@seams/wallet-server 0.6.2 → 0.7.3

package/dist/esm/router/cloudflare/d1/identity/d1IdentityService.js

@@ -1,5 +1,6 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import "../../../../shared-ts/src/utils/validation.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { parseD1BoundaryWalletId } from "../auth/d1RouterApiAuthBoundary.js";
 import { requireD1RouterApiAuthScopeString } from "../auth/d1RouterApiAuthConfig.js";
 import { deriveHostedNearAccountId } from "../../../../core/hostedAccountIds.js";
@@ -36,74 +37,42 @@ var CloudflareD1IdentityService = class {
 	async listIdentities(input) {
 		try {
 			const userId = normalizeOptionalTrimmedString(input.userId);
-			if (!userId) return {
-				ok: false,
-				code: "invalid_args",
-				message: "Missing userId"
-			};
+			if (!userId) return failure("invalid_args", "Missing userId");
 			return {
 				ok: true,
 				subjects: await this.identityStore.listSubjectsByUserId(userId)
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				code: "internal",
-				message: errorMessage(error) || "Failed to list identities"
-			};
+			return failure("internal", errorMessage(error) || "Failed to list identities");
 		}
 	}
 	async linkIdentity(input) {
 		try {
 			const userId = normalizeOptionalTrimmedString(input.userId);
 			const subject = normalizeOptionalTrimmedString(input.subject);
-			if (!userId) return {
-				ok: false,
-				code: "invalid_args",
-				message: "Missing userId"
-			};
-			if (!subject) return {
-				ok: false,
-				code: "invalid_args",
-				message: "Missing subject"
-			};
+			if (!userId) return failure("invalid_args", "Missing userId");
+			if (!subject) return failure("invalid_args", "Missing subject");
 			return await this.identityStore.linkSubjectToUserId({
 				userId,
 				subject,
 				allowMoveIfSoleIdentity: Boolean(input.allowMoveIfSoleIdentity)
 			});
 		} catch (error) {
-			return {
-				ok: false,
-				code: "internal",
-				message: errorMessage(error) || "Failed to link identity"
-			};
+			return failure("internal", errorMessage(error) || "Failed to link identity");
 		}
 	}
 	async unlinkIdentity(input) {
 		try {
 			const userId = normalizeOptionalTrimmedString(input.userId);
 			const subject = normalizeOptionalTrimmedString(input.subject);
-			if (!userId) return {
-				ok: false,
-				code: "invalid_args",
-				message: "Missing userId"
-			};
-			if (!subject) return {
-				ok: false,
-				code: "invalid_args",
-				message: "Missing subject"
-			};
+			if (!userId) return failure("invalid_args", "Missing userId");
+			if (!subject) return failure("invalid_args", "Missing subject");
 			return await this.identityStore.unlinkSubjectFromUserId({
 				userId,
 				subject
 			});
 		} catch (error) {
-			return {
-				ok: false,
-				code: "internal",
-				message: errorMessage(error) || "Failed to unlink identity"
-			};
+			return failure("internal", errorMessage(error) || "Failed to unlink identity");
 		}
 	}
 	async resolveOidcWalletId(input) {

package/dist/esm/router/cloudflare/d1/near/d1NearPublicKeyStore.js

@@ -1,6 +1,8 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import "../../../../shared-ts/src/utils/validation.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { parseNearPublicKey } from "../webauthn/d1WebAuthnRecords.js";
+import { NEAR_PUBLIC_KEYS_BY_USER_SQL } from "../../../../core/NearPublicKeyStore.js";
 //#region src/router/cloudflare/d1/near/d1NearPublicKeyStore.ts
 var CloudflareD1NearPublicKeyStore = class {
 	constructor(input) {
@@ -9,32 +11,17 @@ var CloudflareD1NearPublicKeyStore = class {
 	async listForRelayUser(input) {
 		try {
 			const userId = normalizeOptionalTrimmedString(input.userId);
-			if (!userId) return {
-				ok: false,
-				code: "invalid_args",
-				message: "Missing userId"
-			};
+			if (!userId) return failure("invalid_args", "Missing userId");
 			return {
 				ok: true,
 				keys: (await this.listForUser(userId)).map(nearPublicKeyForRelayResponse)
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				code: "internal",
-				message: nearPublicKeyErrorMessage(error) || "Failed to list keys"
-			};
+			return failure("internal", nearPublicKeyErrorMessage(error) || "Failed to list keys");
 		}
 	}
 	async listForUser(userId) {
-		const result = await this.prepare(`SELECT record_json
-         FROM near_public_keys
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND user_id = ?
-        ORDER BY COALESCE(signer_slot, 0) ASC, created_at_ms ASC, public_key ASC`, [userId]).all();
+		const result = await this.prepare(NEAR_PUBLIC_KEYS_BY_USER_SQL, [userId]).all();
 		const records = [];
 		for (const row of result.results || []) {
 			const record = parseNearPublicKey(row);

package/dist/esm/router/cloudflare/d1/oidc/d1OidcBoundary.js

@@ -2,7 +2,9 @@ import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
 import "../../../../shared-ts/src/utils/encoders.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import "../../../../shared-ts/src/utils/validation.js";
-import { toArrayBufferCopy, toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";
+import { failedVerification } from "../../../../shared-ts/src/utils/failure.js";
+import { toArrayBufferCopy } from "../../../../core/authService/portableCrypto.js";
+import { toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";
 //#region src/router/cloudflare/d1/oidc/d1OidcBoundary.ts
 function parseJwtAud(input) {
 	const values = [];
@@ -75,43 +77,18 @@ var CloudflareD1OidcJwksCache = class {
 };
 function parseRs256JwtForVerification(input) {
 	const parts = input.token.split(".");
-	if (parts.length !== 3) return {
-		ok: false,
-		verified: false,
-		code: "invalid_body",
-		message: `${input.tokenLabel} must be a JWT (3 segments)`
-	};
+	if (parts.length !== 3) return failedVerification("invalid_body", `${input.tokenLabel} must be a JWT (3 segments)`);
 	const headerB64u = parts[0] || "";
 	const payloadB64u = parts[1] || "";
 	const signatureB64u = parts[2] || "";
 	const header = parseJwtSegmentJson(headerB64u);
-	if (!header) return {
-		ok: false,
-		verified: false,
-		code: "invalid_body",
-		message: `Invalid ${input.tokenLabel} header encoding`
-	};
+	if (!header) return failedVerification("invalid_body", `Invalid ${input.tokenLabel} header encoding`);
 	const payload = parseJwtSegmentJson(payloadB64u);
-	if (!payload) return {
-		ok: false,
-		verified: false,
-		code: "invalid_body",
-		message: `Invalid ${input.tokenLabel} payload encoding`
-	};
+	if (!payload) return failedVerification("invalid_body", `Invalid ${input.tokenLabel} payload encoding`);
 	const kid = normalizeOptionalTrimmedString(header.kid);
 	const alg = normalizeOptionalTrimmedString(header.alg);
-	if (!kid) return {
-		ok: false,
-		verified: false,
-		code: "invalid_body",
-		message: `${input.tokenLabel} header.kid is required`
-	};
-	if (alg !== "RS256") return {
-		ok: false,
-		verified: false,
-		code: "invalid_body",
-		message: `${input.tokenLabel} header.alg must be RS256`
-	};
+	if (!kid) return failedVerification("invalid_body", `${input.tokenLabel} header.kid is required`);
+	if (alg !== "RS256") return failedVerification("invalid_body", `${input.tokenLabel} header.alg must be RS256`);
 	return {
 		ok: true,
 		jwt: {
@@ -128,24 +105,14 @@ async function verifyRs256JwtSignature(input) {
 	try {
 		signatureBytes = base64UrlDecode(input.jwt.signatureB64u);
 	} catch {
-		return {
-			ok: false,
-			verified: false,
-			code: "invalid_body",
-			message: `Invalid ${input.tokenLabel} signature encoding`
-		};
+		return failedVerification("invalid_body", `Invalid ${input.tokenLabel} signature encoding`);
 	}
 	const dataBytes = new TextEncoder().encode(`${input.jwt.headerB64u}.${input.jwt.payloadB64u}`);
 	const key = await input.subtle.importKey("jwk", input.jwk, {
 		name: "RSASSA-PKCS1-v1_5",
 		hash: "SHA-256"
 	}, false, ["verify"]);
-	if (!await input.subtle.verify({ name: "RSASSA-PKCS1-v1_5" }, key, toArrayBufferCopy(signatureBytes), toArrayBufferCopy(dataBytes))) return {
-		ok: false,
-		verified: false,
-		code: "invalid_signature",
-		message: input.invalidSignatureMessage
-	};
+	if (!await input.subtle.verify({ name: "RSASSA-PKCS1-v1_5" }, key, toArrayBufferCopy(signatureBytes), toArrayBufferCopy(dataBytes))) return failedVerification("invalid_signature", input.invalidSignatureMessage);
 	return { ok: true };
 }
 function parseBooleanJwtClaim(input) {
@@ -157,61 +124,21 @@ function parseBooleanJwtClaim(input) {
 function validateGoogleIdTokenClaims(input) {
 	const payload = input.payload;
 	const iss = normalizeOptionalTrimmedString(payload.iss);
-	if (iss !== "https://accounts.google.com" && iss !== "accounts.google.com") return {
-		ok: false,
-		verified: false,
-		code: "invalid_issuer",
-		message: "Invalid Google id_token issuer"
-	};
+	if (iss !== "https://accounts.google.com" && iss !== "accounts.google.com") return failedVerification("invalid_issuer", "Invalid Google id_token issuer");
 	const nowSec = Math.floor(Date.now() / 1e3);
 	const exp = Number(payload.exp);
-	if (!Number.isFinite(exp) || exp <= 0) return {
-		ok: false,
-		verified: false,
-		code: "invalid_claims",
-		message: "Invalid Google id_token exp"
-	};
-	if (nowSec >= exp) return {
-		ok: false,
-		verified: false,
-		code: "expired",
-		message: "Google id_token is expired"
-	};
+	if (!Number.isFinite(exp) || exp <= 0) return failedVerification("invalid_claims", "Invalid Google id_token exp");
+	if (nowSec >= exp) return failedVerification("expired", "Google id_token is expired");
 	if (payload.nbf !== void 0) {
 		const nbf = Number(payload.nbf);
-		if (!Number.isFinite(nbf)) return {
-			ok: false,
-			verified: false,
-			code: "invalid_claims",
-			message: "Invalid Google id_token nbf"
-		};
-		if (nowSec < nbf) return {
-			ok: false,
-			verified: false,
-			code: "not_yet_valid",
-			message: "Google id_token is not yet valid"
-		};
+		if (!Number.isFinite(nbf)) return failedVerification("invalid_claims", "Invalid Google id_token nbf");
+		if (nowSec < nbf) return failedVerification("not_yet_valid", "Google id_token is not yet valid");
 	}
 	const aud = parseJwtAud(payload.aud);
-	if (aud.length === 0) return {
-		ok: false,
-		verified: false,
-		code: "invalid_claims",
-		message: "Missing Google id_token aud"
-	};
-	if (!aud.includes(input.clientId)) return {
-		ok: false,
-		verified: false,
-		code: "invalid_audience",
-		message: "Google id_token audience mismatch"
-	};
+	if (aud.length === 0) return failedVerification("invalid_claims", "Missing Google id_token aud");
+	if (!aud.includes(input.clientId)) return failedVerification("invalid_audience", "Google id_token audience mismatch");
 	const sub = normalizeOptionalTrimmedString(payload.sub);
-	if (!sub) return {
-		ok: false,
-		verified: false,
-		code: "invalid_claims",
-		message: "Missing Google id_token sub"
-	};
+	if (!sub) return failedVerification("invalid_claims", "Missing Google id_token sub");
 	const email = normalizeOptionalTrimmedString(payload.email);
 	const name = normalizeOptionalTrimmedString(payload.name);
 	const givenName = normalizeOptionalTrimmedString(payload.given_name);

package/dist/esm/router/cloudflare/d1/oidc/d1OidcVerificationService.js

@@ -1,5 +1,6 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import "../../../../shared-ts/src/utils/validation.js";
+import { failedVerification } from "../../../../shared-ts/src/utils/failure.js";
 import { CloudflareD1OidcJwksCache, parseRs256JwtForVerification, validateGoogleIdTokenClaims, verifyRs256JwtSignature } from "./d1OidcBoundary.js";
 import { githubOAuthPublicConfig, verifyGithubOAuthCodeWithIdentityStore } from "../../../../core/authService/githubOAuth.js";
 //#region src/router/cloudflare/d1/oidc/d1OidcVerificationService.ts
@@ -45,26 +46,11 @@ var CloudflareD1OidcVerificationService = class {
 	async verifyGoogleIdToken(input, linkIdentity) {
 		try {
 			const clientId = normalizeOptionalTrimmedString(this.googleOidcClientId);
-			if (!clientId) return {
-				ok: false,
-				verified: false,
-				code: "not_configured",
-				message: "Google OIDC is not configured on this Worker"
-			};
+			if (!clientId) return failedVerification("not_configured", "Google OIDC is not configured on this Worker");
 			const idToken = normalizeOptionalTrimmedString(input.idToken ?? input.id_token);
-			if (!idToken) return {
-				ok: false,
-				verified: false,
-				code: "invalid_body",
-				message: "id_token is required"
-			};
+			if (!idToken) return failedVerification("invalid_body", "id_token is required");
 			const subtle = globalThis.crypto?.subtle;
-			if (!subtle) return {
-				ok: false,
-				verified: false,
-				code: "unsupported",
-				message: "WebCrypto (crypto.subtle) is unavailable in this runtime"
-			};
+			if (!subtle) return failedVerification("unsupported", "WebCrypto (crypto.subtle) is unavailable in this runtime");
 			const parsed = parseRs256JwtForVerification({
 				token: idToken,
 				tokenLabel: "id_token"
@@ -72,12 +58,7 @@ var CloudflareD1OidcVerificationService = class {
 			if (!parsed.ok) return parsed;
 			const jwt = parsed.jwt;
 			const jwk = (await this.oidcJwksCache.getGoogleJwks()).keysByKid.get(jwt.kid);
-			if (!jwk) return {
-				ok: false,
-				verified: false,
-				code: "unknown_kid",
-				message: "Unknown Google key id (kid)"
-			};
+			if (!jwk) return failedVerification("unknown_kid", "Unknown Google key id (kid)");
 			const signature = await verifyRs256JwtSignature({
 				subtle,
 				jwt,
@@ -106,12 +87,7 @@ var CloudflareD1OidcVerificationService = class {
 				...claims.hostedDomain ? { hostedDomain: claims.hostedDomain } : {}
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				verified: false,
-				code: "internal",
-				message: errorMessage(error) || "Google OIDC verification failed"
-			};
+			return failedVerification("internal", errorMessage(error) || "Google OIDC verification failed");
 		}
 	}
 	async linkGoogleIdentity(providerSubject) {

package/dist/esm/router/cloudflare/d1/passkeyCustody/d1PasskeyCustodyEnvelopeStore.js

@@ -433,7 +433,7 @@ var CloudflareD1PasskeyCustodyEnvelopeStore = class {
 	* The envelope row is insert-only, so a repeated envelope identity or any
 	* conflicting credential aborts the complete transaction.
 	*
-	* The factor kind is the caller's to assert, not this store's. Refactor 109C
+	* The factor kind is the caller's to assert, not this store's. Method addition
 	* enrols an Email OTP factor by exactly this route — a new envelope holding
 	* the same seed, committed with the auth-method insert — and each branch has
 	* already verified the factor it built the envelope for by the time it gets

package/dist/esm/router/cloudflare/d1/passkeyCustody/d1PasskeyCustodyRouteService.js

@@ -5,6 +5,7 @@ import "../../../../shared-ts/src/utils/encoders.js";
 import { isActiveRecoveredWalletAuthorityV1, walletAuthorityDigestsMatchV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { PASSKEY_PRF_FIRST_SALT_V1, PASSKEY_PRF_SECOND_SALT_V1 } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { isHostWithinRpId, originHostnameOrEmpty } from "../../../../core/authService/webauthnOidcHelpers.js";
 import { buildWalletRecoveryBackupAcknowledgementV1, walletRecoveryBackupIsOutstanding } from "../../../../shared-ts/src/wallet-recovery/backupAcknowledgement.js";
 import "../../../../shared-ts/src/wallet-recovery/recoveryCodes.js";
@@ -13,10 +14,10 @@ import { buildWebAuthnRecoveryContinuityAnchorRecord } from "../webauthn/d1WebAu
 import { buildWalletRecoveryCommittedProjectionV1 } from "../../../../shared-ts/src/wallet-recovery/walletRecoveryCommittedProjection.js";
 import { envelopeFactorRef } from "./d1PasskeyCustodyEnvelopeStore.js";
 import { buildPreparedWalletRecoveryGoogleEmailOtpAttempt, walletRecoveryGoogleEmailOtpFinalizationInput } from "./d1WalletRecoveryGoogleEmailOtpRecords.js";
-import { handlePasskeyCustodyEnvelopeRetrieval } from "../../../domains/passkeyCustody/passkeyCustodyEnvelopeRetrievalRoute.js";
-import { prepareWalletRecoveryWithCodeV1 } from "../../../domains/passkeyCustody/walletRecoveryAttempt.js";
 import { buildWalletRecoveryEcdsaPossessionChallengesV1, projectWalletRecoveryPreparationKeyManifestV1, projectWalletUnlockKeyManifestV1, resolveWalletRecoveryKeyManifestV1 } from "../../../domains/passkeyCustody/walletRecoveryKeyManifest.js";
 import { finalizeRecoveredWalletCredentialV1, resolveCommittedRecoveryReplayV1 } from "../../../domains/passkeyCustody/walletRecoveryFinalization.js";
+import { handlePasskeyCustodyEnvelopeRetrieval } from "../../../domains/passkeyCustody/passkeyCustodyEnvelopeRetrievalRoute.js";
+import { prepareWalletRecoveryWithCodeV1 } from "../../../domains/passkeyCustody/walletRecoveryAttempt.js";
 import { rotateWalletRecoveryCodesV1 } from "../../../domains/passkeyCustody/walletRecoveryRotation.js";
 //#region src/router/cloudflare/d1/passkeyCustody/d1PasskeyCustodyRouteService.ts
 /** How long a reservation may sit before another attempt may take the code. */
@@ -251,20 +252,12 @@ function createD1PasskeyCustodyRouteService(assembly) {
 			const expectedOrigin = String(request.expectedOrigin || "").trim();
 			if (!challengeId || !expectedOrigin) return {
 				status: 400,
-				body: {
-					ok: false,
-					code: "challenge_required",
-					message: "custody retrieval needs a server-issued challenge and an origin"
-				}
+				body: failure("challenge_required", "custody retrieval needs a server-issued challenge and an origin")
 			};
 			const challenge = await assembly.webAuthnStore.consumeLoginChallenge(challengeId);
 			if (!challenge) return {
 				status: 401,
-				body: {
-					ok: false,
-					code: "challenge_unknown",
-					message: "the challenge is unknown, expired, or already used"
-				}
+				body: failure("challenge_unknown", "the challenge is unknown, expired, or already used")
 			};
 			const projections = await assembly.passkeyCustodyEnvelopes.listWalletCredentialActivity(request.locator.walletId);
 			const requestedFactor = request.locator.factor;
@@ -275,11 +268,7 @@ function createD1PasskeyCustodyRouteService(assembly) {
 			const projection = matchingProjections.find((entry) => entry.index.lifecycle.state === "active") ?? matchingProjections[0];
 			if (!projection || projection.index.factor.kind !== "passkey") return {
 				status: 404,
-				body: {
-					ok: false,
-					code: "envelope_missing",
-					message: "no custody envelope for this wallet and credential"
-				}
+				body: failure("envelope_missing", "no custody envelope for this wallet and credential")
 			};
 			const locator = {
 				walletId: request.locator.walletId,
@@ -866,6 +855,6 @@ function authenticatorStoreView(store) {
 	};
 }
 //#endregion
-export { createD1PasskeyCustodyRouteService, createWalletRecoveryRegistrationOptions, selectWalletRecoveryContinuityAnchor };
+export { createD1PasskeyCustodyRouteService };
 
 //# sourceMappingURL=d1PasskeyCustodyRouteService.js.map

package/dist/esm/router/cloudflare/d1/passkeyCustody/d1WalletCustodyCommitStore.js

@@ -1,10 +1,11 @@
-import { mpcMaterialActivationRefsEqual, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { buildDelegatedWalletAuthorityV1, buildFullOwnerDelegatedWalletAuthorityV1, sameDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
-import { walletAuthorityDigestsMatchV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
-import { sameWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/registrationIntent.js";
+import { sameWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
+import { sameVerifiedActiveWalletAuthorityV1, walletAuthorityDigestsMatchV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
+import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
 import { D1WalletAuthMethodStore } from "../../../../core/d1WalletAuthMethodStore.js";
-import { parsePasskeyCustodyEnvelopeRecord, sameWalletCustodyEnvelopeOwnership } from "../../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
+import { parsePasskeyCustodyEnvelopeRecord } from "../../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
 import { WALLET_EMAIL_OTP_ACTIONS, emailOtpDeviceEnrollmentId } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { parseDerivedWalletRecoveryKeyId } from "../../../../shared-ts/src/wallet-recovery/recoveryKeyId.js";
@@ -19,8 +20,10 @@ import { CloudflareD1VersionedJsonRecordStore } from "../versionedJson/d1Version
 import { parseEmailOtpWalletEnrollmentRow } from "../emailOtp/d1EmailOtpRecords.js";
 import "../../../../shared-ts/src/wallet-recovery/index.js";
 import "../../../../shared-ts/src/authorization/index.js";
+import { sameWalletEcdsaSignerActivationV1, sameWalletEd25519SignerActivationV1 } from "../../../../shared-ts/src/authorization/walletSignerActivationEquality.js";
 import { PASSKEY_ENVELOPE_KEY_PREFIX, passkeyCustodyEnvelopeLocatorOf, passkeyCustodyEnvelopeRecordKey } from "./d1PasskeyCustodyEnvelopeStore.js";
-import { parseWalletRecoveryGoogleEmailOtpAttemptRecord, walletRecoveryGoogleEmailOtpAttemptKey, walletRecoveryGoogleEmailOtpFinalizationInput } from "./d1WalletRecoveryGoogleEmailOtpRecords.js";
+import { parseWalletRecoveryGoogleEmailOtpAttemptRecord, sameWalletRecoveryGoogleEmailOtpFinalizationInputV1, walletRecoveryGoogleEmailOtpAttemptKey, walletRecoveryGoogleEmailOtpFinalizationInput } from "./d1WalletRecoveryGoogleEmailOtpRecords.js";
+import { sameWalletCustodyRecoveryReplacementEnvelopeV1 } from "../../../domains/passkeyCustody/walletRecoveryFinalization.js";
 //#region src/router/cloudflare/d1/passkeyCustody/d1WalletCustodyCommitStore.ts
 function sameWalletSignerActivationSetV1(left, right) {
 	if (left.kind !== right.kind || left.keyFamilies.length !== right.keyFamilies.length) return false;
@@ -34,58 +37,12 @@ function sameWalletSignerActivationSetV1(left, right) {
 	if (leftEd25519 === void 0 !== (rightEd25519 === void 0)) return false;
 	return leftEd25519 === void 0 || rightEd25519 === void 0 || sameWalletEd25519SignerActivationV1(leftEd25519, rightEd25519);
 }
-function sameWalletEcdsaSignerActivationV1(left, right) {
-	return left.kind === right.kind && left.signer.kind === right.signer.kind && left.signer.keyFamily === right.signer.keyFamily && left.signer.walletId === right.signer.walletId && left.signer.walletKeyId === right.signer.walletKeyId && left.signer.thresholdPublicKey33B64u === right.signer.thresholdPublicKey33B64u && left.signer.evmAddress === right.signer.evmAddress && mpcMaterialActivationRefsEqual(left.materialActivation, right.materialActivation);
-}
-function sameWalletEd25519SignerActivationV1(left, right) {
-	return left.kind === right.kind && left.signer.kind === right.signer.kind && left.signer.keyFamily === right.signer.keyFamily && left.signer.walletId === right.signer.walletId && left.signer.walletKeyId === right.signer.walletKeyId && left.signer.registeredPublicKeyB64u === right.signer.registeredPublicKeyB64u && mpcMaterialActivationRefsEqual(left.materialActivation, right.materialActivation);
-}
-function sameWalletRecoveryGoogleEmailOtpFinalizationInputV1(left, right) {
-	return left.kind === right.kind && left.walletId === right.walletId && left.orgId === right.orgId && left.reservationId === right.reservationId && left.recoveryOperationId === right.recoveryOperationId && left.targetDeviceId === right.targetDeviceId && left.targetAuthorityId === right.targetAuthorityId && left.targetWalletAuthMethodId === right.targetWalletAuthMethodId && left.challengeId === right.challengeId && left.providerSubject === right.providerSubject && left.verifiedEmail === right.verifiedEmail && left.ownerProofBindingDigest === right.ownerProofBindingDigest && sameWalletRecoveryGoogleEmailOtpTargetEnrollmentV1(left.targetEnrollment, right.targetEnrollment);
-}
-function sameWalletRecoveryGoogleEmailOtpTargetEnrollmentV1(left, right) {
-	switch (left.kind) {
-		case "existing": return right.kind === "existing" && left.enrollmentId === right.enrollmentId && left.enrollmentSealKeyVersion === right.enrollmentSealKeyVersion;
-		case "create": return right.kind === "create" && left.providerSubject === right.providerSubject && left.verifiedEmail === right.verifiedEmail;
-		default: return assertNeverWalletRecoveryComparison(left, "Google Email OTP target enrollment");
-	}
-}
 function hasFullOwnerPermissionsV1(permissions) {
 	return sameDelegatedWalletAuthorityV1(buildDelegatedWalletAuthorityV1({ permissions }), buildFullOwnerDelegatedWalletAuthorityV1());
 }
-async function sameVerifiedActiveWalletAuthorityV1(left, right) {
-	const [leftVerified, rightVerified] = await Promise.all([walletAuthorityDigestsMatchV1(left), walletAuthorityDigestsMatchV1(right)]);
-	return leftVerified && rightVerified && left.authorityDigestB64u === right.authorityDigestB64u && left.signerActivationSetDigestB64u === right.signerActivationSetDigestB64u && left.createdAtMs === right.createdAtMs && left.updatedAtMs === right.updatedAtMs && left.activatedAtMs === right.activatedAtMs;
-}
-function sameWalletCustodyRecoveryReplacementEnvelopeV1(left, right) {
-	if (left.kind !== right.kind || left.envelopeId !== right.envelopeId || left.walletId !== right.walletId || !sameWalletCustodyEnvelopeOwnership(left.ownership, right.ownership) || left.binding.kind !== "wallet_custody_seed_v1" || right.binding.kind !== "wallet_custody_seed_v1" || left.binding.derivationScheme !== right.binding.derivationScheme || left.envelopeVersion !== right.envelopeVersion || left.envelopeRevision !== right.envelopeRevision || left.nonceB64u !== right.nonceB64u || left.sealedCustodySecretB64u !== right.sealedCustodySecretB64u || left.ciphertextDigestB64u !== right.ciphertextDigestB64u || left.aadHashB64u !== right.aadHashB64u || left.lifecycle.state !== "active" || right.lifecycle.state !== "active" || left.lifecycle.activatedAtMs !== right.lifecycle.activatedAtMs || left.createdAtMs !== right.createdAtMs || left.updatedAtMs !== right.updatedAtMs) return false;
-	switch (left.factor.kind) {
-		case "passkey": return right.factor.kind === "passkey" && left.factor.rpId === right.factor.rpId && left.factor.credentialIdB64u === right.factor.credentialIdB64u && left.factor.kekVersion === right.factor.kekVersion;
-		case "email_otp": return right.factor.kind === "email_otp" && left.factor.enrollmentId === right.factor.enrollmentId && left.factor.enrollmentSealKeyVersion === right.factor.enrollmentSealKeyVersion && left.factor.kekVersion === right.factor.kekVersion;
-		default: return assertNeverWalletRecoveryComparison(left.factor, "custody envelope factor");
-	}
-}
 function sameEmailOtpWalletEnrollmentRecordV1(left, right) {
 	return left.version === right.version && left.walletId === right.walletId && left.providerUserId === right.providerUserId && left.orgId === right.orgId && left.verifiedEmail === right.verifiedEmail && left.enrollmentId === right.enrollmentId && left.enrollmentVersion === right.enrollmentVersion && left.enrollmentSealKeyVersion === right.enrollmentSealKeyVersion && left.clientUnlockPublicKeyB64u === right.clientUnlockPublicKeyB64u && left.unlockKeyVersion === right.unlockKeyVersion && left.serverSealedFactorCiphertextB64u === right.serverSealedFactorCiphertextB64u && left.createdAtMs === right.createdAtMs && left.updatedAtMs === right.updatedAtMs;
 }
-function assertNeverWalletRecoveryComparison(value, label) {
-	throw new Error(`${label} branch is unsupported: ${String(value)}`);
-}
-const WEB_AUTHN_RECOVERY_CHALLENGE_CAS_GUARD = `
-  INSERT INTO router_ab_yao_versioned_json_cas_guard (guard_id)
-  SELECT 1
-   WHERE changes() = 0
-`;
-const RECOVERY_CODE_LOCATOR_CAS_GUARD = `
-  INSERT INTO router_ab_yao_versioned_json_cas_guard (guard_id)
-  SELECT 1
-   WHERE changes() = 0
-`;
-const WALLET_RECOVERY_GOOGLE_EMAIL_OTP_ATTEMPT_CAS_GUARD = `
-  INSERT INTO router_ab_yao_versioned_json_cas_guard (guard_id)
-  SELECT 1
-   WHERE changes() = 0
-`;
 function requireWalletId(value) {
 	const parsed = parseWalletId(value);
 	if (!parsed.ok) throw new Error(parsed.error.message);
@@ -237,6 +194,14 @@ var CloudflareD1WalletCustodyCommitStore = class {
 			return null;
 		}
 	}
+	tenantScope() {
+		return {
+			namespace: this.scope.namespace,
+			orgId: this.scope.orgId,
+			projectId: this.scope.projectId,
+			envId: this.scope.envId
+		};
+	}
 	prepareRecoveryCodeLocatorInsertStatement(locator) {
 		return this.database.prepare(`INSERT INTO wallet_recovery_code_locators
           (namespace, org_id, project_id, env_id, locator_b64u, wallet_id, recovery_key_id)
@@ -577,33 +542,18 @@ var CloudflareD1WalletCustodyCommitStore = class {
 		const recoverySetKey = walletRecoveryEnvelopeSetRecordKey(walletId);
 		const authorityStatement = prepareD1WalletAuthorityPutStatement({
 			database: this.database,
-			scope: {
-				namespace: this.scope.namespace,
-				orgId: this.scope.orgId,
-				projectId: this.scope.projectId,
-				envId: this.scope.envId
-			},
+			scope: this.tenantScope(),
 			authority: input.authority
 		});
 		const authenticatorStatement = prepareD1WebAuthnAuthenticatorInsertStatement({
 			database: this.database,
-			scope: {
-				namespace: this.scope.namespace,
-				orgId: this.scope.orgId,
-				projectId: this.scope.projectId,
-				envId: this.scope.envId
-			},
+			scope: this.tenantScope(),
 			userId: input.authenticatorCommit.userId,
 			record: input.authenticatorCommit.authenticator
 		});
 		const bindingStatement = prepareD1WebAuthnCredentialBindingInsertStatement({
 			database: this.database,
-			scope: {
-				namespace: this.scope.namespace,
-				orgId: this.scope.orgId,
-				projectId: this.scope.projectId,
-				envId: this.scope.envId
-			},
+			scope: this.tenantScope(),
 			record: input.authenticatorCommit.binding
 		});
 		const walletAuthMethodStatements = this.walletAuthMethodStore.prepareV2InsertStatements(targetMethod);
@@ -623,12 +573,12 @@ var CloudflareD1WalletCustodyCommitStore = class {
 				authenticatorStatement,
 				bindingStatement,
 				input.authenticatorCommit.challengeDeleteStatement,
-				this.database.prepare(WEB_AUTHN_RECOVERY_CHALLENGE_CAS_GUARD),
+				this.database.prepare(D1_BATCH_CAS_GUARD_SQL),
 				this.prepareRecoveryCodeLocatorConsumeStatement({
 					walletId,
 					recoveryKeyId: input.recoveryKeyId
 				}),
-				this.database.prepare(RECOVERY_CODE_LOCATOR_CAS_GUARD)
+				this.database.prepare(D1_BATCH_CAS_GUARD_SQL)
 			]);
 		} catch {
 			return { kind: "conflict" };
@@ -765,12 +715,7 @@ var CloudflareD1WalletCustodyCommitStore = class {
 		const recoverySetKey = walletRecoveryEnvelopeSetRecordKey(walletId);
 		const authorityStatement = prepareD1WalletAuthorityPutStatement({
 			database: this.database,
-			scope: {
-				namespace: this.scope.namespace,
-				orgId: this.scope.orgId,
-				projectId: this.scope.projectId,
-				envId: this.scope.envId
-			},
+			scope: this.tenantScope(),
 			authority: input.authority
 		});
 		const walletAuthMethodStatements = this.walletAuthMethodStore.prepareV2InsertStatements(targetMethod);
@@ -794,12 +739,12 @@ var CloudflareD1WalletCustodyCommitStore = class {
 					expectedVersion: input.recoveryAttemptStoreVersion,
 					finalizedAtMs: input.authority.updatedAtMs
 				}),
-				this.database.prepare(WALLET_RECOVERY_GOOGLE_EMAIL_OTP_ATTEMPT_CAS_GUARD),
+				this.database.prepare(D1_BATCH_CAS_GUARD_SQL),
 				this.prepareRecoveryCodeLocatorConsumeStatement({
 					walletId,
 					recoveryKeyId: input.recoveryKeyId
 				}),
-				this.database.prepare(RECOVERY_CODE_LOCATOR_CAS_GUARD)
+				this.database.prepare(D1_BATCH_CAS_GUARD_SQL)
 			]);
 		} catch {
 			return { kind: "conflict" };
@@ -818,6 +763,6 @@ var CloudflareD1WalletCustodyCommitStore = class {
 	}
 };
 //#endregion
-export { CloudflareD1WalletCustodyCommitStore, walletRecoveryBackupAcknowledgementRecordKey, walletRecoveryEnvelopeSetRecordKey };
+export { CloudflareD1WalletCustodyCommitStore };
 
 //# sourceMappingURL=d1WalletCustodyCommitStore.js.map