.targetEmail
-		};
-		if (enrollment.verifiedEmail !== input.targetEmail) return {
-			kind: "conflict",
-			message: "target Email OTP address conflicts with the wallet enrollment"
-		};
-		return (await this.listEligibleBaseFactorsV1(input.walletId)).length > 0 ? {
-			kind: "existing_enrollment",
-			targetEmail: input.targetEmail
-		} : {
-			kind: "new_enrollment",
-			targetEmail: input.targetEmail
-		};
-	}
 	async resolveBaseFactorSelectionV1(input) {
 		const candidates = await this.listEligibleBaseFactorsV1(input.walletId);
 		if (input.request.kind === "select") {

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceManagementService.js

@@ -66,14 +66,15 @@ function authorityPortV1(input) {
 			};
 		},
 		readByIdV1: async (authorityId) => await input.store.readById(authorityId),
-		revokeWalletAuthMethodV1: async (request) => await input.store.revokeWalletAuthMethod({
+		revokeWalletAuthMethodV1: async ({ commit, ...request }) => await input.store.revokeWalletAuthMethod({
 			...request,
-			sessionRevocationStatements: input.walletSessionAuthorizations.prepareRetireWalletSessionAuthorizationsV2ForAuthority({
+			sessionRevocationStatements: [...input.walletSessionAuthorizations.prepareRetireWalletSessionAuthorizationsV2ForAuthority({
 				tenantId: input.tenantId,
 				walletId: request.walletId,
 				authorityId: request.authorityId,
 				nowMs: request.requestedAtMs
-			})
+			}), ...commit?.statements ?? []],
+			trailingStatements: commit?.trailingStatements ?? []
 		})
 	};
 }

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceOwnerAuthorizationProvider.js

@@ -1,19 +1,20 @@
 import { mpcMaterialActivationRefsEqual, parseEcdsaRelayerKeyId, parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseProviderSubject } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseWalletSessionAuthorizationId, parseWalletSessionId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
-import { parseSecp256k1CompressedPublicKeyB64u } from "../../../../shared-ts/src/passkey-custody/primitives.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { buildFullOwnerDelegatedWalletAuthorityV1, hasDelegatedWalletPermissionV1, validateDelegatedWalletAuthorityAttenuationV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
-import { walletAuthorityDigestsMatchV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
+import { parseSecp256k1CompressedPublicKeyB64u } from "../../../../shared-ts/src/passkey-custody/primitives.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { deriveRouterAbEd25519YaoApplicationBindingDigestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
+import { deriveRouterAbEd25519YaoApplicationBindingDigestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519YaoDigests.js";
 import { buildEmailOtpWalletAuthAuthority, buildPasskeyWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { walletAuthorityDigestsMatchV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { buildWalletSessionLinkedDeviceOwnerAuthorizationV1, parseQrLinkedDeviceSessionPayloadV5 } from "../../../../shared-ts/src/device-linking/parsers.js";
 import { computeLinkedDevicePublicKeyDigestV1 } from "../../../../shared-ts/src/device-linking/requestProof.js";
-import { resolveActiveOwnerWalletExecutionLane, resolveWalletAuthMethodIdForAuthority } from "../../../../core/signingLanes/WalletExecutionLaneProjection.js";
 import { thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
-import { sourceKeyManifestDigestForFamilyV1 } from "../../../../core/deviceLinking/linkedDeviceSession.js";
+import { resolveActiveOwnerWalletExecutionLane, resolveWalletAuthMethodIdForAuthority } from "../../../../core/signingLanes/WalletExecutionLaneProjection.js";
+import "../../../../core/deviceLinking/requestProof.js";
+import { sourceKeyManifestDigestForFamilyV1 } from "../../../../core/deviceLinking/linkedDeviceSessionRecord.js";
 import { LinkedDeviceSourceFamilyUnavailableErrorV1 } from "./d1LinkedDeviceVerifiedLinkSourceReader.js";
 import { linkedDeviceSignerManifestsEqualV1 } from "./d1LinkedDeviceVerifiedLinkBuilder.js";
 import { D1LinkedDeviceTargetPlannerV1 } from "./d1LinkedDeviceTargetPlanner.js";
@@ -22,7 +23,7 @@ const ENROLLMENT_ID_DOMAIN_V1 = "seams/linked-device/enrollment-identity/v1";
 /** Builds authoritative source-child facts directly from the wallet stores. */
 function createD1LinkedDeviceOwnerSourceChildReaderV1(options) {
 	const projectionSource = new D1LinkedDeviceOwnerSourceProjectionSourceV1(options);
-	return { readOwnerSourceChildV1: readD1LinkedDeviceOwnerSourceChildV1.bind(void 0, projectionSource) };
+	return { readOwnerSourceChildV1: readD1LinkedDeviceOwnerSourceChildV1.bind(void 0, projectionSource, options) };
 }
 var D1LinkedDeviceOwnerSourceProjectionSourceV1 = class {
 	constructor(options) {
@@ -48,7 +49,7 @@ var WalletExecutionLaneProjectionSnapshotV1 = class {
 		return this.signers;
 	}
 };
-async function readD1LinkedDeviceOwnerSourceChildV1(projectionSource, input) {
+async function readD1LinkedDeviceOwnerSourceChildV1(projectionSource, linkedSources, input) {
 	if (input.owner.walletId !== input.request.approval.walletId) return null;
 	if (input.request.sourceSigner.walletId !== input.owner.walletId) return null;
 	const [authMethods, signers] = await Promise.all([projectionSource.listWalletAuthMethods({ walletId: input.owner.walletId }), projectionSource.listWalletSigners({ walletId: input.owner.walletId })]);
@@ -65,10 +66,52 @@ async function readD1LinkedDeviceOwnerSourceChildV1(projectionSource, input) {
 		sourceSigner: input.request.sourceSigner
 	});
 	if (!resolved || resolved.signer.custodyKeyManifestDigestB64u !== input.owner.keyManifestDigestB64u) return null;
-	return await sourceChildResolutionFromSignerV1({
+	const resolution = await sourceChildResolutionFromSignerV1({
 		signer: resolved.signer,
 		projection: resolved.projection
 	});
+	if (!resolution) return null;
+	const authMethod = authMethods.find((method) => String(method.walletAuthMethodId) === String(walletAuthMethodId));
+	if (!authMethod) return null;
+	const sourceAuthority = {
+		walletId: input.owner.walletId,
+		authorityId: authMethod.walletAuthorityId,
+		walletAuthMethodId
+	};
+	if (resolution.keyFamily === "ed25519") {
+		const linked = await linkedSources.readLinkedEd25519SourceV1(sourceAuthority);
+		return linked ? linkedEd25519SourceChildResolutionV1(resolution, linked) : resolution;
+	}
+	const linked = await linkedSources.readLinkedEcdsaSourceV1(sourceAuthority);
+	return linked ? linkedEcdsaSourceChildResolutionV1(resolution, linked) : resolution;
+}
+/**
+* A linked device's Ed25519 source: its own registration binding, which
+* preserves the wallet's stable key context and registered key. Its owner
+* lane stays the wallet's.
+*/
+function linkedEd25519SourceChildResolutionV1(resolution, linked) {
+	const binding = linked.targetBinding;
+	if (binding.operation !== "registration" || base64UrlEncode(Uint8Array.from(binding.stable_key_context_binding)) !== resolution.stableContextBindingB64u || base64UrlEncode(Uint8Array.from(linked.activationReceipt.registered_public_key)) !== resolution.registeredPublicKeyB64u) return null;
+	return {
+		...resolution,
+		linkedSourceBinding: binding
+	};
+}
+/**
+* A linked device's ECDSA source: its own active material and public
+* identity, which preserve the wallet's key and address. Its owner lane stays
+* the wallet's, so the lane checks read the signer that material preserves.
+*/
+function linkedEcdsaSourceChildResolutionV1(resolution, linked) {
+	const receipt = linked.activationReceipt;
+	if (receipt.thresholdPublicKey33B64u !== resolution.thresholdPublicKey33B64u || linked.signer.evmAddress !== resolution.evmAddress || receipt.sourceDerivation.applicationBindingDigestB64u !== resolution.applicationBindingDigestB64u || receipt.sourceDerivation.clientShareRetryCounter !== resolution.clientShareRetryCounter) return null;
+	return {
+		...resolution,
+		linkedSourceMaterialActivation: linked.materialActivation,
+		sourceHolderVerifyingShare33B64u: receipt.binding.targetClientPublicKey33B64u,
+		sourceServerVerifyingShare33B64u: receipt.targetRelayerPublicKey33B64u
+	};
 }
 async function resolveExactSourceSignerProjectionV1(input) {
 	for (const signer of input.signers) {

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRequestProofNonceStore.js

@@ -1,6 +1,7 @@
 import { parseLinkDeviceSessionId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { requireCanonicalString } from "../../../../shared-ts/src/utils/validation.js";
 import { d1ChangedRows } from "../../../../storage/d1Sql.js";
 //#region src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRequestProofNonceStore.ts
 const NONCE_TABLE = "linked_device_request_proof_nonces";
@@ -79,8 +80,8 @@ function parseNonceRecord(raw) {
 }
 function parseNonceRowV1(row) {
 	return parseNonceRecord({
-		linkSessionId: parseSessionId(requireString(row.link_session_id, "link_session_id")),
-		requestNonceB64u: requireString(row.request_nonce_b64u, "request_nonce_b64u"),
+		linkSessionId: parseSessionId(requireCanonicalString(row.link_session_id, "link_session_id")),
+		requestNonceB64u: requireCanonicalString(row.request_nonce_b64u, "request_nonce_b64u"),
 		proofDigestB64u: parseDigest(row.proof_digest_b64u, "proof_digest_b64u"),
 		issuedAtMs: requirePositiveInteger(row.issued_at_ms, "issued_at_ms"),
 		expiresAtMs: requirePositiveInteger(row.expires_at_ms, "expires_at_ms"),
@@ -105,10 +106,6 @@ function parseDigest(raw, field) {
 		throw new Error(`${field} is invalid`);
 	}
 }
-function requireString(raw, field) {
-	if (typeof raw !== "string" || raw.length === 0 || raw.trim() !== raw) throw new Error(`${field} is invalid`);
-	return raw;
-}
 function requirePositiveInteger(raw, field) {
 	const value = typeof raw === "number" ? raw : typeof raw === "string" && /^\d+$/.test(raw) ? Number(raw) : NaN;
 	if (!Number.isSafeInteger(value) || value <= 0) throw new Error(`${field} is invalid`);

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRevocation.js

@@ -0,0 +1,100 @@
+import { computeWalletAuthMethodRevokeOperationFingerprintV1 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
+import { computeWalletAuthMethodRevocationProofDigestV1 } from "../wallet/d1WalletAuthMethodRevocationReplayStore.js";
+//#region src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRevocation.ts
+/**
+* Revokes one linked device on a fresh proof from another active full-owner
+* method, as an auth-method revocation does: the proof is spent, the method
+* revoked and the answer recorded in one batch.
+*
+* The record binds the answer to the operation fingerprint and to a digest
+* of the proof, never the proof or its code. An exact retry is answered from
+* the record before its proof is examined again, so a request whose answer
+* was lost receives what committed although its code is spent. An Email OTP
+* code is verified without being spent, and spent only in that batch, so a
+* batch that does not commit leaves it usable for the same request.
+*/
+function createD1LinkedDeviceRevocationV1(deps) {
+	return async (input) => {
+		const { walletId, walletAuthMethodId, requestedAtMs } = input.request;
+		const operationFingerprintDigest = await computeWalletAuthMethodRevokeOperationFingerprintV1({
+			walletId,
+			targetWalletAuthMethodId: walletAuthMethodId,
+			requestedAtMs
+		});
+		const replay = {
+			walletId,
+			targetWalletAuthMethodId: walletAuthMethodId,
+			operationFingerprintDigestB64u: String(operationFingerprintDigest),
+			sourceProofDigestB64u: await computeWalletAuthMethodRevocationProofDigestV1(input.proof)
+		};
+		const answeredFromRecord = async () => {
+			const recorded = await deps.replays.readExactLinkedDeviceAnswerV1(replay);
+			if (!recorded) return null;
+			await deps.management.finishLinkedDeviceRevocationV1({
+				walletId,
+				walletAuthMethodId,
+				requestedAtMs
+			});
+			return {
+				kind: "answered",
+				result: recorded
+			};
+		};
+		const committed = await answeredFromRecord();
+		if (committed) return committed;
+		const verified = await deps.verifyProofForBatch({
+			walletId,
+			targetWalletAuthMethodId: walletAuthMethodId,
+			proof: input.proof,
+			expectedOrigin: input.expectedOrigin,
+			verifiedAtMs: requestedAtMs,
+			operationFingerprintDigest
+		});
+		if (verified.kind === "denied") return await answeredFromRecord().catch(() => null) ?? verified;
+		const spend = verified.emailOtpConsumeInBatch ?? [];
+		if (input.proof.kind === "email_otp" && spend.length === 0) return {
+			kind: "denied",
+			code: "invalid",
+			message: "Fresh Email OTP revocation proof cannot be spent with the revocation"
+		};
+		const sourceMethod = await deps.authMethodStore.readByIdV2({ walletAuthMethodId: verified.walletAuthMethodId });
+		const sourceAuthority = sourceMethod ? await deps.authorityStore.readById(sourceMethod.walletAuthorityId) : null;
+		if (!sourceMethod || sourceMethod.walletId !== walletId || sourceAuthority?.state !== "active" || sourceAuthority.walletId !== walletId) return {
+			kind: "denied",
+			code: "unauthorized",
+			message: "Fresh revocation proof is not from an active wallet method"
+		};
+		const result = await deps.management.revokeLinkedDeviceV1(input.request, {
+			...input.owner,
+			freshProof: {
+				walletAuthMethodId: verified.walletAuthMethodId,
+				verifiedAtMs: verified.verifiedAtMs
+			}
+		}, {
+			prerequisites: [...deps.authMethodStore.prepareActiveV2SourceGuardStatements({
+				walletId,
+				walletAuthMethodId: sourceMethod.walletAuthMethodId,
+				walletAuthorityId: sourceMethod.walletAuthorityId,
+				authorityDigestB64u: sourceAuthority.authorityDigestB64u,
+				authorityRevocationEpoch: sourceAuthority.revocationEpoch
+			}), ...spend],
+			recordAnswer: ({ authorityId }) => deps.replays.prepareRecordLinkedDeviceAnswerStatements({
+				identity: replay,
+				sourceWalletAuthMethodId: verified.walletAuthMethodId,
+				authorityId,
+				committedAtMs: deps.nowV1()
+			})
+		});
+		return await deps.replays.readExactLinkedDeviceAnswerV1(replay).then((recorded) => recorded ? {
+			kind: "answered",
+			result: recorded
+		} : null).catch(() => null) ?? {
+			kind: "answered",
+			result
+		};
+	};
+}
+//#endregion
+export { createD1LinkedDeviceRevocationV1 };
+
+//# sourceMappingURL=d1LinkedDeviceRevocation.js.map