@seams/wallet-server 0.7.1 → 0.8.0

package/dist/esm/router/cloudflare/d1/authorization/d1VaultProxyStore.js

@@ -2,6 +2,7 @@ import { parseCapabilityId, parseTenantId, parseVaultId, parseVaultItemId } from
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
 import { parseVaultProxyDestination } from "../../../../authorization/vaultProxyUse.js";
+import { toArrayBufferCopy } from "../../../../core/authService/portableCrypto.js";
 //#region src/router/cloudflare/d1/authorization/d1VaultProxyStore.ts
 const VAULT_PROXY_SECRET_AAD_DOMAIN_V1 = "seams:vault:proxy-secret:v1";
 const AES_GCM_NONCE_BYTES = 12;
@@ -21,10 +22,10 @@ var CloudflareD1VaultProxyStore = class {
 		try {
 			const ciphertext = await crypto.subtle.encrypt({
 				name: "AES-GCM",
-				iv: toArrayBuffer(nonce),
-				additionalData: toArrayBuffer(aad(input)),
+				iv: toArrayBufferCopy(nonce),
+				additionalData: toArrayBufferCopy(aad(input)),
 				tagLength: 128
-			}, await this.key, toArrayBuffer(plaintext));
+			}, await this.key, toArrayBufferCopy(plaintext));
 			await this.database.prepare(`INSERT INTO vault_proxy_secrets (
             namespace,
             tenant_id,
@@ -65,10 +66,10 @@ var CloudflareD1VaultProxyStore = class {
 		try {
 			return new Uint8Array(await crypto.subtle.decrypt({
 				name: "AES-GCM",
-				iv: toArrayBuffer(nonce),
-				additionalData: toArrayBuffer(aad(input)),
+				iv: toArrayBufferCopy(nonce),
+				additionalData: toArrayBufferCopy(aad(input)),
 				tagLength: 128
-			}, await this.key, toArrayBuffer(ciphertext)));
+			}, await this.key, toArrayBufferCopy(ciphertext)));
 		} finally {
 			nonce.fill(0);
 			ciphertext.fill(0);
@@ -77,7 +78,7 @@ var CloudflareD1VaultProxyStore = class {
 };
 async function importEncryptionKey(bytes) {
 	try {
-		return await crypto.subtle.importKey("raw", toArrayBuffer(bytes), { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
+		return await crypto.subtle.importKey("raw", toArrayBufferCopy(bytes), { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
 	} finally {
 		bytes.fill(0);
 	}
@@ -111,11 +112,6 @@ function requireCompactString(value, label) {
 	if (typeof value !== "string" || !value || value.trim() !== value) throw new Error(`vault proxy ${label} is invalid`);
 	return value;
 }
-function toArrayBuffer(bytes) {
-	const copy = new ArrayBuffer(bytes.byteLength);
-	new Uint8Array(copy).set(bytes);
-	return copy;
-}
 //#endregion
 export { CloudflareD1VaultProxyStore };
 

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService.js

@@ -3,8 +3,9 @@ import { parseDeviceId, parsePrincipalId, parseTenantId, parseWalletSessionMintI
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
 import { buildDelegatedWalletAuthorityV1, parseDelegatedWalletPermissionSetV1, validateDelegatedWalletAuthorityAttenuationV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
-import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { routerAbMpcMaterialActivationRefFromWire, routerAbMpcMaterialActivationRefToWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseRouterAbEd25519YaoApplicationBindingFactsV1, parseRouterAbEd25519YaoCeremonyBindingV1, sameRouterAbEd25519YaoActivationBindingV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { assertLinkedDeviceOrdinaryMaterialSourceContributionMatchesContextV1, parseLinkedDeviceEcdsaSourceContributionPackageV1, parseLinkedDeviceEcdsaSourceDerivationV1, parseLinkedDeviceOrdinaryMaterialSourceContributionV1 } from "../../../../shared-ts/src/device-linking/sourceContribution.js";
 import { buildWalletAuthMethodRecordV2, sameWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
@@ -13,16 +14,19 @@ import { computeCommittedSignerPackageSetDigestB64u, parseCommittedAuthorityPack
 import { unknownWebAuthnAuthenticatorDeviceInfo } from "../../../../shared-ts/src/utils/webauthnDeviceInfo.js";
 import { assertLinkedDeviceWalletSessionCredentialDeliveryIntegrityV1, buildLinkedDeviceWalletSessionCredentialDeliveryBindingV1, computeLinkedDeviceActivationCleanupReceiptDigestB64u, computeLinkedDeviceWalletSessionCredentialDeliveryAadDigestB64u, computeLinkedDeviceWalletSessionCredentialEnvelopeDigestB64u, encodeLinkedDeviceWalletSessionCredentialDeliveryAadV1, parseLinkedDeviceActivationCleanupReceiptV1, parseLinkedDeviceWalletSessionCredentialDeliveryV1 } from "../../../../shared-ts/src/device-linking/walletSessionCredentialDelivery.js";
 import { parseLocalAuthorityActivationFinalAckV1 } from "../../../../shared-ts/src/device-linking/authorityActivation.js";
-import { computeWalletSessionInstallationReceiptDigestB64u, computeWalletSessionOperationCredentialDigestB64u } from "../../../../shared-ts/src/device-linking/digests.js";
+import { computeWalletSessionInstallationReceiptDigestB64u } from "../../../../shared-ts/src/device-linking/digests.js";
 import { computeLinkedDevicePublicKeyDigestV1 } from "../../../../shared-ts/src/device-linking/requestProof.js";
-import { buildPersistedActiveWalletSessionAuthorizationV2, walletSessionAuthorizationV2RecordsEqual } from "../../../../authorization/domain.js";
+import { walletSessionAuthorizationV2RecordsEqual } from "../../../../authorization/domain.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
+import { EcdsaMaterialReadSnapshot } from "../../../../core/ecdsaMaterialReadSnapshot.js";
 import { parseD1JsonColumn } from "../../../../storage/d1Sql.js";
+import { parseWalletEcdsaSignerRows, prepareWalletEcdsaSignersRead } from "../../../../core/d1EcdsaSignerRead.js";
 import "../../../../core/deviceLinking/requestProof.js";
+import { reservePasskeyCredential } from "../../../../core/passkeyCredentialClaims.js";
 import { prepareD1WebAuthnCredentialBindingInsertStatement } from "../../../../core/WebAuthnCredentialBindingStore.js";
 import { prepareD1WebAuthnAuthenticatorInsertStatement } from "../webauthn/d1WebAuthnStore.js";
-import { buildAuthorityActiveSessionRecordV1, buildAuthorityPendingLocalInstallSessionRecordV1 } from "../../../../core/deviceLinking/linkedDeviceSessionRecord.js";
 import { findInstalledEcdsaAuthority, installedEcdsaAuthorityChain, projectInstalledEcdsaAuthority } from "./installedEcdsaAuthority.js";
+import { buildAuthorityActiveSessionRecordV1, buildAuthorityPendingLocalInstallSessionRecordV1 } from "../../../../core/deviceLinking/linkedDeviceSessionRecord.js";
 import { linkedDeviceX25519RecipientPublicKeyB64uV1 } from "./d1LinkedDeviceSourceContributionPreparationPlanner.js";
 //#region src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService.ts
 var LinkedDeviceActivationIntegrityErrorV1 = class extends Error {
@@ -254,6 +258,7 @@ var D1LinkedDeviceAuthorityInstallServiceV1 = class {
 			const activeAuthority = await buildActiveAuthority(authority, receipt.installedAtMs);
 			const activeAuthMethod = buildActiveAuthMethod(authMethod, receipt.installedAtMs);
 			const passkeyCredentialStatements = await buildPasskeyCredentialPromotionStatements({
+				credentialClaims: this.options.credentialClaims,
 				database: this.options.database,
 				scope: this.options.scope,
 				listWalletEd25519Signers: this.options.listWalletEd25519Signers,
@@ -276,17 +281,9 @@ var D1LinkedDeviceAuthorityInstallServiceV1 = class {
 				nowMs
 			});
 			const preparedWalletSession = await this.options.authorizationService.prepareWalletSessionAuthorizationV2(this.buildWalletSessionAuthorizationInput(activeAuthority, activeAuthMethod, receipt.installedAtMs));
-			const operationCredential = {
-				kind: "opaque_wallet_session_operation_credential_v1",
-				token: `wst_${secureRandomBase64Url(32, "linked-device Wallet Session operation credential")}`,
-				walletSessionId: preparedWalletSession.session.walletSessionId
-			};
-			const credentialDigestB64u = await computeWalletSessionOperationCredentialDigestB64u(operationCredential);
-			const walletSessionStatements = this.options.authorizationStore.prepareDirectWalletSessionAuthorizationV2Statements(buildPersistedActiveWalletSessionAuthorizationV2({
-				session: preparedWalletSession.session,
-				quota: preparedWalletSession.quota,
-				primaryOperationCredentialDigestB64u: credentialDigestB64u
-			}));
+			const { operationCredential, persisted } = await this.options.authorizationService.prepareDirectWalletSessionCredential(preparedWalletSession);
+			const credentialDigestB64u = persisted.primaryOperationCredentialDigestB64u;
+			const walletSessionStatements = this.options.authorizationStore.prepareDirectWalletSessionAuthorizationV2Statements(persisted);
 			const installationReceiptDigestB64u = await computeWalletSessionInstallationReceiptDigestB64u(receipt);
 			const sealedDelivery = await sealLinkedDeviceWalletSessionCredentialV1({
 				scope: this.options.scope,
@@ -471,11 +468,20 @@ var D1LinkedDeviceAuthorityInstallServiceV1 = class {
 			return null;
 		}
 	}
-	async readInstalledEcdsaAuthorityChainByMaterialActivationV1(input) {
+	async readInstalledEcdsaCustodySnapshotV1(input) {
 		try {
-			return installedEcdsaAuthorityChain(await this.readVerifiedEcdsaInstallations(input.walletId), input.materialActivation);
+			if (input.source.kind === "credential_snapshot") return input.source.materialRead.resolveLinked(this.options.scope, input.walletId, routerAbMpcMaterialActivationRefToWire(input.materialActivation));
+			const [installations, signers] = await this.options.database.batch([this.prepareInstallationsByWalletRead(input.walletId), prepareWalletEcdsaSignersRead(this.options.database, this.options.scope, input.walletId)]);
+			if (!installations?.success || !signers?.success) throw new Error("Linked ECDSA custody snapshot is incomplete");
+			return await parseInstalledEcdsaCustodySnapshotV1({
+				scope: this.options.scope,
+				walletId: input.walletId,
+				materialActivation: input.materialActivation,
+				installations: installations.results ?? [],
+				signers: signers.results ?? []
+			});
 		} catch {
-			return [];
+			return null;
 		}
 	}
 	async readVerifiedEcdsaInstallations(walletId) {
@@ -1023,12 +1029,42 @@ var D1LinkedDeviceAuthorityInstallServiceV1 = class {
 		return await readStoredInstallationByAuthorityV1(this.options, authorityId);
 	}
 	async readInstallationsByWallet(walletId) {
-		return ((await this.options.database.prepare(`SELECT * FROM linked_device_authority_installations
+		return ((await this.prepareInstallationsByWalletRead(walletId).all()).results ?? []).map(parseStoredInstallationRow);
+	}
+	prepareInstallationsByWalletRead(walletId) {
+		return this.options.database.prepare(`SELECT * FROM linked_device_authority_installations
           WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
             AND wallet_id = ?
-          ORDER BY link_session_id ASC`).bind(this.options.scope.namespace, this.options.scope.orgId, this.options.scope.projectId, this.options.scope.envId, String(walletId)).all()).results ?? []).map(parseStoredInstallationRow);
+          ORDER BY link_session_id ASC`).bind(this.options.scope.namespace, this.options.scope.orgId, this.options.scope.projectId, this.options.scope.envId, String(walletId));
 	}
 };
+async function parseInstalledEcdsaCustodySnapshotV1(input) {
+	try {
+		if (!Array.isArray(input.installations) || !Array.isArray(input.signers)) return null;
+		const installations = [];
+		const signers = [];
+		for (const row of input.installations) {
+			if (!isPlainObject(row)) return null;
+			installations.push(row);
+		}
+		for (const row of input.signers) {
+			if (!isPlainObject(row)) return null;
+			signers.push(row);
+		}
+		const rows = installations.map(parseStoredInstallationRow);
+		for (const row of rows) {
+			if (row.walletId !== input.walletId) return null;
+			await assertStoredPackageDigest(row);
+		}
+		return {
+			readSnapshot: EcdsaMaterialReadSnapshot.linked(input.scope, input.walletId, installations, signers),
+			chain: installedEcdsaAuthorityChain(rows, input.materialActivation),
+			signers: parseWalletEcdsaSignerRows(signers, input.walletId)
+		};
+	} catch {
+		return null;
+	}
+}
 async function readStoredInstallationByAuthorityV1(sql, authorityId) {
 	const row = await sql.database.prepare(`SELECT * FROM linked_device_authority_installations
         WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
@@ -1371,6 +1407,11 @@ function buildActiveAuthMethod(pending, activatedAtMs) {
 }
 async function buildPasskeyCredentialPromotionStatements(input) {
 	if (input.authMethod.kind !== "passkey") return [];
+	await reservePasskeyCredential(input.credentialClaims, {
+		walletId: input.authMethod.walletId,
+		rpId: input.authMethod.rpId,
+		credentialIdB64u: input.authMethod.credentialIdB64u
+	});
 	const signer = await resolveLinkedDeviceEd25519Signer({
 		authority: input.authority,
 		listWalletEd25519Signers: input.listWalletEd25519Signers
@@ -1825,6 +1866,6 @@ function errorMessage(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 //#endregion
-export { D1LinkedDeviceAuthorityInstallServiceV1, readD1LinkedDeviceEcdsaSourceV1, readD1LinkedDeviceEd25519SourceV1 };
+export { D1LinkedDeviceAuthorityInstallServiceV1, parseInstalledEcdsaCustodySnapshotV1, readD1LinkedDeviceEcdsaSourceV1, readD1LinkedDeviceEd25519SourceV1 };
 
 //# sourceMappingURL=d1LinkedDeviceAuthorityInstallService.js.map

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEd25519ExportRootStore.js

@@ -13,7 +13,12 @@ var D1LinkedDeviceEd25519ExportRootStoreV1 = class {
            namespace, org_id, project_id, env_id, link_session_id,
            wallet_id, enrollment_id, device_id, state, transfer_alg,
            recipient_public_key_b64u, recipient_json, registered_at_ms
-         ) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, 'recipient_registered', ?9, ?10, ?11, ?12)`).bind(...scopeValues(this.scope), String(recipient.linkSessionId), String(recipient.walletId), String(recipient.enrollmentId), String(recipient.deviceId), "x25519-hkdf-sha256-chacha20poly1305-v1", String(recipient.recipientPublicKeyB64u), JSON.stringify(recipient), recipient.registeredAtMs).run()) === 1) return { outcome: "applied" };
+         ) SELECT ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, 'recipient_registered', ?9, ?10, ?11, ?12
+           FROM linked_device_sessions
+          WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+            AND link_session_id = ?5
+            AND state IN ('awaiting_target_factor', 'awaiting_source_contribution',
+                          'provisioning', 'authority_pending_local_install', 'active')`).bind(...scopeValues(this.scope), String(recipient.linkSessionId), String(recipient.walletId), String(recipient.enrollmentId), String(recipient.deviceId), "x25519-hkdf-sha256-chacha20poly1305-v1", String(recipient.recipientPublicKeyB64u), JSON.stringify(recipient), recipient.registeredAtMs).run()) === 1) return { outcome: "applied" };
 		const existing = await this.readRowV1(String(recipient.linkSessionId));
 		if (!existing) return {
 			outcome: "conflict",

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEmailOtpGrantStore.js

@@ -1,3 +1,4 @@
+import { d1ChangedRows } from "../../../../storage/d1Sql.js";
 import { SESSION_CAS_GUARD_SQL } from "./d1LinkedDeviceSessionStore.js";
 import { parseLinkedDeviceEmailOtpGrantRecordV1 } from "../../../../core/deviceLinking/linkedDeviceEmailOtpGrant.js";
 //#region src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEmailOtpGrantStore.ts
@@ -18,7 +19,7 @@ var D1LinkedDeviceEmailOtpGrantStoreV1 = class {
 	async issueV1(record) {
 		const parsed = parseLinkedDeviceEmailOtpGrantRecordV1(record);
 		if (parsed.state.kind !== "issued") throw new Error("a linked-device email OTP grant is only ever inserted as issued");
-		await this.database.prepare(`INSERT INTO ${GRANT_TABLE} (
+		if (d1ChangedRows(await this.database.prepare(`INSERT INTO ${GRANT_TABLE} (
            namespace, org_id, project_id, env_id, grant_id,
            grant_token_digest_b64u, wallet_id, link_session_id, enrollment_id,
            device_id, target_factor, target_preparation_digest_b64u,
@@ -27,7 +28,16 @@ var D1LinkedDeviceEmailOtpGrantStoreV1 = class {
            base_wallet_auth_method_id, linked_owner_auth_method_id,
            authority_digest_b64u, challenge_id, state, record_json,
            issued_at_ms, expires_at_ms, consumed_at_ms
-         ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'email_otp', ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'issued', ?, ?, ?, NULL)`).bind(...scopeValues(this.scope), parsed.grantId, parsed.grantTokenDigestB64u, String(parsed.walletId), String(parsed.linkSessionId), String(parsed.enrollmentId), String(parsed.deviceId), parsed.targetPreparationDigestB64u, parsed.targetEmail, parsed.enrollment.kind, parsed.emailHashHex, parsed.registrationAuthorityId, parsed.providerUserId, parsed.baseWalletAuthMethodId ?? null, String(parsed.walletAuthMethodId), parsed.authorityDigestB64u, parsed.challengeId, serializeGrantForD1(parsed), parsed.issuedAtMs, parsed.expiresAtMs).run();
+         ) SELECT ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, 'email_otp',
+                  ?11, ?12, ?13, ?14, ?15, ?16, ?17, ?18, ?19, ?20, 'issued', ?21, ?22, ?23, NULL
+             FROM linked_device_sessions
+            WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+              AND link_session_id = ?8 AND state = 'awaiting_target_factor'`).bind(...scopeValues(this.scope), parsed.grantId, parsed.grantTokenDigestB64u, String(parsed.walletId), String(parsed.linkSessionId), String(parsed.enrollmentId), String(parsed.deviceId), parsed.targetPreparationDigestB64u, parsed.targetEmail, parsed.enrollment.kind, parsed.emailHashHex, parsed.registrationAuthorityId, parsed.providerUserId, parsed.baseWalletAuthMethodId ?? null, String(parsed.walletAuthMethodId), parsed.authorityDigestB64u, parsed.challengeId, serializeGrantForD1(parsed), parsed.issuedAtMs, parsed.expiresAtMs).run()) === 1) return { kind: "issued" };
+		return {
+			kind: "refused",
+			code: "link_session_inactive",
+			message: "linked-device session no longer accepts Email OTP grants"
+		};
 	}
 	async readByIdV1(grantId) {
 		const row = await this.database.prepare(`SELECT json_set(

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEmailOtpTargetFactor.js

@@ -177,7 +177,8 @@ var D1LinkedDeviceEmailOtpTargetFactorV1 = class {
 			code: sealed.code,
 			message: sealed.message
 		};
-		await this.options.grants.issueV1(grantRecord);
+		const issued = await this.options.grants.issueV1(grantRecord);
+		if (issued.kind === "refused") return issued;
 		return {
 			kind: "verified",
 			grant: {
@@ -264,7 +265,8 @@ var D1LinkedDeviceEmailOtpTargetFactorV1 = class {
 			issuedAtMs,
 			expiresAtMs
 		});
-		await this.options.grants.issueV1(grantRecord);
+		const issued = await this.options.grants.issueV1(grantRecord);
+		if (issued.kind === "refused") return issued;
 		return {
 			kind: "verified",
 			grant: {
@@ -409,7 +411,6 @@ var D1LinkedDeviceEmailOtpTargetFactorV1 = class {
 				kind: "existing_enrollment",
 				resolved,
 				targetEmail,
-				enrollment: { kind: "existing_enrollment" },
 				targetPreparationDigestB64u,
 				walletAuthMethodId,
 				authorityDigestB64u: await computeLinkedDeviceEmailOtpAuthorityDigestV1({
@@ -448,7 +449,6 @@ var D1LinkedDeviceEmailOtpTargetFactorV1 = class {
 		return {
 			kind: "new_enrollment",
 			targetEmail,
-			enrollment: { kind: "new_enrollment" },
 			targetPreparationDigestB64u,
 			walletAuthMethodId,
 			authorityDigestB64u: await computeLinkedDeviceEmailOtpAuthorityDigestV1({

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceOwnerAuthorizationProvider.js

@@ -11,9 +11,9 @@ import { buildEmailOtpWalletAuthAuthority, buildPasskeyWalletAuthAuthority, wall
 import { walletAuthorityDigestsMatchV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { buildWalletSessionLinkedDeviceOwnerAuthorizationV1, parseQrLinkedDeviceSessionPayloadV5 } from "../../../../shared-ts/src/device-linking/parsers.js";
 import { computeLinkedDevicePublicKeyDigestV1 } from "../../../../shared-ts/src/device-linking/requestProof.js";
-import { thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
 import { resolveActiveOwnerWalletExecutionLane, resolveWalletAuthMethodIdForAuthority } from "../../../../core/signingLanes/WalletExecutionLaneProjection.js";
 import "../../../../core/deviceLinking/requestProof.js";
+import { thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
 import { sourceKeyManifestDigestForFamilyV1 } from "../../../../core/deviceLinking/linkedDeviceSessionRecord.js";
 import { LinkedDeviceSourceFamilyUnavailableErrorV1 } from "./d1LinkedDeviceVerifiedLinkSourceReader.js";
 import { linkedDeviceSignerManifestsEqualV1 } from "./d1LinkedDeviceVerifiedLinkBuilder.js";

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRequestProofNonceStore.js

@@ -1,7 +1,7 @@
 import { parseLinkDeviceSessionId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { requireCanonicalString } from "../../../../shared-ts/src/utils/validation.js";
+import { isObject, requireCanonicalString } from "../../../../shared-ts/src/utils/validation.js";
 import { d1ChangedRows } from "../../../../storage/d1Sql.js";
 //#region src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRequestProofNonceStore.ts
 const NONCE_TABLE = "linked_device_request_proof_nonces";
@@ -12,14 +12,7 @@ var D1LinkedDeviceRequestProofNonceStoreV1 = class {
 		this.scope = normalizeScope(options.scope);
 	}
 	async consumeRequestProofNonceV1(input) {
-		const normalized = parseNonceRecord({
-			linkSessionId: input.linkSessionId,
-			requestNonceB64u: input.requestNonceB64u,
-			proofDigestB64u: input.proofDigestB64u,
-			issuedAtMs: input.issuedAtMs,
-			expiresAtMs: input.expiresAtMs,
-			consumedAtMs: input.consumedAtMs
-		});
+		const normalized = parseNonceRecord(input);
 		await this.pruneExpiredNoncesV1(normalized.consumedAtMs);
 		try {
 			if (d1ChangedRows(await this.database.prepare(`INSERT INTO ${NONCE_TABLE} (
@@ -60,6 +53,7 @@ var D1LinkedDeviceRequestProofNonceStoreV1 = class {
 	}
 };
 function parseNonceRecord(raw) {
+	if (!isObject(raw)) throw new Error("Invalid device request nonce");
 	const linkSessionId = parseSessionId(raw.linkSessionId);
 	const requestNonceB64u = parseFixedB64u(raw.requestNonceB64u, "requestNonceB64u");
 	const proofDigestB64u = parseDigest(raw.proofDigestB64u, "proofDigestB64u");

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRouteService.js

@@ -8,12 +8,13 @@ import { D1LinkedDeviceSessionStoreV1 } from "./d1LinkedDeviceSessionStore.js";
 //#region src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRouteService.ts
 function createD1LinkedDeviceRouteServiceV1(options) {
 	const nowV1 = options.nowV1 ?? Date.now;
-	const proofVerifier = new LinkedDeviceRequestProofVerifierV1({ nonceStore: new D1LinkedDeviceRequestProofNonceStoreV1({
+	const proofVerifier = new LinkedDeviceRequestProofVerifierV1({ nonceStore: options.proofNonces ?? new D1LinkedDeviceRequestProofNonceStoreV1({
 		database: options.database,
 		scope: options.scope
 	}) });
 	const { sessionService } = createD1LinkedDeviceSessionServiceV1({
 		sessionStore: new D1LinkedDeviceSessionStoreV1({
+			bootstrap: options.bootstrap,
 			database: options.database,
 			scope: options.scope,
 			now: nowV1

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionStore.js

@@ -3,6 +3,7 @@ import { assertNeverLinkSessionStateV1 } from "../../../../shared-ts/src/device-
 import { parseLinkedDeviceApprovalV1, parseLinkedDeviceSessionClaimV1 } from "../../../../shared-ts/src/device-linking/parsers.js";
 import { computeLinkedDeviceApprovalDigestV1, computeLinkedDeviceSessionClaimDigestV1 } from "../../../../shared-ts/src/device-linking/digests.js";
 import { d1ChangedRows, queryD1All } from "../../../../storage/d1Sql.js";
+import { requireLinkedDeviceBootstrapRecord } from "../../../../core/deviceLinking/linkedDeviceBootstrap.js";
 import { LinkedDeviceRetiredSessionShapeErrorV1, approvalTranscriptMatchesDigest, claimTranscriptMatchesDigest, conflictResult, integrityResult, invalidStateResult, isPrecommitState, linkedDeviceEmailOtpChallengesEqualV1, linkedDeviceQrPayloadsEqualV1, parseLinkedDeviceSessionRecordV1, sessionExpiryMsV1, sourceContributionTranscriptMatchesDigest } from "../../../../core/deviceLinking/linkedDeviceSessionRecord.js";
 import { parseD1LinkedDeviceSessionRowV1, parseD1LinkedDeviceSessionTranscriptRowV1 } from "./d1LinkedDeviceSessionRecords.js";
 //#region src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionStore.ts
@@ -29,21 +30,33 @@ const PRECOMMIT_STATES = [
 ];
 var D1LinkedDeviceSessionStoreV1 = class {
 	constructor(options) {
+		this.bootstrap = options.bootstrap;
 		this.database = options.database;
 		this.scope = normalizeScope(options.scope);
 	}
 	async createUnclaimedSessionV1(record) {
 		const normalized = parseLinkedDeviceSessionRecordV1(record);
 		if (normalized.state.state !== "displaying_qr" || normalized.revision !== 1) return invalidStateResult(normalized);
+		if (this.bootstrap) {
+			const existing = requireLinkedDeviceBootstrapRecord(await this.bootstrap.create(normalized));
+			if (!existing) throw new Error("Bootstrap creation returned no session");
+			if (!linkedDeviceQrPayloadsEqualV1(existing.qrPayload, normalized.qrPayload)) return conflictResult(1, existing);
+			if (existing.state.state === "claimed") {
+				const current = await this.getSessionV1(normalized.linkSessionId);
+				if (!current) return conflictResult(1, null);
+				return {
+					outcome: "replayed",
+					record: current
+				};
+			}
+			return {
+				outcome: "applied",
+				record: existing
+			};
+		}
 		let insertError;
 		try {
-			if (d1ChangedRows(await this.database.prepare(`INSERT INTO ${SESSION_TABLE} (
-             namespace, org_id, project_id, env_id, link_session_id,
-             link_public_key_b64u, device_public_key_b64u, state, record_json,
-             revision, expires_at_ms, claim_expires_at_ms, claim_digest_b64u,
-             approval_digest_b64u, authority_id, package_set_digest_b64u,
-             created_at_ms, updated_at_ms
-           ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).bind(...scopeValues(this.scope), ...sessionColumnValues(normalized)).run()) === 1) return {
+			if (d1ChangedRows(await this.sessionInsertStatement(normalized).run()) === 1) return {
 				outcome: "applied",
 				record: normalized
 			};
@@ -62,6 +75,44 @@ var D1LinkedDeviceSessionStoreV1 = class {
 		return conflictResult(1, existing);
 	}
 	async getSessionV1(linkSessionId) {
+		const local = await this.readLocalSession(linkSessionId);
+		if (local || !this.bootstrap) return local;
+		if (await this.database.prepare(`SELECT 1 AS imported FROM linked_device_bootstrap_imports
+      WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ? AND link_session_id = ?`).bind(...scopeValues(this.scope), String(linkSessionId)).first()) return null;
+		const record = requireLinkedDeviceBootstrapRecord(await this.bootstrap.read(linkSessionId));
+		if (!record || record.state.state !== "claimed") return record;
+		return this.importClaimedSession(record);
+	}
+	sessionInsertStatement(normalized) {
+		return this.database.prepare(`INSERT INTO ${SESSION_TABLE} (
+             namespace, org_id, project_id, env_id, link_session_id,
+             link_public_key_b64u, device_public_key_b64u, state, record_json,
+             revision, expires_at_ms, claim_expires_at_ms, claim_digest_b64u,
+             approval_digest_b64u, authority_id, package_set_digest_b64u,
+             created_at_ms, updated_at_ms
+           ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).bind(...scopeValues(this.scope), ...sessionColumnValues(normalized));
+	}
+	async importClaimedSession(record) {
+		if (record.state.state !== "claimed" || !record.claimTranscript || record.revision !== 2) throw new Error("Invalid bootstrap claim");
+		const transcript = record.claimTranscript;
+		if (await computeLinkedDeviceSessionClaimDigestV1(transcript.value) !== transcript.digestB64u) throw new Error("Invalid bootstrap claim digest");
+		try {
+			await this.database.batch([
+				this.sessionInsertStatement(record),
+				this.database.prepare(`INSERT INTO linked_device_session_transcripts
+          (namespace, org_id, project_id, env_id, link_session_id, transcript_kind, digest_b64u, transcript_json, created_at_ms)
+          VALUES (?, ?, ?, ?, ?, 'claim', ?, ?, ?)`).bind(...scopeValues(this.scope), record.linkSessionId, transcript.digestB64u, JSON.stringify(transcript.value), record.updatedAtMs),
+				this.database.prepare(`INSERT INTO linked_device_bootstrap_imports
+          (namespace, org_id, project_id, env_id, link_session_id) VALUES (?, ?, ?, ?, ?)`).bind(...scopeValues(this.scope), record.linkSessionId)
+			]);
+		} catch (error) {
+			const raced = await this.readLocalSession(record.linkSessionId);
+			if (raced && claimTranscriptMatchesDigest(raced, transcript.digestB64u)) return raced;
+			throw Object.assign(new Error("Linked-device claim import is unavailable", { cause: error }), { code: "home_unavailable" });
+		}
+		return record;
+	}
+	async readLocalSession(linkSessionId) {
 		const row = await this.database.prepare(`SELECT link_session_id, link_public_key_b64u, device_public_key_b64u,
                 state, record_json, revision, expires_at_ms, claim_expires_at_ms,
                 claim_digest_b64u, approval_digest_b64u, authority_id,
@@ -157,6 +208,21 @@ var D1LinkedDeviceSessionStoreV1 = class {
 		};
 	}
 	async claimSessionV1(input) {
+		if (this.bootstrap) {
+			const selected = requireLinkedDeviceBootstrapRecord(await this.bootstrap.claim(input.nextRecord));
+			if (selected?.state.state !== "claimed" || !selected.claimTranscript) throw Object.assign(/* @__PURE__ */ new Error("Bootstrap claim returned invalid state"), { code: "home_unavailable" });
+			const current = await this.readLocalSession(input.linkSessionId);
+			if (current) return claimTranscriptMatchesDigest(current, selected.claimTranscript.digestB64u) ? {
+				outcome: "replayed",
+				record: current
+			} : conflictResult(input.expectedRevision, current);
+			const imported = await this.getSessionV1(input.linkSessionId);
+			if (!imported) return conflictResult(input.expectedRevision, null);
+			return {
+				outcome: "applied",
+				record: imported
+			};
+		}
 		const current = await this.getSessionV1(input.linkSessionId);
 		if (!current) return conflictResult(input.expectedRevision, null);
 		if (claimTranscriptMatchesDigest(current, input.claimDigestB64u)) return {
@@ -293,6 +359,14 @@ var D1LinkedDeviceSessionStoreV1 = class {
 		});
 	}
 	async cancelSessionV1(input) {
+		if (this.bootstrap && !await this.readLocalSession(input.linkSessionId)) {
+			const record = requireLinkedDeviceBootstrapRecord(await this.bootstrap.finish(input.nextRecord));
+			if (!record) return conflictResult(input.expectedRevision, null);
+			return {
+				outcome: "applied",
+				record
+			};
+		}
 		return this.applyTerminalStateCas({
 			...sessionMutationFieldsV1(input),
 			expectedStates: PRECOMMIT_STATES,
@@ -301,6 +375,14 @@ var D1LinkedDeviceSessionStoreV1 = class {
 		});
 	}
 	async expireSessionV1(input) {
+		if (this.bootstrap && !await this.readLocalSession(input.linkSessionId)) {
+			const record = requireLinkedDeviceBootstrapRecord(await this.bootstrap.finish(input.nextRecord));
+			if (!record) return conflictResult(input.expectedRevision, null);
+			return {
+				outcome: "applied",
+				record
+			};
+		}
 		const current = await this.getSessionV1(input.linkSessionId);
 		if (!current) return conflictResult(input.expectedRevision, null);
 		if (current.state.state === "expired") return {

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetCredentialProvider.js

@@ -10,10 +10,10 @@ import { assertLinkedDeviceTargetCredentialRegistrationMatchesPreparationV1, com
 import { d1ChangedRows } from "../../../../storage/d1Sql.js";
 import { errorMessage } from "../../../../shared-ts/src/utils/errors.js";
 import { parseClientDataJsonBase64url } from "../../../../core/authService/webauthnOidcHelpers.js";
+import { linkedDeviceX25519RecipientPublicKeyB64uV1 } from "./d1LinkedDeviceSourceContributionPreparationPlanner.js";
 import { verifyWebAuthnRegistrationCredentialForIntent } from "../../../../core/authService/webauthn.js";
 import { SESSION_CAS_GUARD_SQL } from "./d1LinkedDeviceSessionStore.js";
 import { linkedDeviceEmailOtpDescriptorCredentialIdV1 } from "../../../../core/deviceLinking/linkedDeviceEmailOtpGrant.js";
-import { linkedDeviceX25519RecipientPublicKeyB64uV1 } from "./d1LinkedDeviceSourceContributionPreparationPlanner.js";
 import { buildVerifiedLinkInputV1, buildVerifiedTargetFactorV1 } from "./d1LinkedDeviceVerifiedLinkBuilder.js";
 //#region src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetCredentialProvider.ts
 /** Verifies the browser-signed ceremony origin against the configured RP ID. */
@@ -128,14 +128,7 @@ var D1LinkedDeviceTargetCredentialProviderV1 = class {
 	}
 	async getTargetPreparationV1(input) {
 		const persisted = await this.readV1(input.session.linkSessionId);
-		if (persisted) {
-			assertPreparationMatchesSession(persisted.preparation, input.session, input.approval);
-			if (input.access === "create_or_replay" && input.deliveryRecipientPublicKey65B64u !== persisted.preparation.deliveryRecipientPublicKey65B64u) return {
-				kind: "conflict",
-				message: "linked-device target preparation recipient conflicts with its durable replay"
-			};
-			return persisted.preparation;
-		}
+		if (persisted) return replayTargetPreparation(persisted.preparation, input);
 		if (input.session.state.state !== "awaiting_target_factor") throw new Error("linked-device target preparation is unavailable in this session state");
 		if (input.access === "replay_only") throw new Error("linked-device target preparation has not been created");
 		const preparation = parseLinkedDeviceTargetPreparationV1(await this.planner.createTargetPreparationV1(input));
@@ -146,11 +139,16 @@ var D1LinkedDeviceTargetCredentialProviderV1 = class {
            namespace, org_id, project_id, env_id, link_session_id,
            wallet_id, enrollment_id, device_id, state, target_factor,
            preparation_digest_b64u, preparation_json, prepared_at_ms, expires_at_ms
-         ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'prepared', ?, ?, ?, ?, ?)`).bind(...scopeValues(this.scope), String(preparation.linkSessionId), String(preparation.walletId), String(preparation.enrollmentId), String(preparation.deviceId), preparation.targetFactor.kind, preparationDigestB64u, JSON.stringify(preparation), preparation.issuedAtMs, preparation.expiresAtMs).run();
+         ) SELECT ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, 'prepared', ?9, ?10, ?11, ?12, ?13
+           FROM linked_device_sessions
+          WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+            AND link_session_id = ?5 AND state = 'awaiting_target_factor'`).bind(...scopeValues(this.scope), String(preparation.linkSessionId), String(preparation.walletId), String(preparation.enrollmentId), String(preparation.deviceId), preparation.targetFactor.kind, preparationDigestB64u, JSON.stringify(preparation), preparation.issuedAtMs, preparation.expiresAtMs).run();
 		const stored = await this.readV1(input.session.linkSessionId);
-		if (!stored) throw new Error("linked-device target preparation did not persist");
-		if (stored.preparationDigestB64u !== preparationDigestB64u) throw new Error("linked-device target preparation conflicts with its durable replay");
-		return stored.preparation;
+		if (!stored) return {
+			kind: "conflict",
+			message: "linked-device session no longer accepts target preparation"
+		};
+		return replayTargetPreparation(stored.preparation, input);
 	}
 	async registerTargetCredentialV1(input) {
 		try {
@@ -441,9 +439,12 @@ var D1LinkedDeviceTargetCredentialProviderV1 = class {
 		if (d1ChangedRows(await this.database.prepare(`INSERT OR IGNORE INTO ${TARGET_COMMIT_RESERVATION_TABLE} (
            namespace, org_id, project_id, env_id, link_session_id,
            registration_digest_b64u, state, reserved_at_ms
-         ) VALUES (?, ?, ?, ?, ?, ?, 'reserved', ?)`).bind(...scopeValues(this.scope), input.linkSessionId, input.registrationDigestB64u, input.nowMs).run()) === 1) return { outcome: "acquired" };
+         ) SELECT ?1, ?2, ?3, ?4, ?5, ?6, 'reserved', ?7
+           FROM linked_device_sessions
+          WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+            AND link_session_id = ?5 AND state = 'awaiting_target_factor'`).bind(...scopeValues(this.scope), input.linkSessionId, input.registrationDigestB64u, input.nowMs).run()) === 1) return { outcome: "acquired" };
 		const row = await this.readCommitReservationV1(input.linkSessionId);
-		if (!row) return await this.reserveCommitV1(input);
+		if (!row) throw new Error("linked-device session no longer accepts target credential registration");
 		if (row.registrationDigestB64u !== input.registrationDigestB64u) throw new Error("linked-device target credential conflicts with its durable commit reservation");
 		if (row.state === "committed") return {
 			outcome: "replayed",
@@ -560,6 +561,14 @@ async function assertRegistrationReplay(persisted, registration, keyManifestDige
 	if (!persisted.registration || persisted.registration.keyManifestDigestB64u !== keyManifestDigestB64u) throw new Error("linked-device target credential conflicts with its durable record");
 	await assertRegistrationValueReplay(persisted.registration.value, registration);
 }
+function replayTargetPreparation(preparation, input) {
+	assertPreparationMatchesSession(preparation, input.session, input.approval);
+	if (input.access === "create_or_replay" && input.deliveryRecipientPublicKey65B64u !== preparation.deliveryRecipientPublicKey65B64u) return {
+		kind: "conflict",
+		message: "linked-device target preparation recipient conflicts with its durable replay"
+	};
+	return preparation;
+}
 function assertPreparationMatchesSession(preparation, session, approval) {
 	const sourceSignerManifest = session.approvalTranscript?.sourceSignerManifest;
 	if (!sourceSignerManifest) throw new Error("linked-device verified source signer manifest is unavailable");

package/dist/esm/router/cloudflare/d1/deviceLinking/index.js

@@ -1,15 +1,15 @@
+import { D1LinkedDeviceSourceContributionPreparationPlannerV1, createD1LinkedDeviceSourceContributionPreparationPlannerV1, linkedDeviceX25519RecipientPublicKeyB64uV1 } from "./d1LinkedDeviceSourceContributionPreparationPlanner.js";
+import { D1LinkedDeviceAuthorityInstallServiceV1, parseInstalledEcdsaCustodySnapshotV1, readD1LinkedDeviceEcdsaSourceV1, readD1LinkedDeviceEd25519SourceV1 } from "./d1LinkedDeviceAuthorityInstallService.js";
 import { D1LinkedDeviceEd25519ExportRootStoreV1 } from "./d1LinkedDeviceEd25519ExportRootStore.js";
 import { D1LinkedDeviceRequestProofNonceStoreV1 } from "./d1LinkedDeviceRequestProofNonceStore.js";
 import { createD1LinkedDeviceSessionServiceV1 } from "./d1LinkedDeviceSessionService.js";
 import { parseD1LinkedDeviceSessionRowV1, parseD1LinkedDeviceSessionTranscriptRowV1 } from "./d1LinkedDeviceSessionRecords.js";
 import { D1LinkedDeviceSessionStoreV1, SESSION_CAS_GUARD_SQL } from "./d1LinkedDeviceSessionStore.js";
 import { createD1LinkedDeviceRouteServiceV1 } from "./d1LinkedDeviceRouteService.js";
-import { D1LinkedDeviceSourceContributionPreparationPlannerV1, createD1LinkedDeviceSourceContributionPreparationPlannerV1, linkedDeviceX25519RecipientPublicKeyB64uV1 } from "./d1LinkedDeviceSourceContributionPreparationPlanner.js";
-import { D1LinkedDeviceAuthorityInstallServiceV1, readD1LinkedDeviceEcdsaSourceV1, readD1LinkedDeviceEd25519SourceV1 } from "./d1LinkedDeviceAuthorityInstallService.js";
 import { LinkedDeviceSourceFamilyUnavailableErrorV1, createD1LinkedDeviceVerifiedLinkSourceReaderV1 } from "./d1LinkedDeviceVerifiedLinkSourceReader.js";
 import { buildVerifiedLinkInputV1, buildVerifiedTargetFactorV1, computeVerifiedTargetFactorVerificationDigestV1, linkedDeviceSignerManifestsEqualV1 } from "./d1LinkedDeviceVerifiedLinkBuilder.js";
 import { D1LinkedDeviceTargetCredentialProviderV1, LinkedDeviceRetiredTargetRegistrationShapeErrorV1, LinkedDeviceWebAuthnRegistrationVerifierV1 } from "./d1LinkedDeviceTargetCredentialProvider.js";
 import { D1LinkedDeviceTargetPlannerV1 } from "./d1LinkedDeviceTargetPlanner.js";
 import { createD1LinkedDeviceOwnerAuthorizationMetadataSourceV1, createD1LinkedDeviceOwnerAuthorizationProviderV1, createD1LinkedDeviceOwnerSourceChildReaderV1 } from "./d1LinkedDeviceOwnerAuthorizationProvider.js";
 import { D1LinkedDeviceTargetAuthenticatorStoreV1 } from "./d1LinkedDeviceTargetAuthenticatorStore.js";
-export { D1LinkedDeviceAuthorityInstallServiceV1, D1LinkedDeviceEd25519ExportRootStoreV1, D1LinkedDeviceRequestProofNonceStoreV1, D1LinkedDeviceSessionStoreV1, D1LinkedDeviceSourceContributionPreparationPlannerV1, D1LinkedDeviceTargetAuthenticatorStoreV1, D1LinkedDeviceTargetCredentialProviderV1, D1LinkedDeviceTargetPlannerV1, LinkedDeviceRetiredTargetRegistrationShapeErrorV1, LinkedDeviceSourceFamilyUnavailableErrorV1, LinkedDeviceWebAuthnRegistrationVerifierV1, SESSION_CAS_GUARD_SQL, buildVerifiedLinkInputV1, buildVerifiedTargetFactorV1, computeVerifiedTargetFactorVerificationDigestV1, createD1LinkedDeviceOwnerAuthorizationMetadataSourceV1, createD1LinkedDeviceOwnerAuthorizationProviderV1, createD1LinkedDeviceOwnerSourceChildReaderV1, createD1LinkedDeviceRouteServiceV1, createD1LinkedDeviceSessionServiceV1, createD1LinkedDeviceSourceContributionPreparationPlannerV1, createD1LinkedDeviceVerifiedLinkSourceReaderV1, linkedDeviceSignerManifestsEqualV1, linkedDeviceX25519RecipientPublicKeyB64uV1, parseD1LinkedDeviceSessionRowV1, parseD1LinkedDeviceSessionTranscriptRowV1, readD1LinkedDeviceEcdsaSourceV1, readD1LinkedDeviceEd25519SourceV1 };
+export { D1LinkedDeviceAuthorityInstallServiceV1, D1LinkedDeviceEd25519ExportRootStoreV1, D1LinkedDeviceRequestProofNonceStoreV1, D1LinkedDeviceSessionStoreV1, D1LinkedDeviceSourceContributionPreparationPlannerV1, D1LinkedDeviceTargetAuthenticatorStoreV1, D1LinkedDeviceTargetCredentialProviderV1, D1LinkedDeviceTargetPlannerV1, LinkedDeviceRetiredTargetRegistrationShapeErrorV1, LinkedDeviceSourceFamilyUnavailableErrorV1, LinkedDeviceWebAuthnRegistrationVerifierV1, SESSION_CAS_GUARD_SQL, buildVerifiedLinkInputV1, buildVerifiedTargetFactorV1, computeVerifiedTargetFactorVerificationDigestV1, createD1LinkedDeviceOwnerAuthorizationMetadataSourceV1, createD1LinkedDeviceOwnerAuthorizationProviderV1, createD1LinkedDeviceOwnerSourceChildReaderV1, createD1LinkedDeviceRouteServiceV1, createD1LinkedDeviceSessionServiceV1, createD1LinkedDeviceSourceContributionPreparationPlannerV1, createD1LinkedDeviceVerifiedLinkSourceReaderV1, linkedDeviceSignerManifestsEqualV1, linkedDeviceX25519RecipientPublicKeyB64uV1, parseD1LinkedDeviceSessionRowV1, parseD1LinkedDeviceSessionTranscriptRowV1, parseInstalledEcdsaCustodySnapshotV1, readD1LinkedDeviceEcdsaSourceV1, readD1LinkedDeviceEd25519SourceV1 };