@seams/wallet-server 0.6.2 → 0.7.3

package/dist/esm/router/cloudflare/d1/passkeyCustody/d1WalletRecoveryGoogleEmailOtpRecords.js

@@ -2,8 +2,9 @@ import { parsePasskeyEnvelopeId, parseWalletAuthMethodId, parseWalletAuthorityId
 import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { parseEnvelopeRevision } from "../../../../shared-ts/src/passkey-custody/primitives.js";
+import { parseWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
-import { parseWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/registrationIntent.js";
+import { hasExactKeys } from "../../../../shared-ts/src/utils/exactKeys.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
 import { parseRecoveryCodeReservationId } from "../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
 //#region src/router/cloudflare/d1/passkeyCustody/d1WalletRecoveryGoogleEmailOtpRecords.ts
@@ -65,6 +66,19 @@ function walletRecoveryGoogleEmailOtpFinalizationInput(attempt) {
 		targetEnrollment: attempt.targetEnrollment
 	};
 }
+function sameWalletRecoveryGoogleEmailOtpFinalizationInputV1(left, right) {
+	return left.kind === right.kind && left.walletId === right.walletId && left.orgId === right.orgId && left.reservationId === right.reservationId && left.recoveryOperationId === right.recoveryOperationId && left.targetDeviceId === right.targetDeviceId && left.targetAuthorityId === right.targetAuthorityId && left.targetWalletAuthMethodId === right.targetWalletAuthMethodId && left.challengeId === right.challengeId && left.providerSubject === right.providerSubject && left.verifiedEmail === right.verifiedEmail && left.ownerProofBindingDigest === right.ownerProofBindingDigest && sameWalletRecoveryGoogleEmailOtpTargetEnrollmentV1(left.targetEnrollment, right.targetEnrollment);
+}
+function sameWalletRecoveryGoogleEmailOtpTargetEnrollmentV1(left, right) {
+	switch (left.kind) {
+		case "existing": return right.kind === "existing" && left.enrollmentId === right.enrollmentId && left.enrollmentSealKeyVersion === right.enrollmentSealKeyVersion;
+		case "create": return right.kind === "create" && left.providerSubject === right.providerSubject && left.verifiedEmail === right.verifiedEmail;
+		default: return assertNeverWalletRecoveryGoogleEmailOtpComparison(left);
+	}
+}
+function assertNeverWalletRecoveryGoogleEmailOtpComparison(value) {
+	throw new Error(`unsupported Google Email OTP comparison branch: ${String(value)}`);
+}
 function parseWalletRecoveryGoogleEmailOtpAttemptRecord(raw) {
 	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
 	const record = raw;
@@ -112,14 +126,14 @@ function parseWalletRecoveryGoogleEmailOtpAttemptRecord(raw) {
 		expiresAtMs
 	};
 	if (record.state === "prepared") {
-		if (!hasExactFields(record, [...expectedCommonFields])) return null;
+		if (!hasExactKeys(record, [...expectedCommonFields])) return null;
 		return {
 			...common,
 			state: "prepared"
 		};
 	}
 	if (record.state !== "otp_issued" && record.state !== "otp_verified" && record.state !== "finalized") return null;
-	if (!hasExactFields(record, [
+	if (!hasExactKeys(record, [
 		...expectedCommonFields,
 		"providerSubject",
 		"verifiedEmail",
@@ -151,7 +165,7 @@ function parseWalletRecoveryGoogleEmailOtpAttemptRecord(raw) {
 function parseContinuityAnchor(raw) {
 	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
 	const record = raw;
-	if (!hasExactFields(record, [
+	if (!hasExactKeys(record, [
 		"kind",
 		"authority",
 		"method",
@@ -194,7 +208,7 @@ function parseContinuityEnvelope(raw) {
 	const updatedAtMs = parsePositiveMs(record.updatedAtMs);
 	if (!envelopeId.ok || !walletId.ok || updatedAtMs === null || record.bindingKind !== "wallet_custody_seed_v1") return null;
 	if (record.kind === "passkey") {
-		if (!hasExactFields(record, [
+		if (!hasExactKeys(record, [
 			...commonFields,
 			"rpId",
 			"credentialIdB64u"
@@ -214,7 +228,7 @@ function parseContinuityEnvelope(raw) {
 		};
 	}
 	if (record.kind === "email_otp") {
-		if (!hasExactFields(record, [
+		if (!hasExactKeys(record, [
 			...commonFields,
 			"enrollmentId",
 			"enrollmentSealKeyVersion"
@@ -238,7 +252,7 @@ function parseContinuityEnvelope(raw) {
 function parseTarget(raw) {
 	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
 	const record = raw;
-	return hasExactFields(record, ["kind", "googleProvider"]) && record.kind === "google_email_otp" && record.googleProvider === "google" ? {
+	return hasExactKeys(record, ["kind", "googleProvider"]) && record.kind === "google_email_otp" && record.googleProvider === "google" ? {
 		kind: "google_email_otp",
 		googleProvider: "google"
 	} : null;
@@ -248,7 +262,7 @@ function parseTargetEnrollment(raw) {
 	const record = raw;
 	if (typeof record.kind !== "string") return null;
 	if (record.kind === "existing") {
-		if (!hasExactFields(record, [
+		if (!hasExactKeys(record, [
 			"kind",
 			"enrollmentId",
 			"enrollmentSealKeyVersion"
@@ -262,7 +276,7 @@ function parseTargetEnrollment(raw) {
 		} : null;
 	}
 	if (record.kind === "create") {
-		if (!hasExactFields(record, [
+		if (!hasExactKeys(record, [
 			"kind",
 			"providerSubject",
 			"verifiedEmail"
@@ -290,15 +304,10 @@ function parsePositiveMs(raw) {
 function nonEmpty(raw) {
 	return typeof raw === "string" && raw.trim() ? raw.trim() : null;
 }
-function hasExactFields(record, fields) {
-	const actual = Object.keys(record).sort();
-	const expected = [...fields].sort();
-	return actual.length === expected.length && actual.every((field, index) => field === expected[index]);
-}
 function hasFields(record, fields) {
 	return fields.every((field) => Object.hasOwn(record, field));
 }
 //#endregion
-export { buildPreparedWalletRecoveryGoogleEmailOtpAttempt, markWalletRecoveryGoogleEmailOtpAttemptIssued, markWalletRecoveryGoogleEmailOtpAttemptVerified, parseWalletRecoveryGoogleEmailOtpAttemptRecord, walletRecoveryGoogleEmailOtpAttemptKey, walletRecoveryGoogleEmailOtpFinalizationInput };
+export { buildPreparedWalletRecoveryGoogleEmailOtpAttempt, markWalletRecoveryGoogleEmailOtpAttemptIssued, markWalletRecoveryGoogleEmailOtpAttemptVerified, parseWalletRecoveryGoogleEmailOtpAttemptRecord, sameWalletRecoveryGoogleEmailOtpFinalizationInputV1, walletRecoveryGoogleEmailOtpAttemptKey, walletRecoveryGoogleEmailOtpFinalizationInput };
 
 //# sourceMappingURL=d1WalletRecoveryGoogleEmailOtpRecords.js.map

package/dist/esm/router/cloudflare/d1/passkeyCustody/d1WalletRecoveryGoogleEmailOtpService.js

@@ -1,37 +1,18 @@
-import { parseProviderSubject, parseVerifiedGoogleEmail, parseWalletAuthorityBindingDigest } from "../../../../shared-ts/src/utils/domainIds.js";
+import { parseProviderSubject, parseVerifiedGoogleEmail } from "../../../../shared-ts/src/utils/domainIds.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { alphabetizeStringify, sha256BytesUtf8, sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import "../../../../shared-ts/src/utils/encoders.js";
-import { buildFullOwnerPermissionsV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
-import { buildActiveWalletAuthorityV1, computeWalletAuthorityDigestB64u, computeWalletSignerActivationSetDigestB64u, replaceActiveWalletAuthorityEd25519MaterialActivationV1, walletAuthorityDigestsMatchV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
-import { buildWalletAuthMethodRecordV2, sameWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/registrationIntent.js";
-import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { buildWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { consumeReservedRecoveryCode } from "../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
-import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
+import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { sealEmailOtpFactorSecretForWorker } from "../../../domains/emailOtp/emailOtpRouteHandlers.js";
-import "../../../../shared-ts/src/authorization/index.js";
-import { markWalletRecoveryGoogleEmailOtpAttemptIssued, markWalletRecoveryGoogleEmailOtpAttemptVerified, walletRecoveryGoogleEmailOtpFinalizationInput } from "./d1WalletRecoveryGoogleEmailOtpRecords.js";
+import { markWalletRecoveryGoogleEmailOtpAttemptIssued, markWalletRecoveryGoogleEmailOtpAttemptVerified, sameWalletRecoveryGoogleEmailOtpFinalizationInputV1, walletRecoveryGoogleEmailOtpFinalizationInput } from "./d1WalletRecoveryGoogleEmailOtpRecords.js";
 import { buildWalletRecoveryEcdsaPossessionChallengesV1, resolveWalletRecoveryKeyManifestV1, verifyWalletRecoveryKeyActivationsV1 } from "../../../domains/passkeyCustody/walletRecoveryKeyManifest.js";
+import { buildConsumedRecoverySet, buildRecoveredWalletAuthority, parseRecoveryAuthorityDigest, readRecoveryContinuityAnchor } from "../../../domains/passkeyCustody/walletRecoveryFinalization.js";
 //#region src/router/cloudflare/d1/passkeyCustody/d1WalletRecoveryGoogleEmailOtpService.ts
-function sameWalletRecoveryGoogleEmailOtpFinalizationInputV1(left, right) {
-	return left.kind === right.kind && left.walletId === right.walletId && left.orgId === right.orgId && left.reservationId === right.reservationId && left.recoveryOperationId === right.recoveryOperationId && left.targetDeviceId === right.targetDeviceId && left.targetAuthorityId === right.targetAuthorityId && left.targetWalletAuthMethodId === right.targetWalletAuthMethodId && left.challengeId === right.challengeId && left.providerSubject === right.providerSubject && left.verifiedEmail === right.verifiedEmail && left.ownerProofBindingDigest === right.ownerProofBindingDigest && sameWalletRecoveryGoogleEmailOtpTargetEnrollmentV1(left.targetEnrollment, right.targetEnrollment);
-}
-function sameWalletRecoveryGoogleEmailOtpTargetEnrollmentV1(left, right) {
-	switch (left.kind) {
-		case "existing": return right.kind === "existing" && left.enrollmentId === right.enrollmentId && left.enrollmentSealKeyVersion === right.enrollmentSealKeyVersion;
-		case "create": return right.kind === "create" && left.providerSubject === right.providerSubject && left.verifiedEmail === right.verifiedEmail;
-		default: return assertNeverWalletRecoveryGoogleEmailOtpComparison(left);
-	}
-}
-async function sameVerifiedActiveWalletAuthorityV1(left, right) {
-	const [leftVerified, rightVerified] = await Promise.all([walletAuthorityDigestsMatchV1(left), walletAuthorityDigestsMatchV1(right)]);
-	return leftVerified && rightVerified && left.authorityDigestB64u === right.authorityDigestB64u && left.signerActivationSetDigestB64u === right.signerActivationSetDigestB64u && left.createdAtMs === right.createdAtMs && left.updatedAtMs === right.updatedAtMs && left.activatedAtMs === right.activatedAtMs;
-}
-function assertNeverWalletRecoveryGoogleEmailOtpComparison(value) {
-	throw new Error(`unsupported Google Email OTP comparison branch: ${String(value)}`);
-}
 /**
 * Recovery-scoped Google and Email OTP coordinator. It owns only the
 * recovery operation binding; Google verification, OTP issuance/consumption,
@@ -149,24 +130,12 @@ var CloudflareD1WalletRecoveryGoogleEmailOtpService = class {
 			enrollment: attempt.targetEnrollment
 		};
 		const workerEphemeralPublicKey65B64u = nonEmpty(input.workerEphemeralPublicKey65B64u);
-		if (!workerEphemeralPublicKey65B64u) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Email OTP recovery factor release key is required"
-		};
+		if (!workerEphemeralPublicKey65B64u) return failure("invalid_body", "Email OTP recovery factor release key is required");
 		const enrollment = await this.enrollments.readEnrollment(String(attempt.walletId));
-		if (!enrollment || enrollment.orgId !== attempt.orgId || enrollment.providerUserId !== attempt.providerSubject || enrollment.verifiedEmail !== attempt.verifiedEmail || enrollment.enrollmentId !== attempt.targetEnrollment.enrollmentId || enrollment.enrollmentSealKeyVersion !== attempt.targetEnrollment.enrollmentSealKeyVersion) return {
-			ok: false,
-			code: "recovery_conflict",
-			message: "Email OTP recovery enrollment changed after verification"
-		};
+		if (!enrollment || enrollment.orgId !== attempt.orgId || enrollment.providerUserId !== attempt.providerSubject || enrollment.verifiedEmail !== attempt.verifiedEmail || enrollment.enrollmentId !== attempt.targetEnrollment.enrollmentId || enrollment.enrollmentSealKeyVersion !== attempt.targetEnrollment.enrollmentSealKeyVersion) return failure("recovery_conflict", "Email OTP recovery enrollment changed after verification");
 		const unsealed = await this.serverSeal.removeEmailOtpServerSeal({ wrappedCiphertext: enrollment.serverSealedFactorCiphertextB64u });
 		if (!unsealed.ok) return unsealed;
-		if (unsealed.enrollmentSealKeyVersion !== enrollment.enrollmentSealKeyVersion) return {
-			ok: false,
-			code: "recovery_conflict",
-			message: "Email OTP recovery enrollment seal changed after verification"
-		};
+		if (unsealed.enrollmentSealKeyVersion !== enrollment.enrollmentSealKeyVersion) return failure("recovery_conflict", "Email OTP recovery enrollment seal changed after verification");
 		const sealed = await sealEmailOtpFactorSecretForWorker({
 			factorSecret32B64u: unsealed.ciphertext,
 			workerEphemeralPublicKey65B64u,
@@ -235,7 +204,7 @@ var CloudflareD1WalletRecoveryGoogleEmailOtpService = class {
 		} catch (error) {
 			return recoveryFinalizationRefused(error instanceof Error ? error.message : "wallet recovery key manifest unavailable");
 		}
-		const continuity = await readGoogleEmailRecoveryContinuityAnchor({
+		const continuity = await readRecoveryContinuityAnchor({
 			walletId: recovery.walletId,
 			anchor: attempt.continuityAnchor,
 			manifest,
@@ -250,7 +219,7 @@ var CloudflareD1WalletRecoveryGoogleEmailOtpService = class {
 				walletId: recovery.walletId,
 				reservationId: String(recovery.reservationId),
 				replacementId: String(recovery.recoveryOperationId),
-				sourceAuthorityDigestB64u: googleEmailRecoveryAuthorityDigest(attempt.continuityAnchor.authority),
+				sourceAuthorityDigestB64u: parseRecoveryAuthorityDigest(attempt.continuityAnchor.authority),
 				challengeB64u: String(recovery.recoveryOperationId),
 				expiresAtMs: attempt.expiresAtMs
 			});
@@ -275,8 +244,9 @@ var CloudflareD1WalletRecoveryGoogleEmailOtpService = class {
 		}
 		let authority;
 		try {
-			authority = await buildGoogleEmailRecoveryAuthority({
-				recovery,
+			authority = await buildRecoveredWalletAuthority({
+				walletId: recovery.walletId,
+				target: recovery,
 				continuityAuthority: continuity.authority,
 				manifest,
 				nowMs: this.nowMs()
@@ -322,7 +292,7 @@ var CloudflareD1WalletRecoveryGoogleEmailOtpService = class {
 			nowMs: this.nowMs()
 		});
 		if (!consumed.ok || consumed.lifecycle.state !== "consumed") return recoveryAttemptUnavailableForFinalization();
-		const consumedRecoverySet = buildGoogleEmailConsumedRecoverySet({
+		const consumedRecoverySet = buildConsumedRecoverySet({
 			record: storedRecoverySet.record,
 			reservedIndex,
 			consumedLifecycle: consumed.lifecycle,
@@ -438,158 +408,6 @@ function validateGoogleEmailRecoveryEnvelope(input) {
 	if (envelope.walletId !== input.recovery.walletId || envelope.binding.kind !== "wallet_custody_seed_v1" || envelope.factor.kind !== "email_otp" || envelope.lifecycle.state !== "active" || Number(envelope.envelopeRevision) !== 1 || envelope.ownership.kind !== "method_bound" || envelope.ownership.walletAuthMethodId !== input.recovery.targetWalletAuthMethodId || envelope.factor.enrollmentId !== input.enrollment.enrollmentId || envelope.factor.enrollmentSealKeyVersion !== input.enrollment.enrollmentSealKeyVersion) return "the replacement Email OTP envelope is not bound to this recovery target";
 	return null;
 }
-async function readGoogleEmailRecoveryContinuityAnchor(input) {
-	const authority = await input.walletAuthorityStore.readById(input.anchor.authority.authorityId);
-	const expectedAuthority = authority ? await googleEmailRecoveryContinuityAuthorityAfterActivation({
-		authority: input.anchor.authority,
-		manifest: input.manifest,
-		updatedAtMs: authority.updatedAtMs
-	}) : null;
-	if (!authority || !expectedAuthority || authority.state !== "active" || authority.walletId !== input.walletId || !await sameVerifiedActiveWalletAuthorityV1(authority, expectedAuthority)) return {
-		kind: "rejected",
-		reason: "the recovery continuity authority changed"
-	};
-	const method = await input.walletCustodyCommits.readWalletAuthMethodById(input.anchor.method.walletAuthMethodId);
-	if (!method || method.status !== "active" || method.walletId !== input.walletId || !sameWalletAuthMethodRecordV2(method, input.anchor.method)) return {
-		kind: "rejected",
-		reason: "the recovery continuity method changed"
-	};
-	const envelopeLookup = await input.envelopeStore.lookupEnvelope(googleEmailContinuityEnvelopeLocator(input.anchor));
-	if (envelopeLookup.kind !== "active" || !googleEmailContinuityEnvelopeMatchesAnchor(envelopeLookup.envelope, input.anchor)) return {
-		kind: "rejected",
-		reason: "the recovery continuity envelope changed"
-	};
-	const authorityDigest = parseWalletAuthorityBindingDigest(String(input.anchor.authority.authorityDigestB64u));
-	if (!authorityDigest.ok) return {
-		kind: "rejected",
-		reason: "the recovery continuity authority changed"
-	};
-	return {
-		kind: "ready",
-		authority,
-		authorityRef: {
-			kind: "wallet_auth_authority_ref",
-			walletId: input.walletId,
-			authorityDigest: authorityDigest.value,
-			walletAuthMethodId: input.anchor.method.walletAuthMethodId
-		}
-	};
-}
-async function googleEmailRecoveryContinuityAuthorityAfterActivation(input) {
-	const ed25519 = googleEmailRecoverySignerActivations({
-		continuity: input.authority.signerActivations,
-		manifest: input.manifest
-	}).ed25519;
-	if (!ed25519) return input.authority;
-	return await replaceActiveWalletAuthorityEd25519MaterialActivationV1({
-		authority: input.authority,
-		materialActivation: ed25519.materialActivation,
-		updatedAtMs: input.updatedAtMs
-	});
-}
-function googleEmailRecoveryAuthorityDigest(authority) {
-	const parsed = parseWalletAuthorityBindingDigest(String(authority.authorityDigestB64u));
-	if (!parsed.ok) throw new Error("wallet recovery authority digest is invalid");
-	return parsed.value;
-}
-function googleEmailContinuityEnvelopeLocator(anchor) {
-	switch (anchor.envelope.kind) {
-		case "passkey": return {
-			walletId: anchor.envelope.walletId,
-			envelopeId: anchor.envelope.envelopeId,
-			factor: {
-				kind: "passkey",
-				rpId: anchor.envelope.rpId,
-				credentialIdB64u: anchor.envelope.credentialIdB64u
-			}
-		};
-		case "email_otp": return {
-			walletId: anchor.envelope.walletId,
-			envelopeId: anchor.envelope.envelopeId,
-			factor: {
-				kind: "email_otp",
-				enrollmentId: anchor.envelope.enrollmentId,
-				enrollmentSealKeyVersion: anchor.envelope.enrollmentSealKeyVersion
-			}
-		};
-	}
-}
-function googleEmailContinuityEnvelopeMatchesAnchor(envelope, anchor) {
-	if (envelope.lifecycle.state !== "active" || envelope.walletId !== anchor.envelope.walletId || envelope.envelopeId !== anchor.envelope.envelopeId || envelope.binding.kind !== "wallet_custody_seed_v1" || envelope.ownership.kind !== "method_bound" || envelope.ownership.walletAuthMethodId !== anchor.method.walletAuthMethodId || envelope.envelopeRevision !== anchor.envelope.envelopeRevision || envelope.updatedAtMs !== anchor.envelope.updatedAtMs) return false;
-	switch (anchor.envelope.kind) {
-		case "passkey": return envelope.factor.kind === "passkey" && envelope.factor.rpId === anchor.envelope.rpId && envelope.factor.credentialIdB64u === anchor.envelope.credentialIdB64u;
-		case "email_otp": return envelope.factor.kind === "email_otp" && envelope.factor.enrollmentId === anchor.envelope.enrollmentId && envelope.factor.enrollmentSealKeyVersion === anchor.envelope.enrollmentSealKeyVersion;
-	}
-}
-async function buildGoogleEmailRecoveryAuthority(input) {
-	const signerActivations = googleEmailRecoverySignerActivations({
-		continuity: input.continuityAuthority.signerActivations,
-		manifest: input.manifest
-	});
-	const signerActivationSetDigestB64u = await computeWalletSignerActivationSetDigestB64u(signerActivations);
-	const draft = {
-		kind: "wallet_authority_v1",
-		authorityId: input.recovery.targetAuthorityId,
-		walletId: input.recovery.walletId,
-		principal: {
-			kind: "owner_device",
-			deviceId: input.recovery.targetDeviceId
-		},
-		provenance: {
-			kind: "wallet_recovery",
-			recoveryOperationId: input.recovery.recoveryOperationId,
-			continuityAuthorityId: input.continuityAuthority.authorityId
-		},
-		permissions: buildFullOwnerPermissionsV1(),
-		signerActivations,
-		signerActivationSetDigestB64u,
-		authorityDigestB64u: input.continuityAuthority.authorityDigestB64u,
-		revocationEpoch: 0,
-		createdAtMs: input.nowMs,
-		updatedAtMs: input.nowMs,
-		state: "active",
-		activatedAtMs: input.nowMs
-	};
-	return buildActiveWalletAuthorityV1({
-		kind: draft.kind,
-		authorityId: draft.authorityId,
-		walletId: draft.walletId,
-		principal: draft.principal,
-		provenance: draft.provenance,
-		permissions: draft.permissions,
-		signerActivations: draft.signerActivations,
-		signerActivationSetDigestB64u: draft.signerActivationSetDigestB64u,
-		authorityDigestB64u: await computeWalletAuthorityDigestB64u(draft),
-		revocationEpoch: draft.revocationEpoch,
-		createdAtMs: draft.createdAtMs,
-		updatedAtMs: draft.updatedAtMs,
-		state: draft.state,
-		activatedAtMs: draft.activatedAtMs
-	});
-}
-function googleEmailRecoverySignerActivations(input) {
-	const continuityEd25519 = input.continuity.ed25519;
-	if (!continuityEd25519) return input.continuity;
-	const entries = input.manifest.entries.filter((entry) => entry.kind === "near_ed25519" && entry.registeredPublicKeyB64u === continuityEd25519.signer.registeredPublicKeyB64u && entry.recoveryBasis.capabilityKind === "recovery");
-	if (entries.length !== 1 || entries[0]?.kind !== "near_ed25519") throw new Error("wallet recovery has no exact fresh Ed25519 activation");
-	const ed25519 = {
-		kind: "wallet_ed25519_signer_activation_v1",
-		signer: continuityEd25519.signer,
-		materialActivation: routerAbMpcMaterialActivationRefFromWire(entries[0].recoveryBasis.activeMaterialActivation)
-	};
-	const continuityEcdsa = input.continuity.ecdsa;
-	if (!continuityEcdsa) return {
-		kind: "wallet_signer_activation_set_v1",
-		keyFamilies: ["ed25519"],
-		ed25519
-	};
-	return {
-		kind: "wallet_signer_activation_set_v1",
-		keyFamilies: ["ed25519", "ecdsa_secp256k1"],
-		ed25519,
-		ecdsa: continuityEcdsa
-	};
-}
 function buildGoogleEmailRecoveryAuthMethod(input) {
 	const method = buildWalletAuthMethodRecordV2({
 		version: "wallet_auth_method_v2",
@@ -607,26 +425,6 @@ function buildGoogleEmailRecoveryAuthMethod(input) {
 	if (method.kind !== "email_otp" || method.status !== "active") throw new Error("recovery Email method builder returned an invalid branch");
 	return method;
 }
-function buildGoogleEmailConsumedRecoverySet(input) {
-	const manifestKekWraps = input.record.manifestKekWraps.map((wrap, index) => {
-		if (index !== input.reservedIndex) return wrap;
-		return {
-			recoveryKeyId: wrap.recoveryKeyId,
-			nonceB64u: wrap.nonceB64u,
-			wrappedManifestKekB64u: wrap.wrappedManifestKekB64u,
-			aadHashB64u: wrap.aadHashB64u,
-			lifecycle: input.consumedLifecycle
-		};
-	});
-	return {
-		kind: "wallet_recovery_envelope_set_v1",
-		walletId: input.record.walletId,
-		manifestKekWraps,
-		entries: input.record.entries,
-		issuedAtMs: input.record.issuedAtMs,
-		updatedAtMs: input.nowMs
-	};
-}
 async function replayGoogleEmailOtpRecovery(input) {
 	const replay = await input.dependencies.walletCustodyCommits.resolveRecoveryGoogleEmailOtpReplay({
 		recovery: input.recovery,
@@ -655,18 +453,10 @@ async function replayGoogleEmailOtpRecovery(input) {
 	};
 }
 function parseGoogleIdentity(result) {
-	if (!result.ok || result.verified !== true) return {
-		ok: false,
-		code: result.code || "not_verified",
-		message: result.message || "Google verification failed"
-	};
+	if (!result.ok || result.verified !== true) return failure(result.code || "not_verified", result.message || "Google verification failed");
 	const providerSubject = parseProviderSubject(result.providerSubject);
 	const email = parseVerifiedGoogleEmail(result.email);
-	if (!providerSubject.ok || !email.ok || result.emailVerified !== true) return {
-		ok: false,
-		code: "provider_identity_mismatch",
-		message: "Google verification did not provide a verified identity email"
-	};
+	if (!providerSubject.ok || !email.ok || result.emailVerified !== true) return failure("provider_identity_mismatch", "Google verification did not provide a verified identity email");
 	return {
 		ok: true,
 		providerSubject: providerSubject.value,
@@ -675,27 +465,15 @@ function parseGoogleIdentity(result) {
 }
 function resolveTargetEnrollment(input) {
 	if (input.enrollment) {
-		if (input.enrollment.orgId !== input.orgId || input.enrollment.providerUserId !== input.identity.providerSubject || input.enrollment.verifiedEmail !== input.identity.verifiedEmail) return {
-			ok: false,
-			code: "provider_identity_mismatch",
-			message: "Google identity does not match the wallet Email enrollment"
-		};
-		if (input.anchor.envelope.kind === "email_otp" && (input.anchor.envelope.enrollmentId !== input.enrollment.enrollmentId || input.anchor.envelope.enrollmentSealKeyVersion !== input.enrollment.enrollmentSealKeyVersion)) return {
-			ok: false,
-			code: "recovery_conflict",
-			message: "Wallet Email custody enrollment changed after preparation"
-		};
+		if (input.enrollment.orgId !== input.orgId || input.enrollment.providerUserId !== input.identity.providerSubject || input.enrollment.verifiedEmail !== input.identity.verifiedEmail) return failure("provider_identity_mismatch", "Google identity does not match the wallet Email enrollment");
+		if (input.anchor.envelope.kind === "email_otp" && (input.anchor.envelope.enrollmentId !== input.enrollment.enrollmentId || input.anchor.envelope.enrollmentSealKeyVersion !== input.enrollment.enrollmentSealKeyVersion)) return failure("recovery_conflict", "Wallet Email custody enrollment changed after preparation");
 		return {
 			kind: "existing",
 			enrollmentId: input.enrollment.enrollmentId,
 			enrollmentSealKeyVersion: input.enrollment.enrollmentSealKeyVersion
 		};
 	}
-	if (input.anchor.envelope.kind === "email_otp") return {
-		ok: false,
-		code: "recovery_conflict",
-		message: "Wallet Email custody enrollment is missing after preparation"
-	};
+	if (input.anchor.envelope.kind === "email_otp") return failure("recovery_conflict", "Wallet Email custody enrollment is missing after preparation");
 	return {
 		kind: "create",
 		providerSubject: input.identity.providerSubject,
@@ -756,18 +534,10 @@ function nonEmpty(value) {
 	return typeof value === "string" && value.trim() ? value.trim() : null;
 }
 function recoveryAttemptUnavailable() {
-	return {
-		ok: false,
-		code: "recovery_attempt_unavailable",
-		message: "Wallet recovery operation is unavailable"
-	};
+	return failure("recovery_attempt_unavailable", "Wallet recovery operation is unavailable");
 }
 function recoveryAttemptConflict() {
-	return {
-		ok: false,
-		code: "recovery_conflict",
-		message: "Wallet recovery operation changed; retry recovery"
-	};
+	return failure("recovery_conflict", "Wallet recovery operation changed; retry recovery");
 }
 function recoveryFinalizationRefused(reason) {
 	return {

package/dist/esm/router/cloudflare/d1/registration/d1EvmFamilyEcdsaRegistrationBranch.js

@@ -3,6 +3,7 @@ import { deriveEvmFamilySigningKeySlotId } from "../../../../shared-ts/src/signi
 import { computeEcdsaDerivationRoleLocalRelayerKeyId, computeEcdsaDerivationRoleLocalThresholdKeyId, computeSdkEcdsaDerivationApplicationBindingDigestB64u, parseSdkEcdsaDerivationSigningRootId, parseSdkEcdsaDerivationSigningRootVersion, parseSdkEcdsaDerivationThresholdKeyId } from "../../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { buildRouterAbEcdsaDerivationActiveStateIdV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import "./d1RegistrationCeremonyRecords.js";
 //#region src/router/cloudflare/d1/registration/d1EvmFamilyEcdsaRegistrationBranch.ts
 const REGISTRATION_WALLET_SIGNING_SESSION_REMAINING_USES = 3;
@@ -13,28 +14,12 @@ function requireRegistrationRootShareEpoch(value) {
 	return parsed.value;
 }
 async function buildD1EvmFamilyEcdsaRegistrationPrepare(input) {
-	if (!input.chainTargets) return {
-		ok: false,
-		code: "invalid_body",
-		message: "ECDSA registration contains an invalid chain target"
-	};
-	if (input.chainTargets.length === 0) return {
-		ok: false,
-		code: "invalid_body",
-		message: "ECDSA registration requires at least one chain target"
-	};
+	if (!input.chainTargets) return failure("invalid_body", "ECDSA registration contains an invalid chain target");
+	if (input.chainTargets.length === 0) return failure("invalid_body", "ECDSA registration requires at least one chain target");
 	const firstChainTarget = input.chainTargets[0];
-	if (!firstChainTarget) return {
-		ok: false,
-		code: "invalid_body",
-		message: "ECDSA registration requires at least one chain target"
-	};
+	if (!firstChainTarget) return failure("invalid_body", "ECDSA registration requires at least one chain target");
 	const chainTargets = [firstChainTarget, ...input.chainTargets.slice(1)];
-	if (input.participantIds.length !== 2 || input.participantIds[0] !== 1 || input.participantIds[1] !== 2) return {
-		ok: false,
-		code: "invalid_body",
-		message: "ECDSA registration requires participant pair [1, 2]"
-	};
+	if (input.participantIds.length !== 2 || input.participantIds[0] !== 1 || input.participantIds[1] !== 2) return failure("invalid_body", "ECDSA registration requires participant pair [1, 2]");
 	const evmFamilySigningKeySlotId = deriveEvmFamilySigningKeySlotId({
 		walletId: input.walletId,
 		signingRootId: input.signingRootId,

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore.js

@@ -7,6 +7,19 @@ const TABLE_NAME = "registration_ceremony_records";
 const CAS_GUARD_SQL = `INSERT INTO registration_ceremony_cas_guard (guard_id)
 SELECT 1
  WHERE changes() = 0`;
+/** Replaces the record when it is still at the expected version (?10) and bumps the version. */
+const UPDATE_EXPECTED_VERSION_SQL = `UPDATE ${TABLE_NAME}
+            SET version = version + 1,
+                record_json = ?7,
+                expires_at_ms = ?8,
+                updated_at_ms = ?9
+          WHERE namespace = ?1
+            AND org_id = ?2
+            AND project_id = ?3
+            AND env_id = ?4
+            AND record_scope = ?5
+            AND record_id = ?6
+            AND version = ?10`;
 var D1RegistrationCeremonyRecordConflictError = class extends Error {
 	constructor(message) {
 		super(message);
@@ -48,35 +61,17 @@ var D1RegistrationCeremonyRecordStore = class {
 		if (recordsMatch(current, prepared)) return;
 		throw conflict("Registration ceremony record conflicts with the stored value");
 	}
-	async reserveExclusive(mutation) {
-		const key = this.normalizeKey(mutation.scope, mutation.id);
-		const prepared = prepareValue(mutation.value, mutation.expiresAtMs);
-		if (await this.insert(key, prepared)) return true;
-		await this.get(mutation.scope, mutation.id);
-		return await this.insert(key, prepared);
-	}
 	async updateExpected(input) {
 		const key = this.normalizeKey(input.scope, input.id);
 		const current = await this.get(input.scope, input.id);
-		if (!current || stableJson(current.value) !== stableJson(input.expected)) throw conflict("Registration ceremony record changed before update");
+		if (!current || alphabetizeStringify(current.value) !== alphabetizeStringify(input.expected)) throw conflict("Registration ceremony record changed before update");
 		const next = prepareValue(input.next, input.expiresAtMs);
-		if (changes(await this.database.prepare(`UPDATE ${TABLE_NAME}
-            SET version = version + 1,
-                record_json = ?7,
-                expires_at_ms = ?8,
-                updated_at_ms = ?9
-          WHERE namespace = ?1
-            AND org_id = ?2
-            AND project_id = ?3
-            AND env_id = ?4
-            AND record_scope = ?5
-            AND record_id = ?6
-            AND version = ?10`).bind(...this.bindKey(key), next.recordJson, next.expiresAtMs, Date.now(), current.version).run()) !== 1) throw conflict("Registration ceremony record changed during update");
+		if (changes(await this.database.prepare(UPDATE_EXPECTED_VERSION_SQL).bind(...this.bindKey(key), next.recordJson, next.expiresAtMs, Date.now(), current.version).run()) !== 1) throw conflict("Registration ceremony record changed during update");
 	}
 	async claimEcdsaRegistrationBranch(input) {
 		const key = this.normalizeKey(input.scope, input.id);
 		const strictRegistrationBindingJson = input.binding.kind === "strict_registration" ? normalizeKeyPart(input.binding.strictRegistrationBindingJson, "strictRegistrationBindingJson", 16384) : "";
-		const patchJson = stableJson(input.patch);
+		const patchJson = alphabetizeStringify(input.patch);
 		const nowMs = Date.now();
 		const row = await this.database.prepare(`WITH target(branch_index) AS (
            SELECT CAST(branch.key AS INTEGER)
@@ -130,18 +125,7 @@ var D1RegistrationCeremonyRecordStore = class {
 		const key = this.normalizeKey(input.scope, input.id);
 		if (!Number.isSafeInteger(input.expectedVersion) || input.expectedVersion < 1) throw new Error("Registration ceremony expected version is invalid");
 		const next = prepareValue(input.next, input.expiresAtMs);
-		if (changes(await this.database.prepare(`UPDATE ${TABLE_NAME}
-            SET version = version + 1,
-                record_json = ?7,
-                expires_at_ms = ?8,
-                updated_at_ms = ?9
-          WHERE namespace = ?1
-            AND org_id = ?2
-            AND project_id = ?3
-            AND env_id = ?4
-            AND record_scope = ?5
-            AND record_id = ?6
-            AND version = ?10`).bind(...this.bindKey(key), next.recordJson, next.expiresAtMs, Date.now(), input.expectedVersion).run()) !== 1) throw conflict("Registration ceremony record changed during versioned update");
+		if (changes(await this.database.prepare(UPDATE_EXPECTED_VERSION_SQL).bind(...this.bindKey(key), next.recordJson, next.expiresAtMs, Date.now(), input.expectedVersion).run()) !== 1) throw conflict("Registration ceremony record changed during versioned update");
 		return input.expectedVersion + 1;
 	}
 	async take(scope, id) {
@@ -252,7 +236,7 @@ function prepareValue(value, expiresAtMs) {
 	if (!Number.isSafeInteger(normalizedExpiresAtMs) || normalizedExpiresAtMs <= Date.now()) throw new Error("Registration ceremony record expiry must be in the future");
 	return {
 		value,
-		recordJson: stableJson(value),
+		recordJson: alphabetizeStringify(value),
 		expiresAtMs: normalizedExpiresAtMs
 	};
 }
@@ -275,10 +259,7 @@ function parseStoredRow(row) {
 	};
 }
 function recordsMatch(current, next) {
-	return current.expiresAtMs === next.expiresAtMs && stableJson(current.value) === next.recordJson;
-}
-function stableJson(value) {
-	return alphabetizeStringify(value);
+	return current.expiresAtMs === next.expiresAtMs && alphabetizeStringify(current.value) === next.recordJson;
 }
 function changes(result) {
 	if (!result.success) throw new Error("Registration ceremony D1 mutation failed");
@@ -312,6 +293,6 @@ function conflict(message) {
 	return new D1RegistrationCeremonyRecordConflictError(message);
 }
 //#endregion
-export { D1RegistrationCeremonyRecordConflictError, D1RegistrationCeremonyRecordStore };
+export { D1RegistrationCeremonyRecordStore };
 
 //# sourceMappingURL=d1RegistrationCeremonyRecordStore.js.map