@seams/wallet-server 0.7.3 → 0.8.0

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService.js

@@ -14,14 +14,15 @@ import { computeCommittedSignerPackageSetDigestB64u, parseCommittedAuthorityPack
 import { unknownWebAuthnAuthenticatorDeviceInfo } from "../../../../shared-ts/src/utils/webauthnDeviceInfo.js";
 import { assertLinkedDeviceWalletSessionCredentialDeliveryIntegrityV1, buildLinkedDeviceWalletSessionCredentialDeliveryBindingV1, computeLinkedDeviceActivationCleanupReceiptDigestB64u, computeLinkedDeviceWalletSessionCredentialDeliveryAadDigestB64u, computeLinkedDeviceWalletSessionCredentialEnvelopeDigestB64u, encodeLinkedDeviceWalletSessionCredentialDeliveryAadV1, parseLinkedDeviceActivationCleanupReceiptV1, parseLinkedDeviceWalletSessionCredentialDeliveryV1 } from "../../../../shared-ts/src/device-linking/walletSessionCredentialDelivery.js";
 import { parseLocalAuthorityActivationFinalAckV1 } from "../../../../shared-ts/src/device-linking/authorityActivation.js";
-import { computeWalletSessionInstallationReceiptDigestB64u, computeWalletSessionOperationCredentialDigestB64u } from "../../../../shared-ts/src/device-linking/digests.js";
+import { computeWalletSessionInstallationReceiptDigestB64u } from "../../../../shared-ts/src/device-linking/digests.js";
 import { computeLinkedDevicePublicKeyDigestV1 } from "../../../../shared-ts/src/device-linking/requestProof.js";
-import { buildPersistedActiveWalletSessionAuthorizationV2, walletSessionAuthorizationV2RecordsEqual } from "../../../../authorization/domain.js";
+import { walletSessionAuthorizationV2RecordsEqual } from "../../../../authorization/domain.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { EcdsaMaterialReadSnapshot } from "../../../../core/ecdsaMaterialReadSnapshot.js";
 import { parseD1JsonColumn } from "../../../../storage/d1Sql.js";
 import { parseWalletEcdsaSignerRows, prepareWalletEcdsaSignersRead } from "../../../../core/d1EcdsaSignerRead.js";
 import "../../../../core/deviceLinking/requestProof.js";
+import { reservePasskeyCredential } from "../../../../core/passkeyCredentialClaims.js";
 import { prepareD1WebAuthnCredentialBindingInsertStatement } from "../../../../core/WebAuthnCredentialBindingStore.js";
 import { prepareD1WebAuthnAuthenticatorInsertStatement } from "../webauthn/d1WebAuthnStore.js";
 import { findInstalledEcdsaAuthority, installedEcdsaAuthorityChain, projectInstalledEcdsaAuthority } from "./installedEcdsaAuthority.js";
@@ -257,6 +258,7 @@ var D1LinkedDeviceAuthorityInstallServiceV1 = class {
 			const activeAuthority = await buildActiveAuthority(authority, receipt.installedAtMs);
 			const activeAuthMethod = buildActiveAuthMethod(authMethod, receipt.installedAtMs);
 			const passkeyCredentialStatements = await buildPasskeyCredentialPromotionStatements({
+				credentialClaims: this.options.credentialClaims,
 				database: this.options.database,
 				scope: this.options.scope,
 				listWalletEd25519Signers: this.options.listWalletEd25519Signers,
@@ -279,17 +281,9 @@ var D1LinkedDeviceAuthorityInstallServiceV1 = class {
 				nowMs
 			});
 			const preparedWalletSession = await this.options.authorizationService.prepareWalletSessionAuthorizationV2(this.buildWalletSessionAuthorizationInput(activeAuthority, activeAuthMethod, receipt.installedAtMs));
-			const operationCredential = {
-				kind: "opaque_wallet_session_operation_credential_v1",
-				token: `wst_${secureRandomBase64Url(32, "linked-device Wallet Session operation credential")}`,
-				walletSessionId: preparedWalletSession.session.walletSessionId
-			};
-			const credentialDigestB64u = await computeWalletSessionOperationCredentialDigestB64u(operationCredential);
-			const walletSessionStatements = this.options.authorizationStore.prepareDirectWalletSessionAuthorizationV2Statements(buildPersistedActiveWalletSessionAuthorizationV2({
-				session: preparedWalletSession.session,
-				quota: preparedWalletSession.quota,
-				primaryOperationCredentialDigestB64u: credentialDigestB64u
-			}));
+			const { operationCredential, persisted } = await this.options.authorizationService.prepareDirectWalletSessionCredential(preparedWalletSession);
+			const credentialDigestB64u = persisted.primaryOperationCredentialDigestB64u;
+			const walletSessionStatements = this.options.authorizationStore.prepareDirectWalletSessionAuthorizationV2Statements(persisted);
 			const installationReceiptDigestB64u = await computeWalletSessionInstallationReceiptDigestB64u(receipt);
 			const sealedDelivery = await sealLinkedDeviceWalletSessionCredentialV1({
 				scope: this.options.scope,
@@ -1413,6 +1407,11 @@ function buildActiveAuthMethod(pending, activatedAtMs) {
 }
 async function buildPasskeyCredentialPromotionStatements(input) {
 	if (input.authMethod.kind !== "passkey") return [];
+	await reservePasskeyCredential(input.credentialClaims, {
+		walletId: input.authMethod.walletId,
+		rpId: input.authMethod.rpId,
+		credentialIdB64u: input.authMethod.credentialIdB64u
+	});
 	const signer = await resolveLinkedDeviceEd25519Signer({
 		authority: input.authority,
 		listWalletEd25519Signers: input.listWalletEd25519Signers

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEd25519ExportRootStore.js

@@ -13,7 +13,12 @@ var D1LinkedDeviceEd25519ExportRootStoreV1 = class {
            namespace, org_id, project_id, env_id, link_session_id,
            wallet_id, enrollment_id, device_id, state, transfer_alg,
            recipient_public_key_b64u, recipient_json, registered_at_ms
-         ) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, 'recipient_registered', ?9, ?10, ?11, ?12)`).bind(...scopeValues(this.scope), String(recipient.linkSessionId), String(recipient.walletId), String(recipient.enrollmentId), String(recipient.deviceId), "x25519-hkdf-sha256-chacha20poly1305-v1", String(recipient.recipientPublicKeyB64u), JSON.stringify(recipient), recipient.registeredAtMs).run()) === 1) return { outcome: "applied" };
+         ) SELECT ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, 'recipient_registered', ?9, ?10, ?11, ?12
+           FROM linked_device_sessions
+          WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+            AND link_session_id = ?5
+            AND state IN ('awaiting_target_factor', 'awaiting_source_contribution',
+                          'provisioning', 'authority_pending_local_install', 'active')`).bind(...scopeValues(this.scope), String(recipient.linkSessionId), String(recipient.walletId), String(recipient.enrollmentId), String(recipient.deviceId), "x25519-hkdf-sha256-chacha20poly1305-v1", String(recipient.recipientPublicKeyB64u), JSON.stringify(recipient), recipient.registeredAtMs).run()) === 1) return { outcome: "applied" };
 		const existing = await this.readRowV1(String(recipient.linkSessionId));
 		if (!existing) return {
 			outcome: "conflict",

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEmailOtpGrantStore.js

@@ -1,3 +1,4 @@
+import { d1ChangedRows } from "../../../../storage/d1Sql.js";
 import { SESSION_CAS_GUARD_SQL } from "./d1LinkedDeviceSessionStore.js";
 import { parseLinkedDeviceEmailOtpGrantRecordV1 } from "../../../../core/deviceLinking/linkedDeviceEmailOtpGrant.js";
 //#region src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEmailOtpGrantStore.ts
@@ -18,7 +19,7 @@ var D1LinkedDeviceEmailOtpGrantStoreV1 = class {
 	async issueV1(record) {
 		const parsed = parseLinkedDeviceEmailOtpGrantRecordV1(record);
 		if (parsed.state.kind !== "issued") throw new Error("a linked-device email OTP grant is only ever inserted as issued");
-		await this.database.prepare(`INSERT INTO ${GRANT_TABLE} (
+		if (d1ChangedRows(await this.database.prepare(`INSERT INTO ${GRANT_TABLE} (
            namespace, org_id, project_id, env_id, grant_id,
            grant_token_digest_b64u, wallet_id, link_session_id, enrollment_id,
            device_id, target_factor, target_preparation_digest_b64u,
@@ -27,7 +28,16 @@ var D1LinkedDeviceEmailOtpGrantStoreV1 = class {
            base_wallet_auth_method_id, linked_owner_auth_method_id,
            authority_digest_b64u, challenge_id, state, record_json,
            issued_at_ms, expires_at_ms, consumed_at_ms
-         ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'email_otp', ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'issued', ?, ?, ?, NULL)`).bind(...scopeValues(this.scope), parsed.grantId, parsed.grantTokenDigestB64u, String(parsed.walletId), String(parsed.linkSessionId), String(parsed.enrollmentId), String(parsed.deviceId), parsed.targetPreparationDigestB64u, parsed.targetEmail, parsed.enrollment.kind, parsed.emailHashHex, parsed.registrationAuthorityId, parsed.providerUserId, parsed.baseWalletAuthMethodId ?? null, String(parsed.walletAuthMethodId), parsed.authorityDigestB64u, parsed.challengeId, serializeGrantForD1(parsed), parsed.issuedAtMs, parsed.expiresAtMs).run();
+         ) SELECT ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, 'email_otp',
+                  ?11, ?12, ?13, ?14, ?15, ?16, ?17, ?18, ?19, ?20, 'issued', ?21, ?22, ?23, NULL
+             FROM linked_device_sessions
+            WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+              AND link_session_id = ?8 AND state = 'awaiting_target_factor'`).bind(...scopeValues(this.scope), parsed.grantId, parsed.grantTokenDigestB64u, String(parsed.walletId), String(parsed.linkSessionId), String(parsed.enrollmentId), String(parsed.deviceId), parsed.targetPreparationDigestB64u, parsed.targetEmail, parsed.enrollment.kind, parsed.emailHashHex, parsed.registrationAuthorityId, parsed.providerUserId, parsed.baseWalletAuthMethodId ?? null, String(parsed.walletAuthMethodId), parsed.authorityDigestB64u, parsed.challengeId, serializeGrantForD1(parsed), parsed.issuedAtMs, parsed.expiresAtMs).run()) === 1) return { kind: "issued" };
+		return {
+			kind: "refused",
+			code: "link_session_inactive",
+			message: "linked-device session no longer accepts Email OTP grants"
+		};
 	}
 	async readByIdV1(grantId) {
 		const row = await this.database.prepare(`SELECT json_set(

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEmailOtpTargetFactor.js

@@ -177,7 +177,8 @@ var D1LinkedDeviceEmailOtpTargetFactorV1 = class {
 			code: sealed.code,
 			message: sealed.message
 		};
-		await this.options.grants.issueV1(grantRecord);
+		const issued = await this.options.grants.issueV1(grantRecord);
+		if (issued.kind === "refused") return issued;
 		return {
 			kind: "verified",
 			grant: {
@@ -264,7 +265,8 @@ var D1LinkedDeviceEmailOtpTargetFactorV1 = class {
 			issuedAtMs,
 			expiresAtMs
 		});
-		await this.options.grants.issueV1(grantRecord);
+		const issued = await this.options.grants.issueV1(grantRecord);
+		if (issued.kind === "refused") return issued;
 		return {
 			kind: "verified",
 			grant: {
@@ -409,7 +411,6 @@ var D1LinkedDeviceEmailOtpTargetFactorV1 = class {
 				kind: "existing_enrollment",
 				resolved,
 				targetEmail,
-				enrollment: { kind: "existing_enrollment" },
 				targetPreparationDigestB64u,
 				walletAuthMethodId,
 				authorityDigestB64u: await computeLinkedDeviceEmailOtpAuthorityDigestV1({
@@ -448,7 +449,6 @@ var D1LinkedDeviceEmailOtpTargetFactorV1 = class {
 		return {
 			kind: "new_enrollment",
 			targetEmail,
-			enrollment: { kind: "new_enrollment" },
 			targetPreparationDigestB64u,
 			walletAuthMethodId,
 			authorityDigestB64u: await computeLinkedDeviceEmailOtpAuthorityDigestV1({

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceOwnerAuthorizationProvider.js

@@ -11,9 +11,9 @@ import { buildEmailOtpWalletAuthAuthority, buildPasskeyWalletAuthAuthority, wall
 import { walletAuthorityDigestsMatchV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { buildWalletSessionLinkedDeviceOwnerAuthorizationV1, parseQrLinkedDeviceSessionPayloadV5 } from "../../../../shared-ts/src/device-linking/parsers.js";
 import { computeLinkedDevicePublicKeyDigestV1 } from "../../../../shared-ts/src/device-linking/requestProof.js";
-import { thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
 import { resolveActiveOwnerWalletExecutionLane, resolveWalletAuthMethodIdForAuthority } from "../../../../core/signingLanes/WalletExecutionLaneProjection.js";
 import "../../../../core/deviceLinking/requestProof.js";
+import { thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
 import { sourceKeyManifestDigestForFamilyV1 } from "../../../../core/deviceLinking/linkedDeviceSessionRecord.js";
 import { LinkedDeviceSourceFamilyUnavailableErrorV1 } from "./d1LinkedDeviceVerifiedLinkSourceReader.js";
 import { linkedDeviceSignerManifestsEqualV1 } from "./d1LinkedDeviceVerifiedLinkBuilder.js";

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRequestProofNonceStore.js

@@ -1,7 +1,7 @@
 import { parseLinkDeviceSessionId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { requireCanonicalString } from "../../../../shared-ts/src/utils/validation.js";
+import { isObject, requireCanonicalString } from "../../../../shared-ts/src/utils/validation.js";
 import { d1ChangedRows } from "../../../../storage/d1Sql.js";
 //#region src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRequestProofNonceStore.ts
 const NONCE_TABLE = "linked_device_request_proof_nonces";
@@ -12,14 +12,7 @@ var D1LinkedDeviceRequestProofNonceStoreV1 = class {
 		this.scope = normalizeScope(options.scope);
 	}
 	async consumeRequestProofNonceV1(input) {
-		const normalized = parseNonceRecord({
-			linkSessionId: input.linkSessionId,
-			requestNonceB64u: input.requestNonceB64u,
-			proofDigestB64u: input.proofDigestB64u,
-			issuedAtMs: input.issuedAtMs,
-			expiresAtMs: input.expiresAtMs,
-			consumedAtMs: input.consumedAtMs
-		});
+		const normalized = parseNonceRecord(input);
 		await this.pruneExpiredNoncesV1(normalized.consumedAtMs);
 		try {
 			if (d1ChangedRows(await this.database.prepare(`INSERT INTO ${NONCE_TABLE} (
@@ -60,6 +53,7 @@ var D1LinkedDeviceRequestProofNonceStoreV1 = class {
 	}
 };
 function parseNonceRecord(raw) {
+	if (!isObject(raw)) throw new Error("Invalid device request nonce");
 	const linkSessionId = parseSessionId(raw.linkSessionId);
 	const requestNonceB64u = parseFixedB64u(raw.requestNonceB64u, "requestNonceB64u");
 	const proofDigestB64u = parseDigest(raw.proofDigestB64u, "proofDigestB64u");

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRouteService.js

@@ -8,12 +8,13 @@ import { D1LinkedDeviceSessionStoreV1 } from "./d1LinkedDeviceSessionStore.js";
 //#region src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRouteService.ts
 function createD1LinkedDeviceRouteServiceV1(options) {
 	const nowV1 = options.nowV1 ?? Date.now;
-	const proofVerifier = new LinkedDeviceRequestProofVerifierV1({ nonceStore: new D1LinkedDeviceRequestProofNonceStoreV1({
+	const proofVerifier = new LinkedDeviceRequestProofVerifierV1({ nonceStore: options.proofNonces ?? new D1LinkedDeviceRequestProofNonceStoreV1({
 		database: options.database,
 		scope: options.scope
 	}) });
 	const { sessionService } = createD1LinkedDeviceSessionServiceV1({
 		sessionStore: new D1LinkedDeviceSessionStoreV1({
+			bootstrap: options.bootstrap,
 			database: options.database,
 			scope: options.scope,
 			now: nowV1

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionStore.js

@@ -3,6 +3,7 @@ import { assertNeverLinkSessionStateV1 } from "../../../../shared-ts/src/device-
 import { parseLinkedDeviceApprovalV1, parseLinkedDeviceSessionClaimV1 } from "../../../../shared-ts/src/device-linking/parsers.js";
 import { computeLinkedDeviceApprovalDigestV1, computeLinkedDeviceSessionClaimDigestV1 } from "../../../../shared-ts/src/device-linking/digests.js";
 import { d1ChangedRows, queryD1All } from "../../../../storage/d1Sql.js";
+import { requireLinkedDeviceBootstrapRecord } from "../../../../core/deviceLinking/linkedDeviceBootstrap.js";
 import { LinkedDeviceRetiredSessionShapeErrorV1, approvalTranscriptMatchesDigest, claimTranscriptMatchesDigest, conflictResult, integrityResult, invalidStateResult, isPrecommitState, linkedDeviceEmailOtpChallengesEqualV1, linkedDeviceQrPayloadsEqualV1, parseLinkedDeviceSessionRecordV1, sessionExpiryMsV1, sourceContributionTranscriptMatchesDigest } from "../../../../core/deviceLinking/linkedDeviceSessionRecord.js";
 import { parseD1LinkedDeviceSessionRowV1, parseD1LinkedDeviceSessionTranscriptRowV1 } from "./d1LinkedDeviceSessionRecords.js";
 //#region src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionStore.ts
@@ -29,21 +30,33 @@ const PRECOMMIT_STATES = [
 ];
 var D1LinkedDeviceSessionStoreV1 = class {
 	constructor(options) {
+		this.bootstrap = options.bootstrap;
 		this.database = options.database;
 		this.scope = normalizeScope(options.scope);
 	}
 	async createUnclaimedSessionV1(record) {
 		const normalized = parseLinkedDeviceSessionRecordV1(record);
 		if (normalized.state.state !== "displaying_qr" || normalized.revision !== 1) return invalidStateResult(normalized);
+		if (this.bootstrap) {
+			const existing = requireLinkedDeviceBootstrapRecord(await this.bootstrap.create(normalized));
+			if (!existing) throw new Error("Bootstrap creation returned no session");
+			if (!linkedDeviceQrPayloadsEqualV1(existing.qrPayload, normalized.qrPayload)) return conflictResult(1, existing);
+			if (existing.state.state === "claimed") {
+				const current = await this.getSessionV1(normalized.linkSessionId);
+				if (!current) return conflictResult(1, null);
+				return {
+					outcome: "replayed",
+					record: current
+				};
+			}
+			return {
+				outcome: "applied",
+				record: existing
+			};
+		}
 		let insertError;
 		try {
-			if (d1ChangedRows(await this.database.prepare(`INSERT INTO ${SESSION_TABLE} (
-             namespace, org_id, project_id, env_id, link_session_id,
-             link_public_key_b64u, device_public_key_b64u, state, record_json,
-             revision, expires_at_ms, claim_expires_at_ms, claim_digest_b64u,
-             approval_digest_b64u, authority_id, package_set_digest_b64u,
-             created_at_ms, updated_at_ms
-           ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).bind(...scopeValues(this.scope), ...sessionColumnValues(normalized)).run()) === 1) return {
+			if (d1ChangedRows(await this.sessionInsertStatement(normalized).run()) === 1) return {
 				outcome: "applied",
 				record: normalized
 			};
@@ -62,6 +75,44 @@ var D1LinkedDeviceSessionStoreV1 = class {
 		return conflictResult(1, existing);
 	}
 	async getSessionV1(linkSessionId) {
+		const local = await this.readLocalSession(linkSessionId);
+		if (local || !this.bootstrap) return local;
+		if (await this.database.prepare(`SELECT 1 AS imported FROM linked_device_bootstrap_imports
+      WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ? AND link_session_id = ?`).bind(...scopeValues(this.scope), String(linkSessionId)).first()) return null;
+		const record = requireLinkedDeviceBootstrapRecord(await this.bootstrap.read(linkSessionId));
+		if (!record || record.state.state !== "claimed") return record;
+		return this.importClaimedSession(record);
+	}
+	sessionInsertStatement(normalized) {
+		return this.database.prepare(`INSERT INTO ${SESSION_TABLE} (
+             namespace, org_id, project_id, env_id, link_session_id,
+             link_public_key_b64u, device_public_key_b64u, state, record_json,
+             revision, expires_at_ms, claim_expires_at_ms, claim_digest_b64u,
+             approval_digest_b64u, authority_id, package_set_digest_b64u,
+             created_at_ms, updated_at_ms
+           ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).bind(...scopeValues(this.scope), ...sessionColumnValues(normalized));
+	}
+	async importClaimedSession(record) {
+		if (record.state.state !== "claimed" || !record.claimTranscript || record.revision !== 2) throw new Error("Invalid bootstrap claim");
+		const transcript = record.claimTranscript;
+		if (await computeLinkedDeviceSessionClaimDigestV1(transcript.value) !== transcript.digestB64u) throw new Error("Invalid bootstrap claim digest");
+		try {
+			await this.database.batch([
+				this.sessionInsertStatement(record),
+				this.database.prepare(`INSERT INTO linked_device_session_transcripts
+          (namespace, org_id, project_id, env_id, link_session_id, transcript_kind, digest_b64u, transcript_json, created_at_ms)
+          VALUES (?, ?, ?, ?, ?, 'claim', ?, ?, ?)`).bind(...scopeValues(this.scope), record.linkSessionId, transcript.digestB64u, JSON.stringify(transcript.value), record.updatedAtMs),
+				this.database.prepare(`INSERT INTO linked_device_bootstrap_imports
+          (namespace, org_id, project_id, env_id, link_session_id) VALUES (?, ?, ?, ?, ?)`).bind(...scopeValues(this.scope), record.linkSessionId)
+			]);
+		} catch (error) {
+			const raced = await this.readLocalSession(record.linkSessionId);
+			if (raced && claimTranscriptMatchesDigest(raced, transcript.digestB64u)) return raced;
+			throw Object.assign(new Error("Linked-device claim import is unavailable", { cause: error }), { code: "home_unavailable" });
+		}
+		return record;
+	}
+	async readLocalSession(linkSessionId) {
 		const row = await this.database.prepare(`SELECT link_session_id, link_public_key_b64u, device_public_key_b64u,
                 state, record_json, revision, expires_at_ms, claim_expires_at_ms,
                 claim_digest_b64u, approval_digest_b64u, authority_id,
@@ -157,6 +208,21 @@ var D1LinkedDeviceSessionStoreV1 = class {
 		};
 	}
 	async claimSessionV1(input) {
+		if (this.bootstrap) {
+			const selected = requireLinkedDeviceBootstrapRecord(await this.bootstrap.claim(input.nextRecord));
+			if (selected?.state.state !== "claimed" || !selected.claimTranscript) throw Object.assign(/* @__PURE__ */ new Error("Bootstrap claim returned invalid state"), { code: "home_unavailable" });
+			const current = await this.readLocalSession(input.linkSessionId);
+			if (current) return claimTranscriptMatchesDigest(current, selected.claimTranscript.digestB64u) ? {
+				outcome: "replayed",
+				record: current
+			} : conflictResult(input.expectedRevision, current);
+			const imported = await this.getSessionV1(input.linkSessionId);
+			if (!imported) return conflictResult(input.expectedRevision, null);
+			return {
+				outcome: "applied",
+				record: imported
+			};
+		}
 		const current = await this.getSessionV1(input.linkSessionId);
 		if (!current) return conflictResult(input.expectedRevision, null);
 		if (claimTranscriptMatchesDigest(current, input.claimDigestB64u)) return {
@@ -293,6 +359,14 @@ var D1LinkedDeviceSessionStoreV1 = class {
 		});
 	}
 	async cancelSessionV1(input) {
+		if (this.bootstrap && !await this.readLocalSession(input.linkSessionId)) {
+			const record = requireLinkedDeviceBootstrapRecord(await this.bootstrap.finish(input.nextRecord));
+			if (!record) return conflictResult(input.expectedRevision, null);
+			return {
+				outcome: "applied",
+				record
+			};
+		}
 		return this.applyTerminalStateCas({
 			...sessionMutationFieldsV1(input),
 			expectedStates: PRECOMMIT_STATES,
@@ -301,6 +375,14 @@ var D1LinkedDeviceSessionStoreV1 = class {
 		});
 	}
 	async expireSessionV1(input) {
+		if (this.bootstrap && !await this.readLocalSession(input.linkSessionId)) {
+			const record = requireLinkedDeviceBootstrapRecord(await this.bootstrap.finish(input.nextRecord));
+			if (!record) return conflictResult(input.expectedRevision, null);
+			return {
+				outcome: "applied",
+				record
+			};
+		}
 		const current = await this.getSessionV1(input.linkSessionId);
 		if (!current) return conflictResult(input.expectedRevision, null);
 		if (current.state.state === "expired") return {

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetCredentialProvider.js

@@ -128,14 +128,7 @@ var D1LinkedDeviceTargetCredentialProviderV1 = class {
 	}
 	async getTargetPreparationV1(input) {
 		const persisted = await this.readV1(input.session.linkSessionId);
-		if (persisted) {
-			assertPreparationMatchesSession(persisted.preparation, input.session, input.approval);
-			if (input.access === "create_or_replay" && input.deliveryRecipientPublicKey65B64u !== persisted.preparation.deliveryRecipientPublicKey65B64u) return {
-				kind: "conflict",
-				message: "linked-device target preparation recipient conflicts with its durable replay"
-			};
-			return persisted.preparation;
-		}
+		if (persisted) return replayTargetPreparation(persisted.preparation, input);
 		if (input.session.state.state !== "awaiting_target_factor") throw new Error("linked-device target preparation is unavailable in this session state");
 		if (input.access === "replay_only") throw new Error("linked-device target preparation has not been created");
 		const preparation = parseLinkedDeviceTargetPreparationV1(await this.planner.createTargetPreparationV1(input));
@@ -146,11 +139,16 @@ var D1LinkedDeviceTargetCredentialProviderV1 = class {
            namespace, org_id, project_id, env_id, link_session_id,
            wallet_id, enrollment_id, device_id, state, target_factor,
            preparation_digest_b64u, preparation_json, prepared_at_ms, expires_at_ms
-         ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'prepared', ?, ?, ?, ?, ?)`).bind(...scopeValues(this.scope), String(preparation.linkSessionId), String(preparation.walletId), String(preparation.enrollmentId), String(preparation.deviceId), preparation.targetFactor.kind, preparationDigestB64u, JSON.stringify(preparation), preparation.issuedAtMs, preparation.expiresAtMs).run();
+         ) SELECT ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, 'prepared', ?9, ?10, ?11, ?12, ?13
+           FROM linked_device_sessions
+          WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+            AND link_session_id = ?5 AND state = 'awaiting_target_factor'`).bind(...scopeValues(this.scope), String(preparation.linkSessionId), String(preparation.walletId), String(preparation.enrollmentId), String(preparation.deviceId), preparation.targetFactor.kind, preparationDigestB64u, JSON.stringify(preparation), preparation.issuedAtMs, preparation.expiresAtMs).run();
 		const stored = await this.readV1(input.session.linkSessionId);
-		if (!stored) throw new Error("linked-device target preparation did not persist");
-		if (stored.preparationDigestB64u !== preparationDigestB64u) throw new Error("linked-device target preparation conflicts with its durable replay");
-		return stored.preparation;
+		if (!stored) return {
+			kind: "conflict",
+			message: "linked-device session no longer accepts target preparation"
+		};
+		return replayTargetPreparation(stored.preparation, input);
 	}
 	async registerTargetCredentialV1(input) {
 		try {
@@ -441,9 +439,12 @@ var D1LinkedDeviceTargetCredentialProviderV1 = class {
 		if (d1ChangedRows(await this.database.prepare(`INSERT OR IGNORE INTO ${TARGET_COMMIT_RESERVATION_TABLE} (
            namespace, org_id, project_id, env_id, link_session_id,
            registration_digest_b64u, state, reserved_at_ms
-         ) VALUES (?, ?, ?, ?, ?, ?, 'reserved', ?)`).bind(...scopeValues(this.scope), input.linkSessionId, input.registrationDigestB64u, input.nowMs).run()) === 1) return { outcome: "acquired" };
+         ) SELECT ?1, ?2, ?3, ?4, ?5, ?6, 'reserved', ?7
+           FROM linked_device_sessions
+          WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+            AND link_session_id = ?5 AND state = 'awaiting_target_factor'`).bind(...scopeValues(this.scope), input.linkSessionId, input.registrationDigestB64u, input.nowMs).run()) === 1) return { outcome: "acquired" };
 		const row = await this.readCommitReservationV1(input.linkSessionId);
-		if (!row) return await this.reserveCommitV1(input);
+		if (!row) throw new Error("linked-device session no longer accepts target credential registration");
 		if (row.registrationDigestB64u !== input.registrationDigestB64u) throw new Error("linked-device target credential conflicts with its durable commit reservation");
 		if (row.state === "committed") return {
 			outcome: "replayed",
@@ -560,6 +561,14 @@ async function assertRegistrationReplay(persisted, registration, keyManifestDige
 	if (!persisted.registration || persisted.registration.keyManifestDigestB64u !== keyManifestDigestB64u) throw new Error("linked-device target credential conflicts with its durable record");
 	await assertRegistrationValueReplay(persisted.registration.value, registration);
 }
+function replayTargetPreparation(preparation, input) {
+	assertPreparationMatchesSession(preparation, input.session, input.approval);
+	if (input.access === "create_or_replay" && input.deliveryRecipientPublicKey65B64u !== preparation.deliveryRecipientPublicKey65B64u) return {
+		kind: "conflict",
+		message: "linked-device target preparation recipient conflicts with its durable replay"
+	};
+	return preparation;
+}
 function assertPreparationMatchesSession(preparation, session, approval) {
 	const sourceSignerManifest = session.approvalTranscript?.sourceSignerManifest;
 	if (!sourceSignerManifest) throw new Error("linked-device verified source signer manifest is unavailable");

package/dist/esm/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoCapabilityPersistence.js

@@ -13,6 +13,7 @@ const CAPABILITY_REPLACEMENT_SCHEMA_SQL = `
     org_id TEXT NOT NULL,
     project_id TEXT NOT NULL,
     env_id TEXT NOT NULL,
+    wallet_id TEXT NOT NULL CHECK (length(wallet_id) > 0),
     operation_id TEXT NOT NULL,
     operation_fingerprint TEXT NOT NULL,
     previous_capability_binding_json TEXT NOT NULL,
@@ -76,6 +77,10 @@ var CloudflareD1RouterAbEd25519YaoCapabilityPersistence = class {
 	async prepareActiveCapabilityReplacement(input) {
 		const operation = validateReplacementOperation(input.operation);
 		if (!operation.ok) return operation.failure;
+		const application = activeCapabilityApplication(input.next);
+		const walletId = parseWalletId(application.wallet_id);
+		if (!walletId.ok) return persistenceFailure("invalid_wallet", "promoted Yao capability wallet ID is invalid");
+		if (activeCapabilityApplication(input.previous).wallet_id !== walletId.value) return persistenceFailure("identity_mismatch", "capability replacement crosses wallet ownership");
 		await this.ensureSchema();
 		const receiptMatch = matchReceipt(await this.readReceipt(operation.value.operationId), operation.value, input);
 		if (receiptMatch === "match") return {
@@ -83,9 +88,6 @@ var CloudflareD1RouterAbEd25519YaoCapabilityPersistence = class {
 			disposition: "exact_retry"
 		};
 		if (receiptMatch === "conflict") return persistenceFailure("operation_conflict", "capability replacement operation belongs to a different activation");
-		const application = activeCapabilityApplication(input.next);
-		const walletId = parseWalletId(application.wallet_id);
-		if (!walletId.ok) return persistenceFailure("invalid_wallet", "promoted Yao capability wallet ID is invalid");
 		const signer = await this.walletStore.getEd25519SignerBySlot({
 			walletId: walletId.value,
 			signerSlot: application.key_creation_signer_slot
@@ -127,13 +129,14 @@ var CloudflareD1RouterAbEd25519YaoCapabilityPersistence = class {
             org_id,
             project_id,
             env_id,
+            wallet_id,
             operation_id,
             operation_fingerprint,
             previous_capability_binding_json,
             next_capability_binding_json,
             created_at_ms
           )
-          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, operation.value.operationId, operation.value.operationFingerprint, previousBindingJson, nextBindingJson, now));
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, walletId.value, operation.value.operationId, operation.value.operationFingerprint, previousBindingJson, nextBindingJson, now));
 		for (const authorityReplacement of authorityReplacements) {
 			statements.push(this.prepareAuthorityReplacementStatement(authorityReplacement));
 			statements.push(this.database.prepare(D1_BATCH_CAS_GUARD_SQL));
@@ -243,7 +246,7 @@ var CloudflareD1RouterAbEd25519YaoCapabilityPersistence = class {
             AND retired_at_ms IS NULL`).bind(String(next.authorityDigestB64u), JSON.stringify(next.capabilitySubjects), JSON.stringify(next), this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, String(next.authorizationId), String(next.authorityId), String(input.previous.authorityDigestB64u), input.previous.authorityRevocationEpoch);
 	}
 	async readReceipt(operationId) {
-		return await this.database.prepare(`SELECT operation_fingerprint,
+		return await this.database.prepare(`SELECT wallet_id, operation_fingerprint,
                 previous_capability_binding_json,
                 next_capability_binding_json
            FROM ${ROUTER_AB_ED25519_YAO_CAPABILITY_REPLACEMENT_TABLE_V1}
@@ -274,7 +277,7 @@ function validateReplacementOperation(operation) {
 }
 function matchReceipt(receipt, operation, input) {
 	if (!receipt) return "missing";
-	return receipt.operation_fingerprint === operation.operationFingerprint && receipt.previous_capability_binding_json === JSON.stringify(input.previous.activeCapabilityBinding) && receipt.next_capability_binding_json === JSON.stringify(input.next.activeCapabilityBinding) ? "match" : "conflict";
+	return receipt.wallet_id === activeCapabilityApplication(input.next).wallet_id && receipt.operation_fingerprint === operation.operationFingerprint && receipt.previous_capability_binding_json === JSON.stringify(input.previous.activeCapabilityBinding) && receipt.next_capability_binding_json === JSON.stringify(input.next.activeCapabilityBinding) ? "match" : "conflict";
 }
 //#endregion
 export { CloudflareD1RouterAbEd25519YaoCapabilityPersistence, ROUTER_AB_ED25519_YAO_CAPABILITY_REPLACEMENT_TABLE_V1 };

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeIssuer.js

@@ -1,5 +1,4 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS } from "../../../../shared-ts/src/utils/emailOtpDomain.js";

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeService.js

@@ -1,5 +1,4 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeStore.js

@@ -1,7 +1,7 @@
 import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
 import { parseD1NonNegativeCount } from "../auth/d1RouterApiAuthBoundary.js";
-import { emailOtpChallengeRows, emailOtpUnlockChallengeRows } from "../../../../core/emailOtpD1Statements.js";
 import { emailOtpChallengeContextValues, emailOtpChallengeWithAttemptCount, parseEmailOtpChallengeRow, parseEmailOtpRegistrationVerificationReceiptV1, parseEmailOtpUnlockChallengeRow } from "./d1EmailOtpRecords.js";
+import { emailOtpChallengeRows, emailOtpUnlockChallengeRows } from "../../../../core/emailOtpD1Statements.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeStore.ts
 const REGISTRATION_VERIFICATION_RECEIPT_SCOPE = "email-otp-registration-verification-v1";
 const REGISTRATION_CEREMONY_CAS_GUARD_SQL = `INSERT INTO registration_ceremony_cas_guard (guard_id)

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeVerifier.js

@@ -2,7 +2,6 @@ import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import "../../../../shared-ts/src/utils/encoders.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_REGISTRATION_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { emailOtpChallengeBindingMismatchCode, emailOtpChallengeInvalidOrExpired, emailOtpRegistrationChallengeBindingMismatchCode } from "./d1EmailOtpRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeVerifier.ts

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpEnrollmentStore.js

@@ -1,5 +1,5 @@
-import { emailOtpAuthStateRows, emailOtpWalletEnrollmentRows } from "../../../../core/emailOtpD1Statements.js";
 import { emailOtpAuthStateRecord, parseEmailOtpAuthStateRow, parseEmailOtpWalletEnrollmentRow } from "./d1EmailOtpRecords.js";
+import { emailOtpAuthStateRows, emailOtpWalletEnrollmentRows } from "../../../../core/emailOtpD1Statements.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpEnrollmentStore.ts
 var CloudflareD1EmailOtpEnrollmentStore = class {
 	constructor(input) {

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpGrantStore.js

@@ -1,5 +1,5 @@
-import { emailOtpGrantRows } from "../../../../core/emailOtpD1Statements.js";
 import { parseEmailOtpGrantRow } from "./d1EmailOtpRecords.js";
+import { emailOtpGrantRows } from "../../../../core/emailOtpD1Statements.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpGrantStore.ts
 var CloudflareD1EmailOtpGrantStore = class {
 	constructor(input) {
@@ -11,12 +11,6 @@ var CloudflareD1EmailOtpGrantStore = class {
 	async consume(grantToken) {
 		return parseEmailOtpGrantRow(await emailOtpGrantRows.consume(this.prepare, grantToken).first());
 	}
-	async read(grantToken) {
-		return parseEmailOtpGrantRow(await emailOtpGrantRows.select(this.prepare, grantToken).first());
-	}
-	async delete(grantToken) {
-		await emailOtpGrantRows.delete(this.prepare, grantToken).run();
-	}
 };
 //#endregion
 export { CloudflareD1EmailOtpGrantStore };

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRateLimitStore.js

@@ -2,8 +2,8 @@ import { emailOtpRateLimitExceeded, emailOtpRateLimitKeys } from "./d1EmailOtpRe
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpRateLimitStore.ts
 var CloudflareD1EmailOtpRateLimitStore = class {
 	constructor(input) {
-		this.prepare = input.prepare;
 		this.rateLimits = input.rateLimits;
+		this.counter = input.counter ?? new D1EmailOtpRateLimitCounter(input.prepare);
 	}
 	async consume(input) {
 		const policy = this.rateLimits[input.scope];
@@ -12,17 +12,23 @@ var CloudflareD1EmailOtpRateLimitStore = class {
 			policy
 		});
 		for (const key of keys) {
-			const consumed = await this.consumeKey({
+			const consumed = await this.counter.consume({
 				key,
-				policy,
-				nowMs: Date.now()
+				limit: policy.limit,
+				windowMs: policy.windowMs
 			});
 			if (!consumed.ok) return consumed;
 		}
 		return { ok: true };
 	}
-	async consumeKey(input) {
-		const resetAtMs = input.nowMs + input.policy.windowMs;
+};
+var D1EmailOtpRateLimitCounter = class {
+	constructor(prepare) {
+		this.prepare = prepare;
+	}
+	async consume(input) {
+		const nowMs = Date.now();
+		const resetAtMs = nowMs + input.windowMs;
 		if (await this.prepare(`INSERT INTO email_otp_rate_limits (
         namespace,
         org_id,
@@ -52,13 +58,13 @@ var CloudflareD1EmailOtpRateLimitStore = class {
       RETURNING consumed_count, reset_at_ms`, [
 			input.key,
 			resetAtMs,
-			input.nowMs,
-			input.nowMs,
-			input.nowMs,
+			nowMs,
+			nowMs,
+			nowMs,
 			resetAtMs,
-			input.nowMs,
-			input.nowMs,
-			input.policy.limit
+			nowMs,
+			nowMs,
+			input.limit
 		]).first()) return { ok: true };
 		return emailOtpRateLimitExceeded(await this.prepare(`SELECT consumed_count, reset_at_ms
          FROM email_otp_rate_limits
@@ -71,6 +77,6 @@ var CloudflareD1EmailOtpRateLimitStore = class {
 	}
 };
 //#endregion
-export { CloudflareD1EmailOtpRateLimitStore };
+export { CloudflareD1EmailOtpRateLimitStore, D1EmailOtpRateLimitCounter };
 
 //# sourceMappingURL=d1EmailOtpRateLimitStore.js.map

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRecords.js

@@ -1,7 +1,6 @@
 import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
 import "../../../../shared-ts/src/utils/encoders.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { hasExactKeys } from "../../../../shared-ts/src/utils/exactKeys.js";
 import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION, isWalletEmailOtpLoginOperation } from "../../../../shared-ts/src/utils/emailOtpDomain.js";