@seams/wallet-server 0.5.0

package/dist/esm/core/d1WalletAuthMethodStore.js

@@ -0,0 +1,768 @@
+import { parseWebAuthnRpId } from "../shared-ts/src/utils/domainIds.js";
+import { parseWalletAuthMethodRecordV2, walletAuthMethodRecordId, walletIdFromString } from "../shared-ts/src/utils/registrationIntent.js";
+import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
+import "../shared-ts/src/utils/validation.js";
+import { formatD1ExecStatement, parseD1JsonColumn } from "../storage/d1Sql.js";
+//#region src/core/d1WalletAuthMethodStore.ts
+const WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL = Object.freeze([
+	`
+    CREATE TABLE IF NOT EXISTS wallet_auth_methods (
+      namespace TEXT NOT NULL,
+      org_id TEXT NOT NULL,
+      project_id TEXT NOT NULL,
+      env_id TEXT NOT NULL,
+      wallet_id TEXT NOT NULL,
+      rp_id TEXT NOT NULL DEFAULT '',
+      kind TEXT NOT NULL,
+      status TEXT NOT NULL,
+      wallet_auth_method_id TEXT NOT NULL,
+      auth_identifier_key TEXT NOT NULL,
+      credential_id_b64u TEXT,
+      credential_public_key_b64u TEXT,
+      email_hash_hex TEXT,
+      registration_authority_id TEXT,
+      record_json TEXT NOT NULL,
+      created_at_ms INTEGER NOT NULL,
+      updated_at_ms INTEGER NOT NULL,
+      PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_auth_method_id),
+      CHECK (length(wallet_id) > 0),
+      CHECK (kind IN ('passkey', 'email_otp')),
+      CHECK (status IN ('active', 'revoked')),
+      CHECK (length(wallet_auth_method_id) > 0),
+      CHECK (length(auth_identifier_key) > 0),
+      CHECK (json_valid(record_json)),
+      CHECK (created_at_ms >= 0),
+      CHECK (updated_at_ms >= created_at_ms),
+      CHECK (
+        (
+          kind = 'passkey'
+          AND length(rp_id) > 0
+          AND credential_id_b64u IS NOT NULL
+          AND length(credential_id_b64u) > 0
+          AND credential_public_key_b64u IS NOT NULL
+          AND length(credential_public_key_b64u) > 0
+          AND email_hash_hex IS NULL
+          AND registration_authority_id IS NULL
+          AND auth_identifier_key = credential_id_b64u
+          AND wallet_auth_method_id = 'passkey:' || rp_id || ':' || credential_id_b64u
+        )
+        OR
+        (
+          kind = 'email_otp'
+          AND rp_id = ''
+          AND credential_id_b64u IS NULL
+          AND credential_public_key_b64u IS NULL
+          AND email_hash_hex IS NOT NULL
+          AND length(email_hash_hex) > 0
+          AND registration_authority_id IS NOT NULL
+          AND length(registration_authority_id) > 0
+          AND auth_identifier_key = email_hash_hex
+          AND wallet_auth_method_id = 'email_otp:' || wallet_id || ':' || email_hash_hex
+        )
+      )
+    )
+  `,
+	`
+    CREATE INDEX IF NOT EXISTS wallet_auth_methods_wallet_idx
+      ON wallet_auth_methods (
+        namespace,
+        org_id,
+        project_id,
+        env_id,
+        wallet_id,
+        rp_id,
+        status
+      )
+  `,
+	`
+    CREATE INDEX IF NOT EXISTS wallet_auth_methods_identifier_idx
+      ON wallet_auth_methods (
+        namespace,
+        org_id,
+        project_id,
+        env_id,
+        kind,
+        auth_identifier_key
+      )
+  `,
+	`
+    CREATE UNIQUE INDEX IF NOT EXISTS wallet_auth_methods_passkey_uidx
+      ON wallet_auth_methods (
+        namespace,
+        org_id,
+        project_id,
+        env_id,
+        rp_id,
+        credential_id_b64u
+      )
+      WHERE kind = 'passkey' AND credential_id_b64u IS NOT NULL
+  `,
+	`
+    CREATE UNIQUE INDEX IF NOT EXISTS wallet_auth_methods_email_uidx
+      ON wallet_auth_methods (
+        namespace,
+        org_id,
+        project_id,
+        env_id,
+        wallet_id,
+        email_hash_hex
+      )
+      WHERE kind = 'email_otp' AND email_hash_hex IS NOT NULL
+  `
+]);
+/**
+* The authority-owned table shape is kept separate from the historical
+* create-if-missing schema above. Deployments apply 0007 before using these
+* statements; keeping the SQL here lets focused D1 tests provision the V2
+* table without copying migration text into a test.
+*/
+const WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL = Object.freeze([
+	`
+    CREATE TABLE IF NOT EXISTS wallet_auth_methods (
+      namespace TEXT NOT NULL,
+      org_id TEXT NOT NULL,
+      project_id TEXT NOT NULL,
+      env_id TEXT NOT NULL,
+      wallet_id TEXT NOT NULL,
+      wallet_authority_id TEXT NOT NULL,
+      rp_id TEXT NOT NULL DEFAULT '',
+      kind TEXT NOT NULL,
+      status TEXT NOT NULL,
+      wallet_auth_method_id TEXT NOT NULL,
+      auth_identifier_key TEXT NOT NULL,
+      credential_id_b64u TEXT,
+      credential_public_key_b64u TEXT,
+      email_hash_hex TEXT,
+      registration_authority_id TEXT,
+      record_json TEXT NOT NULL,
+      created_at_ms INTEGER NOT NULL,
+      updated_at_ms INTEGER NOT NULL,
+      activated_at_ms INTEGER,
+      revoked_at_ms INTEGER,
+      PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_auth_method_id),
+      FOREIGN KEY (
+        namespace,
+        org_id,
+        project_id,
+        env_id,
+        wallet_authority_id
+      ) REFERENCES wallet_authorities(
+        namespace,
+        org_id,
+        project_id,
+        env_id,
+        authority_id
+      ),
+      CHECK (length(wallet_id) > 0),
+      CHECK (length(wallet_authority_id) > 0),
+      CHECK (kind IN ('passkey', 'email_otp')),
+      CHECK (status IN ('pending_local_install', 'active', 'revoked')),
+      CHECK (length(wallet_auth_method_id) > 0),
+      CHECK (length(auth_identifier_key) > 0),
+      CHECK (json_valid(record_json)),
+      CHECK (created_at_ms >= 0),
+      CHECK (updated_at_ms >= created_at_ms),
+      CHECK (
+        (status = 'pending_local_install' AND activated_at_ms IS NULL AND revoked_at_ms IS NULL)
+        OR
+        (status = 'active' AND activated_at_ms IS NOT NULL AND revoked_at_ms IS NULL)
+        OR
+        (status = 'revoked' AND activated_at_ms IS NOT NULL AND revoked_at_ms IS NOT NULL)
+      ),
+      CHECK (
+        (kind = 'passkey'
+          AND length(rp_id) > 0
+          AND credential_id_b64u IS NOT NULL
+          AND length(credential_id_b64u) > 0
+          AND credential_public_key_b64u IS NOT NULL
+          AND length(credential_public_key_b64u) > 0
+          AND email_hash_hex IS NULL
+          AND registration_authority_id IS NULL
+          AND auth_identifier_key = credential_id_b64u)
+        OR
+        (kind = 'email_otp'
+          AND rp_id = ''
+          AND credential_id_b64u IS NULL
+          AND credential_public_key_b64u IS NULL
+          AND email_hash_hex IS NOT NULL
+          AND length(email_hash_hex) > 0
+          AND registration_authority_id IS NOT NULL
+          AND length(registration_authority_id) > 0
+          AND auth_identifier_key = email_hash_hex)
+      ),
+      CHECK (json_extract(record_json, '$.version') = 'wallet_auth_method_v2'),
+      CHECK (json_extract(record_json, '$.walletAuthMethodId') = wallet_auth_method_id),
+      CHECK (json_extract(record_json, '$.walletId') = wallet_id),
+      CHECK (json_extract(record_json, '$.walletAuthorityId') = wallet_authority_id),
+      CHECK (json_extract(record_json, '$.kind') = kind),
+      CHECK (json_extract(record_json, '$.status') = status),
+      CHECK (json_extract(record_json, '$.createdAtMs') = created_at_ms),
+      CHECK (json_extract(record_json, '$.updatedAtMs') = updated_at_ms),
+      CHECK (
+        (kind = 'passkey'
+          AND json_extract(record_json, '$.rpId') = rp_id
+          AND json_extract(record_json, '$.credentialIdB64u') = credential_id_b64u
+          AND json_extract(record_json, '$.credentialPublicKeyB64u') = credential_public_key_b64u
+          AND json_extract(record_json, '$.counter') >= 0)
+        OR
+        (kind = 'email_otp'
+          AND json_extract(record_json, '$.emailHashHex') = email_hash_hex
+          AND json_extract(record_json, '$.registrationAuthorityId') = registration_authority_id)
+      )
+    )
+  `,
+	`
+    CREATE INDEX IF NOT EXISTS wallet_auth_methods_wallet_authority_status_idx
+      ON wallet_auth_methods (
+        namespace,
+        org_id,
+        project_id,
+        env_id,
+        wallet_id,
+        wallet_authority_id,
+        status
+      )
+  `,
+	`
+    CREATE UNIQUE INDEX IF NOT EXISTS wallet_auth_methods_v2_passkey_uidx
+      ON wallet_auth_methods (
+        namespace,
+        org_id,
+        project_id,
+        env_id,
+        rp_id,
+        credential_id_b64u
+      )
+      WHERE kind = 'passkey' AND credential_id_b64u IS NOT NULL
+  `
+]);
+async function ensureWalletAuthMethodStoreD1Schema(options) {
+	for (const statement of WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL) await options.database.exec(formatD1ExecStatement(statement));
+}
+async function ensureWalletAuthMethodStoreD1SchemaV2(options) {
+	for (const statement of WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL) await options.database.exec(formatD1ExecStatement(statement));
+}
+function isObject(value) {
+	return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+function trimString(value) {
+	return typeof value === "string" ? value.trim() : "";
+}
+function walletAuthMethodId(record) {
+	return walletAuthMethodRecordId(record);
+}
+function normalizeWalletAuthMethod(raw) {
+	if (!isObject(raw)) return null;
+	const version = trimString(raw.version);
+	const kind = trimString(raw.kind);
+	const status = trimString(raw.status);
+	const walletId = walletIdFromString(trimString(raw.walletId));
+	const rpId = trimString(raw.rpId);
+	const createdAtMs = Math.floor(Number(raw.createdAtMs));
+	const updatedAtMs = Math.floor(Number(raw.updatedAtMs));
+	if (version !== "wallet_auth_method_v1" || kind !== "passkey" && kind !== "email_otp" || status !== "active" && status !== "revoked" || !walletId || !Number.isSafeInteger(createdAtMs) || !Number.isSafeInteger(updatedAtMs)) return null;
+	if (kind === "passkey") {
+		const parsedRpId = parseWebAuthnRpId(raw.rpId);
+		if (!parsedRpId.ok) return null;
+		const credentialIdB64u = trimString(raw.credentialIdB64u);
+		const credentialPublicKeyB64u = trimString(raw.credentialPublicKeyB64u);
+		const counter = Math.floor(Number(raw.counter));
+		if (!credentialIdB64u || !credentialPublicKeyB64u || !Number.isSafeInteger(counter)) return null;
+		return {
+			version: "wallet_auth_method_v1",
+			kind: "passkey",
+			status,
+			walletId,
+			rpId: parsedRpId.value,
+			credentialIdB64u,
+			credentialPublicKeyB64u,
+			counter,
+			createdAtMs,
+			updatedAtMs
+		};
+	}
+	if (rpId) return null;
+	const emailHashHex = trimString(raw.emailHashHex);
+	const registrationAuthorityId = trimString(raw.registrationAuthorityId);
+	if (!emailHashHex || !registrationAuthorityId) return null;
+	return {
+		version: "wallet_auth_method_v1",
+		kind: "email_otp",
+		status,
+		walletId,
+		emailHashHex,
+		registrationAuthorityId,
+		createdAtMs,
+		updatedAtMs
+	};
+}
+function normalizeWalletAuthMethodV2(raw) {
+	return parseWalletAuthMethodRecordV2(raw);
+}
+function walletAuthMethodV2Id(record) {
+	return record.walletAuthMethodId;
+}
+function bindWalletAuthMethodIdentityV2(record) {
+	switch (record.kind) {
+		case "passkey": return {
+			rpId: String(record.rpId),
+			authIdentifierKey: String(record.credentialIdB64u),
+			credentialIdB64u: String(record.credentialIdB64u),
+			credentialPublicKeyB64u: record.credentialPublicKeyB64u,
+			emailHashHex: null,
+			registrationAuthorityId: null,
+			activatedAtMs: record.status === "pending_local_install" ? null : record.activatedAtMs,
+			revokedAtMs: record.status === "revoked" ? record.revokedAtMs : null
+		};
+		case "email_otp": return {
+			rpId: "",
+			authIdentifierKey: record.emailHashHex,
+			credentialIdB64u: null,
+			credentialPublicKeyB64u: null,
+			emailHashHex: record.emailHashHex,
+			registrationAuthorityId: record.registrationAuthorityId,
+			activatedAtMs: record.status === "pending_local_install" ? null : record.activatedAtMs,
+			revokedAtMs: record.status === "revoked" ? record.revokedAtMs : null
+		};
+	}
+}
+function walletAuthMethodV2IdentityColumns(record) {
+	const identity = bindWalletAuthMethodIdentityV2(record);
+	return {
+		walletId: String(record.walletId),
+		walletAuthorityId: String(record.walletAuthorityId),
+		kind: record.kind,
+		walletAuthMethodId: String(record.walletAuthMethodId),
+		recordJson: JSON.stringify(record),
+		createdAtMs: record.createdAtMs,
+		updatedAtMs: record.updatedAtMs,
+		rpId: identity.rpId,
+		authIdentifierKey: identity.authIdentifierKey,
+		credentialIdB64u: identity.credentialIdB64u,
+		credentialPublicKeyB64u: identity.credentialPublicKeyB64u,
+		emailHashHex: identity.emailHashHex,
+		registrationAuthorityId: identity.registrationAuthorityId,
+		status: record.status,
+		activatedAtMs: identity.activatedAtMs,
+		revokedAtMs: identity.revokedAtMs
+	};
+}
+function prepareD1WalletAuthMethodV2PutStatement(input) {
+	const parsed = normalizeWalletAuthMethodV2(input.record);
+	if (!parsed) throw new Error("Invalid V2 wallet auth method record");
+	const columns = walletAuthMethodV2IdentityColumns(parsed);
+	const conflictClause = input.insertOnly ? "" : `
+      ON CONFLICT (namespace, org_id, project_id, env_id, wallet_auth_method_id)
+      DO UPDATE SET
+        wallet_id = EXCLUDED.wallet_id,
+        wallet_authority_id = EXCLUDED.wallet_authority_id,
+        rp_id = EXCLUDED.rp_id,
+        kind = EXCLUDED.kind,
+        status = EXCLUDED.status,
+        auth_identifier_key = EXCLUDED.auth_identifier_key,
+        credential_id_b64u = EXCLUDED.credential_id_b64u,
+        credential_public_key_b64u = EXCLUDED.credential_public_key_b64u,
+        email_hash_hex = EXCLUDED.email_hash_hex,
+        registration_authority_id = EXCLUDED.registration_authority_id,
+        record_json = EXCLUDED.record_json,
+        created_at_ms = MIN(wallet_auth_methods.created_at_ms, EXCLUDED.created_at_ms),
+        updated_at_ms = MAX(wallet_auth_methods.updated_at_ms, EXCLUDED.updated_at_ms),
+        activated_at_ms = EXCLUDED.activated_at_ms,
+        revoked_at_ms = EXCLUDED.revoked_at_ms`;
+	return input.database.prepare(`INSERT INTO wallet_auth_methods (
+        namespace,
+        org_id,
+        project_id,
+        env_id,
+        wallet_id,
+        wallet_authority_id,
+        rp_id,
+        kind,
+        status,
+        wallet_auth_method_id,
+        auth_identifier_key,
+        credential_id_b64u,
+        credential_public_key_b64u,
+        email_hash_hex,
+        registration_authority_id,
+        record_json,
+        created_at_ms,
+        updated_at_ms,
+        activated_at_ms,
+        revoked_at_ms
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ${conflictClause}`).bind(input.scope.namespace, input.scope.orgId, input.scope.projectId, input.scope.envId, columns.walletId, columns.walletAuthorityId, columns.rpId, columns.kind, columns.status, columns.walletAuthMethodId, columns.authIdentifierKey, columns.credentialIdB64u, columns.credentialPublicKeyB64u, columns.emailHashHex, columns.registrationAuthorityId, columns.recordJson, columns.createdAtMs, columns.updatedAtMs, columns.activatedAtMs, columns.revokedAtMs);
+}
+function requireD1ScopeString(input, field) {
+	const normalized = normalizeOptionalTrimmedString(input);
+	if (!normalized) throw new Error(`${field} is required for D1 wallet auth-method store`);
+	return normalized;
+}
+function normalizeD1WalletAuthMethodStoreOptions(input) {
+	return {
+		database: input.database,
+		namespace: requireD1ScopeString(input.namespace, "namespace"),
+		orgId: requireD1ScopeString(input.orgId, "orgId"),
+		projectId: requireD1ScopeString(input.projectId, "projectId"),
+		envId: requireD1ScopeString(input.envId, "envId"),
+		ensureSchema: input.ensureSchema !== false
+	};
+}
+function bindWalletAuthMethodIdentity(record) {
+	switch (record.kind) {
+		case "passkey": return {
+			rpId: record.rpId,
+			authIdentifierKey: record.credentialIdB64u,
+			credentialIdB64u: record.credentialIdB64u,
+			credentialPublicKeyB64u: record.credentialPublicKeyB64u,
+			emailHashHex: null,
+			registrationAuthorityId: null
+		};
+		case "email_otp": return {
+			rpId: "",
+			authIdentifierKey: record.emailHashHex,
+			credentialIdB64u: null,
+			credentialPublicKeyB64u: null,
+			emailHashHex: record.emailHashHex,
+			registrationAuthorityId: record.registrationAuthorityId
+		};
+		default: return assertNeverWalletAuthMethod(record);
+	}
+}
+function prepareD1WalletAuthMethodPutStatement(input) {
+	const parsed = normalizeWalletAuthMethod(input.record);
+	if (!parsed) throw new Error("Invalid wallet auth method record");
+	const identity = bindWalletAuthMethodIdentity(parsed);
+	return input.database.prepare(`INSERT INTO wallet_auth_methods (
+        namespace,
+        org_id,
+        project_id,
+        env_id,
+        wallet_id,
+        rp_id,
+        kind,
+        status,
+        wallet_auth_method_id,
+        auth_identifier_key,
+        credential_id_b64u,
+        credential_public_key_b64u,
+        email_hash_hex,
+        registration_authority_id,
+        record_json,
+        created_at_ms,
+        updated_at_ms
+      )
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT (namespace, org_id, project_id, env_id, wallet_auth_method_id)
+      DO UPDATE SET
+        wallet_id = EXCLUDED.wallet_id,
+        rp_id = EXCLUDED.rp_id,
+        kind = EXCLUDED.kind,
+        status = EXCLUDED.status,
+        auth_identifier_key = EXCLUDED.auth_identifier_key,
+        credential_id_b64u = EXCLUDED.credential_id_b64u,
+        credential_public_key_b64u = EXCLUDED.credential_public_key_b64u,
+        email_hash_hex = EXCLUDED.email_hash_hex,
+        registration_authority_id = EXCLUDED.registration_authority_id,
+        record_json = EXCLUDED.record_json,
+        created_at_ms = MIN(
+          wallet_auth_methods.created_at_ms,
+          EXCLUDED.created_at_ms
+        ),
+        updated_at_ms = MAX(
+          wallet_auth_methods.updated_at_ms,
+          EXCLUDED.updated_at_ms
+        )`).bind(input.scope.namespace, input.scope.orgId, input.scope.projectId, input.scope.envId, parsed.walletId, identity.rpId, parsed.kind, parsed.status, walletAuthMethodId(parsed), identity.authIdentifierKey, identity.credentialIdB64u, identity.credentialPublicKeyB64u, identity.emailHashHex, identity.registrationAuthorityId, JSON.stringify(parsed), parsed.createdAtMs, parsed.updatedAtMs);
+}
+/** Insert-only auth-method write used when a new factor and its envelope are
+* committed together. A credential collision must abort the enclosing D1
+* batch instead of updating an existing factor's identity. */
+function prepareD1WalletAuthMethodInsertStatement(input) {
+	const parsed = normalizeWalletAuthMethod(input.record);
+	if (!parsed) throw new Error("Invalid wallet auth method record");
+	const identity = bindWalletAuthMethodIdentity(parsed);
+	return input.database.prepare(`INSERT INTO wallet_auth_methods (
+        namespace,
+        org_id,
+        project_id,
+        env_id,
+        wallet_id,
+        rp_id,
+        kind,
+        status,
+        wallet_auth_method_id,
+        auth_identifier_key,
+        credential_id_b64u,
+        credential_public_key_b64u,
+        email_hash_hex,
+        registration_authority_id,
+        record_json,
+        created_at_ms,
+        updated_at_ms
+      )
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).bind(input.scope.namespace, input.scope.orgId, input.scope.projectId, input.scope.envId, parsed.walletId, identity.rpId, parsed.kind, parsed.status, walletAuthMethodId(parsed), identity.authIdentifierKey, identity.credentialIdB64u, identity.credentialPublicKeyB64u, identity.emailHashHex, identity.registrationAuthorityId, JSON.stringify(parsed), parsed.createdAtMs, parsed.updatedAtMs);
+}
+function assertNeverWalletAuthMethod(record) {
+	throw new Error(`Unexpected wallet auth method record: ${JSON.stringify(record)}`);
+}
+var D1WalletAuthMethodStore = class {
+	constructor(input) {
+		this.adapterKind = "d1";
+		this.schemaReady = false;
+		this.v2SchemaReady = false;
+		const normalized = normalizeD1WalletAuthMethodStoreOptions(input);
+		this.database = normalized.database;
+		this.scope = {
+			namespace: normalized.namespace,
+			orgId: normalized.orgId,
+			projectId: normalized.projectId,
+			envId: normalized.envId
+		};
+		this.ensureSchemaOnUse = normalized.ensureSchema;
+	}
+	async ensureSchema() {
+		if (!this.ensureSchemaOnUse || this.schemaReady) return;
+		await ensureWalletAuthMethodStoreD1Schema({ database: this.database });
+		this.schemaReady = true;
+	}
+	async ensureV2Schema() {
+		if (!this.ensureSchemaOnUse || this.v2SchemaReady) return;
+		await ensureWalletAuthMethodStoreD1SchemaV2({ database: this.database });
+		this.v2SchemaReady = true;
+	}
+	async put(record) {
+		await this.ensureSchema();
+		await prepareD1WalletAuthMethodPutStatement({
+			database: this.database,
+			scope: this.scope,
+			record
+		}).run();
+	}
+	/**
+	* Prepares the insert-only wallet auth-method mutation used by custody
+	* linking. The statement intentionally has no conflict handler; the unique
+	* credential index is part of the transaction's fail-closed boundary.
+	*/
+	preparePasskeyRegistrationStatements(record) {
+		if (record.kind !== "passkey" || record.status !== "active") throw new Error("Passkey registration statements require an active passkey record");
+		return [prepareD1WalletAuthMethodInsertStatement({
+			database: this.database,
+			scope: this.scope,
+			record
+		}), this.database.prepare(`
+      INSERT INTO router_ab_yao_versioned_json_cas_guard (guard_id)
+      SELECT 1
+       WHERE changes() = 0
+    `)];
+	}
+	async getPasskey(input) {
+		await this.ensureSchema();
+		const rpId = normalizeOptionalTrimmedString(input.rpId);
+		const credentialIdB64u = normalizeOptionalTrimmedString(input.credentialIdB64u);
+		if (!rpId || !credentialIdB64u) return null;
+		return normalizeWalletAuthMethod(parseD1JsonColumn((await this.database.prepare(`SELECT record_json
+           FROM wallet_auth_methods
+          WHERE namespace = ?
+            AND org_id = ?
+            AND project_id = ?
+            AND env_id = ?
+            AND wallet_auth_method_id = ?
+          LIMIT 1`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, `passkey:${rpId}:${credentialIdB64u}`).first())?.record_json));
+	}
+	async getEmailOtp(input) {
+		await this.ensureSchema();
+		const walletId = normalizeOptionalTrimmedString(input.walletId);
+		const emailHashHex = normalizeOptionalTrimmedString(input.emailHashHex);
+		if (!walletId || !emailHashHex) return null;
+		return normalizeWalletAuthMethod(parseD1JsonColumn((await this.database.prepare(`SELECT record_json
+           FROM wallet_auth_methods
+          WHERE namespace = ?
+            AND org_id = ?
+            AND project_id = ?
+            AND env_id = ?
+            AND wallet_auth_method_id = ?
+          LIMIT 1`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, `email_otp:${walletId}:${emailHashHex}`).first())?.record_json));
+	}
+	async listForWallet(input) {
+		await this.ensureSchema();
+		const walletId = normalizeOptionalTrimmedString(input.walletId);
+		if (!walletId) return [];
+		const rpId = normalizeOptionalTrimmedString(input.rpId);
+		const result = await this.database.prepare(`SELECT record_json
+           FROM wallet_auth_methods
+          WHERE namespace = ?
+            AND org_id = ?
+            AND project_id = ?
+            AND env_id = ?
+            AND wallet_id = ?
+            AND (kind = 'email_otp' OR ? = '' OR rp_id = ?)
+          ORDER BY created_at_ms ASC`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, walletId, rpId, rpId).all();
+		const records = [];
+		for (const row of result.results || []) {
+			const parsed = normalizeWalletAuthMethod(parseD1JsonColumn(row.record_json));
+			if (parsed) records.push(parsed);
+		}
+		return records;
+	}
+	async putV2(record) {
+		await this.ensureV2Schema();
+		await prepareD1WalletAuthMethodV2PutStatement({
+			database: this.database,
+			scope: this.scope,
+			record
+		}).run();
+	}
+	async insertActiveV2Atomically(input) {
+		await this.ensureV2Schema();
+		try {
+			const statements = [...input.prerequisiteStatements, ...this.prepareV2InsertStatements(input.record)];
+			const results = await this.database.batch(statements);
+			return results.length === statements.length && results.every((result) => result.success);
+		} catch {
+			return false;
+		}
+	}
+	prepareActiveV2SourceGuardStatements(input) {
+		if (!Number.isSafeInteger(input.authorityRevocationEpoch) || input.authorityRevocationEpoch < 0) throw new Error("Source authority revocation epoch is invalid");
+		return [this.database.prepare(`UPDATE wallet_auth_methods
+            SET updated_at_ms = updated_at_ms
+          WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
+            AND wallet_auth_method_id = ? AND wallet_id = ?
+            AND wallet_authority_id = ? AND status = 'active'
+            AND EXISTS (
+              SELECT 1
+                FROM wallet_authorities AS source_authority
+               WHERE source_authority.namespace = ?
+                 AND source_authority.org_id = ?
+                 AND source_authority.project_id = ?
+                 AND source_authority.env_id = ?
+                 AND source_authority.authority_id = ?
+                 AND source_authority.wallet_id = ?
+                 AND source_authority.lifecycle_state = 'active'
+                 AND source_authority.authority_digest_b64u = ?
+                 AND source_authority.revocation_epoch = ?
+            )`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, String(input.walletAuthMethodId), String(input.walletId), String(input.walletAuthorityId), this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, String(input.walletAuthorityId), String(input.walletId), String(input.authorityDigestB64u), input.authorityRevocationEpoch), this.database.prepare(`
+      INSERT INTO wallet_authority_cas_guard (guard_id)
+      SELECT 1
+       WHERE changes() = 0
+    `)];
+	}
+	/**
+	* Aborts the surrounding batch if the authority already holds an active
+	* method of this family.
+	*
+	* Refactor 109C's admission answers `already_configured` before a ceremony
+	* starts, but an admission read cannot close a race: two ceremonies can pass
+	* it concurrently and both insert. The auth-method insert's own guard covers
+	* only the allocated method id, and migration `0011` deliberately dropped
+	* the Email uniqueness index so linked devices could share one address, so
+	* nothing else in the batch enforces this.
+	*
+	* The idiom is the repo's existing CAS guard read backwards: the sibling
+	* SELECT normally matches nothing and the INSERT is a no-op, and when a
+	* sibling does exist it inserts `guard_id = 1` into a singleton table and
+	* collides, which aborts the batch.
+	*/
+	prepareActiveV2TargetFamilyAbsentGuardStatements(input) {
+		return [this.database.prepare(`INSERT INTO wallet_authority_cas_guard (guard_id)
+         SELECT 1
+          WHERE EXISTS (
+            SELECT 1
+              FROM wallet_auth_methods
+             WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
+               AND wallet_id = ? AND wallet_authority_id = ?
+               AND kind = ? AND status = 'active'
+          )`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, String(input.walletId), String(input.walletAuthorityId), input.kind)];
+	}
+	/**
+	* Prepares an insert-only active V2 method mutation. A credential or opaque
+	* method-id collision stays inside the surrounding transaction boundary.
+	*/
+	prepareV2InsertStatements(record) {
+		const parsed = normalizeWalletAuthMethodV2(record);
+		if (!parsed || parsed.status !== "active") throw new Error("V2 insert requires an active V2 auth-method record");
+		if (!String(parsed.walletAuthMethodId).startsWith("wallet-auth-method:")) throw new Error("V2 insert requires an opaque auth-method id");
+		return [prepareD1WalletAuthMethodV2PutStatement({
+			database: this.database,
+			scope: this.scope,
+			record: parsed,
+			insertOnly: true
+		}), this.database.prepare(`
+      INSERT INTO router_ab_yao_versioned_json_cas_guard (guard_id)
+      SELECT 1
+       WHERE changes() = 0
+    `)];
+	}
+	async readByIdV2(input) {
+		await this.ensureV2Schema();
+		return normalizeWalletAuthMethodV2(parseD1JsonColumn((await this.database.prepare(`SELECT record_json
+           FROM wallet_auth_methods
+          WHERE namespace = ?
+            AND org_id = ?
+            AND project_id = ?
+            AND env_id = ?
+            AND wallet_auth_method_id = ?
+          LIMIT 1`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, String(input.walletAuthMethodId)).first())?.record_json));
+	}
+	async getPasskeyV2(input) {
+		await this.ensureV2Schema();
+		const rpId = normalizeOptionalTrimmedString(input.rpId);
+		const credentialIdB64u = normalizeOptionalTrimmedString(input.credentialIdB64u);
+		if (!rpId || !credentialIdB64u) return null;
+		return normalizeWalletAuthMethodV2(parseD1JsonColumn((await this.database.prepare(`SELECT record_json
+           FROM wallet_auth_methods
+          WHERE namespace = ?
+            AND org_id = ?
+            AND project_id = ?
+            AND env_id = ?
+            AND kind = 'passkey'
+            AND rp_id = ?
+            AND credential_id_b64u = ?
+          ORDER BY created_at_ms ASC
+          LIMIT 1`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, rpId, credentialIdB64u).first())?.record_json));
+	}
+	async getEmailOtpV2(input) {
+		await this.ensureV2Schema();
+		const walletId = normalizeOptionalTrimmedString(input.walletId);
+		const emailHashHex = normalizeOptionalTrimmedString(input.emailHashHex);
+		if (!walletId || !emailHashHex) return null;
+		return normalizeWalletAuthMethodV2(parseD1JsonColumn((await this.database.prepare(`SELECT record_json
+           FROM wallet_auth_methods
+          WHERE namespace = ?
+            AND org_id = ?
+            AND project_id = ?
+            AND env_id = ?
+            AND kind = 'email_otp'
+            AND wallet_id = ?
+            AND email_hash_hex = ?
+          ORDER BY created_at_ms ASC
+          LIMIT 1`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, walletId, emailHashHex).first())?.record_json));
+	}
+	async listForWalletV2(input) {
+		await this.ensureV2Schema();
+		const walletId = normalizeOptionalTrimmedString(input.walletId);
+		if (!walletId) return [];
+		const authorityId = input.walletAuthorityId ? String(input.walletAuthorityId) : "";
+		const rpId = normalizeOptionalTrimmedString(input.rpId);
+		const result = await this.database.prepare(`SELECT record_json
+           FROM wallet_auth_methods
+          WHERE namespace = ?
+            AND org_id = ?
+            AND project_id = ?
+            AND env_id = ?
+            AND wallet_id = ?
+            AND (? = '' OR wallet_authority_id = ?)
+            AND (kind = 'email_otp' OR ? = '' OR rp_id = ?)
+          ORDER BY created_at_ms ASC, wallet_auth_method_id ASC`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, walletId, authorityId, authorityId, rpId, rpId).all();
+		const records = [];
+		for (const row of result.results || []) {
+			const parsed = normalizeWalletAuthMethodV2(parseD1JsonColumn(row.record_json));
+			if (parsed) records.push(parsed);
+		}
+		return records;
+	}
+};
+//#endregion
+export { D1WalletAuthMethodStore, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL, bindWalletAuthMethodIdentity, bindWalletAuthMethodIdentityV2, ensureWalletAuthMethodStoreD1Schema, ensureWalletAuthMethodStoreD1SchemaV2, normalizeWalletAuthMethod, normalizeWalletAuthMethodV2, prepareD1WalletAuthMethodInsertStatement, prepareD1WalletAuthMethodPutStatement, prepareD1WalletAuthMethodV2PutStatement, walletAuthMethodId, walletAuthMethodV2Id };
+
+//# sourceMappingURL=d1WalletAuthMethodStore.js.map