@seams/wallet-server 0.7.3 → 0.9.0

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService.js

@@ -1,10 +1,10 @@
 import { mpcMaterialActivationRefsEqual, parseLinkDeviceSessionId, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWalletKeyId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseDeviceId, parsePrincipalId, parseTenantId, parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
+import { buildDelegatedWalletAuthorityV1, parseDelegatedWalletPermissionSetV1, validateDelegatedWalletAuthorityAttenuationV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
-import { buildDelegatedWalletAuthorityV1, parseDelegatedWalletPermissionSetV1, validateDelegatedWalletAuthorityAttenuationV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { routerAbMpcMaterialActivationRefFromWire, routerAbMpcMaterialActivationRefToWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseRouterAbEd25519YaoApplicationBindingFactsV1, parseRouterAbEd25519YaoCeremonyBindingV1, sameRouterAbEd25519YaoActivationBindingV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { assertLinkedDeviceOrdinaryMaterialSourceContributionMatchesContextV1, parseLinkedDeviceEcdsaSourceContributionPackageV1, parseLinkedDeviceEcdsaSourceDerivationV1, parseLinkedDeviceOrdinaryMaterialSourceContributionV1 } from "../../../../shared-ts/src/device-linking/sourceContribution.js";
@@ -14,16 +14,18 @@ import { computeCommittedSignerPackageSetDigestB64u, parseCommittedAuthorityPack
 import { unknownWebAuthnAuthenticatorDeviceInfo } from "../../../../shared-ts/src/utils/webauthnDeviceInfo.js";
 import { assertLinkedDeviceWalletSessionCredentialDeliveryIntegrityV1, buildLinkedDeviceWalletSessionCredentialDeliveryBindingV1, computeLinkedDeviceActivationCleanupReceiptDigestB64u, computeLinkedDeviceWalletSessionCredentialDeliveryAadDigestB64u, computeLinkedDeviceWalletSessionCredentialEnvelopeDigestB64u, encodeLinkedDeviceWalletSessionCredentialDeliveryAadV1, parseLinkedDeviceActivationCleanupReceiptV1, parseLinkedDeviceWalletSessionCredentialDeliveryV1 } from "../../../../shared-ts/src/device-linking/walletSessionCredentialDelivery.js";
 import { parseLocalAuthorityActivationFinalAckV1 } from "../../../../shared-ts/src/device-linking/authorityActivation.js";
-import { computeWalletSessionInstallationReceiptDigestB64u, computeWalletSessionOperationCredentialDigestB64u } from "../../../../shared-ts/src/device-linking/digests.js";
+import { computeWalletSessionInstallationReceiptDigestB64u } from "../../../../shared-ts/src/device-linking/digests.js";
 import { computeLinkedDevicePublicKeyDigestV1 } from "../../../../shared-ts/src/device-linking/requestProof.js";
-import { buildPersistedActiveWalletSessionAuthorizationV2, walletSessionAuthorizationV2RecordsEqual } from "../../../../authorization/domain.js";
+import { walletSessionAuthorizationV2RecordsEqual } from "../../../../authorization/domain.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { EcdsaMaterialReadSnapshot } from "../../../../core/ecdsaMaterialReadSnapshot.js";
 import { parseD1JsonColumn } from "../../../../storage/d1Sql.js";
 import { parseWalletEcdsaSignerRows, prepareWalletEcdsaSignersRead } from "../../../../core/d1EcdsaSignerRead.js";
 import "../../../../core/deviceLinking/requestProof.js";
+import { reservePasskeyCredential } from "../../../../core/passkeyCredentialClaims.js";
 import { prepareD1WebAuthnCredentialBindingInsertStatement } from "../../../../core/WebAuthnCredentialBindingStore.js";
 import { prepareD1WebAuthnAuthenticatorInsertStatement } from "../webauthn/d1WebAuthnStore.js";
+import { admitD1EstablishedWalletHome } from "../registration/d1WalletExecutionAuthority.js";
 import { findInstalledEcdsaAuthority, installedEcdsaAuthorityChain, projectInstalledEcdsaAuthority } from "./installedEcdsaAuthority.js";
 import { buildAuthorityActiveSessionRecordV1, buildAuthorityPendingLocalInstallSessionRecordV1 } from "../../../../core/deviceLinking/linkedDeviceSessionRecord.js";
 import { linkedDeviceX25519RecipientPublicKeyB64uV1 } from "./d1LinkedDeviceSourceContributionPreparationPlanner.js";
@@ -257,6 +259,7 @@ var D1LinkedDeviceAuthorityInstallServiceV1 = class {
 			const activeAuthority = await buildActiveAuthority(authority, receipt.installedAtMs);
 			const activeAuthMethod = buildActiveAuthMethod(authMethod, receipt.installedAtMs);
 			const passkeyCredentialStatements = await buildPasskeyCredentialPromotionStatements({
+				credentialClaims: this.options.credentialClaims,
 				database: this.options.database,
 				scope: this.options.scope,
 				listWalletEd25519Signers: this.options.listWalletEd25519Signers,
@@ -279,17 +282,9 @@ var D1LinkedDeviceAuthorityInstallServiceV1 = class {
 				nowMs
 			});
 			const preparedWalletSession = await this.options.authorizationService.prepareWalletSessionAuthorizationV2(this.buildWalletSessionAuthorizationInput(activeAuthority, activeAuthMethod, receipt.installedAtMs));
-			const operationCredential = {
-				kind: "opaque_wallet_session_operation_credential_v1",
-				token: `wst_${secureRandomBase64Url(32, "linked-device Wallet Session operation credential")}`,
-				walletSessionId: preparedWalletSession.session.walletSessionId
-			};
-			const credentialDigestB64u = await computeWalletSessionOperationCredentialDigestB64u(operationCredential);
-			const walletSessionStatements = this.options.authorizationStore.prepareDirectWalletSessionAuthorizationV2Statements(buildPersistedActiveWalletSessionAuthorizationV2({
-				session: preparedWalletSession.session,
-				quota: preparedWalletSession.quota,
-				primaryOperationCredentialDigestB64u: credentialDigestB64u
-			}));
+			const { operationCredential, persisted } = await this.options.authorizationService.prepareDirectWalletSessionCredential(preparedWalletSession);
+			const credentialDigestB64u = persisted.primaryOperationCredentialDigestB64u;
+			const walletSessionStatements = this.options.authorizationStore.prepareDirectWalletSessionAuthorizationV2Statements(persisted);
 			const installationReceiptDigestB64u = await computeWalletSessionInstallationReceiptDigestB64u(receipt);
 			const sealedDelivery = await sealLinkedDeviceWalletSessionCredentialV1({
 				scope: this.options.scope,
@@ -744,6 +739,9 @@ var D1LinkedDeviceAuthorityInstallServiceV1 = class {
 	}
 	async reserveSignerMaterial(input, sourceContributionPreparation) {
 		assertRecipientRequestsMatchManifest(input);
+		const admitted = await admitD1EstablishedWalletHome(this.options.database, this.options.scope, { walletId: input.walletId });
+		if (!admitted.ok) throw new Error(admitted.message);
+		const ownershipGeneration = admitted.ownershipGeneration;
 		let ed25519;
 		let ecdsa;
 		let ed25519Preparation;
@@ -783,6 +781,7 @@ var D1LinkedDeviceAuthorityInstallServiceV1 = class {
 				assertPreparationActivationMatches(targetMaterialActivation, workerPreparation.sourceContribution.targetMaterialActivation);
 				const reservation = await this.options.reservationService.reserveOrdinaryInactiveSignerMaterialV1({
 					kind: "ordinary_ed25519_signer_material_reservation_request_v1",
+					ownershipGeneration,
 					keyFamily: "ed25519",
 					signer,
 					plannedActivationRef: targetMaterialActivation,
@@ -798,6 +797,7 @@ var D1LinkedDeviceAuthorityInstallServiceV1 = class {
 			assertPreparationActivationMatches(targetMaterialActivation, workerPreparation.sourceContribution.binding.target.activation);
 			const reservation = await this.options.reservationService.reserveOrdinaryInactiveSignerMaterialV1({
 				kind: "ordinary_ecdsa_signer_material_reservation_request_v1",
+				ownershipGeneration,
 				keyFamily: "ecdsa_secp256k1",
 				signer,
 				plannedActivationRef: targetMaterialActivation,
@@ -820,10 +820,12 @@ var D1LinkedDeviceAuthorityInstallServiceV1 = class {
 				ordinarySignerMaterialPreparations: sourceContributionPreparation,
 				serverReservationIds: {
 					ed25519: {
+						ownershipGeneration,
 						reservationId: ed25519.serverMaterial.reservationId,
 						preparation: ed25519Preparation
 					},
 					ecdsa_secp256k1: {
+						ownershipGeneration,
 						reservationId: ecdsa.serverMaterial.reservationId,
 						preparation: ecdsaPreparation
 					}
@@ -840,6 +842,7 @@ var D1LinkedDeviceAuthorityInstallServiceV1 = class {
 				},
 				ordinarySignerMaterialPreparations: sourceContributionPreparation,
 				serverReservationIds: { ed25519: {
+					ownershipGeneration,
 					reservationId: ed25519.serverMaterial.reservationId,
 					preparation: ed25519Preparation
 				} }
@@ -855,6 +858,7 @@ var D1LinkedDeviceAuthorityInstallServiceV1 = class {
 			},
 			ordinarySignerMaterialPreparations: sourceContributionPreparation,
 			serverReservationIds: { ecdsa_secp256k1: {
+				ownershipGeneration,
 				reservationId: ecdsa.serverMaterial.reservationId,
 				preparation: ecdsaPreparation
 			} }
@@ -868,6 +872,7 @@ var D1LinkedDeviceAuthorityInstallServiceV1 = class {
 				const reservation = stored.serverReservationIds.ed25519;
 				if (!reservation || !packageValue) throw new Error("server reservation for ed25519 is missing");
 				await activation.activateOrdinaryInactiveSignerMaterialV1({
+					ownershipGeneration: reservation.ownershipGeneration,
 					keyFamily: "ed25519",
 					reservationId: reservation.reservationId,
 					materialActivation: packageValue.materialActivation,
@@ -883,6 +888,7 @@ var D1LinkedDeviceAuthorityInstallServiceV1 = class {
 			const reservation = stored.serverReservationIds.ecdsa_secp256k1;
 			if (!reservation || !packageValue) throw new Error("server reservation for ECDSA is missing");
 			await activation.activateOrdinaryInactiveSignerMaterialV1({
+				ownershipGeneration: reservation.ownershipGeneration,
 				keyFamily: "ecdsa_secp256k1",
 				reservationId: reservation.reservationId,
 				materialActivation: packageValue.materialActivation,
@@ -1413,6 +1419,11 @@ function buildActiveAuthMethod(pending, activatedAtMs) {
 }
 async function buildPasskeyCredentialPromotionStatements(input) {
 	if (input.authMethod.kind !== "passkey") return [];
+	await reservePasskeyCredential(input.credentialClaims, {
+		walletId: input.authMethod.walletId,
+		rpId: input.authMethod.rpId,
+		credentialIdB64u: input.authMethod.credentialIdB64u
+	});
 	const signer = await resolveLinkedDeviceEd25519Signer({
 		authority: input.authority,
 		listWalletEd25519Signers: input.listWalletEd25519Signers
@@ -1617,7 +1628,11 @@ function parseServerReservationIds(raw) {
 }
 function parseEd25519ServerReservationRecord(raw) {
 	const record = requireRecord(raw, "Ed25519 server reservation");
-	requireExactKeys(record, ["reservationId", "preparation"], "Ed25519 server reservation");
+	requireExactKeys(record, Object.hasOwn(record, "ownershipGeneration") ? [
+		"reservationId",
+		"preparation",
+		"ownershipGeneration"
+	] : ["reservationId", "preparation"], "Ed25519 server reservation");
 	const preparationRecord = requireRecord(record.preparation, "Ed25519 reservation preparation");
 	requireExactKeys(preparationRecord, [
 		"kind",
@@ -1632,6 +1647,7 @@ function parseEd25519ServerReservationRecord(raw) {
 	const applicationBinding = parseRouterAbEd25519YaoApplicationBindingFactsV1(preparationRecord.applicationBinding);
 	if (targetBinding.operation !== "registration") throw new Error("Ed25519 target binding must use registration");
 	return {
+		ownershipGeneration: storedReservationGeneration(record),
 		reservationId: requireReservationId(record.reservationId, "Ed25519 server reservation id"),
 		preparation: {
 			kind: "ordinary_ed25519_signer_material_reservation_preparation_v1",
@@ -1643,7 +1659,11 @@ function parseEd25519ServerReservationRecord(raw) {
 }
 function parseEcdsaServerReservationRecord(raw) {
 	const record = requireRecord(raw, "ECDSA server reservation");
-	requireExactKeys(record, ["reservationId", "preparation"], "ECDSA server reservation");
+	requireExactKeys(record, Object.hasOwn(record, "ownershipGeneration") ? [
+		"reservationId",
+		"preparation",
+		"ownershipGeneration"
+	] : ["reservationId", "preparation"], "ECDSA server reservation");
 	const preparationRecord = requireRecord(record.preparation, "ECDSA reservation preparation");
 	requireExactKeys(preparationRecord, [
 		"kind",
@@ -1652,6 +1672,7 @@ function parseEcdsaServerReservationRecord(raw) {
 	], "ECDSA reservation preparation");
 	if (preparationRecord.kind !== "ordinary_ecdsa_signer_material_reservation_preparation_v1") throw new Error("ECDSA reservation preparation kind is invalid");
 	return {
+		ownershipGeneration: storedReservationGeneration(record),
 		reservationId: requireReservationId(record.reservationId, "ECDSA server reservation id"),
 		preparation: {
 			kind: "ordinary_ecdsa_signer_material_reservation_preparation_v1",
@@ -1866,6 +1887,11 @@ function requireTime(raw, label) {
 function errorMessage(error) {
 	return error instanceof Error ? error.message : String(error);
 }
+function storedReservationGeneration(record) {
+	const generation = Object.hasOwn(record, "ownershipGeneration") ? record.ownershipGeneration : 1;
+	if (typeof generation !== "number" || !Number.isSafeInteger(generation) || generation < 1) throw new Error("Stored reservation ownership generation is invalid");
+	return generation;
+}
 //#endregion
 export { D1LinkedDeviceAuthorityInstallServiceV1, parseInstalledEcdsaCustodySnapshotV1, readD1LinkedDeviceEcdsaSourceV1, readD1LinkedDeviceEd25519SourceV1 };
 

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEd25519ExportRootStore.js

@@ -13,7 +13,12 @@ var D1LinkedDeviceEd25519ExportRootStoreV1 = class {
            namespace, org_id, project_id, env_id, link_session_id,
            wallet_id, enrollment_id, device_id, state, transfer_alg,
            recipient_public_key_b64u, recipient_json, registered_at_ms
-         ) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, 'recipient_registered', ?9, ?10, ?11, ?12)`).bind(...scopeValues(this.scope), String(recipient.linkSessionId), String(recipient.walletId), String(recipient.enrollmentId), String(recipient.deviceId), "x25519-hkdf-sha256-chacha20poly1305-v1", String(recipient.recipientPublicKeyB64u), JSON.stringify(recipient), recipient.registeredAtMs).run()) === 1) return { outcome: "applied" };
+         ) SELECT ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, 'recipient_registered', ?9, ?10, ?11, ?12
+           FROM linked_device_sessions
+          WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+            AND link_session_id = ?5
+            AND state IN ('awaiting_target_factor', 'awaiting_source_contribution',
+                          'provisioning', 'authority_pending_local_install', 'active')`).bind(...scopeValues(this.scope), String(recipient.linkSessionId), String(recipient.walletId), String(recipient.enrollmentId), String(recipient.deviceId), "x25519-hkdf-sha256-chacha20poly1305-v1", String(recipient.recipientPublicKeyB64u), JSON.stringify(recipient), recipient.registeredAtMs).run()) === 1) return { outcome: "applied" };
 		const existing = await this.readRowV1(String(recipient.linkSessionId));
 		if (!existing) return {
 			outcome: "conflict",

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEmailOtpGrantStore.js

@@ -1,3 +1,4 @@
+import { d1ChangedRows } from "../../../../storage/d1Sql.js";
 import { SESSION_CAS_GUARD_SQL } from "./d1LinkedDeviceSessionStore.js";
 import { parseLinkedDeviceEmailOtpGrantRecordV1 } from "../../../../core/deviceLinking/linkedDeviceEmailOtpGrant.js";
 //#region src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEmailOtpGrantStore.ts
@@ -18,7 +19,7 @@ var D1LinkedDeviceEmailOtpGrantStoreV1 = class {
 	async issueV1(record) {
 		const parsed = parseLinkedDeviceEmailOtpGrantRecordV1(record);
 		if (parsed.state.kind !== "issued") throw new Error("a linked-device email OTP grant is only ever inserted as issued");
-		await this.database.prepare(`INSERT INTO ${GRANT_TABLE} (
+		if (d1ChangedRows(await this.database.prepare(`INSERT INTO ${GRANT_TABLE} (
            namespace, org_id, project_id, env_id, grant_id,
            grant_token_digest_b64u, wallet_id, link_session_id, enrollment_id,
            device_id, target_factor, target_preparation_digest_b64u,
@@ -27,7 +28,16 @@ var D1LinkedDeviceEmailOtpGrantStoreV1 = class {
            base_wallet_auth_method_id, linked_owner_auth_method_id,
            authority_digest_b64u, challenge_id, state, record_json,
            issued_at_ms, expires_at_ms, consumed_at_ms
-         ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'email_otp', ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'issued', ?, ?, ?, NULL)`).bind(...scopeValues(this.scope), parsed.grantId, parsed.grantTokenDigestB64u, String(parsed.walletId), String(parsed.linkSessionId), String(parsed.enrollmentId), String(parsed.deviceId), parsed.targetPreparationDigestB64u, parsed.targetEmail, parsed.enrollment.kind, parsed.emailHashHex, parsed.registrationAuthorityId, parsed.providerUserId, parsed.baseWalletAuthMethodId ?? null, String(parsed.walletAuthMethodId), parsed.authorityDigestB64u, parsed.challengeId, serializeGrantForD1(parsed), parsed.issuedAtMs, parsed.expiresAtMs).run();
+         ) SELECT ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, 'email_otp',
+                  ?11, ?12, ?13, ?14, ?15, ?16, ?17, ?18, ?19, ?20, 'issued', ?21, ?22, ?23, NULL
+             FROM linked_device_sessions
+            WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+              AND link_session_id = ?8 AND state = 'awaiting_target_factor'`).bind(...scopeValues(this.scope), parsed.grantId, parsed.grantTokenDigestB64u, String(parsed.walletId), String(parsed.linkSessionId), String(parsed.enrollmentId), String(parsed.deviceId), parsed.targetPreparationDigestB64u, parsed.targetEmail, parsed.enrollment.kind, parsed.emailHashHex, parsed.registrationAuthorityId, parsed.providerUserId, parsed.baseWalletAuthMethodId ?? null, String(parsed.walletAuthMethodId), parsed.authorityDigestB64u, parsed.challengeId, serializeGrantForD1(parsed), parsed.issuedAtMs, parsed.expiresAtMs).run()) === 1) return { kind: "issued" };
+		return {
+			kind: "refused",
+			code: "link_session_inactive",
+			message: "linked-device session no longer accepts Email OTP grants"
+		};
 	}
 	async readByIdV1(grantId) {
 		const row = await this.database.prepare(`SELECT json_set(

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEmailOtpTargetFactor.js

@@ -177,7 +177,8 @@ var D1LinkedDeviceEmailOtpTargetFactorV1 = class {
 			code: sealed.code,
 			message: sealed.message
 		};
-		await this.options.grants.issueV1(grantRecord);
+		const issued = await this.options.grants.issueV1(grantRecord);
+		if (issued.kind === "refused") return issued;
 		return {
 			kind: "verified",
 			grant: {
@@ -264,7 +265,8 @@ var D1LinkedDeviceEmailOtpTargetFactorV1 = class {
 			issuedAtMs,
 			expiresAtMs
 		});
-		await this.options.grants.issueV1(grantRecord);
+		const issued = await this.options.grants.issueV1(grantRecord);
+		if (issued.kind === "refused") return issued;
 		return {
 			kind: "verified",
 			grant: {
@@ -409,7 +411,6 @@ var D1LinkedDeviceEmailOtpTargetFactorV1 = class {
 				kind: "existing_enrollment",
 				resolved,
 				targetEmail,
-				enrollment: { kind: "existing_enrollment" },
 				targetPreparationDigestB64u,
 				walletAuthMethodId,
 				authorityDigestB64u: await computeLinkedDeviceEmailOtpAuthorityDigestV1({
@@ -448,7 +449,6 @@ var D1LinkedDeviceEmailOtpTargetFactorV1 = class {
 		return {
 			kind: "new_enrollment",
 			targetEmail,
-			enrollment: { kind: "new_enrollment" },
 			targetPreparationDigestB64u,
 			walletAuthMethodId,
 			authorityDigestB64u: await computeLinkedDeviceEmailOtpAuthorityDigestV1({

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceOwnerAuthorizationProvider.js

@@ -1,9 +1,9 @@
 import { mpcMaterialActivationRefsEqual, parseEcdsaRelayerKeyId, parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseProviderSubject } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseWalletSessionAuthorizationId, parseWalletSessionId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { buildFullOwnerDelegatedWalletAuthorityV1, hasDelegatedWalletPermissionV1, validateDelegatedWalletAuthorityAttenuationV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { buildFullOwnerDelegatedWalletAuthorityV1, hasDelegatedWalletPermissionV1, validateDelegatedWalletAuthorityAttenuationV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { parseSecp256k1CompressedPublicKeyB64u } from "../../../../shared-ts/src/passkey-custody/primitives.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { deriveRouterAbEd25519YaoApplicationBindingDigestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519YaoDigests.js";
@@ -11,9 +11,9 @@ import { buildEmailOtpWalletAuthAuthority, buildPasskeyWalletAuthAuthority, wall
 import { walletAuthorityDigestsMatchV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { buildWalletSessionLinkedDeviceOwnerAuthorizationV1, parseQrLinkedDeviceSessionPayloadV5 } from "../../../../shared-ts/src/device-linking/parsers.js";
 import { computeLinkedDevicePublicKeyDigestV1 } from "../../../../shared-ts/src/device-linking/requestProof.js";
-import { thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
 import { resolveActiveOwnerWalletExecutionLane, resolveWalletAuthMethodIdForAuthority } from "../../../../core/signingLanes/WalletExecutionLaneProjection.js";
 import "../../../../core/deviceLinking/requestProof.js";
+import { thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
 import { sourceKeyManifestDigestForFamilyV1 } from "../../../../core/deviceLinking/linkedDeviceSessionRecord.js";
 import { LinkedDeviceSourceFamilyUnavailableErrorV1 } from "./d1LinkedDeviceVerifiedLinkSourceReader.js";
 import { linkedDeviceSignerManifestsEqualV1 } from "./d1LinkedDeviceVerifiedLinkBuilder.js";

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRequestProofNonceStore.js

@@ -1,7 +1,7 @@
 import { parseLinkDeviceSessionId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { isObject, requireCanonicalString } from "../../../../shared-ts/src/utils/validation.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { requireCanonicalString } from "../../../../shared-ts/src/utils/validation.js";
 import { d1ChangedRows } from "../../../../storage/d1Sql.js";
 //#region src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRequestProofNonceStore.ts
 const NONCE_TABLE = "linked_device_request_proof_nonces";
@@ -12,14 +12,7 @@ var D1LinkedDeviceRequestProofNonceStoreV1 = class {
 		this.scope = normalizeScope(options.scope);
 	}
 	async consumeRequestProofNonceV1(input) {
-		const normalized = parseNonceRecord({
-			linkSessionId: input.linkSessionId,
-			requestNonceB64u: input.requestNonceB64u,
-			proofDigestB64u: input.proofDigestB64u,
-			issuedAtMs: input.issuedAtMs,
-			expiresAtMs: input.expiresAtMs,
-			consumedAtMs: input.consumedAtMs
-		});
+		const normalized = parseNonceRecord(input);
 		await this.pruneExpiredNoncesV1(normalized.consumedAtMs);
 		try {
 			if (d1ChangedRows(await this.database.prepare(`INSERT INTO ${NONCE_TABLE} (
@@ -60,6 +53,7 @@ var D1LinkedDeviceRequestProofNonceStoreV1 = class {
 	}
 };
 function parseNonceRecord(raw) {
+	if (!isObject(raw)) throw new Error("Invalid device request nonce");
 	const linkSessionId = parseSessionId(raw.linkSessionId);
 	const requestNonceB64u = parseFixedB64u(raw.requestNonceB64u, "requestNonceB64u");
 	const proofDigestB64u = parseDigest(raw.proofDigestB64u, "proofDigestB64u");

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRouteService.js

@@ -8,12 +8,13 @@ import { D1LinkedDeviceSessionStoreV1 } from "./d1LinkedDeviceSessionStore.js";
 //#region src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRouteService.ts
 function createD1LinkedDeviceRouteServiceV1(options) {
 	const nowV1 = options.nowV1 ?? Date.now;
-	const proofVerifier = new LinkedDeviceRequestProofVerifierV1({ nonceStore: new D1LinkedDeviceRequestProofNonceStoreV1({
+	const proofVerifier = new LinkedDeviceRequestProofVerifierV1({ nonceStore: options.proofNonces ?? new D1LinkedDeviceRequestProofNonceStoreV1({
 		database: options.database,
 		scope: options.scope
 	}) });
 	const { sessionService } = createD1LinkedDeviceSessionServiceV1({
 		sessionStore: new D1LinkedDeviceSessionStoreV1({
+			bootstrap: options.bootstrap,
 			database: options.database,
 			scope: options.scope,
 			now: nowV1

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionRecords.js

@@ -1,6 +1,6 @@
 import { parseWalletAuthorityId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { requireCanonicalString } from "../../../../shared-ts/src/utils/validation.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { parseLinkedDeviceSessionRecordV1 } from "../../../../core/deviceLinking/linkedDeviceSessionRecord.js";
 //#region src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionRecords.ts
 function parseD1LinkedDeviceSessionRowV1(row) {

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionStore.js

@@ -3,6 +3,7 @@ import { assertNeverLinkSessionStateV1 } from "../../../../shared-ts/src/device-
 import { parseLinkedDeviceApprovalV1, parseLinkedDeviceSessionClaimV1 } from "../../../../shared-ts/src/device-linking/parsers.js";
 import { computeLinkedDeviceApprovalDigestV1, computeLinkedDeviceSessionClaimDigestV1 } from "../../../../shared-ts/src/device-linking/digests.js";
 import { d1ChangedRows, queryD1All } from "../../../../storage/d1Sql.js";
+import { requireLinkedDeviceBootstrapRecord } from "../../../../core/deviceLinking/linkedDeviceBootstrap.js";
 import { LinkedDeviceRetiredSessionShapeErrorV1, approvalTranscriptMatchesDigest, claimTranscriptMatchesDigest, conflictResult, integrityResult, invalidStateResult, isPrecommitState, linkedDeviceEmailOtpChallengesEqualV1, linkedDeviceQrPayloadsEqualV1, parseLinkedDeviceSessionRecordV1, sessionExpiryMsV1, sourceContributionTranscriptMatchesDigest } from "../../../../core/deviceLinking/linkedDeviceSessionRecord.js";
 import { parseD1LinkedDeviceSessionRowV1, parseD1LinkedDeviceSessionTranscriptRowV1 } from "./d1LinkedDeviceSessionRecords.js";
 //#region src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionStore.ts
@@ -29,21 +30,33 @@ const PRECOMMIT_STATES = [
 ];
 var D1LinkedDeviceSessionStoreV1 = class {
 	constructor(options) {
+		this.bootstrap = options.bootstrap;
 		this.database = options.database;
 		this.scope = normalizeScope(options.scope);
 	}
 	async createUnclaimedSessionV1(record) {
 		const normalized = parseLinkedDeviceSessionRecordV1(record);
 		if (normalized.state.state !== "displaying_qr" || normalized.revision !== 1) return invalidStateResult(normalized);
+		if (this.bootstrap) {
+			const existing = requireLinkedDeviceBootstrapRecord(await this.bootstrap.create(normalized));
+			if (!existing) throw new Error("Bootstrap creation returned no session");
+			if (!linkedDeviceQrPayloadsEqualV1(existing.qrPayload, normalized.qrPayload)) return conflictResult(1, existing);
+			if (existing.state.state === "claimed") {
+				const current = await this.getSessionV1(normalized.linkSessionId);
+				if (!current) return conflictResult(1, null);
+				return {
+					outcome: "replayed",
+					record: current
+				};
+			}
+			return {
+				outcome: "applied",
+				record: existing
+			};
+		}
 		let insertError;
 		try {
-			if (d1ChangedRows(await this.database.prepare(`INSERT INTO ${SESSION_TABLE} (
-             namespace, org_id, project_id, env_id, link_session_id,
-             link_public_key_b64u, device_public_key_b64u, state, record_json,
-             revision, expires_at_ms, claim_expires_at_ms, claim_digest_b64u,
-             approval_digest_b64u, authority_id, package_set_digest_b64u,
-             created_at_ms, updated_at_ms
-           ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).bind(...scopeValues(this.scope), ...sessionColumnValues(normalized)).run()) === 1) return {
+			if (d1ChangedRows(await this.sessionInsertStatement(normalized).run()) === 1) return {
 				outcome: "applied",
 				record: normalized
 			};
@@ -62,6 +75,44 @@ var D1LinkedDeviceSessionStoreV1 = class {
 		return conflictResult(1, existing);
 	}
 	async getSessionV1(linkSessionId) {
+		const local = await this.readLocalSession(linkSessionId);
+		if (local || !this.bootstrap) return local;
+		if (await this.database.prepare(`SELECT 1 AS imported FROM linked_device_bootstrap_imports
+      WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ? AND link_session_id = ?`).bind(...scopeValues(this.scope), String(linkSessionId)).first()) return null;
+		const record = requireLinkedDeviceBootstrapRecord(await this.bootstrap.read(linkSessionId));
+		if (!record || record.state.state !== "claimed") return record;
+		return this.importClaimedSession(record);
+	}
+	sessionInsertStatement(normalized) {
+		return this.database.prepare(`INSERT INTO ${SESSION_TABLE} (
+             namespace, org_id, project_id, env_id, link_session_id,
+             link_public_key_b64u, device_public_key_b64u, state, record_json,
+             revision, expires_at_ms, claim_expires_at_ms, claim_digest_b64u,
+             approval_digest_b64u, authority_id, package_set_digest_b64u,
+             created_at_ms, updated_at_ms
+           ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).bind(...scopeValues(this.scope), ...sessionColumnValues(normalized));
+	}
+	async importClaimedSession(record) {
+		if (record.state.state !== "claimed" || !record.claimTranscript || record.revision !== 2) throw new Error("Invalid bootstrap claim");
+		const transcript = record.claimTranscript;
+		if (await computeLinkedDeviceSessionClaimDigestV1(transcript.value) !== transcript.digestB64u) throw new Error("Invalid bootstrap claim digest");
+		try {
+			await this.database.batch([
+				this.sessionInsertStatement(record),
+				this.database.prepare(`INSERT INTO linked_device_session_transcripts
+          (namespace, org_id, project_id, env_id, link_session_id, transcript_kind, digest_b64u, transcript_json, created_at_ms)
+          VALUES (?, ?, ?, ?, ?, 'claim', ?, ?, ?)`).bind(...scopeValues(this.scope), record.linkSessionId, transcript.digestB64u, JSON.stringify(transcript.value), record.updatedAtMs),
+				this.database.prepare(`INSERT INTO linked_device_bootstrap_imports
+          (namespace, org_id, project_id, env_id, link_session_id) VALUES (?, ?, ?, ?, ?)`).bind(...scopeValues(this.scope), record.linkSessionId)
+			]);
+		} catch (error) {
+			const raced = await this.readLocalSession(record.linkSessionId);
+			if (raced && claimTranscriptMatchesDigest(raced, transcript.digestB64u)) return raced;
+			throw Object.assign(new Error("Linked-device claim import is unavailable", { cause: error }), { code: "home_unavailable" });
+		}
+		return record;
+	}
+	async readLocalSession(linkSessionId) {
 		const row = await this.database.prepare(`SELECT link_session_id, link_public_key_b64u, device_public_key_b64u,
                 state, record_json, revision, expires_at_ms, claim_expires_at_ms,
                 claim_digest_b64u, approval_digest_b64u, authority_id,
@@ -157,6 +208,21 @@ var D1LinkedDeviceSessionStoreV1 = class {
 		};
 	}
 	async claimSessionV1(input) {
+		if (this.bootstrap) {
+			const selected = requireLinkedDeviceBootstrapRecord(await this.bootstrap.claim(input.nextRecord));
+			if (selected?.state.state !== "claimed" || !selected.claimTranscript) throw Object.assign(/* @__PURE__ */ new Error("Bootstrap claim returned invalid state"), { code: "home_unavailable" });
+			const current = await this.readLocalSession(input.linkSessionId);
+			if (current) return claimTranscriptMatchesDigest(current, selected.claimTranscript.digestB64u) ? {
+				outcome: "replayed",
+				record: current
+			} : conflictResult(input.expectedRevision, current);
+			const imported = await this.getSessionV1(input.linkSessionId);
+			if (!imported) return conflictResult(input.expectedRevision, null);
+			return {
+				outcome: "applied",
+				record: imported
+			};
+		}
 		const current = await this.getSessionV1(input.linkSessionId);
 		if (!current) return conflictResult(input.expectedRevision, null);
 		if (claimTranscriptMatchesDigest(current, input.claimDigestB64u)) return {
@@ -293,6 +359,14 @@ var D1LinkedDeviceSessionStoreV1 = class {
 		});
 	}
 	async cancelSessionV1(input) {
+		if (this.bootstrap && !await this.readLocalSession(input.linkSessionId)) {
+			const record = requireLinkedDeviceBootstrapRecord(await this.bootstrap.finish(input.nextRecord));
+			if (!record) return conflictResult(input.expectedRevision, null);
+			return {
+				outcome: "applied",
+				record
+			};
+		}
 		return this.applyTerminalStateCas({
 			...sessionMutationFieldsV1(input),
 			expectedStates: PRECOMMIT_STATES,
@@ -301,6 +375,14 @@ var D1LinkedDeviceSessionStoreV1 = class {
 		});
 	}
 	async expireSessionV1(input) {
+		if (this.bootstrap && !await this.readLocalSession(input.linkSessionId)) {
+			const record = requireLinkedDeviceBootstrapRecord(await this.bootstrap.finish(input.nextRecord));
+			if (!record) return conflictResult(input.expectedRevision, null);
+			return {
+				outcome: "applied",
+				record
+			};
+		}
 		const current = await this.getSessionV1(input.linkSessionId);
 		if (!current) return conflictResult(input.expectedRevision, null);
 		if (current.state.state === "expired") return {

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetCredentialProvider.js

@@ -1,8 +1,8 @@
 import { hasControlCharacter, mpcMaterialActivationRefsEqual, parseWebAuthnCredentialIdB64u } from "../../../../shared-ts/src/utils/domainIds.js";
+import { requireCanonicalString, requireRecord } from "../../../../shared-ts/src/utils/validation.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u, sha256Utf8DigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { requireCanonicalString, requireRecord } from "../../../../shared-ts/src/utils/validation.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1 } from "../../../../shared-ts/src/device-linking/sourceContribution.js";
 import { parseLinkedDeviceTargetCredentialRegistrationResultV1, parseLinkedDeviceTargetCredentialRegistrationV1, parseLinkedDeviceTargetPreparationV1 } from "../../../../shared-ts/src/device-linking/parsers.js";
@@ -128,14 +128,7 @@ var D1LinkedDeviceTargetCredentialProviderV1 = class {
 	}
 	async getTargetPreparationV1(input) {
 		const persisted = await this.readV1(input.session.linkSessionId);
-		if (persisted) {
-			assertPreparationMatchesSession(persisted.preparation, input.session, input.approval);
-			if (input.access === "create_or_replay" && input.deliveryRecipientPublicKey65B64u !== persisted.preparation.deliveryRecipientPublicKey65B64u) return {
-				kind: "conflict",
-				message: "linked-device target preparation recipient conflicts with its durable replay"
-			};
-			return persisted.preparation;
-		}
+		if (persisted) return replayTargetPreparation(persisted.preparation, input);
 		if (input.session.state.state !== "awaiting_target_factor") throw new Error("linked-device target preparation is unavailable in this session state");
 		if (input.access === "replay_only") throw new Error("linked-device target preparation has not been created");
 		const preparation = parseLinkedDeviceTargetPreparationV1(await this.planner.createTargetPreparationV1(input));
@@ -146,11 +139,16 @@ var D1LinkedDeviceTargetCredentialProviderV1 = class {
            namespace, org_id, project_id, env_id, link_session_id,
            wallet_id, enrollment_id, device_id, state, target_factor,
            preparation_digest_b64u, preparation_json, prepared_at_ms, expires_at_ms
-         ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'prepared', ?, ?, ?, ?, ?)`).bind(...scopeValues(this.scope), String(preparation.linkSessionId), String(preparation.walletId), String(preparation.enrollmentId), String(preparation.deviceId), preparation.targetFactor.kind, preparationDigestB64u, JSON.stringify(preparation), preparation.issuedAtMs, preparation.expiresAtMs).run();
+         ) SELECT ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, 'prepared', ?9, ?10, ?11, ?12, ?13
+           FROM linked_device_sessions
+          WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+            AND link_session_id = ?5 AND state = 'awaiting_target_factor'`).bind(...scopeValues(this.scope), String(preparation.linkSessionId), String(preparation.walletId), String(preparation.enrollmentId), String(preparation.deviceId), preparation.targetFactor.kind, preparationDigestB64u, JSON.stringify(preparation), preparation.issuedAtMs, preparation.expiresAtMs).run();
 		const stored = await this.readV1(input.session.linkSessionId);
-		if (!stored) throw new Error("linked-device target preparation did not persist");
-		if (stored.preparationDigestB64u !== preparationDigestB64u) throw new Error("linked-device target preparation conflicts with its durable replay");
-		return stored.preparation;
+		if (!stored) return {
+			kind: "conflict",
+			message: "linked-device session no longer accepts target preparation"
+		};
+		return replayTargetPreparation(stored.preparation, input);
 	}
 	async registerTargetCredentialV1(input) {
 		try {
@@ -441,9 +439,12 @@ var D1LinkedDeviceTargetCredentialProviderV1 = class {
 		if (d1ChangedRows(await this.database.prepare(`INSERT OR IGNORE INTO ${TARGET_COMMIT_RESERVATION_TABLE} (
            namespace, org_id, project_id, env_id, link_session_id,
            registration_digest_b64u, state, reserved_at_ms
-         ) VALUES (?, ?, ?, ?, ?, ?, 'reserved', ?)`).bind(...scopeValues(this.scope), input.linkSessionId, input.registrationDigestB64u, input.nowMs).run()) === 1) return { outcome: "acquired" };
+         ) SELECT ?1, ?2, ?3, ?4, ?5, ?6, 'reserved', ?7
+           FROM linked_device_sessions
+          WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+            AND link_session_id = ?5 AND state = 'awaiting_target_factor'`).bind(...scopeValues(this.scope), input.linkSessionId, input.registrationDigestB64u, input.nowMs).run()) === 1) return { outcome: "acquired" };
 		const row = await this.readCommitReservationV1(input.linkSessionId);
-		if (!row) return await this.reserveCommitV1(input);
+		if (!row) throw new Error("linked-device session no longer accepts target credential registration");
 		if (row.registrationDigestB64u !== input.registrationDigestB64u) throw new Error("linked-device target credential conflicts with its durable commit reservation");
 		if (row.state === "committed") return {
 			outcome: "replayed",
@@ -560,6 +561,14 @@ async function assertRegistrationReplay(persisted, registration, keyManifestDige
 	if (!persisted.registration || persisted.registration.keyManifestDigestB64u !== keyManifestDigestB64u) throw new Error("linked-device target credential conflicts with its durable record");
 	await assertRegistrationValueReplay(persisted.registration.value, registration);
 }
+function replayTargetPreparation(preparation, input) {
+	assertPreparationMatchesSession(preparation, input.session, input.approval);
+	if (input.access === "create_or_replay" && input.deliveryRecipientPublicKey65B64u !== preparation.deliveryRecipientPublicKey65B64u) return {
+		kind: "conflict",
+		message: "linked-device target preparation recipient conflicts with its durable replay"
+	};
+	return preparation;
+}
 function assertPreparationMatchesSession(preparation, session, approval) {
 	const sourceSignerManifest = session.approvalTranscript?.sourceSignerManifest;
 	if (!sourceSignerManifest) throw new Error("linked-device verified source signer manifest is unavailable");

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetPlanner.js

@@ -1,6 +1,6 @@
 import { parseWalletAuthMethodId, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { hasDelegatedWalletPermissionV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
+import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { buildLinkedDeviceTargetPreparationV1 } from "../../../../shared-ts/src/device-linking/parsers.js";
 import { computeLinkedDevicePasskeyTargetConfigurationDigestV1 } from "../../../../shared-ts/src/device-linking/digests.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceVerifiedLinkBuilder.js

@@ -1,9 +1,9 @@
 import { parseWebAuthnCredentialIdB64u } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { buildDelegatedWalletAuthorityV1, validateDelegatedWalletAuthorityAttenuationV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
 import { sha256Utf8DigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { buildDelegatedWalletAuthorityV1, validateDelegatedWalletAuthorityAttenuationV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { buildExactAdministeredSignerManifestV1 } from "../../../../shared-ts/src/device-linking/delegatedActivationPlan.js";
 import { walletAuthorityDigestsMatchV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { sourceKeyManifestDigestForFamilyV1 } from "../../../../core/deviceLinking/linkedDeviceSessionRecord.js";