@seams/wallet-server 0.6.2 → 0.7.3

package/dist/esm/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoCapabilityPersistence.js

@@ -1,7 +1,9 @@
 import { mpcMaterialActivationRefsEqual, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseWalletAuthorityV1, replaceActiveWalletAuthorityEd25519MaterialActivationV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { buildWalletSessionAuthorizationV2, buildWalletSessionCapabilitySubjectsV1, parseWalletSessionAuthorizationV2 } from "../../../../authorization/domain.js";
+import { parseWalletAuthorityV1, replaceActiveWalletAuthorityEd25519MaterialActivationV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
+import { buildWalletSessionAuthorizationV2, buildWalletSessionCapabilitySubjectsV1 } from "../../../../authorization/domain.js";
+import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
+import { parsePersistedWalletSessionAuthorizationV2 } from "../authorization/persistedWalletSessionAuthorization.js";
 import { ed25519NearPublicKeyFromBytes, replaceYaoEd25519WalletSignerActiveCapability } from "./d1Ed25519YaoWalletSigner.js";
 //#region src/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoCapabilityPersistence.ts
 const ROUTER_AB_ED25519_YAO_CAPABILITY_REPLACEMENT_TABLE_V1 = "router_ab_yao_capability_replacements";
@@ -58,14 +60,6 @@ function persistenceFailure(code, message) {
 		message
 	};
 }
-function persistenceUncertain(error) {
-	return {
-		ok: false,
-		disposition: "uncertain",
-		code: "capability_persistence_uncertain",
-		message: error instanceof Error ? error.message : String(error)
-	};
-}
 function parseRecordJson(value) {
 	if (typeof value !== "string" || !value) throw new Error("D1 record JSON is missing");
 	return JSON.parse(value);
@@ -79,7 +73,7 @@ var CloudflareD1RouterAbEd25519YaoCapabilityPersistence = class {
 		this.ensureSchemaOnUse = options.ensureSchema ?? true;
 		this.now = options.now ?? Date.now;
 	}
-	async replaceActiveCapability(input) {
+	async prepareActiveCapabilityReplacement(input) {
 		const operation = validateReplacementOperation(input.operation);
 		if (!operation.ok) return operation.failure;
 		await this.ensureSchema();
@@ -117,49 +111,42 @@ var CloudflareD1RouterAbEd25519YaoCapabilityPersistence = class {
 		const nextJson = JSON.stringify(replacement);
 		const previousBindingJson = JSON.stringify(input.previous.activeCapabilityBinding);
 		const nextBindingJson = JSON.stringify(input.next.activeCapabilityBinding);
-		try {
-			const statements = [this.database.prepare(`UPDATE wallet_signers
-                SET record_json = ?,
-                    updated_at_ms = ?
-              WHERE namespace = ?
-                AND org_id = ?
-                AND project_id = ?
-                AND env_id = ?
-                AND wallet_id = ?
-                AND signer_family = 'ed25519'
-                AND signer_id = ?
-                AND record_json = ?`).bind(nextJson, now, this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, signer.walletId, signer.signerId, previousJson)];
-			statements.push(this.database.prepare(`INSERT INTO ${ROUTER_AB_ED25519_YAO_CAPABILITY_REPLACEMENT_TABLE_V1} (
-              namespace,
-              org_id,
-              project_id,
-              env_id,
-              operation_id,
-              operation_fingerprint,
-              previous_capability_binding_json,
-              next_capability_binding_json,
-              created_at_ms
-            )
-            SELECT ?, ?, ?, ?, ?, ?, ?, ?, ?
-             WHERE changes() = 1`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, operation.value.operationId, operation.value.operationFingerprint, previousBindingJson, nextBindingJson, now));
-			for (const authorityReplacement of authorityReplacements) {
-				statements.push(this.prepareAuthorityReplacementStatement(authorityReplacement));
-				for (const session of authorityReplacement.sessions) statements.push(this.prepareSessionAuthorityProjectionReplacementStatement({
-					previous: session,
-					authority: authorityReplacement.next
-				}));
-			}
-			requireSuccessfulBatch(await this.database.batch(statements), statements.length);
-		} catch (error) {
-			return await this.reconcileAfterUncertainWrite(operation.value, input, error);
+		const statements = [this.database.prepare(`UPDATE wallet_signers
+              SET record_json = ?,
+                  updated_at_ms = ?
+            WHERE namespace = ?
+              AND org_id = ?
+              AND project_id = ?
+              AND env_id = ?
+              AND wallet_id = ?
+              AND signer_family = 'ed25519'
+              AND signer_id = ?
+              AND record_json = ?`).bind(nextJson, now, this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, signer.walletId, signer.signerId, previousJson), this.database.prepare(D1_BATCH_CAS_GUARD_SQL)];
+		statements.push(this.database.prepare(`INSERT INTO ${ROUTER_AB_ED25519_YAO_CAPABILITY_REPLACEMENT_TABLE_V1} (
+            namespace,
+            org_id,
+            project_id,
+            env_id,
+            operation_id,
+            operation_fingerprint,
+            previous_capability_binding_json,
+            next_capability_binding_json,
+            created_at_ms
+          )
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, operation.value.operationId, operation.value.operationFingerprint, previousBindingJson, nextBindingJson, now));
+		for (const authorityReplacement of authorityReplacements) {
+			statements.push(this.prepareAuthorityReplacementStatement(authorityReplacement));
+			statements.push(this.database.prepare(D1_BATCH_CAS_GUARD_SQL));
+			for (const session of authorityReplacement.sessions) statements.push(this.prepareSessionAuthorityProjectionReplacementStatement({
+				previous: session,
+				authority: authorityReplacement.next
+			}));
 		}
-		const committed = matchReceipt(await this.readReceipt(operation.value.operationId), operation.value, input);
-		if (committed === "match") return {
+		return {
 			ok: true,
-			disposition: "applied"
+			disposition: "prepared",
+			write: { statements }
 		};
-		if (committed === "conflict") return persistenceFailure("operation_conflict", "capability replacement operation raced with a different activation");
-		return persistenceFailure("capability_conflict", "durable Yao capability changed before recovery promotion");
 	}
 	async ensureSchema() {
 		if (!this.ensureSchemaOnUse || this.schemaReady) return;
@@ -199,7 +186,7 @@ var CloudflareD1RouterAbEd25519YaoCapabilityPersistence = class {
               AND authority_id = ?
               AND retired_at_ms IS NULL`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, input.walletId, String(previousAuthority.authorityId)).all();
 			const sessions = [];
-			for (const row of sessionRows.results ?? []) sessions.push(parseWalletSessionAuthorizationV2(parseRecordJson(row.record_json)));
+			for (const row of sessionRows.results ?? []) sessions.push(parsePersistedWalletSessionAuthorizationV2(parseRecordJson(row.record_json)));
 			replacements.push({
 				previous: previousAuthority,
 				next: nextAuthority,
@@ -267,19 +254,6 @@ var CloudflareD1RouterAbEd25519YaoCapabilityPersistence = class {
             AND operation_id = ?
           LIMIT 1`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, operationId).first();
 	}
-	async reconcileAfterUncertainWrite(operation, input, error) {
-		try {
-			const matched = matchReceipt(await this.readReceipt(operation.operationId), operation, input);
-			if (matched === "match") return {
-				ok: true,
-				disposition: "exact_retry"
-			};
-			if (matched === "conflict") return persistenceFailure("operation_conflict", "capability replacement operation belongs to a different activation");
-		} catch {
-			return persistenceUncertain(error);
-		}
-		return persistenceUncertain(error);
-	}
 };
 function validateReplacementOperation(operation) {
 	const operationId = operation.operationId.trim();
@@ -302,9 +276,6 @@ function matchReceipt(receipt, operation, input) {
 	if (!receipt) return "missing";
 	return receipt.operation_fingerprint === operation.operationFingerprint && receipt.previous_capability_binding_json === JSON.stringify(input.previous.activeCapabilityBinding) && receipt.next_capability_binding_json === JSON.stringify(input.next.activeCapabilityBinding) ? "match" : "conflict";
 }
-function requireSuccessfulBatch(results, expectedLength) {
-	if (results.length !== expectedLength || results.some((result) => result.success !== true)) throw new Error("capability replacement D1 batch failed");
-}
 //#endregion
 export { CloudflareD1RouterAbEd25519YaoCapabilityPersistence, ROUTER_AB_ED25519_YAO_CAPABILITY_REPLACEMENT_TABLE_V1 };
 

package/dist/esm/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoLifecycleDecisionStore.js

@@ -0,0 +1,69 @@
+import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
+//#region src/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoLifecycleDecisionStore.ts
+/**
+* The Gateway's Ed25519 Yao lifecycle decisions, in the signer database. A
+* decision is inserted once, in the batch that makes its finalization
+* visible, and never changes.
+*/
+var CloudflareD1Ed25519YaoLifecycleDecisionStoreV1 = class {
+	constructor(input) {
+		this.database = input.database;
+		this.scope = {
+			namespace: input.namespace,
+			orgId: input.orgId,
+			projectId: input.projectId,
+			envId: input.envId
+		};
+	}
+	async read(lifecycleId) {
+		const row = await this.database.prepare(`SELECT decision_kind, decision_id, wallet_id
+           FROM yao_lifecycle_decisions
+          WHERE namespace = ?1
+            AND org_id = ?2
+            AND project_id = ?3
+            AND env_id = ?4
+            AND lifecycle_id = ?5`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, lifecycleId).first();
+		if (!row) return null;
+		const kind = parseDecisionKind(row.decision_kind);
+		if (!kind) throw new Error("Stored Ed25519 Yao lifecycle decision has an unknown kind");
+		return {
+			lifecycleId,
+			kind,
+			decisionId: row.decision_id,
+			walletId: row.wallet_id
+		};
+	}
+	/**
+	* The statements that record `decision`, for a batch whose other statements
+	* make its finalization visible. The batch aborts unless they insert the
+	* decision: a lifecycle already decided, even the same way, commits nothing
+	* more.
+	*/
+	prepareDecideStatements(decision, decidedAtMs) {
+		return [this.database.prepare(`INSERT OR IGNORE INTO yao_lifecycle_decisions (
+             namespace, org_id, project_id, env_id, lifecycle_id,
+             decision_kind, decision_id, wallet_id, decided_at_ms
+           ) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9)`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, decision.lifecycleId, decision.kind, decision.decisionId, decision.walletId, decidedAtMs), this.database.prepare(D1_BATCH_CAS_GUARD_SQL)];
+	}
+	/**
+	* Commits `decision` and the statements that make its finalization visible
+	* in one batch. A guard among `visibility`, or a decision already recorded,
+	* aborts it and nothing commits: the caller reads what holds instead.
+	*/
+	async decide(decision, visibility, decidedAtMs) {
+		const statements = [...visibility, ...this.prepareDecideStatements(decision, decidedAtMs)];
+		const results = await this.database.batch(statements);
+		if (results.length !== statements.length || results.some((result) => !result.success)) throw new Error("Ed25519 Yao lifecycle decision batch did not complete");
+	}
+};
+function parseDecisionKind(value) {
+	switch (value) {
+		case "registration_finalized":
+		case "add_signer_finalized": return value;
+		default: return null;
+	}
+}
+//#endregion
+export { CloudflareD1Ed25519YaoLifecycleDecisionStoreV1 };
+
+//# sourceMappingURL=d1Ed25519YaoLifecycleDecisionStore.js.map

package/dist/esm/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoProductRegistrationPartitionedStateStore.js

@@ -9,8 +9,8 @@ function createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V
 	});
 	return createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1({
 		readMany: records.readMany.bind(records),
-		putMany: records.putMany.bind(records)
-	}, records.patchAtomically.bind(records));
+		putMany: async (mutations, companion) => await records.putManyWithAdditionalStatements(mutations, companion?.statements ?? [])
+	});
 }
 function identityVersionedJsonObject(value) {
 	return value;

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeIssuer.js

@@ -1,6 +1,7 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import "../../../../shared-ts/src/utils/validation.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { emailOtpChallengePurposeIsValid, emailOtpChallengeRecord, generateNumericOtp } from "./d1EmailOtpRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeIssuer.ts
@@ -8,18 +9,10 @@ function errorMessage(error) {
 	return error instanceof Error ? error.message : String(error || "");
 }
 function emailOtpEnrollmentTenantMismatch() {
-	return {
-		ok: false,
-		code: "tenant_scope_mismatch",
-		message: "Email OTP enrollment does not match the requested orgId"
-	};
+	return failure("tenant_scope_mismatch", "Email OTP enrollment does not match the requested orgId");
 }
 function emailOtpProviderIdentityMismatch() {
-	return {
-		ok: false,
-		code: "provider_identity_mismatch",
-		message: "Email OTP enrollment does not match the requested provider user"
-	};
+	return failure("provider_identity_mismatch", "Email OTP enrollment does not match the requested provider user");
 }
 var CloudflareD1EmailOtpChallengeIssuer = class {
 	constructor(input) {
@@ -40,39 +33,15 @@ var CloudflareD1EmailOtpChallengeIssuer = class {
 			const clientIp = normalizeOptionalTrimmedString(input.clientIp);
 			const action = input.action;
 			const operation = input.operation;
-			if (!userId) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Missing userId"
-			};
-			if (!walletId) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Missing walletId"
-			};
-			if (!orgId) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Missing orgId"
-			};
-			if (otpChannel !== "email_otp") return {
-				ok: false,
-				code: "invalid_body",
-				message: "otpChannel must be email_otp"
-			};
-			if (!ownerProofBindingDigest) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Missing ownerProofBindingDigest"
-			};
+			if (!userId) return failure("invalid_body", "Missing userId");
+			if (!walletId) return failure("invalid_body", "Missing walletId");
+			if (!orgId) return failure("invalid_body", "Missing orgId");
+			if (otpChannel !== "email_otp") return failure("invalid_body", "otpChannel must be email_otp");
+			if (!ownerProofBindingDigest) return failure("invalid_body", "Missing ownerProofBindingDigest");
 			if (!emailOtpChallengePurposeIsValid({
 				action,
 				operation
-			})) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Email OTP challenge action does not match operation"
-			};
+			})) return failure("invalid_body", "Email OTP challenge action does not match operation");
 			let challengeEmail = email;
 			if (action !== WALLET_EMAIL_OTP_ACTIONS.registration && action !== WALLET_EMAIL_OTP_ACTIONS.recoveryBootstrap) {
 				const enrollment = await this.readActiveEnrollment({
@@ -91,11 +60,7 @@ var CloudflareD1EmailOtpChallengeIssuer = class {
 				};
 				challengeEmail = enrollment.enrollment.verifiedEmail;
 			}
-			if (!challengeEmail) return {
-				ok: false,
-				code: "recovery_email_missing",
-				message: "Authenticated identity does not include a recovery email"
-			};
+			if (!challengeEmail) return failure("recovery_email_missing", "Authenticated identity does not include a recovery email");
 			const nowMs = Date.now();
 			await this.emailOtpChallenges.pruneExpired(nowMs);
 			if (input.reuseActiveChallenge === true) {
@@ -188,20 +153,12 @@ var CloudflareD1EmailOtpChallengeIssuer = class {
 				delivery: delivery.delivery
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				code: "internal",
-				message: errorMessage(error) || "Failed to create Email OTP challenge"
-			};
+			return failure("internal", errorMessage(error) || "Failed to create Email OTP challenge");
 		}
 	}
 	async readActiveEnrollment(input) {
 		const enrollment = await this.emailOtpEnrollments.readEnrollment(input.walletId);
-		if (!enrollment) return {
-			ok: false,
-			code: "not_found",
-			message: "Email OTP enrollment not found"
-		};
+		if (!enrollment) return failure("not_found", "Email OTP enrollment not found");
 		if (enrollment.orgId !== input.orgId) return emailOtpEnrollmentTenantMismatch();
 		if (enrollment.providerUserId !== input.providerUserId) return emailOtpProviderIdentityMismatch();
 		return {

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeService.js

@@ -1,6 +1,7 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import "../../../../shared-ts/src/utils/validation.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { emailOtpGrantRecord, maskEmail, parseEmailOtpLoginOperation } from "./d1EmailOtpRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeService.ts
@@ -89,26 +90,10 @@ var CloudflareD1EmailOtpChallengeService = class {
 			const orgId = normalizeOptionalTrimmedString(input.orgId);
 			const challengeId = normalizeOptionalTrimmedString(input.challengeId);
 			const registrationAttemptId = normalizeOptionalTrimmedString(input.googleEmailOtpRegistrationAttemptId);
-			if (!providerSubject) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Email OTP registration requires providerSubject"
-			};
-			if (!walletId) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Email OTP registration requires walletId"
-			};
-			if (!orgId) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Email OTP registration requires orgId"
-			};
-			if (!challengeId) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Email OTP registration requires challengeId"
-			};
+			if (!providerSubject) return failure("invalid_body", "Email OTP registration requires providerSubject");
+			if (!walletId) return failure("invalid_body", "Email OTP registration requires walletId");
+			if (!orgId) return failure("invalid_body", "Email OTP registration requires orgId");
+			if (!challengeId) return failure("invalid_body", "Email OTP registration requires challengeId");
 			const proofEmail = await this.resolveRegistrationProofEmail({
 				explicitProofEmail: input.proofEmail,
 				providerSubject,
@@ -129,11 +114,7 @@ var CloudflareD1EmailOtpChallengeService = class {
 			});
 			if (!verified.ok) return verified;
 			const verifiedEmail = normalizeOptionalTrimmedString(verified.email)?.toLowerCase() || "";
-			if (!verifiedEmail) return {
-				ok: false,
-				code: "internal",
-				message: "Email OTP enrollment verification did not include a verified email"
-			};
+			if (!verifiedEmail) return failure("internal", "Email OTP enrollment verification did not include a verified email");
 			const persisted = await this.finalizer.persistVerifiedEnrollment({
 				walletId: verified.walletId,
 				orgId: verified.orgId,
@@ -151,11 +132,7 @@ var CloudflareD1EmailOtpChallengeService = class {
 				enrollment: persisted.enrollment
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				code: "internal",
-				message: errorMessage(error) || "Failed to verify Email OTP enrollment"
-			};
+			return failure("internal", errorMessage(error) || "Failed to verify Email OTP enrollment");
 		}
 	}
 	async verifyEmailOtpChallenge(input) {
@@ -232,41 +209,21 @@ var CloudflareD1EmailOtpChallengeService = class {
 		};
 	}
 	async readEmailOtpOutboxEntry(input) {
-		if (!this.devOutboxEnabled) return {
-			ok: false,
-			code: "not_found",
-			message: "Email OTP dev outbox is not enabled"
-		};
+		if (!this.devOutboxEnabled) return failure("not_found", "Email OTP dev outbox is not enabled");
 		const challengeId = normalizeOptionalTrimmedString(input.challengeId);
 		const userId = normalizeOptionalTrimmedString(input.userId);
 		const walletId = normalizeOptionalTrimmedString(input.walletId);
-		if (!userId) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing userId"
-		};
-		if (!walletId) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing walletId"
-		};
+		if (!userId) return failure("invalid_body", "Missing userId");
+		if (!walletId) return failure("invalid_body", "Missing walletId");
 		const record = challengeId ? await this.challenges.read(challengeId) : await this.challenges.readLatestActiveForSubjectWallet({
 			challengeSubjectId: userId,
 			walletId,
 			nowMs: Date.now()
 		});
-		if (!record || record.challengeSubjectId !== userId || record.walletId !== walletId) return {
-			ok: false,
-			code: "not_found",
-			message: "Email OTP outbox entry was not found"
-		};
+		if (!record || record.challengeSubjectId !== userId || record.walletId !== walletId) return failure("not_found", "Email OTP outbox entry was not found");
 		if (Date.now() > record.expiresAtMs) {
 			await this.challenges.delete(challengeId);
-			return {
-				ok: false,
-				code: "not_found",
-				message: "Email OTP outbox entry expired"
-			};
+			return failure("not_found", "Email OTP outbox entry expired");
 		}
 		return {
 			ok: true,
@@ -286,33 +243,13 @@ var CloudflareD1EmailOtpChallengeService = class {
 				ok: true,
 				email: proofEmail
 			};
-			return {
-				ok: false,
-				code: "invalid_body",
-				message: "Email OTP registration requires proofEmail"
-			};
+			return failure("invalid_body", "Email OTP registration requires proofEmail");
 		}
 		const attempt = await this.registrationAttempts.read(input.registrationAttemptId);
-		if (!attempt) return {
-			ok: false,
-			code: "registration_attempt_missing",
-			message: "Google Email OTP registration attempt expired or was not found"
-		};
-		if (attempt.providerSubject !== input.providerSubject) return {
-			ok: false,
-			code: "challenge_subject_mismatch",
-			message: "Email OTP registration attempt does not match the provider subject"
-		};
-		if (attempt.expiresAtMs <= Date.now()) return {
-			ok: false,
-			code: "registration_attempt_expired",
-			message: "Google Email OTP registration attempt expired"
-		};
-		if (attempt.walletId !== input.walletId) return {
-			ok: false,
-			code: "wallet_identity_mismatch",
-			message: "registrationAttemptId does not match walletId"
-		};
+		if (!attempt) return failure("registration_attempt_missing", "Google Email OTP registration attempt expired or was not found");
+		if (attempt.providerSubject !== input.providerSubject) return failure("challenge_subject_mismatch", "Email OTP registration attempt does not match the provider subject");
+		if (attempt.expiresAtMs <= Date.now()) return failure("registration_attempt_expired", "Google Email OTP registration attempt expired");
+		if (attempt.walletId !== input.walletId) return failure("wallet_identity_mismatch", "registrationAttemptId does not match walletId");
 		proofEmail = attempt.email.toLowerCase();
 		return {
 			ok: true,

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeStore.js

@@ -1,5 +1,6 @@
-import { EMAIL_OTP_CHANNEL } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
+import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
 import { parseD1NonNegativeCount } from "../auth/d1RouterApiAuthBoundary.js";
+import { emailOtpChallengeRows, emailOtpUnlockChallengeRows } from "../../../../core/emailOtpD1Statements.js";
 import { emailOtpChallengeContextValues, emailOtpChallengeWithAttemptCount, parseEmailOtpChallengeRow, parseEmailOtpRegistrationVerificationReceiptV1, parseEmailOtpUnlockChallengeRow } from "./d1EmailOtpRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeStore.ts
 const REGISTRATION_VERIFICATION_RECEIPT_SCOPE = "email-otp-registration-verification-v1";
@@ -8,6 +9,7 @@ SELECT 1
  WHERE changes() = 0`;
 var CloudflareD1EmailOtpChallengeStore = class {
 	constructor(input) {
+		this.prepare = (sql, values) => this.database.prepare(sql).bind(...this.scopeValues(values));
 		this.database = input.database;
 		this.namespace = input.namespace;
 		this.orgId = input.orgId;
@@ -86,38 +88,7 @@ var CloudflareD1EmailOtpChallengeStore = class {
 		return deletedRecords;
 	}
 	async put(record) {
-		await this.prepare(`INSERT INTO email_otp_challenges (
-        namespace,
-        org_id,
-        project_id,
-        env_id,
-        challenge_id,
-        challenge_subject_id,
-        wallet_id,
-        record_org_id,
-        otp_channel,
-        owner_proof_binding_digest,
-        action,
-        operation,
-        otp_code,
-        record_json,
-        created_at_ms,
-        expires_at_ms
-      )
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
-			record.challengeId,
-			record.challengeSubjectId,
-			record.walletId,
-			record.orgId || "",
-			EMAIL_OTP_CHANNEL,
-			record.ownerProofBindingDigest,
-			record.action,
-			record.operation,
-			record.otpCode,
-			JSON.stringify(record),
-			record.createdAtMs,
-			record.expiresAtMs
-		]).run();
+		await emailOtpChallengeRows.insert(this.prepare, record).run();
 	}
 	async updateAttemptCount(record, attemptCount) {
 		const next = emailOtpChallengeWithAttemptCount(record, attemptCount);
@@ -137,12 +108,7 @@ var CloudflareD1EmailOtpChallengeStore = class {
 		]).run();
 	}
 	async delete(challengeId) {
-		await this.prepare(`DELETE FROM email_otp_challenges
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND challenge_id = ?`, [challengeId]).run();
+		await emailOtpChallengeRows.delete(this.prepare, challengeId).run();
 	}
 	async consume(challengeId) {
 		return parseEmailOtpChallengeRow(await this.prepare(`DELETE FROM email_otp_challenges
@@ -153,6 +119,25 @@ var CloudflareD1EmailOtpChallengeStore = class {
           AND challenge_id = ?
       RETURNING record_json, expires_at_ms`, [challengeId]).first());
 	}
+	/**
+	* The statements that consume one verified challenge inside a caller's
+	* batch. The delete matches the exact record, code and expiry the caller
+	* verified, and the guard aborts the whole batch when nothing matched: a
+	* challenge another request consumed first, or one that expired meanwhile.
+	* The guard collides with a row a migration seeds, so it aborts from the
+	* first time it fires.
+	*/
+	prepareConsumeInBatchStatements(challenge, nowMs) {
+		return [this.database.prepare(`DELETE FROM email_otp_challenges
+            WHERE namespace = ?1
+              AND org_id = ?2
+              AND project_id = ?3
+              AND env_id = ?4
+              AND challenge_id = ?5
+              AND record_json = ?6
+              AND otp_code = ?7
+              AND expires_at_ms > ?8`).bind(this.namespace, this.orgId, this.projectId, this.envId, challenge.challengeId, JSON.stringify(challenge), challenge.otpCode, nowMs), this.database.prepare(D1_BATCH_CAS_GUARD_SQL)];
+	}
 	async readRegistrationVerificationReceipt(challengeId, nowMs) {
 		const row = await this.database.prepare(`SELECT version, record_json, expires_at_ms
            FROM registration_ceremony_records
@@ -239,37 +224,10 @@ var CloudflareD1EmailOtpChallengeStore = class {
 		}
 	}
 	async putUnlock(record) {
-		await this.prepare(`INSERT INTO email_otp_unlock_challenges (
-        namespace,
-        org_id,
-        project_id,
-        env_id,
-        challenge_id,
-        wallet_id,
-        user_id,
-        record_org_id,
-        record_json,
-        created_at_ms,
-        expires_at_ms
-      )
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
-			record.challengeId,
-			record.walletId,
-			record.userId,
-			record.orgId || "",
-			JSON.stringify(record),
-			record.createdAtMs,
-			record.expiresAtMs
-		]).run();
+		await emailOtpUnlockChallengeRows.insert(this.prepare, record).run();
 	}
 	async consumeUnlock(challengeId) {
-		return parseEmailOtpUnlockChallengeRow(await this.prepare(`DELETE FROM email_otp_unlock_challenges
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND challenge_id = ?
-      RETURNING record_json, expires_at_ms`, [challengeId]).first());
+		return parseEmailOtpUnlockChallengeRow(await emailOtpUnlockChallengeRows.consume(this.prepare, challengeId).first());
 	}
 	async countActive(input) {
 		return parseD1NonNegativeCount((await this.prepare(`SELECT COUNT(*) AS subject_count
@@ -313,9 +271,6 @@ var CloudflareD1EmailOtpChallengeStore = class {
             )
         RETURNING record_json, expires_at_ms`).bind(...this.scopeValues([]), ...this.scopeValues([...emailOtpChallengeContextValues(input), input.nowMs])).first());
 	}
-	prepare(sql, values) {
-		return this.database.prepare(sql).bind(...this.scopeValues(values));
-	}
 	scopeValues(values) {
 		return [
 			this.namespace,