@seams/wallet-server 0.6.2 → 0.7.1

package/dist/esm/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoCapabilityPersistence.js

@@ -1,7 +1,9 @@
 import { mpcMaterialActivationRefsEqual, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseWalletAuthorityV1, replaceActiveWalletAuthorityEd25519MaterialActivationV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { buildWalletSessionAuthorizationV2, buildWalletSessionCapabilitySubjectsV1, parseWalletSessionAuthorizationV2 } from "../../../../authorization/domain.js";
+import { parseWalletAuthorityV1, replaceActiveWalletAuthorityEd25519MaterialActivationV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
+import { buildWalletSessionAuthorizationV2, buildWalletSessionCapabilitySubjectsV1 } from "../../../../authorization/domain.js";
+import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
+import { parsePersistedWalletSessionAuthorizationV2 } from "../authorization/persistedWalletSessionAuthorization.js";
 import { ed25519NearPublicKeyFromBytes, replaceYaoEd25519WalletSignerActiveCapability } from "./d1Ed25519YaoWalletSigner.js";
 //#region src/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoCapabilityPersistence.ts
 const ROUTER_AB_ED25519_YAO_CAPABILITY_REPLACEMENT_TABLE_V1 = "router_ab_yao_capability_replacements";
@@ -58,14 +60,6 @@ function persistenceFailure(code, message) {
 		message
 	};
 }
-function persistenceUncertain(error) {
-	return {
-		ok: false,
-		disposition: "uncertain",
-		code: "capability_persistence_uncertain",
-		message: error instanceof Error ? error.message : String(error)
-	};
-}
 function parseRecordJson(value) {
 	if (typeof value !== "string" || !value) throw new Error("D1 record JSON is missing");
 	return JSON.parse(value);
@@ -79,7 +73,7 @@ var CloudflareD1RouterAbEd25519YaoCapabilityPersistence = class {
 		this.ensureSchemaOnUse = options.ensureSchema ?? true;
 		this.now = options.now ?? Date.now;
 	}
-	async replaceActiveCapability(input) {
+	async prepareActiveCapabilityReplacement(input) {
 		const operation = validateReplacementOperation(input.operation);
 		if (!operation.ok) return operation.failure;
 		await this.ensureSchema();
@@ -117,49 +111,42 @@ var CloudflareD1RouterAbEd25519YaoCapabilityPersistence = class {
 		const nextJson = JSON.stringify(replacement);
 		const previousBindingJson = JSON.stringify(input.previous.activeCapabilityBinding);
 		const nextBindingJson = JSON.stringify(input.next.activeCapabilityBinding);
-		try {
-			const statements = [this.database.prepare(`UPDATE wallet_signers
-                SET record_json = ?,
-                    updated_at_ms = ?
-              WHERE namespace = ?
-                AND org_id = ?
-                AND project_id = ?
-                AND env_id = ?
-                AND wallet_id = ?
-                AND signer_family = 'ed25519'
-                AND signer_id = ?
-                AND record_json = ?`).bind(nextJson, now, this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, signer.walletId, signer.signerId, previousJson)];
-			statements.push(this.database.prepare(`INSERT INTO ${ROUTER_AB_ED25519_YAO_CAPABILITY_REPLACEMENT_TABLE_V1} (
-              namespace,
-              org_id,
-              project_id,
-              env_id,
-              operation_id,
-              operation_fingerprint,
-              previous_capability_binding_json,
-              next_capability_binding_json,
-              created_at_ms
-            )
-            SELECT ?, ?, ?, ?, ?, ?, ?, ?, ?
-             WHERE changes() = 1`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, operation.value.operationId, operation.value.operationFingerprint, previousBindingJson, nextBindingJson, now));
-			for (const authorityReplacement of authorityReplacements) {
-				statements.push(this.prepareAuthorityReplacementStatement(authorityReplacement));
-				for (const session of authorityReplacement.sessions) statements.push(this.prepareSessionAuthorityProjectionReplacementStatement({
-					previous: session,
-					authority: authorityReplacement.next
-				}));
-			}
-			requireSuccessfulBatch(await this.database.batch(statements), statements.length);
-		} catch (error) {
-			return await this.reconcileAfterUncertainWrite(operation.value, input, error);
+		const statements = [this.database.prepare(`UPDATE wallet_signers
+              SET record_json = ?,
+                  updated_at_ms = ?
+            WHERE namespace = ?
+              AND org_id = ?
+              AND project_id = ?
+              AND env_id = ?
+              AND wallet_id = ?
+              AND signer_family = 'ed25519'
+              AND signer_id = ?
+              AND record_json = ?`).bind(nextJson, now, this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, signer.walletId, signer.signerId, previousJson), this.database.prepare(D1_BATCH_CAS_GUARD_SQL)];
+		statements.push(this.database.prepare(`INSERT INTO ${ROUTER_AB_ED25519_YAO_CAPABILITY_REPLACEMENT_TABLE_V1} (
+            namespace,
+            org_id,
+            project_id,
+            env_id,
+            operation_id,
+            operation_fingerprint,
+            previous_capability_binding_json,
+            next_capability_binding_json,
+            created_at_ms
+          )
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, operation.value.operationId, operation.value.operationFingerprint, previousBindingJson, nextBindingJson, now));
+		for (const authorityReplacement of authorityReplacements) {
+			statements.push(this.prepareAuthorityReplacementStatement(authorityReplacement));
+			statements.push(this.database.prepare(D1_BATCH_CAS_GUARD_SQL));
+			for (const session of authorityReplacement.sessions) statements.push(this.prepareSessionAuthorityProjectionReplacementStatement({
+				previous: session,
+				authority: authorityReplacement.next
+			}));
 		}
-		const committed = matchReceipt(await this.readReceipt(operation.value.operationId), operation.value, input);
-		if (committed === "match") return {
+		return {
 			ok: true,
-			disposition: "applied"
+			disposition: "prepared",
+			write: { statements }
 		};
-		if (committed === "conflict") return persistenceFailure("operation_conflict", "capability replacement operation raced with a different activation");
-		return persistenceFailure("capability_conflict", "durable Yao capability changed before recovery promotion");
 	}
 	async ensureSchema() {
 		if (!this.ensureSchemaOnUse || this.schemaReady) return;
@@ -199,7 +186,7 @@ var CloudflareD1RouterAbEd25519YaoCapabilityPersistence = class {
               AND authority_id = ?
               AND retired_at_ms IS NULL`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, input.walletId, String(previousAuthority.authorityId)).all();
 			const sessions = [];
-			for (const row of sessionRows.results ?? []) sessions.push(parseWalletSessionAuthorizationV2(parseRecordJson(row.record_json)));
+			for (const row of sessionRows.results ?? []) sessions.push(parsePersistedWalletSessionAuthorizationV2(parseRecordJson(row.record_json)));
 			replacements.push({
 				previous: previousAuthority,
 				next: nextAuthority,
@@ -267,19 +254,6 @@ var CloudflareD1RouterAbEd25519YaoCapabilityPersistence = class {
             AND operation_id = ?
           LIMIT 1`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, operationId).first();
 	}
-	async reconcileAfterUncertainWrite(operation, input, error) {
-		try {
-			const matched = matchReceipt(await this.readReceipt(operation.operationId), operation, input);
-			if (matched === "match") return {
-				ok: true,
-				disposition: "exact_retry"
-			};
-			if (matched === "conflict") return persistenceFailure("operation_conflict", "capability replacement operation belongs to a different activation");
-		} catch {
-			return persistenceUncertain(error);
-		}
-		return persistenceUncertain(error);
-	}
 };
 function validateReplacementOperation(operation) {
 	const operationId = operation.operationId.trim();
@@ -302,9 +276,6 @@ function matchReceipt(receipt, operation, input) {
 	if (!receipt) return "missing";
 	return receipt.operation_fingerprint === operation.operationFingerprint && receipt.previous_capability_binding_json === JSON.stringify(input.previous.activeCapabilityBinding) && receipt.next_capability_binding_json === JSON.stringify(input.next.activeCapabilityBinding) ? "match" : "conflict";
 }
-function requireSuccessfulBatch(results, expectedLength) {
-	if (results.length !== expectedLength || results.some((result) => result.success !== true)) throw new Error("capability replacement D1 batch failed");
-}
 //#endregion
 export { CloudflareD1RouterAbEd25519YaoCapabilityPersistence, ROUTER_AB_ED25519_YAO_CAPABILITY_REPLACEMENT_TABLE_V1 };
 

package/dist/esm/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoLifecycleDecisionStore.js

@@ -0,0 +1,69 @@
+import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
+//#region src/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoLifecycleDecisionStore.ts
+/**
+* The Gateway's Ed25519 Yao lifecycle decisions, in the signer database. A
+* decision is inserted once, in the batch that makes its finalization
+* visible, and never changes.
+*/
+var CloudflareD1Ed25519YaoLifecycleDecisionStoreV1 = class {
+	constructor(input) {
+		this.database = input.database;
+		this.scope = {
+			namespace: input.namespace,
+			orgId: input.orgId,
+			projectId: input.projectId,
+			envId: input.envId
+		};
+	}
+	async read(lifecycleId) {
+		const row = await this.database.prepare(`SELECT decision_kind, decision_id, wallet_id
+           FROM yao_lifecycle_decisions
+          WHERE namespace = ?1
+            AND org_id = ?2
+            AND project_id = ?3
+            AND env_id = ?4
+            AND lifecycle_id = ?5`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, lifecycleId).first();
+		if (!row) return null;
+		const kind = parseDecisionKind(row.decision_kind);
+		if (!kind) throw new Error("Stored Ed25519 Yao lifecycle decision has an unknown kind");
+		return {
+			lifecycleId,
+			kind,
+			decisionId: row.decision_id,
+			walletId: row.wallet_id
+		};
+	}
+	/**
+	* The statements that record `decision`, for a batch whose other statements
+	* make its finalization visible. The batch aborts unless they insert the
+	* decision: a lifecycle already decided, even the same way, commits nothing
+	* more.
+	*/
+	prepareDecideStatements(decision, decidedAtMs) {
+		return [this.database.prepare(`INSERT OR IGNORE INTO yao_lifecycle_decisions (
+             namespace, org_id, project_id, env_id, lifecycle_id,
+             decision_kind, decision_id, wallet_id, decided_at_ms
+           ) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9)`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, decision.lifecycleId, decision.kind, decision.decisionId, decision.walletId, decidedAtMs), this.database.prepare(D1_BATCH_CAS_GUARD_SQL)];
+	}
+	/**
+	* Commits `decision` and the statements that make its finalization visible
+	* in one batch. A guard among `visibility`, or a decision already recorded,
+	* aborts it and nothing commits: the caller reads what holds instead.
+	*/
+	async decide(decision, visibility, decidedAtMs) {
+		const statements = [...visibility, ...this.prepareDecideStatements(decision, decidedAtMs)];
+		const results = await this.database.batch(statements);
+		if (results.length !== statements.length || results.some((result) => !result.success)) throw new Error("Ed25519 Yao lifecycle decision batch did not complete");
+	}
+};
+function parseDecisionKind(value) {
+	switch (value) {
+		case "registration_finalized":
+		case "add_signer_finalized": return value;
+		default: return null;
+	}
+}
+//#endregion
+export { CloudflareD1Ed25519YaoLifecycleDecisionStoreV1 };
+
+//# sourceMappingURL=d1Ed25519YaoLifecycleDecisionStore.js.map

package/dist/esm/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoProductRegistrationPartitionedStateStore.js

@@ -9,8 +9,8 @@ function createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V
 	});
 	return createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1({
 		readMany: records.readMany.bind(records),
-		putMany: records.putMany.bind(records)
-	}, records.patchAtomically.bind(records));
+		putMany: async (mutations, companion) => await records.putManyWithAdditionalStatements(mutations, companion?.statements ?? [])
+	});
 }
 function identityVersionedJsonObject(value) {
 	return value;

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeStore.js

@@ -1,5 +1,6 @@
-import { EMAIL_OTP_CHANNEL } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
+import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
 import { parseD1NonNegativeCount } from "../auth/d1RouterApiAuthBoundary.js";
+import { emailOtpChallengeRows, emailOtpUnlockChallengeRows } from "../../../../core/emailOtpD1Statements.js";
 import { emailOtpChallengeContextValues, emailOtpChallengeWithAttemptCount, parseEmailOtpChallengeRow, parseEmailOtpRegistrationVerificationReceiptV1, parseEmailOtpUnlockChallengeRow } from "./d1EmailOtpRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeStore.ts
 const REGISTRATION_VERIFICATION_RECEIPT_SCOPE = "email-otp-registration-verification-v1";
@@ -8,6 +9,7 @@ SELECT 1
  WHERE changes() = 0`;
 var CloudflareD1EmailOtpChallengeStore = class {
 	constructor(input) {
+		this.prepare = (sql, values) => this.database.prepare(sql).bind(...this.scopeValues(values));
 		this.database = input.database;
 		this.namespace = input.namespace;
 		this.orgId = input.orgId;
@@ -86,38 +88,7 @@ var CloudflareD1EmailOtpChallengeStore = class {
 		return deletedRecords;
 	}
 	async put(record) {
-		await this.prepare(`INSERT INTO email_otp_challenges (
-        namespace,
-        org_id,
-        project_id,
-        env_id,
-        challenge_id,
-        challenge_subject_id,
-        wallet_id,
-        record_org_id,
-        otp_channel,
-        owner_proof_binding_digest,
-        action,
-        operation,
-        otp_code,
-        record_json,
-        created_at_ms,
-        expires_at_ms
-      )
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
-			record.challengeId,
-			record.challengeSubjectId,
-			record.walletId,
-			record.orgId || "",
-			EMAIL_OTP_CHANNEL,
-			record.ownerProofBindingDigest,
-			record.action,
-			record.operation,
-			record.otpCode,
-			JSON.stringify(record),
-			record.createdAtMs,
-			record.expiresAtMs
-		]).run();
+		await emailOtpChallengeRows.insert(this.prepare, record).run();
 	}
 	async updateAttemptCount(record, attemptCount) {
 		const next = emailOtpChallengeWithAttemptCount(record, attemptCount);
@@ -137,12 +108,7 @@ var CloudflareD1EmailOtpChallengeStore = class {
 		]).run();
 	}
 	async delete(challengeId) {
-		await this.prepare(`DELETE FROM email_otp_challenges
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND challenge_id = ?`, [challengeId]).run();
+		await emailOtpChallengeRows.delete(this.prepare, challengeId).run();
 	}
 	async consume(challengeId) {
 		return parseEmailOtpChallengeRow(await this.prepare(`DELETE FROM email_otp_challenges
@@ -153,6 +119,25 @@ var CloudflareD1EmailOtpChallengeStore = class {
           AND challenge_id = ?
       RETURNING record_json, expires_at_ms`, [challengeId]).first());
 	}
+	/**
+	* The statements that consume one verified challenge inside a caller's
+	* batch. The delete matches the exact record, code and expiry the caller
+	* verified, and the guard aborts the whole batch when nothing matched: a
+	* challenge another request consumed first, or one that expired meanwhile.
+	* The guard collides with a row a migration seeds, so it aborts from the
+	* first time it fires.
+	*/
+	prepareConsumeInBatchStatements(challenge, nowMs) {
+		return [this.database.prepare(`DELETE FROM email_otp_challenges
+            WHERE namespace = ?1
+              AND org_id = ?2
+              AND project_id = ?3
+              AND env_id = ?4
+              AND challenge_id = ?5
+              AND record_json = ?6
+              AND otp_code = ?7
+              AND expires_at_ms > ?8`).bind(this.namespace, this.orgId, this.projectId, this.envId, challenge.challengeId, JSON.stringify(challenge), challenge.otpCode, nowMs), this.database.prepare(D1_BATCH_CAS_GUARD_SQL)];
+	}
 	async readRegistrationVerificationReceipt(challengeId, nowMs) {
 		const row = await this.database.prepare(`SELECT version, record_json, expires_at_ms
            FROM registration_ceremony_records
@@ -239,37 +224,10 @@ var CloudflareD1EmailOtpChallengeStore = class {
 		}
 	}
 	async putUnlock(record) {
-		await this.prepare(`INSERT INTO email_otp_unlock_challenges (
-        namespace,
-        org_id,
-        project_id,
-        env_id,
-        challenge_id,
-        wallet_id,
-        user_id,
-        record_org_id,
-        record_json,
-        created_at_ms,
-        expires_at_ms
-      )
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
-			record.challengeId,
-			record.walletId,
-			record.userId,
-			record.orgId || "",
-			JSON.stringify(record),
-			record.createdAtMs,
-			record.expiresAtMs
-		]).run();
+		await emailOtpUnlockChallengeRows.insert(this.prepare, record).run();
 	}
 	async consumeUnlock(challengeId) {
-		return parseEmailOtpUnlockChallengeRow(await this.prepare(`DELETE FROM email_otp_unlock_challenges
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND challenge_id = ?
-      RETURNING record_json, expires_at_ms`, [challengeId]).first());
+		return parseEmailOtpUnlockChallengeRow(await emailOtpUnlockChallengeRows.consume(this.prepare, challengeId).first());
 	}
 	async countActive(input) {
 		return parseD1NonNegativeCount((await this.prepare(`SELECT COUNT(*) AS subject_count
@@ -313,9 +271,6 @@ var CloudflareD1EmailOtpChallengeStore = class {
             )
         RETURNING record_json, expires_at_ms`).bind(...this.scopeValues([]), ...this.scopeValues([...emailOtpChallengeContextValues(input), input.nowMs])).first());
 	}
-	prepare(sql, values) {
-		return this.database.prepare(sql).bind(...this.scopeValues(values));
-	}
 	scopeValues(values) {
 		return [
 			this.namespace,

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeVerifier.js

@@ -61,6 +61,20 @@ var CloudflareD1EmailOtpChallengeVerifier = class {
 		return this.emailOtpEnrollments.prepareDeleteEnrollmentIfUnreferencedStatement(walletId);
 	}
 	async verifyExisting(input) {
+		const verified = await this.verifyExistingChallenge(input, "now");
+		if (!verified.ok) return verified;
+		const { consumeInBatch: _consumed, ...result } = verified;
+		return result;
+	}
+	/**
+	* Verifies an existing challenge for an operation that commits its
+	* consumption with its own writes. Nothing is consumed here: a batch that
+	* never commits leaves the challenge usable for an exact retry.
+	*/
+	async verifyExistingForBatch(input) {
+		return await this.verifyExistingChallenge(input, "in_batch");
+	}
+	async verifyExistingChallenge(input, consumption) {
 		try {
 			const userId = normalizeOptionalTrimmedString(input.userId);
 			const walletId = normalizeOptionalTrimmedString(input.walletId);
@@ -157,15 +171,18 @@ var CloudflareD1EmailOtpChallengeVerifier = class {
 				authState: authState.state,
 				record
 			});
-			const consumed = await this.emailOtpChallenges.consume(record.challengeId);
-			if (!consumed) return emailOtpChallengeInvalidOrExpired();
+			let consumeInBatch = [];
+			if (consumption === "now") {
+				if (!await this.emailOtpChallenges.consume(record.challengeId)) return emailOtpChallengeInvalidOrExpired();
+			} else consumeInBatch = this.emailOtpChallenges.prepareConsumeInBatchStatements(record, nowMs);
 			await this.emailOtpEnrollments.resetFailureState({
 				enrollment: enrollment.enrollment,
 				authState: authState.state
 			});
 			return {
 				ok: true,
-				challengeId: consumed.challengeId,
+				consumeInBatch,
+				challengeId: record.challengeId,
 				userId,
 				walletId,
 				orgId,

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpEnrollmentStore.js

@@ -1,3 +1,4 @@
+import { emailOtpAuthStateRows, emailOtpWalletEnrollmentRows } from "../../../../core/emailOtpD1Statements.js";
 import { emailOtpAuthStateRecord, parseEmailOtpAuthStateRow, parseEmailOtpWalletEnrollmentRow } from "./d1EmailOtpRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpEnrollmentStore.ts
 var CloudflareD1EmailOtpEnrollmentStore = class {
@@ -44,7 +45,7 @@ var CloudflareD1EmailOtpEnrollmentStore = class {
 	* Deletes the shared provider enrollment only once nothing references it.
 	*
 	* The enrollment is deliberately shared: every Email method on a wallet
-	* unwraps through it, and R109D keeps active and pending methods pointing at
+	* unwraps through it, and both active and pending methods keep pointing at
 	* one row. So revoking a method must not remove it — only the disappearance
 	* of its last reference may.
 	*
@@ -73,82 +74,20 @@ var CloudflareD1EmailOtpEnrollmentStore = class {
           )`, [walletId]);
 	}
 	prepareDeleteEnrollmentStatement(walletId) {
-		return this.prepare(`DELETE FROM email_otp_wallet_enrollments
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND wallet_id = ?`, [walletId]);
+		return emailOtpWalletEnrollmentRows.delete(this.prepare, walletId);
 	}
 	async putEnrollment(record) {
 		await this.preparePutEnrollmentStatement(record).run();
 	}
 	preparePutEnrollmentStatement(record) {
-		return this.prepare(`INSERT INTO email_otp_wallet_enrollments (
-        namespace,
-        org_id,
-        project_id,
-        env_id,
-        wallet_id,
-        provider_user_id,
-        record_org_id,
-        verified_email,
-        record_json,
-        created_at_ms,
-        updated_at_ms
-      )
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT (namespace, org_id, project_id, env_id, wallet_id)
-      DO UPDATE SET
-        provider_user_id = EXCLUDED.provider_user_id,
-        record_org_id = EXCLUDED.record_org_id,
-        verified_email = EXCLUDED.verified_email,
-        record_json = EXCLUDED.record_json,
-        created_at_ms = EXCLUDED.created_at_ms,
-        updated_at_ms = EXCLUDED.updated_at_ms`, [
-			record.walletId,
-			record.providerUserId,
-			record.orgId,
-			record.verifiedEmail,
-			JSON.stringify(record),
-			record.createdAtMs,
-			record.updatedAtMs
-		]);
+		return emailOtpWalletEnrollmentRows.upsert(this.prepare, record);
 	}
 	/** Inserts the first enrollment without turning a concurrent winner into an update. */
 	prepareInsertEnrollmentStatement(record) {
-		return this.prepare(`INSERT INTO email_otp_wallet_enrollments (
-        namespace,
-        org_id,
-        project_id,
-        env_id,
-        wallet_id,
-        provider_user_id,
-        record_org_id,
-        verified_email,
-        record_json,
-        created_at_ms,
-        updated_at_ms
-      )
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
-			record.walletId,
-			record.providerUserId,
-			record.orgId,
-			record.verifiedEmail,
-			JSON.stringify(record),
-			record.createdAtMs,
-			record.updatedAtMs
-		]);
+		return emailOtpWalletEnrollmentRows.insert(this.prepare, record);
 	}
 	async readAuthState(walletId) {
-		return parseEmailOtpAuthStateRow(await this.prepare(`SELECT record_json, updated_at_ms
-         FROM email_otp_auth_states
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND wallet_id = ?
-        LIMIT 1`, [walletId]).first());
+		return parseEmailOtpAuthStateRow(await emailOtpAuthStateRows.select(this.prepare, walletId).first());
 	}
 	async readAuthStateForEnrollment(enrollment) {
 		const state = await this.readAuthState(enrollment.walletId);
@@ -213,33 +152,7 @@ var CloudflareD1EmailOtpEnrollmentStore = class {
 		await this.preparePutAuthStateStatement(record).run();
 	}
 	preparePutAuthStateStatement(record) {
-		return this.prepare(`INSERT INTO email_otp_auth_states (
-        namespace,
-        org_id,
-        project_id,
-        env_id,
-        wallet_id,
-        provider_user_id,
-        record_org_id,
-        record_json,
-        created_at_ms,
-        updated_at_ms
-      )
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT (namespace, org_id, project_id, env_id, wallet_id)
-      DO UPDATE SET
-        provider_user_id = EXCLUDED.provider_user_id,
-        record_org_id = EXCLUDED.record_org_id,
-        record_json = EXCLUDED.record_json,
-        created_at_ms = EXCLUDED.created_at_ms,
-        updated_at_ms = EXCLUDED.updated_at_ms`, [
-			record.walletId,
-			record.providerUserId,
-			record.orgId,
-			JSON.stringify(record),
-			record.createdAtMs,
-			record.updatedAtMs
-		]);
+		return emailOtpAuthStateRows.upsert(this.prepare, record);
 	}
 };
 //#endregion

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpGrantStore.js

@@ -1,3 +1,4 @@
+import { emailOtpGrantRows } from "../../../../core/emailOtpD1Statements.js";
 import { parseEmailOtpGrantRow } from "./d1EmailOtpRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpGrantStore.ts
 var CloudflareD1EmailOtpGrantStore = class {
@@ -5,59 +6,16 @@ var CloudflareD1EmailOtpGrantStore = class {
 		this.prepare = input.prepare;
 	}
 	async put(record) {
-		await this.prepare(`INSERT INTO email_otp_grants (
-        namespace,
-        org_id,
-        project_id,
-        env_id,
-        grant_token,
-        user_id,
-        wallet_id,
-        record_org_id,
-        challenge_id,
-        action,
-        record_json,
-        issued_at_ms,
-        expires_at_ms
-      )
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
-			record.grantToken,
-			record.userId,
-			record.walletId,
-			record.orgId || "",
-			record.challengeId,
-			record.action,
-			JSON.stringify(record),
-			record.issuedAtMs,
-			record.expiresAtMs
-		]).run();
+		await emailOtpGrantRows.insert(this.prepare, record).run();
 	}
 	async consume(grantToken) {
-		return parseEmailOtpGrantRow(await this.prepare(`DELETE FROM email_otp_grants
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND grant_token = ?
-      RETURNING record_json, expires_at_ms`, [grantToken]).first());
+		return parseEmailOtpGrantRow(await emailOtpGrantRows.consume(this.prepare, grantToken).first());
 	}
 	async read(grantToken) {
-		return parseEmailOtpGrantRow(await this.prepare(`SELECT record_json, expires_at_ms
-         FROM email_otp_grants
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND grant_token = ?
-        LIMIT 1`, [grantToken]).first());
+		return parseEmailOtpGrantRow(await emailOtpGrantRows.select(this.prepare, grantToken).first());
 	}
 	async delete(grantToken) {
-		await this.prepare(`DELETE FROM email_otp_grants
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND grant_token = ?`, [grantToken]).run();
+		await emailOtpGrantRows.delete(this.prepare, grantToken).run();
 	}
 };
 //#endregion