@seams/wallet-server 0.7.1 → 0.8.0

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthMethodService.js

@@ -3,7 +3,6 @@ import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/util
 import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
 import "../../../../shared-ts/src/utils/encoders.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { buildDelegatedWalletAuthorityV1, buildFullOwnerPermissionsV1, sameDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { parseWalletAddAuthMethodRegistrationOptions } from "../../../../shared-ts/src/utils/addAuthMethodRegistration.js";
 import { normalizeRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
@@ -24,7 +23,7 @@ import { toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";
 import { d1HostIsWithinWebAuthnRpId, resolveD1AddAuthMethodExistingAuth, resolveD1AddSignerExistingAuth, verifyD1LinkedDeviceFreshRevokeProofV1, walletAuthAuthorityFromRegistrationAuthority } from "./d1WalletAuthMethodBoundary.js";
 import { parseWalletIdForIntent } from "../registration/d1RegistrationCeremonyRecords.js";
 import { runtimePolicyScopeKey } from "../../../../core/EmailOtpRecords.js";
-import { expiredGoogleEmailOtpRegistrationAttemptRecord, pendingGoogleEmailOtpRegistrationAttemptWithSelectedCandidate } from "../emailOtp/d1GoogleEmailOtpRegistrationRecords.js";
+import { expiredGoogleEmailOtpRegistrationAttemptRecord } from "../emailOtp/d1GoogleEmailOtpRegistrationRecords.js";
 import { admitAddWalletAuthMethod } from "../../../../shared-ts/src/utils/addWalletAuthMethod.js";
 import { computeWalletAuthMethodRevocationProofDigestV1 } from "./d1WalletAuthMethodRevocationReplayStore.js";
 //#region src/router/cloudflare/d1/wallet/d1WalletAuthMethodService.ts
@@ -864,7 +863,7 @@ var CloudflareD1WalletAuthMethodService = class {
 							deviceInfo: credential.device
 						}
 					}),
-					this.webAuthnStore.prepareCredentialBindingInsertStatement(binding),
+					await this.webAuthnStore.prepareCredentialBindingInsertStatement(binding),
 					...this.getWalletAuthMethodStore().prepareV2InsertStatements(authMethod),
 					...replayStatements,
 					...atomicCompanionStatements
@@ -1932,11 +1931,6 @@ var CloudflareD1WalletAuthMethodService = class {
 				code: "registration_candidate_mismatch",
 				message: "Google Email OTP registration candidate does not match walletId"
 			};
-			if (attempt.walletId !== selectedOfferCandidate.walletId || attempt.selectedCandidateId !== selectedOfferCandidate.candidateId || attempt.collisionCounter !== selectedOfferCandidate.collisionCounter) await this.googleEmailOtpRegistrationAttempts.put(pendingGoogleEmailOtpRegistrationAttemptWithSelectedCandidate({
-				record: attempt,
-				candidate: selectedOfferCandidate,
-				updatedAtMs: Date.now()
-			}));
 			if (runtimePolicyScopeKey(attempt.runtimePolicyScope) !== runtimePolicyScopeKeyForRegistrationIntent(input.intent.runtimePolicyScope)) return {
 				ok: false,
 				code: "runtime_policy_scope_mismatch",
@@ -1961,6 +1955,13 @@ var CloudflareD1WalletAuthMethodService = class {
 				code: "duplicate_auth_method",
 				message: "Email OTP auth method is already registered"
 			};
+			const claimed = await this.googleEmailOtpRegistrationAttempts.claimCandidate({
+				attemptId: attempt.attemptId,
+				candidateId: selectedOfferCandidate.candidateId,
+				walletId: finalWalletId,
+				intentDigest: input.expectedDigestB64u
+			});
+			if (!claimed.ok) return claimed;
 			return {
 				ok: true,
 				authority: {

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthorityStore.js

@@ -5,136 +5,11 @@ import { parseDelegatedWalletPermissionSetV1 } from "../../../../shared-ts/src/a
 import { parseWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { buildRevokedWalletAuthorityV1, computeWalletAuthorityDigestB64u, parseWalletAuthorityV1, parseWalletSignerActivationSetV1, walletAuthorityDigestsMatchV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { buildWalletSessionCapabilitySubjectsV1 } from "../../../../authorization/domain.js";
-import { d1ChangedRows, formatD1ExecStatement, parseD1JsonColumn } from "../../../../storage/d1Sql.js";
+import { d1ChangedRows, parseD1JsonColumn } from "../../../../storage/d1Sql.js";
 import { prepareD1WalletPutSignerStatement } from "../../../../core/d1WalletStore.js";
-import { ensureWalletAuthMethodStoreD1SchemaV2, prepareD1WalletAuthMethodV2PutStatement } from "../../../../core/d1WalletAuthMethodStore.js";
+import { prepareD1WalletAuthMethodV2PutStatement } from "../../../../core/d1WalletAuthMethodStore.js";
 import { prepareD1WalletSessionAuthorityProjectionStatements } from "../authorization/walletSessionAuthorityProjection.js";
 //#region src/router/cloudflare/d1/wallet/d1WalletAuthorityStore.ts
-const WALLET_AUTHORITY_STORE_D1_SCHEMA_SQL = Object.freeze([
-	`
-    CREATE TABLE IF NOT EXISTS wallet_authorities (
-      namespace TEXT NOT NULL,
-      org_id TEXT NOT NULL,
-      project_id TEXT NOT NULL,
-      env_id TEXT NOT NULL,
-      authority_id TEXT NOT NULL,
-      wallet_id TEXT NOT NULL,
-      device_id TEXT NOT NULL,
-      provenance_kind TEXT NOT NULL,
-      enrollment_id TEXT,
-      source_authority_id TEXT,
-      link_session_id TEXT,
-      recovery_operation_id TEXT,
-      continuity_authority_id TEXT,
-      lifecycle_state TEXT NOT NULL,
-      permissions_json TEXT NOT NULL,
-      signer_activations_json TEXT NOT NULL,
-      local_install_package_set_digest_b64u TEXT,
-      signer_activation_set_digest_b64u TEXT NOT NULL,
-      authority_digest_b64u TEXT NOT NULL,
-      revocation_epoch INTEGER NOT NULL,
-      record_json TEXT NOT NULL,
-      created_at_ms INTEGER NOT NULL,
-      updated_at_ms INTEGER NOT NULL,
-      activated_at_ms INTEGER,
-      revoked_at_ms INTEGER,
-      PRIMARY KEY (namespace, org_id, project_id, env_id, authority_id),
-      CHECK (length(authority_id) > 0),
-      CHECK (length(wallet_id) > 0),
-      CHECK (length(device_id) > 0),
-      CHECK (provenance_kind IN ('wallet_registration', 'device_link', 'wallet_recovery')),
-      CHECK (lifecycle_state IN ('pending_local_install', 'active', 'revoked')),
-      CHECK (length(permissions_json) > 0 AND json_valid(permissions_json)),
-      CHECK (length(signer_activations_json) > 0 AND json_valid(signer_activations_json)),
-      CHECK (length(record_json) > 0 AND json_valid(record_json)),
-      CHECK (length(signer_activation_set_digest_b64u) > 0),
-      CHECK (length(authority_digest_b64u) > 0),
-      CHECK (revocation_epoch >= 0),
-      CHECK (created_at_ms >= 0),
-      CHECK (updated_at_ms >= created_at_ms),
-      CHECK (
-        (provenance_kind = 'wallet_registration'
-          AND enrollment_id IS NULL
-          AND source_authority_id IS NULL
-          AND link_session_id IS NULL
-          AND recovery_operation_id IS NULL
-          AND continuity_authority_id IS NULL)
-        OR
-        (provenance_kind = 'device_link'
-          AND enrollment_id IS NOT NULL AND length(enrollment_id) > 0
-          AND source_authority_id IS NOT NULL AND length(source_authority_id) > 0
-          AND link_session_id IS NOT NULL AND length(link_session_id) > 0
-          AND recovery_operation_id IS NULL
-          AND continuity_authority_id IS NULL)
-        OR
-        (provenance_kind = 'wallet_recovery'
-          AND enrollment_id IS NULL
-          AND source_authority_id IS NULL
-          AND link_session_id IS NULL
-          AND recovery_operation_id IS NOT NULL
-          AND length(recovery_operation_id) > 0
-          AND continuity_authority_id IS NOT NULL
-          AND length(continuity_authority_id) > 0)
-      ),
-      CHECK (
-        (lifecycle_state = 'pending_local_install'
-          AND local_install_package_set_digest_b64u IS NOT NULL
-          AND length(local_install_package_set_digest_b64u) > 0
-          AND activated_at_ms IS NULL
-          AND revoked_at_ms IS NULL
-          AND revocation_epoch = 0)
-        OR
-        (lifecycle_state = 'active'
-          AND local_install_package_set_digest_b64u IS NULL
-          AND activated_at_ms IS NOT NULL
-          AND revoked_at_ms IS NULL)
-        OR
-        (lifecycle_state = 'revoked'
-          AND local_install_package_set_digest_b64u IS NULL
-          AND activated_at_ms IS NOT NULL
-          AND revoked_at_ms IS NOT NULL)
-      ),
-      CHECK (json_extract(record_json, '$.authorityId') = authority_id),
-      CHECK (json_extract(record_json, '$.walletId') = wallet_id),
-      CHECK (json_extract(record_json, '$.state') = lifecycle_state),
-      CHECK (json_extract(record_json, '$.revocationEpoch') = revocation_epoch),
-      CHECK (json_extract(record_json, '$.authorityDigestB64u') = authority_digest_b64u),
-      CHECK (
-        json_extract(record_json, '$.signerActivationSetDigestB64u')
-          = signer_activation_set_digest_b64u
-      )
-    )
-  `,
-	`
-    CREATE UNIQUE INDEX IF NOT EXISTS wallet_authorities_active_device_uidx
-      ON wallet_authorities (
-        namespace, org_id, project_id, env_id, wallet_id, device_id
-      )
-      WHERE lifecycle_state <> 'revoked'
-  `,
-	`
-    CREATE UNIQUE INDEX IF NOT EXISTS wallet_authorities_enrollment_uidx
-      ON wallet_authorities (
-        namespace, org_id, project_id, env_id, wallet_id, enrollment_id
-      )
-      WHERE enrollment_id IS NOT NULL
-  `,
-	`
-    CREATE INDEX IF NOT EXISTS wallet_authorities_inventory_idx
-      ON wallet_authorities (
-        namespace, org_id, project_id, env_id, wallet_id, lifecycle_state,
-        updated_at_ms, authority_id
-      )
-  `,
-	`
-    CREATE TABLE IF NOT EXISTS wallet_authority_cas_guard (
-      guard_id INTEGER PRIMARY KEY CHECK (guard_id = 1)
-    )
-  `,
-	`
-    INSERT OR IGNORE INTO wallet_authority_cas_guard (guard_id) VALUES (1)
-  `
-]);
 function normalizeScope(input) {
 	return {
 		namespace: requireScopeString(input.namespace, "namespace"),
@@ -385,7 +260,6 @@ var WalletAuthorityCommitConflictError = class extends Error {
 };
 var D1WalletAuthorityStore = class {
 	constructor(input) {
-		this.schemaReady = false;
 		this.database = input.database;
 		this.scope = normalizeScope(input.scope ?? {
 			namespace: input.namespace ?? "",
@@ -393,13 +267,6 @@ var D1WalletAuthorityStore = class {
 			projectId: input.projectId ?? "",
 			envId: input.envId ?? ""
 		});
-		this.ensureSchemaOnUse = input.ensureSchema !== false;
-	}
-	async ensureSchema() {
-		if (!this.ensureSchemaOnUse || this.schemaReady) return;
-		for (const statement of WALLET_AUTHORITY_STORE_D1_SCHEMA_SQL) await this.database.exec(formatD1ExecStatement(statement));
-		await ensureWalletAuthMethodStoreD1SchemaV2({ database: this.database });
-		this.schemaReady = true;
 	}
 	/**
 	* Commits an added signer: its signer records, the authority extended with
@@ -409,7 +276,6 @@ var D1WalletAuthorityStore = class {
 	* credentials and deletes its unredeemed hosted exchange codes.
 	*/
 	async extendActiveAuthority(input) {
-		await this.ensureSchema();
 		const statements = [
 			...input.walletSigners.map((record) => prepareD1WalletPutSignerStatement({
 				database: this.database,
@@ -447,7 +313,6 @@ var D1WalletAuthorityStore = class {
 		if (results.length !== statements.length || results.some((result) => !result.success)) throw new Error("D1 wallet authority extension returned an incomplete batch result");
 	}
 	async readById(authorityId) {
-		await this.ensureSchema();
 		const row = await this.database.prepare(`SELECT *
            FROM wallet_authorities
           WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
@@ -457,7 +322,6 @@ var D1WalletAuthorityStore = class {
 		return await parseD1WalletAuthorityRow(row);
 	}
 	async readByWalletAndDevice(input) {
-		await this.ensureSchema();
 		const row = await this.database.prepare(`SELECT *
            FROM wallet_authorities
           WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
@@ -476,7 +340,6 @@ var D1WalletAuthorityStore = class {
 	* link-session CAS, keeping the pending transition one atomic batch.
 	*/
 	async commitPendingAuthorityWithStatements(input, additionalStatements) {
-		await this.ensureSchema();
 		assertPendingCommitInput(input);
 		if (!await walletAuthorityDigestsMatchV1(input.authority)) throw new Error("pending wallet authority digest does not match its canonical record");
 		const existing = await this.readById(input.authority.authorityId);
@@ -539,7 +402,6 @@ var D1WalletAuthorityStore = class {
 	* same transaction as authority and auth-method visibility.
 	*/
 	async activatePendingAuthorityWithStatements(input, additionalStatements) {
-		await this.ensureSchema();
 		assertActivationInput(input);
 		if (!await walletAuthorityDigestsMatchV1(input.pendingAuthority)) return {
 			kind: "conflict",
@@ -617,7 +479,6 @@ var D1WalletAuthorityStore = class {
 		};
 	}
 	async listForWallet(input) {
-		await this.ensureSchema();
 		if (!Number.isSafeInteger(input.limit) || input.limit < 1 || input.limit > 1e3) throw new Error("wallet authority page limit is invalid");
 		const state = input.lifecycleState ?? "";
 		const cursorTime = input.cursor?.updatedAtMs ?? 0;
@@ -645,7 +506,6 @@ var D1WalletAuthorityStore = class {
 		};
 	}
 	async revokeWalletAuthMethod(input) {
-		await this.ensureSchema();
 		const expectedEpoch = requireNonNegativeInteger(input.expectedAuthorityRevocationEpoch, "expected authority revocation epoch");
 		const requestedAtMs = requireNonNegativeInteger(input.requestedAtMs, "requestedAtMs");
 		const activeCountRow = await this.database.prepare(`SELECT COUNT(*) AS count

package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnAuthService.js

@@ -1,8 +1,9 @@
 import { parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
+import { WalletLifecycleLocator } from "../../../../authorization/lifecycleRouting.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
+import { failedVerification, failure } from "../../../../shared-ts/src/utils/failure.js";
 import { decodeWebAuthnBase64UrlOrBase64, parseWebAuthnAuthenticationCredential, parseWebAuthnClientDataJsonBase64url, webAuthnCredentialIdB64uFromCredential, webAuthnOriginHostnameOrEmpty } from "../../../auth/webAuthnCredentialCodecs.js";
 import { nonNegativeSafeInteger, optionalNonNegativeInteger, parseD1BoundaryWalletId, parseD1BoundaryWalletIdResult, parseJsonObject } from "../auth/d1RouterApiAuthBoundary.js";
 import { parseWebAuthnAuthenticatorRowDeviceInfo, webAuthnSyncWalletBindingFromCredentialBinding } from "./d1WebAuthnRecords.js";
@@ -14,6 +15,7 @@ function errorMessage(error) {
 }
 var CloudflareD1WebAuthnAuthService = class {
 	constructor(input) {
+		this.lifecycleRouting = input.lifecycleRouting;
 		this.webAuthnStore = input.webAuthnStore;
 		this.walletManifestSource = input.walletManifestSource;
 		this.walletAuthMethodStore = input.walletAuthMethodStore;
@@ -21,11 +23,7 @@ var CloudflareD1WebAuthnAuthService = class {
 	async listWebAuthnAuthenticatorsForUser(input) {
 		try {
 			const userId = parseD1BoundaryWalletIdResult(input.userId);
-			if (!userId.ok) return {
-				ok: false,
-				code: "invalid_args",
-				message: userId.code === "missing" ? "Missing userId" : "Invalid userId"
-			};
+			if (!userId.ok) return failure("invalid_args", userId.code === "missing" ? "Missing userId" : "Invalid userId");
 			const rpId = normalizeOptionalTrimmedString(input.rpId);
 			const authRows = await this.webAuthnStore.readAuthenticatorRows(userId.value);
 			const bindings = await this.webAuthnStore.readBindingRows({
@@ -55,27 +53,15 @@ var CloudflareD1WebAuthnAuthService = class {
 				authenticators
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				code: "internal",
-				message: errorMessage(error) || "Failed to list authenticators"
-			};
+			return failure("internal", errorMessage(error) || "Failed to list authenticators");
 		}
 	}
 	async createWebAuthnLoginOptions(input) {
 		try {
 			const userId = parseD1BoundaryWalletIdResult(input.userId ?? input.user_id);
 			const rpId = normalizeOptionalTrimmedString(input.rpId ?? input.rp_id);
-			if (!userId.ok) return {
-				ok: false,
-				code: "invalid_body",
-				message: userId.code === "missing" ? "Missing userId" : "Invalid userId"
-			};
-			if (!rpId) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Missing rpId"
-			};
+			if (!userId.ok) return failure("invalid_body", userId.code === "missing" ? "Missing userId" : "Invalid userId");
+			if (!rpId) return failure("invalid_body", "Missing rpId");
 			const createdAtMs = Date.now();
 			const expiresAtMs = createdAtMs + webAuthnLoginChallengeTtlMs(input.ttlMs ?? input.ttl_ms);
 			const challengeId = secureRandomBase64Url(16, "WebAuthn login challenge id");
@@ -96,11 +82,7 @@ var CloudflareD1WebAuthnAuthService = class {
 				seenCredentialIds.add(credentialId);
 				credentialIds.push(credentialId);
 			}
-			if (credentialIds.length === 0) return {
-				ok: false,
-				code: "unknown_credential",
-				message: "Wallet has no registered passkey credential"
-			};
+			if (credentialIds.length === 0) return failure("unknown_credential", "Wallet has no registered passkey credential");
 			const record = {
 				version: "webauthn_login_challenge_v1",
 				challengeId,
@@ -110,6 +92,8 @@ var CloudflareD1WebAuthnAuthService = class {
 				createdAtMs,
 				expiresAtMs
 			};
+			const publication = await publishPasskeyChallengeHome(this.lifecycleRouting, userId.value, challengeId);
+			if (!publication.ok) return publication;
 			await this.webAuthnStore.writeChallenge({
 				challengeId,
 				challengeKind: "login",
@@ -125,28 +109,16 @@ var CloudflareD1WebAuthnAuthService = class {
 				expiresAtMs
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				code: "internal",
-				message: errorMessage(error) || "Failed to create login options"
-			};
+			return failure("internal", errorMessage(error) || "Failed to create login options");
 		}
 	}
 	async createWebAuthnSyncAccountOptions(input) {
 		try {
 			const rpId = normalizeOptionalTrimmedString(input.rp_id);
-			if (!rpId) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Missing rp_id"
-			};
+			if (!rpId) return failure("invalid_body", "Missing rp_id");
 			const expectedUserIdRaw = normalizeOptionalTrimmedString(input.account_id);
 			const expectedUserId = expectedUserIdRaw ? parseD1BoundaryWalletId(expectedUserIdRaw) : null;
-			if (expectedUserIdRaw && !expectedUserId) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Invalid wallet account_id"
-			};
+			if (expectedUserIdRaw && !expectedUserId) return failure("invalid_body", "Invalid wallet account_id");
 			const createdAtMs = Date.now();
 			const expiresAtMs = createdAtMs + webAuthnLoginChallengeTtlMs(input.ttlMs ?? input.ttl_ms);
 			const challengeId = secureRandomBase64Url(16, "WebAuthn sync challenge id");
@@ -172,11 +144,7 @@ var CloudflareD1WebAuthnAuthService = class {
 					}
 					if (credentialId && activeCredentialIds.has(credentialId) && !walletBinding) walletBinding = webAuthnSyncWalletBindingFromCredentialBinding(binding) || void 0;
 				}
-				if (credentialIds.length === 0) return {
-					ok: false,
-					code: "unknown_credential",
-					message: "Wallet has no registered active passkey credential"
-				};
+				if (credentialIds.length === 0) return failure("unknown_credential", "Wallet has no registered active passkey credential");
 			}
 			const record = {
 				version: "webauthn_sync_challenge_v1",
@@ -187,13 +155,14 @@ var CloudflareD1WebAuthnAuthService = class {
 				createdAtMs,
 				expiresAtMs
 			};
-			await this.webAuthnStore.writeChallenge({
+			const stored = await this.webAuthnStore.writeChallenge({
 				challengeId,
 				challengeKind: "sync",
 				record,
 				createdAtMs,
 				expiresAtMs
 			});
+			if (!stored.ok) return stored;
 			return {
 				ok: true,
 				challengeId,
@@ -203,11 +172,7 @@ var CloudflareD1WebAuthnAuthService = class {
 				expiresAtMs
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				code: "internal",
-				message: errorMessage(error) || "Failed to create sync account options"
-			};
+			return failure("internal", errorMessage(error) || "Failed to create sync account options");
 		}
 	}
 	async verifyWebAuthnAuthenticationLite(input) {
@@ -349,56 +314,22 @@ var CloudflareD1WebAuthnAuthService = class {
 	async verifyWebAuthnLogin(input) {
 		try {
 			const challengeId = normalizeOptionalTrimmedString(input.challengeId ?? input.challenge_id);
-			if (!challengeId) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Missing challengeId"
-			};
+			if (!challengeId) return failure("invalid_body", "Missing challengeId");
 			const challenge = await this.webAuthnStore.consumeLoginChallenge(challengeId);
-			if (!challenge) return {
-				ok: false,
-				verified: false,
-				code: "challenge_expired_or_invalid",
-				message: "Login challenge expired or invalid"
-			};
+			if (!challenge) return failedVerification("challenge_expired_or_invalid", "Login challenge expired or invalid");
 			const expectedOrigin = normalizeOptionalTrimmedString(input.expected_origin);
-			if (!expectedOrigin) return {
-				ok: false,
-				verified: false,
-				code: "invalid_body",
-				message: "expected_origin is required for WebAuthn authentication verification"
-			};
+			if (!expectedOrigin) return failedVerification("invalid_body", "expected_origin is required for WebAuthn authentication verification");
 			const rpId = parseWebAuthnRpId(challenge.rpId);
-			if (!rpId.ok) return {
-				ok: false,
-				verified: false,
-				code: "internal",
-				message: `Stored login challenge rpId is invalid: ${rpId.error.message}`
-			};
+			if (!rpId.ok) return failedVerification("internal", `Stored login challenge rpId is invalid: ${rpId.error.message}`);
 			const credential = parseWebAuthnAuthenticationCredential(input.webauthn_authentication);
-			if (!credential) return {
-				ok: false,
-				verified: false,
-				code: "invalid_body",
-				message: "Missing webauthn_authentication"
-			};
+			if (!credential) return failedVerification("invalid_body", "Missing webauthn_authentication");
 			const credentialId = webAuthnCredentialIdB64uFromCredential(credential);
-			if (!credentialId.ok) return {
-				ok: false,
-				verified: false,
-				code: credentialId.code,
-				message: credentialId.message
-			};
+			if (!credentialId.ok) return failedVerification(credentialId.code, credentialId.message);
 			const activeMethod = await this.walletAuthMethodStore.getPasskeyV2({
 				rpId: challenge.rpId,
 				credentialIdB64u: credentialId.credentialIdB64u
 			});
-			if (!activeMethod || activeMethod.kind !== "passkey" || activeMethod.status !== "active" || String(activeMethod.walletId) !== String(challenge.userId) || String(activeMethod.rpId) !== String(challenge.rpId) || String(activeMethod.credentialIdB64u) !== String(credentialId.credentialIdB64u)) return {
-				ok: false,
-				verified: false,
-				code: "unknown_credential",
-				message: "Credential is not active for this wallet"
-			};
+			if (!activeMethod || activeMethod.kind !== "passkey" || activeMethod.status !== "active" || String(activeMethod.walletId) !== String(challenge.userId) || String(activeMethod.rpId) !== String(challenge.rpId) || String(activeMethod.credentialIdB64u) !== String(credentialId.credentialIdB64u)) return failedVerification("unknown_credential", "Credential is not active for this wallet");
 			const verificationFailure = webAuthnAuthenticationFailure(await this.verifyWebAuthnAuthenticationLite({
 				userId: challenge.userId,
 				rpId: rpId.value,
@@ -424,43 +355,21 @@ var CloudflareD1WebAuthnAuthService = class {
 				ed25519: loginSigner.ed25519
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				verified: false,
-				code: "internal",
-				message: errorMessage(error) || "Login verification failed"
-			};
+			return failedVerification("internal", errorMessage(error) || "Login verification failed");
 		}
 	}
 	async verifyWebAuthnSyncAccount(input) {
 		try {
 			const challengeId = normalizeOptionalTrimmedString(input.challengeId ?? input.challenge_id);
-			if (!challengeId) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Missing challengeId"
-			};
-			const challenge = await this.webAuthnStore.consumeSyncChallenge(challengeId);
-			if (!challenge) return {
-				ok: false,
-				verified: false,
-				code: "challenge_expired_or_invalid",
-				message: "Sync challenge expired or invalid"
-			};
+			if (!challengeId) return failure("invalid_body", "Missing challengeId");
 			const credential = parseWebAuthnAuthenticationCredential(input.webauthn_authentication);
-			if (!credential) return {
-				ok: false,
-				verified: false,
-				code: "invalid_body",
-				message: "Missing webauthn_authentication"
-			};
+			if (!credential) return failedVerification("invalid_body", "Missing webauthn_authentication");
 			const credentialId = webAuthnCredentialIdB64uFromCredential(credential);
-			if (!credentialId.ok) return {
-				ok: false,
-				verified: false,
-				code: credentialId.code,
-				message: credentialId.message
-			};
+			if (!credentialId.ok) return failedVerification(credentialId.code, credentialId.message);
+			const consumed = await this.webAuthnStore.consumeSyncChallenge(challengeId, credentialId.credentialIdB64u);
+			if (!consumed.ok) return failedVerification(consumed.code, consumed.message);
+			const challenge = consumed.record;
+			if (!challenge) return failedVerification("challenge_expired_or_invalid", "Sync challenge expired or invalid");
 			const syncBinding = webAuthnSyncCredentialBinding(await this.webAuthnStore.readBindingByCredential({
 				rpId: challenge.rpId,
 				credentialIdB64u: credentialId.credentialIdB64u
@@ -471,26 +380,11 @@ var CloudflareD1WebAuthnAuthService = class {
 				rpId: challenge.rpId,
 				credentialIdB64u: credentialId.credentialIdB64u
 			});
-			if (!activeMethod || activeMethod.kind !== "passkey" || activeMethod.status !== "active" || String(activeMethod.walletId) !== String(binding.userId) || String(activeMethod.rpId) !== String(challenge.rpId) || String(activeMethod.credentialIdB64u) !== String(credentialId.credentialIdB64u)) return {
-				ok: false,
-				verified: false,
-				code: "unknown_credential",
-				message: "Credential is not active for this wallet"
-			};
+			if (!activeMethod || activeMethod.kind !== "passkey" || activeMethod.status !== "active" || String(activeMethod.walletId) !== String(binding.userId) || String(activeMethod.rpId) !== String(challenge.rpId) || String(activeMethod.credentialIdB64u) !== String(credentialId.credentialIdB64u)) return failedVerification("unknown_credential", "Credential is not active for this wallet");
 			const expectedOrigin = normalizeOptionalTrimmedString(input.expected_origin);
-			if (!expectedOrigin) return {
-				ok: false,
-				verified: false,
-				code: "invalid_body",
-				message: "expected_origin is required for WebAuthn authentication verification"
-			};
+			if (!expectedOrigin) return failedVerification("invalid_body", "expected_origin is required for WebAuthn authentication verification");
 			const rpId = parseWebAuthnRpId(binding.rpId);
-			if (!rpId.ok) return {
-				ok: false,
-				verified: false,
-				code: "internal",
-				message: `Stored sync credential binding rpId is invalid: ${rpId.error.message}`
-			};
+			if (!rpId.ok) return failedVerification("internal", `Stored sync credential binding rpId is invalid: ${rpId.error.message}`);
 			const verificationFailure = webAuthnAuthenticationFailure(await this.verifyWebAuthnAuthenticationLite({
 				userId: binding.userId,
 				rpId: rpId.value,
@@ -503,36 +397,16 @@ var CloudflareD1WebAuthnAuthService = class {
 				userId: binding.userId,
 				credentialIdB64u: credentialId.credentialIdB64u
 			});
-			if (!authenticator) return {
-				ok: false,
-				verified: false,
-				code: "unknown_credential",
-				message: "Credential is not registered for user"
-			};
+			if (!authenticator) return failedVerification("unknown_credential", "Credential is not registered for user");
 			const walletBinding = webAuthnSyncWalletBindingFromCredentialBinding(binding);
-			if (!walletBinding) return {
-				ok: false,
-				verified: false,
-				code: "internal",
-				message: "Credential binding is missing wallet identity fields"
-			};
+			if (!walletBinding) return failedVerification("internal", "Credential binding is missing wallet identity fields");
 			const walletId = parseD1BoundaryWalletId(walletBinding.walletId);
-			if (!walletId) return {
-				ok: false,
-				verified: false,
-				code: "internal",
-				message: "Credential binding contains an invalid wallet ID"
-			};
+			if (!walletId) return failedVerification("internal", "Credential binding contains an invalid wallet ID");
 			const ed25519Manifest = await this.walletManifestSource.getEd25519KeyManifestBySlot({
 				walletId,
 				signerSlot: walletBinding.signerSlot
 			});
-			if (!ed25519Manifest) return {
-				ok: false,
-				verified: false,
-				code: "ed25519_not_provisioned",
-				message: "Wallet has no Ed25519 signer yet; NEAR provisioning has not completed"
-			};
+			if (!ed25519Manifest) return failedVerification("ed25519_not_provisioned", "Wallet has no Ed25519 signer yet; NEAR provisioning has not completed");
 			const thresholdEd25519 = binding.relayerKeyId && binding.publicKey ? {
 				relayerKeyId: binding.relayerKeyId,
 				authorityScope: {
@@ -566,12 +440,7 @@ var CloudflareD1WebAuthnAuthService = class {
 				...thresholdEd25519 ? { thresholdEd25519 } : {}
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				verified: false,
-				code: "internal",
-				message: errorMessage(error) || "Sync verification failed"
-			};
+			return failedVerification("internal", errorMessage(error) || "Sync verification failed");
 		}
 	}
 };
@@ -594,6 +463,21 @@ function webAuthnLoginChallengeTtlMs(input) {
 function compareAuthenticatorSlots(left, right) {
 	return (Number(left.signerSlot || 0) || 0) - (Number(right.signerSlot || 0) || 0);
 }
+async function publishPasskeyChallengeHome(publisher, walletId, challengeId) {
+	if (!publisher) return { ok: true };
+	try {
+		if (!(await publisher.publishLifecycle({
+			walletId,
+			locator: WalletLifecycleLocator.parse({
+				kind: "passkey_challenge",
+				value: challengeId
+			})
+		})).ok) return failure("wallet_home_conflict", "Passkey challenge home conflicts");
+		return { ok: true };
+	} catch {
+		return failure("wallet_home_unavailable", "Passkey challenge home is unavailable");
+	}
+}
 //#endregion
 export { CloudflareD1WebAuthnAuthService };