@seams/wallet-server 0.7.1 → 0.8.0

package/dist/esm/core/deviceLinking/linkedDeviceSession.js

@@ -2,6 +2,7 @@ import { parseLinkDeviceSessionId, parseWalletAuthorityId } from "../../shared-t
 import { parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1 } from "../../shared-ts/src/device-linking/sourceContribution.js";
 import { parseLinkedDeviceApprovalV1 } from "../../shared-ts/src/device-linking/parsers.js";
 import { computeLinkedDeviceApprovalDigestV1, computeLinkedDeviceSessionClaimDigestV1 } from "../../shared-ts/src/device-linking/digests.js";
+import { linkedDeviceBootstrapFailure } from "./linkedDeviceBootstrap.js";
 import { activeStateV1, approvalTranscriptMatchesDigest, authorityPendingStateV1, awaitingSourceContributionDeadlineMsV1, awaitingSourceContributionStateV1, awaitingTargetDeadlineMsV1, awaitingTargetFactorStateV1, buildUnclaimedSessionRecordV1, claimTranscriptMatchesDigest, claimedStateV1, conflictResult, integrityResult, invalidStateResult, isPrecommitState, linkedDeviceEmailOtpChallengesEqualV1, linkedDevicePrecommitFailuresEqualV1, linkedDeviceQrPayloadsEqualV1, parseEmailOtpChallengeV1, parseId, parseQrLinkedDeviceSessionPayloadV1, provisioningStateV1, replaceSessionRecordV1, requireDigest, requireTimestamp, sessionExpiryMsV1, sourceContributionTranscriptMatchesDigest } from "./linkedDeviceSessionRecord.js";
 import { validateApprovalMatchesSession, validateLinkedDeviceRequestedAuthorityV1, validateSourceContributionApprovalMatchesSession, validateSourceContributionPreparationMatchesApproval } from "./linkedDeviceSessionApproval.js";
 //#region src/core/deviceLinking/linkedDeviceSession.ts
@@ -20,7 +21,7 @@ var LinkedDeviceSessionServiceV1 = class {
 			};
 			return await this.store.createUnclaimedSessionV1(buildUnclaimedSessionRecordV1(payload, nowMs));
 		} catch (error) {
-			return invalidInputResult(error);
+			return sessionFailureResult(error);
 		}
 	}
 	async claimSessionV1(input) {
@@ -68,7 +69,7 @@ var LinkedDeviceSessionServiceV1 = class {
 				nowMs
 			});
 		} catch (error) {
-			return invalidInputResult(error);
+			return sessionFailureResult(error);
 		}
 	}
 	async recordOwnerApprovalV1(input) {
@@ -120,7 +121,7 @@ var LinkedDeviceSessionServiceV1 = class {
 				nowMs
 			});
 		} catch (error) {
-			return invalidInputResult(error);
+			return sessionFailureResult(error);
 		}
 	}
 	async recordTargetCredentialV1(input) {
@@ -150,7 +151,7 @@ var LinkedDeviceSessionServiceV1 = class {
 				nowMs
 			});
 		} catch (error) {
-			return invalidInputResult(error);
+			return sessionFailureResult(error);
 		}
 	}
 	async recordSourceContributionV1(input) {
@@ -204,7 +205,7 @@ var LinkedDeviceSessionServiceV1 = class {
 				nowMs
 			});
 		} catch (error) {
-			return invalidInputResult(error);
+			return sessionFailureResult(error);
 		}
 	}
 	async recordEmailOtpChallengeStateV1(input) {
@@ -233,7 +234,7 @@ var LinkedDeviceSessionServiceV1 = class {
 				nowMs
 			});
 		} catch (error) {
-			return invalidInputResult(error);
+			return sessionFailureResult(error);
 		}
 	}
 	async markAuthorityPendingLocalInstallV1(input) {
@@ -261,7 +262,7 @@ var LinkedDeviceSessionServiceV1 = class {
 				nowMs
 			});
 		} catch (error) {
-			return invalidInputResult(error);
+			return sessionFailureResult(error);
 		}
 	}
 	async activateSessionV1(input) {
@@ -294,7 +295,7 @@ var LinkedDeviceSessionServiceV1 = class {
 				nowMs
 			});
 		} catch (error) {
-			return invalidInputResult(error);
+			return sessionFailureResult(error);
 		}
 	}
 	async failBeforeCommitV1(input) {
@@ -322,7 +323,7 @@ var LinkedDeviceSessionServiceV1 = class {
 				nowMs
 			});
 		} catch (error) {
-			return invalidInputResult(error);
+			return sessionFailureResult(error);
 		}
 	}
 	async cancelSessionV1(input) {
@@ -349,7 +350,7 @@ var LinkedDeviceSessionServiceV1 = class {
 				nowMs
 			});
 		} catch (error) {
-			return invalidInputResult(error);
+			return sessionFailureResult(error);
 		}
 	}
 	async expireSessionV1(input) {
@@ -380,7 +381,7 @@ var LinkedDeviceSessionServiceV1 = class {
 				nowMs
 			});
 		} catch (error) {
-			return invalidInputResult(error);
+			return sessionFailureResult(error);
 		}
 	}
 	async deleteActiveSessionV1(input) {
@@ -404,7 +405,7 @@ var LinkedDeviceSessionServiceV1 = class {
 				nowMs
 			});
 		} catch (error) {
-			return invalidInputResult(error);
+			return sessionFailureResult(error);
 		}
 	}
 	async getSessionV1(input) {
@@ -417,7 +418,7 @@ var LinkedDeviceSessionServiceV1 = class {
 			expectedRevision: existing.revision,
 			nowMs: normalized.nowMs
 		});
-		return "record" in expired ? expired.record : existing;
+		return "record" in expired && expired.record !== void 0 ? expired.record : existing;
 	}
 	async listSessionsForWalletV1(input) {
 		const page = await this.store.listSessionsForWalletV1({
@@ -511,7 +512,12 @@ function normalizeSessionReadInput(input) {
 		nowMs: requireTimestamp(input.nowMs, "nowMs")
 	};
 }
-function invalidInputResult(error) {
+function sessionFailureResult(error) {
+	const failure = linkedDeviceBootstrapFailure(error);
+	if (failure) return {
+		outcome: failure,
+		message: "Linked-device bootstrap authority is unavailable or conflicting"
+	};
 	return {
 		outcome: "invalid_input",
 		message: error instanceof Error ? error.message : String(error || "invalid linked-device input")

package/dist/esm/core/deviceLinking/linkedDeviceSessionApproval.js

@@ -1,6 +1,7 @@
 import { mpcMaterialActivationRefsEqual } from "../../shared-ts/src/utils/domainIds.js";
 import { hasDelegatedWalletPermissionV1, sameDelegatedWalletAuthorityV1, validateDelegatedWalletAuthorityAttenuationV1 } from "../../shared-ts/src/authorization/delegatedAuthority.js";
 import { routerAbMpcMaterialActivationRefFromWire, sameRouterAbMpcMaterialActivationRef } from "../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { sameRouterAbEd25519YaoByteSequence } from "../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { assertLinkedDeviceOrdinaryMaterialSourceContributionMatchesContextV1 } from "../../shared-ts/src/device-linking/sourceContribution.js";
 import { parseDeviceIdValue } from "./linkedDeviceSessionRecord.js";
 //#region src/core/deviceLinking/linkedDeviceSessionApproval.ts
@@ -93,9 +94,6 @@ function linkedDeviceOwnerAuthorizationsEqualV1(left, right) {
 function linkedDeviceEd25519BindingsEqualV1(left, right) {
 	return left.operation === right.operation && sameRouterAbEd25519YaoByteSequence(left.session_id, right.session_id) && sameRouterAbEd25519YaoByteSequence(left.stable_key_context_binding, right.stable_key_context_binding) && sameRouterAbMpcMaterialActivationRef(left.material_activation, right.material_activation) && left.lifecycle.lifecycle_id === right.lifecycle.lifecycle_id && left.lifecycle.work_kind === right.lifecycle.work_kind && left.lifecycle.primitive_request_kind === right.lifecycle.primitive_request_kind && left.lifecycle.root_share_epoch === right.lifecycle.root_share_epoch && left.lifecycle.account_id === right.lifecycle.account_id && left.lifecycle.session_id === right.lifecycle.session_id && left.lifecycle.signer_set_id === right.lifecycle.signer_set_id && left.lifecycle.selected_server_id === right.lifecycle.selected_server_id;
 }
-function sameRouterAbEd25519YaoByteSequence(left, right) {
-	return left.length === right.length && left.every((value, index) => value === right[index]);
-}
 //#endregion
 export { validateApprovalMatchesSession, validateLinkedDeviceRequestedAuthorityV1, validateSourceContributionApprovalMatchesSession, validateSourceContributionPreparationMatchesApproval };
 

package/dist/esm/core/deviceLinking/linkedDeviceSessionRecord.js

@@ -6,7 +6,7 @@ import { requireRecordCopy } from "../../shared-ts/src/utils/validation.js";
 import { sameDelegatedWalletAuthorityV1 } from "../../shared-ts/src/authorization/delegatedAuthority.js";
 import { parseExactAdministeredSignerManifestV1 } from "../../shared-ts/src/device-linking/delegatedActivationPlan.js";
 import { parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1 } from "../../shared-ts/src/device-linking/sourceContribution.js";
-import { parseLinkSessionStateV1, parseLinkedDeviceApprovalV1 as parseLinkedDeviceApprovalV1$1, parseLinkedDeviceSessionClaimV1, parseQrLinkedDeviceSessionPayloadV5 } from "../../shared-ts/src/device-linking/parsers.js";
+import { parseLinkSessionStateV1, parseLinkedDeviceApprovalV1, parseLinkedDeviceSessionClaimV1, parseQrLinkedDeviceSessionPayloadV5 } from "../../shared-ts/src/device-linking/parsers.js";
 import "../../shared-ts/src/device-linking/requestProof.js";
 //#region src/core/deviceLinking/linkedDeviceSessionRecord.ts
 function sourceKeyManifestDigestForFamilyV1(digests, keyFamily) {
@@ -377,19 +377,13 @@ function assertNeverLinkedDeviceEmailOtpChallengeV1(value) {
 function assertNeverLinkPrecommitFailureV1(value) {
 	throw new Error(`unsupported linked-device precommit failure: ${String(value)}`);
 }
-function parseLinkedDeviceApprovalV1(raw) {
-	return parseLinkedDeviceApprovalV1$1(raw);
-}
-function parseLinkedDeviceClaimV1(raw) {
-	return parseLinkedDeviceSessionClaimV1(raw);
-}
 function parseOptionalClaimTranscript(raw) {
 	if (raw === void 0) return void 0;
 	const record = requireRecordCopy(raw, "claimTranscript");
 	requireExactKeys(record, ["digestB64u", "value"]);
 	return {
 		digestB64u: requireDigest(record.digestB64u, "claimTranscript.digestB64u"),
-		value: parseLinkedDeviceClaimV1(record.value)
+		value: parseLinkedDeviceSessionClaimV1(record.value)
 	};
 }
 /**

package/dist/esm/core/deviceLinking/requestProof.js

@@ -2,6 +2,7 @@ import { parseLinkDeviceSessionId } from "../../shared-ts/src/utils/domainIds.js
 import { base64UrlDecode, base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
 import { parseDigestB64u } from "../../shared-ts/src/utils/canonicalPrimitives.js";
 import { LINKED_DEVICE_CLOCK_SKEW_TOLERANCE_MS_V1, LINKED_DEVICE_REQUEST_PROOF_HEADER_V1, LINKED_DEVICE_REQUEST_PROOF_MAX_TTL_MS_V1, computeLinkedDevicePublicKeyDigestV1, computeLinkedDeviceRequestProofDigestV1, encodeLinkedDeviceRequestProofV1 } from "../../shared-ts/src/device-linking/requestProof.js";
+import { hasExactKeys } from "../../shared-ts/src/utils/exactKeys.js";
 //#region src/core/deviceLinking/requestProof.ts
 var LinkedDeviceRequestProofVerifierV1 = class {
 	constructor(input) {
@@ -22,22 +23,25 @@ var LinkedDeviceRequestProofVerifierV1 = class {
 				code: "invalid",
 				message: "device request proof signature is invalid"
 			};
-			if ((await this.nonceStore.consumeRequestProofNonceV1({
+			const consumed = await this.nonceStore.consumeRequestProofNonceV1({
 				linkSessionId: input.proof.linkSessionId,
 				requestNonceB64u: input.proof.requestNonceB64u,
 				proofDigestB64u,
 				issuedAtMs: input.proof.issuedAtMs,
 				expiresAtMs: input.proof.expiresAtMs,
 				consumedAtMs: input.nowMs
-			})).outcome === "already_used") return {
+			});
+			if (consumed.outcome === "unavailable") return {
+				kind: "denied",
+				code: "unavailable",
+				message: "Device request proof authority is unavailable"
+			};
+			if (consumed.outcome === "already_used") return {
 				kind: "denied",
 				code: "replayed",
 				message: "device request proof was already used"
 			};
-			return {
-				kind: "authorized",
-				proofDigestB64u
-			};
+			return { kind: "authorized" };
 		} catch (error) {
 			const message = errorMessage(error);
 			return {
@@ -62,7 +66,18 @@ var LinkedDeviceRequestProofVerifierV1 = class {
 };
 function parseLinkedDeviceRequestProofV1(raw) {
 	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new Error("linked-device request proof must be an object");
-	if (!isLinkedDeviceRequestProofRecordV1(raw)) throw new Error("record contains invalid fields");
+	if (!hasExactKeys(raw, [
+		"kind",
+		"linkSessionId",
+		"devicePublicKeyDigestB64u",
+		"requestNonceB64u",
+		"method",
+		"canonicalPath",
+		"bodyDigestB64u",
+		"issuedAtMs",
+		"expiresAtMs",
+		"signatureB64u"
+	])) throw new Error("record contains invalid fields");
 	const record = raw;
 	if (record.kind !== "linked_device_request_proof_v1") throw new Error("linked-device request proof kind is invalid");
 	const linkSessionId = parseSessionId(record.linkSessionId);
@@ -152,9 +167,6 @@ function parseFixedB64u(raw, expectedBytes, field) {
 function toArrayBuffer(bytes) {
 	return bytes.slice().buffer;
 }
-function isLinkedDeviceRequestProofRecordV1(value) {
-	return Object.keys(value).sort().join("|") === "bodyDigestB64u|canonicalPath|devicePublicKeyDigestB64u|expiresAtMs|issuedAtMs|kind|linkSessionId|method|requestNonceB64u|signatureB64u";
-}
 function errorMessage(error) {
 	return error instanceof Error ? error.message : String(error || "invalid device request proof");
 }

package/dist/esm/core/ecdsaMaterialReadSnapshot.js

@@ -0,0 +1,85 @@
+//#region src/core/ecdsaMaterialReadSnapshot.ts
+const ECDSA_INSTALLATION_SNAPSHOT_COLUMNS = [
+	"link_session_id",
+	"authority_id",
+	"wallet_id",
+	"auth_method_id",
+	"device_id",
+	"package_set_digest_b64u",
+	"target_factor_verification_digest_b64u",
+	"target_factor_verified_at_ms",
+	"source_manifest_digest_b64u",
+	"delivery_recipient_public_key_b64u",
+	"packages_json",
+	"server_reservation_ids_json",
+	"installed_record_set_digest_b64u",
+	"activated_at_ms"
+];
+/** Request-local evidence of the exact records a material resolver examined. */
+var EcdsaMaterialReadSnapshot = class EcdsaMaterialReadSnapshot {
+	#scope;
+	#conditions;
+	constructor(walletId, scope, conditions) {
+		this.walletId = walletId;
+		this.#scope = scope;
+		this.#conditions = conditions;
+	}
+	static canonical(scope, walletId, activationId, rows) {
+		return new EcdsaMaterialReadSnapshot(walletId, scope, [recordSetCondition("wallet_signers", scope, walletId, ["record_json"], rows, "signer_family = 'ecdsa' AND json_extract(record_json, '$.walletKey.publicCapability.material_activation.activation_id') = ?", [activationId])]);
+	}
+	static linked(scope, walletId, installations, signers) {
+		return new EcdsaMaterialReadSnapshot(walletId, scope, [recordSetCondition("linked_device_authority_installations", scope, walletId, ECDSA_INSTALLATION_SNAPSHOT_COLUMNS, installations, "1", []), recordSetCondition("wallet_signers", scope, walletId, ["record_json"], signers, "signer_family = 'ecdsa'", [])]);
+	}
+	condition(scope) {
+		if (scope.namespace !== this.#scope.namespace || scope.orgId !== this.#scope.orgId || scope.projectId !== this.#scope.projectId || scope.envId !== this.#scope.envId) return {
+			sql: "0",
+			bindings: []
+		};
+		const clauses = [];
+		const bindings = [];
+		for (const condition of this.#conditions) {
+			clauses.push(`(${condition.sql})`);
+			bindings.push(...condition.bindings);
+		}
+		return {
+			sql: clauses.join(" AND "),
+			bindings
+		};
+	}
+};
+function recordSetCondition(table, scope, walletId, columns, rows, filter, filterBindings) {
+	const values = [];
+	for (const row of rows) {
+		const tuple = [];
+		for (const column of columns) {
+			const value = row[column];
+			if (value !== null && typeof value !== "string" && typeof value !== "number") throw new Error(`Invalid stored material column: ${column}`);
+			tuple.push(value);
+		}
+		values.push(tuple);
+	}
+	const predicate = `namespace = ? AND org_id = ? AND project_id = ? AND env_id = ? AND wallet_id = ? AND ${filter}`;
+	const identity = [
+		scope.namespace,
+		scope.orgId,
+		scope.projectId,
+		scope.envId,
+		walletId,
+		...filterBindings
+	];
+	return {
+		sql: `(SELECT COUNT(*) FROM ${table} WHERE ${predicate}) = ?
+      AND NOT EXISTS (SELECT 1 FROM ${table} WHERE ${predicate}
+        AND json_array(${columns.join(", ")}) NOT IN (SELECT value FROM json_each(?)))`,
+		bindings: [
+			...identity,
+			rows.length,
+			...identity,
+			JSON.stringify(values)
+		]
+	};
+}
+//#endregion
+export { ECDSA_INSTALLATION_SNAPSHOT_COLUMNS, EcdsaMaterialReadSnapshot };
+
+//# sourceMappingURL=ecdsaMaterialReadSnapshot.js.map

package/dist/esm/core/emailOtpD1Statements.js

@@ -39,20 +39,6 @@ function challengeValues(record) {
 /** Statements on `email_otp_challenges`. */
 const emailOtpChallengeRows = {
 	insert: (prepare, record) => prepare(INSERT_CHALLENGE_SQL, challengeValues(record)),
-	upsert: (prepare, record) => prepare(`${INSERT_CHALLENGE_SQL}
-      ON CONFLICT (namespace, org_id, project_id, env_id, challenge_id)
-      DO UPDATE SET
-        challenge_subject_id = EXCLUDED.challenge_subject_id,
-        wallet_id = EXCLUDED.wallet_id,
-        record_org_id = EXCLUDED.record_org_id,
-        otp_channel = EXCLUDED.otp_channel,
-        owner_proof_binding_digest = EXCLUDED.owner_proof_binding_digest,
-        action = EXCLUDED.action,
-        operation = EXCLUDED.operation,
-        otp_code = EXCLUDED.otp_code,
-        record_json = EXCLUDED.record_json,
-        created_at_ms = EXCLUDED.created_at_ms,
-        expires_at_ms = EXCLUDED.expires_at_ms`, challengeValues(record)),
 	delete: (prepare, challengeId) => prepare(`DELETE FROM email_otp_challenges
         WHERE namespace = ?
           AND org_id = ?
@@ -92,38 +78,13 @@ function grantValues(record) {
 /** Statements on `email_otp_grants`. */
 const emailOtpGrantRows = {
 	insert: (prepare, record) => prepare(INSERT_GRANT_SQL, grantValues(record)),
-	upsert: (prepare, record) => prepare(`${INSERT_GRANT_SQL}
-      ON CONFLICT (namespace, org_id, project_id, env_id, grant_token)
-      DO UPDATE SET
-        user_id = EXCLUDED.user_id,
-        wallet_id = EXCLUDED.wallet_id,
-        record_org_id = EXCLUDED.record_org_id,
-        challenge_id = EXCLUDED.challenge_id,
-        action = EXCLUDED.action,
-        record_json = EXCLUDED.record_json,
-        issued_at_ms = EXCLUDED.issued_at_ms,
-        expires_at_ms = EXCLUDED.expires_at_ms`, grantValues(record)),
-	select: (prepare, grantToken) => prepare(`SELECT record_json, expires_at_ms
-         FROM email_otp_grants
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND grant_token = ?
-        LIMIT 1`, [grantToken]),
 	consume: (prepare, grantToken) => prepare(`DELETE FROM email_otp_grants
         WHERE namespace = ?
           AND org_id = ?
           AND project_id = ?
           AND env_id = ?
           AND grant_token = ?
-      RETURNING record_json, expires_at_ms`, [grantToken]),
-	delete: (prepare, grantToken) => prepare(`DELETE FROM email_otp_grants
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND grant_token = ?`, [grantToken])
+      RETURNING record_json, expires_at_ms`, [grantToken])
 };
 const INSERT_WALLET_ENROLLMENT_SQL = `INSERT INTO email_otp_wallet_enrollments (
         namespace,
@@ -235,15 +196,6 @@ function unlockChallengeValues(record) {
 /** Statements on `email_otp_unlock_challenges`. */
 const emailOtpUnlockChallengeRows = {
 	insert: (prepare, record) => prepare(INSERT_UNLOCK_CHALLENGE_SQL, unlockChallengeValues(record)),
-	upsert: (prepare, record) => prepare(`${INSERT_UNLOCK_CHALLENGE_SQL}
-      ON CONFLICT (namespace, org_id, project_id, env_id, challenge_id)
-      DO UPDATE SET
-        wallet_id = EXCLUDED.wallet_id,
-        user_id = EXCLUDED.user_id,
-        record_org_id = EXCLUDED.record_org_id,
-        record_json = EXCLUDED.record_json,
-        created_at_ms = EXCLUDED.created_at_ms,
-        expires_at_ms = EXCLUDED.expires_at_ms`, unlockChallengeValues(record)),
 	consume: (prepare, challengeId) => prepare(`DELETE FROM email_otp_unlock_challenges
         WHERE namespace = ?
           AND org_id = ?
@@ -269,53 +221,95 @@ const PENDING_ATTEMPTS_SQL = `SELECT record_json, expires_at_ms, updated_at_ms,
           AND expires_at_ms > ?`;
 /** Statements on `email_otp_registration_attempts`. */
 const emailOtpRegistrationAttemptRows = {
-	upsert: (prepare, record) => prepare(`INSERT INTO email_otp_registration_attempts (
-        namespace,
-        org_id,
-        project_id,
-        env_id,
-        attempt_id,
-        provider_subject,
-        email,
-        wallet_id,
-        state,
-        owner_proof_binding_digest,
-        runtime_org_id,
-        runtime_policy_key,
-        offer_wallet_ids_json,
-        record_json,
-        created_at_ms,
-        updated_at_ms,
-        expires_at_ms
+	insertPendingIfAbsent: (prepare, record) => prepare(`WITH candidate (
+        namespace, org_id, project_id, env_id, attempt_id, provider_subject, email,
+        wallet_id, state, owner_proof_binding_digest, runtime_org_id, runtime_policy_key,
+        offer_wallet_ids_json, record_json, created_at_ms, updated_at_ms, expires_at_ms
+      ) AS (VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?))
+      INSERT INTO email_otp_registration_attempts (
+        namespace, org_id, project_id, env_id, attempt_id, provider_subject, email,
+        wallet_id, state, owner_proof_binding_digest, runtime_org_id, runtime_policy_key,
+        offer_wallet_ids_json, record_json, created_at_ms, updated_at_ms, expires_at_ms
       )
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT (namespace, org_id, project_id, env_id, attempt_id)
-      DO UPDATE SET
-        provider_subject = EXCLUDED.provider_subject,
-        email = EXCLUDED.email,
-        wallet_id = EXCLUDED.wallet_id,
-        state = EXCLUDED.state,
-        owner_proof_binding_digest = EXCLUDED.owner_proof_binding_digest,
-        runtime_org_id = EXCLUDED.runtime_org_id,
-        runtime_policy_key = EXCLUDED.runtime_policy_key,
-        offer_wallet_ids_json = EXCLUDED.offer_wallet_ids_json,
-        record_json = EXCLUDED.record_json,
-        created_at_ms = EXCLUDED.created_at_ms,
-        updated_at_ms = EXCLUDED.updated_at_ms,
-        expires_at_ms = EXCLUDED.expires_at_ms`, [
-		record.attemptId,
-		record.providerSubject,
-		record.email,
+      SELECT * FROM candidate
+      WHERE NOT EXISTS (
+        SELECT 1 FROM email_otp_registration_attempts existing
+        WHERE existing.namespace = candidate.namespace
+          AND existing.org_id = candidate.org_id
+          AND existing.project_id = candidate.project_id
+          AND existing.env_id = candidate.env_id
+          AND existing.provider_subject = candidate.provider_subject
+          AND existing.email = candidate.email
+          AND existing.owner_proof_binding_digest = candidate.owner_proof_binding_digest
+          AND existing.runtime_org_id = candidate.runtime_org_id
+          AND existing.runtime_policy_key = candidate.runtime_policy_key
+          AND existing.state IN ('started', 'key_finalized')
+          AND (existing.expires_at_ms > candidate.created_at_ms OR existing.selection_digest IS NOT NULL)
+      )`, registrationAttemptValues(record)),
+	claimCandidate: (prepare, input) => prepare(`WITH scope AS (SELECT ? AS namespace, ? AS org_id, ? AS project_id, ? AS env_id)
+    UPDATE email_otp_registration_attempts
+    SET wallet_id = ?, selection_digest = ?,
+      record_json = json_set(record_json,
+        '$.walletId', ?, '$.selectedCandidateId', ?,
+        '$.collisionCounter', (
+          SELECT json_extract(value, '$.collisionCounter')
+          FROM json_each(record_json, '$.offerCandidates')
+          WHERE json_extract(value, '$.candidateId') = ?
+        ), '$.updatedAtMs', MAX(updated_at_ms, ?)),
+      updated_at_ms = MAX(updated_at_ms, ?)
+    WHERE namespace = (SELECT namespace FROM scope)
+      AND org_id = (SELECT org_id FROM scope)
+      AND project_id = (SELECT project_id FROM scope)
+      AND env_id = (SELECT env_id FROM scope)
+      AND attempt_id = ? AND state IN ('started', 'key_finalized') AND expires_at_ms > ?
+      AND EXISTS (
+        SELECT 1 FROM json_each(record_json, '$.offerCandidates')
+        WHERE json_extract(value, '$.candidateId') = ? AND json_extract(value, '$.walletId') = ?
+      )
+      AND (selection_digest IS NULL OR (
+        selection_digest = ? AND wallet_id = ? AND json_extract(record_json, '$.selectedCandidateId') = ?
+      ))`, [
+		input.walletId,
+		input.intentDigest,
+		input.walletId,
+		input.candidateId,
+		input.candidateId,
+		input.nowMs,
+		input.nowMs,
+		input.attemptId,
+		input.nowMs,
+		input.candidateId,
+		input.walletId,
+		input.intentDigest,
+		input.walletId,
+		input.candidateId
+	]),
+	updatePending: (prepare, record) => prepare(`WITH scope AS (SELECT ? AS namespace, ? AS org_id, ? AS project_id, ? AS env_id)
+      UPDATE email_otp_registration_attempts
+      SET wallet_id = ?, state = ?, record_json = ?, updated_at_ms = ?
+      WHERE namespace = (SELECT namespace FROM scope)
+        AND org_id = (SELECT org_id FROM scope)
+        AND project_id = (SELECT project_id FROM scope)
+        AND env_id = (SELECT env_id FROM scope)
+        AND attempt_id = ?
+        AND state IN ('started', 'key_finalized')
+        AND wallet_id = ?
+        AND json_extract(record_json, '$.selectedCandidateId') = ?
+        AND NOT (state = 'key_finalized' AND ? = 'started')
+        AND (? NOT IN ('abandoned', 'expired') OR selection_digest IS NULL)
+        AND ? <> 'active'
+        AND updated_at_ms <= ?`, [
 		record.walletId,
 		record.state,
-		record.ownerProofBindingDigest,
-		record.runtimePolicyScope?.orgId || "",
-		runtimePolicyScopeKey(record.runtimePolicyScope),
-		offerWalletIdsJson(record.offerCandidates),
 		JSON.stringify(record),
-		record.createdAtMs,
 		record.updatedAtMs,
-		record.expiresAtMs
+		record.attemptId,
+		record.walletId,
+		record.selectedCandidateId,
+		record.state,
+		record.state,
+		record.state,
+		record.updatedAtMs
 	]),
 	select: (prepare, attemptId) => prepare(`SELECT record_json, expires_at_ms, updated_at_ms, attempt_id
          FROM email_otp_registration_attempts
@@ -348,6 +342,7 @@ const emailOtpRegistrationAttemptRows = {
           AND org_id = ?
           AND project_id = ?
           AND env_id = ?
+          AND state <> 'active' AND selection_digest IS NULL
           AND (expires_at_ms <= ? OR state = 'expired')`, [nowMs]),
 	selectLiveForWallet: (prepare, walletId, nowMs) => prepare(`SELECT 1 AS found
          FROM email_otp_registration_attempts
@@ -356,7 +351,7 @@ const emailOtpRegistrationAttemptRows = {
           AND project_id = ?
           AND env_id = ?
           AND state IN ('started', 'key_finalized')
-          AND expires_at_ms > ?
+          AND (expires_at_ms > ? OR selection_digest IS NOT NULL)
           AND (
             wallet_id = ?
             OR EXISTS (
@@ -370,13 +365,31 @@ const emailOtpRegistrationAttemptRows = {
 		walletId,
 		walletId
 	]),
-	delete: (prepare, attemptId) => prepare(`DELETE FROM email_otp_registration_attempts
+	deleteUnclaimed: (prepare, attemptId) => prepare(`DELETE FROM email_otp_registration_attempts
         WHERE namespace = ?
           AND org_id = ?
           AND project_id = ?
           AND env_id = ?
-          AND attempt_id = ?`, [attemptId])
+          AND attempt_id = ?
+          AND selection_digest IS NULL`, [attemptId])
 };
+function registrationAttemptValues(record) {
+	return [
+		record.attemptId,
+		record.providerSubject,
+		record.email,
+		record.walletId,
+		record.state,
+		record.ownerProofBindingDigest,
+		record.runtimePolicyScope?.orgId || "",
+		runtimePolicyScopeKey(record.runtimePolicyScope),
+		offerWalletIdsJson(record.offerCandidates),
+		JSON.stringify(record),
+		record.createdAtMs,
+		record.updatedAtMs,
+		record.expiresAtMs
+	];
+}
 //#endregion
 export { emailOtpAuthStateRows, emailOtpChallengeRows, emailOtpGrantRows, emailOtpRegistrationAttemptRows, emailOtpUnlockChallengeRows, emailOtpWalletEnrollmentRows };
 

package/dist/esm/core/keyMaterialBrands.js

@@ -1,12 +1,2 @@
-import { formatEcdsaClientVerifyingShareB64uForWire, formatEcdsaDerivationKeyVersionForWire, formatEcdsaKeyHandleForWire, formatEcdsaRelayerKeyIdForWire, formatEcdsaThresholdKeyIdForWire, formatEd25519RelayerKeyIdForWire, formatSigningSessionSealKeyVersionForWire, parseEcdsaClientVerifyingShareB64u, parseEcdsaDerivationKeyVersion, parseEcdsaKeyHandle, parseEcdsaRelayerKeyId, parseEd25519RelayerKeyId, parseNonEmptyBrand, parseSigningSessionSealKeyVersion } from "../shared-ts/src/threshold/keyMaterialBrands.js";
-//#region src/core/keyMaterialBrands.ts
-function parseEcdsaThresholdKeyId(value) {
-	return parseNonEmptyBrand(value, "ECDSA threshold key id");
-}
-function formatEd25519ClientVerifyingShareB64uForWire(value) {
-	return value;
-}
-//#endregion
-export { formatEcdsaClientVerifyingShareB64uForWire, formatEcdsaDerivationKeyVersionForWire, formatEcdsaKeyHandleForWire, formatEcdsaRelayerKeyIdForWire, formatEcdsaThresholdKeyIdForWire, formatEd25519ClientVerifyingShareB64uForWire, formatEd25519RelayerKeyIdForWire, formatSigningSessionSealKeyVersionForWire, parseEcdsaClientVerifyingShareB64u, parseEcdsaDerivationKeyVersion, parseEcdsaKeyHandle, parseEcdsaRelayerKeyId, parseEcdsaThresholdKeyId, parseEd25519RelayerKeyId, parseSigningSessionSealKeyVersion };
-
-//# sourceMappingURL=keyMaterialBrands.js.map
+import { formatEcdsaKeyHandleForWire, formatSigningSessionSealKeyVersionForWire, parseEcdsaClientVerifyingShareB64u, parseEcdsaKeyHandle, parseEcdsaRelayerKeyId, parseSigningSessionSealKeyVersion } from "../shared-ts/src/threshold/keyMaterialBrands.js";
+export { formatEcdsaKeyHandleForWire, formatSigningSessionSealKeyVersionForWire, parseEcdsaClientVerifyingShareB64u, parseEcdsaKeyHandle, parseEcdsaRelayerKeyId, parseSigningSessionSealKeyVersion };

package/dist/esm/core/nearKeys.js

@@ -1,5 +1,4 @@
 import { ensureEd25519Prefix } from "../shared-ts/src/utils/near.js";
-import "../shared-ts/src/utils/validation.js";
 import bs58 from "bs58";
 //#region src/core/nearKeys.ts
 function stripEd25519Prefix(value) {