@seams/wallet-server 0.7.3 → 0.9.0

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAddSignerService.js

@@ -1,10 +1,10 @@
 import { mpcMaterialActivationRefsEqual, parseWalletKeyId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
-import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
-import "../../../../shared-ts/src/utils/encoders.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
+import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
+import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseSecp256k1CompressedPublicKeyB64u } from "../../../../shared-ts/src/passkey-custody/primitives.js";
+import "../../../../shared-ts/src/utils/encoders.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseRouterAbEd25519YaoRegistrationAdmissionRequestV1, sameRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { ecdsaClientRootPublicKey33B64uFromString } from "../../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
@@ -12,17 +12,18 @@ import { deriveSigningRootId } from "../../../../shared-ts/src/threshold/signing
 import { buildRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaRegistrationRequestFactsV1, sameRouterAbEcdsaDerivationNormalSigningStateV1, sameRouterAbEcdsaRegistrationActivationReceiptV1, sameRouterAbEcdsaRegistrationRequestFactsV1, sameRouterAbEcdsaVerifiedClientActivationFactsV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { buildWalletEcdsaSignerActivationV1, extendEd25519WalletAuthorityWithEcdsa, isActiveEd25519WalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { registrationPreparationIdFromString } from "../../../../core/types.js";
-import { buildTenantRootIdentityFromAuthenticatedDeploymentV1 } from "../../../../shared-ts/src/tenant-root/tenantRootIdentity.js";
 import { addSignerIntentGrantFromString, computeAddSignerIntentDigestB64u, sameAddSignerIntentV1 } from "../../../../shared-ts/src/utils/registrationIntent.js";
-import { WalletAuthorityCommitConflictError } from "./d1WalletAuthorityStore.js";
+import { buildTenantRootIdentityFromAuthenticatedDeploymentV1 } from "../../../../shared-ts/src/tenant-root/tenantRootIdentity.js";
 import { buildRouterAbEd25519YaoRegistrationCapabilityRecordV1 } from "../../../domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery.js";
 import { buildRouterAbEd25519YaoAddSignerAdmissionRequestV1, createRouterAbEd25519YaoMaterialActivationRefV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js";
+import { WalletAuthorityCommitConflictError } from "./d1WalletAuthorityStore.js";
 import { parseRouterAbEd25519YaoRegistrationSideEffectRecordV1, runRouterAbEd25519YaoRegistrationSideEffectV1, throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
 import { buildYaoEd25519WalletSignerRecord, ed25519NearPublicKeyFromBytes, implicitNearAccountIdFromEd25519PublicKeyBytes } from "../ed25519Yao/d1Ed25519YaoWalletSigner.js";
 import { routerAbEcdsaStrictRegistrationRequestMatchesFacts } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
-import { buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, normalizeThresholdEcdsaChainTargets, parseD1AddSignerIntent, parseD1RuntimePolicyScope, parseD1StoredAddSignerAuth, parseD1StoredAddSignerIntent, parseD1StoredWalletAddSignerCeremony, parseD1WalletAddSignerFinalizeTerminalResponse, parseWalletIdForIntent, positiveIntegerArraysEqual, runtimePolicyScopeMatches, thresholdEcdsaChainTargetsEqual } from "../registration/d1RegistrationCeremonyRecords.js";
-import { buildD1EvmFamilyEcdsaRegistrationPrepare } from "../registration/d1EvmFamilyEcdsaRegistrationBranch.js";
+import { buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, normalizeThresholdEcdsaChainTargets, parseD1AddSignerIntent, parseD1RuntimePolicyScope, parseD1StoredAddSignerAuth, parseD1StoredAddSignerIntent, parseD1StoredWalletAddSignerCeremony, parseWalletIdForIntent, positiveIntegerArraysEqual, runtimePolicyScopeMatches, thresholdEcdsaChainTargetsEqual } from "../registration/d1RegistrationCeremonyRecords.js";
+import { buildD1WalletAddSignerFinalizePrepared, fingerprintD1WalletAddSignerFinalizePrepared, rejectUnexpectedWalletAddSignerFinalizePreparation, returnD1WalletAddSignerFinalizePrepared } from "./d1WalletAddSignerFinalizeRecord.js";
 import { routerAbEd25519YaoLifecycleDecisionLookupV1, routerAbEd25519YaoLifecycleDecisionV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoLifecycleDecision.js";
+import { buildD1EvmFamilyEcdsaRegistrationPrepare } from "../registration/d1EvmFamilyEcdsaRegistrationBranch.js";
 import { buildActivatedEcdsaFamilyBootstrap, ecdsaStrictRegistrationAuthority, exactEcdsaParticipantPair } from "../registration/d1WalletRegistrationService.js";
 import { computeWalletAddSignerEcdsaActivationRequestDigestB64u } from "../../../../shared-ts/src/utils/walletAddSignerActivation.js";
 //#region src/router/cloudflare/d1/wallet/d1WalletAddSignerService.ts
@@ -49,7 +50,7 @@ function sameEcdsaDerivationPublicIdentityV1(left, right) {
 	return left.derivationClientSharePublicKey33B64u === right.derivationClientSharePublicKey33B64u && left.relayerPublicKey33B64u === right.relayerPublicKey33B64u && left.groupPublicKey33B64u === right.groupPublicKey33B64u && left.ethereumAddress === right.ethereumAddress;
 }
 function sameEcdsaDerivationServerBootstrapV1(left, right) {
-	return left.formatVersion === right.formatVersion && left.walletId === right.walletId && left.evmFamilySigningKeySlotId === right.evmFamilySigningKeySlotId && left.ecdsaThresholdKeyId === right.ecdsaThresholdKeyId && left.relayerKeyId === right.relayerKeyId && left.applicationBindingDigestB64u === right.applicationBindingDigestB64u && left.contextBinding32B64u === right.contextBinding32B64u && sameEcdsaDerivationPublicIdentityV1(left.publicIdentity, right.publicIdentity) && left.clientShareRetryCounter === right.clientShareRetryCounter && left.relayerShareRetryCounter === right.relayerShareRetryCounter && left.publicTranscriptDigest32B64u === right.publicTranscriptDigest32B64u && left.keyHandle === right.keyHandle && left.signingRootId === right.signingRootId && left.signingRootVersion === right.signingRootVersion && left.thresholdEcdsaPublicKeyB64u === right.thresholdEcdsaPublicKeyB64u && left.ethereumAddress === right.ethereumAddress && left.relayerVerifyingShareB64u === right.relayerVerifyingShareB64u && positiveIntegerArraysEqual(left.participantIds, right.participantIds) && left.thresholdSessionId === right.thresholdSessionId && left.activationEpoch === right.activationEpoch && left.expiresAtMs === right.expiresAtMs && left.expiresAt === right.expiresAt && left.remainingUses === right.remainingUses && sameRouterAbEcdsaDerivationNormalSigningStateV1(left.routerAbEcdsaDerivationNormalSigning, right.routerAbEcdsaDerivationNormalSigning);
+	return left.formatVersion === right.formatVersion && left.walletId === right.walletId && left.evmFamilySigningKeySlotId === right.evmFamilySigningKeySlotId && left.ecdsaThresholdKeyId === right.ecdsaThresholdKeyId && left.relayerKeyId === right.relayerKeyId && left.applicationBindingDigestB64u === right.applicationBindingDigestB64u && left.contextBinding32B64u === right.contextBinding32B64u && sameEcdsaDerivationPublicIdentityV1(left.publicIdentity, right.publicIdentity) && left.clientShareRetryCounter === right.clientShareRetryCounter && left.relayerShareRetryCounter === right.relayerShareRetryCounter && left.keyHandle === right.keyHandle && left.signingRootId === right.signingRootId && left.signingRootVersion === right.signingRootVersion && left.thresholdEcdsaPublicKeyB64u === right.thresholdEcdsaPublicKeyB64u && left.ethereumAddress === right.ethereumAddress && left.relayerVerifyingShareB64u === right.relayerVerifyingShareB64u && positiveIntegerArraysEqual(left.participantIds, right.participantIds) && left.thresholdSessionId === right.thresholdSessionId && left.activationEpoch === right.activationEpoch && left.expiresAtMs === right.expiresAtMs && left.expiresAt === right.expiresAt && left.remainingUses === right.remainingUses && sameRouterAbEcdsaDerivationNormalSigningStateV1(left.routerAbEcdsaDerivationNormalSigning, right.routerAbEcdsaDerivationNormalSigning);
 }
 function walletAddSignerStartResponseFromCeremony(ceremony) {
 	const base = {
@@ -242,54 +243,6 @@ async function rejectUnexpectedWalletAddSignerStartPreparation() {
 async function fingerprintD1WalletAddSignerStartPrepared(prepared) {
 	return base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(prepared)));
 }
-function parseWalletAddSignerFinalizePrepared(raw) {
-	const record = addSignerRecordValue(raw);
-	if (!record) return null;
-	if (record.kind === "d1_wallet_add_signer_finalize_ed25519_prepared_v1") {
-		const finalizingAtMs = record.finalizingAtMs;
-		if (typeof finalizingAtMs !== "number" || !Number.isSafeInteger(finalizingAtMs) || finalizingAtMs <= 0) return null;
-		return {
-			kind: "d1_wallet_add_signer_finalize_ed25519_prepared_v1",
-			finalizingAtMs
-		};
-	}
-	if (record.kind !== "d1_wallet_add_signer_finalize_ecdsa_prepared_v1") return null;
-	const signerWriteAtMs = record.signerWriteAtMs;
-	return typeof signerWriteAtMs === "number" && Number.isSafeInteger(signerWriteAtMs) && signerWriteAtMs > 0 ? {
-		kind: "d1_wallet_add_signer_finalize_ecdsa_prepared_v1",
-		signerWriteAtMs
-	} : null;
-}
-function parseD1WalletAddSignerFinalizeSideEffectRecord(raw) {
-	return parseRouterAbEd25519YaoRegistrationSideEffectRecordV1(raw, {
-		operation: "add_signer_finalize",
-		parsePrepared: parseWalletAddSignerFinalizePrepared,
-		parseResponse: parseD1WalletAddSignerFinalizeTerminalResponse
-	});
-}
-async function fingerprintD1WalletAddSignerFinalizePrepared(prepared) {
-	return base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(prepared)));
-}
-async function returnD1WalletAddSignerFinalizePrepared(prepared) {
-	return prepared;
-}
-async function rejectUnexpectedWalletAddSignerFinalizePreparation() {
-	throw new Error("persisted add-signer finalize claim disappeared during reconciliation");
-}
-function buildD1WalletAddSignerFinalizePrepared(input) {
-	if (input.request.kind === "evm_family_ecdsa") return {
-		kind: "d1_wallet_add_signer_finalize_ecdsa_prepared_v1",
-		signerWriteAtMs: input.nowMs
-	};
-	if (input.ceremony.signerState.kind === "near_ed25519_yao_add_signer_finalizing") return {
-		kind: "d1_wallet_add_signer_finalize_ed25519_prepared_v1",
-		finalizingAtMs: input.ceremony.signerState.finalizingAtMs
-	};
-	return {
-		kind: "d1_wallet_add_signer_finalize_ed25519_prepared_v1",
-		finalizingAtMs: input.nowMs
-	};
-}
 function rejectedWalletAddSignerStartTerminal(code, message) {
 	return {
 		kind: "d1_wallet_add_signer_start_rejected_v1",
@@ -400,7 +353,6 @@ function storedEcdsaAddSignerBootstrap(bootstrap) {
 		publicIdentity: bootstrap.publicIdentity,
 		clientShareRetryCounter: bootstrap.clientShareRetryCounter,
 		relayerShareRetryCounter: bootstrap.relayerShareRetryCounter,
-		publicTranscriptDigest32B64u: bootstrap.publicTranscriptDigest32B64u,
 		keyHandle: bootstrap.keyHandle,
 		signingRootId: bootstrap.signingRootId,
 		signingRootVersion: bootstrap.signingRootVersion,
@@ -421,6 +373,7 @@ function sameEcdsaSignerActivation(left, right) {
 }
 var CloudflareD1WalletAddSignerService = class {
 	constructor(input) {
+		this.executionAuthority = input.executionAuthority;
 		this.getRegistrationCeremonyIntentStore = input.getRegistrationCeremonyIntentStore;
 		this.getEd25519YaoProductRegistration = input.getEd25519YaoProductRegistration;
 		this.ecdsaStrictRegistration = input.ecdsaStrictRegistration;
@@ -730,8 +683,11 @@ var CloudflareD1WalletAddSignerService = class {
 					signingWorkerId: yaoRuntime.signingWorkerId
 				})
 			});
+			const homeAdmission = await this.executionAuthority.admitEstablishedHome({ walletId: input.walletId });
+			if (!homeAdmission.ok) return rejectedWalletAddSignerStartTerminal(homeAdmission.code, homeAdmission.message);
 			const bound = await yaoRuntime.bindVerifiedIntent({
 				kind: "verified_add_signer_intent",
+				ownershipGeneration: homeAdmission.ownershipGeneration,
 				addSignerIntentGrant: storedIntent.grant,
 				intent: ed25519Intent,
 				admissionRequest,
@@ -859,9 +815,14 @@ var CloudflareD1WalletAddSignerService = class {
 				code: "invalid_state",
 				message: "ECDSA add-signer tenant root is not active"
 			};
+			const home = await this.executionAuthority.admitEstablishedHome({ walletId: ceremony.intent.walletId });
+			if (!home.ok) return home;
 			const registered = await this.ecdsaStrictRegistration.registerWithTenantRoot({
 				request: request.ecdsa.strictRegistration,
-				tenantRoot,
+				tenantRoot: {
+					...tenantRoot,
+					ownershipGeneration: home.ownershipGeneration
+				},
 				requestPolicy: {
 					policyVersion: WALLET_ADD_SIGNER_ROUTER_POLICY_VERSION,
 					requestDigestB64u: request.ecdsa.requestDigestB64u
@@ -1230,7 +1191,7 @@ var CloudflareD1WalletAddSignerService = class {
 			idempotencyKey
 		}) || await store.getAddSignerFinalizeReplayForCeremony(finalizeRequest.addSignerCeremonyId);
 		if (replay) {
-			if (!sameWalletAddSignerFinalizeRequestV1(replay.request, finalizeRequest)) return {
+			if (replay.response.walletId !== prepared.walletId || !sameWalletAddSignerFinalizeRequestV1(replay.request, finalizeRequest)) return {
 				ok: false,
 				code: "idempotency_conflict",
 				message: "idempotencyKey is already bound to another add-signer finalize request"
@@ -1243,6 +1204,7 @@ var CloudflareD1WalletAddSignerService = class {
 			code: "not_found",
 			message: "add-signer ceremony not found"
 		};
+		if (ceremony.intent.walletId !== prepared.walletId) throw new Error("Add-signer finalize claim belongs to another wallet");
 		if (finalizeRequest.kind === "near_ed25519") {
 			if (prepared.kind !== "d1_wallet_add_signer_finalize_ed25519_prepared_v1") throw new Error("Ed25519 add-signer finalize claim changed branch");
 			if (ceremony.intent.signerSelection.mode !== "ed25519" || ceremony.auth.kind !== "webauthn_assertion") return {
@@ -1530,6 +1492,6 @@ var CloudflareD1WalletAddSignerService = class {
 	}
 };
 //#endregion
-export { CloudflareD1WalletAddSignerService, parseD1WalletAddSignerFinalizeSideEffectRecord, parseD1WalletAddSignerStartSideEffectRecord };
+export { CloudflareD1WalletAddSignerService, parseD1WalletAddSignerStartSideEffectRecord };
 
 //# sourceMappingURL=d1WalletAddSignerService.js.map

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthMethodService.js

@@ -1,10 +1,9 @@
 import { parseChallengeSubjectId, parseEmailOtpChallengeId, parseOrgId, parseProviderSubject, parseWalletAuthMethodId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
+import { buildDelegatedWalletAuthorityV1, buildFullOwnerPermissionsV1, sameDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
 import "../../../../shared-ts/src/utils/encoders.js";
-import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
-import { buildDelegatedWalletAuthorityV1, buildFullOwnerPermissionsV1, sameDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { parseWalletAddAuthMethodRegistrationOptions } from "../../../../shared-ts/src/utils/addAuthMethodRegistration.js";
 import { normalizeRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { buildEmailOtpWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
@@ -24,7 +23,7 @@ import { toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";
 import { d1HostIsWithinWebAuthnRpId, resolveD1AddAuthMethodExistingAuth, resolveD1AddSignerExistingAuth, verifyD1LinkedDeviceFreshRevokeProofV1, walletAuthAuthorityFromRegistrationAuthority } from "./d1WalletAuthMethodBoundary.js";
 import { parseWalletIdForIntent } from "../registration/d1RegistrationCeremonyRecords.js";
 import { runtimePolicyScopeKey } from "../../../../core/EmailOtpRecords.js";
-import { expiredGoogleEmailOtpRegistrationAttemptRecord, pendingGoogleEmailOtpRegistrationAttemptWithSelectedCandidate } from "../emailOtp/d1GoogleEmailOtpRegistrationRecords.js";
+import { expiredGoogleEmailOtpRegistrationAttemptRecord } from "../emailOtp/d1GoogleEmailOtpRegistrationRecords.js";
 import { admitAddWalletAuthMethod } from "../../../../shared-ts/src/utils/addWalletAuthMethod.js";
 import { computeWalletAuthMethodRevocationProofDigestV1 } from "./d1WalletAuthMethodRevocationReplayStore.js";
 //#region src/router/cloudflare/d1/wallet/d1WalletAuthMethodService.ts
@@ -864,7 +863,7 @@ var CloudflareD1WalletAuthMethodService = class {
 							deviceInfo: credential.device
 						}
 					}),
-					this.webAuthnStore.prepareCredentialBindingInsertStatement(binding),
+					await this.webAuthnStore.prepareCredentialBindingInsertStatement(binding),
 					...this.getWalletAuthMethodStore().prepareV2InsertStatements(authMethod),
 					...replayStatements,
 					...atomicCompanionStatements
@@ -1459,44 +1458,7 @@ var CloudflareD1WalletAuthMethodService = class {
 	* Ed25519 leg arrives, so that leg must address the same rows.
 	*/
 	async readActiveRegistrationIdentity(authority) {
-		let record;
-		switch (authority.kind) {
-			case "passkey":
-				record = await this.getWalletAuthMethodStore().getPasskeyV2({
-					rpId: authority.rpId,
-					credentialIdB64u: authority.credentialIdB64u
-				});
-				break;
-			case "email_otp":
-				record = await this.getWalletAuthMethodStore().getEmailOtpV2({
-					walletId: String(authority.walletId),
-					emailHashHex: authority.emailHashHex
-				});
-				break;
-			default: return unreachableRegistrationStartAuthority(authority);
-		}
-		if (!record || record.status !== "active" || record.walletId !== authority.walletId) return null;
-		if (authority.kind === "passkey") {
-			if (record.kind !== "passkey" || record.rpId !== authority.rpId || record.credentialIdB64u !== authority.credentialIdB64u || record.credentialPublicKeyB64u !== authority.credentialPublicKeyB64u) return null;
-		} else if (record.kind !== "email_otp" || record.emailHashHex !== authority.emailHashHex || record.registrationAuthorityId !== authority.registrationAuthorityId) return null;
-		const walletAuthority = await this.walletAuthorityStore.readById(record.walletAuthorityId);
-		if (!walletAuthority || walletAuthority.state !== "active" || walletAuthority.walletId !== record.walletId) return null;
-		return {
-			walletAuthorityId: record.walletAuthorityId,
-			walletAuthMethodId: record.walletAuthMethodId,
-			authority: walletAuthority,
-			authMethod: record
-		};
-	}
-	async readActiveRegistrationAuthority(authority) {
-		const identity = await this.readActiveRegistrationIdentity(authority);
-		if (!identity) return null;
-		const walletAuthority = await this.walletAuthorityStore.readById(identity.walletAuthorityId);
-		if (!walletAuthority || walletAuthority.state !== "active" || walletAuthority.walletId !== authority.walletId || walletAuthority.authorityId !== identity.walletAuthorityId) return null;
-		return {
-			authority: walletAuthority,
-			walletAuthMethodId: identity.walletAuthMethodId
-		};
+		return await this.walletAuthorityStore.readActiveRegistrationIdentity(authority);
 	}
 	/**
 	* Verifies a revocation's source proof: bound to this operation, and from a
@@ -1932,11 +1894,6 @@ var CloudflareD1WalletAuthMethodService = class {
 				code: "registration_candidate_mismatch",
 				message: "Google Email OTP registration candidate does not match walletId"
 			};
-			if (attempt.walletId !== selectedOfferCandidate.walletId || attempt.selectedCandidateId !== selectedOfferCandidate.candidateId || attempt.collisionCounter !== selectedOfferCandidate.collisionCounter) await this.googleEmailOtpRegistrationAttempts.put(pendingGoogleEmailOtpRegistrationAttemptWithSelectedCandidate({
-				record: attempt,
-				candidate: selectedOfferCandidate,
-				updatedAtMs: Date.now()
-			}));
 			if (runtimePolicyScopeKey(attempt.runtimePolicyScope) !== runtimePolicyScopeKeyForRegistrationIntent(input.intent.runtimePolicyScope)) return {
 				ok: false,
 				code: "runtime_policy_scope_mismatch",
@@ -1961,6 +1918,13 @@ var CloudflareD1WalletAuthMethodService = class {
 				code: "duplicate_auth_method",
 				message: "Email OTP auth method is already registered"
 			};
+			const claimed = await this.googleEmailOtpRegistrationAttempts.claimCandidate({
+				attemptId: attempt.attemptId,
+				candidateId: selectedOfferCandidate.candidateId,
+				walletId: finalWalletId,
+				intentDigest: input.expectedDigestB64u
+			});
+			if (!claimed.ok) return claimed;
 			return {
 				ok: true,
 				authority: {

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthorityStore.js

@@ -1,140 +1,38 @@
 import { mpcMaterialActivationRefsEqual, parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseWalletAuthorityId, parseWalletId, parseWalletRecoveryOperationId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
-import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { parseDelegatedWalletPermissionSetV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { parseWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { buildRevokedWalletAuthorityV1, computeWalletAuthorityDigestB64u, parseWalletAuthorityV1, parseWalletSignerActivationSetV1, walletAuthorityDigestsMatchV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { buildWalletSessionCapabilitySubjectsV1 } from "../../../../authorization/domain.js";
-import { d1ChangedRows, formatD1ExecStatement, parseD1JsonColumn } from "../../../../storage/d1Sql.js";
+import { d1ChangedRows, parseD1JsonColumn } from "../../../../storage/d1Sql.js";
 import { prepareD1WalletPutSignerStatement } from "../../../../core/d1WalletStore.js";
-import { ensureWalletAuthMethodStoreD1SchemaV2, prepareD1WalletAuthMethodV2PutStatement } from "../../../../core/d1WalletAuthMethodStore.js";
+import { prepareD1WalletAuthMethodV2PutStatement } from "../../../../core/d1WalletAuthMethodStore.js";
 import { prepareD1WalletSessionAuthorityProjectionStatements } from "../authorization/walletSessionAuthorityProjection.js";
 //#region src/router/cloudflare/d1/wallet/d1WalletAuthorityStore.ts
-const WALLET_AUTHORITY_STORE_D1_SCHEMA_SQL = Object.freeze([
-	`
-    CREATE TABLE IF NOT EXISTS wallet_authorities (
-      namespace TEXT NOT NULL,
-      org_id TEXT NOT NULL,
-      project_id TEXT NOT NULL,
-      env_id TEXT NOT NULL,
-      authority_id TEXT NOT NULL,
-      wallet_id TEXT NOT NULL,
-      device_id TEXT NOT NULL,
-      provenance_kind TEXT NOT NULL,
-      enrollment_id TEXT,
-      source_authority_id TEXT,
-      link_session_id TEXT,
-      recovery_operation_id TEXT,
-      continuity_authority_id TEXT,
-      lifecycle_state TEXT NOT NULL,
-      permissions_json TEXT NOT NULL,
-      signer_activations_json TEXT NOT NULL,
-      local_install_package_set_digest_b64u TEXT,
-      signer_activation_set_digest_b64u TEXT NOT NULL,
-      authority_digest_b64u TEXT NOT NULL,
-      revocation_epoch INTEGER NOT NULL,
-      record_json TEXT NOT NULL,
-      created_at_ms INTEGER NOT NULL,
-      updated_at_ms INTEGER NOT NULL,
-      activated_at_ms INTEGER,
-      revoked_at_ms INTEGER,
-      PRIMARY KEY (namespace, org_id, project_id, env_id, authority_id),
-      CHECK (length(authority_id) > 0),
-      CHECK (length(wallet_id) > 0),
-      CHECK (length(device_id) > 0),
-      CHECK (provenance_kind IN ('wallet_registration', 'device_link', 'wallet_recovery')),
-      CHECK (lifecycle_state IN ('pending_local_install', 'active', 'revoked')),
-      CHECK (length(permissions_json) > 0 AND json_valid(permissions_json)),
-      CHECK (length(signer_activations_json) > 0 AND json_valid(signer_activations_json)),
-      CHECK (length(record_json) > 0 AND json_valid(record_json)),
-      CHECK (length(signer_activation_set_digest_b64u) > 0),
-      CHECK (length(authority_digest_b64u) > 0),
-      CHECK (revocation_epoch >= 0),
-      CHECK (created_at_ms >= 0),
-      CHECK (updated_at_ms >= created_at_ms),
-      CHECK (
-        (provenance_kind = 'wallet_registration'
-          AND enrollment_id IS NULL
-          AND source_authority_id IS NULL
-          AND link_session_id IS NULL
-          AND recovery_operation_id IS NULL
-          AND continuity_authority_id IS NULL)
-        OR
-        (provenance_kind = 'device_link'
-          AND enrollment_id IS NOT NULL AND length(enrollment_id) > 0
-          AND source_authority_id IS NOT NULL AND length(source_authority_id) > 0
-          AND link_session_id IS NOT NULL AND length(link_session_id) > 0
-          AND recovery_operation_id IS NULL
-          AND continuity_authority_id IS NULL)
-        OR
-        (provenance_kind = 'wallet_recovery'
-          AND enrollment_id IS NULL
-          AND source_authority_id IS NULL
-          AND link_session_id IS NULL
-          AND recovery_operation_id IS NOT NULL
-          AND length(recovery_operation_id) > 0
-          AND continuity_authority_id IS NOT NULL
-          AND length(continuity_authority_id) > 0)
-      ),
-      CHECK (
-        (lifecycle_state = 'pending_local_install'
-          AND local_install_package_set_digest_b64u IS NOT NULL
-          AND length(local_install_package_set_digest_b64u) > 0
-          AND activated_at_ms IS NULL
-          AND revoked_at_ms IS NULL
-          AND revocation_epoch = 0)
-        OR
-        (lifecycle_state = 'active'
-          AND local_install_package_set_digest_b64u IS NULL
-          AND activated_at_ms IS NOT NULL
-          AND revoked_at_ms IS NULL)
-        OR
-        (lifecycle_state = 'revoked'
-          AND local_install_package_set_digest_b64u IS NULL
-          AND activated_at_ms IS NOT NULL
-          AND revoked_at_ms IS NOT NULL)
-      ),
-      CHECK (json_extract(record_json, '$.authorityId') = authority_id),
-      CHECK (json_extract(record_json, '$.walletId') = wallet_id),
-      CHECK (json_extract(record_json, '$.state') = lifecycle_state),
-      CHECK (json_extract(record_json, '$.revocationEpoch') = revocation_epoch),
-      CHECK (json_extract(record_json, '$.authorityDigestB64u') = authority_digest_b64u),
-      CHECK (
-        json_extract(record_json, '$.signerActivationSetDigestB64u')
-          = signer_activation_set_digest_b64u
-      )
-    )
-  `,
-	`
-    CREATE UNIQUE INDEX IF NOT EXISTS wallet_authorities_active_device_uidx
-      ON wallet_authorities (
-        namespace, org_id, project_id, env_id, wallet_id, device_id
-      )
-      WHERE lifecycle_state <> 'revoked'
-  `,
-	`
-    CREATE UNIQUE INDEX IF NOT EXISTS wallet_authorities_enrollment_uidx
-      ON wallet_authorities (
-        namespace, org_id, project_id, env_id, wallet_id, enrollment_id
-      )
-      WHERE enrollment_id IS NOT NULL
-  `,
-	`
-    CREATE INDEX IF NOT EXISTS wallet_authorities_inventory_idx
-      ON wallet_authorities (
-        namespace, org_id, project_id, env_id, wallet_id, lifecycle_state,
-        updated_at_ms, authority_id
-      )
-  `,
-	`
-    CREATE TABLE IF NOT EXISTS wallet_authority_cas_guard (
-      guard_id INTEGER PRIMARY KEY CHECK (guard_id = 1)
-    )
-  `,
-	`
-    INSERT OR IGNORE INTO wallet_authority_cas_guard (guard_id) VALUES (1)
-  `
-]);
+function registrationMethodSelector(authority) {
+	switch (authority.kind) {
+		case "passkey": return {
+			predicate: "kind = 'passkey' AND rp_id = ? AND credential_id_b64u = ?",
+			values: [authority.rpId, authority.credentialIdB64u]
+		};
+		case "email_otp": return {
+			predicate: "kind = 'email_otp' AND wallet_id = ? AND email_hash_hex = ?",
+			values: [authority.walletId, authority.emailHashHex]
+		};
+		default: return assertNeverRegistrationAuthority(authority);
+	}
+}
+function registrationMethodMatches(expected, method) {
+	switch (expected.kind) {
+		case "passkey": return method.kind === "passkey" && method.rpId === expected.rpId && method.credentialIdB64u === expected.credentialIdB64u && method.credentialPublicKeyB64u === expected.credentialPublicKeyB64u;
+		case "email_otp": return method.kind === "email_otp" && method.emailHashHex === expected.emailHashHex && method.registrationAuthorityId === expected.registrationAuthorityId;
+		default: return assertNeverRegistrationAuthority(expected);
+	}
+}
+function assertNeverRegistrationAuthority(value) {
+	throw new Error(`Unsupported registration authority: ${String(value)}`);
+}
 function normalizeScope(input) {
 	return {
 		namespace: requireScopeString(input.namespace, "namespace"),
@@ -385,7 +283,6 @@ var WalletAuthorityCommitConflictError = class extends Error {
 };
 var D1WalletAuthorityStore = class {
 	constructor(input) {
-		this.schemaReady = false;
 		this.database = input.database;
 		this.scope = normalizeScope(input.scope ?? {
 			namespace: input.namespace ?? "",
@@ -393,13 +290,6 @@ var D1WalletAuthorityStore = class {
 			projectId: input.projectId ?? "",
 			envId: input.envId ?? ""
 		});
-		this.ensureSchemaOnUse = input.ensureSchema !== false;
-	}
-	async ensureSchema() {
-		if (!this.ensureSchemaOnUse || this.schemaReady) return;
-		for (const statement of WALLET_AUTHORITY_STORE_D1_SCHEMA_SQL) await this.database.exec(formatD1ExecStatement(statement));
-		await ensureWalletAuthMethodStoreD1SchemaV2({ database: this.database });
-		this.schemaReady = true;
 	}
 	/**
 	* Commits an added signer: its signer records, the authority extended with
@@ -409,7 +299,6 @@ var D1WalletAuthorityStore = class {
 	* credentials and deletes its unredeemed hosted exchange codes.
 	*/
 	async extendActiveAuthority(input) {
-		await this.ensureSchema();
 		const statements = [
 			...input.walletSigners.map((record) => prepareD1WalletPutSignerStatement({
 				database: this.database,
@@ -447,7 +336,6 @@ var D1WalletAuthorityStore = class {
 		if (results.length !== statements.length || results.some((result) => !result.success)) throw new Error("D1 wallet authority extension returned an incomplete batch result");
 	}
 	async readById(authorityId) {
-		await this.ensureSchema();
 		const row = await this.database.prepare(`SELECT *
            FROM wallet_authorities
           WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
@@ -456,8 +344,37 @@ var D1WalletAuthorityStore = class {
 		if (!row) return null;
 		return await parseD1WalletAuthorityRow(row);
 	}
+	/** Reads the method and its authority from one database snapshot. */
+	async readActiveRegistrationIdentity(expected) {
+		const selector = registrationMethodSelector(expected);
+		const row = await this.database.prepare(`SELECT authority.*, method.record_json AS auth_method_record_json,
+                method.wallet_auth_method_id, method.status AS auth_method_status
+           FROM (
+             SELECT * FROM wallet_auth_methods
+              WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
+                AND ${selector.predicate}
+              ORDER BY created_at_ms ASC LIMIT 1
+           ) AS method
+           JOIN wallet_authorities AS authority
+             ON authority.namespace = method.namespace
+            AND authority.org_id = method.org_id
+            AND authority.project_id = method.project_id
+            AND authority.env_id = method.env_id
+            AND authority.authority_id = method.wallet_authority_id
+            AND authority.wallet_id = method.wallet_id`).bind(...scopeValues(this.scope), ...selector.values).first();
+		if (!row) return null;
+		const method = parseWalletAuthMethodRecordV2(parseD1JsonColumn(row.auth_method_record_json));
+		if (!method || method.status !== "active" || method.status !== row.auth_method_status || method.walletAuthMethodId !== row.wallet_auth_method_id || method.walletId !== expected.walletId || !registrationMethodMatches(expected, method)) return null;
+		const authority = await parseD1WalletAuthorityRow(row);
+		if (authority.state !== "active" || authority.walletId !== method.walletId || authority.authorityId !== method.walletAuthorityId) return null;
+		return {
+			walletAuthorityId: authority.authorityId,
+			walletAuthMethodId: method.walletAuthMethodId,
+			authority,
+			authMethod: method
+		};
+	}
 	async readByWalletAndDevice(input) {
-		await this.ensureSchema();
 		const row = await this.database.prepare(`SELECT *
            FROM wallet_authorities
           WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
@@ -476,7 +393,6 @@ var D1WalletAuthorityStore = class {
 	* link-session CAS, keeping the pending transition one atomic batch.
 	*/
 	async commitPendingAuthorityWithStatements(input, additionalStatements) {
-		await this.ensureSchema();
 		assertPendingCommitInput(input);
 		if (!await walletAuthorityDigestsMatchV1(input.authority)) throw new Error("pending wallet authority digest does not match its canonical record");
 		const existing = await this.readById(input.authority.authorityId);
@@ -539,7 +455,6 @@ var D1WalletAuthorityStore = class {
 	* same transaction as authority and auth-method visibility.
 	*/
 	async activatePendingAuthorityWithStatements(input, additionalStatements) {
-		await this.ensureSchema();
 		assertActivationInput(input);
 		if (!await walletAuthorityDigestsMatchV1(input.pendingAuthority)) return {
 			kind: "conflict",
@@ -617,7 +532,6 @@ var D1WalletAuthorityStore = class {
 		};
 	}
 	async listForWallet(input) {
-		await this.ensureSchema();
 		if (!Number.isSafeInteger(input.limit) || input.limit < 1 || input.limit > 1e3) throw new Error("wallet authority page limit is invalid");
 		const state = input.lifecycleState ?? "";
 		const cursorTime = input.cursor?.updatedAtMs ?? 0;
@@ -645,7 +559,6 @@ var D1WalletAuthorityStore = class {
 		};
 	}
 	async revokeWalletAuthMethod(input) {
-		await this.ensureSchema();
 		const expectedEpoch = requireNonNegativeInteger(input.expectedAuthorityRevocationEpoch, "expected authority revocation epoch");
 		const requestedAtMs = requireNonNegativeInteger(input.requestedAtMs, "requestedAtMs");
 		const activeCountRow = await this.database.prepare(`SELECT COUNT(*) AS count