@seams/wallet-server 0.8.0 → 0.9.0

package/dist/esm/router/cloudflare/d1/wallet/d1WalletRelocationApprovals.js

@@ -0,0 +1,140 @@
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
+import { readWalletRelocationOwner } from "./d1WalletRelocationOwner.js";
+import { WalletRelocationChallengeBinding } from "./d1WalletRelocationChallenges.js";
+import { verifyWalletRelocationEmailOtp } from "./d1WalletRelocationEmailOtp.js";
+import { verifyWalletRelocationPasskey } from "./d1WalletRelocationPasskey.js";
+//#region src/router/cloudflare/d1/wallet/d1WalletRelocationApprovals.ts
+var D1WalletRelocationApprovals = class {
+	constructor(database, scope) {
+		this.database = database;
+		this.scope = scope;
+	}
+	async approvePasskey(input) {
+		const previous = await this.read(input.binding);
+		if (previous) return {
+			kind: "approved",
+			approval: previous
+		};
+		const verified = await verifyWalletRelocationPasskey({
+			database: this.database,
+			scope: this.scope,
+			binding: input.binding,
+			credential: input.credential,
+			nowMs: input.nowMs
+		});
+		return this.commit(input, verified);
+	}
+	async approveEmailOtp(input) {
+		const previous = await this.read(input.binding);
+		if (previous) return {
+			kind: "approved",
+			approval: previous
+		};
+		const verified = await verifyWalletRelocationEmailOtp({
+			database: this.database,
+			scope: this.scope,
+			binding: input.binding,
+			challengeId: input.challengeId,
+			otpCode: input.otpCode,
+			nowMs: input.nowMs,
+			verifier: input.verifier,
+			emailOtpChallenges: input.emailOtpChallenges
+		});
+		return this.commit(input, verified);
+	}
+	async commit(input, verified) {
+		if (verified.kind === "denied") {
+			const concurrent = await this.read(input.binding);
+			return concurrent ? {
+				kind: "approved",
+				approval: concurrent
+			} : { kind: "denied" };
+		}
+		const statements = [
+			...input.owner.prepareApprovalGuard(this.database, this.scope, input.binding, input.nowMs),
+			...verified.commitPrerequisites,
+			this.database.prepare(`INSERT INTO wallet_relocation_approvals
+        (namespace, org_id, project_id, env_id, wallet_id, move_id, binding_json,
+         authority_digest_b64u, authority_revocation_epoch, approved_at_ms, expires_at_ms)
+        SELECT namespace, org_id, project_id, env_id, wallet_id, move_id, binding_json,
+          ?8, ?9, consumed_at_ms, expires_at_ms
+        FROM wallet_relocation_challenges
+        WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+          AND wallet_id = ?5 AND move_id = ?6 AND binding_json = ?7
+          AND consumed_at_ms = ?10 AND expires_at_ms > ?10
+          AND expires_at_ms > CAST(unixepoch('subsec') * 1000 AS INTEGER)`).bind(...this.key(input.binding), input.binding.encoded(), verified.authorityDigestB64u, verified.authorityRevocationEpoch, input.nowMs),
+			this.database.prepare(D1_BATCH_CAS_GUARD_SQL)
+		];
+		try {
+			const results = await this.database.batch(statements);
+			if (results.length !== statements.length || results.some(failedStatement)) throw new Error("Relocation approval batch failed");
+		} catch (error) {
+			const concurrent = await this.read(input.binding);
+			if (concurrent) return {
+				kind: "approved",
+				approval: concurrent
+			};
+			throw error;
+		}
+		const approval = await this.read(input.binding);
+		if (!approval) throw new Error("Relocation approval was not recorded");
+		return {
+			kind: "approved",
+			approval
+		};
+	}
+	async find(walletId, moveId) {
+		const row = await this.database.prepare(`SELECT binding_json FROM wallet_relocation_approvals
+      WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+        AND wallet_id = ?5 AND move_id = ?6`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, walletId, moveId).first();
+		if (!row) return null;
+		if (typeof row.binding_json !== "string") throw new Error("Stored relocation binding is invalid");
+		const binding = WalletRelocationChallengeBinding.decode(row.binding_json);
+		if (binding.walletId !== walletId || binding.moveId !== moveId) throw new Error("Stored relocation binding is inconsistent");
+		return this.read(binding);
+	}
+	async readForAdmission(binding, nowMs) {
+		const approval = await this.read(binding);
+		if (!approval || !Number.isSafeInteger(nowMs) || nowMs < approval.approvedAtMs || nowMs >= approval.expiresAtMs) return null;
+		const owner = await readWalletRelocationOwner(this.database, this.scope, binding);
+		if (!owner || owner.authority.authorityDigestB64u !== approval.authorityDigestB64u || owner.authority.revocationEpoch !== approval.authorityRevocationEpoch) return null;
+		return approval;
+	}
+	async read(binding) {
+		const row = await this.database.prepare(`SELECT binding_json, authority_digest_b64u,
+      authority_revocation_epoch, approved_at_ms, expires_at_ms FROM wallet_relocation_approvals
+      WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+        AND wallet_id = ?5 AND move_id = ?6`).bind(...this.key(binding)).first();
+		if (!row) return null;
+		if (row.binding_json !== binding.encoded()) throw new Error("Relocation approval binding changed");
+		const approvedAtMs = row.approved_at_ms;
+		const expiresAtMs = row.expires_at_ms;
+		const authorityRevocationEpoch = row.authority_revocation_epoch;
+		if (typeof approvedAtMs !== "number" || !Number.isSafeInteger(approvedAtMs) || approvedAtMs <= 0 || typeof expiresAtMs !== "number" || !Number.isSafeInteger(expiresAtMs) || expiresAtMs <= approvedAtMs || expiresAtMs - approvedAtMs > 3e5 || expiresAtMs > binding.credentialExpiresAtMs || typeof authorityRevocationEpoch !== "number" || !Number.isSafeInteger(authorityRevocationEpoch) || authorityRevocationEpoch < 0 || typeof row.authority_digest_b64u !== "string") throw new Error("Stored relocation approval is invalid");
+		return {
+			binding,
+			authorityDigestB64u: parseDigestB64u(row.authority_digest_b64u),
+			authorityRevocationEpoch,
+			approvedAtMs,
+			expiresAtMs
+		};
+	}
+	key(binding) {
+		return [
+			this.scope.namespace,
+			this.scope.orgId,
+			this.scope.projectId,
+			this.scope.envId,
+			binding.walletId,
+			binding.moveId
+		];
+	}
+};
+function failedStatement(result) {
+	return result.success !== true;
+}
+//#endregion
+export { D1WalletRelocationApprovals };
+
+//# sourceMappingURL=d1WalletRelocationApprovals.js.map

package/dist/esm/router/cloudflare/d1/wallet/d1WalletRelocationChallenges.js

@@ -0,0 +1,170 @@
+import { parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { isPlainObject, requireCanonicalString } from "../../../../shared-ts/src/utils/validation.js";
+import { parseSessionOrigin } from "../../../../authorization/domain.js";
+import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
+import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
+//#region src/router/cloudflare/d1/wallet/d1WalletRelocationChallenges.ts
+const MAX_CHALLENGE_LIFETIME_MS = 3e5;
+var WalletRelocationChallengeBinding = class WalletRelocationChallengeBinding {
+	#canonical;
+	constructor(walletId, moveId, requestDigestHex, sourceGeneration, destinationRegion, authorityId, walletAuthMethodId, credentialDigestHex, credentialExpiresAtMs, origin) {
+		this.walletId = walletId;
+		this.moveId = moveId;
+		this.requestDigestHex = requestDigestHex;
+		this.sourceGeneration = sourceGeneration;
+		this.destinationRegion = destinationRegion;
+		this.authorityId = authorityId;
+		this.walletAuthMethodId = walletAuthMethodId;
+		this.credentialDigestHex = credentialDigestHex;
+		this.credentialExpiresAtMs = credentialExpiresAtMs;
+		this.origin = origin;
+		this.#canonical = JSON.stringify([
+			"seams/wallet-relocation-challenge/v1",
+			walletId,
+			moveId,
+			requestDigestHex,
+			sourceGeneration,
+			destinationRegion,
+			authorityId,
+			walletAuthMethodId,
+			credentialDigestHex,
+			credentialExpiresAtMs,
+			origin
+		]);
+		Object.freeze(this);
+	}
+	static parse(raw) {
+		if (!isPlainObject(raw) || Object.keys(raw).length !== 10) throw invalid();
+		const wallet = parseWalletId(raw.walletId);
+		const authority = parseWalletAuthorityId(raw.authorityId);
+		const method = parseWalletAuthMethodId(raw.walletAuthMethodId);
+		if (!wallet.ok || !authority.ok || !method.ok) throw invalid();
+		return new WalletRelocationChallengeBinding(wallet.value, matching(raw.moveId, /^wmove_[A-Za-z0-9_-]{43}$/u), matching(raw.requestDigestHex, /^[a-f0-9]{64}$/u), timestamp(raw.sourceGeneration), region(raw.destinationRegion), authority.value, method.value, matching(raw.credentialDigestHex, /^[a-f0-9]{64}$/u), timestamp(raw.credentialExpiresAtMs), parseSessionOrigin(raw.origin));
+	}
+	static decode(encoded) {
+		const raw = JSON.parse(encoded);
+		if (!Array.isArray(raw) || raw.length !== 11 || raw[0] !== "seams/wallet-relocation-challenge/v1") throw invalid();
+		const [, walletId, moveId, requestDigestHex, sourceGeneration, destinationRegion, authorityId, walletAuthMethodId, credentialDigestHex, credentialExpiresAtMs, origin] = raw;
+		const binding = WalletRelocationChallengeBinding.parse({
+			walletId,
+			moveId,
+			requestDigestHex,
+			sourceGeneration,
+			destinationRegion,
+			authorityId,
+			walletAuthMethodId,
+			credentialDigestHex,
+			credentialExpiresAtMs,
+			origin
+		});
+		if (binding.encoded() !== encoded) throw invalid();
+		return binding;
+	}
+	encoded() {
+		return this.#canonical;
+	}
+};
+var D1WalletRelocationChallenges = class {
+	constructor(database, scope) {
+		this.database = database;
+		this.scope = scope;
+	}
+	async issue(binding, nowMs, factorExpiresAtMs) {
+		timestamp(nowMs);
+		const previous = await this.read(binding);
+		if (previous) return previous;
+		const expiresAtMs = Math.min(nowMs + MAX_CHALLENGE_LIFETIME_MS, timestamp(factorExpiresAtMs), binding.credentialExpiresAtMs);
+		if (!Number.isSafeInteger(expiresAtMs) || expiresAtMs <= nowMs) throw invalid();
+		await this.database.prepare(`INSERT OR IGNORE INTO wallet_relocation_challenges
+      (namespace, org_id, project_id, env_id, wallet_id, move_id, binding_json,
+       challenge_b64u, created_at_ms, expires_at_ms)
+      VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10)`).bind(...this.key(binding), binding.encoded(), secureRandomBase64Url(32, "relocation challenge"), nowMs, expiresAtMs).run();
+		const created = await this.read(binding);
+		if (!created) throw new Error("Relocation challenge was not recorded");
+		return created;
+	}
+	async find(walletId, moveId) {
+		const row = await this.database.prepare(`SELECT binding_json FROM wallet_relocation_challenges
+      WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+        AND wallet_id = ?5 AND move_id = ?6`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, walletId, moveId).first();
+		if (!row) return null;
+		if (typeof row.binding_json !== "string") throw invalid();
+		const binding = WalletRelocationChallengeBinding.decode(row.binding_json);
+		if (binding.walletId !== walletId || binding.moveId !== moveId) throw invalid();
+		return this.read(binding);
+	}
+	async read(binding) {
+		const row = await this.database.prepare(`SELECT binding_json, challenge_b64u,
+      created_at_ms, expires_at_ms, consumed_at_ms FROM wallet_relocation_challenges
+      WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+        AND wallet_id = ?5 AND move_id = ?6`).bind(...this.key(binding)).first();
+		if (!row) return null;
+		if (row.binding_json !== binding.encoded()) throw new Error("Relocation challenge binding changed");
+		const challengeB64u = matching(row.challenge_b64u, /^[A-Za-z0-9_-]{43}$/u);
+		const createdAtMs = timestamp(row.created_at_ms);
+		const expiresAtMs = timestamp(row.expires_at_ms);
+		if (expiresAtMs <= createdAtMs || expiresAtMs - createdAtMs > MAX_CHALLENGE_LIFETIME_MS || expiresAtMs > binding.credentialExpiresAtMs) throw invalid();
+		if (row.consumed_at_ms === null) return {
+			state: "issued",
+			binding,
+			challengeB64u,
+			createdAtMs,
+			expiresAtMs
+		};
+		const consumedAtMs = timestamp(row.consumed_at_ms);
+		if (consumedAtMs < createdAtMs || consumedAtMs >= expiresAtMs) throw invalid();
+		return {
+			state: "consumed",
+			binding,
+			challengeB64u,
+			createdAtMs,
+			expiresAtMs,
+			consumedAtMs
+		};
+	}
+	prepareConsume(challenge, nowMs) {
+		timestamp(nowMs);
+		if (nowMs < challenge.createdAtMs || nowMs >= challenge.expiresAtMs) throw invalid();
+		return [this.database.prepare(`UPDATE wallet_relocation_challenges SET consumed_at_ms = ?7
+        WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+          AND wallet_id = ?5 AND move_id = ?6 AND consumed_at_ms IS NULL
+          AND binding_json = ?8 AND challenge_b64u = ?9
+          AND created_at_ms = ?10 AND expires_at_ms = ?11
+          AND created_at_ms <= ?7 AND expires_at_ms > ?7`).bind(...this.key(challenge.binding), nowMs, challenge.binding.encoded(), challenge.challengeB64u, challenge.createdAtMs, challenge.expiresAtMs), this.database.prepare(D1_BATCH_CAS_GUARD_SQL)];
+	}
+	key(binding) {
+		return [
+			this.scope.namespace,
+			this.scope.orgId,
+			this.scope.projectId,
+			this.scope.envId,
+			binding.walletId,
+			binding.moveId
+		];
+	}
+};
+function matching(raw, pattern) {
+	const value = requireCanonicalString(raw, "relocation challenge identity");
+	if (!pattern.test(value)) throw invalid();
+	return value;
+}
+function timestamp(raw) {
+	if (typeof raw !== "number" || !Number.isSafeInteger(raw) || raw <= 0) throw invalid();
+	return raw;
+}
+function invalid() {
+	return /* @__PURE__ */ new Error("Relocation challenge is invalid or expired");
+}
+function region(raw) {
+	switch (raw) {
+		case "US":
+		case "WEUR":
+		case "APAC":
+		case "OC": return raw;
+		default: throw invalid();
+	}
+}
+//#endregion
+export { D1WalletRelocationChallenges, WalletRelocationChallengeBinding };
+
+//# sourceMappingURL=d1WalletRelocationChallenges.js.map

package/dist/esm/router/cloudflare/d1/wallet/d1WalletRelocationEmailOtp.js

@@ -0,0 +1,60 @@
+import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import { sha256Utf8DigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
+import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_RELOCATION_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
+import { readWalletRelocationOwner } from "./d1WalletRelocationOwner.js";
+import { D1WalletRelocationChallenges } from "./d1WalletRelocationChallenges.js";
+//#region src/router/cloudflare/d1/wallet/d1WalletRelocationEmailOtp.ts
+async function walletRelocationEmailOtpBinding(scope, binding, challengeB64u) {
+	return sha256Utf8DigestB64u(JSON.stringify([
+		"seams/wallet-relocation-email-otp/v1",
+		scope.namespace,
+		scope.orgId,
+		scope.projectId,
+		scope.envId,
+		binding.encoded(),
+		challengeB64u
+	]));
+}
+async function verifyWalletRelocationEmailOtp(input) {
+	const challenges = new D1WalletRelocationChallenges(input.database, input.scope);
+	const challenge = await challenges.read(input.binding);
+	if (!challenge || challenge.state !== "issued" || !Number.isSafeInteger(input.nowMs) || input.nowMs < challenge.createdAtMs || input.nowMs >= challenge.expiresAtMs) return { kind: "denied" };
+	const owner = await readWalletRelocationOwner(input.database, input.scope, input.binding);
+	if (!owner || owner.method.kind !== "email_otp") return { kind: "denied" };
+	const enrollment = await input.verifier.readEnrollmentForWallet(input.binding.walletId);
+	if (!enrollment || enrollment.walletId !== input.binding.walletId || enrollment.orgId !== input.scope.orgId || await sha256HexUtf8(enrollment.verifiedEmail) !== owner.method.emailHashHex) return { kind: "denied" };
+	const otp = await input.emailOtpChallenges.read(input.challengeId);
+	if (!otp || otp.createdAtMs < challenge.createdAtMs || otp.createdAtMs > input.nowMs || otp.expiresAtMs < challenge.expiresAtMs) return { kind: "denied" };
+	const ownerProofBindingDigest = await walletRelocationEmailOtpBinding(input.scope, input.binding, challenge.challengeB64u);
+	const verified = await input.verifier.verifyExistingForBatch({
+		userId: enrollment.providerUserId,
+		walletId: input.binding.walletId,
+		orgId: input.scope.orgId,
+		challengeId: input.challengeId,
+		otpCode: input.otpCode,
+		otpChannel: EMAIL_OTP_CHANNEL,
+		ownerProofBindingDigest,
+		action: WALLET_EMAIL_OTP_ACTIONS.relocation,
+		operation: WALLET_EMAIL_OTP_RELOCATION_OPERATION
+	});
+	if (!verified.ok || verified.consumeInBatch.length === 0) return { kind: "denied" };
+	return {
+		kind: "verified",
+		authorityDigestB64u: owner.authority.authorityDigestB64u,
+		authorityRevocationEpoch: owner.authority.revocationEpoch,
+		commitPrerequisites: [
+			...owner.commitPrerequisites,
+			input.database.prepare(`UPDATE email_otp_wallet_enrollments SET updated_at_ms = updated_at_ms
+        WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
+          AND wallet_id = ? AND provider_user_id = ? AND record_org_id = ? AND verified_email = ?`).bind(input.scope.namespace, input.scope.orgId, input.scope.projectId, input.scope.envId, input.binding.walletId, enrollment.providerUserId, enrollment.orgId, enrollment.verifiedEmail),
+			input.database.prepare(D1_BATCH_CAS_GUARD_SQL),
+			...verified.consumeInBatch,
+			...challenges.prepareConsume(challenge, input.nowMs)
+		]
+	};
+}
+//#endregion
+export { verifyWalletRelocationEmailOtp, walletRelocationEmailOtpBinding };
+
+//# sourceMappingURL=d1WalletRelocationEmailOtp.js.map

package/dist/esm/router/cloudflare/d1/wallet/d1WalletRelocationOwner.js

@@ -0,0 +1,33 @@
+import { buildDelegatedWalletAuthorityV1, buildFullOwnerPermissionsV1, sameDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
+import { D1WalletAuthMethodStore } from "../../../../core/d1WalletAuthMethodStore.js";
+import { D1WalletAuthorityStore } from "./d1WalletAuthorityStore.js";
+//#region src/router/cloudflare/d1/wallet/d1WalletRelocationOwner.ts
+async function readWalletRelocationOwner(database, scope, binding) {
+	const methods = new D1WalletAuthMethodStore({
+		database,
+		...scope,
+		ensureSchema: false
+	});
+	const method = await methods.readByIdV2({ walletAuthMethodId: binding.walletAuthMethodId });
+	if (!method || method.status !== "active" || method.walletId !== binding.walletId || method.walletAuthorityId !== binding.authorityId) return null;
+	const authority = await new D1WalletAuthorityStore({
+		database,
+		scope
+	}).readById(method.walletAuthorityId);
+	if (!authority || authority.state !== "active" || authority.walletId !== binding.walletId || !sameDelegatedWalletAuthorityV1(buildDelegatedWalletAuthorityV1({ permissions: authority.permissions }), buildDelegatedWalletAuthorityV1({ permissions: buildFullOwnerPermissionsV1() }))) return null;
+	return {
+		method,
+		authority,
+		commitPrerequisites: methods.prepareActiveV2SourceGuardStatements({
+			walletId: binding.walletId,
+			walletAuthMethodId: method.walletAuthMethodId,
+			walletAuthorityId: method.walletAuthorityId,
+			authorityDigestB64u: authority.authorityDigestB64u,
+			authorityRevocationEpoch: authority.revocationEpoch
+		})
+	};
+}
+//#endregion
+export { readWalletRelocationOwner };
+
+//# sourceMappingURL=d1WalletRelocationOwner.js.map

package/dist/esm/router/cloudflare/d1/wallet/d1WalletRelocationOwnerRequest.js

@@ -0,0 +1,74 @@
+import { buildDelegatedWalletAuthorityV1, buildFullOwnerPermissionsV1, sameDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
+import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import { buildWalletSessionCapabilitySubjectsV1, parseSessionOrigin, walletSessionCapabilitySubjectsV1Equal } from "../../../../authorization/domain.js";
+import { digestOpaqueValue } from "../../../../authorization/service.js";
+import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
+import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";
+import { WalletRelocationChallengeBinding } from "./d1WalletRelocationChallenges.js";
+//#region src/router/cloudflare/d1/wallet/d1WalletRelocationOwnerRequest.ts
+var WalletRelocationOwnerRequest = class WalletRelocationOwnerRequest {
+	#credentialDigestHex;
+	constructor(walletId, authorityId, walletAuthMethodId, credentialExpiresAtMs, origin, credentialDigestHex, scope, tenantId, authorizationId, credentialHash) {
+		this.walletId = walletId;
+		this.authorityId = authorityId;
+		this.walletAuthMethodId = walletAuthMethodId;
+		this.credentialExpiresAtMs = credentialExpiresAtMs;
+		this.origin = origin;
+		this.scope = scope;
+		this.tenantId = tenantId;
+		this.authorizationId = authorizationId;
+		this.credentialHash = credentialHash;
+		this.#credentialDigestHex = credentialDigestHex;
+		Object.freeze(this);
+	}
+	static async authenticate(input) {
+		if (!Number.isSafeInteger(input.nowMs) || input.nowMs <= 0) return null;
+		const token = extractBearerCredential(input.request.headers);
+		if (!token) return null;
+		let origin;
+		try {
+			origin = parseSessionOrigin(input.request.headers.get("origin"));
+		} catch {
+			return null;
+		}
+		if (!input.allowedOrigins.includes(origin)) return null;
+		const context = await input.authorizationSessions.readWalletSessionExactOperationContextByCredential({
+			tenantId: input.tenantId,
+			token,
+			nowMs: input.nowMs
+		});
+		if (!context) return null;
+		const { session, authority, ownerWalletScope } = context;
+		if (session.walletId !== input.walletId || session.tenantId !== input.tenantId || ownerWalletScope.orgId !== input.scope.orgId || ownerWalletScope.projectId !== input.scope.projectId || ownerWalletScope.projectEnvironmentId !== input.scope.envId || !sameDelegatedWalletAuthorityV1(buildDelegatedWalletAuthorityV1({ permissions: authority.permissions }), buildDelegatedWalletAuthorityV1({ permissions: buildFullOwnerPermissionsV1() })) || !walletSessionCapabilitySubjectsV1Equal(session.capabilitySubjects, buildWalletSessionCapabilitySubjectsV1(authority))) return null;
+		return new WalletRelocationOwnerRequest(session.walletId, session.authorityId, session.walletAuthMethodId, session.expiresAtMs, origin, await sha256HexUtf8(token), Object.freeze({ ...input.scope }), session.tenantId, session.authorizationId, await digestOpaqueValue(token));
+	}
+	prepareApprovalGuard(database, scope, binding, nowMs) {
+		if (scope.namespace !== this.scope.namespace || scope.orgId !== this.scope.orgId || scope.projectId !== this.scope.projectId || scope.envId !== this.scope.envId || this.bindMove(binding).encoded() !== binding.encoded()) throw new Error("Relocation approval owner binding changed");
+		return [database.prepare(`UPDATE wallet_session_authorizations_v2
+        SET retired_at_ms = retired_at_ms
+        WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+          AND tenant_id = ?5 AND authorization_id = ?6
+          AND wallet_id = ?7 AND authority_id = ?8 AND wallet_auth_method_id = ?9
+          AND operation_credential_hash = ?10 AND expires_at_ms = ?11
+          AND retired_at_ms IS NULL AND expires_at_ms > ?12
+          AND expires_at_ms > CAST(unixepoch('subsec') * 1000 AS INTEGER)`).bind(scope.namespace, scope.orgId, scope.projectId, scope.envId, this.tenantId, this.authorizationId, this.walletId, this.authorityId, this.walletAuthMethodId, this.credentialHash, this.credentialExpiresAtMs, nowMs), database.prepare(D1_BATCH_CAS_GUARD_SQL)];
+	}
+	bindMove(input) {
+		return WalletRelocationChallengeBinding.parse({
+			walletId: this.walletId,
+			moveId: input.moveId,
+			requestDigestHex: input.requestDigestHex,
+			sourceGeneration: input.sourceGeneration,
+			destinationRegion: input.destinationRegion,
+			authorityId: this.authorityId,
+			walletAuthMethodId: this.walletAuthMethodId,
+			credentialDigestHex: this.#credentialDigestHex,
+			credentialExpiresAtMs: this.credentialExpiresAtMs,
+			origin: this.origin
+		});
+	}
+};
+//#endregion
+export { WalletRelocationOwnerRequest };
+
+//# sourceMappingURL=d1WalletRelocationOwnerRequest.js.map

package/dist/esm/router/cloudflare/d1/wallet/d1WalletRelocationPasskey.js

@@ -0,0 +1,77 @@
+import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
+import { decodeWebAuthnBase64UrlOrBase64, parseWebAuthnAuthenticationCredential, webAuthnCredentialIdB64uFromCredential } from "../../../auth/webAuthnCredentialCodecs.js";
+import { CloudflareD1WebAuthnStore } from "../webauthn/d1WebAuthnStore.js";
+import { d1HostIsWithinWebAuthnRpId } from "./d1WalletAuthMethodBoundary.js";
+import { readWalletRelocationOwner } from "./d1WalletRelocationOwner.js";
+import { D1WalletRelocationChallenges } from "./d1WalletRelocationChallenges.js";
+import { verifyAuthenticationResponse } from "@simplewebauthn/server";
+//#region src/router/cloudflare/d1/wallet/d1WalletRelocationPasskey.ts
+async function verifyWalletRelocationPasskey(input) {
+	const challenges = new D1WalletRelocationChallenges(input.database, input.scope);
+	const challenge = await challenges.read(input.binding);
+	if (!challenge || challenge.state !== "issued" || !Number.isSafeInteger(input.nowMs) || input.nowMs < challenge.createdAtMs || input.nowMs >= challenge.expiresAtMs) return { kind: "denied" };
+	const credential = parseWebAuthnAuthenticationCredential(input.credential);
+	if (!credential) return { kind: "denied" };
+	const credentialId = webAuthnCredentialIdB64uFromCredential(credential);
+	if (!credentialId.ok) return { kind: "denied" };
+	const owner = await readWalletRelocationOwner(input.database, input.scope, input.binding);
+	if (!owner || owner.method.kind !== "passkey") return { kind: "denied" };
+	const { method, authority } = owner;
+	if (method.credentialIdB64u !== credentialId.credentialIdB64u || !d1HostIsWithinWebAuthnRpId(new URL(input.binding.origin).hostname, method.rpId)) return { kind: "denied" };
+	const authenticator = await new CloudflareD1WebAuthnStore({
+		database: input.database,
+		...input.scope
+	}).readAuthenticator({
+		userId: method.walletId,
+		credentialIdB64u: method.credentialIdB64u
+	});
+	if (!authenticator || authenticator.credentialPublicKeyB64u !== method.credentialPublicKeyB64u) return { kind: "denied" };
+	let newCounter;
+	try {
+		const verification = await verifyAuthenticationResponse({
+			response: {
+				id: credential.id,
+				rawId: credential.rawId,
+				type: "public-key",
+				clientExtensionResults: {},
+				response: {
+					clientDataJSON: credential.response.clientDataJSON,
+					authenticatorData: credential.response.authenticatorData,
+					signature: credential.response.signature,
+					...credential.response.userHandle === null ? {} : { userHandle: credential.response.userHandle }
+				}
+			},
+			expectedChallenge: challenge.challengeB64u,
+			expectedOrigin: input.binding.origin,
+			expectedRPID: method.rpId,
+			credential: {
+				id: method.credentialIdB64u,
+				publicKey: decodeWebAuthnBase64UrlOrBase64(method.credentialPublicKeyB64u, "passkey public key"),
+				counter: authenticator.counter
+			},
+			requireUserVerification: true
+		});
+		if (!verification.verified) return { kind: "denied" };
+		newCounter = verification.authenticationInfo.newCounter;
+	} catch {
+		return { kind: "denied" };
+	}
+	return {
+		kind: "verified",
+		authorityDigestB64u: authority.authorityDigestB64u,
+		authorityRevocationEpoch: authority.revocationEpoch,
+		commitPrerequisites: [
+			...owner.commitPrerequisites,
+			input.database.prepare(`UPDATE webauthn_authenticators SET counter = ?, updated_at_ms = ?
+        WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
+          AND user_id = ? AND credential_id_b64u = ? AND counter = ?
+          AND credential_public_key_b64u = ?`).bind(newCounter, input.nowMs, input.scope.namespace, input.scope.orgId, input.scope.projectId, input.scope.envId, method.walletId, method.credentialIdB64u, authenticator.counter, authenticator.credentialPublicKeyB64u),
+			input.database.prepare(D1_BATCH_CAS_GUARD_SQL),
+			...challenges.prepareConsume(challenge, input.nowMs)
+		]
+	};
+}
+//#endregion
+export { verifyWalletRelocationPasskey };
+
+//# sourceMappingURL=d1WalletRelocationPasskey.js.map

package/dist/esm/router/cloudflare/d1/wallet/d1WalletRelocationReadAccess.js

@@ -0,0 +1,37 @@
+import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import { parseSessionOrigin } from "../../../../authorization/domain.js";
+import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";
+import { readWalletRelocationOwner } from "./d1WalletRelocationOwner.js";
+import { D1WalletRelocationApprovals } from "./d1WalletRelocationApprovals.js";
+//#region src/router/cloudflare/d1/wallet/d1WalletRelocationReadAccess.ts
+var WalletRelocationReadAccess = class WalletRelocationReadAccess {
+	#binding;
+	constructor(binding) {
+		this.#binding = binding;
+		Object.freeze(this);
+	}
+	static async authenticate(input) {
+		if (!Number.isSafeInteger(input.nowMs) || input.nowMs <= 0) return null;
+		const token = extractBearerCredential(input.request.headers);
+		if (!token) return null;
+		let origin;
+		try {
+			origin = parseSessionOrigin(input.request.headers.get("origin"));
+		} catch {
+			return null;
+		}
+		if (origin !== input.binding.origin || !input.allowedOrigins.includes(origin) || input.nowMs >= input.binding.credentialExpiresAtMs || await sha256HexUtf8(token) !== input.binding.credentialDigestHex) return null;
+		const approval = await new D1WalletRelocationApprovals(input.database, input.scope).read(input.binding);
+		if (!approval || approval.approvedAtMs > input.nowMs) return null;
+		const owner = await readWalletRelocationOwner(input.database, input.scope, input.binding);
+		if (!owner || owner.authority.authorityDigestB64u !== approval.authorityDigestB64u || owner.authority.revocationEpoch !== approval.authorityRevocationEpoch) return null;
+		return new WalletRelocationReadAccess(input.binding);
+	}
+	get binding() {
+		return this.#binding;
+	}
+};
+//#endregion
+export { WalletRelocationReadAccess };
+
+//# sourceMappingURL=d1WalletRelocationReadAccess.js.map