@seams/wallet-server 0.7.3 → 0.9.0

package/dist/esm/router/cloudflare/d1/identity/d1IdentityRecords.js

@@ -1,5 +1,4 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { GOOGLE_EMAIL_OTP_STALE_IDENTITY_MESSAGE } from "../../../../core/authService/googleEmailOtpErrors.js";
 //#region src/router/cloudflare/d1/identity/d1IdentityRecords.ts
 function hasDifferentWalletIdentitySubject(input) {

package/dist/esm/router/cloudflare/d1/identity/d1IdentityService.js

@@ -1,38 +1,12 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { failure } from "../../../../shared-ts/src/utils/failure.js";
-import { parseD1BoundaryWalletId } from "../auth/d1RouterApiAuthBoundary.js";
-import { requireD1RouterApiAuthScopeString } from "../auth/d1RouterApiAuthConfig.js";
-import { deriveHostedNearAccountId } from "../../../../core/hostedAccountIds.js";
 //#region src/router/cloudflare/d1/identity/d1IdentityService.ts
 function errorMessage(error) {
 	return error instanceof Error ? error.message : String(error || "");
 }
-function isHostedOidcWalletScopeRecord(input) {
-	return input !== null && typeof input === "object" && !Array.isArray(input);
-}
-function resolveHostedOidcWalletScope(input) {
-	const scope = isHostedOidcWalletScopeRecord(input) ? input : {};
-	const orgId = normalizeOptionalTrimmedString(scope.orgId);
-	const projectId = normalizeOptionalTrimmedString(scope.projectId);
-	const envId = normalizeOptionalTrimmedString(scope.envId);
-	if (orgId && projectId && envId) return {
-		projectId,
-		envId
-	};
-	throw new Error("runtimePolicyScope.orgId, runtimePolicyScope.projectId, and runtimePolicyScope.envId are required for hosted wallet id derivation");
-}
-function codedError(code, message) {
-	const error = new Error(message);
-	error.code = code;
-	return error;
-}
 var CloudflareD1IdentityService = class {
 	constructor(input) {
-		this.accountIdDerivationSecret = input.accountIdDerivationSecret;
 		this.identityStore = input.identityStore;
-		this.relayerAccount = input.relayerAccount;
-		this.resolveGoogleEmailOtpSession = input.resolveGoogleEmailOtpSession;
 	}
 	async listIdentities(input) {
 		try {
@@ -75,28 +49,6 @@ var CloudflareD1IdentityService = class {
 			return failure("internal", errorMessage(error) || "Failed to unlink identity");
 		}
 	}
-	async resolveOidcWalletId(input) {
-		const providerSubject = normalizeOptionalTrimmedString(input.providerSubject ?? input.sub);
-		if (!providerSubject) throw new Error("Cannot resolve OIDC wallet id without provider subject");
-		if (providerSubject.startsWith("google:")) {
-			const resolution = await this.resolveGoogleEmailOtpSession(input);
-			if (resolution.ok) return resolution.walletId;
-			throw codedError(resolution.code, resolution.message);
-		}
-		const parsedLinkedWalletId = parseD1BoundaryWalletId(await this.identityStore.getUserIdBySubject(`wallet:${providerSubject}`));
-		if (parsedLinkedWalletId) return parsedLinkedWalletId;
-		const scope = resolveHostedOidcWalletScope(input.runtimePolicyScope);
-		const verifiedEmail = normalizeOptionalTrimmedString(input.email);
-		return await deriveHostedNearAccountId({
-			accountIdDerivationSecret: requireD1RouterApiAuthScopeString(this.accountIdDerivationSecret, "ACCOUNT_ID_DERIVATION_SECRET"),
-			relayerAccount: requireD1RouterApiAuthScopeString(this.relayerAccount, "relayerAccount"),
-			projectId: scope.projectId,
-			envId: scope.envId,
-			authProvider: "oidc",
-			providerSubject,
-			...verifiedEmail ? { verifiedEmail } : {}
-		});
-	}
 };
 //#endregion
 export { CloudflareD1IdentityService };

package/dist/esm/router/cloudflare/d1/near/d1SponsoredNearAccount.js

@@ -0,0 +1,242 @@
+import { parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
+import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import "../../../../shared-ts/src/utils/encoders.js";
+import { createCloudflareD1VersionedJsonRecordStore } from "../versionedJson/d1VersionedJsonRecordStore.js";
+import { runRouterAbEd25519YaoRegistrationSideEffectV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
+import { broadcastPreparedSponsoredNearAccountCreation, prepareSponsoredNearAccountCreationWithRelayer, preparedSponsoredNearAccountCreationArtifactFingerprint } from "../../../../core/nearRelayerAccountProvisioning.js";
+//#region src/router/cloudflare/d1/near/d1SponsoredNearAccount.ts
+/**
+* Validates a persisted claim before it is trusted to skip a broadcast or to be
+* replayed. An invalid record makes the D1 read fail, which leaves the effect
+* uncertain and prevents any network action on unvalidated bytes.
+*/
+function parseSponsoredNearAccountSideEffectRecord(raw) {
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
+	if (Reflect.get(raw, "operation") !== "finalize") return null;
+	const requestFingerprint = parseSideEffectFingerprint(Reflect.get(raw, "requestFingerprint"));
+	const preparedArtifactFingerprint = parseSideEffectFingerprint(Reflect.get(raw, "preparedArtifactFingerprint"));
+	if (requestFingerprint === null || preparedArtifactFingerprint === null) return null;
+	const claimedAtMs = Reflect.get(raw, "claimedAtMs");
+	if (!isNonNegativeSafeInteger(claimedAtMs)) return null;
+	const prepared = parseWalletSponsoredTransaction(Reflect.get(raw, "prepared"));
+	if (prepared === null) return null;
+	const kind = Reflect.get(raw, "kind");
+	if (kind === "router_ab_ed25519_yao_registration_side_effect_claim_v1") return {
+		kind: "router_ab_ed25519_yao_registration_side_effect_claim_v1",
+		operation: "finalize",
+		requestFingerprint,
+		preparedArtifactFingerprint,
+		claimedAtMs,
+		prepared
+	};
+	if (kind === "router_ab_ed25519_yao_registration_side_effect_completion_v1") {
+		const completedAtMs = Reflect.get(raw, "completedAtMs");
+		if (!isNonNegativeSafeInteger(completedAtMs)) return null;
+		const response = parseAccountCreationResult(Reflect.get(raw, "response"));
+		if (response === null) return null;
+		return {
+			kind: "router_ab_ed25519_yao_registration_side_effect_completion_v1",
+			operation: "finalize",
+			requestFingerprint,
+			preparedArtifactFingerprint,
+			claimedAtMs,
+			completedAtMs,
+			prepared,
+			response
+		};
+	}
+	return null;
+}
+function parsePreparedSponsoredNearAccountCreation(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+	if (Reflect.get(value, "kind") !== "prepared_sponsored_near_account_creation_v1") return null;
+	const accountId = parseNonEmptyString(Reflect.get(value, "accountId"));
+	const publicKey = parseNonEmptyString(Reflect.get(value, "publicKey"));
+	const relayerAccountId = parseNonEmptyString(Reflect.get(value, "relayerAccountId"));
+	const relayerPublicKey = parseNonEmptyString(Reflect.get(value, "relayerPublicKey"));
+	const initialBalanceYocto = parseNonEmptyString(Reflect.get(value, "initialBalanceYocto"));
+	const transactionHash = parseNonEmptyString(Reflect.get(value, "transactionHash"));
+	const nextNonce = parseNonEmptyString(Reflect.get(value, "nextNonce"));
+	const blockHash = parseNonEmptyString(Reflect.get(value, "blockHash"));
+	const signedTransactionBorshB64u = parseBoundedBase64Url(Reflect.get(value, "signedTransactionBorshB64u"));
+	if (accountId === null || publicKey === null || relayerAccountId === null || relayerPublicKey === null || initialBalanceYocto === null || transactionHash === null || nextNonce === null || blockHash === null || signedTransactionBorshB64u === null) return null;
+	return {
+		kind: "prepared_sponsored_near_account_creation_v1",
+		accountId,
+		publicKey,
+		relayerAccountId,
+		relayerPublicKey,
+		initialBalanceYocto,
+		transactionHash,
+		nextNonce,
+		blockHash,
+		signedTransactionBorshB64u
+	};
+}
+function parseAccountCreationResult(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+	const success = Reflect.get(value, "success");
+	if (typeof success !== "boolean") return null;
+	const accountId = parseOptionalString(Reflect.get(value, "accountId"));
+	const transactionHash = parseOptionalString(Reflect.get(value, "transactionHash"));
+	const error = parseOptionalString(Reflect.get(value, "error"));
+	const message = parseOptionalString(Reflect.get(value, "message"));
+	if ("accountId" in value && accountId === null || "transactionHash" in value && transactionHash === null || "error" in value && error === null || "message" in value && message === null) return null;
+	if (success && (accountId === void 0 || transactionHash === void 0)) return null;
+	const normalizedAccountId = accountId ?? void 0;
+	const normalizedTransactionHash = transactionHash ?? void 0;
+	const normalizedError = error ?? void 0;
+	const normalizedMessage = message ?? void 0;
+	return {
+		success,
+		...normalizedAccountId === void 0 ? {} : { accountId: normalizedAccountId },
+		...normalizedTransactionHash === void 0 ? {} : { transactionHash: normalizedTransactionHash },
+		...normalizedError === void 0 ? {} : { error: normalizedError },
+		...normalizedMessage === void 0 ? {} : { message: normalizedMessage }
+	};
+}
+function parseNonEmptyString(value) {
+	return typeof value === "string" && value.trim() ? value : null;
+}
+function parseSideEffectFingerprint(value) {
+	return typeof value === "string" && /^[a-zA-Z0-9:_-]{32,192}$/u.test(value) ? value : null;
+}
+function parseBoundedBase64Url(value) {
+	return typeof value === "string" && value.length > 0 && value.length <= 8192 && /^[\w-]+$/u.test(value) ? value : null;
+}
+function parseOptionalString(value) {
+	return value === void 0 ? void 0 : parseNonEmptyString(value);
+}
+function isNonNegativeSafeInteger(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+function sponsoredNearAccountSideEffectStore(options) {
+	return createCloudflareD1VersionedJsonRecordStore({
+		database: options.database,
+		scope: {
+			namespace: options.namespace,
+			orgId: options.orgId,
+			projectId: options.projectId,
+			envId: options.envId
+		},
+		keyPrefix: "router-ab-yao-sponsored-account:",
+		encode: encodeSponsoredRecord,
+		parse: parseSponsoredNearAccountSideEffectRecord
+	});
+}
+/**
+* Creates the sponsored account through a durable claim. The signed transaction
+* and its hash are persisted before the broadcast, so a lost response replays
+* those exact bytes instead of building a second transaction under a fresh
+* nonce. Rebroadcasting an identical signed transaction reuses its hash, so the
+* network treats the retry as the same transaction.
+*/
+async function createSponsoredNamedNearAccountForOptions(options, input) {
+	const relayerAccount = options.relayerAccount;
+	const relayerPrivateKey = options.relayerPrivateKey;
+	const nearRpcUrl = options.nearRpcUrl;
+	const initialBalanceYocto = options.accountInitialBalance;
+	if (!relayerAccount || !relayerPrivateKey || !nearRpcUrl || !initialBalanceYocto) return {
+		kind: "rejected",
+		message: "Sponsored NEAR account creation is not configured on this server"
+	};
+	const relayerInput = {
+		accountId: input.accountId,
+		publicKey: input.publicKey,
+		relayerAccount,
+		relayerPrivateKey,
+		relayerPublicKey: options.relayerPublicKey,
+		nearRpcUrl,
+		initialBalanceYocto
+	};
+	const requestFingerprint = base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
+		kind: "sponsored_near_account_creation_v1",
+		walletId: input.walletId,
+		accountId: input.accountId,
+		publicKey: input.publicKey,
+		relayerAccountId: relayerAccount,
+		initialBalanceYocto
+	})));
+	const outcome = await runRouterAbEd25519YaoRegistrationSideEffectV1(sponsoredNearAccountSideEffectStore(options), {
+		kind: "prepared_resumable",
+		resumeAfterMs: 3e4,
+		operation: "finalize",
+		key: `sponsored-account:${input.idempotencyKey}`,
+		requestFingerprint,
+		nowMs: () => Date.now(),
+		prepare: prepareWalletSponsoredTransaction.bind(null, input.walletId, relayerInput),
+		derivePreparedArtifactFingerprint: fingerprintWalletSponsoredTransaction,
+		execute: executeWalletSponsoredTransaction.bind(null, {
+			walletId: input.walletId,
+			nearRpcUrl,
+			relayerAccountId: relayerAccount
+		})
+	});
+	switch (outcome.kind) {
+		case "executed":
+		case "exact_replay":
+			if (outcome.value.success && outcome.value.accountId && outcome.value.transactionHash) return {
+				kind: "created",
+				accountId: outcome.value.accountId,
+				transactionHash: outcome.value.transactionHash
+			};
+			return {
+				kind: "rejected",
+				message: outcome.value.message || outcome.value.error || "Sponsored NEAR account creation was rejected"
+			};
+		case "in_progress":
+		case "uncertain": return {
+			kind: "retryable",
+			message: outcome.kind === "uncertain" ? outcome.message : "Sponsored NEAR account creation is already in progress for this registration",
+			retryAfterMs: 3e4
+		};
+		case "request_conflict": return {
+			kind: "rejected",
+			message: "Sponsored NEAR account creation idempotency key conflicts with another request"
+		};
+	}
+}
+function parseWalletSponsoredTransaction(raw) {
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
+	const walletId = parseWalletId(Reflect.get(raw, "walletId"));
+	const transaction = parsePreparedSponsoredNearAccountCreation(Reflect.get(raw, "transaction"));
+	if (!walletId.ok || !transaction) return null;
+	return {
+		walletId: walletId.value,
+		transaction
+	};
+}
+async function fingerprintWalletSponsoredTransaction(prepared) {
+	const transactionFingerprint = await preparedSponsoredNearAccountCreationArtifactFingerprint(prepared.transaction);
+	return base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
+		walletId: prepared.walletId,
+		transactionFingerprint
+	})));
+}
+function encodeSponsoredRecord(record) {
+	return record;
+}
+async function prepareWalletSponsoredTransaction(walletId, input) {
+	const prepared = await prepareSponsoredNearAccountCreationWithRelayer(input);
+	if (!prepared.ok) throw new Error(prepared.message);
+	return {
+		walletId,
+		transaction: prepared.prepared
+	};
+}
+async function executeWalletSponsoredTransaction(context, prepared, attempt) {
+	if (prepared.walletId !== context.walletId) throw new Error("Sponsored NEAR account claim belongs to another wallet");
+	const broadcast = await broadcastPreparedSponsoredNearAccountCreation({
+		prepared: prepared.transaction,
+		nearRpcUrl: context.nearRpcUrl,
+		relayerAccountId: context.relayerAccountId,
+		reconcileFirst: attempt === "resumed"
+	});
+	if (broadcast.kind === "uncertain") throw new Error(broadcast.message);
+	return broadcast.result;
+}
+//#endregion
+export { createSponsoredNamedNearAccountForOptions };
+
+//# sourceMappingURL=d1SponsoredNearAccount.js.map

package/dist/esm/router/cloudflare/d1/oidc/d1OidcBoundary.js

@@ -1,7 +1,6 @@
+import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
 import "../../../../shared-ts/src/utils/encoders.js";
-import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { failedVerification } from "../../../../shared-ts/src/utils/failure.js";
 import { toArrayBufferCopy } from "../../../../core/authService/portableCrypto.js";
 import { toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";

package/dist/esm/router/cloudflare/d1/oidc/d1OidcVerificationService.js

@@ -1,15 +1,13 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { failedVerification } from "../../../../shared-ts/src/utils/failure.js";
-import { CloudflareD1OidcJwksCache, parseRs256JwtForVerification, validateGoogleIdTokenClaims, verifyRs256JwtSignature } from "./d1OidcBoundary.js";
 import { githubOAuthPublicConfig, verifyGithubOAuthCodeWithIdentityStore } from "../../../../core/authService/githubOAuth.js";
+import { verifyGoogleOidcToken } from "./googleOidcToken.js";
 //#region src/router/cloudflare/d1/oidc/d1OidcVerificationService.ts
 function errorMessage(error) {
 	return error instanceof Error ? error.message : String(error || "");
 }
 var CloudflareD1OidcVerificationService = class {
 	constructor(input) {
-		this.oidcJwksCache = new CloudflareD1OidcJwksCache();
 		this.googleOidcClientId = input.googleOidcClientId;
 		this.githubOAuth = input.githubOAuth;
 		this.identityStore = input.identityStore;
@@ -45,32 +43,7 @@ var CloudflareD1OidcVerificationService = class {
 	}
 	async verifyGoogleIdToken(input, linkIdentity) {
 		try {
-			const clientId = normalizeOptionalTrimmedString(this.googleOidcClientId);
-			if (!clientId) return failedVerification("not_configured", "Google OIDC is not configured on this Worker");
-			const idToken = normalizeOptionalTrimmedString(input.idToken ?? input.id_token);
-			if (!idToken) return failedVerification("invalid_body", "id_token is required");
-			const subtle = globalThis.crypto?.subtle;
-			if (!subtle) return failedVerification("unsupported", "WebCrypto (crypto.subtle) is unavailable in this runtime");
-			const parsed = parseRs256JwtForVerification({
-				token: idToken,
-				tokenLabel: "id_token"
-			});
-			if (!parsed.ok) return parsed;
-			const jwt = parsed.jwt;
-			const jwk = (await this.oidcJwksCache.getGoogleJwks()).keysByKid.get(jwt.kid);
-			if (!jwk) return failedVerification("unknown_kid", "Unknown Google key id (kid)");
-			const signature = await verifyRs256JwtSignature({
-				subtle,
-				jwt,
-				jwk,
-				tokenLabel: "id_token",
-				invalidSignatureMessage: "Invalid Google id_token signature"
-			});
-			if (!signature.ok) return signature;
-			const claims = validateGoogleIdTokenClaims({
-				payload: jwt.payload,
-				clientId
-			});
+			const claims = await verifyGoogleOidcToken(this.googleOidcClientId, input.idToken ?? input.id_token);
 			if (!claims.ok) return claims;
 			const providerSubject = `google:${claims.sub}`;
 			return {

package/dist/esm/router/cloudflare/d1/oidc/googleOidcToken.js

@@ -0,0 +1,41 @@
+import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
+import { failedVerification } from "../../../../shared-ts/src/utils/failure.js";
+import { CloudflareD1OidcJwksCache, parseRs256JwtForVerification, validateGoogleIdTokenClaims, verifyRs256JwtSignature } from "./d1OidcBoundary.js";
+//#region src/router/cloudflare/d1/oidc/googleOidcToken.ts
+const googleJwks = new CloudflareD1OidcJwksCache();
+/** Verifies provider proof without reading or mutating wallet identity state. */
+async function verifyGoogleOidcToken(configuredClientId, rawToken) {
+	const clientId = normalizeOptionalTrimmedString(configuredClientId);
+	if (!clientId) return failedVerification("not_configured", "Google OIDC is not configured on this Worker");
+	const token = normalizeOptionalTrimmedString(rawToken);
+	if (!token) return failedVerification("invalid_body", "id_token is required");
+	const subtle = globalThis.crypto?.subtle;
+	if (!subtle) return failedVerification("unsupported", "WebCrypto (crypto.subtle) is unavailable in this runtime");
+	const parsed = parseRs256JwtForVerification({
+		token,
+		tokenLabel: "id_token"
+	});
+	if (!parsed.ok) return parsed;
+	try {
+		const jwk = (await googleJwks.getGoogleJwks()).keysByKid.get(parsed.jwt.kid);
+		if (!jwk) return failedVerification("unknown_kid", "Unknown Google key id (kid)");
+		const signature = await verifyRs256JwtSignature({
+			subtle,
+			jwt: parsed.jwt,
+			jwk,
+			tokenLabel: "id_token",
+			invalidSignatureMessage: "Invalid Google id_token signature"
+		});
+		if (!signature.ok) return signature;
+		return validateGoogleIdTokenClaims({
+			payload: parsed.jwt.payload,
+			clientId
+		});
+	} catch {
+		return failedVerification("internal", "Google OIDC verification unavailable");
+	}
+}
+//#endregion
+export { verifyGoogleOidcToken };
+
+//# sourceMappingURL=googleOidcToken.js.map

package/dist/esm/router/cloudflare/d1/passkeyCustody/d1PasskeyCustodyRouteService.js

@@ -451,6 +451,11 @@ async function prepareRecoveryForRoute(assembly, request) {
 		reservationTtlMs: RECOVERY_RESERVATION_TTL_MS
 	});
 	if (prepared.kind !== "prepared") return prepared;
+	try {
+		await assembly.walletCustodyCommits.publishRecoveryOperation(walletId, targetIdentity.recoveryOperationId);
+	} catch {
+		return { kind: "routing_unavailable" };
+	}
 	try {
 		const manifest = await resolveWalletRecoveryKeyManifestV1({
 			registry: assembly.walletStore,

package/dist/esm/router/cloudflare/d1/passkeyCustody/d1WalletCustodyCommitStore.js

@@ -1,6 +1,6 @@
 import { parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { buildDelegatedWalletAuthorityV1, buildFullOwnerDelegatedWalletAuthorityV1, sameDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
+import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { sameWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { sameVerifiedActiveWalletAuthorityV1, walletAuthorityDigestsMatchV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
@@ -13,6 +13,7 @@ import { parseWalletRecoveryBackupAcknowledgementV1 } from "../../../../shared-t
 import "../../../../shared-ts/src/wallet-recovery/recoveryCodes.js";
 import { parseWalletRecoveryEnvelopeSetRecord } from "../../../../shared-ts/src/wallet-recovery/walletRecoveryEnvelopeSet.js";
 import { parseRecoveryCodeLocatorV1 } from "../../../../shared-ts/src/wallet-recovery/recoveryCodeLocator.js";
+import { reservePasskeyCredential } from "../../../../core/passkeyCredentialClaims.js";
 import { prepareD1WebAuthnCredentialBindingInsertStatement } from "../../../../core/WebAuthnCredentialBindingStore.js";
 import { prepareD1WebAuthnAuthenticatorInsertStatement } from "../webauthn/d1WebAuthnStore.js";
 import { D1WalletAuthorityStore, prepareD1WalletAuthorityPutStatement } from "../wallet/d1WalletAuthorityStore.js";
@@ -125,6 +126,8 @@ function isRecoveryCodeLocatorCollision(error) {
 }
 var CloudflareD1WalletCustodyCommitStore = class {
 	constructor(options) {
+		this.credentialClaims = options.credentialClaims;
+		this.recoveryRouting = options.recoveryRouting;
 		this.database = options.database;
 		this.scope = options.scope;
 		this.walletAuthMethodStore = options.walletAuthMethodStore ?? new D1WalletAuthMethodStore({
@@ -146,6 +149,27 @@ var CloudflareD1WalletCustodyCommitStore = class {
 			keyPrefix: PASSKEY_ENVELOPE_KEY_PREFIX
 		});
 	}
+	async publishRecoveryOperation(walletId, operationId) {
+		const result = await this.recoveryRouting?.publishRecovery({
+			kind: "operation",
+			walletId,
+			operationId
+		});
+		if (result && !result.ok) throw new Error("Recovery operation routing conflicts");
+	}
+	async claimRecoveryCodeRoutes(walletId, records) {
+		if (!this.recoveryRouting) return true;
+		const locators = [];
+		for (const record of records) {
+			if (record.walletId !== walletId) throw new Error("Recovery code routing wallet differs");
+			locators.push(record.locatorB64u);
+		}
+		return (await this.recoveryRouting.publishRecovery({
+			kind: "codes",
+			walletId,
+			locators
+		})).ok;
+	}
 	async readRecoveryCodeLocator(locatorB64u) {
 		const row = await this.database.prepare(`SELECT locator_b64u, wallet_id, recovery_key_id
            FROM wallet_recovery_code_locators
@@ -322,18 +346,33 @@ var CloudflareD1WalletCustodyCommitStore = class {
           LIMIT 1`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, challengeId).first() !== null;
 	}
 	/**
-	* Writes the envelope and the recovery set in one transaction.
-	*
-	* Both are inserts, never updates: `expectedVersion: null` fails if either
-	* key already holds a row, so a repeated registration cannot silently replace
-	* an established wallet's custody.
+	* Checks the commit and claims its recovery-code routes. The claim is an
+	* exact-retryable directory write that needs no local record, so a caller
+	* may run it beside its other remote effects and write afterwards.
 	*/
-	async commitRegistration(commit) {
+	async reserveRegistration(commit) {
 		const inconsistency = commitInconsistency(commit);
 		if (inconsistency !== null) return {
 			kind: "inconsistent",
 			reason: inconsistency
 		};
+		if (!await this.claimRecoveryCodeRoutes(commit.recoverySet.walletId, commit.recoveryCodeLocators)) return {
+			kind: "inconsistent",
+			reason: "recovery code locator already exists"
+		};
+		return {
+			kind: "reserved",
+			commit: () => this.commitReservedRegistration(commit)
+		};
+	}
+	/**
+	* Writes the envelope and the recovery set in one transaction.
+	*
+	* Both are inserts, never updates: `expectedVersion: null` fails if either
+	* key already holds a row, so a repeated registration cannot silently replace
+	* an established wallet's custody.
+	*/
+	async commitReservedRegistration(commit) {
 		const envelopeKey = passkeyCustodyEnvelopeRecordKey(passkeyCustodyEnvelopeLocatorOf(commit.envelope));
 		const recoverySetKey = walletRecoveryEnvelopeSetRecordKey(commit.recoverySet.walletId);
 		const recoveryBackupAcknowledgementKey = walletRecoveryBackupAcknowledgementRecordKey(commit.recoverySet.walletId);
@@ -465,6 +504,7 @@ var CloudflareD1WalletCustodyCommitStore = class {
 	* the explicit acknowledge route. Both rows are guarded against races.
 	*/
 	async replaceRecoveryEnvelopeSetAndPreserveBackupAcknowledgement(input) {
+		if (!await this.claimRecoveryCodeRoutes(input.record.walletId, input.recoveryCodeLocators)) return { kind: "collision" };
 		const acknowledgementKey = walletRecoveryBackupAcknowledgementRecordKey(input.record.walletId);
 		const existingAcknowledgement = await this.records.read(acknowledgementKey);
 		const mutations = [{
@@ -551,6 +591,11 @@ var CloudflareD1WalletCustodyCommitStore = class {
 			userId: input.authenticatorCommit.userId,
 			record: input.authenticatorCommit.authenticator
 		});
+		await reservePasskeyCredential(this.credentialClaims, {
+			walletId: targetMethod.walletId,
+			rpId: targetMethod.rpId,
+			credentialIdB64u: targetMethod.credentialIdB64u
+		});
 		const bindingStatement = prepareD1WebAuthnCredentialBindingInsertStatement({
 			database: this.database,
 			scope: this.tenantScope(),