@seams/wallet-server 0.7.3 → 0.9.0

package/dist/esm/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoCapabilityPersistence.js

@@ -13,6 +13,7 @@ const CAPABILITY_REPLACEMENT_SCHEMA_SQL = `
     org_id TEXT NOT NULL,
     project_id TEXT NOT NULL,
     env_id TEXT NOT NULL,
+    wallet_id TEXT NOT NULL CHECK (length(wallet_id) > 0),
     operation_id TEXT NOT NULL,
     operation_fingerprint TEXT NOT NULL,
     previous_capability_binding_json TEXT NOT NULL,
@@ -76,6 +77,10 @@ var CloudflareD1RouterAbEd25519YaoCapabilityPersistence = class {
 	async prepareActiveCapabilityReplacement(input) {
 		const operation = validateReplacementOperation(input.operation);
 		if (!operation.ok) return operation.failure;
+		const application = activeCapabilityApplication(input.next);
+		const walletId = parseWalletId(application.wallet_id);
+		if (!walletId.ok) return persistenceFailure("invalid_wallet", "promoted Yao capability wallet ID is invalid");
+		if (activeCapabilityApplication(input.previous).wallet_id !== walletId.value) return persistenceFailure("identity_mismatch", "capability replacement crosses wallet ownership");
 		await this.ensureSchema();
 		const receiptMatch = matchReceipt(await this.readReceipt(operation.value.operationId), operation.value, input);
 		if (receiptMatch === "match") return {
@@ -83,9 +88,6 @@ var CloudflareD1RouterAbEd25519YaoCapabilityPersistence = class {
 			disposition: "exact_retry"
 		};
 		if (receiptMatch === "conflict") return persistenceFailure("operation_conflict", "capability replacement operation belongs to a different activation");
-		const application = activeCapabilityApplication(input.next);
-		const walletId = parseWalletId(application.wallet_id);
-		if (!walletId.ok) return persistenceFailure("invalid_wallet", "promoted Yao capability wallet ID is invalid");
 		const signer = await this.walletStore.getEd25519SignerBySlot({
 			walletId: walletId.value,
 			signerSlot: application.key_creation_signer_slot
@@ -127,13 +129,14 @@ var CloudflareD1RouterAbEd25519YaoCapabilityPersistence = class {
             org_id,
             project_id,
             env_id,
+            wallet_id,
             operation_id,
             operation_fingerprint,
             previous_capability_binding_json,
             next_capability_binding_json,
             created_at_ms
           )
-          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, operation.value.operationId, operation.value.operationFingerprint, previousBindingJson, nextBindingJson, now));
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, walletId.value, operation.value.operationId, operation.value.operationFingerprint, previousBindingJson, nextBindingJson, now));
 		for (const authorityReplacement of authorityReplacements) {
 			statements.push(this.prepareAuthorityReplacementStatement(authorityReplacement));
 			statements.push(this.database.prepare(D1_BATCH_CAS_GUARD_SQL));
@@ -243,7 +246,7 @@ var CloudflareD1RouterAbEd25519YaoCapabilityPersistence = class {
             AND retired_at_ms IS NULL`).bind(String(next.authorityDigestB64u), JSON.stringify(next.capabilitySubjects), JSON.stringify(next), this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, String(next.authorizationId), String(next.authorityId), String(input.previous.authorityDigestB64u), input.previous.authorityRevocationEpoch);
 	}
 	async readReceipt(operationId) {
-		return await this.database.prepare(`SELECT operation_fingerprint,
+		return await this.database.prepare(`SELECT wallet_id, operation_fingerprint,
                 previous_capability_binding_json,
                 next_capability_binding_json
            FROM ${ROUTER_AB_ED25519_YAO_CAPABILITY_REPLACEMENT_TABLE_V1}
@@ -274,7 +277,7 @@ function validateReplacementOperation(operation) {
 }
 function matchReceipt(receipt, operation, input) {
 	if (!receipt) return "missing";
-	return receipt.operation_fingerprint === operation.operationFingerprint && receipt.previous_capability_binding_json === JSON.stringify(input.previous.activeCapabilityBinding) && receipt.next_capability_binding_json === JSON.stringify(input.next.activeCapabilityBinding) ? "match" : "conflict";
+	return receipt.wallet_id === activeCapabilityApplication(input.next).wallet_id && receipt.operation_fingerprint === operation.operationFingerprint && receipt.previous_capability_binding_json === JSON.stringify(input.previous.activeCapabilityBinding) && receipt.next_capability_binding_json === JSON.stringify(input.next.activeCapabilityBinding) ? "match" : "conflict";
 }
 //#endregion
 export { CloudflareD1RouterAbEd25519YaoCapabilityPersistence, ROUTER_AB_ED25519_YAO_CAPABILITY_REPLACEMENT_TABLE_V1 };

package/dist/esm/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoLifecycleDecisionStore.js

@@ -16,16 +16,25 @@ var CloudflareD1Ed25519YaoLifecycleDecisionStoreV1 = class {
 		};
 	}
 	async read(lifecycleId) {
-		const row = await this.database.prepare(`SELECT decision_kind, decision_id, wallet_id
+		const result = await this.prepareRead(lifecycleId).all();
+		return this.parseRead(lifecycleId, result);
+	}
+	prepareRead(lifecycleId) {
+		return this.database.prepare(`SELECT decision_kind, decision_id, wallet_id
            FROM yao_lifecycle_decisions
           WHERE namespace = ?1
             AND org_id = ?2
             AND project_id = ?3
             AND env_id = ?4
-            AND lifecycle_id = ?5`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, lifecycleId).first();
+            AND lifecycle_id = ?5`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, lifecycleId);
+	}
+	parseRead(lifecycleId, result) {
+		if (!result.success) throw new Error("Ed25519 Yao lifecycle decision read failed");
+		const row = result.results?.[0];
 		if (!row) return null;
 		const kind = parseDecisionKind(row.decision_kind);
 		if (!kind) throw new Error("Stored Ed25519 Yao lifecycle decision has an unknown kind");
+		if (typeof row.decision_id !== "string" || typeof row.wallet_id !== "string") throw new Error("Stored Ed25519 Yao lifecycle decision has invalid identities");
 		return {
 			lifecycleId,
 			kind,

package/dist/esm/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoProductRegistrationPartitionedStateStore.js

@@ -1,21 +1,111 @@
+import { ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordJsonV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore.js";
 import { createCloudflareD1VersionedJsonRecordStore } from "../versionedJson/d1VersionedJsonRecordStore.js";
-import { createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordJsonV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore.js";
+import { D1WalletCeremonyActivity, ceremonySettled } from "./d1WalletCeremonyActivity.js";
+import { collectChangedStateWallets, lifecycleWriteFenceStatements } from "./d1Ed25519YaoStateWriteFence.js";
 //#region src/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoProductRegistrationPartitionedStateStore.ts
 function createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1(options) {
-	const records = createCloudflareD1VersionedJsonRecordStore({
+	return createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1(new D1LifecycleRecords(options, createLifecycleRecords(options)));
+}
+var D1LifecycleRecords = class {
+	constructor(options, records) {
+		this.options = options;
+		this.records = records;
+		this.observed = /* @__PURE__ */ new Map();
+	}
+	async readMany(keys) {
+		const entries = await this.records.readMany(keys);
+		this.observed.clear();
+		for (const entry of entries) if (entry.result.kind === "present") this.observed.set(entry.key, {
+			version: entry.result.version,
+			value: structuredClone(entry.result.value)
+		});
+		return entries;
+	}
+	async putMany(mutations, companion) {
+		const keys = [];
+		const wallets = /* @__PURE__ */ new Set();
+		const previousValues = /* @__PURE__ */ new Map();
+		for (const mutation of mutations) {
+			if (mutation.expectedVersion === null) continue;
+			const observed = this.observed.get(mutation.key);
+			if (observed?.version === mutation.expectedVersion) previousValues.set(mutation.key, observed.value);
+			else keys.push(mutation.key);
+		}
+		this.observed.clear();
+		const previous = keys.length === 0 ? [] : await this.records.readMany(keys);
+		for (const entry of previous) if (entry.result.kind === "present") previousValues.set(entry.key, entry.result.value);
+		const activity = new D1WalletCeremonyActivity(this.options.database, this.options.scope);
+		const projections = [];
+		for (const mutation of mutations) {
+			const previousValue = previousValues.get(mutation.key);
+			const before = previousValue === void 0 ? null : readPartition(previousValue);
+			const after = readPartition(mutation.value);
+			const changedWallets = /* @__PURE__ */ new Set();
+			collectChangedStateWallets(before, after, changedWallets);
+			for (const walletId of changedWallets) wallets.add(walletId);
+			if (after.kind === "router_ab_ed25519_yao_product_registration_ceremony_record_v1") {
+				if (changedWallets.size > 1) throw new Error("Ceremony wallet owner changed");
+				for (const walletId of changedWallets) projections.push(activity.project(this.records.storageKey(mutation.key), walletId, ceremonySettled(after.value)));
+			}
+		}
+		return this.records.putManyWithAdditionalStatements(mutations, [
+			...lifecycleWriteFenceStatements(this.options, wallets),
+			...projections,
+			...companion?.statements ?? []
+		], companion?.executeBatch);
+	}
+};
+function identityVersionedJsonObject(value) {
+	return value;
+}
+function readPartition(value) {
+	const record = parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1(value);
+	if (!record) throw new Error("Lifecycle mutation contains an invalid partition record");
+	return record;
+}
+async function evictWalletEd25519CapabilityCache(options, walletId) {
+	const records = createLifecycleRecords(options);
+	const key = ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1;
+	const current = await records.read(key);
+	if (current.kind !== "present") return;
+	const partition = readPartition(current.value);
+	if (partition.kind !== "router_ab_ed25519_yao_product_registration_shared_record_v1") throw new Error("Capability cache has an invalid partition kind");
+	const capabilities = new Map(partition.value.recoveryCapabilities);
+	const identities = new Map(partition.value.recoveryIdentityCapabilities);
+	const removed = /* @__PURE__ */ new Set();
+	for (const [capabilityKey, capability] of capabilities) {
+		if (capability.identity.applicationBinding.wallet_id !== walletId) continue;
+		if (capability.kind === "suspended") throw new Error("Relocation cleanup cannot evict an unsettled capability");
+		capabilities.delete(capabilityKey);
+		removed.add(capabilityKey);
+	}
+	if (removed.size === 0) return;
+	for (const [identity, capabilityKey] of identities) if (removed.has(capabilityKey)) identities.delete(identity);
+	const value = encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1({
+		kind: "router_ab_ed25519_yao_product_registration_shared_record_v1",
+		value: {
+			kind: partition.value.kind,
+			recoveryCapabilities: capabilities,
+			recoveryIdentityCapabilities: identities,
+			recoverySessions: partition.value.recoverySessions,
+			exportAuthorizationNonceOwners: partition.value.exportAuthorizationNonceOwners,
+			exportAuthorizationUncertainOwners: partition.value.exportAuthorizationUncertainOwners
+		}
+	});
+	if ((await records.putMany([{
+		key,
+		value,
+		expectedVersion: current.version
+	}])).kind !== "stored") throw new Error("Capability cache changed during cleanup");
+}
+function createLifecycleRecords(options) {
+	return createCloudflareD1VersionedJsonRecordStore({
 		...options,
 		encode: identityVersionedJsonObject,
 		parse: parseRouterAbEd25519YaoProductRegistrationPartitionRecordJsonV1
 	});
-	return createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1({
-		readMany: records.readMany.bind(records),
-		putMany: async (mutations, companion) => await records.putManyWithAdditionalStatements(mutations, companion?.statements ?? [])
-	});
-}
-function identityVersionedJsonObject(value) {
-	return value;
 }
 //#endregion
-export { createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1 };
+export { createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1, evictWalletEd25519CapabilityCache };
 
 //# sourceMappingURL=d1Ed25519YaoProductRegistrationPartitionedStateStore.js.map

package/dist/esm/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoStateWriteFence.js

@@ -0,0 +1,92 @@
+import { parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { parseRouterAbEd25519YaoRecoveryAdmissionRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
+//#region src/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoStateWriteFence.ts
+function collectChangedStateWallets(before, after, wallets) {
+	if (before && before.kind !== after.kind) throw new Error("Lifecycle partition kind changed");
+	if (after.kind === "router_ab_ed25519_yao_product_registration_ceremony_record_v1") {
+		collectCeremonyWallets(after, wallets);
+		if (before) collectCeremonyWallets(before, wallets);
+		return;
+	}
+	if (before?.kind === "router_ab_ed25519_yao_product_registration_ceremony_record_v1") throw new Error("Lifecycle partition kind changed");
+	collectChangedRecoveryCapabilities(before?.value ?? null, after.value, wallets);
+	const empty = /* @__PURE__ */ new Map();
+	collectChangedOwners(before?.value.exportAuthorizationNonceOwners ?? empty, after.value.exportAuthorizationNonceOwners, walletOwner, wallets);
+	collectChangedOwners(before?.value.exportAuthorizationUncertainOwners ?? empty, after.value.exportAuthorizationUncertainOwners, walletOwner, wallets);
+	collectChangedOwners(before?.value.recoverySessions ?? empty, after.value.recoverySessions, recoverySessionOwner, wallets);
+}
+function collectChangedRecoveryCapabilities(before, after, wallets) {
+	for (const [key, capability] of after.recoveryCapabilities) {
+		const previous = before?.recoveryCapabilities.get(key);
+		if (JSON.stringify(previous) === JSON.stringify(capability)) continue;
+		if (previous) wallets.add(walletOwner(previous.identity.applicationBinding.wallet_id));
+		wallets.add(walletOwner(capability.identity.applicationBinding.wallet_id));
+	}
+	for (const [key, capability] of before?.recoveryCapabilities ?? []) if (capability.kind === "suspended" && !after.recoveryCapabilities.has(key)) wallets.add(walletOwner(capability.identity.applicationBinding.wallet_id));
+	const identities = new Set([...before?.recoveryIdentityCapabilities.keys() ?? [], ...after.recoveryIdentityCapabilities.keys()]);
+	for (const identity of identities) {
+		const previousKey = before?.recoveryIdentityCapabilities.get(identity);
+		const nextKey = after.recoveryIdentityCapabilities.get(identity);
+		if (previousKey === nextKey) continue;
+		if (nextKey === void 0 && previousKey !== void 0 && !after.recoveryCapabilities.has(previousKey)) continue;
+		if (previousKey !== void 0) {
+			const previous = before?.recoveryCapabilities.get(previousKey);
+			if (!previous) throw new Error("Recovery identity index has no capability owner");
+			wallets.add(walletOwner(previous.identity.applicationBinding.wallet_id));
+		}
+		if (nextKey !== void 0) {
+			const next = after.recoveryCapabilities.get(nextKey);
+			if (!next) throw new Error("Recovery identity index has no capability owner");
+			wallets.add(walletOwner(next.identity.applicationBinding.wallet_id));
+		}
+	}
+}
+function walletOwner(value) {
+	const parsed = parseWalletId(value);
+	if (!parsed.ok) throw new Error("Lifecycle wallet owner is invalid");
+	return parsed.value;
+}
+function recoverySessionOwner(value) {
+	const parsed = parseRouterAbEd25519YaoRecoveryAdmissionRequestV1(JSON.parse(value));
+	if (!parsed.ok) throw new Error("Stored recovery session request is invalid");
+	return walletOwner(parsed.value.application_binding.wallet_id);
+}
+function collectChangedOwners(before, after, owner, wallets) {
+	for (const key of new Set([...before.keys(), ...after.keys()])) {
+		const oldValue = before.get(key);
+		const newValue = after.get(key);
+		if (oldValue === newValue) continue;
+		if (oldValue !== void 0) wallets.add(owner(oldValue));
+		if (newValue !== void 0) wallets.add(owner(newValue));
+	}
+}
+function collectCeremonyWallets(record, wallets) {
+	if (record.kind === "router_ab_ed25519_yao_product_registration_shared_record_v1") return;
+	const state = record.value;
+	const owners = /* @__PURE__ */ new Set();
+	for (const authority of state.authorization.authorities) owners.add(authority.admissionRequest.application_binding.wallet_id);
+	for (const registration of state.registration.states.values()) owners.add(registration.admissionRequest.application_binding.wallet_id);
+	for (const recovery of state.recovery.recoveries.values()) owners.add(recovery.context.authorization.walletId);
+	for (const exported of state.export.exports.values()) owners.add(exported.request.application_binding.wallet_id);
+	if (owners.size > 1 || owners.size === 0 && (state.registration.admissionClaims.size > 0 || state.registration.dispatchRoots.size > 0 || state.registration.lifecycleSessions.size > 0)) throw new Error("Ceremony mutation has no unique wallet owner");
+	for (const owner of owners) wallets.add(walletOwner(owner));
+}
+function lifecycleWriteFenceStatements(options, wallets) {
+	const statements = [];
+	for (const walletId of wallets) statements.push(options.database.prepare(`
+      INSERT INTO router_ab_yao_versioned_json_cas_guard (guard_id)
+      SELECT 1 WHERE EXISTS (
+        SELECT 1 FROM wallet_relocation_authorization_fences
+        WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+          AND wallet_id = ?5
+      ) OR EXISTS (
+        SELECT 1 FROM wallet_execution_generations
+        WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+          AND wallet_id = ?5 AND registration_completion = 'cancelled'
+      )`).bind(options.scope.namespace, options.scope.orgId, options.scope.projectId, options.scope.envId, walletId));
+	return statements;
+}
+//#endregion
+export { collectChangedStateWallets, lifecycleWriteFenceStatements };
+
+//# sourceMappingURL=d1Ed25519YaoStateWriteFence.js.map

package/dist/esm/router/cloudflare/d1/ed25519Yao/d1WalletCeremonyActivity.js

@@ -0,0 +1,77 @@
+import { prepareD1TenantStatement } from "../../../../core/d1TenantStore.js";
+//#region src/router/cloudflare/d1/ed25519Yao/d1WalletCeremonyActivity.ts
+var D1WalletCeremonyActivity = class {
+	constructor(database, scope) {
+		this.database = database;
+		this.scope = scope;
+	}
+	async hasPending(walletId) {
+		return await prepareD1TenantStatement(this.database, this.scope, `
+      SELECT 1 AS pending FROM wallet_ceremony_activity
+      WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+        AND wallet_id = ?5 AND settled = 0 LIMIT 1`, [walletId]).first() !== null;
+	}
+	project(recordKey, walletId, settled) {
+		return prepareD1TenantStatement(this.database, this.scope, `
+      INSERT INTO wallet_ceremony_activity
+        (namespace, org_id, project_id, env_id, record_key, wallet_id, settled)
+      VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7)
+      ON CONFLICT (namespace, org_id, project_id, env_id, record_key)
+      DO UPDATE SET wallet_id = excluded.wallet_id, settled = excluded.settled`, [
+			recordKey,
+			walletId,
+			settled ? 1 : 0
+		]);
+	}
+};
+function ceremonySettled(ceremony) {
+	if (ceremony.registration.admissionClaims.size > 0) return false;
+	for (const registration of ceremony.registration.states.values()) if (!registrationSettled(registration)) return false;
+	for (const recovery of ceremony.recovery.recoveries.values()) if (!recoverySettled(recovery)) return false;
+	for (const exported of ceremony.export.exports.values()) if (!exportSettled(exported)) return false;
+	return true;
+}
+function registrationSettled(state) {
+	switch (state.kind) {
+		case "activated": return state.activationConsumerBinding !== null;
+		case "admitted": return true;
+		case "executing":
+		case "failed": return false;
+		default: return assertNever(state);
+	}
+}
+function recoverySettled(state) {
+	switch (state.kind) {
+		case "promoted":
+		case "superseded": return true;
+		case "admitting":
+		case "admission_failed":
+		case "admitted":
+		case "executing":
+		case "execution_interrupted":
+		case "execution_failed":
+		case "staged":
+		case "activating":
+		case "activation_failed": return false;
+		default: return assertNever(state);
+	}
+}
+function exportSettled(state) {
+	switch (state.kind) {
+		case "completed": return true;
+		case "authorized":
+		case "admitting":
+		case "admission_failed":
+		case "admitted":
+		case "executing":
+		case "execution_failed": return false;
+		default: return assertNever(state);
+	}
+}
+function assertNever(value) {
+	throw new Error(`Unknown ceremony state: ${String(value)}`);
+}
+//#endregion
+export { D1WalletCeremonyActivity, ceremonySettled };
+
+//# sourceMappingURL=d1WalletCeremonyActivity.js.map

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeIssuer.js

@@ -1,5 +1,4 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
@@ -22,6 +21,9 @@ var CloudflareD1EmailOtpChallengeIssuer = class {
 		this.emailOtpEnrollments = input.emailOtpEnrollments;
 		this.emailOtpRateLimits = input.emailOtpRateLimits;
 	}
+	challengeExpiresAt(nowMs) {
+		return nowMs + this.config.challengeTtlMs;
+	}
 	async create(input) {
 		try {
 			const userId = normalizeOptionalTrimmedString(input.userId);
@@ -62,8 +64,9 @@ var CloudflareD1EmailOtpChallengeIssuer = class {
 			}
 			if (!challengeEmail) return failure("recovery_email_missing", "Authenticated identity does not include a recovery email");
 			const nowMs = Date.now();
+			if (input.action === WALLET_EMAIL_OTP_ACTIONS.relocation && (!Number.isSafeInteger(input.expiresAtMs) || input.expiresAtMs <= nowMs || input.expiresAtMs > nowMs + this.config.challengeTtlMs)) return failure("invalid_body", "Relocation OTP expiry is invalid");
 			await this.emailOtpChallenges.pruneExpired(nowMs);
-			if (input.reuseActiveChallenge === true) {
+			if (input.reuseActiveChallenge === true && action !== WALLET_EMAIL_OTP_ACTIONS.relocation) {
 				const existing = await this.emailOtpChallenges.findLatestActive({
 					challengeSubjectId: userId,
 					walletId,
@@ -95,6 +98,7 @@ var CloudflareD1EmailOtpChallengeIssuer = class {
 				}
 			}
 			const rateLimit = await this.emailOtpRateLimits.consume({
+				kind: "wallet",
 				scope: "challenge",
 				action,
 				userId,
@@ -103,7 +107,7 @@ var CloudflareD1EmailOtpChallengeIssuer = class {
 				clientIp
 			});
 			if (!rateLimit.ok) return rateLimit;
-			await this.emailOtpChallenges.deleteActiveOverflow({
+			if (action !== WALLET_EMAIL_OTP_ACTIONS.relocation) await this.emailOtpChallenges.deleteActiveOverflow({
 				challengeSubjectId: userId,
 				walletId,
 				orgId,
@@ -113,10 +117,10 @@ var CloudflareD1EmailOtpChallengeIssuer = class {
 				nowMs,
 				maxActiveChallenges: this.config.maxActiveChallengesPerContext
 			});
-			const challengeId = secureRandomBase64Url(16, "email otp challenge ids");
+			const challengeId = action === WALLET_EMAIL_OTP_ACTIONS.relocation ? `relocation:${ownerProofBindingDigest}` : secureRandomBase64Url(16, "email otp challenge ids");
 			const otpCode = generateNumericOtp(this.config.codeLength);
-			const expiresAtMs = nowMs + this.config.challengeTtlMs;
-			const record = emailOtpChallengeRecord({
+			const expiresAtMs = input.action === WALLET_EMAIL_OTP_ACTIONS.relocation ? input.expiresAtMs : nowMs + this.config.challengeTtlMs;
+			let record = emailOtpChallengeRecord({
 				challengeId,
 				challengeSubjectId: userId,
 				walletId,
@@ -130,17 +134,18 @@ var CloudflareD1EmailOtpChallengeIssuer = class {
 				expiresAtMs,
 				maxAttempts: this.config.maxAttempts
 			});
-			await this.emailOtpChallenges.put(record);
+			if (action === WALLET_EMAIL_OTP_ACTIONS.relocation) record = await this.emailOtpChallenges.putIfAbsent(record);
+			else await this.emailOtpChallenges.put(record);
 			const delivery = await this.emailOtpDelivery.deliverEmailOtpCode(record, input.requestOrigin);
 			if (!delivery.ok) {
-				await this.emailOtpChallenges.delete(challengeId);
+				if (action !== WALLET_EMAIL_OTP_ACTIONS.relocation) await this.emailOtpChallenges.delete(challengeId);
 				return delivery;
 			}
 			return {
 				ok: true,
 				challenge: {
 					challengeId,
-					issuedAtMs: nowMs,
+					issuedAtMs: record.createdAtMs,
 					expiresAtMs,
 					challengeSubjectId: userId,
 					walletId,

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeService.js

@@ -1,5 +1,4 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeStore.js

@@ -1,7 +1,7 @@
 import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
 import { parseD1NonNegativeCount } from "../auth/d1RouterApiAuthBoundary.js";
-import { emailOtpChallengeRows, emailOtpUnlockChallengeRows } from "../../../../core/emailOtpD1Statements.js";
 import { emailOtpChallengeContextValues, emailOtpChallengeWithAttemptCount, parseEmailOtpChallengeRow, parseEmailOtpRegistrationVerificationReceiptV1, parseEmailOtpUnlockChallengeRow } from "./d1EmailOtpRecords.js";
+import { emailOtpChallengeRows, emailOtpUnlockChallengeRows } from "../../../../core/emailOtpD1Statements.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeStore.ts
 const REGISTRATION_VERIFICATION_RECEIPT_SCOPE = "email-otp-registration-verification-v1";
 const REGISTRATION_CEREMONY_CAS_GUARD_SQL = `INSERT INTO registration_ceremony_cas_guard (guard_id)
@@ -87,20 +87,26 @@ var CloudflareD1EmailOtpChallengeStore = class {
 		}
 		return deletedRecords;
 	}
+	async putIfAbsent(record) {
+		await emailOtpChallengeRows.insertIfAbsent(this.prepare, record).run();
+		const stored = await this.read(record.challengeId);
+		if (!stored || stored.walletId !== record.walletId || stored.orgId !== record.orgId || stored.challengeSubjectId !== record.challengeSubjectId || stored.email !== record.email || stored.action !== record.action || stored.operation !== record.operation || stored.ownerProofBindingDigest !== record.ownerProofBindingDigest || stored.expiresAtMs !== record.expiresAtMs || stored.createdAtMs > record.createdAtMs) throw new Error("Email OTP challenge identity conflict");
+		return stored;
+	}
 	async put(record) {
 		await emailOtpChallengeRows.insert(this.prepare, record).run();
 	}
 	async updateAttemptCount(record, attemptCount) {
 		const next = emailOtpChallengeWithAttemptCount(record, attemptCount);
 		await this.prepare(`UPDATE email_otp_challenges
-          SET record_json = ?,
-              otp_code = ?,
-              expires_at_ms = ?
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND challenge_id = ?`, [
+          SET record_json = ?5,
+              otp_code = ?6,
+              expires_at_ms = ?7
+        WHERE namespace = ?1
+          AND org_id = ?2
+          AND project_id = ?3
+          AND env_id = ?4
+          AND challenge_id = ?8`, [
 			JSON.stringify(next),
 			next.otpCode,
 			next.expiresAtMs,

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeVerifier.js

@@ -1,8 +1,7 @@
+import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import "../../../../shared-ts/src/utils/encoders.js";
-import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_REGISTRATION_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { emailOtpChallengeBindingMismatchCode, emailOtpChallengeInvalidOrExpired, emailOtpRegistrationChallengeBindingMismatchCode } from "./d1EmailOtpRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeVerifier.ts
@@ -122,6 +121,7 @@ var CloudflareD1EmailOtpChallengeVerifier = class {
 				message: "Missing ownerProofBindingDigest"
 			};
 			const rateLimit = await this.emailOtpRateLimits.consume({
+				kind: "wallet",
 				scope: "verify",
 				action,
 				userId,
@@ -306,6 +306,7 @@ var CloudflareD1EmailOtpChallengeVerifier = class {
 				}
 			}
 			const rateLimit = await this.emailOtpRateLimits.consume({
+				kind: "wallet",
 				scope: "verify",
 				action: recoveryBootstrap ? WALLET_EMAIL_OTP_ACTIONS.recoveryBootstrap : WALLET_EMAIL_OTP_ACTIONS.registration,
 				userId: providerSubject || walletId,

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpEnrollmentStore.js

@@ -1,5 +1,5 @@
-import { emailOtpAuthStateRows, emailOtpWalletEnrollmentRows } from "../../../../core/emailOtpD1Statements.js";
 import { emailOtpAuthStateRecord, parseEmailOtpAuthStateRow, parseEmailOtpWalletEnrollmentRow } from "./d1EmailOtpRecords.js";
+import { emailOtpAuthStateRows, emailOtpWalletEnrollmentRows } from "../../../../core/emailOtpD1Statements.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpEnrollmentStore.ts
 var CloudflareD1EmailOtpEnrollmentStore = class {
 	constructor(input) {

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpGrantStore.js

@@ -1,5 +1,5 @@
-import { emailOtpGrantRows } from "../../../../core/emailOtpD1Statements.js";
 import { parseEmailOtpGrantRow } from "./d1EmailOtpRecords.js";
+import { emailOtpGrantRows } from "../../../../core/emailOtpD1Statements.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpGrantStore.ts
 var CloudflareD1EmailOtpGrantStore = class {
 	constructor(input) {
@@ -11,12 +11,6 @@ var CloudflareD1EmailOtpGrantStore = class {
 	async consume(grantToken) {
 		return parseEmailOtpGrantRow(await emailOtpGrantRows.consume(this.prepare, grantToken).first());
 	}
-	async read(grantToken) {
-		return parseEmailOtpGrantRow(await emailOtpGrantRows.select(this.prepare, grantToken).first());
-	}
-	async delete(grantToken) {
-		await emailOtpGrantRows.delete(this.prepare, grantToken).run();
-	}
 };
 //#endregion
 export { CloudflareD1EmailOtpGrantStore };