@seams/wallet-server 0.6.2 → 0.7.1

package/dist/esm/router/cloudflare/d1/passkeyCustody/d1WalletCustodyCommitStore.js

@@ -1,10 +1,11 @@
 import { mpcMaterialActivationRefsEqual, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { buildDelegatedWalletAuthorityV1, buildFullOwnerDelegatedWalletAuthorityV1, sameDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
-import { walletAuthorityDigestsMatchV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
-import { sameWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/registrationIntent.js";
+import { sameWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
+import { sameVerifiedActiveWalletAuthorityV1, walletAuthorityDigestsMatchV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
+import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
 import { D1WalletAuthMethodStore } from "../../../../core/d1WalletAuthMethodStore.js";
-import { parsePasskeyCustodyEnvelopeRecord, sameWalletCustodyEnvelopeOwnership } from "../../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
+import { parsePasskeyCustodyEnvelopeRecord } from "../../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
 import { WALLET_EMAIL_OTP_ACTIONS, emailOtpDeviceEnrollmentId } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { parseDerivedWalletRecoveryKeyId } from "../../../../shared-ts/src/wallet-recovery/recoveryKeyId.js";
@@ -20,7 +21,8 @@ import { parseEmailOtpWalletEnrollmentRow } from "../emailOtp/d1EmailOtpRecords.
 import "../../../../shared-ts/src/wallet-recovery/index.js";
 import "../../../../shared-ts/src/authorization/index.js";
 import { PASSKEY_ENVELOPE_KEY_PREFIX, passkeyCustodyEnvelopeLocatorOf, passkeyCustodyEnvelopeRecordKey } from "./d1PasskeyCustodyEnvelopeStore.js";
-import { parseWalletRecoveryGoogleEmailOtpAttemptRecord, walletRecoveryGoogleEmailOtpAttemptKey, walletRecoveryGoogleEmailOtpFinalizationInput } from "./d1WalletRecoveryGoogleEmailOtpRecords.js";
+import { parseWalletRecoveryGoogleEmailOtpAttemptRecord, sameWalletRecoveryGoogleEmailOtpFinalizationInputV1, walletRecoveryGoogleEmailOtpAttemptKey, walletRecoveryGoogleEmailOtpFinalizationInput } from "./d1WalletRecoveryGoogleEmailOtpRecords.js";
+import { sameWalletCustodyRecoveryReplacementEnvelopeV1 } from "../../../domains/passkeyCustody/walletRecoveryFinalization.js";
 //#region src/router/cloudflare/d1/passkeyCustody/d1WalletCustodyCommitStore.ts
 function sameWalletSignerActivationSetV1(left, right) {
 	if (left.kind !== right.kind || left.keyFamilies.length !== right.keyFamilies.length) return false;
@@ -40,52 +42,12 @@ function sameWalletEcdsaSignerActivationV1(left, right) {
 function sameWalletEd25519SignerActivationV1(left, right) {
 	return left.kind === right.kind && left.signer.kind === right.signer.kind && left.signer.keyFamily === right.signer.keyFamily && left.signer.walletId === right.signer.walletId && left.signer.walletKeyId === right.signer.walletKeyId && left.signer.registeredPublicKeyB64u === right.signer.registeredPublicKeyB64u && mpcMaterialActivationRefsEqual(left.materialActivation, right.materialActivation);
 }
-function sameWalletRecoveryGoogleEmailOtpFinalizationInputV1(left, right) {
-	return left.kind === right.kind && left.walletId === right.walletId && left.orgId === right.orgId && left.reservationId === right.reservationId && left.recoveryOperationId === right.recoveryOperationId && left.targetDeviceId === right.targetDeviceId && left.targetAuthorityId === right.targetAuthorityId && left.targetWalletAuthMethodId === right.targetWalletAuthMethodId && left.challengeId === right.challengeId && left.providerSubject === right.providerSubject && left.verifiedEmail === right.verifiedEmail && left.ownerProofBindingDigest === right.ownerProofBindingDigest && sameWalletRecoveryGoogleEmailOtpTargetEnrollmentV1(left.targetEnrollment, right.targetEnrollment);
-}
-function sameWalletRecoveryGoogleEmailOtpTargetEnrollmentV1(left, right) {
-	switch (left.kind) {
-		case "existing": return right.kind === "existing" && left.enrollmentId === right.enrollmentId && left.enrollmentSealKeyVersion === right.enrollmentSealKeyVersion;
-		case "create": return right.kind === "create" && left.providerSubject === right.providerSubject && left.verifiedEmail === right.verifiedEmail;
-		default: return assertNeverWalletRecoveryComparison(left, "Google Email OTP target enrollment");
-	}
-}
 function hasFullOwnerPermissionsV1(permissions) {
 	return sameDelegatedWalletAuthorityV1(buildDelegatedWalletAuthorityV1({ permissions }), buildFullOwnerDelegatedWalletAuthorityV1());
 }
-async function sameVerifiedActiveWalletAuthorityV1(left, right) {
-	const [leftVerified, rightVerified] = await Promise.all([walletAuthorityDigestsMatchV1(left), walletAuthorityDigestsMatchV1(right)]);
-	return leftVerified && rightVerified && left.authorityDigestB64u === right.authorityDigestB64u && left.signerActivationSetDigestB64u === right.signerActivationSetDigestB64u && left.createdAtMs === right.createdAtMs && left.updatedAtMs === right.updatedAtMs && left.activatedAtMs === right.activatedAtMs;
-}
-function sameWalletCustodyRecoveryReplacementEnvelopeV1(left, right) {
-	if (left.kind !== right.kind || left.envelopeId !== right.envelopeId || left.walletId !== right.walletId || !sameWalletCustodyEnvelopeOwnership(left.ownership, right.ownership) || left.binding.kind !== "wallet_custody_seed_v1" || right.binding.kind !== "wallet_custody_seed_v1" || left.binding.derivationScheme !== right.binding.derivationScheme || left.envelopeVersion !== right.envelopeVersion || left.envelopeRevision !== right.envelopeRevision || left.nonceB64u !== right.nonceB64u || left.sealedCustodySecretB64u !== right.sealedCustodySecretB64u || left.ciphertextDigestB64u !== right.ciphertextDigestB64u || left.aadHashB64u !== right.aadHashB64u || left.lifecycle.state !== "active" || right.lifecycle.state !== "active" || left.lifecycle.activatedAtMs !== right.lifecycle.activatedAtMs || left.createdAtMs !== right.createdAtMs || left.updatedAtMs !== right.updatedAtMs) return false;
-	switch (left.factor.kind) {
-		case "passkey": return right.factor.kind === "passkey" && left.factor.rpId === right.factor.rpId && left.factor.credentialIdB64u === right.factor.credentialIdB64u && left.factor.kekVersion === right.factor.kekVersion;
-		case "email_otp": return right.factor.kind === "email_otp" && left.factor.enrollmentId === right.factor.enrollmentId && left.factor.enrollmentSealKeyVersion === right.factor.enrollmentSealKeyVersion && left.factor.kekVersion === right.factor.kekVersion;
-		default: return assertNeverWalletRecoveryComparison(left.factor, "custody envelope factor");
-	}
-}
 function sameEmailOtpWalletEnrollmentRecordV1(left, right) {
 	return left.version === right.version && left.walletId === right.walletId && left.providerUserId === right.providerUserId && left.orgId === right.orgId && left.verifiedEmail === right.verifiedEmail && left.enrollmentId === right.enrollmentId && left.enrollmentVersion === right.enrollmentVersion && left.enrollmentSealKeyVersion === right.enrollmentSealKeyVersion && left.clientUnlockPublicKeyB64u === right.clientUnlockPublicKeyB64u && left.unlockKeyVersion === right.unlockKeyVersion && left.serverSealedFactorCiphertextB64u === right.serverSealedFactorCiphertextB64u && left.createdAtMs === right.createdAtMs && left.updatedAtMs === right.updatedAtMs;
 }
-function assertNeverWalletRecoveryComparison(value, label) {
-	throw new Error(`${label} branch is unsupported: ${String(value)}`);
-}
-const WEB_AUTHN_RECOVERY_CHALLENGE_CAS_GUARD = `
-  INSERT INTO router_ab_yao_versioned_json_cas_guard (guard_id)
-  SELECT 1
-   WHERE changes() = 0
-`;
-const RECOVERY_CODE_LOCATOR_CAS_GUARD = `
-  INSERT INTO router_ab_yao_versioned_json_cas_guard (guard_id)
-  SELECT 1
-   WHERE changes() = 0
-`;
-const WALLET_RECOVERY_GOOGLE_EMAIL_OTP_ATTEMPT_CAS_GUARD = `
-  INSERT INTO router_ab_yao_versioned_json_cas_guard (guard_id)
-  SELECT 1
-   WHERE changes() = 0
-`;
 function requireWalletId(value) {
 	const parsed = parseWalletId(value);
 	if (!parsed.ok) throw new Error(parsed.error.message);
@@ -237,6 +199,14 @@ var CloudflareD1WalletCustodyCommitStore = class {
 			return null;
 		}
 	}
+	tenantScope() {
+		return {
+			namespace: this.scope.namespace,
+			orgId: this.scope.orgId,
+			projectId: this.scope.projectId,
+			envId: this.scope.envId
+		};
+	}
 	prepareRecoveryCodeLocatorInsertStatement(locator) {
 		return this.database.prepare(`INSERT INTO wallet_recovery_code_locators
           (namespace, org_id, project_id, env_id, locator_b64u, wallet_id, recovery_key_id)
@@ -577,33 +547,18 @@ var CloudflareD1WalletCustodyCommitStore = class {
 		const recoverySetKey = walletRecoveryEnvelopeSetRecordKey(walletId);
 		const authorityStatement = prepareD1WalletAuthorityPutStatement({
 			database: this.database,
-			scope: {
-				namespace: this.scope.namespace,
-				orgId: this.scope.orgId,
-				projectId: this.scope.projectId,
-				envId: this.scope.envId
-			},
+			scope: this.tenantScope(),
 			authority: input.authority
 		});
 		const authenticatorStatement = prepareD1WebAuthnAuthenticatorInsertStatement({
 			database: this.database,
-			scope: {
-				namespace: this.scope.namespace,
-				orgId: this.scope.orgId,
-				projectId: this.scope.projectId,
-				envId: this.scope.envId
-			},
+			scope: this.tenantScope(),
 			userId: input.authenticatorCommit.userId,
 			record: input.authenticatorCommit.authenticator
 		});
 		const bindingStatement = prepareD1WebAuthnCredentialBindingInsertStatement({
 			database: this.database,
-			scope: {
-				namespace: this.scope.namespace,
-				orgId: this.scope.orgId,
-				projectId: this.scope.projectId,
-				envId: this.scope.envId
-			},
+			scope: this.tenantScope(),
 			record: input.authenticatorCommit.binding
 		});
 		const walletAuthMethodStatements = this.walletAuthMethodStore.prepareV2InsertStatements(targetMethod);
@@ -623,12 +578,12 @@ var CloudflareD1WalletCustodyCommitStore = class {
 				authenticatorStatement,
 				bindingStatement,
 				input.authenticatorCommit.challengeDeleteStatement,
-				this.database.prepare(WEB_AUTHN_RECOVERY_CHALLENGE_CAS_GUARD),
+				this.database.prepare(D1_BATCH_CAS_GUARD_SQL),
 				this.prepareRecoveryCodeLocatorConsumeStatement({
 					walletId,
 					recoveryKeyId: input.recoveryKeyId
 				}),
-				this.database.prepare(RECOVERY_CODE_LOCATOR_CAS_GUARD)
+				this.database.prepare(D1_BATCH_CAS_GUARD_SQL)
 			]);
 		} catch {
 			return { kind: "conflict" };
@@ -765,12 +720,7 @@ var CloudflareD1WalletCustodyCommitStore = class {
 		const recoverySetKey = walletRecoveryEnvelopeSetRecordKey(walletId);
 		const authorityStatement = prepareD1WalletAuthorityPutStatement({
 			database: this.database,
-			scope: {
-				namespace: this.scope.namespace,
-				orgId: this.scope.orgId,
-				projectId: this.scope.projectId,
-				envId: this.scope.envId
-			},
+			scope: this.tenantScope(),
 			authority: input.authority
 		});
 		const walletAuthMethodStatements = this.walletAuthMethodStore.prepareV2InsertStatements(targetMethod);
@@ -794,12 +744,12 @@ var CloudflareD1WalletCustodyCommitStore = class {
 					expectedVersion: input.recoveryAttemptStoreVersion,
 					finalizedAtMs: input.authority.updatedAtMs
 				}),
-				this.database.prepare(WALLET_RECOVERY_GOOGLE_EMAIL_OTP_ATTEMPT_CAS_GUARD),
+				this.database.prepare(D1_BATCH_CAS_GUARD_SQL),
 				this.prepareRecoveryCodeLocatorConsumeStatement({
 					walletId,
 					recoveryKeyId: input.recoveryKeyId
 				}),
-				this.database.prepare(RECOVERY_CODE_LOCATOR_CAS_GUARD)
+				this.database.prepare(D1_BATCH_CAS_GUARD_SQL)
 			]);
 		} catch {
 			return { kind: "conflict" };
@@ -818,6 +768,6 @@ var CloudflareD1WalletCustodyCommitStore = class {
 	}
 };
 //#endregion
-export { CloudflareD1WalletCustodyCommitStore, walletRecoveryBackupAcknowledgementRecordKey, walletRecoveryEnvelopeSetRecordKey };
+export { CloudflareD1WalletCustodyCommitStore };
 
 //# sourceMappingURL=d1WalletCustodyCommitStore.js.map

package/dist/esm/router/cloudflare/d1/passkeyCustody/d1WalletRecoveryGoogleEmailOtpRecords.js

@@ -2,8 +2,8 @@ import { parsePasskeyEnvelopeId, parseWalletAuthMethodId, parseWalletAuthorityId
 import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { parseEnvelopeRevision } from "../../../../shared-ts/src/passkey-custody/primitives.js";
+import { parseWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
-import { parseWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/registrationIntent.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
 import { parseRecoveryCodeReservationId } from "../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
 //#region src/router/cloudflare/d1/passkeyCustody/d1WalletRecoveryGoogleEmailOtpRecords.ts
@@ -65,6 +65,19 @@ function walletRecoveryGoogleEmailOtpFinalizationInput(attempt) {
 		targetEnrollment: attempt.targetEnrollment
 	};
 }
+function sameWalletRecoveryGoogleEmailOtpFinalizationInputV1(left, right) {
+	return left.kind === right.kind && left.walletId === right.walletId && left.orgId === right.orgId && left.reservationId === right.reservationId && left.recoveryOperationId === right.recoveryOperationId && left.targetDeviceId === right.targetDeviceId && left.targetAuthorityId === right.targetAuthorityId && left.targetWalletAuthMethodId === right.targetWalletAuthMethodId && left.challengeId === right.challengeId && left.providerSubject === right.providerSubject && left.verifiedEmail === right.verifiedEmail && left.ownerProofBindingDigest === right.ownerProofBindingDigest && sameWalletRecoveryGoogleEmailOtpTargetEnrollmentV1(left.targetEnrollment, right.targetEnrollment);
+}
+function sameWalletRecoveryGoogleEmailOtpTargetEnrollmentV1(left, right) {
+	switch (left.kind) {
+		case "existing": return right.kind === "existing" && left.enrollmentId === right.enrollmentId && left.enrollmentSealKeyVersion === right.enrollmentSealKeyVersion;
+		case "create": return right.kind === "create" && left.providerSubject === right.providerSubject && left.verifiedEmail === right.verifiedEmail;
+		default: return assertNeverWalletRecoveryGoogleEmailOtpComparison(left);
+	}
+}
+function assertNeverWalletRecoveryGoogleEmailOtpComparison(value) {
+	throw new Error(`unsupported Google Email OTP comparison branch: ${String(value)}`);
+}
 function parseWalletRecoveryGoogleEmailOtpAttemptRecord(raw) {
 	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
 	const record = raw;
@@ -299,6 +312,6 @@ function hasFields(record, fields) {
 	return fields.every((field) => Object.hasOwn(record, field));
 }
 //#endregion
-export { buildPreparedWalletRecoveryGoogleEmailOtpAttempt, markWalletRecoveryGoogleEmailOtpAttemptIssued, markWalletRecoveryGoogleEmailOtpAttemptVerified, parseWalletRecoveryGoogleEmailOtpAttemptRecord, walletRecoveryGoogleEmailOtpAttemptKey, walletRecoveryGoogleEmailOtpFinalizationInput };
+export { buildPreparedWalletRecoveryGoogleEmailOtpAttempt, markWalletRecoveryGoogleEmailOtpAttemptIssued, markWalletRecoveryGoogleEmailOtpAttemptVerified, parseWalletRecoveryGoogleEmailOtpAttemptRecord, sameWalletRecoveryGoogleEmailOtpFinalizationInputV1, walletRecoveryGoogleEmailOtpAttemptKey, walletRecoveryGoogleEmailOtpFinalizationInput };
 
 //# sourceMappingURL=d1WalletRecoveryGoogleEmailOtpRecords.js.map

package/dist/esm/router/cloudflare/d1/passkeyCustody/d1WalletRecoveryGoogleEmailOtpService.js

@@ -1,37 +1,17 @@
-import { parseProviderSubject, parseVerifiedGoogleEmail, parseWalletAuthorityBindingDigest } from "../../../../shared-ts/src/utils/domainIds.js";
+import { parseProviderSubject, parseVerifiedGoogleEmail } from "../../../../shared-ts/src/utils/domainIds.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { alphabetizeStringify, sha256BytesUtf8, sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import "../../../../shared-ts/src/utils/encoders.js";
-import { buildFullOwnerPermissionsV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
-import { buildActiveWalletAuthorityV1, computeWalletAuthorityDigestB64u, computeWalletSignerActivationSetDigestB64u, replaceActiveWalletAuthorityEd25519MaterialActivationV1, walletAuthorityDigestsMatchV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
-import { buildWalletAuthMethodRecordV2, sameWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/registrationIntent.js";
-import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { buildWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { consumeReservedRecoveryCode } from "../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
-import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
+import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { sealEmailOtpFactorSecretForWorker } from "../../../domains/emailOtp/emailOtpRouteHandlers.js";
-import "../../../../shared-ts/src/authorization/index.js";
-import { markWalletRecoveryGoogleEmailOtpAttemptIssued, markWalletRecoveryGoogleEmailOtpAttemptVerified, walletRecoveryGoogleEmailOtpFinalizationInput } from "./d1WalletRecoveryGoogleEmailOtpRecords.js";
+import { markWalletRecoveryGoogleEmailOtpAttemptIssued, markWalletRecoveryGoogleEmailOtpAttemptVerified, sameWalletRecoveryGoogleEmailOtpFinalizationInputV1, walletRecoveryGoogleEmailOtpFinalizationInput } from "./d1WalletRecoveryGoogleEmailOtpRecords.js";
 import { buildWalletRecoveryEcdsaPossessionChallengesV1, resolveWalletRecoveryKeyManifestV1, verifyWalletRecoveryKeyActivationsV1 } from "../../../domains/passkeyCustody/walletRecoveryKeyManifest.js";
+import { buildConsumedRecoverySet, buildRecoveredWalletAuthority, parseRecoveryAuthorityDigest, readRecoveryContinuityAnchor } from "../../../domains/passkeyCustody/walletRecoveryFinalization.js";
 //#region src/router/cloudflare/d1/passkeyCustody/d1WalletRecoveryGoogleEmailOtpService.ts
-function sameWalletRecoveryGoogleEmailOtpFinalizationInputV1(left, right) {
-	return left.kind === right.kind && left.walletId === right.walletId && left.orgId === right.orgId && left.reservationId === right.reservationId && left.recoveryOperationId === right.recoveryOperationId && left.targetDeviceId === right.targetDeviceId && left.targetAuthorityId === right.targetAuthorityId && left.targetWalletAuthMethodId === right.targetWalletAuthMethodId && left.challengeId === right.challengeId && left.providerSubject === right.providerSubject && left.verifiedEmail === right.verifiedEmail && left.ownerProofBindingDigest === right.ownerProofBindingDigest && sameWalletRecoveryGoogleEmailOtpTargetEnrollmentV1(left.targetEnrollment, right.targetEnrollment);
-}
-function sameWalletRecoveryGoogleEmailOtpTargetEnrollmentV1(left, right) {
-	switch (left.kind) {
-		case "existing": return right.kind === "existing" && left.enrollmentId === right.enrollmentId && left.enrollmentSealKeyVersion === right.enrollmentSealKeyVersion;
-		case "create": return right.kind === "create" && left.providerSubject === right.providerSubject && left.verifiedEmail === right.verifiedEmail;
-		default: return assertNeverWalletRecoveryGoogleEmailOtpComparison(left);
-	}
-}
-async function sameVerifiedActiveWalletAuthorityV1(left, right) {
-	const [leftVerified, rightVerified] = await Promise.all([walletAuthorityDigestsMatchV1(left), walletAuthorityDigestsMatchV1(right)]);
-	return leftVerified && rightVerified && left.authorityDigestB64u === right.authorityDigestB64u && left.signerActivationSetDigestB64u === right.signerActivationSetDigestB64u && left.createdAtMs === right.createdAtMs && left.updatedAtMs === right.updatedAtMs && left.activatedAtMs === right.activatedAtMs;
-}
-function assertNeverWalletRecoveryGoogleEmailOtpComparison(value) {
-	throw new Error(`unsupported Google Email OTP comparison branch: ${String(value)}`);
-}
 /**
 * Recovery-scoped Google and Email OTP coordinator. It owns only the
 * recovery operation binding; Google verification, OTP issuance/consumption,
@@ -235,7 +215,7 @@ var CloudflareD1WalletRecoveryGoogleEmailOtpService = class {
 		} catch (error) {
 			return recoveryFinalizationRefused(error instanceof Error ? error.message : "wallet recovery key manifest unavailable");
 		}
-		const continuity = await readGoogleEmailRecoveryContinuityAnchor({
+		const continuity = await readRecoveryContinuityAnchor({
 			walletId: recovery.walletId,
 			anchor: attempt.continuityAnchor,
 			manifest,
@@ -250,7 +230,7 @@ var CloudflareD1WalletRecoveryGoogleEmailOtpService = class {
 				walletId: recovery.walletId,
 				reservationId: String(recovery.reservationId),
 				replacementId: String(recovery.recoveryOperationId),
-				sourceAuthorityDigestB64u: googleEmailRecoveryAuthorityDigest(attempt.continuityAnchor.authority),
+				sourceAuthorityDigestB64u: parseRecoveryAuthorityDigest(attempt.continuityAnchor.authority),
 				challengeB64u: String(recovery.recoveryOperationId),
 				expiresAtMs: attempt.expiresAtMs
 			});
@@ -275,8 +255,9 @@ var CloudflareD1WalletRecoveryGoogleEmailOtpService = class {
 		}
 		let authority;
 		try {
-			authority = await buildGoogleEmailRecoveryAuthority({
-				recovery,
+			authority = await buildRecoveredWalletAuthority({
+				walletId: recovery.walletId,
+				target: recovery,
 				continuityAuthority: continuity.authority,
 				manifest,
 				nowMs: this.nowMs()
@@ -322,7 +303,7 @@ var CloudflareD1WalletRecoveryGoogleEmailOtpService = class {
 			nowMs: this.nowMs()
 		});
 		if (!consumed.ok || consumed.lifecycle.state !== "consumed") return recoveryAttemptUnavailableForFinalization();
-		const consumedRecoverySet = buildGoogleEmailConsumedRecoverySet({
+		const consumedRecoverySet = buildConsumedRecoverySet({
 			record: storedRecoverySet.record,
 			reservedIndex,
 			consumedLifecycle: consumed.lifecycle,
@@ -438,158 +419,6 @@ function validateGoogleEmailRecoveryEnvelope(input) {
 	if (envelope.walletId !== input.recovery.walletId || envelope.binding.kind !== "wallet_custody_seed_v1" || envelope.factor.kind !== "email_otp" || envelope.lifecycle.state !== "active" || Number(envelope.envelopeRevision) !== 1 || envelope.ownership.kind !== "method_bound" || envelope.ownership.walletAuthMethodId !== input.recovery.targetWalletAuthMethodId || envelope.factor.enrollmentId !== input.enrollment.enrollmentId || envelope.factor.enrollmentSealKeyVersion !== input.enrollment.enrollmentSealKeyVersion) return "the replacement Email OTP envelope is not bound to this recovery target";
 	return null;
 }
-async function readGoogleEmailRecoveryContinuityAnchor(input) {
-	const authority = await input.walletAuthorityStore.readById(input.anchor.authority.authorityId);
-	const expectedAuthority = authority ? await googleEmailRecoveryContinuityAuthorityAfterActivation({
-		authority: input.anchor.authority,
-		manifest: input.manifest,
-		updatedAtMs: authority.updatedAtMs
-	}) : null;
-	if (!authority || !expectedAuthority || authority.state !== "active" || authority.walletId !== input.walletId || !await sameVerifiedActiveWalletAuthorityV1(authority, expectedAuthority)) return {
-		kind: "rejected",
-		reason: "the recovery continuity authority changed"
-	};
-	const method = await input.walletCustodyCommits.readWalletAuthMethodById(input.anchor.method.walletAuthMethodId);
-	if (!method || method.status !== "active" || method.walletId !== input.walletId || !sameWalletAuthMethodRecordV2(method, input.anchor.method)) return {
-		kind: "rejected",
-		reason: "the recovery continuity method changed"
-	};
-	const envelopeLookup = await input.envelopeStore.lookupEnvelope(googleEmailContinuityEnvelopeLocator(input.anchor));
-	if (envelopeLookup.kind !== "active" || !googleEmailContinuityEnvelopeMatchesAnchor(envelopeLookup.envelope, input.anchor)) return {
-		kind: "rejected",
-		reason: "the recovery continuity envelope changed"
-	};
-	const authorityDigest = parseWalletAuthorityBindingDigest(String(input.anchor.authority.authorityDigestB64u));
-	if (!authorityDigest.ok) return {
-		kind: "rejected",
-		reason: "the recovery continuity authority changed"
-	};
-	return {
-		kind: "ready",
-		authority,
-		authorityRef: {
-			kind: "wallet_auth_authority_ref",
-			walletId: input.walletId,
-			authorityDigest: authorityDigest.value,
-			walletAuthMethodId: input.anchor.method.walletAuthMethodId
-		}
-	};
-}
-async function googleEmailRecoveryContinuityAuthorityAfterActivation(input) {
-	const ed25519 = googleEmailRecoverySignerActivations({
-		continuity: input.authority.signerActivations,
-		manifest: input.manifest
-	}).ed25519;
-	if (!ed25519) return input.authority;
-	return await replaceActiveWalletAuthorityEd25519MaterialActivationV1({
-		authority: input.authority,
-		materialActivation: ed25519.materialActivation,
-		updatedAtMs: input.updatedAtMs
-	});
-}
-function googleEmailRecoveryAuthorityDigest(authority) {
-	const parsed = parseWalletAuthorityBindingDigest(String(authority.authorityDigestB64u));
-	if (!parsed.ok) throw new Error("wallet recovery authority digest is invalid");
-	return parsed.value;
-}
-function googleEmailContinuityEnvelopeLocator(anchor) {
-	switch (anchor.envelope.kind) {
-		case "passkey": return {
-			walletId: anchor.envelope.walletId,
-			envelopeId: anchor.envelope.envelopeId,
-			factor: {
-				kind: "passkey",
-				rpId: anchor.envelope.rpId,
-				credentialIdB64u: anchor.envelope.credentialIdB64u
-			}
-		};
-		case "email_otp": return {
-			walletId: anchor.envelope.walletId,
-			envelopeId: anchor.envelope.envelopeId,
-			factor: {
-				kind: "email_otp",
-				enrollmentId: anchor.envelope.enrollmentId,
-				enrollmentSealKeyVersion: anchor.envelope.enrollmentSealKeyVersion
-			}
-		};
-	}
-}
-function googleEmailContinuityEnvelopeMatchesAnchor(envelope, anchor) {
-	if (envelope.lifecycle.state !== "active" || envelope.walletId !== anchor.envelope.walletId || envelope.envelopeId !== anchor.envelope.envelopeId || envelope.binding.kind !== "wallet_custody_seed_v1" || envelope.ownership.kind !== "method_bound" || envelope.ownership.walletAuthMethodId !== anchor.method.walletAuthMethodId || envelope.envelopeRevision !== anchor.envelope.envelopeRevision || envelope.updatedAtMs !== anchor.envelope.updatedAtMs) return false;
-	switch (anchor.envelope.kind) {
-		case "passkey": return envelope.factor.kind === "passkey" && envelope.factor.rpId === anchor.envelope.rpId && envelope.factor.credentialIdB64u === anchor.envelope.credentialIdB64u;
-		case "email_otp": return envelope.factor.kind === "email_otp" && envelope.factor.enrollmentId === anchor.envelope.enrollmentId && envelope.factor.enrollmentSealKeyVersion === anchor.envelope.enrollmentSealKeyVersion;
-	}
-}
-async function buildGoogleEmailRecoveryAuthority(input) {
-	const signerActivations = googleEmailRecoverySignerActivations({
-		continuity: input.continuityAuthority.signerActivations,
-		manifest: input.manifest
-	});
-	const signerActivationSetDigestB64u = await computeWalletSignerActivationSetDigestB64u(signerActivations);
-	const draft = {
-		kind: "wallet_authority_v1",
-		authorityId: input.recovery.targetAuthorityId,
-		walletId: input.recovery.walletId,
-		principal: {
-			kind: "owner_device",
-			deviceId: input.recovery.targetDeviceId
-		},
-		provenance: {
-			kind: "wallet_recovery",
-			recoveryOperationId: input.recovery.recoveryOperationId,
-			continuityAuthorityId: input.continuityAuthority.authorityId
-		},
-		permissions: buildFullOwnerPermissionsV1(),
-		signerActivations,
-		signerActivationSetDigestB64u,
-		authorityDigestB64u: input.continuityAuthority.authorityDigestB64u,
-		revocationEpoch: 0,
-		createdAtMs: input.nowMs,
-		updatedAtMs: input.nowMs,
-		state: "active",
-		activatedAtMs: input.nowMs
-	};
-	return buildActiveWalletAuthorityV1({
-		kind: draft.kind,
-		authorityId: draft.authorityId,
-		walletId: draft.walletId,
-		principal: draft.principal,
-		provenance: draft.provenance,
-		permissions: draft.permissions,
-		signerActivations: draft.signerActivations,
-		signerActivationSetDigestB64u: draft.signerActivationSetDigestB64u,
-		authorityDigestB64u: await computeWalletAuthorityDigestB64u(draft),
-		revocationEpoch: draft.revocationEpoch,
-		createdAtMs: draft.createdAtMs,
-		updatedAtMs: draft.updatedAtMs,
-		state: draft.state,
-		activatedAtMs: draft.activatedAtMs
-	});
-}
-function googleEmailRecoverySignerActivations(input) {
-	const continuityEd25519 = input.continuity.ed25519;
-	if (!continuityEd25519) return input.continuity;
-	const entries = input.manifest.entries.filter((entry) => entry.kind === "near_ed25519" && entry.registeredPublicKeyB64u === continuityEd25519.signer.registeredPublicKeyB64u && entry.recoveryBasis.capabilityKind === "recovery");
-	if (entries.length !== 1 || entries[0]?.kind !== "near_ed25519") throw new Error("wallet recovery has no exact fresh Ed25519 activation");
-	const ed25519 = {
-		kind: "wallet_ed25519_signer_activation_v1",
-		signer: continuityEd25519.signer,
-		materialActivation: routerAbMpcMaterialActivationRefFromWire(entries[0].recoveryBasis.activeMaterialActivation)
-	};
-	const continuityEcdsa = input.continuity.ecdsa;
-	if (!continuityEcdsa) return {
-		kind: "wallet_signer_activation_set_v1",
-		keyFamilies: ["ed25519"],
-		ed25519
-	};
-	return {
-		kind: "wallet_signer_activation_set_v1",
-		keyFamilies: ["ed25519", "ecdsa_secp256k1"],
-		ed25519,
-		ecdsa: continuityEcdsa
-	};
-}
 function buildGoogleEmailRecoveryAuthMethod(input) {
 	const method = buildWalletAuthMethodRecordV2({
 		version: "wallet_auth_method_v2",
@@ -607,26 +436,6 @@ function buildGoogleEmailRecoveryAuthMethod(input) {
 	if (method.kind !== "email_otp" || method.status !== "active") throw new Error("recovery Email method builder returned an invalid branch");
 	return method;
 }
-function buildGoogleEmailConsumedRecoverySet(input) {
-	const manifestKekWraps = input.record.manifestKekWraps.map((wrap, index) => {
-		if (index !== input.reservedIndex) return wrap;
-		return {
-			recoveryKeyId: wrap.recoveryKeyId,
-			nonceB64u: wrap.nonceB64u,
-			wrappedManifestKekB64u: wrap.wrappedManifestKekB64u,
-			aadHashB64u: wrap.aadHashB64u,
-			lifecycle: input.consumedLifecycle
-		};
-	});
-	return {
-		kind: "wallet_recovery_envelope_set_v1",
-		walletId: input.record.walletId,
-		manifestKekWraps,
-		entries: input.record.entries,
-		issuedAtMs: input.record.issuedAtMs,
-		updatedAtMs: input.nowMs
-	};
-}
 async function replayGoogleEmailOtpRecovery(input) {
 	const replay = await input.dependencies.walletCustodyCommits.resolveRecoveryGoogleEmailOtpReplay({
 		recovery: input.recovery,

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore.js

@@ -7,6 +7,19 @@ const TABLE_NAME = "registration_ceremony_records";
 const CAS_GUARD_SQL = `INSERT INTO registration_ceremony_cas_guard (guard_id)
 SELECT 1
  WHERE changes() = 0`;
+/** Replaces the record when it is still at the expected version (?10) and bumps the version. */
+const UPDATE_EXPECTED_VERSION_SQL = `UPDATE ${TABLE_NAME}
+            SET version = version + 1,
+                record_json = ?7,
+                expires_at_ms = ?8,
+                updated_at_ms = ?9
+          WHERE namespace = ?1
+            AND org_id = ?2
+            AND project_id = ?3
+            AND env_id = ?4
+            AND record_scope = ?5
+            AND record_id = ?6
+            AND version = ?10`;
 var D1RegistrationCeremonyRecordConflictError = class extends Error {
 	constructor(message) {
 		super(message);
@@ -48,30 +61,12 @@ var D1RegistrationCeremonyRecordStore = class {
 		if (recordsMatch(current, prepared)) return;
 		throw conflict("Registration ceremony record conflicts with the stored value");
 	}
-	async reserveExclusive(mutation) {
-		const key = this.normalizeKey(mutation.scope, mutation.id);
-		const prepared = prepareValue(mutation.value, mutation.expiresAtMs);
-		if (await this.insert(key, prepared)) return true;
-		await this.get(mutation.scope, mutation.id);
-		return await this.insert(key, prepared);
-	}
 	async updateExpected(input) {
 		const key = this.normalizeKey(input.scope, input.id);
 		const current = await this.get(input.scope, input.id);
 		if (!current || stableJson(current.value) !== stableJson(input.expected)) throw conflict("Registration ceremony record changed before update");
 		const next = prepareValue(input.next, input.expiresAtMs);
-		if (changes(await this.database.prepare(`UPDATE ${TABLE_NAME}
-            SET version = version + 1,
-                record_json = ?7,
-                expires_at_ms = ?8,
-                updated_at_ms = ?9
-          WHERE namespace = ?1
-            AND org_id = ?2
-            AND project_id = ?3
-            AND env_id = ?4
-            AND record_scope = ?5
-            AND record_id = ?6
-            AND version = ?10`).bind(...this.bindKey(key), next.recordJson, next.expiresAtMs, Date.now(), current.version).run()) !== 1) throw conflict("Registration ceremony record changed during update");
+		if (changes(await this.database.prepare(UPDATE_EXPECTED_VERSION_SQL).bind(...this.bindKey(key), next.recordJson, next.expiresAtMs, Date.now(), current.version).run()) !== 1) throw conflict("Registration ceremony record changed during update");
 	}
 	async claimEcdsaRegistrationBranch(input) {
 		const key = this.normalizeKey(input.scope, input.id);
@@ -130,18 +125,7 @@ var D1RegistrationCeremonyRecordStore = class {
 		const key = this.normalizeKey(input.scope, input.id);
 		if (!Number.isSafeInteger(input.expectedVersion) || input.expectedVersion < 1) throw new Error("Registration ceremony expected version is invalid");
 		const next = prepareValue(input.next, input.expiresAtMs);
-		if (changes(await this.database.prepare(`UPDATE ${TABLE_NAME}
-            SET version = version + 1,
-                record_json = ?7,
-                expires_at_ms = ?8,
-                updated_at_ms = ?9
-          WHERE namespace = ?1
-            AND org_id = ?2
-            AND project_id = ?3
-            AND env_id = ?4
-            AND record_scope = ?5
-            AND record_id = ?6
-            AND version = ?10`).bind(...this.bindKey(key), next.recordJson, next.expiresAtMs, Date.now(), input.expectedVersion).run()) !== 1) throw conflict("Registration ceremony record changed during versioned update");
+		if (changes(await this.database.prepare(UPDATE_EXPECTED_VERSION_SQL).bind(...this.bindKey(key), next.recordJson, next.expiresAtMs, Date.now(), input.expectedVersion).run()) !== 1) throw conflict("Registration ceremony record changed during versioned update");
 		return input.expectedVersion + 1;
 	}
 	async take(scope, id) {
@@ -312,6 +296,6 @@ function conflict(message) {
 	return new D1RegistrationCeremonyRecordConflictError(message);
 }
 //#endregion
-export { D1RegistrationCeremonyRecordConflictError, D1RegistrationCeremonyRecordStore };
+export { D1RegistrationCeremonyRecordStore };
 
 //# sourceMappingURL=d1RegistrationCeremonyRecordStore.js.map