@seams/wallet-server 0.7.3 → 0.9.0

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRateLimitStore.js

@@ -2,74 +2,100 @@ import { emailOtpRateLimitExceeded, emailOtpRateLimitKeys } from "./d1EmailOtpRe
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpRateLimitStore.ts
 var CloudflareD1EmailOtpRateLimitStore = class {
 	constructor(input) {
-		this.prepare = input.prepare;
-		this.rateLimits = input.rateLimits;
+		this.input = input;
 	}
 	async consume(input) {
-		const policy = this.rateLimits[input.scope];
-		const keys = emailOtpRateLimitKeys({
-			...input,
-			policy
-		});
-		for (const key of keys) {
-			const consumed = await this.consumeKey({
-				key,
-				policy,
-				nowMs: Date.now()
-			});
-			if (!consumed.ok) return consumed;
+		const policy = this.input.rateLimits[input.scope];
+		const keys = emailOtpRateLimitKeys(input, policy);
+		if (keys.length === 0) return { ok: true };
+		const nowMs = Date.now();
+		const statements = [];
+		for (const [index, counter] of keys.entries()) statements.push(this.prepareConsume(counter, policy, nowMs, index === 0));
+		const results = await this.input.batch(statements);
+		if (results.length !== keys.length) throw new Error("OTP counter batch omitted results");
+		for (const [index, result] of results.entries()) {
+			if (!result.success) throw new Error("OTP counter batch failed");
+			if (result.results?.length) continue;
+			return emailOtpRateLimitExceeded(await this.readCounter(keys[index]));
 		}
 		return { ok: true };
 	}
-	async consumeKey(input) {
-		const resetAtMs = input.nowMs + input.policy.windowMs;
-		if (await this.prepare(`INSERT INTO email_otp_rate_limits (
+	prepareConsume(counter, policy, nowMs, first) {
+		const resetAtMs = nowMs + policy.windowMs;
+		let walletId;
+		switch (counter.kind) {
+			case "wallet":
+				walletId = counter.walletId;
+				break;
+			case "regional":
+				walletId = null;
+				break;
+			default: return assertNever(counter);
+		}
+		const table = walletId === null ? "email_otp_rate_limits" : "wallet_email_otp_rate_limits";
+		const ownerColumn = walletId === null ? "" : "wallet_id,";
+		const ownerPlaceholder = walletId === null ? "" : "?,";
+		const ownerValues = walletId === null ? [] : [walletId];
+		return this.input.prepare(`INSERT INTO ${table} (
         namespace,
         org_id,
         project_id,
         env_id,
+        ${ownerColumn}
         rate_key,
         consumed_count,
         reset_at_ms,
         updated_at_ms
       )
-      VALUES (?, ?, ?, ?, ?, 1, ?, ?)
-      ON CONFLICT (namespace, org_id, project_id, env_id, rate_key)
+      SELECT ?, ?, ?, ?, ${ownerPlaceholder} ?, 1, ?, ?
+      WHERE ? OR changes() > 0
+      ON CONFLICT (namespace, org_id, project_id, env_id, ${ownerColumn} rate_key)
       DO UPDATE SET
         consumed_count = CASE
-          WHEN email_otp_rate_limits.reset_at_ms <= ?
+          WHEN ${table}.reset_at_ms <= ?
             THEN 1
-          ELSE email_otp_rate_limits.consumed_count + 1
+          ELSE ${table}.consumed_count + 1
         END,
         reset_at_ms = CASE
-          WHEN email_otp_rate_limits.reset_at_ms <= ?
+          WHEN ${table}.reset_at_ms <= ?
             THEN ?
-          ELSE email_otp_rate_limits.reset_at_ms
+          ELSE ${table}.reset_at_ms
         END,
         updated_at_ms = ?
-      WHERE email_otp_rate_limits.reset_at_ms <= ?
-         OR email_otp_rate_limits.consumed_count < ?
+      WHERE ${table}.reset_at_ms <= ?
+         OR ${table}.consumed_count < ?
       RETURNING consumed_count, reset_at_ms`, [
-			input.key,
+			...ownerValues,
+			counter.key,
 			resetAtMs,
-			input.nowMs,
-			input.nowMs,
-			input.nowMs,
+			nowMs,
+			first ? 1 : 0,
+			nowMs,
+			nowMs,
 			resetAtMs,
-			input.nowMs,
-			input.nowMs,
-			input.policy.limit
-		]).first()) return { ok: true };
-		return emailOtpRateLimitExceeded(await this.prepare(`SELECT consumed_count, reset_at_ms
-         FROM email_otp_rate_limits
+			nowMs,
+			nowMs,
+			policy.limit
+		]);
+	}
+	async readCounter(counter) {
+		const walletId = counter.kind === "wallet" ? counter.walletId : null;
+		const table = walletId === null ? "email_otp_rate_limits" : "wallet_email_otp_rate_limits";
+		const ownerValues = walletId === null ? [] : [walletId];
+		return this.input.prepare(`SELECT consumed_count, reset_at_ms
+         FROM ${table}
         WHERE namespace = ?
           AND org_id = ?
           AND project_id = ?
           AND env_id = ?
+          ${walletId === null ? "" : "AND wallet_id = ?"}
           AND rate_key = ?
-        LIMIT 1`, [input.key]).first());
+        LIMIT 1`, [...ownerValues, counter.key]).first();
 	}
 };
+function assertNever(value) {
+	throw new Error(`Unexpected OTP counter ownership: ${String(value)}`);
+}
 //#endregion
 export { CloudflareD1EmailOtpRateLimitStore };
 

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRecords.js

@@ -1,12 +1,11 @@
+import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
 import "../../../../shared-ts/src/utils/encoders.js";
-import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { hasExactKeys } from "../../../../shared-ts/src/utils/exactKeys.js";
 import { failure } from "../../../../shared-ts/src/utils/failure.js";
-import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION, isWalletEmailOtpLoginOperation } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
+import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_UNLOCK_OPERATION, isWalletEmailOtpLoginOperation } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { isB64uString, nonNegativeSafeInteger, parseJsonObject, positiveSafeInteger } from "../auth/d1RouterApiAuthBoundary.js";
-import { parseCurrentEmailOtpChallengeRow, parseCurrentEmailOtpGrantRow, parseCurrentEmailOtpUnlockChallengeRow } from "../../../../core/EmailOtpRecords.js";
+import { parseCurrentEmailOtpChallengeRow, parseCurrentEmailOtpGrantRow, parseCurrentEmailOtpUnlockChallengeRow, parseEmailOtpChallengePurpose } from "../../../../core/EmailOtpRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpRecords.ts
 function maskEmail(email) {
 	const trimmed = email.trim().toLowerCase();
@@ -45,20 +44,30 @@ function bytesEqual(left, right) {
 	for (let index = 0; index < left.length; index += 1) difference |= (left[index] || 0) ^ (right[index] || 0);
 	return difference === 0;
 }
-function emailOtpRateLimitKeys(input) {
+function emailOtpRateLimitKeys(input, policy) {
 	const keySuffix = [
 		`scope=${input.scope}`,
 		`action=${input.action || "default"}`,
-		`limit=${input.policy.limit}`,
-		`windowMs=${input.policy.windowMs}`
+		`limit=${policy.limit}`,
+		`windowMs=${policy.windowMs}`
 	].join(":");
-	return [
+	const counters = [];
+	if (input.kind === "wallet") counters.push({
+		kind: "wallet",
+		walletId: input.walletId,
+		key: keySuffix
+	});
+	const regionalKeys = [
 		input.clientIp ? `${keySuffix}:ip:${input.clientIp}` : "",
 		input.userId ? `${keySuffix}:user:${input.userId}` : "",
-		input.walletId ? `${keySuffix}:wallet:${input.walletId}` : "",
 		input.providerSubject ? `${keySuffix}:provider:${input.providerSubject}` : "",
 		input.orgId ? `${keySuffix}:org:${input.orgId}` : ""
-	].filter(Boolean);
+	];
+	for (const key of regionalKeys) if (key) counters.push({
+		kind: "regional",
+		key
+	});
+	return counters;
 }
 function emailOtpRateLimitExceeded(row) {
 	const resetAtMs = positiveSafeInteger(row?.reset_at_ms);
@@ -159,7 +168,7 @@ function parseEmailOtpChallengeRow(row) {
 		recordJson: row?.record_json,
 		expiresAtMs: row?.expires_at_ms
 	});
-	if (!record || record.expiresAtMs <= record.createdAtMs || !emailOtpChallengePurposeIsValid(record)) return null;
+	if (!record || record.expiresAtMs <= record.createdAtMs) return null;
 	return {
 		...record,
 		email: record.email.toLowerCase()
@@ -227,6 +236,8 @@ function emailOtpChallengeContextValues(input) {
 	];
 }
 function emailOtpChallengeRecord(input) {
+	const purpose = parseEmailOtpChallengePurpose(input.action, input.operation);
+	if (!purpose) throw new Error("Invalid Email OTP challenge purpose");
 	return {
 		version: "email_otp_challenge_v1",
 		challengeId: input.challengeId,
@@ -237,8 +248,7 @@ function emailOtpChallengeRecord(input) {
 		email: input.email,
 		otpCode: input.otpCode,
 		ownerProofBindingDigest: input.ownerProofBindingDigest,
-		action: input.action,
-		operation: input.operation,
+		...purpose,
 		createdAtMs: input.createdAtMs,
 		expiresAtMs: input.expiresAtMs,
 		attemptCount: 0,
@@ -246,6 +256,8 @@ function emailOtpChallengeRecord(input) {
 	};
 }
 function emailOtpChallengeWithAttemptCount(record, attemptCount) {
+	const purpose = parseEmailOtpChallengePurpose(record.action, record.operation);
+	if (!purpose) throw new Error("Invalid Email OTP challenge purpose");
 	return {
 		version: "email_otp_challenge_v1",
 		challengeId: record.challengeId,
@@ -256,8 +268,7 @@ function emailOtpChallengeWithAttemptCount(record, attemptCount) {
 		email: record.email,
 		otpCode: record.otpCode,
 		ownerProofBindingDigest: record.ownerProofBindingDigest,
-		action: record.action,
-		operation: record.operation,
+		...purpose,
 		createdAtMs: record.createdAtMs,
 		expiresAtMs: record.expiresAtMs,
 		attemptCount,
@@ -373,12 +384,7 @@ function emailOtpAuthStateRecord(input) {
 	};
 }
 function emailOtpChallengePurposeIsValid(input) {
-	switch (input.action) {
-		case WALLET_EMAIL_OTP_ACTIONS.login: return isWalletEmailOtpLoginOperation(input.operation);
-		case WALLET_EMAIL_OTP_ACTIONS.registration: return input.operation === WALLET_EMAIL_OTP_REGISTRATION_OPERATION;
-		case WALLET_EMAIL_OTP_ACTIONS.recoveryBootstrap: return input.operation === WALLET_EMAIL_OTP_UNLOCK_OPERATION;
-		case WALLET_EMAIL_OTP_ACTIONS.deviceLink: return input.operation === WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION;
-	}
+	return parseEmailOtpChallengePurpose(input.action, input.operation) !== null;
 }
 function optionalPositiveSafeIntegerField(record, field) {
 	if (!hasRecordField(record, field) || record[field] == null) return void 0;

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRecoveryService.js

@@ -1,5 +1,4 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { failedVerification, failure } from "../../../../shared-ts/src/utils/failure.js";
 import { validateSecp256k1PublicKey33, verifySecp256k1RecoverableSignatureAgainstPublicKey33 } from "../../../../core/ThresholdService/evmCryptoWasm.js";
@@ -230,6 +229,7 @@ var CloudflareD1EmailOtpRecoveryService = class {
 			const parsed = normalizeGrantConsumptionInput(input);
 			if (!parsed.ok) return parsed.result;
 			const rateLimit = await this.emailOtpRateLimits.consume({
+				kind: "wallet",
 				scope: "grant",
 				userId: parsed.value.userId,
 				walletId: parsed.value.walletId,

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer.js

@@ -1,5 +1,4 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { validateSecp256k1PublicKey33 } from "../../../../core/ThresholdService/evmCryptoWasm.js";
 import { emailOtpDeviceEnrollmentId } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
@@ -59,8 +58,9 @@ var CloudflareD1EmailOtpRegistrationEnrollmentFinalizer = class {
 			case "passkey": return { ok: true };
 			case "email_otp": switch (input.authority.proofKind) {
 				case "otp_challenge": return { ok: true };
-				case "google_sso_registration": return await this.googleEmailOtpSessions.completeRegistrationAttempt({
+				case "google_sso_registration": return await this.googleEmailOtpSessions.completeCommittedRegistrationAttempt({
 					registrationAttemptId: input.authority.googleEmailOtpRegistrationAttemptId,
+					intentDigest: input.authority.registrationIntentDigestB64u,
 					walletId: input.walletId
 				});
 			}

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpServerSealRuntime.js

@@ -1,5 +1,4 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { createSigningSessionSealShamir3PassCipherAdapter } from "../../../../threshold/session/signingSessionSeal/crypto/cipher.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpServerSealRuntime.ts

package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationAttemptStore.js

@@ -1,15 +1,31 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { d1MutationChanges } from "../auth/d1RouterApiAuthBoundary.js";
 import { registrationAttemptMatchesReplacementScope, registrationAttemptMatchesStartedScope } from "../../../../core/EmailOtpRecords.js";
+import { completeGoogleRegistration } from "./d1GoogleRegistrationCompletion.js";
 import { emailOtpRegistrationAttemptRows } from "../../../../core/emailOtpD1Statements.js";
-import { abandonedGoogleEmailOtpRegistrationAttemptRecord, parseGoogleEmailOtpRegistrationAttemptRow, pendingGoogleEmailOtpRegistrationAttemptWithUpdatedAt } from "./d1GoogleEmailOtpRegistrationRecords.js";
+import { abandonedGoogleEmailOtpRegistrationAttemptRecord, parseGoogleEmailOtpRegistrationAttemptRow } from "./d1GoogleEmailOtpRegistrationRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationAttemptStore.ts
 var CloudflareD1GoogleEmailOtpRegistrationAttemptStore = class {
 	constructor(input) {
 		this.prepare = input.prepare;
 		this.orgId = input.orgId;
+		this.batch = input.batch;
+	}
+	complete(input) {
+		return completeGoogleRegistration(this.prepare, this.batch, {
+			kind: "live_offer",
+			attemptId: input.attemptId,
+			walletId: input.walletId
+		});
+	}
+	completeCommitted(input) {
+		return completeGoogleRegistration(this.prepare, this.batch, {
+			kind: "committed_wallet",
+			attemptId: input.attemptId,
+			walletId: input.walletId,
+			intentDigest: input.intentDigest
+		});
 	}
 	async cleanupExpired(nowMs) {
 		return d1MutationChanges(await emailOtpRegistrationAttemptRows.deleteExpired(this.prepare, nowMs).run());
@@ -37,8 +53,16 @@ var CloudflareD1GoogleEmailOtpRegistrationAttemptStore = class {
 			expiresAtMs: nowMs + 30 * 6e4,
 			runtimePolicyScope: input.runtimePolicyScope
 		};
-		await this.put(attempt);
-		return attempt;
+		await emailOtpRegistrationAttemptRows.insertPendingIfAbsent(this.prepare, attempt).run();
+		const winner = await this.findStarted({
+			providerSubject: input.providerSubject,
+			email: input.email,
+			orgId: this.orgId,
+			ownerProofBindingDigest: input.ownerProofBindingDigest,
+			runtimePolicyScope: input.runtimePolicyScope
+		});
+		if (!winner) throw new Error("Registration offer changed during creation; retry the request");
+		return winner;
 	}
 	async findStarted(input) {
 		const nowMs = Date.now();
@@ -51,13 +75,11 @@ var CloudflareD1GoogleEmailOtpRegistrationAttemptStore = class {
 		const parsed = parseGoogleEmailOtpRegistrationAttemptRow(row);
 		if (!parsed) {
 			const malformedAttemptId = normalizeOptionalTrimmedString(row?.attempt_id);
-			if (malformedAttemptId) await this.delete(malformedAttemptId);
+			if (malformedAttemptId) await this.deleteMalformedUnclaimed(malformedAttemptId);
 			return null;
 		}
 		if (!registrationAttemptMatchesStartedScope(parsed, scope)) return null;
-		const refreshed = pendingGoogleEmailOtpRegistrationAttemptWithUpdatedAt(parsed, nowMs);
-		await this.put(refreshed);
-		return refreshed;
+		return parsed;
 	}
 	async abandonStartedExceptBinding(input) {
 		const result = await emailOtpRegistrationAttemptRows.selectPending(this.prepare, input).all();
@@ -65,7 +87,7 @@ var CloudflareD1GoogleEmailOtpRegistrationAttemptStore = class {
 			const parsed = parseGoogleEmailOtpRegistrationAttemptRow(row);
 			if (!parsed) {
 				const malformedAttemptId = normalizeOptionalTrimmedString(row.attempt_id);
-				if (malformedAttemptId) await this.delete(malformedAttemptId);
+				if (malformedAttemptId) await this.deleteMalformedUnclaimed(malformedAttemptId);
 				continue;
 			}
 			if (!registrationAttemptMatchesReplacementScope(parsed, input)) continue;
@@ -80,16 +102,26 @@ var CloudflareD1GoogleEmailOtpRegistrationAttemptStore = class {
 		const row = await emailOtpRegistrationAttemptRows.selectLiveForWallet(this.prepare, input.walletId, input.nowMs).first();
 		return Boolean(row);
 	}
+	async claimCandidate(input) {
+		return d1MutationChanges(await emailOtpRegistrationAttemptRows.claimCandidate(this.prepare, {
+			...input,
+			nowMs: Date.now()
+		}).run()) === 1 ? { ok: true } : {
+			ok: false,
+			code: "registration_candidate_unavailable",
+			message: "Registration offer is unavailable or already claimed by another candidate or intent"
+		};
+	}
 	async read(attemptId) {
 		const record = parseGoogleEmailOtpRegistrationAttemptRow(await emailOtpRegistrationAttemptRows.select(this.prepare, attemptId).first());
 		return record?.runtimePolicyScope?.orgId === this.orgId ? record : null;
 	}
 	async put(record) {
 		if (record.runtimePolicyScope?.orgId !== this.orgId) throw new Error("Google Email OTP registration attempt org scope mismatch");
-		await emailOtpRegistrationAttemptRows.upsert(this.prepare, record).run();
+		if (d1MutationChanges(await emailOtpRegistrationAttemptRows.updatePending(this.prepare, record).run()) !== 1) throw new Error("Registration offer is no longer pending or has changed");
 	}
-	async delete(attemptId) {
-		await emailOtpRegistrationAttemptRows.delete(this.prepare, attemptId).run();
+	async deleteMalformedUnclaimed(attemptId) {
+		await emailOtpRegistrationAttemptRows.deleteUnclaimed(this.prepare, attemptId).run();
 	}
 };
 //#endregion

package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationRecords.js

@@ -1,5 +1,4 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { isB64uString, nonNegativeSafeInteger, parseJsonObject, positiveSafeInteger } from "../auth/d1RouterApiAuthBoundary.js";
 //#region src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationRecords.ts
 const GOOGLE_EMAIL_OTP_AUTH_PROVIDER = "google";
@@ -8,18 +7,6 @@ function requireRuntimePolicyScope(input) {
 	if (scope) return scope;
 	throw new Error("runtimePolicyScope.orgId, runtimePolicyScope.projectId, runtimePolicyScope.envId, and runtimePolicyScope.signingRootVersion are required for Google Email OTP registration");
 }
-function activeGoogleEmailOtpRegistrationAttemptRecord(input) {
-	const terminal = terminalGoogleEmailOtpRegistrationAttemptRecord({
-		fields: {
-			...input.record,
-			updatedAtMs: input.updatedAtMs
-		},
-		state: "active",
-		...input.record.state === "key_finalized" ? { finalizedPublicKey: input.record.finalizedPublicKey } : {}
-	});
-	if (!terminal) throw new Error("Failed to build active Google Email OTP registration attempt");
-	return terminal;
-}
 function expiredGoogleEmailOtpRegistrationAttemptRecord(input) {
 	const terminal = terminalGoogleEmailOtpRegistrationAttemptRecord({
 		fields: {
@@ -33,19 +20,6 @@ function expiredGoogleEmailOtpRegistrationAttemptRecord(input) {
 	if (!terminal) throw new Error("Failed to build expired Google Email OTP registration attempt");
 	return terminal;
 }
-function failedGoogleEmailOtpRegistrationAttemptWithCode(input) {
-	const terminal = terminalGoogleEmailOtpRegistrationAttemptRecord({
-		fields: {
-			...input.record,
-			updatedAtMs: input.updatedAtMs
-		},
-		state: "failed",
-		failureCode: input.failureCode,
-		...input.record.state === "key_finalized" ? { finalizedPublicKey: input.record.finalizedPublicKey } : {}
-	});
-	if (!terminal) throw new Error("Failed to build failed Google Email OTP registration attempt");
-	return terminal;
-}
 function parseGoogleEmailOtpRegistrationAttemptRecord(input) {
 	const record = parseJsonObject(input);
 	if (!record) return null;
@@ -137,21 +111,6 @@ function googleEmailOtpRegistrationOfferForResponse(input) {
 		candidates: [candidates[0], ...candidates.slice(1)]
 	};
 }
-function pendingGoogleEmailOtpRegistrationAttemptWithUpdatedAt(record, updatedAtMs) {
-	return pendingRegistrationAttemptRecord({
-		...record,
-		updatedAtMs
-	}, record);
-}
-function pendingGoogleEmailOtpRegistrationAttemptWithSelectedCandidate(input) {
-	return pendingRegistrationAttemptRecord({
-		...input.record,
-		walletId: input.candidate.walletId,
-		selectedCandidateId: input.candidate.candidateId,
-		collisionCounter: input.candidate.collisionCounter,
-		updatedAtMs: input.updatedAtMs
-	}, input.record);
-}
 function abandonedGoogleEmailOtpRegistrationAttemptRecord(input) {
 	return registrationAttemptRecord({
 		...input.record,
@@ -244,13 +203,6 @@ function registrationAttemptRecord(fields, state) {
 		...fields.runtimePolicyScope ? { runtimePolicyScope: fields.runtimePolicyScope } : {}
 	};
 }
-/** Rebuilds a pending attempt from changed fields, keeping its state. */
-function pendingRegistrationAttemptRecord(fields, record) {
-	return record.state === "started" ? registrationAttemptRecord(fields, { state: "started" }) : registrationAttemptRecord(fields, {
-		state: "key_finalized",
-		finalizedPublicKey: record.finalizedPublicKey
-	});
-}
 function terminalGoogleEmailOtpRegistrationAttemptRecord(input) {
 	const finalized = input.finalizedPublicKey ? { finalizedPublicKey: input.finalizedPublicKey } : {};
 	switch (input.state) {
@@ -274,6 +226,6 @@ function terminalGoogleEmailOtpRegistrationAttemptRecord(input) {
 	}
 }
 //#endregion
-export { abandonedGoogleEmailOtpRegistrationAttemptRecord, activeGoogleEmailOtpRegistrationAttemptRecord, expiredGoogleEmailOtpRegistrationAttemptRecord, failedGoogleEmailOtpRegistrationAttemptWithCode, googleEmailOtpRegistrationOfferForResponse, parseGoogleEmailOtpRegistrationAttemptRow, pendingGoogleEmailOtpRegistrationAttemptWithSelectedCandidate, pendingGoogleEmailOtpRegistrationAttemptWithUpdatedAt, requireRuntimePolicyScope };
+export { abandonedGoogleEmailOtpRegistrationAttemptRecord, expiredGoogleEmailOtpRegistrationAttemptRecord, googleEmailOtpRegistrationOfferForResponse, parseGoogleEmailOtpRegistrationAttemptRecord, parseGoogleEmailOtpRegistrationAttemptRow, parseGoogleEmailOtpRegistrationOfferCandidates, requireRuntimePolicyScope };
 
 //# sourceMappingURL=d1GoogleEmailOtpRegistrationRecords.js.map

package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpSessionResolver.js

@@ -1,12 +1,11 @@
 import { parseGoogleProviderSubject, parseOrgId, parseVerifiedGoogleEmail } from "../../../../shared-ts/src/utils/domainIds.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { createServerAllocatedWalletId } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
 import { parseD1BoundaryWalletId, parseD1BoundaryWalletIdResult } from "../auth/d1RouterApiAuthBoundary.js";
-import { abandonedGoogleEmailOtpRegistrationAttemptRecord, activeGoogleEmailOtpRegistrationAttemptRecord, expiredGoogleEmailOtpRegistrationAttemptRecord, failedGoogleEmailOtpRegistrationAttemptWithCode, googleEmailOtpRegistrationOfferForResponse, requireRuntimePolicyScope } from "./d1GoogleEmailOtpRegistrationRecords.js";
+import { abandonedGoogleEmailOtpRegistrationAttemptRecord, expiredGoogleEmailOtpRegistrationAttemptRecord, googleEmailOtpRegistrationOfferForResponse, requireRuntimePolicyScope } from "./d1GoogleEmailOtpRegistrationRecords.js";
 import { googleEmailOtpStaleIdentityMapping, hasDifferentWalletIdentitySubject } from "../identity/d1IdentityRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpSessionResolver.ts
 var CloudflareD1GoogleEmailOtpSessionResolver = class {
@@ -122,6 +121,7 @@ var CloudflareD1GoogleEmailOtpSessionResolver = class {
 		if (!orgId.ok) return failure("invalid_body", orgId.error.message);
 		const restartOffer = isTrueFlag(input.restartRegistrationOffer);
 		return await this.emailOtpRateLimits.consume({
+			kind: "regional",
 			scope: "googleRegistrationAttempt",
 			action: restartOffer ? "google_email_otp_registration_offer_restart" : "google_email_otp_registration_create",
 			userId: normalizeOptionalTrimmedString(input.providerUserId),
@@ -130,41 +130,22 @@ var CloudflareD1GoogleEmailOtpSessionResolver = class {
 			clientIp: normalizeOptionalTrimmedString(input.clientIp)
 		});
 	}
+	completeCommittedRegistrationAttempt(input) {
+		return this.registrationAttempts.completeCommitted({
+			attemptId: input.registrationAttemptId,
+			walletId: input.walletId,
+			intentDigest: input.intentDigest
+		});
+	}
 	async completeRegistrationAttempt(input) {
 		const registrationAttemptId = normalizeOptionalTrimmedString(input.registrationAttemptId);
 		if (!registrationAttemptId) return { ok: true };
 		const walletId = parseD1BoundaryWalletIdResult(input.walletId);
 		if (!walletId.ok) return failure("invalid_body", walletId.code === "missing" ? "Missing walletId" : "Invalid walletId");
-		const attempt = await this.registrationAttempts.read(registrationAttemptId);
-		if (!attempt) return failure("registration_incomplete", "Google Email OTP registration attempt expired or was not found");
-		if (attempt.expiresAtMs <= Date.now()) {
-			await this.registrationAttempts.put(expiredGoogleEmailOtpRegistrationAttemptRecord({
-				record: attempt,
-				updatedAtMs: Date.now()
-			}));
-			return failure("registration_incomplete", "Google Email OTP registration attempt expired");
-		}
-		if (walletId.value !== attempt.walletId) return failure("wallet_identity_mismatch", "registrationAttemptId does not match walletId");
-		if (attempt.state === "active") return { ok: true };
-		if (attempt.state !== "started" && attempt.state !== "key_finalized") return failure("registration_incomplete", "Google Email OTP registration attempt is no longer active");
-		const linked = await this.linkIdentity({
-			userId: attempt.walletId,
-			subject: `wallet:${attempt.providerSubject}`,
-			allowMoveIfSoleIdentity: true
+		return this.registrationAttempts.complete({
+			attemptId: registrationAttemptId,
+			walletId: walletId.value
 		});
-		if (!linked.ok) {
-			await this.registrationAttempts.put(failedGoogleEmailOtpRegistrationAttemptWithCode({
-				record: attempt,
-				failureCode: linked.code,
-				updatedAtMs: Date.now()
-			}));
-			return failure(linked.code, linked.message);
-		}
-		await this.registrationAttempts.put(activeGoogleEmailOtpRegistrationAttemptRecord({
-			record: attempt,
-			updatedAtMs: Date.now()
-		}));
-		return { ok: true };
 	}
 	async validateRegistrationCandidateWallet(input) {
 		const registrationAttemptId = normalizeOptionalTrimmedString(input.registrationAttemptId);
@@ -206,6 +187,14 @@ var CloudflareD1GoogleEmailOtpSessionResolver = class {
 					hasEmailOtpEnrollment: true
 				};
 			}
+			return {
+				ok: false,
+				mode: "wallet_identity_mismatch",
+				code: "wallet_identity_mismatch",
+				walletId: input.loginWalletId,
+				providerSubject: input.providerSubject,
+				message: "The selected wallet does not match the verified Google account"
+			};
 		}
 		if (input.linkedWalletId) {
 			const enrollment = await this.readActiveEnrollment({

package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleRegistrationCompletion.js

@@ -0,0 +1,85 @@
+//#region src/router/cloudflare/d1/emailOtp/d1GoogleRegistrationCompletion.ts
+const PENDING_OFFER = `SELECT * FROM email_otp_registration_attempts
+  WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
+    AND attempt_id = ? AND wallet_id = ? AND selection_digest IS NOT NULL
+    AND state IN ('started', 'key_finalized')`;
+async function completeGoogleRegistration(prepare, batch, input) {
+	const nowMs = Date.now();
+	const eligibility = input.kind === "live_offer" ? `${PENDING_OFFER} AND expires_at_ms > ?` : `${PENDING_OFFER} AND selection_digest = ?`;
+	const scopeValues = [
+		input.attemptId,
+		input.walletId,
+		input.kind === "live_offer" ? nowMs : input.intentDigest
+	];
+	const results = await batch([
+		prepare(`WITH offer AS (${eligibility})
+      INSERT INTO identity_links (
+        namespace, org_id, project_id, env_id, subject, user_id, record_json,
+        created_at_ms, updated_at_ms
+      )
+      SELECT namespace, org_id, project_id, env_id, 'wallet:' || provider_subject,
+        wallet_id, json_object('version', 'identity_subject_v1',
+          'subject', 'wallet:' || provider_subject, 'userId', wallet_id,
+          'createdAtMs', ?, 'updatedAtMs', ?), ?, ?
+      FROM offer WHERE 1
+      ON CONFLICT (namespace, org_id, project_id, env_id, subject) DO UPDATE SET
+        user_id = excluded.user_id,
+        record_json = json_set(identity_links.record_json,
+          '$.userId', excluded.user_id,
+          '$.updatedAtMs', MAX(identity_links.updated_at_ms, excluded.updated_at_ms)),
+        updated_at_ms = MAX(identity_links.updated_at_ms, excluded.updated_at_ms)
+      WHERE identity_links.user_id = excluded.user_id OR (
+        SELECT COUNT(*) FROM identity_links old
+        WHERE old.namespace = identity_links.namespace AND old.org_id = identity_links.org_id
+          AND old.project_id = identity_links.project_id AND old.env_id = identity_links.env_id
+          AND old.user_id = identity_links.user_id
+      ) = 1`, [
+			...scopeValues,
+			nowMs,
+			nowMs,
+			nowMs,
+			nowMs
+		]),
+		prepare(`WITH offer AS (${eligibility})
+      UPDATE email_otp_registration_attempts AS attempt
+      SET state = 'active', updated_at_ms = MAX(updated_at_ms, ?),
+        record_json = json_set(record_json, '$.state', 'active', '$.updatedAtMs', MAX(updated_at_ms, ?))
+      WHERE EXISTS (SELECT 1 FROM offer
+        JOIN identity_links link ON link.namespace = offer.namespace AND link.org_id = offer.org_id
+          AND link.project_id = offer.project_id AND link.env_id = offer.env_id
+          AND link.subject = 'wallet:' || offer.provider_subject AND link.user_id = offer.wallet_id
+        WHERE attempt.namespace = offer.namespace AND attempt.org_id = offer.org_id
+          AND attempt.project_id = offer.project_id AND attempt.env_id = offer.env_id
+          AND attempt.attempt_id = offer.attempt_id)`, [
+			...scopeValues,
+			nowMs,
+			nowMs
+		]),
+		prepare(`SELECT 1 AS completed FROM email_otp_registration_attempts offer
+      JOIN identity_links link ON link.namespace = offer.namespace AND link.org_id = offer.org_id
+        AND link.project_id = offer.project_id AND link.env_id = offer.env_id
+        AND link.subject = 'wallet:' || offer.provider_subject AND link.user_id = offer.wallet_id
+      WHERE offer.namespace = ? AND offer.org_id = ? AND offer.project_id = ? AND offer.env_id = ?
+        AND offer.attempt_id = ? AND offer.wallet_id = ?
+        AND offer.selection_digest IS NOT NULL AND offer.state = 'active'
+        ${input.kind === "committed_wallet" ? "AND offer.selection_digest = ?" : ""}`, input.kind === "committed_wallet" ? [
+			input.attemptId,
+			input.walletId,
+			input.intentDigest
+		] : [input.attemptId, input.walletId])
+	]);
+	if (results.some(batchFailed)) throw new Error("Registration completion transaction failed");
+	if (results[2]?.results?.[0]?.completed === 1) return { ok: true };
+	return {
+		ok: false,
+		code: "registration_incomplete",
+		message: "Registration offer or identity link is unavailable for completion"
+	};
+}
+function batchFailed(result) {
+	return !result.success;
+}
+//#endregion
+export { completeGoogleRegistration };
+
+//# sourceMappingURL=d1GoogleRegistrationCompletion.js.map