@seams/wallet-server 0.7.3 → 0.9.0

package/dist/esm/core/d1IdentityStore.js

@@ -1,5 +1,4 @@
 import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
-import "../shared-ts/src/utils/validation.js";
 import { failure } from "../shared-ts/src/utils/failure.js";
 import { d1ChangedRows } from "../storage/d1Sql.js";
 import { D1TenantTable, ensureD1Schema } from "./d1TenantStore.js";
@@ -242,6 +241,6 @@ var D1IdentityStore = class {
 	}
 };
 //#endregion
-export { D1IdentityStore, IDENTITY_D1_STORE, IDENTITY_STORE_D1_SCHEMA_SQL, ensureIdentityStoreD1Schema };
+export { D1IdentityStore, IDENTITY_STORE_D1_SCHEMA_SQL, ensureIdentityStoreD1Schema };
 
 //# sourceMappingURL=d1IdentityStore.js.map

package/dist/esm/core/d1TenantStore.js

@@ -1,20 +1,6 @@
 import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
-import "../shared-ts/src/utils/validation.js";
-import "./defaultConfigsServer.js";
-import { toPrefixWithColon } from "./ThresholdService/validation.js";
 import { formatD1ExecStatement } from "../storage/d1Sql.js";
 //#region src/core/d1TenantStore.ts
-/**
-* A store's key prefix, which is also its D1 namespace: the first of `explicitKeys` set in
-* `config`, else `<THRESHOLD_PREFIX>:<segment>`. It always ends with a colon.
-*/
-function resolveStorePrefix(config, explicitKeys, segment) {
-	for (const key of explicitKeys) {
-		const explicit = normalizeOptionalTrimmedString(config[key]);
-		if (explicit) return toPrefixWithColon(explicit, "");
-	}
-	return `${toPrefixWithColon(normalizeOptionalTrimmedString(config.THRESHOLD_PREFIX) || "w3a", `w3a:`)}${segment}`;
-}
 /** Requires each part of the scope; `store` ends the error, e.g. `identity store`. */
 function requireD1TenantScope(input, store) {
 	const field = (value, name) => {
@@ -29,15 +15,6 @@ function requireD1TenantScope(input, store) {
 		envId: field(input.envId, "envId")
 	};
 }
-/** The scope env-shaped store config names (`orgId` or `ORG_ID`, and so on) under `namespace`. */
-function d1TenantScopeFromConfig(config, namespace, store) {
-	return requireD1TenantScope({
-		namespace,
-		orgId: config.orgId || config.ORG_ID,
-		projectId: config.projectId || config.PROJECT_ID,
-		envId: config.envId || config.ENV_ID
-	}, store);
-}
 async function ensureD1Schema(database, statements) {
 	for (const statement of statements) await database.exec(formatD1ExecStatement(statement));
 }
@@ -77,6 +54,6 @@ var D1TenantTable = class {
 	}
 };
 //#endregion
-export { D1Schema, D1TenantTable, d1TenantScopeFromConfig, ensureD1Schema, prepareD1TenantStatement, resolveStorePrefix };
+export { D1Schema, D1TenantTable, ensureD1Schema, prepareD1TenantStatement };
 
 //# sourceMappingURL=d1TenantStore.js.map

package/dist/esm/core/d1WalletAuthMethodStore.js

@@ -3,8 +3,8 @@ import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize
 import { isPlainObject } from "../shared-ts/src/utils/validation.js";
 import { parseWalletAuthMethodRecordV2, walletAuthMethodRecordId } from "../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { D1_BATCH_CAS_GUARD_SQL, parseD1JsonColumn } from "../storage/d1Sql.js";
-import { D1Schema, D1TenantTable, ensureD1Schema } from "./d1TenantStore.js";
 import { walletIdFromString } from "../shared-ts/src/utils/registrationIds.js";
+import { D1Schema, D1TenantTable, ensureD1Schema } from "./d1TenantStore.js";
 //#region src/core/d1WalletAuthMethodStore.ts
 /** Names the wallet auth-method store in D1 scope errors. */
 const WALLET_AUTH_METHOD_D1_STORE = "wallet auth-method store";
@@ -243,9 +243,6 @@ const WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL = Object.freeze([
 async function ensureWalletAuthMethodStoreD1Schema(options) {
 	await ensureD1Schema(options.database, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL);
 }
-async function ensureWalletAuthMethodStoreD1SchemaV2(options) {
-	await ensureD1Schema(options.database, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL);
-}
 function trimString(value) {
 	return typeof value === "string" ? value.trim() : "";
 }
@@ -712,6 +709,6 @@ var D1WalletAuthMethodStore = class {
 	}
 };
 //#endregion
-export { D1WalletAuthMethodStore, WALLET_AUTH_METHOD_D1_STORE, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL, bindWalletAuthMethodIdentity, bindWalletAuthMethodIdentityV2, ensureWalletAuthMethodStoreD1Schema, ensureWalletAuthMethodStoreD1SchemaV2, normalizeWalletAuthMethod, normalizeWalletAuthMethodV2, prepareD1WalletAuthMethodInsertStatement, prepareD1WalletAuthMethodPutStatement, prepareD1WalletAuthMethodV2PutStatement, walletAuthMethodId, walletAuthMethodV2Id };
+export { D1WalletAuthMethodStore, WALLET_AUTH_METHOD_D1_STORE, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL, bindWalletAuthMethodIdentity, bindWalletAuthMethodIdentityV2, ensureWalletAuthMethodStoreD1Schema, normalizeWalletAuthMethod, normalizeWalletAuthMethodV2, prepareD1WalletAuthMethodInsertStatement, prepareD1WalletAuthMethodPutStatement, prepareD1WalletAuthMethodV2PutStatement, walletAuthMethodId, walletAuthMethodV2Id };
 
 //# sourceMappingURL=d1WalletAuthMethodStore.js.map

package/dist/esm/core/d1WalletStore.js

@@ -5,11 +5,11 @@ import { sameRouterAbMpcMaterialActivationRef } from "../shared-ts/src/utils/rou
 import { parseRouterAbEd25519YaoRecoveryActivationResultV1, parseRouterAbEd25519YaoRecoveryAdmissionRequestV1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationActivationResultV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { normalizeRuntimePolicyScope, signingRootScopeFromRuntimePolicyScope } from "../shared-ts/src/threshold/signingRootScope.js";
 import { sameRouterAbEcdsaDerivationPublicCapabilityV1 } from "../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { normalizeThresholdEd25519ParticipantIds } from "../shared-ts/src/threshold/participants.js";
-import { D1_BATCH_CAS_GUARD_SQL, formatD1ExecStatement, parseD1JsonColumn } from "../storage/d1Sql.js";
 import { thresholdEcdsaChainTargetKey } from "../shared-ts/src/utils/thresholdEcdsaChainTarget.js";
 import { ecdsaPostRegistrationRequestMatchesCapability, parseWalletEcdsaPendingSessionActivationRecord, parseWalletEcdsaSignerRecord } from "./WalletStore.js";
+import { D1_BATCH_CAS_GUARD_SQL, formatD1ExecStatement, parseD1JsonColumn } from "../storage/d1Sql.js";
 import { EcdsaMaterialRead, parseWalletEcdsaSignerRows, prepareWalletEcdsaSignersRead } from "./d1EcdsaSignerRead.js";
+import { normalizeThresholdEd25519ParticipantIds } from "../shared-ts/src/threshold/participants.js";
 //#region src/core/d1WalletStore.ts
 function sameD1WalletRuntimePolicyScopeV1(left, right) {
 	return left.orgId === right.orgId && left.projectId === right.projectId && left.envId === right.envId && left.signingRootVersion === right.signingRootVersion;
@@ -219,6 +219,16 @@ function parseWalletEd25519YaoActiveCapabilityRecord(raw) {
 		default: return null;
 	}
 }
+/** Where an Ed25519 signer row names the material activation it serves. */
+const ED25519_SIGNER_ACTIVATION_ID_PATH = "$.activeYaoCapability.admissionRequest.scope.material_activation.activation_id";
+/** The wallet's signer for one material activation, among the rows that name its id. */
+function selectWalletEd25519Signer(rows, walletId, materialActivation) {
+	const matches = rows.map((row) => parseWalletEd25519SignerRecord(parseD1JsonColumn(row.record_json))).filter((record) => record !== null && record.walletId === walletId && sameRouterAbMpcMaterialActivationRef(record.activeYaoCapability.admissionRequest.scope.material_activation, materialActivation));
+	if (matches.length === 0) return null;
+	const signerId = matches[0]?.signerId;
+	if (!signerId || matches.some((record) => record.signerId !== signerId)) throw new Error("Wallet has conflicting Ed25519 material activations");
+	return matches[0] ?? null;
+}
 function parseWalletEd25519SignerRecord(raw) {
 	if (!isPlainObject(raw) || raw.version !== "wallet_signer_ed25519_v1") return null;
 	const walletId = parseWalletId(raw.walletId);
@@ -579,7 +589,7 @@ var D1WalletStore = class {
 		await this.ensureSchema();
 		const walletId = normalizeOptionalTrimmedString(input.walletId);
 		if (!walletId) return null;
-		const matches = ((await this.database.prepare(`SELECT record_json
+		return selectWalletEd25519Signer((await this.database.prepare(`SELECT record_json
            FROM wallet_signers
           WHERE namespace = ?
             AND org_id = ?
@@ -587,15 +597,8 @@ var D1WalletStore = class {
             AND env_id = ?
             AND wallet_id = ?
             AND signer_family = 'ed25519'
-            AND json_extract(
-              record_json,
-              '$.activeYaoCapability.admissionRequest.scope.material_activation.activation_id'
-            ) = ?
-          LIMIT 4`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, walletId, input.materialActivation.activation_id).all()).results || []).map((row) => parseWalletEd25519SignerRecord(parseD1JsonColumn(row.record_json))).filter((record) => record !== null && record.walletId === walletId && sameRouterAbMpcMaterialActivationRef(record.activeYaoCapability.admissionRequest.scope.material_activation, input.materialActivation));
-		if (matches.length === 0) return null;
-		const signerId = matches[0]?.signerId;
-		if (!signerId || matches.some((record) => record.signerId !== signerId)) throw new Error("Wallet has conflicting Ed25519 material activations");
-		return matches[0] ?? null;
+            AND json_extract(record_json, '\$.activeYaoCapability.admissionRequest.scope.material_activation.activation_id') = ?
+          LIMIT 4`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, walletId, input.materialActivation.activation_id).all()).results || [], walletId, input.materialActivation);
 	}
 	async getEd25519SignerBySlot(input) {
 		await this.ensureSchema();
@@ -711,6 +714,6 @@ var D1WalletStore = class {
 	}
 };
 //#endregion
-export { D1WalletStore, WALLET_STORE_D1_SCHEMA_SQL, buildWalletEcdsaSignerRecord, ensureWalletStoreD1Schema, parseWalletEd25519SignerRecord, prepareD1WalletPutSignerStatement, prepareD1WalletPutSubjectStatement };
+export { D1WalletStore, ED25519_SIGNER_ACTIVATION_ID_PATH, WALLET_STORE_D1_SCHEMA_SQL, buildWalletEcdsaSignerRecord, ensureWalletStoreD1Schema, parseWalletEd25519SignerRecord, prepareD1WalletPutSignerStatement, prepareD1WalletPutSubjectStatement, selectWalletEd25519Signer };
 
 //# sourceMappingURL=d1WalletStore.js.map

package/dist/esm/core/deviceLinking/linkedDeviceBootstrap.js

@@ -0,0 +1,13 @@
+//#region src/core/deviceLinking/linkedDeviceBootstrap.ts
+function requireLinkedDeviceBootstrapRecord(result) {
+	if (result.ok) return result.record;
+	throw Object.assign(/* @__PURE__ */ new Error("Linked-device bootstrap authority rejected the request"), { code: result.code });
+}
+function linkedDeviceBootstrapFailure(error) {
+	if (error && typeof error === "object" && "code" in error && (error.code === "home_conflict" || error.code === "home_unavailable")) return error.code;
+	return null;
+}
+//#endregion
+export { linkedDeviceBootstrapFailure, requireLinkedDeviceBootstrapRecord };
+
+//# sourceMappingURL=linkedDeviceBootstrap.js.map

package/dist/esm/core/deviceLinking/linkedDeviceEmailOtpGrant.js

@@ -1,9 +1,9 @@
 import { parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseVerifiedEmailAddress, parseWalletAuthMethodId, parseWalletId, parseWebAuthnCredentialIdB64u } from "../../shared-ts/src/utils/domainIds.js";
+import { requireRecord } from "../../shared-ts/src/utils/validation.js";
+import { rejectUnknownFields } from "../../shared-ts/src/utils/exactRecord.js";
 import { base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
 import { sha256BytesUtf8 } from "../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u, sha256Utf8DigestB64u } from "../../shared-ts/src/utils/canonicalPrimitives.js";
-import { requireRecord } from "../../shared-ts/src/utils/validation.js";
-import { rejectUnknownFields } from "../../shared-ts/src/utils/exactRecord.js";
 import { parseUnixMs, requireParsed } from "../../shared-ts/src/passkey-custody/primitives.js";
 //#region src/core/deviceLinking/linkedDeviceEmailOtpGrant.ts
 /**

package/dist/esm/core/deviceLinking/linkedDeviceManagement.js

@@ -1,6 +1,6 @@
 import { parseLinkedDeviceId, parseVerifiedEmailAddress, parseWalletAuthorityId } from "../../shared-ts/src/utils/domainIds.js";
-import { base64UrlDecode, base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
 import { buildDelegatedWalletAuthorityV1, buildFullOwnerPermissionsV1, hasDelegatedWalletPermissionV1, sameDelegatedWalletAuthorityV1 } from "../../shared-ts/src/authorization/delegatedAuthority.js";
+import { base64UrlDecode, base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
 //#region src/core/deviceLinking/linkedDeviceManagement.ts
 const MAX_LINKED_DEVICE_LIST_LIMIT_V1 = 50;
 var LinkedDeviceListCursorError = class extends Error {

package/dist/esm/core/deviceLinking/linkedDeviceSession.js

@@ -2,6 +2,7 @@ import { parseLinkDeviceSessionId, parseWalletAuthorityId } from "../../shared-t
 import { parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1 } from "../../shared-ts/src/device-linking/sourceContribution.js";
 import { parseLinkedDeviceApprovalV1 } from "../../shared-ts/src/device-linking/parsers.js";
 import { computeLinkedDeviceApprovalDigestV1, computeLinkedDeviceSessionClaimDigestV1 } from "../../shared-ts/src/device-linking/digests.js";
+import { linkedDeviceBootstrapFailure } from "./linkedDeviceBootstrap.js";
 import { activeStateV1, approvalTranscriptMatchesDigest, authorityPendingStateV1, awaitingSourceContributionDeadlineMsV1, awaitingSourceContributionStateV1, awaitingTargetDeadlineMsV1, awaitingTargetFactorStateV1, buildUnclaimedSessionRecordV1, claimTranscriptMatchesDigest, claimedStateV1, conflictResult, integrityResult, invalidStateResult, isPrecommitState, linkedDeviceEmailOtpChallengesEqualV1, linkedDevicePrecommitFailuresEqualV1, linkedDeviceQrPayloadsEqualV1, parseEmailOtpChallengeV1, parseId, parseQrLinkedDeviceSessionPayloadV1, provisioningStateV1, replaceSessionRecordV1, requireDigest, requireTimestamp, sessionExpiryMsV1, sourceContributionTranscriptMatchesDigest } from "./linkedDeviceSessionRecord.js";
 import { validateApprovalMatchesSession, validateLinkedDeviceRequestedAuthorityV1, validateSourceContributionApprovalMatchesSession, validateSourceContributionPreparationMatchesApproval } from "./linkedDeviceSessionApproval.js";
 //#region src/core/deviceLinking/linkedDeviceSession.ts
@@ -20,7 +21,7 @@ var LinkedDeviceSessionServiceV1 = class {
 			};
 			return await this.store.createUnclaimedSessionV1(buildUnclaimedSessionRecordV1(payload, nowMs));
 		} catch (error) {
-			return invalidInputResult(error);
+			return sessionFailureResult(error);
 		}
 	}
 	async claimSessionV1(input) {
@@ -68,7 +69,7 @@ var LinkedDeviceSessionServiceV1 = class {
 				nowMs
 			});
 		} catch (error) {
-			return invalidInputResult(error);
+			return sessionFailureResult(error);
 		}
 	}
 	async recordOwnerApprovalV1(input) {
@@ -120,7 +121,7 @@ var LinkedDeviceSessionServiceV1 = class {
 				nowMs
 			});
 		} catch (error) {
-			return invalidInputResult(error);
+			return sessionFailureResult(error);
 		}
 	}
 	async recordTargetCredentialV1(input) {
@@ -150,7 +151,7 @@ var LinkedDeviceSessionServiceV1 = class {
 				nowMs
 			});
 		} catch (error) {
-			return invalidInputResult(error);
+			return sessionFailureResult(error);
 		}
 	}
 	async recordSourceContributionV1(input) {
@@ -204,7 +205,7 @@ var LinkedDeviceSessionServiceV1 = class {
 				nowMs
 			});
 		} catch (error) {
-			return invalidInputResult(error);
+			return sessionFailureResult(error);
 		}
 	}
 	async recordEmailOtpChallengeStateV1(input) {
@@ -233,7 +234,7 @@ var LinkedDeviceSessionServiceV1 = class {
 				nowMs
 			});
 		} catch (error) {
-			return invalidInputResult(error);
+			return sessionFailureResult(error);
 		}
 	}
 	async markAuthorityPendingLocalInstallV1(input) {
@@ -261,7 +262,7 @@ var LinkedDeviceSessionServiceV1 = class {
 				nowMs
 			});
 		} catch (error) {
-			return invalidInputResult(error);
+			return sessionFailureResult(error);
 		}
 	}
 	async activateSessionV1(input) {
@@ -294,7 +295,7 @@ var LinkedDeviceSessionServiceV1 = class {
 				nowMs
 			});
 		} catch (error) {
-			return invalidInputResult(error);
+			return sessionFailureResult(error);
 		}
 	}
 	async failBeforeCommitV1(input) {
@@ -322,7 +323,7 @@ var LinkedDeviceSessionServiceV1 = class {
 				nowMs
 			});
 		} catch (error) {
-			return invalidInputResult(error);
+			return sessionFailureResult(error);
 		}
 	}
 	async cancelSessionV1(input) {
@@ -349,7 +350,7 @@ var LinkedDeviceSessionServiceV1 = class {
 				nowMs
 			});
 		} catch (error) {
-			return invalidInputResult(error);
+			return sessionFailureResult(error);
 		}
 	}
 	async expireSessionV1(input) {
@@ -380,7 +381,7 @@ var LinkedDeviceSessionServiceV1 = class {
 				nowMs
 			});
 		} catch (error) {
-			return invalidInputResult(error);
+			return sessionFailureResult(error);
 		}
 	}
 	async deleteActiveSessionV1(input) {
@@ -404,7 +405,7 @@ var LinkedDeviceSessionServiceV1 = class {
 				nowMs
 			});
 		} catch (error) {
-			return invalidInputResult(error);
+			return sessionFailureResult(error);
 		}
 	}
 	async getSessionV1(input) {
@@ -417,7 +418,7 @@ var LinkedDeviceSessionServiceV1 = class {
 			expectedRevision: existing.revision,
 			nowMs: normalized.nowMs
 		});
-		return "record" in expired ? expired.record : existing;
+		return "record" in expired && expired.record !== void 0 ? expired.record : existing;
 	}
 	async listSessionsForWalletV1(input) {
 		const page = await this.store.listSessionsForWalletV1({
@@ -511,7 +512,12 @@ function normalizeSessionReadInput(input) {
 		nowMs: requireTimestamp(input.nowMs, "nowMs")
 	};
 }
-function invalidInputResult(error) {
+function sessionFailureResult(error) {
+	const failure = linkedDeviceBootstrapFailure(error);
+	if (failure) return {
+		outcome: failure,
+		message: "Linked-device bootstrap authority is unavailable or conflicting"
+	};
 	return {
 		outcome: "invalid_input",
 		message: error instanceof Error ? error.message : String(error || "invalid linked-device input")

package/dist/esm/core/deviceLinking/linkedDeviceSessionRecord.js

@@ -1,9 +1,9 @@
 import { hasWhitespaceOrControlCharacters, parseLinkDeviceSessionId, parseVerifiedEmailAddress, parseWalletAuthMethodId, parseWalletAuthorityId } from "../../shared-ts/src/utils/domainIds.js";
 import { parseDeviceId } from "../../shared-ts/src/authorization/capabilityKinds.js";
-import { parseDigestB64u } from "../../shared-ts/src/utils/canonicalPrimitives.js";
-import { assertNeverLinkSessionStateV1 } from "../../shared-ts/src/device-linking/contracts.js";
 import { requireRecordCopy } from "../../shared-ts/src/utils/validation.js";
 import { sameDelegatedWalletAuthorityV1 } from "../../shared-ts/src/authorization/delegatedAuthority.js";
+import { parseDigestB64u } from "../../shared-ts/src/utils/canonicalPrimitives.js";
+import { assertNeverLinkSessionStateV1 } from "../../shared-ts/src/device-linking/contracts.js";
 import { parseExactAdministeredSignerManifestV1 } from "../../shared-ts/src/device-linking/delegatedActivationPlan.js";
 import { parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1 } from "../../shared-ts/src/device-linking/sourceContribution.js";
 import { parseLinkSessionStateV1, parseLinkedDeviceApprovalV1, parseLinkedDeviceSessionClaimV1, parseQrLinkedDeviceSessionPayloadV5 } from "../../shared-ts/src/device-linking/parsers.js";

package/dist/esm/core/deviceLinking/requestProof.js

@@ -23,22 +23,25 @@ var LinkedDeviceRequestProofVerifierV1 = class {
 				code: "invalid",
 				message: "device request proof signature is invalid"
 			};
-			if ((await this.nonceStore.consumeRequestProofNonceV1({
+			const consumed = await this.nonceStore.consumeRequestProofNonceV1({
 				linkSessionId: input.proof.linkSessionId,
 				requestNonceB64u: input.proof.requestNonceB64u,
 				proofDigestB64u,
 				issuedAtMs: input.proof.issuedAtMs,
 				expiresAtMs: input.proof.expiresAtMs,
 				consumedAtMs: input.nowMs
-			})).outcome === "already_used") return {
+			});
+			if (consumed.outcome === "unavailable") return {
+				kind: "denied",
+				code: "unavailable",
+				message: "Device request proof authority is unavailable"
+			};
+			if (consumed.outcome === "already_used") return {
 				kind: "denied",
 				code: "replayed",
 				message: "device request proof was already used"
 			};
-			return {
-				kind: "authorized",
-				proofDigestB64u
-			};
+			return { kind: "authorized" };
 		} catch (error) {
 			const message = errorMessage(error);
 			return {

package/dist/esm/core/emailOtpD1Statements.js

@@ -39,20 +39,7 @@ function challengeValues(record) {
 /** Statements on `email_otp_challenges`. */
 const emailOtpChallengeRows = {
 	insert: (prepare, record) => prepare(INSERT_CHALLENGE_SQL, challengeValues(record)),
-	upsert: (prepare, record) => prepare(`${INSERT_CHALLENGE_SQL}
-      ON CONFLICT (namespace, org_id, project_id, env_id, challenge_id)
-      DO UPDATE SET
-        challenge_subject_id = EXCLUDED.challenge_subject_id,
-        wallet_id = EXCLUDED.wallet_id,
-        record_org_id = EXCLUDED.record_org_id,
-        otp_channel = EXCLUDED.otp_channel,
-        owner_proof_binding_digest = EXCLUDED.owner_proof_binding_digest,
-        action = EXCLUDED.action,
-        operation = EXCLUDED.operation,
-        otp_code = EXCLUDED.otp_code,
-        record_json = EXCLUDED.record_json,
-        created_at_ms = EXCLUDED.created_at_ms,
-        expires_at_ms = EXCLUDED.expires_at_ms`, challengeValues(record)),
+	insertIfAbsent: (prepare, record) => prepare(`${INSERT_CHALLENGE_SQL} ON CONFLICT(namespace, org_id, project_id, env_id, challenge_id) DO NOTHING`, challengeValues(record)),
 	delete: (prepare, challengeId) => prepare(`DELETE FROM email_otp_challenges
         WHERE namespace = ?
           AND org_id = ?
@@ -92,38 +79,13 @@ function grantValues(record) {
 /** Statements on `email_otp_grants`. */
 const emailOtpGrantRows = {
 	insert: (prepare, record) => prepare(INSERT_GRANT_SQL, grantValues(record)),
-	upsert: (prepare, record) => prepare(`${INSERT_GRANT_SQL}
-      ON CONFLICT (namespace, org_id, project_id, env_id, grant_token)
-      DO UPDATE SET
-        user_id = EXCLUDED.user_id,
-        wallet_id = EXCLUDED.wallet_id,
-        record_org_id = EXCLUDED.record_org_id,
-        challenge_id = EXCLUDED.challenge_id,
-        action = EXCLUDED.action,
-        record_json = EXCLUDED.record_json,
-        issued_at_ms = EXCLUDED.issued_at_ms,
-        expires_at_ms = EXCLUDED.expires_at_ms`, grantValues(record)),
-	select: (prepare, grantToken) => prepare(`SELECT record_json, expires_at_ms
-         FROM email_otp_grants
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND grant_token = ?
-        LIMIT 1`, [grantToken]),
 	consume: (prepare, grantToken) => prepare(`DELETE FROM email_otp_grants
         WHERE namespace = ?
           AND org_id = ?
           AND project_id = ?
           AND env_id = ?
           AND grant_token = ?
-      RETURNING record_json, expires_at_ms`, [grantToken]),
-	delete: (prepare, grantToken) => prepare(`DELETE FROM email_otp_grants
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND grant_token = ?`, [grantToken])
+      RETURNING record_json, expires_at_ms`, [grantToken])
 };
 const INSERT_WALLET_ENROLLMENT_SQL = `INSERT INTO email_otp_wallet_enrollments (
         namespace,
@@ -235,15 +197,6 @@ function unlockChallengeValues(record) {
 /** Statements on `email_otp_unlock_challenges`. */
 const emailOtpUnlockChallengeRows = {
 	insert: (prepare, record) => prepare(INSERT_UNLOCK_CHALLENGE_SQL, unlockChallengeValues(record)),
-	upsert: (prepare, record) => prepare(`${INSERT_UNLOCK_CHALLENGE_SQL}
-      ON CONFLICT (namespace, org_id, project_id, env_id, challenge_id)
-      DO UPDATE SET
-        wallet_id = EXCLUDED.wallet_id,
-        user_id = EXCLUDED.user_id,
-        record_org_id = EXCLUDED.record_org_id,
-        record_json = EXCLUDED.record_json,
-        created_at_ms = EXCLUDED.created_at_ms,
-        expires_at_ms = EXCLUDED.expires_at_ms`, unlockChallengeValues(record)),
 	consume: (prepare, challengeId) => prepare(`DELETE FROM email_otp_unlock_challenges
         WHERE namespace = ?
           AND org_id = ?
@@ -269,53 +222,95 @@ const PENDING_ATTEMPTS_SQL = `SELECT record_json, expires_at_ms, updated_at_ms,
           AND expires_at_ms > ?`;
 /** Statements on `email_otp_registration_attempts`. */
 const emailOtpRegistrationAttemptRows = {
-	upsert: (prepare, record) => prepare(`INSERT INTO email_otp_registration_attempts (
-        namespace,
-        org_id,
-        project_id,
-        env_id,
-        attempt_id,
-        provider_subject,
-        email,
-        wallet_id,
-        state,
-        owner_proof_binding_digest,
-        runtime_org_id,
-        runtime_policy_key,
-        offer_wallet_ids_json,
-        record_json,
-        created_at_ms,
-        updated_at_ms,
-        expires_at_ms
+	insertPendingIfAbsent: (prepare, record) => prepare(`WITH candidate (
+        namespace, org_id, project_id, env_id, attempt_id, provider_subject, email,
+        wallet_id, state, owner_proof_binding_digest, runtime_org_id, runtime_policy_key,
+        offer_wallet_ids_json, record_json, created_at_ms, updated_at_ms, expires_at_ms
+      ) AS (VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?))
+      INSERT INTO email_otp_registration_attempts (
+        namespace, org_id, project_id, env_id, attempt_id, provider_subject, email,
+        wallet_id, state, owner_proof_binding_digest, runtime_org_id, runtime_policy_key,
+        offer_wallet_ids_json, record_json, created_at_ms, updated_at_ms, expires_at_ms
       )
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT (namespace, org_id, project_id, env_id, attempt_id)
-      DO UPDATE SET
-        provider_subject = EXCLUDED.provider_subject,
-        email = EXCLUDED.email,
-        wallet_id = EXCLUDED.wallet_id,
-        state = EXCLUDED.state,
-        owner_proof_binding_digest = EXCLUDED.owner_proof_binding_digest,
-        runtime_org_id = EXCLUDED.runtime_org_id,
-        runtime_policy_key = EXCLUDED.runtime_policy_key,
-        offer_wallet_ids_json = EXCLUDED.offer_wallet_ids_json,
-        record_json = EXCLUDED.record_json,
-        created_at_ms = EXCLUDED.created_at_ms,
-        updated_at_ms = EXCLUDED.updated_at_ms,
-        expires_at_ms = EXCLUDED.expires_at_ms`, [
-		record.attemptId,
-		record.providerSubject,
-		record.email,
+      SELECT * FROM candidate
+      WHERE NOT EXISTS (
+        SELECT 1 FROM email_otp_registration_attempts existing
+        WHERE existing.namespace = candidate.namespace
+          AND existing.org_id = candidate.org_id
+          AND existing.project_id = candidate.project_id
+          AND existing.env_id = candidate.env_id
+          AND existing.provider_subject = candidate.provider_subject
+          AND existing.email = candidate.email
+          AND existing.owner_proof_binding_digest = candidate.owner_proof_binding_digest
+          AND existing.runtime_org_id = candidate.runtime_org_id
+          AND existing.runtime_policy_key = candidate.runtime_policy_key
+          AND existing.state IN ('started', 'key_finalized')
+          AND (existing.expires_at_ms > candidate.created_at_ms OR existing.selection_digest IS NOT NULL)
+      )`, registrationAttemptValues(record)),
+	claimCandidate: (prepare, input) => prepare(`WITH scope AS (SELECT ? AS namespace, ? AS org_id, ? AS project_id, ? AS env_id)
+    UPDATE email_otp_registration_attempts
+    SET wallet_id = ?, selection_digest = ?,
+      record_json = json_set(record_json,
+        '$.walletId', ?, '$.selectedCandidateId', ?,
+        '$.collisionCounter', (
+          SELECT json_extract(value, '$.collisionCounter')
+          FROM json_each(record_json, '$.offerCandidates')
+          WHERE json_extract(value, '$.candidateId') = ?
+        ), '$.updatedAtMs', MAX(updated_at_ms, ?)),
+      updated_at_ms = MAX(updated_at_ms, ?)
+    WHERE namespace = (SELECT namespace FROM scope)
+      AND org_id = (SELECT org_id FROM scope)
+      AND project_id = (SELECT project_id FROM scope)
+      AND env_id = (SELECT env_id FROM scope)
+      AND attempt_id = ? AND state IN ('started', 'key_finalized') AND expires_at_ms > ?
+      AND EXISTS (
+        SELECT 1 FROM json_each(record_json, '$.offerCandidates')
+        WHERE json_extract(value, '$.candidateId') = ? AND json_extract(value, '$.walletId') = ?
+      )
+      AND (selection_digest IS NULL OR (
+        selection_digest = ? AND wallet_id = ? AND json_extract(record_json, '$.selectedCandidateId') = ?
+      ))`, [
+		input.walletId,
+		input.intentDigest,
+		input.walletId,
+		input.candidateId,
+		input.candidateId,
+		input.nowMs,
+		input.nowMs,
+		input.attemptId,
+		input.nowMs,
+		input.candidateId,
+		input.walletId,
+		input.intentDigest,
+		input.walletId,
+		input.candidateId
+	]),
+	updatePending: (prepare, record) => prepare(`WITH scope AS (SELECT ? AS namespace, ? AS org_id, ? AS project_id, ? AS env_id)
+      UPDATE email_otp_registration_attempts
+      SET wallet_id = ?, state = ?, record_json = ?, updated_at_ms = ?
+      WHERE namespace = (SELECT namespace FROM scope)
+        AND org_id = (SELECT org_id FROM scope)
+        AND project_id = (SELECT project_id FROM scope)
+        AND env_id = (SELECT env_id FROM scope)
+        AND attempt_id = ?
+        AND state IN ('started', 'key_finalized')
+        AND wallet_id = ?
+        AND json_extract(record_json, '$.selectedCandidateId') = ?
+        AND NOT (state = 'key_finalized' AND ? = 'started')
+        AND (? NOT IN ('abandoned', 'expired') OR selection_digest IS NULL)
+        AND ? <> 'active'
+        AND updated_at_ms <= ?`, [
 		record.walletId,
 		record.state,
-		record.ownerProofBindingDigest,
-		record.runtimePolicyScope?.orgId || "",
-		runtimePolicyScopeKey(record.runtimePolicyScope),
-		offerWalletIdsJson(record.offerCandidates),
 		JSON.stringify(record),
-		record.createdAtMs,
 		record.updatedAtMs,
-		record.expiresAtMs
+		record.attemptId,
+		record.walletId,
+		record.selectedCandidateId,
+		record.state,
+		record.state,
+		record.state,
+		record.updatedAtMs
 	]),
 	select: (prepare, attemptId) => prepare(`SELECT record_json, expires_at_ms, updated_at_ms, attempt_id
          FROM email_otp_registration_attempts
@@ -348,6 +343,7 @@ const emailOtpRegistrationAttemptRows = {
           AND org_id = ?
           AND project_id = ?
           AND env_id = ?
+          AND state <> 'active' AND selection_digest IS NULL
           AND (expires_at_ms <= ? OR state = 'expired')`, [nowMs]),
 	selectLiveForWallet: (prepare, walletId, nowMs) => prepare(`SELECT 1 AS found
          FROM email_otp_registration_attempts
@@ -356,7 +352,7 @@ const emailOtpRegistrationAttemptRows = {
           AND project_id = ?
           AND env_id = ?
           AND state IN ('started', 'key_finalized')
-          AND expires_at_ms > ?
+          AND (expires_at_ms > ? OR selection_digest IS NOT NULL)
           AND (
             wallet_id = ?
             OR EXISTS (
@@ -370,13 +366,31 @@ const emailOtpRegistrationAttemptRows = {
 		walletId,
 		walletId
 	]),
-	delete: (prepare, attemptId) => prepare(`DELETE FROM email_otp_registration_attempts
+	deleteUnclaimed: (prepare, attemptId) => prepare(`DELETE FROM email_otp_registration_attempts
         WHERE namespace = ?
           AND org_id = ?
           AND project_id = ?
           AND env_id = ?
-          AND attempt_id = ?`, [attemptId])
+          AND attempt_id = ?
+          AND selection_digest IS NULL`, [attemptId])
 };
+function registrationAttemptValues(record) {
+	return [
+		record.attemptId,
+		record.providerSubject,
+		record.email,
+		record.walletId,
+		record.state,
+		record.ownerProofBindingDigest,
+		record.runtimePolicyScope?.orgId || "",
+		runtimePolicyScopeKey(record.runtimePolicyScope),
+		offerWalletIdsJson(record.offerCandidates),
+		JSON.stringify(record),
+		record.createdAtMs,
+		record.updatedAtMs,
+		record.expiresAtMs
+	];
+}
 //#endregion
 export { emailOtpAuthStateRows, emailOtpChallengeRows, emailOtpGrantRows, emailOtpRegistrationAttemptRows, emailOtpUnlockChallengeRows, emailOtpWalletEnrollmentRows };
 

package/dist/esm/core/keyMaterialBrands.js

@@ -1,12 +1,2 @@
-import { formatEcdsaClientVerifyingShareB64uForWire, formatEcdsaDerivationKeyVersionForWire, formatEcdsaKeyHandleForWire, formatEcdsaRelayerKeyIdForWire, formatEcdsaThresholdKeyIdForWire, formatEd25519RelayerKeyIdForWire, formatSigningSessionSealKeyVersionForWire, parseEcdsaClientVerifyingShareB64u, parseEcdsaDerivationKeyVersion, parseEcdsaKeyHandle, parseEcdsaRelayerKeyId, parseEd25519RelayerKeyId, parseNonEmptyBrand, parseSigningSessionSealKeyVersion } from "../shared-ts/src/threshold/keyMaterialBrands.js";
-//#region src/core/keyMaterialBrands.ts
-function parseEcdsaThresholdKeyId(value) {
-	return parseNonEmptyBrand(value, "ECDSA threshold key id");
-}
-function formatEd25519ClientVerifyingShareB64uForWire(value) {
-	return value;
-}
-//#endregion
-export { formatEcdsaClientVerifyingShareB64uForWire, formatEcdsaDerivationKeyVersionForWire, formatEcdsaKeyHandleForWire, formatEcdsaRelayerKeyIdForWire, formatEcdsaThresholdKeyIdForWire, formatEd25519ClientVerifyingShareB64uForWire, formatEd25519RelayerKeyIdForWire, formatSigningSessionSealKeyVersionForWire, parseEcdsaClientVerifyingShareB64u, parseEcdsaDerivationKeyVersion, parseEcdsaKeyHandle, parseEcdsaRelayerKeyId, parseEcdsaThresholdKeyId, parseEd25519RelayerKeyId, parseSigningSessionSealKeyVersion };
-
-//# sourceMappingURL=keyMaterialBrands.js.map
+import { formatEcdsaKeyHandleForWire, formatSigningSessionSealKeyVersionForWire, parseEcdsaClientVerifyingShareB64u, parseEcdsaKeyHandle, parseEcdsaRelayerKeyId, parseSigningSessionSealKeyVersion } from "../shared-ts/src/threshold/keyMaterialBrands.js";
+export { formatEcdsaKeyHandleForWire, formatSigningSessionSealKeyVersionForWire, parseEcdsaClientVerifyingShareB64u, parseEcdsaKeyHandle, parseEcdsaRelayerKeyId, parseSigningSessionSealKeyVersion };