@seams/wallet-server 0.5.0

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthMethodService.js

@@ -0,0 +1,2018 @@
+import { parseChallengeSubjectId, parseEmailOtpChallengeId, parseOrgId, parseProviderSubject, parseWalletAuthMethodId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
+import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
+import "../../../../shared-ts/src/utils/encoders.js";
+import { buildDelegatedWalletAuthorityV1, buildFullOwnerPermissionsV1, sameDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
+import { parseWalletAddAuthMethodRegistrationOptions } from "../../../../shared-ts/src/utils/addAuthMethodRegistration.js";
+import { addAuthMethodIntentGrantFromString, buildWalletAuthMethodRecordV2, computeAddAuthMethodIntentDigestB64u, computeWalletAuthMethodRevokeOperationFingerprintV1, normalizeEmailOtpRegistrationProof } from "../../../../shared-ts/src/utils/registrationIntent.js";
+import { deriveWebAuthnAuthenticatorDeviceInfo } from "../../../../shared-ts/src/utils/webauthnDeviceInfo.js";
+import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
+import "../../../../shared-ts/src/utils/validation.js";
+import { normalizeRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
+import { buildEmailOtpWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
+import { PASSKEY_PRF_FIRST_SALT_V1, PASSKEY_PRF_SECOND_SALT_V1 } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
+import { parsePasskeyCustodyEnvelopeRecord } from "../../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
+import "../../../../shared-ts/src/passkey-custody/index.js";
+import { parseWebAuthnClientDataJsonBase64url, webAuthnOriginHostnameOrEmpty } from "../../../auth/webAuthnCredentialCodecs.js";
+import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
+import { resolveWalletAuthMethodIdForAuthority } from "../../../../core/signingLanes/WalletExecutionLaneProjection.js";
+import { toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";
+import { d1HostIsWithinWebAuthnRpId, resolveD1AddAuthMethodExistingAuth, resolveD1AddSignerExistingAuth, verifyD1LinkedDeviceFreshRevokeProofV1, walletAuthAuthorityFromRegistrationAuthority } from "./d1WalletAuthMethodBoundary.js";
+import { parseWalletIdForIntent } from "../registration/d1RegistrationCeremonyRecords.js";
+import { expiredGoogleEmailOtpRegistrationAttemptRecord, pendingGoogleEmailOtpRegistrationAttemptWithSelectedCandidate, runtimePolicyScopeKey } from "../emailOtp/d1GoogleEmailOtpRegistrationRecords.js";
+import { admitAddWalletAuthMethod } from "../../../../shared-ts/src/utils/addWalletAuthMethod.js";
+//#region src/router/cloudflare/d1/wallet/d1WalletAuthMethodService.ts
+/** Long enough for a device to retry across a reload, short of ceremony scale. */
+const ADD_AUTH_METHOD_FINALIZE_REPLAY_TTL_MS = 1440 * 60 * 1e3;
+function isPasskeyAddAuthMethodIntent(intent) {
+	return intent.authMethod.kind === "passkey";
+}
+function isEmailOtpAddAuthMethodIntent(intent) {
+	return intent.authMethod.kind === "email_otp";
+}
+function isActiveWalletAuthMethodRecordV2(record) {
+	return record.status === "active";
+}
+function requireStoredRpId(raw) {
+	const parsed = parseWebAuthnRpId(raw);
+	if (!parsed.ok) throw new Error("Stored passkey RP ID is invalid");
+	return parsed.value;
+}
+function requireStoredCredentialId(raw) {
+	const parsed = parseWebAuthnCredentialIdB64u(raw);
+	if (!parsed.ok) throw new Error("Stored passkey credential ID is invalid");
+	return parsed.value;
+}
+function errorMessage(error) {
+	return error instanceof Error ? error.message : String(error || "");
+}
+async function resolveActiveAddAuthMethodSource(input) {
+	const record = input.auth.kind === "email_otp" ? input.auth.authorityRef.walletId !== input.walletId ? null : await input.walletAuthMethodStore.readByIdV2({ walletAuthMethodId: input.auth.authorityRef.walletAuthMethodId }) : await input.walletAuthMethodStore.getPasskeyV2({
+		rpId: input.auth.rpId,
+		credentialIdB64u: input.auth.credentialIdB64u
+	});
+	if (!record || record.status !== "active" || record.walletId !== input.walletId) return null;
+	if (input.auth.kind === "email_otp") return record.kind === "email_otp" ? record : null;
+	return record.kind === "passkey" ? record : null;
+}
+function buildActiveAddedWalletAuthMethodV2(input) {
+	let record;
+	switch (input.authority.kind) {
+		case "passkey":
+			record = buildWalletAuthMethodRecordV2({
+				version: "wallet_auth_method_v2",
+				walletAuthMethodId: input.walletAuthMethodId,
+				walletId: input.authority.walletId,
+				walletAuthorityId: input.walletAuthorityId,
+				kind: "passkey",
+				status: "active",
+				rpId: input.authority.rpId,
+				credentialIdB64u: requireStoredCredentialId(input.authority.credentialIdB64u),
+				credentialPublicKeyB64u: input.authority.credentialPublicKeyB64u,
+				counter: input.authority.counter,
+				createdAtMs: input.now,
+				updatedAtMs: input.now,
+				activatedAtMs: input.now
+			});
+			break;
+		case "email_otp":
+			record = buildWalletAuthMethodRecordV2({
+				version: "wallet_auth_method_v2",
+				walletAuthMethodId: input.walletAuthMethodId,
+				walletId: input.authority.walletId,
+				walletAuthorityId: input.walletAuthorityId,
+				kind: "email_otp",
+				status: "active",
+				emailHashHex: input.authority.emailHashHex,
+				registrationAuthorityId: input.authority.registrationAuthorityId,
+				createdAtMs: input.now,
+				updatedAtMs: input.now,
+				activatedAtMs: input.now
+			});
+			break;
+		default: return unreachableRegistrationStartAuthority(input.authority);
+	}
+	if (record.status !== "active") throw new Error("Added wallet auth method must be active");
+	return record;
+}
+function bindEmailOtpAuthorityToMethod(authority, walletAuthMethodId) {
+	return {
+		walletId: authority.walletId,
+		factor: authority.factor,
+		verifier: authority.verifier,
+		bindingId: walletAuthMethodId
+	};
+}
+function isFullOwnerAuthorityV1(authority) {
+	return sameDelegatedWalletAuthorityV1(buildDelegatedWalletAuthorityV1({ permissions: authority.permissions }), buildDelegatedWalletAuthorityV1({ permissions: buildFullOwnerPermissionsV1() }));
+}
+function walletAuthMethodRevokedResponse(walletId, record) {
+	switch (record.kind) {
+		case "passkey": return {
+			ok: true,
+			walletId,
+			authMethod: {
+				kind: "passkey",
+				status: "revoked"
+			},
+			rpId: record.rpId
+		};
+		case "email_otp": return {
+			ok: true,
+			walletId,
+			authMethod: {
+				kind: "email_otp",
+				status: "revoked"
+			}
+		};
+		default: return unreachableRevokedMethodKind(record);
+	}
+}
+function bytesToHex(bytes) {
+	let hex = "";
+	for (const byte of bytes) hex += byte.toString(16).padStart(2, "0");
+	return hex;
+}
+function runtimePolicyScopeKeyForRegistrationIntent(input) {
+	try {
+		return runtimePolicyScopeKey(normalizeRuntimePolicyScope(input));
+	} catch {
+		return "";
+	}
+}
+function unreachableAddAuthMethodEmailOtpTarget(value) {
+	throw new Error(`Unhandled Email OTP add-auth-method target: ${String(value)}`);
+}
+function unreachableRevokedMethodKind(value) {
+	throw new Error(`Unhandled revoked wallet auth-method kind: ${String(value)}`);
+}
+function unreachableRegistrationStartAuthority(value) {
+	throw new Error(`Unhandled registration start authority kind: ${String(value)}`);
+}
+function custodyFactorFromAddAuthMethodAuth(auth) {
+	switch (auth.kind) {
+		case "webauthn_assertion": return {
+			kind: "passkey",
+			rpId: requireStoredRpId(auth.rpId),
+			credentialIdB64u: requireStoredCredentialId(auth.credentialIdB64u)
+		};
+		case "wallet_session": return {
+			kind: "passkey",
+			rpId: requireStoredRpId(auth.rpId),
+			credentialIdB64u: requireStoredCredentialId(auth.credentialIdB64u)
+		};
+		case "email_otp": return {
+			kind: "email_otp",
+			enrollmentId: auth.enrollmentId,
+			enrollmentSealKeyVersion: auth.enrollmentSealKeyVersion
+		};
+		default: return unreachableRegistrationStartAuthority(auth);
+	}
+}
+async function loadSimpleWebAuthnServer() {
+	try {
+		return await import("@simplewebauthn/server");
+	} catch (error) {
+		throw new Error(`Server WebAuthn route selected but '@simplewebauthn/server' dependency is not available: ${errorMessage(error) || "import failed"}`);
+	}
+}
+async function buildAddedPasskeyCredentialBinding(input) {
+	if (input.ceremony.auth.kind === "email_otp") {
+		const base = {
+			version: "webauthn_credential_binding_v1",
+			rpId: input.rpId,
+			credentialIdB64u: input.credentialIdB64u,
+			userId: String(input.walletId),
+			createdAtMs: input.now,
+			updatedAtMs: input.now
+		};
+		const [signer, ...remaining] = await input.listWalletEd25519Signers(input.walletId);
+		if (!signer) return base;
+		if (remaining.length > 0) throw new Error("Added passkey cannot resolve one exact wallet Ed25519 signer to bind against");
+		return {
+			...base,
+			nearAccountId: signer.nearAccountId,
+			nearEd25519SigningKeyId: signer.nearEd25519SigningKeyId,
+			signerSlot: signer.signerSlot,
+			publicKey: signer.publicKey,
+			relayerKeyId: signer.signingWorkerId,
+			keyVersion: signer.keyVersion,
+			recoveryExportCapable: signer.recoveryExportCapable,
+			clientParticipantId: signer.participantIds[0],
+			relayerParticipantId: signer.participantIds[1],
+			participantIds: [signer.participantIds[0], signer.participantIds[1]],
+			runtimePolicyScope: signer.runtimePolicyScope
+		};
+	}
+	const source = await input.webAuthnStore.readBindingByCredential({
+		rpId: input.ceremony.auth.rpId,
+		credentialIdB64u: input.ceremony.auth.credentialIdB64u
+	});
+	if (!source || source.userId !== input.walletId || !source.nearAccountId || !source.nearEd25519SigningKeyId || source.signerSlot === void 0 || !source.publicKey) throw new Error("Authorizing passkey binding is missing wallet identity fields");
+	const binding = {
+		version: "webauthn_credential_binding_v1",
+		rpId: input.rpId,
+		credentialIdB64u: input.credentialIdB64u,
+		userId: String(input.walletId),
+		nearAccountId: source.nearAccountId,
+		nearEd25519SigningKeyId: source.nearEd25519SigningKeyId,
+		signerSlot: source.signerSlot,
+		publicKey: source.publicKey,
+		createdAtMs: input.now,
+		updatedAtMs: input.now
+	};
+	if (source.relayerKeyId) binding.relayerKeyId = source.relayerKeyId;
+	if (source.keyVersion) binding.keyVersion = source.keyVersion;
+	if (typeof source.recoveryExportCapable === "boolean") binding.recoveryExportCapable = source.recoveryExportCapable;
+	if (source.clientParticipantId !== void 0) binding.clientParticipantId = source.clientParticipantId;
+	if (source.relayerParticipantId !== void 0) binding.relayerParticipantId = source.relayerParticipantId;
+	if (source.participantIds) binding.participantIds = source.participantIds.slice();
+	if (source.runtimePolicyScope) binding.runtimePolicyScope = source.runtimePolicyScope;
+	return binding;
+}
+var CloudflareD1WalletAuthMethodService = class {
+	constructor(input) {
+		this.emailOtpChallengeVerifier = input.emailOtpChallengeVerifier;
+		this.emailOtpEnrollmentChallengeIssuer = input.emailOtpEnrollmentChallengeIssuer;
+		this.emailOtpSourceChallengeIssuer = input.emailOtpSourceChallengeIssuer;
+		this.emailOtpEnrollmentFinalizer = input.emailOtpEnrollmentFinalizer;
+		this.getRegistrationCeremonyIntentStore = input.getRegistrationCeremonyIntentStore;
+		this.getWalletAuthMethodStore = input.getWalletAuthMethodStore;
+		this.googleEmailOtpRegistrationAttempts = input.googleEmailOtpRegistrationAttempts;
+		this.passkeyCustodyEnvelopes = input.passkeyCustodyEnvelopes;
+		this.sha256Bytes = input.sha256Bytes;
+		this.webAuthnStore = input.webAuthnStore;
+		this.listWalletEd25519Signers = input.listWalletEd25519Signers;
+		this.walletAuthorityStore = input.walletAuthorityStore;
+		this.orgId = input.orgId;
+		this.verifyWebAuthnAuthenticationLite = input.verifyWebAuthnAuthenticationLite;
+		this.prepareOwnerWalletSessionRevocation = input.prepareOwnerWalletSessionRevocation;
+	}
+	/**
+	* Sends the enrollment code for an Email OTP addition.
+	*
+	* The challenge is bound to the add-auth-method intent digest, because that
+	* is the value the start's verification checks the code against — the same
+	* digest the source proof signs. Binding it to anything else would issue a
+	* code the ceremony cannot accept.
+	*
+	* The address is the intent's, never the request's. A caller who could name
+	* the recipient would be able to send a wallet's enrollment code anywhere,
+	* and the intent grant is what proves this addition was authorized at all.
+	*/
+	/**
+	* The active methods on the authority this intent was issued against.
+	*
+	* The intent's own source names the authority, so admission can be answered
+	* before any factor is verified. A linked-device ceremony names no source;
+	* there the wallet's active methods are the honest answer, because the
+	* question is only whether the family already exists.
+	*/
+	async activeMethodsOnIntentAuthority(input) {
+		const active = (await this.getWalletAuthMethodStore().listForWalletV2({ walletId: input.walletId })).filter(isActiveWalletAuthMethodRecordV2);
+		const source = input.intent.caller === "same_device_addition" ? input.intent.source : null;
+		if (!source) return active;
+		return active.filter((method) => method.walletAuthorityId === source.walletAuthorityId);
+	}
+	async createAddAuthMethodEmailOtpChallenge(input) {
+		try {
+			const stored = await this.getRegistrationCeremonyIntentStore().getAddAuthMethodIntent(input.addAuthMethodIntentGrant);
+			if (!stored || stored.expiresAtMs <= Date.now()) return {
+				ok: false,
+				code: "invalid_grant",
+				message: "add-auth-method intent grant expired"
+			};
+			if (stored.digestB64u !== input.addAuthMethodIntentDigestB64u || stored.intent.walletId !== input.walletId) return {
+				ok: false,
+				code: "unauthorized",
+				message: "add-auth-method intent does not match this request"
+			};
+			if (!isEmailOtpAddAuthMethodIntent(stored.intent)) {
+				if ((await this.activeMethodsOnIntentAuthority({
+					walletId: input.walletId,
+					intent: stored.intent
+				})).some((method) => method.kind === "passkey")) return {
+					ok: false,
+					code: "already_configured",
+					message: "Wallet authority already has an active passkey auth method"
+				};
+				return await this.createAddAuthMethodEmailOtpSourceChallenge({
+					walletId: input.walletId,
+					orgId: stored.orgId || this.orgId,
+					ownerProofBindingDigest: stored.digestB64u
+				});
+			}
+			if ((await this.activeMethodsOnIntentAuthority({
+				walletId: input.walletId,
+				intent: stored.intent
+			})).some((method) => method.kind === "email_otp")) return {
+				ok: false,
+				code: "already_configured",
+				message: "Wallet authority already has an active email_otp auth method"
+			};
+			const email = String(stored.intent.authMethod.email || "").trim().toLowerCase();
+			if (!email) return {
+				ok: false,
+				code: "invalid_body",
+				message: "the intent names no email address"
+			};
+			const challenge = await this.emailOtpEnrollmentChallengeIssuer({
+				userId: email,
+				walletId: String(input.walletId),
+				orgId: stored.orgId || this.orgId,
+				email,
+				otpChannel: EMAIL_OTP_CHANNEL,
+				ownerProofBindingDigest: stored.digestB64u
+			});
+			if (!challenge.ok) return challenge;
+			return {
+				ok: true,
+				challengeId: challenge.challenge.challengeId,
+				expiresAtMs: challenge.challenge.expiresAtMs,
+				emailHint: String(challenge.delivery?.emailHint || "")
+			};
+		} catch (error) {
+			return {
+				ok: false,
+				code: "internal",
+				message: errorMessage(error) || "Failed to send the Email OTP enrollment code"
+			};
+		}
+	}
+	/**
+	* Sends the code that proves the wallet's existing Email OTP method.
+	*
+	* The recipient is the address the wallet already verified, resolved from
+	* its active Email authority — never named by the caller. Bound to the
+	* addition's intent digest, so a code taken for any other operation cannot
+	* start this ceremony.
+	*/
+	async createAddAuthMethodEmailOtpSourceChallenge(input) {
+		const enrollment = await this.emailOtpChallengeVerifier.readEnrollmentForWallet(String(input.walletId));
+		if (!enrollment) return {
+			ok: false,
+			code: "invalid_state",
+			message: "this wallet has no Email OTP method to prove"
+		};
+		const challenge = await this.emailOtpSourceChallengeIssuer({
+			userId: enrollment.providerUserId,
+			walletId: String(input.walletId),
+			orgId: input.orgId,
+			otpChannel: EMAIL_OTP_CHANNEL,
+			ownerProofBindingDigest: input.ownerProofBindingDigest,
+			operation: WALLET_EMAIL_OTP_UNLOCK_OPERATION,
+			reuseActiveChallenge: true
+		});
+		if (!challenge.ok) return challenge;
+		return {
+			ok: true,
+			challengeId: challenge.challenge.challengeId,
+			expiresAtMs: challenge.challenge.expiresAtMs,
+			emailHint: String(challenge.delivery?.emailHint || "")
+		};
+	}
+	/**
+	* Verifies the fresh Email OTP source proof and resolves who it proved.
+	*
+	* The caller supplies a code and the digest it was taken over; every identity
+	* the ceremony then trusts — provider subject, enrollment, authority — comes
+	* from the verified challenge. A body that could name them would let a caller
+	* authorize an addition with someone else's method.
+	*/
+	async verifyAddAuthMethodEmailOtpSourceProof(input) {
+		const enrollment = await this.emailOtpChallengeVerifier.readEnrollmentForWallet(String(input.walletId));
+		if (!enrollment) return {
+			ok: false,
+			code: "invalid_state",
+			message: "this wallet has no Email OTP method to prove"
+		};
+		const verified = await this.emailOtpChallengeVerifier.verifyExisting({
+			userId: enrollment.providerUserId,
+			walletId: String(input.walletId),
+			orgId: this.orgId,
+			challengeId: input.challengeId,
+			otpCode: input.otpCode,
+			otpChannel: EMAIL_OTP_CHANNEL,
+			ownerProofBindingDigest: input.expectedDigestB64u,
+			action: WALLET_EMAIL_OTP_ACTIONS.login,
+			operation: WALLET_EMAIL_OTP_UNLOCK_OPERATION
+		});
+		if (!verified.ok) return {
+			ok: false,
+			code: verified.code,
+			message: verified.message
+		};
+		const authority = await this.resolveActiveEmailOtpAuthorityForVerifiedMethod({
+			walletId: String(input.walletId),
+			walletAuthMethodId: String(input.walletAuthMethodId),
+			providerUserId: enrollment.providerUserId
+		});
+		if (!authority.ok) return authority;
+		return {
+			ok: true,
+			auth: {
+				kind: "email_otp",
+				providerUserId: enrollment.providerUserId,
+				enrollmentId: verified.enrollment.enrollmentId,
+				enrollmentSealKeyVersion: verified.enrollment.enrollmentSealKeyVersion,
+				authorityRef: await walletAuthAuthorityRef({ authority: authority.authority })
+			}
+		};
+	}
+	async startWalletAddAuthMethod(request, _context) {
+		try {
+			const store = this.getRegistrationCeremonyIntentStore();
+			const walletId = parseWalletIdForIntent(request.subject.walletId);
+			if (!walletId) return {
+				ok: false,
+				code: "invalid_body",
+				message: "walletId is required"
+			};
+			const grant = addAuthMethodIntentGrantFromString(normalizeOptionalTrimmedString(request.addAuthMethodIntentGrant) || "");
+			if (!grant) return {
+				ok: false,
+				code: "invalid_grant",
+				message: "add-auth-method intent grant is required"
+			};
+			const intentPreview = await store.getAddAuthMethodIntent(grant);
+			if (!intentPreview) return {
+				ok: false,
+				code: "invalid_grant",
+				message: "add-auth-method intent grant expired"
+			};
+			if (request.intent.walletId !== walletId) return {
+				ok: false,
+				code: "invalid_body",
+				message: "add-auth-method walletId mismatch"
+			};
+			const digestB64u = normalizeOptionalTrimmedString(request.addAuthMethodIntentDigestB64u);
+			const requestDigest = await computeAddAuthMethodIntentDigestB64u(request.intent);
+			if (!digestB64u || digestB64u !== requestDigest || digestB64u !== intentPreview.digestB64u) return {
+				ok: false,
+				code: "invalid_body",
+				message: "add-auth-method intent digest mismatch"
+			};
+			const storedAuth = await this.resolveAddAuthMethodExistingAuth({
+				auth: request.auth,
+				walletId,
+				orgId: intentPreview.orgId,
+				intent: intentPreview.intent,
+				nowMs: Date.now()
+			});
+			if (!storedAuth.ok) return storedAuth;
+			const sourceMethod = await resolveActiveAddAuthMethodSource({
+				walletAuthMethodStore: this.getWalletAuthMethodStore(),
+				walletId,
+				auth: storedAuth.auth
+			});
+			if (!sourceMethod) return {
+				ok: false,
+				code: "unauthorized",
+				message: "Add-auth-method source is not an active V2 wallet auth method"
+			};
+			const sourceAuthority = await this.walletAuthorityStore.readById(sourceMethod.walletAuthorityId);
+			if (!sourceAuthority || sourceAuthority.state !== "active" || sourceAuthority.walletId !== walletId || !isFullOwnerAuthorityV1(sourceAuthority)) return {
+				ok: false,
+				code: "unauthorized",
+				message: "Add-auth-method source authority is not an active full owner"
+			};
+			const admission = admitAddWalletAuthMethod({
+				sourceMethod,
+				targetFamily: request.authority.kind,
+				activeMethodsOnAuthority: (await this.getWalletAuthMethodStore().listForWalletV2({ walletId })).filter(isActiveWalletAuthMethodRecordV2).filter((method) => method.walletAuthorityId === sourceMethod.walletAuthorityId)
+			});
+			if (admission.kind === "already_configured") return {
+				ok: false,
+				code: "already_configured",
+				message: `Wallet authority already has an active ${admission.family} auth method`
+			};
+			const storedIntent = await store.takeAddAuthMethodIntent(grant);
+			if (!storedIntent) return {
+				ok: false,
+				code: "invalid_grant",
+				message: "add-auth-method intent grant expired"
+			};
+			const storedExpectedOrigin = normalizeOptionalTrimmedString(storedIntent.expectedOrigin);
+			const addAuthMethodCeremonyId = `wauthc_${secureRandomBase64Url(24)}`;
+			const targetWalletAuthMethodId = storedIntent.intent.targetWalletAuthMethodId;
+			if (storedIntent.intent.caller === "same_device_addition") {
+				const claimed = storedIntent.intent.source;
+				if (claimed.walletAuthorityId !== sourceMethod.walletAuthorityId || claimed.walletAuthMethodId !== sourceMethod.walletAuthMethodId || claimed.revocationEpoch !== sourceAuthority.revocationEpoch) return {
+					ok: false,
+					code: "unauthorized",
+					message: "Add-auth-method intent names a different source than the presented proof"
+				};
+			}
+			const expiresAtMs = Date.now() + 10 * 6e4;
+			if (request.authority.kind === "passkey") {
+				const passkeyIntent = storedIntent.intent;
+				if (!isPasskeyAddAuthMethodIntent(passkeyIntent)) return {
+					ok: false,
+					code: "invalid_body",
+					message: "Passkey authority requires a passkey add-auth-method intent"
+				};
+				if (!storedExpectedOrigin) return {
+					ok: false,
+					code: "invalid_body",
+					message: "expected_origin is required for WebAuthn registration verification"
+				};
+				if (storedAuth.auth.kind === "email_otp") {
+					const authority = await this.resolveActiveEmailOtpAuthorityForVerifiedMethod({
+						walletId: String(walletId),
+						walletAuthMethodId: String(storedAuth.auth.authorityRef.walletAuthMethodId),
+						providerUserId: storedAuth.auth.providerUserId
+					});
+					if (!authority.ok) return authority;
+					const expectedAuthorityRef = await walletAuthAuthorityRef({ authority: authority.authority });
+					if (expectedAuthorityRef.walletId !== storedAuth.auth.authorityRef.walletId || expectedAuthorityRef.authorityDigest !== storedAuth.auth.authorityRef.authorityDigest || expectedAuthorityRef.walletAuthMethodId !== storedAuth.auth.authorityRef.walletAuthMethodId) return {
+						ok: false,
+						code: "unauthorized",
+						message: "Email OTP authority does not match this wallet"
+					};
+					const enrollment = await this.emailOtpChallengeVerifier.readActiveEnrollmentForWallet({
+						walletId: String(walletId),
+						orgId: storedIntent.orgId,
+						providerUserId: storedAuth.auth.providerUserId
+					});
+					if (!enrollment.ok) return enrollment;
+					if (enrollment.enrollment.enrollmentId !== storedAuth.auth.enrollmentId || enrollment.enrollment.enrollmentSealKeyVersion !== storedAuth.auth.enrollmentSealKeyVersion) return {
+						ok: false,
+						code: "conflict",
+						message: "Email OTP enrollment changed; retry passkey linking"
+					};
+				}
+				const custodyFactor = custodyFactorFromAddAuthMethodAuth(storedAuth.auth);
+				const envelopeLookup = await this.passkeyCustodyEnvelopes.lookupEnvelopeForWalletAuthMethod({
+					walletId,
+					factor: custodyFactor,
+					walletAuthMethodId: sourceMethod.walletAuthMethodId
+				});
+				if (envelopeLookup.kind !== "active") return {
+					ok: false,
+					code: "invalid_state",
+					message: "Authenticated wallet custody envelope is unavailable"
+				};
+				const registration = this.createPasskeyRegistrationOptions({
+					walletId,
+					rpId: passkeyIntent.authMethod.rpId,
+					sourceWalletAuthorityId: sourceMethod.walletAuthorityId,
+					walletMethods: await this.getWalletAuthMethodStore().listForWalletV2({ walletId })
+				});
+				await store.putAddAuthMethodCeremony({
+					kind: "passkey",
+					addAuthMethodCeremonyId,
+					intent: passkeyIntent,
+					digestB64u: storedIntent.digestB64u,
+					orgId: storedIntent.orgId,
+					sourceWalletAuthMethodId: sourceMethod.walletAuthMethodId,
+					sourceWalletAuthorityId: sourceMethod.walletAuthorityId,
+					sourceAuthorityDigestB64u: sourceAuthority.authorityDigestB64u,
+					sourceAuthorityRevocationEpoch: sourceAuthority.revocationEpoch,
+					targetWalletAuthMethodId,
+					...storedIntent.expectedOrigin ? { expectedOrigin: storedIntent.expectedOrigin } : {},
+					expiresAtMs,
+					auth: storedAuth.auth,
+					passkeyRegistration: {
+						rpId: passkeyIntent.authMethod.rpId,
+						challengeB64u: registration.challengeB64u,
+						options: registration
+					},
+					custodyEnvelope: envelopeLookup.envelope
+				});
+				return {
+					ok: true,
+					addAuthMethodCeremonyId,
+					intent: passkeyIntent,
+					custodyEnvelope: envelopeLookup.envelope,
+					registration,
+					addAuthMethodCeremonyExpiresAtMs: expiresAtMs
+				};
+			}
+			const emailOtpIntent = storedIntent.intent;
+			if (!isEmailOtpAddAuthMethodIntent(emailOtpIntent)) return {
+				ok: false,
+				code: "invalid_body",
+				message: "Email OTP authority requires an Email OTP add-auth-method intent"
+			};
+			const authority = await this.verifyAddAuthMethodEmailOtpAuthority({
+				orgId: storedIntent.orgId,
+				authority: request.authority,
+				expectedDigestB64u: storedIntent.digestB64u,
+				intent: emailOtpIntent,
+				sourceWalletAuthorityId: sourceMethod.walletAuthorityId
+			});
+			if (!authority.ok) return authority;
+			const emailOtpSourceEnvelope = await this.passkeyCustodyEnvelopes.lookupEnvelopeForWalletAuthMethod({
+				walletId,
+				factor: custodyFactorFromAddAuthMethodAuth(storedAuth.auth),
+				walletAuthMethodId: sourceMethod.walletAuthMethodId
+			});
+			if (emailOtpSourceEnvelope.kind !== "active") return {
+				ok: false,
+				code: "invalid_state",
+				message: "Add-auth-method source has no active wallet custody envelope"
+			};
+			await store.putAddAuthMethodCeremony({
+				kind: "email_otp",
+				addAuthMethodCeremonyId,
+				intent: emailOtpIntent,
+				digestB64u: storedIntent.digestB64u,
+				orgId: storedIntent.orgId,
+				sourceWalletAuthMethodId: sourceMethod.walletAuthMethodId,
+				sourceWalletAuthorityId: sourceMethod.walletAuthorityId,
+				sourceAuthorityDigestB64u: sourceAuthority.authorityDigestB64u,
+				sourceAuthorityRevocationEpoch: sourceAuthority.revocationEpoch,
+				targetWalletAuthMethodId,
+				...storedIntent.expectedOrigin ? { expectedOrigin: storedIntent.expectedOrigin } : {},
+				expiresAtMs,
+				auth: storedAuth.auth,
+				authority: authority.authority,
+				custodyEnvelope: emailOtpSourceEnvelope.envelope
+			});
+			return {
+				ok: true,
+				addAuthMethodCeremonyId,
+				intent: emailOtpIntent,
+				custodyEnvelope: emailOtpSourceEnvelope.envelope,
+				addAuthMethodCeremonyExpiresAtMs: expiresAtMs
+			};
+		} catch (error) {
+			return {
+				ok: false,
+				code: "internal",
+				message: errorMessage(error) || "Failed to start wallet add-auth-method ceremony"
+			};
+		}
+	}
+	/**
+	* What an exact retry has to match: the ceremony, the request as sent, and
+	* the authorization branch with any linked admission.
+	*
+	* Substituting a credential, an envelope, or any admitted identity — wallet,
+	* device, enrollment, key manifest — changes this digest, so one comparison
+	* separates a retry from a different finalize wearing the same ceremony id.
+	*/
+	async finalizeReplayDigestB64u(request) {
+		return base64UrlEncode(await this.sha256Bytes(new TextEncoder().encode(alphabetizeStringify({
+			addAuthMethodCeremonyId: request.addAuthMethodCeremonyId,
+			webauthnRegistration: request.webauthnRegistration ?? null,
+			custodyEnvelope: request.custodyEnvelope ?? null,
+			emailOtpTarget: request.emailOtpTarget ?? null,
+			authorization: request.authorization
+		}))));
+	}
+	/**
+	* `atomicCompanionStatements` ride in the same batch as the credential, the
+	* custody envelope, and the owner binding.
+	*
+	* Device 2's linked finalize is the reason this exists. Its link session has
+	* to advance exactly when the credential commits, and a caller cannot get
+	* that by making two calls: finalize is irreversible, so a cancel or an expiry
+	* winning in between would leave a terminal session holding a live owner
+	* credential. Statements passed here either commit with it or the whole
+	* finalize fails, which is the only pair of outcomes that keeps those two
+	* facts in agreement.
+	*
+	* They are a separate argument rather than part of the command because the
+	* command is the wire contract every caller shares, and no wire request may
+	* describe database writes.
+	*/
+	async finalizeWalletAddAuthMethod(request, atomicCompanionStatements = []) {
+		try {
+			const store = this.getRegistrationCeremonyIntentStore();
+			const replayDigestB64u = await this.finalizeReplayDigestB64u(request);
+			const priorFinalize = await store.getAddAuthMethodFinalizeReplay(request.addAuthMethodCeremonyId);
+			if (priorFinalize) return priorFinalize.requestDigestB64u === replayDigestB64u ? priorFinalize.response : {
+				ok: false,
+				code: "conflict",
+				message: "add-auth-method ceremony was already finalized with a different request"
+			};
+			const ceremony = await store.getAddAuthMethodCeremony(request.addAuthMethodCeremonyId);
+			if (!ceremony) return {
+				ok: false,
+				code: "not_found",
+				message: "add-auth-method ceremony not found"
+			};
+			const walletId = parseWalletIdForIntent(request.subject.walletId);
+			if (!walletId || ceremony.intent.walletId !== walletId) return {
+				ok: false,
+				code: "invalid_body",
+				message: "add-auth-method ceremony subject mismatch"
+			};
+			const sourceRevalidation = await this.revalidateAddAuthMethodSource({
+				ceremony,
+				walletId
+			});
+			if (sourceRevalidation) return sourceRevalidation;
+			if (ceremony.kind === "passkey") {
+				const hasWebAuthnRegistration = request.webauthnRegistration !== void 0;
+				const hasCustodyEnvelope = request.custodyEnvelope !== void 0;
+				if (!hasWebAuthnRegistration || !hasCustodyEnvelope) return {
+					ok: false,
+					code: "invalid_body",
+					message: "Passkey add-auth-method finalize requires registration and custody envelope"
+				};
+				const expectedOrigin = normalizeOptionalTrimmedString(ceremony.expectedOrigin);
+				if (!expectedOrigin) return {
+					ok: false,
+					code: "invalid_state",
+					message: "Passkey add-auth-method ceremony has no expected origin"
+				};
+				const verified = await this.verifyRegistrationCredentialForIntent({
+					webauthnRegistration: request.webauthnRegistration,
+					expectedChallenge: ceremony.passkeyRegistration.challengeB64u,
+					expectedOrigin,
+					rpId: ceremony.passkeyRegistration.rpId
+				});
+				if (!verified.ok) return verified;
+				const credential = verified.credential;
+				const duplicate = await this.getWalletAuthMethodStore().getPasskeyV2({
+					rpId: ceremony.passkeyRegistration.rpId,
+					credentialIdB64u: credential.credentialIdB64u
+				});
+				const duplicateAuthenticator = await this.webAuthnStore.readAuthenticator({
+					userId: String(walletId),
+					credentialIdB64u: credential.credentialIdB64u
+				});
+				const duplicateBinding = await this.webAuthnStore.readBindingByCredential({
+					rpId: ceremony.passkeyRegistration.rpId,
+					credentialIdB64u: credential.credentialIdB64u
+				});
+				if (duplicate || duplicateAuthenticator || duplicateBinding) return {
+					ok: false,
+					code: "duplicate_auth_method",
+					message: "Passkey credential is already registered"
+				};
+				let replacementEnvelope = null;
+				if (hasCustodyEnvelope) {
+					try {
+						replacementEnvelope = parsePasskeyCustodyEnvelopeRecord(request.custodyEnvelope);
+					} catch {
+						return {
+							ok: false,
+							code: "invalid_body",
+							message: "custodyEnvelope is invalid"
+						};
+					}
+					const expectedCiphertextDigestB64u = base64UrlEncode(await this.sha256Bytes(base64UrlDecode(replacementEnvelope.sealedCustodySecretB64u)));
+					if (replacementEnvelope.walletId !== walletId || replacementEnvelope.factor.kind !== "passkey" || replacementEnvelope.factor.rpId !== ceremony.passkeyRegistration.rpId || replacementEnvelope.factor.credentialIdB64u !== credential.credentialIdB64u || replacementEnvelope.envelopeRevision !== 1 || replacementEnvelope.lifecycle.state !== "active" || replacementEnvelope.envelopeId === ceremony.custodyEnvelope.envelopeId || replacementEnvelope.ciphertextDigestB64u !== expectedCiphertextDigestB64u) return {
+						ok: false,
+						code: "invalid_body",
+						message: "custodyEnvelope is not bound to the verified passkey"
+					};
+					const currentEnvelope = await this.passkeyCustodyEnvelopes.lookupEnvelopeForWalletAuthMethod({
+						walletId,
+						factor: custodyFactorFromAddAuthMethodAuth(ceremony.auth),
+						walletAuthMethodId: ceremony.sourceWalletAuthMethodId
+					});
+					if (currentEnvelope.kind !== "active" || currentEnvelope.envelope.envelopeId !== ceremony.custodyEnvelope.envelopeId) return {
+						ok: false,
+						code: "conflict",
+						message: "Existing passkey custody changed; retry add-auth-method linking"
+					};
+				}
+				const authority = {
+					kind: "passkey",
+					walletId,
+					rpId: requireStoredRpId(ceremony.passkeyRegistration.rpId),
+					credentialIdB64u: credential.credentialIdB64u,
+					credentialPublicKeyB64u: credential.credentialPublicKeyB64u,
+					counter: credential.counter,
+					device: credential.device,
+					registrationIntentDigestB64u: ceremony.digestB64u
+				};
+				const now = Date.now();
+				const authMethod = buildActiveAddedWalletAuthMethodV2({
+					authority,
+					walletAuthMethodId: ceremony.targetWalletAuthMethodId,
+					walletAuthorityId: ceremony.sourceWalletAuthorityId,
+					now
+				});
+				const binding = await buildAddedPasskeyCredentialBinding({
+					webAuthnStore: this.webAuthnStore,
+					listWalletEd25519Signers: this.listWalletEd25519Signers,
+					ceremony,
+					walletId,
+					rpId: requireStoredRpId(ceremony.passkeyRegistration.rpId),
+					credentialIdB64u: credential.credentialIdB64u,
+					now
+				});
+				const response = {
+					ok: true,
+					walletId,
+					authority: walletAuthAuthorityFromRegistrationAuthority({
+						authority,
+						walletAuthMethodId: ceremony.targetWalletAuthMethodId
+					}),
+					rpId: requireStoredRpId(ceremony.passkeyRegistration.rpId),
+					authMethod: {
+						kind: "passkey",
+						status: "active",
+						credentialIdB64u: credential.credentialIdB64u,
+						credentialPublicKeyB64u: credential.credentialPublicKeyB64u,
+						counter: credential.counter,
+						device: credential.device
+					}
+				};
+				const replayStatements = await store.buildAddAuthMethodFinalizeReplayStatements({
+					kind: "wallet_add_auth_method_finalize_replay_v1",
+					addAuthMethodCeremonyId: ceremony.addAuthMethodCeremonyId,
+					requestDigestB64u: replayDigestB64u,
+					response,
+					createdAtMs: now,
+					expiresAtMs: now + ADD_AUTH_METHOD_FINALIZE_REPLAY_TTL_MS
+				});
+				const additionalStatements = [
+					...this.prepareAddAuthMethodSourceGuard({
+						ceremony,
+						walletId
+					}),
+					this.webAuthnStore.prepareAuthenticatorInsertStatement({
+						userId: String(walletId),
+						record: {
+							credentialIdB64u: credential.credentialIdB64u,
+							credentialPublicKeyB64u: credential.credentialPublicKeyB64u,
+							counter: credential.counter,
+							createdAtMs: now,
+							updatedAtMs: now,
+							deviceInfo: credential.device
+						}
+					}),
+					this.webAuthnStore.prepareCredentialBindingInsertStatement(binding),
+					...this.getWalletAuthMethodStore().prepareV2InsertStatements(authMethod),
+					...replayStatements,
+					...atomicCompanionStatements
+				];
+				const link = replacementEnvelope === null ? await this.passkeyCustodyEnvelopes.commitPasskeyFactorWithoutCustodyAtomically({ additionalStatements }) : await this.passkeyCustodyEnvelopes.linkWalletCustodyFactorAtomically({
+					envelope: replacementEnvelope,
+					additionalStatements
+				});
+				if (link.kind === "version_mismatch" || link.kind === "conflict") return {
+					ok: false,
+					code: "conflict",
+					message: "Passkey credential or custody envelope already exists"
+				};
+				await store.takeAddAuthMethodCeremony(ceremony.addAuthMethodCeremonyId);
+				return response;
+			}
+			if ((await this.getWalletAuthMethodStore().listForWalletV2({ walletId })).filter(isActiveWalletAuthMethodRecordV2).filter((method) => method.kind === "email_otp" && method.walletAuthorityId === ceremony.sourceWalletAuthorityId).length > 0) return {
+				ok: false,
+				code: "already_configured",
+				message: "Wallet authority already has an active email_otp auth method"
+			};
+			if (request.webauthnRegistration !== void 0) return {
+				ok: false,
+				code: "invalid_body",
+				message: "Email OTP add-auth-method finalize carries no WebAuthn registration"
+			};
+			if (request.custodyEnvelope === void 0) return {
+				ok: false,
+				code: "invalid_body",
+				message: "Email OTP add-auth-method finalize requires the resealed custody envelope"
+			};
+			const emailOtpTarget = request.emailOtpTarget;
+			if (emailOtpTarget === void 0) return {
+				ok: false,
+				code: "invalid_body",
+				message: "Email OTP add-auth-method finalize must state its enrollment target"
+			};
+			const enrollmentPlan = await this.resolveAddedEmailOtpEnrollment({
+				walletId,
+				ceremony,
+				target: emailOtpTarget,
+				nowMs: Date.now()
+			});
+			if (!enrollmentPlan.ok) return enrollmentPlan;
+			const targetEnrollment = enrollmentPlan.enrollment;
+			let resealedEnvelope;
+			try {
+				resealedEnvelope = parsePasskeyCustodyEnvelopeRecord(request.custodyEnvelope);
+			} catch {
+				return {
+					ok: false,
+					code: "invalid_body",
+					message: "custodyEnvelope is invalid"
+				};
+			}
+			const expectedResealedCiphertextDigestB64u = base64UrlEncode(await this.sha256Bytes(base64UrlDecode(resealedEnvelope.sealedCustodySecretB64u)));
+			if (resealedEnvelope.walletId !== walletId || resealedEnvelope.factor.kind !== "email_otp" || resealedEnvelope.factor.enrollmentId !== targetEnrollment.enrollmentId || resealedEnvelope.factor.enrollmentSealKeyVersion !== targetEnrollment.enrollmentSealKeyVersion || resealedEnvelope.envelopeRevision !== 1 || resealedEnvelope.lifecycle.state !== "active" || resealedEnvelope.envelopeId === ceremony.custodyEnvelope.envelopeId || resealedEnvelope.ciphertextDigestB64u !== expectedResealedCiphertextDigestB64u) return {
+				ok: false,
+				code: "invalid_body",
+				message: "custodyEnvelope is not bound to the verified Email OTP factor"
+			};
+			const currentSourceEnvelope = await this.passkeyCustodyEnvelopes.lookupEnvelopeForWalletAuthMethod({
+				walletId,
+				factor: custodyFactorFromAddAuthMethodAuth(ceremony.auth),
+				walletAuthMethodId: ceremony.sourceWalletAuthMethodId
+			});
+			if (currentSourceEnvelope.kind !== "active" || currentSourceEnvelope.envelope.envelopeId !== ceremony.custodyEnvelope.envelopeId) return {
+				ok: false,
+				code: "conflict",
+				message: "Existing wallet custody changed; retry add-auth-method linking"
+			};
+			const now = Date.now();
+			const authMethod = buildActiveAddedWalletAuthMethodV2({
+				authority: ceremony.authority,
+				walletAuthMethodId: ceremony.targetWalletAuthMethodId,
+				walletAuthorityId: ceremony.sourceWalletAuthorityId,
+				now
+			});
+			const authority = walletAuthAuthorityFromRegistrationAuthority({
+				authority: ceremony.authority,
+				walletAuthMethodId: ceremony.targetWalletAuthMethodId
+			});
+			const emailOtpResponse = {
+				ok: true,
+				walletId: ceremony.intent.walletId,
+				authority,
+				authMethod: {
+					kind: "email_otp",
+					status: "active"
+				}
+			};
+			const emailOtpReplayStatements = await store.buildAddAuthMethodFinalizeReplayStatements({
+				kind: "wallet_add_auth_method_finalize_replay_v1",
+				addAuthMethodCeremonyId: ceremony.addAuthMethodCeremonyId,
+				requestDigestB64u: replayDigestB64u,
+				response: emailOtpResponse,
+				createdAtMs: now,
+				expiresAtMs: now + ADD_AUTH_METHOD_FINALIZE_REPLAY_TTL_MS
+			});
+			const linked = await this.passkeyCustodyEnvelopes.linkWalletCustodyFactorAtomically({
+				envelope: resealedEnvelope,
+				additionalStatements: [
+					...this.prepareAddAuthMethodSourceGuard({
+						ceremony,
+						walletId
+					}),
+					...this.getWalletAuthMethodStore().prepareActiveV2TargetFamilyAbsentGuardStatements({
+						walletId,
+						walletAuthorityId: ceremony.sourceWalletAuthorityId,
+						kind: "email_otp"
+					}),
+					...this.getWalletAuthMethodStore().prepareV2InsertStatements(authMethod),
+					...enrollmentPlan.statements,
+					...emailOtpReplayStatements,
+					...atomicCompanionStatements
+				]
+			});
+			if (linked.kind === "version_mismatch" || linked.kind === "conflict") return {
+				ok: false,
+				code: "conflict",
+				message: "Add-auth-method source changed or target method already exists"
+			};
+			await store.takeAddAuthMethodCeremony(ceremony.addAuthMethodCeremonyId);
+			return emailOtpResponse;
+		} catch (error) {
+			return {
+				ok: false,
+				code: "internal",
+				message: errorMessage(error) || "Failed to finalize wallet add-auth-method ceremony"
+			};
+		}
+	}
+	async revalidateAddAuthMethodSource(input) {
+		const sourceMethod = await this.getWalletAuthMethodStore().readByIdV2({ walletAuthMethodId: input.ceremony.sourceWalletAuthMethodId });
+		if (!sourceMethod || sourceMethod.status !== "active" || sourceMethod.walletId !== input.walletId || sourceMethod.walletAuthorityId !== input.ceremony.sourceWalletAuthorityId) return {
+			ok: false,
+			code: "conflict",
+			message: "Add-auth-method source method changed; restart the operation"
+		};
+		const sourceAuthority = await this.walletAuthorityStore.readById(input.ceremony.sourceWalletAuthorityId);
+		if (!sourceAuthority || sourceAuthority.state !== "active" || sourceAuthority.walletId !== input.walletId || sourceAuthority.authorityDigestB64u !== input.ceremony.sourceAuthorityDigestB64u || sourceAuthority.revocationEpoch !== input.ceremony.sourceAuthorityRevocationEpoch || !isFullOwnerAuthorityV1(sourceAuthority)) return {
+			ok: false,
+			code: "conflict",
+			message: "Add-auth-method source authority changed; restart the operation"
+		};
+		return null;
+	}
+	/**
+	* The factor whose envelope a revoked method owned.
+	*
+	* Selected by the owning method the envelope itself records, so an Email
+	* method's envelope is removable without touching its sibling's even though
+	* both share one provider enrollment. Legacy unbound envelopes match nothing
+	* and survive until an open has upgraded them.
+	*/
+	/**
+	* Resolves which enrollment an added Email OTP method binds to.
+	*
+	* The wallet's Email OTP enrollment is per provider identity, not per method:
+	* every Email method on the wallet reads its factor secret through the same
+	* record, and its seal key version is inside each of their envelopes' AAD. So
+	* re-enrolling on a wallet that already has one would leave the existing
+	* methods holding ciphertext that no longer opens.
+	*
+	* The caller states which case it believes it is in and is refused when live
+	* state disagrees, rather than being silently switched to the other branch —
+	* a client that thought it was enrolling a new address, and was quietly bound
+	* to an existing one, would report the wrong email as verified.
+	*/
+	async resolveAddedEmailOtpEnrollment(input) {
+		const existing = await this.emailOtpChallengeVerifier.readActiveEnrollmentForWallet({
+			walletId: String(input.walletId),
+			orgId: input.ceremony.orgId,
+			providerUserId: String(input.ceremony.authority.providerSubject)
+		});
+		switch (input.target.kind) {
+			case "existing_enrollment":
+				if (!existing.ok) return existing;
+				return {
+					ok: true,
+					enrollment: {
+						enrollmentId: existing.enrollment.enrollmentId,
+						enrollmentSealKeyVersion: existing.enrollment.enrollmentSealKeyVersion
+					},
+					statements: []
+				};
+			case "new_enrollment": {
+				if (existing.ok) return {
+					ok: false,
+					code: "conflict",
+					message: "this wallet already has an Email OTP enrollment for this identity"
+				};
+				const prepared = await this.emailOtpEnrollmentFinalizer.prepareAddedAuthMethodEnrollment({
+					walletId: String(input.walletId),
+					orgId: input.ceremony.orgId,
+					authSubjectId: String(input.ceremony.authority.providerSubject),
+					verifiedEmail: String(input.ceremony.authority.email),
+					material: input.target.enrollment,
+					nowMs: input.nowMs
+				});
+				if (!prepared.ok) return prepared;
+				return {
+					ok: true,
+					enrollment: {
+						enrollmentId: prepared.enrollment.enrollmentId,
+						enrollmentSealKeyVersion: prepared.enrollment.enrollmentSealKeyVersion
+					},
+					statements: prepared.statements
+				};
+			}
+			default: return unreachableAddAuthMethodEmailOtpTarget(input.target);
+		}
+	}
+	async prepareRevokedMethodEnvelopeStatements(input) {
+		return await this.passkeyCustodyEnvelopes.prepareMethodEnvelopeRevocationStatements({
+			walletId: input.walletId,
+			walletAuthMethodId: input.method.walletAuthMethodId,
+			revokedAtMs: input.revokedAtMs
+		});
+	}
+	prepareAddAuthMethodSourceGuard(input) {
+		return this.getWalletAuthMethodStore().prepareActiveV2SourceGuardStatements({
+			walletId: input.walletId,
+			walletAuthMethodId: input.ceremony.sourceWalletAuthMethodId,
+			walletAuthorityId: input.ceremony.sourceWalletAuthorityId,
+			authorityDigestB64u: input.ceremony.sourceAuthorityDigestB64u,
+			authorityRevocationEpoch: input.ceremony.sourceAuthorityRevocationEpoch
+		});
+	}
+	async resolveAddSignerExistingAuth(input) {
+		return await resolveD1AddSignerExistingAuth({
+			auth: input.auth,
+			walletId: input.walletId,
+			intent: input.intent,
+			walletAuthMethodStore: this.getWalletAuthMethodStore(),
+			nowMs: input.nowMs
+		});
+	}
+	async resolveAddAuthMethodExistingAuth(input) {
+		const walletAuthMethodStore = this.getWalletAuthMethodStore();
+		const activeWalletMethods = (await walletAuthMethodStore.listForWalletV2({ walletId: input.walletId })).filter(isActiveWalletAuthMethodRecordV2);
+		if (activeWalletMethods.length === 0) return {
+			ok: false,
+			code: "not_found",
+			message: "wallet has no active auth methods"
+		};
+		if (input.auth.kind === "email_otp") {
+			const authority = await this.resolveActiveEmailOtpAuthorityForVerifiedMethod({
+				walletId: String(input.walletId),
+				walletAuthMethodId: String(input.auth.authorityRef.walletAuthMethodId),
+				providerUserId: input.auth.providerUserId
+			});
+			if (!authority.ok) return authority;
+			const expectedAuthorityRef = await walletAuthAuthorityRef({ authority: authority.authority });
+			if (expectedAuthorityRef.walletId !== input.auth.authorityRef.walletId || expectedAuthorityRef.authorityDigest !== input.auth.authorityRef.authorityDigest || expectedAuthorityRef.walletAuthMethodId !== input.auth.authorityRef.walletAuthMethodId) return {
+				ok: false,
+				code: "unauthorized",
+				message: "Email OTP authority reference does not match this wallet"
+			};
+			const enrollment = await this.emailOtpChallengeVerifier.readActiveEnrollmentForWallet({
+				walletId: String(input.walletId),
+				orgId: input.orgId,
+				providerUserId: input.auth.providerUserId
+			});
+			if (!enrollment.ok) return enrollment;
+			if (enrollment.enrollment.enrollmentId !== input.auth.enrollmentId || enrollment.enrollment.enrollmentSealKeyVersion !== input.auth.enrollmentSealKeyVersion) return {
+				ok: false,
+				code: "conflict",
+				message: "Email OTP enrollment changed; retry passkey linking"
+			};
+			return {
+				ok: true,
+				auth: {
+					kind: "email_otp",
+					providerUserId: input.auth.providerUserId,
+					enrollmentId: input.auth.enrollmentId,
+					enrollmentSealKeyVersion: input.auth.enrollmentSealKeyVersion,
+					authorityRef: input.auth.authorityRef
+				}
+			};
+		}
+		if (input.auth.kind === "wallet_session") {
+			if (!activeWalletMethods.some((method) => method.kind === "passkey" && input.auth.kind === "wallet_session" && String(method.rpId || "") === String(input.auth.rpId) && String(method.credentialIdB64u || "") === String(input.auth.credentialIdB64u))) return {
+				ok: false,
+				code: "unauthorized",
+				message: "Owner Wallet Session passkey is not an active auth method of this wallet"
+			};
+			return {
+				ok: true,
+				auth: {
+					kind: "wallet_session",
+					walletSessionId: input.auth.walletSessionId,
+					authorizationId: input.auth.authorizationId,
+					rpId: String(input.auth.rpId),
+					credentialIdB64u: input.auth.credentialIdB64u
+				}
+			};
+		}
+		return await resolveD1AddAuthMethodExistingAuth({
+			auth: input.auth,
+			walletId: input.walletId,
+			intent: input.intent,
+			walletAuthMethodStore,
+			nowMs: input.nowMs
+		});
+	}
+	async verifyRegistrationAuthorityForIntent(input) {
+		const authority = input.authority;
+		switch (authority.kind) {
+			case "passkey": return await this.verifyRegistrationPasskeyAuthority({
+				authority,
+				expectedDigestB64u: input.expectedDigestB64u,
+				expectedOrigin: input.expectedOrigin,
+				intent: input.intent,
+				userAgent: input.userAgent
+			});
+			case "email_otp": return await this.verifyRegistrationEmailOtpAuthority({
+				orgId: input.orgId,
+				authority,
+				expectedDigestB64u: input.expectedDigestB64u,
+				intent: input.intent,
+				verificationOperationId: input.verificationOperationId,
+				verificationReceiptExpiresAtMs: input.verificationReceiptExpiresAtMs
+			});
+		}
+		return unreachableRegistrationStartAuthority(authority);
+	}
+	async verifyActivePasskeyAuthority(authority) {
+		const record = await this.getWalletAuthMethodStore().getPasskeyV2({
+			rpId: authority.verifier.rpId,
+			credentialIdB64u: authority.factor.credentialIdB64u
+		});
+		if (!record || record.kind !== "passkey" || record.status !== "active" || record.walletId !== authority.walletId || record.walletAuthMethodId !== authority.bindingId || record.rpId !== authority.verifier.rpId || record.credentialIdB64u !== authority.factor.credentialIdB64u) return {
+			ok: false,
+			code: "unauthorized",
+			message: "Passkey authority is not active for this wallet"
+		};
+		const walletAuthority = await this.walletAuthorityStore.readById(record.walletAuthorityId);
+		if (!walletAuthority || walletAuthority.state !== "active" || walletAuthority.walletId !== record.walletId || walletAuthority.authorityId !== record.walletAuthorityId) return {
+			ok: false,
+			code: "unauthorized",
+			message: "Passkey wallet authority is not active for this wallet"
+		};
+		return {
+			ok: true,
+			authority: walletAuthority,
+			authMethod: record
+		};
+	}
+	async resolveActiveWalletSessionAuthority(input) {
+		const authMethods = await this.getWalletAuthMethodStore().listForWalletV2({ walletId: input.walletId });
+		const walletAuthMethodId = await resolveWalletAuthMethodIdForAuthority({
+			walletId: input.walletId,
+			authorityRef: input.authorityRef,
+			authSource: input.authSource,
+			authMethods
+		});
+		if (!walletAuthMethodId) return {
+			kind: "rejected",
+			code: "unauthorized",
+			message: "Wallet Session proof does not identify one active wallet auth method"
+		};
+		const authMethod = authMethods.find((candidate) => candidate.walletAuthMethodId === walletAuthMethodId);
+		if (!authMethod || authMethod.status !== "active") return {
+			kind: "rejected",
+			code: "unauthorized",
+			message: "Wallet Session auth method is not active"
+		};
+		const authority = await this.walletAuthorityStore.readById(authMethod.walletAuthorityId);
+		if (!authority || authority.state !== "active" || authority.walletId !== input.walletId || authority.authorityId !== authMethod.walletAuthorityId) return {
+			kind: "rejected",
+			code: "unauthorized",
+			message: "Wallet Session authority is not active"
+		};
+		return {
+			kind: "active_authority",
+			authority,
+			authMethod
+		};
+	}
+	async resolveActivePasskeyAuthorityForVerifiedCredential(input) {
+		const record = await this.getWalletAuthMethodStore().getPasskeyV2({
+			rpId: input.rpId,
+			credentialIdB64u: input.credentialIdB64u
+		});
+		if (!record || record.kind !== "passkey" || record.status !== "active" || record.walletId !== input.walletId) return {
+			ok: false,
+			code: "unauthorized",
+			message: "Passkey credential is not active for this wallet"
+		};
+		const authority = {
+			walletId: record.walletId,
+			factor: {
+				kind: "passkey",
+				credentialIdB64u: record.credentialIdB64u
+			},
+			verifier: {
+				kind: "webauthn",
+				rpId: record.rpId
+			},
+			bindingId: record.walletAuthMethodId
+		};
+		const active = await this.verifyActivePasskeyAuthority(authority);
+		return active.ok ? {
+			ok: true,
+			authority,
+			walletAuthority: active.authority,
+			authMethod: active.authMethod
+		} : active;
+	}
+	async resolveActivePasskeyAuthorityForUnlock(input) {
+		const record = await this.getWalletAuthMethodStore().readByIdV2({ walletAuthMethodId: input.walletAuthMethodId });
+		if (!record || record.kind !== "passkey" || record.status !== "active" || record.walletId !== input.walletId || record.walletAuthorityId !== input.walletAuthorityId || record.rpId !== input.rpId || record.credentialIdB64u !== input.credentialIdB64u) return {
+			kind: "rejected",
+			code: "unauthorized",
+			message: "Verified passkey does not identify an active wallet auth method"
+		};
+		const authority = await this.walletAuthorityStore.readById(record.walletAuthorityId);
+		if (!authority || authority.state !== "active" || authority.walletId !== record.walletId || authority.authorityId !== record.walletAuthorityId) return {
+			kind: "rejected",
+			code: "unauthorized",
+			message: "Verified passkey authority is not active for this wallet"
+		};
+		return {
+			kind: "active_authority",
+			authority,
+			authMethod: record
+		};
+	}
+	async resolveActiveEmailOtpAuthorityForUnlock(input) {
+		const record = await this.getWalletAuthMethodStore().readByIdV2({ walletAuthMethodId: input.walletAuthMethodId });
+		if (!record || record.kind !== "email_otp" || record.status !== "active" || record.walletId !== input.walletId || record.emailHashHex !== input.emailHashHex) return {
+			kind: "rejected",
+			code: "unauthorized",
+			message: "Verified Email OTP does not identify an active wallet auth method"
+		};
+		const authority = await this.walletAuthorityStore.readById(record.walletAuthorityId);
+		if (!authority || authority.state !== "active" || authority.walletId !== record.walletId || authority.authorityId !== record.walletAuthorityId) return {
+			kind: "rejected",
+			code: "unauthorized",
+			message: "Verified Email OTP authority is not active for this wallet"
+		};
+		const provider = input.providerUserId.startsWith("google:") ? "google" : "email";
+		let boundAuthority;
+		try {
+			boundAuthority = bindEmailOtpAuthorityToMethod(buildEmailOtpWalletAuthAuthority({
+				walletId: String(record.walletId),
+				provider,
+				providerUserId: input.providerUserId,
+				emailHashHex: record.emailHashHex
+			}), record.walletAuthMethodId);
+		} catch (error) {
+			return {
+				kind: "rejected",
+				code: "invalid_state",
+				message: errorMessage(error) || "Stored Email OTP authority is invalid"
+			};
+		}
+		return {
+			kind: "active_authority",
+			authority,
+			walletAuthAuthority: boundAuthority,
+			authMethod: record
+		};
+	}
+	async verifyActiveEmailOtpAuthority(authority) {
+		const record = await this.getWalletAuthMethodStore().getEmailOtpV2({
+			walletId: authority.walletId,
+			emailHashHex: authority.verifier.emailHashHex
+		});
+		if (!record || record.kind !== "email_otp" || record.status !== "active" || record.walletId !== authority.walletId || record.emailHashHex !== authority.verifier.emailHashHex) return {
+			ok: false,
+			code: "unauthorized",
+			message: "Email OTP authority is not active for this wallet"
+		};
+		return { ok: true };
+	}
+	async resolveActiveEmailOtpAuthorityForVerifiedSubject(input) {
+		const walletId = normalizeOptionalTrimmedString(input.walletId);
+		const providerUserId = normalizeOptionalTrimmedString(input.providerUserId);
+		if (!walletId || !providerUserId) return {
+			ok: false,
+			code: "invalid_body",
+			message: "Verified Email OTP authority identity is required"
+		};
+		const records = [];
+		for (const record of await this.getWalletAuthMethodStore().listForWalletV2({ walletId })) if (record.kind === "email_otp" && record.status === "active") records.push(record);
+		let record = records[0];
+		if (records.length > 1) {
+			const foundingMethods = [];
+			for (const candidate of records) {
+				const authority = await this.walletAuthorityStore.readById(candidate.walletAuthorityId);
+				if (authority?.state === "active" && authority.walletId === candidate.walletId && authority.authorityId === candidate.walletAuthorityId && authority.provenance.kind === "wallet_registration") foundingMethods.push(candidate);
+			}
+			record = foundingMethods.length === 1 ? foundingMethods[0] : void 0;
+		}
+		if (!record) return {
+			ok: false,
+			code: "unauthorized",
+			message: "Wallet Email OTP authority cannot be selected from the verified subject"
+		};
+		if (record.kind !== "email_otp") return {
+			ok: false,
+			code: "unauthorized",
+			message: "Wallet Email OTP authority is unavailable"
+		};
+		const provider = providerUserId.startsWith("google:") ? "google" : "email";
+		try {
+			return {
+				ok: true,
+				authority: bindEmailOtpAuthorityToMethod(buildEmailOtpWalletAuthAuthority({
+					walletId,
+					provider,
+					providerUserId,
+					emailHashHex: record.emailHashHex
+				}), record.walletAuthMethodId)
+			};
+		} catch (error) {
+			return {
+				ok: false,
+				code: "invalid_state",
+				message: errorMessage(error) || "Stored Email OTP authority is invalid"
+			};
+		}
+	}
+	/**
+	* The exact active Email OTP authority a caller names. Several methods can
+	* share one wallet's verified email once a device is linked, so an operation
+	* that knows its method must resolve by that identity instead of asking for
+	* the wallet's only one.
+	*/
+	async resolveActiveEmailOtpAuthorityForVerifiedMethod(input) {
+		const walletId = normalizeOptionalTrimmedString(input.walletId);
+		const providerUserId = normalizeOptionalTrimmedString(input.providerUserId);
+		const parsedMethodId = parseWalletAuthMethodId(input.walletAuthMethodId);
+		if (!walletId || !providerUserId || !parsedMethodId.ok) return {
+			ok: false,
+			code: "invalid_body",
+			message: "Verified Email OTP authority identity is required"
+		};
+		const record = await this.getWalletAuthMethodStore().readByIdV2({ walletAuthMethodId: parsedMethodId.value });
+		if (!record || record.kind !== "email_otp" || record.status !== "active" || String(record.walletId) !== walletId) return {
+			ok: false,
+			code: "unauthorized",
+			message: "Named Email OTP method is not active for this wallet"
+		};
+		const provider = providerUserId.startsWith("google:") ? "google" : "email";
+		try {
+			return {
+				ok: true,
+				authority: bindEmailOtpAuthorityToMethod(buildEmailOtpWalletAuthAuthority({
+					walletId,
+					provider,
+					providerUserId,
+					emailHashHex: record.emailHashHex
+				}), record.walletAuthMethodId)
+			};
+		} catch (error) {
+			return {
+				ok: false,
+				code: "invalid_state",
+				message: errorMessage(error) || "Stored Email OTP authority is invalid"
+			};
+		}
+	}
+	async findDuplicateAuthority(authority) {
+		if (authority.kind === "passkey") return await this.getWalletAuthMethodStore().getPasskeyV2({
+			rpId: authority.rpId,
+			credentialIdB64u: authority.credentialIdB64u
+		}) ? {
+			ok: false,
+			code: "duplicate_auth_method",
+			message: "Passkey credential is already registered"
+		} : null;
+		const duplicateEmailOtp = await this.getWalletAuthMethodStore().getEmailOtpV2({
+			walletId: authority.walletId,
+			emailHashHex: authority.emailHashHex
+		});
+		return duplicateEmailOtp && duplicateEmailOtp.status === "active" ? {
+			ok: false,
+			code: "duplicate_auth_method",
+			message: "Email OTP auth method is already registered"
+		} : null;
+	}
+	/**
+	* Mixed registration finalization runs in two requests. The ECDSA leg
+	* persists the founding authority and auth method before the deferred
+	* Ed25519 leg arrives, so that leg must address the same rows.
+	*/
+	async readActiveRegistrationIdentity(authority) {
+		let record;
+		switch (authority.kind) {
+			case "passkey":
+				record = await this.getWalletAuthMethodStore().getPasskeyV2({
+					rpId: authority.rpId,
+					credentialIdB64u: authority.credentialIdB64u
+				});
+				break;
+			case "email_otp":
+				record = await this.getWalletAuthMethodStore().getEmailOtpV2({
+					walletId: String(authority.walletId),
+					emailHashHex: authority.emailHashHex
+				});
+				break;
+			default: return unreachableRegistrationStartAuthority(authority);
+		}
+		if (!record || record.status !== "active" || record.walletId !== authority.walletId) return null;
+		if (authority.kind === "passkey") {
+			if (record.kind !== "passkey" || record.rpId !== authority.rpId || record.credentialIdB64u !== authority.credentialIdB64u || record.credentialPublicKeyB64u !== authority.credentialPublicKeyB64u) return null;
+		} else if (record.kind !== "email_otp" || record.emailHashHex !== authority.emailHashHex || record.registrationAuthorityId !== authority.registrationAuthorityId) return null;
+		const walletAuthority = await this.walletAuthorityStore.readById(record.walletAuthorityId);
+		if (!walletAuthority || walletAuthority.state !== "active" || walletAuthority.walletId !== record.walletId) return null;
+		return {
+			walletAuthorityId: record.walletAuthorityId,
+			walletAuthMethodId: record.walletAuthMethodId,
+			authority: walletAuthority,
+			authMethod: record
+		};
+	}
+	async readActiveRegistrationAuthority(authority) {
+		const identity = await this.readActiveRegistrationIdentity(authority);
+		if (!identity) return null;
+		const walletAuthority = await this.walletAuthorityStore.readById(identity.walletAuthorityId);
+		if (!walletAuthority || walletAuthority.state !== "active" || walletAuthority.walletId !== authority.walletId || walletAuthority.authorityId !== identity.walletAuthorityId) return null;
+		return {
+			authority: walletAuthority,
+			walletAuthMethodId: identity.walletAuthMethodId
+		};
+	}
+	async verifyWalletAuthMethodRevokeProof(input) {
+		try {
+			const operationFingerprintDigest = await computeWalletAuthMethodRevokeOperationFingerprintV1({
+				walletId: input.walletId,
+				targetWalletAuthMethodId: input.targetWalletAuthMethodId,
+				requestedAtMs: input.requestedAtMs
+			});
+			const verified = await verifyD1LinkedDeviceFreshRevokeProofV1({
+				walletId: input.walletId,
+				orgId: this.orgId,
+				targetWalletAuthMethodId: input.targetWalletAuthMethodId,
+				proof: input.sourceProof,
+				expectedOrigin: input.expectedOrigin,
+				verifiedAtMs: input.requestedAtMs,
+				operationFingerprintDigest,
+				walletAuthMethodStore: this.getWalletAuthMethodStore(),
+				verifyWebAuthnAuthenticationLite: this.verifyWebAuthnAuthenticationLite,
+				verifyEmailOtpExisting: this.emailOtpChallengeVerifier.verifyExisting.bind(this.emailOtpChallengeVerifier),
+				readEmailOtpEnrollment: this.emailOtpChallengeVerifier.readEnrollmentForWallet.bind(this.emailOtpChallengeVerifier)
+			});
+			if (verified.kind === "denied") return verified;
+			const sourceMethod = await this.getWalletAuthMethodStore().readByIdV2({ walletAuthMethodId: verified.walletAuthMethodId });
+			if (!sourceMethod || sourceMethod.status !== "active" || sourceMethod.walletId !== input.walletId || sourceMethod.walletAuthMethodId === input.targetWalletAuthMethodId) return {
+				kind: "denied",
+				code: "unauthorized",
+				message: "Fresh revocation proof is not from a different active wallet method"
+			};
+			const sourceAuthority = await this.walletAuthorityStore.readById(sourceMethod.walletAuthorityId);
+			if (!sourceAuthority || sourceAuthority.state !== "active" || sourceAuthority.walletId !== input.walletId || !isFullOwnerAuthorityV1(sourceAuthority)) return {
+				kind: "denied",
+				code: "unauthorized",
+				message: "Fresh revocation proof requires a full-owner authority"
+			};
+			return verified;
+		} catch (error) {
+			return {
+				kind: "denied",
+				code: "invalid",
+				message: errorMessage(error) || "Fresh revocation proof is invalid"
+			};
+		}
+	}
+	createPasskeyRegistrationOptions(input) {
+		return parseWalletAddAuthMethodRegistrationOptions({
+			kind: "webauthn_add_auth_method_registration_v1",
+			challengeId: secureRandomBase64Url(16, "add-auth-method registration challenge id"),
+			challengeB64u: secureRandomBase64Url(32, "add-auth-method registration challenge"),
+			rpId: input.rpId,
+			user: {
+				idB64u: base64UrlEncode(new TextEncoder().encode(String(input.walletId))),
+				name: String(input.walletId),
+				displayName: String(input.walletId)
+			},
+			pubKeyCredParams: [{
+				type: "public-key",
+				alg: -7
+			}, {
+				type: "public-key",
+				alg: -257
+			}],
+			authenticatorSelection: {
+				residentKey: "required",
+				userVerification: "preferred"
+			},
+			timeoutMs: 6e4,
+			attestation: "none",
+			extensions: { prf: { eval: {
+				firstB64u: base64UrlEncode(PASSKEY_PRF_FIRST_SALT_V1),
+				secondB64u: base64UrlEncode(PASSKEY_PRF_SECOND_SALT_V1)
+			} } },
+			excludeCredentials: input.walletMethods.filter((method) => method.kind === "passkey" && method.status === "active" && method.walletAuthorityId === input.sourceWalletAuthorityId && method.rpId === input.rpId).map((method) => ({
+				type: "public-key",
+				id: method.credentialIdB64u
+			}))
+		});
+	}
+	async revokeWalletAuthMethod(input) {
+		try {
+			const walletId = input.subject.walletId;
+			const sourceWalletAuthMethodId = input.verifiedSource.walletAuthMethodId;
+			if (sourceWalletAuthMethodId === input.walletAuthMethodId) return {
+				ok: false,
+				code: "unauthorized",
+				message: "Revocation requires a different active source auth method"
+			};
+			const walletAuthMethodStore = this.getWalletAuthMethodStore();
+			const sourceMethod = await walletAuthMethodStore.readByIdV2({ walletAuthMethodId: sourceWalletAuthMethodId });
+			const sourceAuthority = sourceMethod ? await this.walletAuthorityStore.readById(sourceMethod.walletAuthorityId) : null;
+			if (!sourceMethod || sourceMethod.status !== "active" || sourceMethod.walletId !== walletId || !sourceAuthority || sourceAuthority.state !== "active" || sourceAuthority.walletId !== walletId || !isFullOwnerAuthorityV1(sourceAuthority)) return {
+				ok: false,
+				code: "unauthorized",
+				message: "Fresh revocation proof requires a different active full-owner method"
+			};
+			const targetMethod = await walletAuthMethodStore.readByIdV2({ walletAuthMethodId: input.walletAuthMethodId });
+			if (!targetMethod || targetMethod.walletId !== walletId) return {
+				ok: false,
+				code: "not_found",
+				message: "wallet auth method not found"
+			};
+			if (targetMethod.status === "revoked") return walletAuthMethodRevokedResponse(walletId, targetMethod);
+			if (targetMethod.status !== "active") return {
+				ok: false,
+				code: "invalid_state",
+				message: "wallet auth method is not active"
+			};
+			const targetAuthority = await this.walletAuthorityStore.readById(targetMethod.walletAuthorityId);
+			if (!targetAuthority || targetAuthority.walletId !== walletId || targetAuthority.state !== "active") return {
+				ok: false,
+				code: "invalid_state",
+				message: "wallet auth method authority is not active"
+			};
+			const envelopeRevocation = await this.prepareRevokedMethodEnvelopeStatements({
+				walletId,
+				method: targetMethod,
+				revokedAtMs: input.requestedAtMs
+			});
+			if (envelopeRevocation.kind === "refused") return {
+				ok: false,
+				code: "invalid_state",
+				message: envelopeRevocation.reason
+			};
+			if (envelopeRevocation.kind === "version_mismatch") return {
+				ok: false,
+				code: "conflict",
+				message: "wallet custody envelope changed; retry revocation"
+			};
+			const revoked = await this.walletAuthorityStore.revokeWalletAuthMethod({
+				walletId,
+				authorityId: targetAuthority.authorityId,
+				walletAuthMethodId: input.walletAuthMethodId,
+				expectedAuthorityRevocationEpoch: targetAuthority.revocationEpoch,
+				requestedAtMs: input.requestedAtMs,
+				sessionRevocationStatements: [
+					...this.prepareOwnerWalletSessionRevocation({
+						walletId,
+						walletAuthMethodId: input.walletAuthMethodId,
+						requestedAtMs: input.requestedAtMs
+					}),
+					...envelopeRevocation.statements,
+					...targetMethod.kind === "email_otp" ? [this.emailOtpChallengeVerifier.prepareDeleteEnrollmentIfUnreferencedStatement(String(walletId))] : []
+				]
+			});
+			if (revoked.kind === "would_remove_last_wallet_auth_method") return {
+				ok: false,
+				code: "invalid_state",
+				message: "wallet must retain at least one active auth method"
+			};
+			if (revoked.kind === "conflict") return {
+				ok: false,
+				code: "conflict",
+				message: "wallet auth method changed; retry revocation"
+			};
+			return walletAuthMethodRevokedResponse(walletId, revoked.authMethod);
+		} catch (error) {
+			return {
+				ok: false,
+				code: "internal",
+				message: errorMessage(error) || "Failed to revoke wallet auth method"
+			};
+		}
+	}
+	async verifyRegistrationCredentialForIntent(input) {
+		const credential = toRecordValue(input.webauthnRegistration);
+		if (!credential) return {
+			ok: false,
+			code: "invalid_body",
+			message: "Missing webauthn_registration"
+		};
+		const response = toRecordValue(credential.response);
+		const clientData = parseWebAuthnClientDataJsonBase64url(normalizeOptionalTrimmedString(response?.clientDataJSON));
+		if (clientData.type !== "webauthn.create") return {
+			ok: false,
+			code: "invalid_body",
+			message: "Invalid webauthn_registration.clientDataJSON.type (expected webauthn.create)"
+		};
+		if (clientData.challenge !== input.expectedChallenge) return {
+			ok: false,
+			code: "challenge_mismatch",
+			message: "Registration challenge mismatch"
+		};
+		const expectedOrigin = normalizeOptionalTrimmedString(input.expectedOrigin);
+		if (!expectedOrigin) return {
+			ok: false,
+			code: "invalid_body",
+			message: "expected_origin is required for WebAuthn registration verification"
+		};
+		if (!d1HostIsWithinWebAuthnRpId(webAuthnOriginHostnameOrEmpty(clientData.origin), input.rpId)) return {
+			ok: false,
+			code: "invalid_origin",
+			message: "WebAuthn origin is not within rpId"
+		};
+		const verifyRegistrationResponse = (await loadSimpleWebAuthnServer()).verifyRegistrationResponse;
+		if (typeof verifyRegistrationResponse !== "function") return {
+			ok: false,
+			code: "unsupported",
+			message: "WebAuthn registration verifier is unavailable in this runtime"
+		};
+		const registrationRecord = toRecordValue(await verifyRegistrationResponse({
+			response: credential,
+			expectedChallenge: input.expectedChallenge,
+			expectedOrigin,
+			expectedRPID: input.rpId,
+			requireUserVerification: false
+		}));
+		if (registrationRecord?.verified !== true) return {
+			ok: false,
+			code: "not_verified",
+			message: "Registration verification failed"
+		};
+		const registrationInfo = toRecordValue(registrationRecord.registrationInfo);
+		const credentialInfo = toRecordValue(registrationInfo?.credential);
+		const credentialIdB64u = normalizeOptionalTrimmedString(credentialInfo?.id);
+		const publicKey = credentialInfo?.publicKey;
+		if (!credentialInfo || !credentialIdB64u || !(publicKey instanceof Uint8Array)) return {
+			ok: false,
+			code: "internal",
+			message: "Registration verification did not return credential public key material"
+		};
+		const counter = Number(credentialInfo.counter);
+		const transports = Array.isArray(credentialInfo.transports) ? credentialInfo.transports.filter((t) => typeof t === "string") : Array.isArray(response?.transports) ? response.transports.filter((t) => typeof t === "string") : [];
+		const device = deriveWebAuthnAuthenticatorDeviceInfo({
+			userAgent: input.userAgent,
+			aaguid: normalizeOptionalTrimmedString(registrationInfo?.aaguid) || "",
+			backedUp: registrationInfo?.credentialBackedUp === true,
+			transports
+		});
+		return {
+			ok: true,
+			credential: {
+				credentialIdB64u,
+				credentialPublicKeyB64u: base64UrlEncode(publicKey),
+				counter: Number.isFinite(counter) && counter >= 0 ? Math.floor(counter) : 0,
+				device
+			}
+		};
+	}
+	async verifyRegistrationPasskeyAuthority(input) {
+		if (input.intent.authMethod.kind !== "passkey") return {
+			ok: false,
+			code: "invalid_body",
+			message: "Passkey registration authority requires a passkey intent"
+		};
+		const verified = await this.verifyRegistrationCredentialForIntent({
+			webauthnRegistration: input.authority.webauthnRegistration,
+			expectedChallenge: input.expectedDigestB64u,
+			expectedOrigin: input.expectedOrigin,
+			rpId: input.intent.authMethod.rpId,
+			userAgent: input.userAgent
+		});
+		if (!verified.ok) return verified;
+		if (await this.getWalletAuthMethodStore().getPasskeyV2({
+			rpId: input.intent.authMethod.rpId,
+			credentialIdB64u: verified.credential.credentialIdB64u
+		})) return {
+			ok: false,
+			code: "duplicate_auth_method",
+			message: "Passkey credential is already registered"
+		};
+		return {
+			ok: true,
+			authority: {
+				kind: "passkey",
+				walletId: input.intent.walletId,
+				rpId: input.intent.authMethod.rpId,
+				credentialIdB64u: verified.credential.credentialIdB64u,
+				credentialPublicKeyB64u: verified.credential.credentialPublicKeyB64u,
+				counter: verified.credential.counter,
+				device: verified.credential.device,
+				registrationIntentDigestB64u: input.expectedDigestB64u
+			}
+		};
+	}
+	async verifyRegistrationEmailOtpAuthority(input) {
+		const proof = normalizeEmailOtpRegistrationProof(input.authority.emailOtpRegistrationProof);
+		if (!proof) return {
+			ok: false,
+			code: "invalid_body",
+			message: "emailOtpRegistrationProof is required for Email OTP registration"
+		};
+		if (proof.registrationIntentDigestB64u !== input.expectedDigestB64u) return {
+			ok: false,
+			code: "registration_intent_digest_mismatch",
+			message: "Email OTP registration proof is not bound to this registration intent"
+		};
+		if (input.intent.authMethod.kind !== "email_otp") return {
+			ok: false,
+			code: "invalid_body",
+			message: "Email OTP registration authority requires an Email OTP intent"
+		};
+		if (proof.proofKind === "google_sso_registration") {
+			if (input.intent.authMethod.proofKind !== "google_sso_registration") return {
+				ok: false,
+				code: "invalid_body",
+				message: "Google SSO registration proof requires a Google SSO registration intent"
+			};
+			if (proof.email !== input.intent.authMethod.email.toLowerCase()) return {
+				ok: false,
+				code: "email_mismatch",
+				message: "Email OTP registration proof email does not match the intent"
+			};
+			if (proof.googleEmailOtpRegistrationAttemptId !== input.intent.authMethod.googleEmailOtpRegistrationAttemptId) return {
+				ok: false,
+				code: "registration_attempt_mismatch",
+				message: "Google SSO registration proof does not match the registration attempt"
+			};
+			if (proof.googleEmailOtpRegistrationOfferId !== input.intent.authMethod.googleEmailOtpRegistrationOfferId || proof.googleEmailOtpRegistrationCandidateId !== input.intent.authMethod.googleEmailOtpRegistrationCandidateId) return {
+				ok: false,
+				code: "registration_offer_mismatch",
+				message: "Google SSO registration proof does not match the selected offer candidate"
+			};
+			const attempt = await this.googleEmailOtpRegistrationAttempts.read(proof.googleEmailOtpRegistrationAttemptId);
+			if (!attempt) return {
+				ok: false,
+				code: "registration_attempt_missing",
+				message: "Google Email OTP registration attempt expired or was not found"
+			};
+			if (attempt.state !== "started" && attempt.state !== "key_finalized") return {
+				ok: false,
+				code: "registration_attempt_not_started",
+				message: "Google Email OTP registration attempt is not active"
+			};
+			if (attempt.expiresAtMs <= Date.now()) {
+				await this.googleEmailOtpRegistrationAttempts.put(expiredGoogleEmailOtpRegistrationAttemptRecord({
+					record: attempt,
+					updatedAtMs: Date.now()
+				}));
+				return {
+					ok: false,
+					code: "registration_attempt_expired",
+					message: "Google Email OTP registration attempt expired"
+				};
+			}
+			if (attempt.email.toLowerCase() !== proof.email) return {
+				ok: false,
+				code: "email_mismatch",
+				message: "Google Email OTP registration attempt email does not match the proof"
+			};
+			if (attempt.offerId !== proof.googleEmailOtpRegistrationOfferId) return {
+				ok: false,
+				code: "registration_offer_mismatch",
+				message: "Google Email OTP registration attempt does not match the selected offer"
+			};
+			const selectedOfferCandidate = attempt.offerCandidates.find((candidate) => candidate.candidateId === proof.googleEmailOtpRegistrationCandidateId);
+			if (!selectedOfferCandidate || selectedOfferCandidate.walletId !== input.intent.walletId) return {
+				ok: false,
+				code: "registration_candidate_mismatch",
+				message: "Google Email OTP registration candidate does not match walletId"
+			};
+			if (attempt.walletId !== selectedOfferCandidate.walletId || attempt.selectedCandidateId !== selectedOfferCandidate.candidateId || attempt.collisionCounter !== selectedOfferCandidate.collisionCounter) await this.googleEmailOtpRegistrationAttempts.put(pendingGoogleEmailOtpRegistrationAttemptWithSelectedCandidate({
+				record: attempt,
+				candidate: selectedOfferCandidate,
+				updatedAtMs: Date.now()
+			}));
+			if (runtimePolicyScopeKey(attempt.runtimePolicyScope) !== runtimePolicyScopeKeyForRegistrationIntent(input.intent.runtimePolicyScope)) return {
+				ok: false,
+				code: "runtime_policy_scope_mismatch",
+				message: "Google Email OTP registration attempt does not match runtime policy scope"
+			};
+			const providerSubject = parseProviderSubject(attempt.providerSubject);
+			const finalWalletId = parseWalletIdForIntent(input.intent.walletId);
+			const orgId = parseOrgId(input.orgId);
+			if (!providerSubject.ok || !finalWalletId || !orgId.ok) return {
+				ok: false,
+				code: "invalid_body",
+				message: "Google SSO registration proof contains invalid domain fields"
+			};
+			const email = attempt.email.toLowerCase();
+			const emailHashHex = await this.emailHashHex(email);
+			const duplicateEmailOtp = await this.getWalletAuthMethodStore().getEmailOtpV2({
+				walletId: finalWalletId,
+				emailHashHex
+			});
+			if (duplicateEmailOtp && duplicateEmailOtp.status === "active") return {
+				ok: false,
+				code: "duplicate_auth_method",
+				message: "Email OTP auth method is already registered"
+			};
+			return {
+				ok: true,
+				authority: {
+					kind: "email_otp",
+					proofKind: "google_sso_registration",
+					walletId: finalWalletId,
+					providerSubject: providerSubject.value,
+					email,
+					emailHashHex,
+					googleEmailOtpRegistrationAttemptId: attempt.attemptId,
+					googleEmailOtpRegistrationOfferId: attempt.offerId,
+					googleEmailOtpRegistrationCandidateId: selectedOfferCandidate.candidateId,
+					registrationAuthorityId: attempt.attemptId,
+					finalWalletId,
+					orgId: orgId.value,
+					ownerProofBindingDigest: input.expectedDigestB64u,
+					registrationIntentDigestB64u: input.expectedDigestB64u
+				}
+			};
+		}
+		if (input.intent.authMethod.proofKind !== "otp_challenge") return {
+			ok: false,
+			code: "unsupported",
+			message: "Cloudflare D1 registration start currently supports direct Email OTP challenge intent"
+		};
+		if (proof.email !== input.intent.authMethod.email.toLowerCase()) return {
+			ok: false,
+			code: "email_mismatch",
+			message: "Email OTP registration proof email does not match the intent"
+		};
+		const verified = await this.emailOtpChallengeVerifier.verifyRegistrationResumable({
+			providerSubject: proof.providerSubject,
+			proofEmail: proof.email,
+			walletId: input.intent.walletId,
+			orgId: input.orgId,
+			challengeId: proof.challengeId,
+			otpCode: proof.otpCode,
+			otpChannel: proof.otpChannel,
+			ownerProofBindingDigest: input.expectedDigestB64u,
+			operationId: input.verificationOperationId,
+			receiptExpiresAtMs: input.verificationReceiptExpiresAtMs
+		});
+		if (!verified.ok) return verified;
+		if (normalizeOptionalTrimmedString(verified.email)?.toLowerCase() !== proof.email) return {
+			ok: false,
+			code: "email_mismatch",
+			message: "Verified Email OTP address does not match the registration proof"
+		};
+		const emailHashHex = await this.emailHashHex(proof.email);
+		const duplicateEmailOtp = await this.getWalletAuthMethodStore().getEmailOtpV2({
+			walletId: input.intent.walletId,
+			emailHashHex
+		});
+		if (duplicateEmailOtp && duplicateEmailOtp.status === "active") return {
+			ok: false,
+			code: "duplicate_auth_method",
+			message: "Email OTP auth method is already registered"
+		};
+		const providerSubject = parseProviderSubject(proof.providerSubject);
+		const challengeSubjectId = parseChallengeSubjectId(proof.providerSubject);
+		const challengeId = parseEmailOtpChallengeId(proof.challengeId);
+		const orgId = parseOrgId(input.orgId);
+		if (!providerSubject.ok || !challengeSubjectId.ok || !challengeId.ok || !orgId.ok) return {
+			ok: false,
+			code: "invalid_body",
+			message: "Email OTP registration proof contains invalid domain fields"
+		};
+		return {
+			ok: true,
+			authority: {
+				kind: "email_otp",
+				proofKind: "otp_challenge",
+				walletId: input.intent.walletId,
+				providerSubject: providerSubject.value,
+				challengeSubjectId: challengeSubjectId.value,
+				email: proof.email,
+				emailHashHex,
+				challengeId: challengeId.value,
+				registrationAuthorityId: challengeId.value,
+				originalWalletId: input.intent.walletId,
+				finalWalletId: input.intent.walletId,
+				orgId: orgId.value,
+				ownerProofBindingDigest: input.expectedDigestB64u,
+				challengePurpose: "registration",
+				registrationIntentDigestB64u: input.expectedDigestB64u
+			}
+		};
+	}
+	async verifyAddAuthMethodEmailOtpAuthority(input) {
+		const proof = input.authority.emailOtpRegistrationProof;
+		if (proof.proofKind !== "otp_challenge") return {
+			ok: false,
+			code: "invalid_body",
+			message: "Email OTP add-auth-method requires an OTP challenge proof"
+		};
+		if (proof.registrationIntentDigestB64u !== input.expectedDigestB64u) return {
+			ok: false,
+			code: "registration_intent_digest_mismatch",
+			message: "Email OTP registration proof is not bound to this add-auth-method intent"
+		};
+		if (input.intent.authMethod.kind !== "email_otp") return {
+			ok: false,
+			code: "invalid_body",
+			message: "Email OTP add-auth-method authority requires an Email OTP intent"
+		};
+		if (proof.email !== input.intent.authMethod.email.toLowerCase()) return {
+			ok: false,
+			code: "email_mismatch",
+			message: "Email OTP registration proof email does not match the intent"
+		};
+		const verified = await this.emailOtpChallengeVerifier.verifyRegistration({
+			providerSubject: proof.providerSubject,
+			proofEmail: proof.email,
+			walletId: input.intent.walletId,
+			orgId: input.orgId,
+			challengeId: proof.challengeId,
+			otpCode: proof.otpCode,
+			otpChannel: proof.otpChannel,
+			ownerProofBindingDigest: input.expectedDigestB64u
+		});
+		if (!verified.ok) return verified;
+		if (normalizeOptionalTrimmedString(verified.email)?.toLowerCase() !== proof.email) return {
+			ok: false,
+			code: "email_mismatch",
+			message: "Verified Email OTP address does not match the registration proof"
+		};
+		const emailHashHex = await this.emailHashHex(proof.email);
+		if ((await this.getWalletAuthMethodStore().listForWalletV2({ walletId: input.intent.walletId })).filter(isActiveWalletAuthMethodRecordV2).filter((method) => method.kind === "email_otp" && method.walletAuthorityId === input.sourceWalletAuthorityId).length > 0) return {
+			ok: false,
+			code: "already_configured",
+			message: "Wallet authority already has an active email_otp auth method"
+		};
+		const providerSubject = parseProviderSubject(proof.providerSubject);
+		const challengeSubjectId = parseChallengeSubjectId(proof.providerSubject);
+		const challengeId = parseEmailOtpChallengeId(proof.challengeId);
+		const orgId = parseOrgId(input.orgId);
+		if (!providerSubject.ok || !challengeSubjectId.ok || !challengeId.ok || !orgId.ok) return {
+			ok: false,
+			code: "invalid_body",
+			message: "Email OTP registration proof contains invalid domain fields"
+		};
+		return {
+			ok: true,
+			authority: {
+				kind: "email_otp",
+				proofKind: "otp_challenge",
+				walletId: input.intent.walletId,
+				providerSubject: providerSubject.value,
+				challengeSubjectId: challengeSubjectId.value,
+				email: proof.email,
+				emailHashHex,
+				challengeId: challengeId.value,
+				registrationAuthorityId: challengeId.value,
+				originalWalletId: input.intent.walletId,
+				finalWalletId: input.intent.walletId,
+				orgId: orgId.value,
+				ownerProofBindingDigest: input.expectedDigestB64u,
+				challengePurpose: "registration",
+				registrationIntentDigestB64u: input.expectedDigestB64u
+			}
+		};
+	}
+	async emailHashHex(email) {
+		return bytesToHex(await this.sha256Bytes(new TextEncoder().encode(email)));
+	}
+};
+//#endregion
+export { CloudflareD1WalletAuthMethodService };
+
+//# sourceMappingURL=d1WalletAuthMethodService.js.map