@seams/wallet-server 0.8.0 → 0.9.1

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService.js

@@ -1,10 +1,10 @@
 import { mpcMaterialActivationRefsEqual, parseLinkDeviceSessionId, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWalletKeyId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseDeviceId, parsePrincipalId, parseTenantId, parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
+import { buildDelegatedWalletAuthorityV1, parseDelegatedWalletPermissionSetV1, validateDelegatedWalletAuthorityAttenuationV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
-import { buildDelegatedWalletAuthorityV1, parseDelegatedWalletPermissionSetV1, validateDelegatedWalletAuthorityAttenuationV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { routerAbMpcMaterialActivationRefFromWire, routerAbMpcMaterialActivationRefToWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseRouterAbEd25519YaoApplicationBindingFactsV1, parseRouterAbEd25519YaoCeremonyBindingV1, sameRouterAbEd25519YaoActivationBindingV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { assertLinkedDeviceOrdinaryMaterialSourceContributionMatchesContextV1, parseLinkedDeviceEcdsaSourceContributionPackageV1, parseLinkedDeviceEcdsaSourceDerivationV1, parseLinkedDeviceOrdinaryMaterialSourceContributionV1 } from "../../../../shared-ts/src/device-linking/sourceContribution.js";
@@ -25,6 +25,7 @@ import "../../../../core/deviceLinking/requestProof.js";
 import { reservePasskeyCredential } from "../../../../core/passkeyCredentialClaims.js";
 import { prepareD1WebAuthnCredentialBindingInsertStatement } from "../../../../core/WebAuthnCredentialBindingStore.js";
 import { prepareD1WebAuthnAuthenticatorInsertStatement } from "../webauthn/d1WebAuthnStore.js";
+import { admitD1EstablishedWalletHome } from "../registration/d1WalletExecutionAuthority.js";
 import { findInstalledEcdsaAuthority, installedEcdsaAuthorityChain, projectInstalledEcdsaAuthority } from "./installedEcdsaAuthority.js";
 import { buildAuthorityActiveSessionRecordV1, buildAuthorityPendingLocalInstallSessionRecordV1 } from "../../../../core/deviceLinking/linkedDeviceSessionRecord.js";
 import { linkedDeviceX25519RecipientPublicKeyB64uV1 } from "./d1LinkedDeviceSourceContributionPreparationPlanner.js";
@@ -738,6 +739,9 @@ var D1LinkedDeviceAuthorityInstallServiceV1 = class {
 	}
 	async reserveSignerMaterial(input, sourceContributionPreparation) {
 		assertRecipientRequestsMatchManifest(input);
+		const admitted = await admitD1EstablishedWalletHome(this.options.database, this.options.scope, { walletId: input.walletId });
+		if (!admitted.ok) throw new Error(admitted.message);
+		const ownershipGeneration = admitted.ownershipGeneration;
 		let ed25519;
 		let ecdsa;
 		let ed25519Preparation;
@@ -777,6 +781,7 @@ var D1LinkedDeviceAuthorityInstallServiceV1 = class {
 				assertPreparationActivationMatches(targetMaterialActivation, workerPreparation.sourceContribution.targetMaterialActivation);
 				const reservation = await this.options.reservationService.reserveOrdinaryInactiveSignerMaterialV1({
 					kind: "ordinary_ed25519_signer_material_reservation_request_v1",
+					ownershipGeneration,
 					keyFamily: "ed25519",
 					signer,
 					plannedActivationRef: targetMaterialActivation,
@@ -792,6 +797,7 @@ var D1LinkedDeviceAuthorityInstallServiceV1 = class {
 			assertPreparationActivationMatches(targetMaterialActivation, workerPreparation.sourceContribution.binding.target.activation);
 			const reservation = await this.options.reservationService.reserveOrdinaryInactiveSignerMaterialV1({
 				kind: "ordinary_ecdsa_signer_material_reservation_request_v1",
+				ownershipGeneration,
 				keyFamily: "ecdsa_secp256k1",
 				signer,
 				plannedActivationRef: targetMaterialActivation,
@@ -814,10 +820,12 @@ var D1LinkedDeviceAuthorityInstallServiceV1 = class {
 				ordinarySignerMaterialPreparations: sourceContributionPreparation,
 				serverReservationIds: {
 					ed25519: {
+						ownershipGeneration,
 						reservationId: ed25519.serverMaterial.reservationId,
 						preparation: ed25519Preparation
 					},
 					ecdsa_secp256k1: {
+						ownershipGeneration,
 						reservationId: ecdsa.serverMaterial.reservationId,
 						preparation: ecdsaPreparation
 					}
@@ -834,6 +842,7 @@ var D1LinkedDeviceAuthorityInstallServiceV1 = class {
 				},
 				ordinarySignerMaterialPreparations: sourceContributionPreparation,
 				serverReservationIds: { ed25519: {
+					ownershipGeneration,
 					reservationId: ed25519.serverMaterial.reservationId,
 					preparation: ed25519Preparation
 				} }
@@ -849,6 +858,7 @@ var D1LinkedDeviceAuthorityInstallServiceV1 = class {
 			},
 			ordinarySignerMaterialPreparations: sourceContributionPreparation,
 			serverReservationIds: { ecdsa_secp256k1: {
+				ownershipGeneration,
 				reservationId: ecdsa.serverMaterial.reservationId,
 				preparation: ecdsaPreparation
 			} }
@@ -862,6 +872,7 @@ var D1LinkedDeviceAuthorityInstallServiceV1 = class {
 				const reservation = stored.serverReservationIds.ed25519;
 				if (!reservation || !packageValue) throw new Error("server reservation for ed25519 is missing");
 				await activation.activateOrdinaryInactiveSignerMaterialV1({
+					ownershipGeneration: reservation.ownershipGeneration,
 					keyFamily: "ed25519",
 					reservationId: reservation.reservationId,
 					materialActivation: packageValue.materialActivation,
@@ -877,6 +888,7 @@ var D1LinkedDeviceAuthorityInstallServiceV1 = class {
 			const reservation = stored.serverReservationIds.ecdsa_secp256k1;
 			if (!reservation || !packageValue) throw new Error("server reservation for ECDSA is missing");
 			await activation.activateOrdinaryInactiveSignerMaterialV1({
+				ownershipGeneration: reservation.ownershipGeneration,
 				keyFamily: "ecdsa_secp256k1",
 				reservationId: reservation.reservationId,
 				materialActivation: packageValue.materialActivation,
@@ -1616,7 +1628,11 @@ function parseServerReservationIds(raw) {
 }
 function parseEd25519ServerReservationRecord(raw) {
 	const record = requireRecord(raw, "Ed25519 server reservation");
-	requireExactKeys(record, ["reservationId", "preparation"], "Ed25519 server reservation");
+	requireExactKeys(record, Object.hasOwn(record, "ownershipGeneration") ? [
+		"reservationId",
+		"preparation",
+		"ownershipGeneration"
+	] : ["reservationId", "preparation"], "Ed25519 server reservation");
 	const preparationRecord = requireRecord(record.preparation, "Ed25519 reservation preparation");
 	requireExactKeys(preparationRecord, [
 		"kind",
@@ -1631,6 +1647,7 @@ function parseEd25519ServerReservationRecord(raw) {
 	const applicationBinding = parseRouterAbEd25519YaoApplicationBindingFactsV1(preparationRecord.applicationBinding);
 	if (targetBinding.operation !== "registration") throw new Error("Ed25519 target binding must use registration");
 	return {
+		ownershipGeneration: storedReservationGeneration(record),
 		reservationId: requireReservationId(record.reservationId, "Ed25519 server reservation id"),
 		preparation: {
 			kind: "ordinary_ed25519_signer_material_reservation_preparation_v1",
@@ -1642,7 +1659,11 @@ function parseEd25519ServerReservationRecord(raw) {
 }
 function parseEcdsaServerReservationRecord(raw) {
 	const record = requireRecord(raw, "ECDSA server reservation");
-	requireExactKeys(record, ["reservationId", "preparation"], "ECDSA server reservation");
+	requireExactKeys(record, Object.hasOwn(record, "ownershipGeneration") ? [
+		"reservationId",
+		"preparation",
+		"ownershipGeneration"
+	] : ["reservationId", "preparation"], "ECDSA server reservation");
 	const preparationRecord = requireRecord(record.preparation, "ECDSA reservation preparation");
 	requireExactKeys(preparationRecord, [
 		"kind",
@@ -1651,6 +1672,7 @@ function parseEcdsaServerReservationRecord(raw) {
 	], "ECDSA reservation preparation");
 	if (preparationRecord.kind !== "ordinary_ecdsa_signer_material_reservation_preparation_v1") throw new Error("ECDSA reservation preparation kind is invalid");
 	return {
+		ownershipGeneration: storedReservationGeneration(record),
 		reservationId: requireReservationId(record.reservationId, "ECDSA server reservation id"),
 		preparation: {
 			kind: "ordinary_ecdsa_signer_material_reservation_preparation_v1",
@@ -1865,6 +1887,11 @@ function requireTime(raw, label) {
 function errorMessage(error) {
 	return error instanceof Error ? error.message : String(error);
 }
+function storedReservationGeneration(record) {
+	const generation = Object.hasOwn(record, "ownershipGeneration") ? record.ownershipGeneration : 1;
+	if (typeof generation !== "number" || !Number.isSafeInteger(generation) || generation < 1) throw new Error("Stored reservation ownership generation is invalid");
+	return generation;
+}
 //#endregion
 export { D1LinkedDeviceAuthorityInstallServiceV1, parseInstalledEcdsaCustodySnapshotV1, readD1LinkedDeviceEcdsaSourceV1, readD1LinkedDeviceEd25519SourceV1 };
 

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceOwnerAuthorizationProvider.js

@@ -1,9 +1,9 @@
 import { mpcMaterialActivationRefsEqual, parseEcdsaRelayerKeyId, parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseProviderSubject } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseWalletSessionAuthorizationId, parseWalletSessionId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { buildFullOwnerDelegatedWalletAuthorityV1, hasDelegatedWalletPermissionV1, validateDelegatedWalletAuthorityAttenuationV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { buildFullOwnerDelegatedWalletAuthorityV1, hasDelegatedWalletPermissionV1, validateDelegatedWalletAuthorityAttenuationV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { parseSecp256k1CompressedPublicKeyB64u } from "../../../../shared-ts/src/passkey-custody/primitives.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { deriveRouterAbEd25519YaoApplicationBindingDigestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519YaoDigests.js";

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRequestProofNonceStore.js

@@ -1,7 +1,7 @@
 import { parseLinkDeviceSessionId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { isObject, requireCanonicalString } from "../../../../shared-ts/src/utils/validation.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { isObject, requireCanonicalString } from "../../../../shared-ts/src/utils/validation.js";
 import { d1ChangedRows } from "../../../../storage/d1Sql.js";
 //#region src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRequestProofNonceStore.ts
 const NONCE_TABLE = "linked_device_request_proof_nonces";

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionRecords.js

@@ -1,6 +1,6 @@
 import { parseWalletAuthorityId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { requireCanonicalString } from "../../../../shared-ts/src/utils/validation.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { parseLinkedDeviceSessionRecordV1 } from "../../../../core/deviceLinking/linkedDeviceSessionRecord.js";
 //#region src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionRecords.ts
 function parseD1LinkedDeviceSessionRowV1(row) {

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetCredentialProvider.js

@@ -1,8 +1,8 @@
 import { hasControlCharacter, mpcMaterialActivationRefsEqual, parseWebAuthnCredentialIdB64u } from "../../../../shared-ts/src/utils/domainIds.js";
+import { requireCanonicalString, requireRecord } from "../../../../shared-ts/src/utils/validation.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u, sha256Utf8DigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { requireCanonicalString, requireRecord } from "../../../../shared-ts/src/utils/validation.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1 } from "../../../../shared-ts/src/device-linking/sourceContribution.js";
 import { parseLinkedDeviceTargetCredentialRegistrationResultV1, parseLinkedDeviceTargetCredentialRegistrationV1, parseLinkedDeviceTargetPreparationV1 } from "../../../../shared-ts/src/device-linking/parsers.js";

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetPlanner.js

@@ -1,6 +1,6 @@
 import { parseWalletAuthMethodId, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { hasDelegatedWalletPermissionV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
+import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { buildLinkedDeviceTargetPreparationV1 } from "../../../../shared-ts/src/device-linking/parsers.js";
 import { computeLinkedDevicePasskeyTargetConfigurationDigestV1 } from "../../../../shared-ts/src/device-linking/digests.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceVerifiedLinkBuilder.js

@@ -1,9 +1,9 @@
 import { parseWebAuthnCredentialIdB64u } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { buildDelegatedWalletAuthorityV1, validateDelegatedWalletAuthorityAttenuationV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
 import { sha256Utf8DigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { buildDelegatedWalletAuthorityV1, validateDelegatedWalletAuthorityAttenuationV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { buildExactAdministeredSignerManifestV1 } from "../../../../shared-ts/src/device-linking/delegatedActivationPlan.js";
 import { walletAuthorityDigestsMatchV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { sourceKeyManifestDigestForFamilyV1 } from "../../../../core/deviceLinking/linkedDeviceSessionRecord.js";

package/dist/esm/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoLifecycleDecisionStore.js

@@ -16,16 +16,25 @@ var CloudflareD1Ed25519YaoLifecycleDecisionStoreV1 = class {
 		};
 	}
 	async read(lifecycleId) {
-		const row = await this.database.prepare(`SELECT decision_kind, decision_id, wallet_id
+		const result = await this.prepareRead(lifecycleId).all();
+		return this.parseRead(lifecycleId, result);
+	}
+	prepareRead(lifecycleId) {
+		return this.database.prepare(`SELECT decision_kind, decision_id, wallet_id
            FROM yao_lifecycle_decisions
           WHERE namespace = ?1
             AND org_id = ?2
             AND project_id = ?3
             AND env_id = ?4
-            AND lifecycle_id = ?5`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, lifecycleId).first();
+            AND lifecycle_id = ?5`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, lifecycleId);
+	}
+	parseRead(lifecycleId, result) {
+		if (!result.success) throw new Error("Ed25519 Yao lifecycle decision read failed");
+		const row = result.results?.[0];
 		if (!row) return null;
 		const kind = parseDecisionKind(row.decision_kind);
 		if (!kind) throw new Error("Stored Ed25519 Yao lifecycle decision has an unknown kind");
+		if (typeof row.decision_id !== "string" || typeof row.wallet_id !== "string") throw new Error("Stored Ed25519 Yao lifecycle decision has invalid identities");
 		return {
 			lifecycleId,
 			kind,

package/dist/esm/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoProductRegistrationPartitionedStateStore.js

@@ -1,21 +1,111 @@
+import { ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordJsonV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore.js";
 import { createCloudflareD1VersionedJsonRecordStore } from "../versionedJson/d1VersionedJsonRecordStore.js";
-import { createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordJsonV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore.js";
+import { D1WalletCeremonyActivity, ceremonySettled } from "./d1WalletCeremonyActivity.js";
+import { collectChangedStateWallets, lifecycleWriteFenceStatements } from "./d1Ed25519YaoStateWriteFence.js";
 //#region src/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoProductRegistrationPartitionedStateStore.ts
 function createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1(options) {
-	const records = createCloudflareD1VersionedJsonRecordStore({
+	return createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1(new D1LifecycleRecords(options, createLifecycleRecords(options)));
+}
+var D1LifecycleRecords = class {
+	constructor(options, records) {
+		this.options = options;
+		this.records = records;
+		this.observed = /* @__PURE__ */ new Map();
+	}
+	async readMany(keys) {
+		const entries = await this.records.readMany(keys);
+		this.observed.clear();
+		for (const entry of entries) if (entry.result.kind === "present") this.observed.set(entry.key, {
+			version: entry.result.version,
+			value: structuredClone(entry.result.value)
+		});
+		return entries;
+	}
+	async putMany(mutations, companion) {
+		const keys = [];
+		const wallets = /* @__PURE__ */ new Set();
+		const previousValues = /* @__PURE__ */ new Map();
+		for (const mutation of mutations) {
+			if (mutation.expectedVersion === null) continue;
+			const observed = this.observed.get(mutation.key);
+			if (observed?.version === mutation.expectedVersion) previousValues.set(mutation.key, observed.value);
+			else keys.push(mutation.key);
+		}
+		this.observed.clear();
+		const previous = keys.length === 0 ? [] : await this.records.readMany(keys);
+		for (const entry of previous) if (entry.result.kind === "present") previousValues.set(entry.key, entry.result.value);
+		const activity = new D1WalletCeremonyActivity(this.options.database, this.options.scope);
+		const projections = [];
+		for (const mutation of mutations) {
+			const previousValue = previousValues.get(mutation.key);
+			const before = previousValue === void 0 ? null : readPartition(previousValue);
+			const after = readPartition(mutation.value);
+			const changedWallets = /* @__PURE__ */ new Set();
+			collectChangedStateWallets(before, after, changedWallets);
+			for (const walletId of changedWallets) wallets.add(walletId);
+			if (after.kind === "router_ab_ed25519_yao_product_registration_ceremony_record_v1") {
+				if (changedWallets.size > 1) throw new Error("Ceremony wallet owner changed");
+				for (const walletId of changedWallets) projections.push(activity.project(this.records.storageKey(mutation.key), walletId, ceremonySettled(after.value)));
+			}
+		}
+		return this.records.putManyWithAdditionalStatements(mutations, [
+			...lifecycleWriteFenceStatements(this.options, wallets),
+			...projections,
+			...companion?.statements ?? []
+		], companion?.executeBatch);
+	}
+};
+function identityVersionedJsonObject(value) {
+	return value;
+}
+function readPartition(value) {
+	const record = parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1(value);
+	if (!record) throw new Error("Lifecycle mutation contains an invalid partition record");
+	return record;
+}
+async function evictWalletEd25519CapabilityCache(options, walletId) {
+	const records = createLifecycleRecords(options);
+	const key = ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1;
+	const current = await records.read(key);
+	if (current.kind !== "present") return;
+	const partition = readPartition(current.value);
+	if (partition.kind !== "router_ab_ed25519_yao_product_registration_shared_record_v1") throw new Error("Capability cache has an invalid partition kind");
+	const capabilities = new Map(partition.value.recoveryCapabilities);
+	const identities = new Map(partition.value.recoveryIdentityCapabilities);
+	const removed = /* @__PURE__ */ new Set();
+	for (const [capabilityKey, capability] of capabilities) {
+		if (capability.identity.applicationBinding.wallet_id !== walletId) continue;
+		if (capability.kind === "suspended") throw new Error("Relocation cleanup cannot evict an unsettled capability");
+		capabilities.delete(capabilityKey);
+		removed.add(capabilityKey);
+	}
+	if (removed.size === 0) return;
+	for (const [identity, capabilityKey] of identities) if (removed.has(capabilityKey)) identities.delete(identity);
+	const value = encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1({
+		kind: "router_ab_ed25519_yao_product_registration_shared_record_v1",
+		value: {
+			kind: partition.value.kind,
+			recoveryCapabilities: capabilities,
+			recoveryIdentityCapabilities: identities,
+			recoverySessions: partition.value.recoverySessions,
+			exportAuthorizationNonceOwners: partition.value.exportAuthorizationNonceOwners,
+			exportAuthorizationUncertainOwners: partition.value.exportAuthorizationUncertainOwners
+		}
+	});
+	if ((await records.putMany([{
+		key,
+		value,
+		expectedVersion: current.version
+	}])).kind !== "stored") throw new Error("Capability cache changed during cleanup");
+}
+function createLifecycleRecords(options) {
+	return createCloudflareD1VersionedJsonRecordStore({
 		...options,
 		encode: identityVersionedJsonObject,
 		parse: parseRouterAbEd25519YaoProductRegistrationPartitionRecordJsonV1
 	});
-	return createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1({
-		readMany: records.readMany.bind(records),
-		putMany: async (mutations, companion) => await records.putManyWithAdditionalStatements(mutations, companion?.statements ?? [])
-	});
-}
-function identityVersionedJsonObject(value) {
-	return value;
 }
 //#endregion
-export { createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1 };
+export { createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1, evictWalletEd25519CapabilityCache };
 
 //# sourceMappingURL=d1Ed25519YaoProductRegistrationPartitionedStateStore.js.map

package/dist/esm/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoStateWriteFence.js

@@ -0,0 +1,92 @@
+import { parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { parseRouterAbEd25519YaoRecoveryAdmissionRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
+//#region src/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoStateWriteFence.ts
+function collectChangedStateWallets(before, after, wallets) {
+	if (before && before.kind !== after.kind) throw new Error("Lifecycle partition kind changed");
+	if (after.kind === "router_ab_ed25519_yao_product_registration_ceremony_record_v1") {
+		collectCeremonyWallets(after, wallets);
+		if (before) collectCeremonyWallets(before, wallets);
+		return;
+	}
+	if (before?.kind === "router_ab_ed25519_yao_product_registration_ceremony_record_v1") throw new Error("Lifecycle partition kind changed");
+	collectChangedRecoveryCapabilities(before?.value ?? null, after.value, wallets);
+	const empty = /* @__PURE__ */ new Map();
+	collectChangedOwners(before?.value.exportAuthorizationNonceOwners ?? empty, after.value.exportAuthorizationNonceOwners, walletOwner, wallets);
+	collectChangedOwners(before?.value.exportAuthorizationUncertainOwners ?? empty, after.value.exportAuthorizationUncertainOwners, walletOwner, wallets);
+	collectChangedOwners(before?.value.recoverySessions ?? empty, after.value.recoverySessions, recoverySessionOwner, wallets);
+}
+function collectChangedRecoveryCapabilities(before, after, wallets) {
+	for (const [key, capability] of after.recoveryCapabilities) {
+		const previous = before?.recoveryCapabilities.get(key);
+		if (JSON.stringify(previous) === JSON.stringify(capability)) continue;
+		if (previous) wallets.add(walletOwner(previous.identity.applicationBinding.wallet_id));
+		wallets.add(walletOwner(capability.identity.applicationBinding.wallet_id));
+	}
+	for (const [key, capability] of before?.recoveryCapabilities ?? []) if (capability.kind === "suspended" && !after.recoveryCapabilities.has(key)) wallets.add(walletOwner(capability.identity.applicationBinding.wallet_id));
+	const identities = new Set([...before?.recoveryIdentityCapabilities.keys() ?? [], ...after.recoveryIdentityCapabilities.keys()]);
+	for (const identity of identities) {
+		const previousKey = before?.recoveryIdentityCapabilities.get(identity);
+		const nextKey = after.recoveryIdentityCapabilities.get(identity);
+		if (previousKey === nextKey) continue;
+		if (nextKey === void 0 && previousKey !== void 0 && !after.recoveryCapabilities.has(previousKey)) continue;
+		if (previousKey !== void 0) {
+			const previous = before?.recoveryCapabilities.get(previousKey);
+			if (!previous) throw new Error("Recovery identity index has no capability owner");
+			wallets.add(walletOwner(previous.identity.applicationBinding.wallet_id));
+		}
+		if (nextKey !== void 0) {
+			const next = after.recoveryCapabilities.get(nextKey);
+			if (!next) throw new Error("Recovery identity index has no capability owner");
+			wallets.add(walletOwner(next.identity.applicationBinding.wallet_id));
+		}
+	}
+}
+function walletOwner(value) {
+	const parsed = parseWalletId(value);
+	if (!parsed.ok) throw new Error("Lifecycle wallet owner is invalid");
+	return parsed.value;
+}
+function recoverySessionOwner(value) {
+	const parsed = parseRouterAbEd25519YaoRecoveryAdmissionRequestV1(JSON.parse(value));
+	if (!parsed.ok) throw new Error("Stored recovery session request is invalid");
+	return walletOwner(parsed.value.application_binding.wallet_id);
+}
+function collectChangedOwners(before, after, owner, wallets) {
+	for (const key of new Set([...before.keys(), ...after.keys()])) {
+		const oldValue = before.get(key);
+		const newValue = after.get(key);
+		if (oldValue === newValue) continue;
+		if (oldValue !== void 0) wallets.add(owner(oldValue));
+		if (newValue !== void 0) wallets.add(owner(newValue));
+	}
+}
+function collectCeremonyWallets(record, wallets) {
+	if (record.kind === "router_ab_ed25519_yao_product_registration_shared_record_v1") return;
+	const state = record.value;
+	const owners = /* @__PURE__ */ new Set();
+	for (const authority of state.authorization.authorities) owners.add(authority.admissionRequest.application_binding.wallet_id);
+	for (const registration of state.registration.states.values()) owners.add(registration.admissionRequest.application_binding.wallet_id);
+	for (const recovery of state.recovery.recoveries.values()) owners.add(recovery.context.authorization.walletId);
+	for (const exported of state.export.exports.values()) owners.add(exported.request.application_binding.wallet_id);
+	if (owners.size > 1 || owners.size === 0 && (state.registration.admissionClaims.size > 0 || state.registration.dispatchRoots.size > 0 || state.registration.lifecycleSessions.size > 0)) throw new Error("Ceremony mutation has no unique wallet owner");
+	for (const owner of owners) wallets.add(walletOwner(owner));
+}
+function lifecycleWriteFenceStatements(options, wallets) {
+	const statements = [];
+	for (const walletId of wallets) statements.push(options.database.prepare(`
+      INSERT INTO router_ab_yao_versioned_json_cas_guard (guard_id)
+      SELECT 1 WHERE EXISTS (
+        SELECT 1 FROM wallet_relocation_authorization_fences
+        WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+          AND wallet_id = ?5
+      ) OR EXISTS (
+        SELECT 1 FROM wallet_execution_generations
+        WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+          AND wallet_id = ?5 AND registration_completion = 'cancelled'
+      )`).bind(options.scope.namespace, options.scope.orgId, options.scope.projectId, options.scope.envId, walletId));
+	return statements;
+}
+//#endregion
+export { collectChangedStateWallets, lifecycleWriteFenceStatements };
+
+//# sourceMappingURL=d1Ed25519YaoStateWriteFence.js.map

package/dist/esm/router/cloudflare/d1/ed25519Yao/d1WalletCeremonyActivity.js

@@ -0,0 +1,77 @@
+import { prepareD1TenantStatement } from "../../../../core/d1TenantStore.js";
+//#region src/router/cloudflare/d1/ed25519Yao/d1WalletCeremonyActivity.ts
+var D1WalletCeremonyActivity = class {
+	constructor(database, scope) {
+		this.database = database;
+		this.scope = scope;
+	}
+	async hasPending(walletId) {
+		return await prepareD1TenantStatement(this.database, this.scope, `
+      SELECT 1 AS pending FROM wallet_ceremony_activity
+      WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+        AND wallet_id = ?5 AND settled = 0 LIMIT 1`, [walletId]).first() !== null;
+	}
+	project(recordKey, walletId, settled) {
+		return prepareD1TenantStatement(this.database, this.scope, `
+      INSERT INTO wallet_ceremony_activity
+        (namespace, org_id, project_id, env_id, record_key, wallet_id, settled)
+      VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7)
+      ON CONFLICT (namespace, org_id, project_id, env_id, record_key)
+      DO UPDATE SET wallet_id = excluded.wallet_id, settled = excluded.settled`, [
+			recordKey,
+			walletId,
+			settled ? 1 : 0
+		]);
+	}
+};
+function ceremonySettled(ceremony) {
+	if (ceremony.registration.admissionClaims.size > 0) return false;
+	for (const registration of ceremony.registration.states.values()) if (!registrationSettled(registration)) return false;
+	for (const recovery of ceremony.recovery.recoveries.values()) if (!recoverySettled(recovery)) return false;
+	for (const exported of ceremony.export.exports.values()) if (!exportSettled(exported)) return false;
+	return true;
+}
+function registrationSettled(state) {
+	switch (state.kind) {
+		case "activated": return state.activationConsumerBinding !== null;
+		case "admitted": return true;
+		case "executing":
+		case "failed": return false;
+		default: return assertNever(state);
+	}
+}
+function recoverySettled(state) {
+	switch (state.kind) {
+		case "promoted":
+		case "superseded": return true;
+		case "admitting":
+		case "admission_failed":
+		case "admitted":
+		case "executing":
+		case "execution_interrupted":
+		case "execution_failed":
+		case "staged":
+		case "activating":
+		case "activation_failed": return false;
+		default: return assertNever(state);
+	}
+}
+function exportSettled(state) {
+	switch (state.kind) {
+		case "completed": return true;
+		case "authorized":
+		case "admitting":
+		case "admission_failed":
+		case "admitted":
+		case "executing":
+		case "execution_failed": return false;
+		default: return assertNever(state);
+	}
+}
+function assertNever(value) {
+	throw new Error(`Unknown ceremony state: ${String(value)}`);
+}
+//#endregion
+export { D1WalletCeremonyActivity, ceremonySettled };
+
+//# sourceMappingURL=d1WalletCeremonyActivity.js.map

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeIssuer.js

@@ -21,6 +21,9 @@ var CloudflareD1EmailOtpChallengeIssuer = class {
 		this.emailOtpEnrollments = input.emailOtpEnrollments;
 		this.emailOtpRateLimits = input.emailOtpRateLimits;
 	}
+	challengeExpiresAt(nowMs) {
+		return nowMs + this.config.challengeTtlMs;
+	}
 	async create(input) {
 		try {
 			const userId = normalizeOptionalTrimmedString(input.userId);
@@ -61,8 +64,9 @@ var CloudflareD1EmailOtpChallengeIssuer = class {
 			}
 			if (!challengeEmail) return failure("recovery_email_missing", "Authenticated identity does not include a recovery email");
 			const nowMs = Date.now();
+			if (input.action === WALLET_EMAIL_OTP_ACTIONS.relocation && (!Number.isSafeInteger(input.expiresAtMs) || input.expiresAtMs <= nowMs || input.expiresAtMs > nowMs + this.config.challengeTtlMs)) return failure("invalid_body", "Relocation OTP expiry is invalid");
 			await this.emailOtpChallenges.pruneExpired(nowMs);
-			if (input.reuseActiveChallenge === true) {
+			if (input.reuseActiveChallenge === true && action !== WALLET_EMAIL_OTP_ACTIONS.relocation) {
 				const existing = await this.emailOtpChallenges.findLatestActive({
 					challengeSubjectId: userId,
 					walletId,
@@ -94,6 +98,7 @@ var CloudflareD1EmailOtpChallengeIssuer = class {
 				}
 			}
 			const rateLimit = await this.emailOtpRateLimits.consume({
+				kind: "wallet",
 				scope: "challenge",
 				action,
 				userId,
@@ -102,7 +107,7 @@ var CloudflareD1EmailOtpChallengeIssuer = class {
 				clientIp
 			});
 			if (!rateLimit.ok) return rateLimit;
-			await this.emailOtpChallenges.deleteActiveOverflow({
+			if (action !== WALLET_EMAIL_OTP_ACTIONS.relocation) await this.emailOtpChallenges.deleteActiveOverflow({
 				challengeSubjectId: userId,
 				walletId,
 				orgId,
@@ -112,10 +117,10 @@ var CloudflareD1EmailOtpChallengeIssuer = class {
 				nowMs,
 				maxActiveChallenges: this.config.maxActiveChallengesPerContext
 			});
-			const challengeId = secureRandomBase64Url(16, "email otp challenge ids");
+			const challengeId = action === WALLET_EMAIL_OTP_ACTIONS.relocation ? `relocation:${ownerProofBindingDigest}` : secureRandomBase64Url(16, "email otp challenge ids");
 			const otpCode = generateNumericOtp(this.config.codeLength);
-			const expiresAtMs = nowMs + this.config.challengeTtlMs;
-			const record = emailOtpChallengeRecord({
+			const expiresAtMs = input.action === WALLET_EMAIL_OTP_ACTIONS.relocation ? input.expiresAtMs : nowMs + this.config.challengeTtlMs;
+			let record = emailOtpChallengeRecord({
 				challengeId,
 				challengeSubjectId: userId,
 				walletId,
@@ -129,17 +134,18 @@ var CloudflareD1EmailOtpChallengeIssuer = class {
 				expiresAtMs,
 				maxAttempts: this.config.maxAttempts
 			});
-			await this.emailOtpChallenges.put(record);
+			if (action === WALLET_EMAIL_OTP_ACTIONS.relocation) record = await this.emailOtpChallenges.putIfAbsent(record);
+			else await this.emailOtpChallenges.put(record);
 			const delivery = await this.emailOtpDelivery.deliverEmailOtpCode(record, input.requestOrigin);
 			if (!delivery.ok) {
-				await this.emailOtpChallenges.delete(challengeId);
+				if (action !== WALLET_EMAIL_OTP_ACTIONS.relocation) await this.emailOtpChallenges.delete(challengeId);
 				return delivery;
 			}
 			return {
 				ok: true,
 				challenge: {
 					challengeId,
-					issuedAtMs: nowMs,
+					issuedAtMs: record.createdAtMs,
 					expiresAtMs,
 					challengeSubjectId: userId,
 					walletId,

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeStore.js

@@ -87,20 +87,26 @@ var CloudflareD1EmailOtpChallengeStore = class {
 		}
 		return deletedRecords;
 	}
+	async putIfAbsent(record) {
+		await emailOtpChallengeRows.insertIfAbsent(this.prepare, record).run();
+		const stored = await this.read(record.challengeId);
+		if (!stored || stored.walletId !== record.walletId || stored.orgId !== record.orgId || stored.challengeSubjectId !== record.challengeSubjectId || stored.email !== record.email || stored.action !== record.action || stored.operation !== record.operation || stored.ownerProofBindingDigest !== record.ownerProofBindingDigest || stored.expiresAtMs !== record.expiresAtMs || stored.createdAtMs > record.createdAtMs) throw new Error("Email OTP challenge identity conflict");
+		return stored;
+	}
 	async put(record) {
 		await emailOtpChallengeRows.insert(this.prepare, record).run();
 	}
 	async updateAttemptCount(record, attemptCount) {
 		const next = emailOtpChallengeWithAttemptCount(record, attemptCount);
 		await this.prepare(`UPDATE email_otp_challenges
-          SET record_json = ?,
-              otp_code = ?,
-              expires_at_ms = ?
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND challenge_id = ?`, [
+          SET record_json = ?5,
+              otp_code = ?6,
+              expires_at_ms = ?7
+        WHERE namespace = ?1
+          AND org_id = ?2
+          AND project_id = ?3
+          AND env_id = ?4
+          AND challenge_id = ?8`, [
 			JSON.stringify(next),
 			next.otpCode,
 			next.expiresAtMs,