@seams/wallet-server 0.5.0

package/dist/esm/core/EmailOtpStores.js

@@ -0,0 +1,1460 @@
+import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
+import { isPlainObject } from "../shared-ts/src/utils/validation.js";
+import { d1ChangedRows, formatD1ExecStatement, resolveD1DatabaseFromConfig } from "../storage/d1Sql.js";
+import "./defaultConfigsServer.js";
+import { parseCurrentEmailOtpAuthStateRecord, parseCurrentEmailOtpAuthStateRow, parseCurrentEmailOtpChallengeRecord, parseCurrentEmailOtpChallengeRow, parseCurrentEmailOtpGrantRecord, parseCurrentEmailOtpGrantRow, parseCurrentEmailOtpUnlockChallengeRecord, parseCurrentEmailOtpUnlockChallengeRow, parseCurrentEmailOtpWalletEnrollmentRecord, parseCurrentEmailOtpWalletEnrollmentRow, parseCurrentGoogleEmailOtpRegistrationAttemptRecord, parseCurrentGoogleEmailOtpRegistrationAttemptRow } from "./EmailOtpRecords.js";
+//#region src/core/EmailOtpStores.ts
+function runtimePolicyScopeKey(scope) {
+	if (!scope) return "";
+	return `${scope.orgId}\n${scope.projectId}\n${scope.envId}\n${scope.signingRootVersion}`;
+}
+function registrationAttemptMatchesStartedScope(record, input) {
+	return record.providerSubject === input.providerSubject && record.email === input.email && record.ownerProofBindingDigest === input.ownerProofBindingDigest && record.runtimePolicyScope?.orgId === input.orgId && runtimePolicyScopeKey(record.runtimePolicyScope) === runtimePolicyScopeKey(input.runtimePolicyScope) && (record.state === "started" || record.state === "key_finalized") && record.expiresAtMs > input.nowMs;
+}
+function registrationAttemptMatchesReplacementScope(record, input) {
+	return record.providerSubject === input.providerSubject && record.email === input.email && record.ownerProofBindingDigest !== input.ownerProofBindingDigest && record.runtimePolicyScope?.orgId === input.orgId && runtimePolicyScopeKey(record.runtimePolicyScope) === runtimePolicyScopeKey(input.runtimePolicyScope) && (record.state === "started" || record.state === "key_finalized") && record.expiresAtMs > input.nowMs;
+}
+const EMAIL_OTP_STORE_D1_SCHEMA_SQL = Object.freeze([
+	`
+    CREATE TABLE IF NOT EXISTS email_otp_challenges (
+      namespace TEXT NOT NULL,
+      org_id TEXT NOT NULL,
+      project_id TEXT NOT NULL,
+      env_id TEXT NOT NULL,
+      challenge_id TEXT NOT NULL,
+      challenge_subject_id TEXT NOT NULL,
+      wallet_id TEXT NOT NULL,
+      record_org_id TEXT NOT NULL,
+      otp_channel TEXT NOT NULL,
+      owner_proof_binding_digest TEXT NOT NULL,
+      action TEXT NOT NULL,
+      operation TEXT NOT NULL,
+      otp_code TEXT NOT NULL,
+      record_json TEXT NOT NULL,
+      created_at_ms INTEGER NOT NULL,
+      expires_at_ms INTEGER NOT NULL,
+      PRIMARY KEY (namespace, org_id, project_id, env_id, challenge_id),
+      CHECK (length(challenge_id) > 0),
+      CHECK (length(challenge_subject_id) > 0),
+      CHECK (length(wallet_id) > 0),
+      CHECK (otp_channel = 'email_otp'),
+      CHECK (length(owner_proof_binding_digest) > 0),
+      CHECK (length(action) > 0),
+      CHECK (length(operation) > 0),
+      CHECK (length(otp_code) > 0),
+      CHECK (json_valid(record_json)),
+      CHECK (created_at_ms > 0),
+      CHECK (expires_at_ms > created_at_ms)
+    )
+  `,
+	`
+    CREATE INDEX IF NOT EXISTS email_otp_challenges_context_idx
+      ON email_otp_challenges (
+        namespace,
+        org_id,
+        project_id,
+        env_id,
+        challenge_subject_id,
+        wallet_id,
+        record_org_id,
+        otp_channel,
+        owner_proof_binding_digest,
+        action,
+        operation,
+        expires_at_ms
+      )
+  `,
+	`
+    CREATE INDEX IF NOT EXISTS email_otp_challenges_expires_idx
+      ON email_otp_challenges (
+        namespace,
+        org_id,
+        project_id,
+        env_id,
+        expires_at_ms
+      )
+  `,
+	`
+    CREATE TABLE IF NOT EXISTS email_otp_grants (
+      namespace TEXT NOT NULL,
+      org_id TEXT NOT NULL,
+      project_id TEXT NOT NULL,
+      env_id TEXT NOT NULL,
+      grant_token TEXT NOT NULL,
+      user_id TEXT NOT NULL,
+      wallet_id TEXT NOT NULL,
+      record_org_id TEXT NOT NULL,
+      challenge_id TEXT NOT NULL,
+      action TEXT NOT NULL,
+      record_json TEXT NOT NULL,
+      issued_at_ms INTEGER NOT NULL,
+      expires_at_ms INTEGER NOT NULL,
+      PRIMARY KEY (namespace, org_id, project_id, env_id, grant_token),
+      CHECK (length(grant_token) > 0),
+      CHECK (length(user_id) > 0),
+      CHECK (length(wallet_id) > 0),
+      CHECK (length(challenge_id) > 0),
+      CHECK (length(action) > 0),
+      CHECK (json_valid(record_json)),
+      CHECK (issued_at_ms > 0),
+      CHECK (expires_at_ms > issued_at_ms)
+    )
+  `,
+	`
+    CREATE INDEX IF NOT EXISTS email_otp_grants_expires_idx
+      ON email_otp_grants (
+        namespace,
+        org_id,
+        project_id,
+        env_id,
+        expires_at_ms
+      )
+  `,
+	`
+    CREATE TABLE IF NOT EXISTS email_otp_wallet_enrollments (
+      namespace TEXT NOT NULL,
+      org_id TEXT NOT NULL,
+      project_id TEXT NOT NULL,
+      env_id TEXT NOT NULL,
+      wallet_id TEXT NOT NULL,
+      provider_user_id TEXT NOT NULL,
+      record_org_id TEXT NOT NULL,
+      verified_email TEXT NOT NULL,
+      record_json TEXT NOT NULL,
+      created_at_ms INTEGER NOT NULL,
+      updated_at_ms INTEGER NOT NULL,
+      PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_id),
+      CHECK (length(wallet_id) > 0),
+      CHECK (length(provider_user_id) > 0),
+      CHECK (length(record_org_id) > 0),
+      CHECK (length(verified_email) > 0),
+      CHECK (json_valid(record_json)),
+      CHECK (created_at_ms > 0),
+      CHECK (updated_at_ms > 0)
+    )
+  `,
+	`
+    CREATE INDEX IF NOT EXISTS email_otp_wallet_enrollments_provider_idx
+      ON email_otp_wallet_enrollments (
+        namespace,
+        org_id,
+        project_id,
+        env_id,
+        record_org_id,
+        provider_user_id,
+        updated_at_ms
+      )
+  `,
+	`
+    CREATE TABLE IF NOT EXISTS email_otp_auth_states (
+      namespace TEXT NOT NULL,
+      org_id TEXT NOT NULL,
+      project_id TEXT NOT NULL,
+      env_id TEXT NOT NULL,
+      wallet_id TEXT NOT NULL,
+      provider_user_id TEXT NOT NULL,
+      record_org_id TEXT NOT NULL,
+      record_json TEXT NOT NULL,
+      created_at_ms INTEGER NOT NULL,
+      updated_at_ms INTEGER NOT NULL,
+      PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_id),
+      CHECK (length(wallet_id) > 0),
+      CHECK (length(provider_user_id) > 0),
+      CHECK (length(record_org_id) > 0),
+      CHECK (json_valid(record_json)),
+      CHECK (created_at_ms > 0),
+      CHECK (updated_at_ms > 0)
+    )
+  `,
+	`
+    CREATE TABLE IF NOT EXISTS email_otp_unlock_challenges (
+      namespace TEXT NOT NULL,
+      org_id TEXT NOT NULL,
+      project_id TEXT NOT NULL,
+      env_id TEXT NOT NULL,
+      challenge_id TEXT NOT NULL,
+      wallet_id TEXT NOT NULL,
+      user_id TEXT NOT NULL,
+      record_org_id TEXT NOT NULL,
+      record_json TEXT NOT NULL,
+      created_at_ms INTEGER NOT NULL,
+      expires_at_ms INTEGER NOT NULL,
+      PRIMARY KEY (namespace, org_id, project_id, env_id, challenge_id),
+      CHECK (length(challenge_id) > 0),
+      CHECK (length(wallet_id) > 0),
+      CHECK (length(user_id) > 0),
+      CHECK (json_valid(record_json)),
+      CHECK (created_at_ms > 0),
+      CHECK (expires_at_ms > created_at_ms)
+    )
+  `,
+	`
+    CREATE INDEX IF NOT EXISTS email_otp_unlock_challenges_expires_idx
+      ON email_otp_unlock_challenges (
+        namespace,
+        org_id,
+        project_id,
+        env_id,
+        expires_at_ms
+      )
+  `,
+	`
+    CREATE TABLE IF NOT EXISTS email_otp_registration_attempts (
+      namespace TEXT NOT NULL,
+      org_id TEXT NOT NULL,
+      project_id TEXT NOT NULL,
+      env_id TEXT NOT NULL,
+      attempt_id TEXT NOT NULL,
+      provider_subject TEXT NOT NULL,
+      email TEXT NOT NULL,
+      wallet_id TEXT NOT NULL,
+      state TEXT NOT NULL,
+      owner_proof_binding_digest TEXT NOT NULL,
+      runtime_org_id TEXT NOT NULL,
+      runtime_policy_key TEXT NOT NULL,
+      offer_wallet_ids_json TEXT NOT NULL,
+      record_json TEXT NOT NULL,
+      created_at_ms INTEGER NOT NULL,
+      updated_at_ms INTEGER NOT NULL,
+      expires_at_ms INTEGER NOT NULL,
+      PRIMARY KEY (namespace, org_id, project_id, env_id, attempt_id),
+      CHECK (length(attempt_id) > 0),
+      CHECK (length(provider_subject) > 0),
+      CHECK (length(email) > 0),
+      CHECK (length(wallet_id) > 0),
+      CHECK (state IN ('started', 'key_finalized', 'active', 'abandoned', 'failed', 'expired')),
+      CHECK (length(owner_proof_binding_digest) > 0),
+      CHECK (json_valid(offer_wallet_ids_json)),
+      CHECK (json_valid(record_json)),
+      CHECK (created_at_ms > 0),
+      CHECK (updated_at_ms > 0),
+      CHECK (expires_at_ms > 0)
+    )
+  `,
+	`
+    CREATE INDEX IF NOT EXISTS email_otp_registration_attempts_subject_idx
+      ON email_otp_registration_attempts (
+        namespace,
+        org_id,
+        project_id,
+        env_id,
+        provider_subject,
+        email,
+        state,
+        expires_at_ms,
+        owner_proof_binding_digest,
+        runtime_org_id,
+        runtime_policy_key,
+        updated_at_ms
+      )
+  `,
+	`
+    CREATE INDEX IF NOT EXISTS email_otp_registration_attempts_wallet_idx
+      ON email_otp_registration_attempts (
+        namespace,
+        org_id,
+        project_id,
+        env_id,
+        wallet_id,
+        state,
+        expires_at_ms
+      )
+  `
+]);
+async function ensureEmailOtpStoreD1Schema(options) {
+	for (const statement of EMAIL_OTP_STORE_D1_SCHEMA_SQL) await options.database.exec(formatD1ExecStatement(statement));
+}
+function toPrefixWithColon(prefix, defaultPrefix) {
+	const p = normalizeOptionalTrimmedString(prefix);
+	if (!p) return defaultPrefix;
+	return p.endsWith(":") ? p : `${p}:`;
+}
+function resolveEmailOtpStoreNamespace(config) {
+	const explicit = normalizeOptionalTrimmedString(config.EMAIL_OTP_PREFIX) || normalizeOptionalTrimmedString(config.EMAIL_OTP_STORE_PREFIX);
+	if (explicit) return toPrefixWithColon(explicit, "");
+	return `${toPrefixWithColon(normalizeOptionalTrimmedString(config.THRESHOLD_PREFIX) || "w3a", `w3a:`)}email-otp:`;
+}
+function getStoreConfig(input) {
+	return isPlainObject(input?.config) ? input.config : {};
+}
+function requireD1ScopeString(input, field) {
+	const normalized = normalizeOptionalTrimmedString(input);
+	if (!normalized) throw new Error(`${field} is required for D1 Email OTP store`);
+	return normalized;
+}
+function normalizeD1EmailOtpStoreOptions(input) {
+	return {
+		database: input.database,
+		namespace: requireD1ScopeString(input.namespace, "namespace"),
+		orgId: requireD1ScopeString(input.orgId, "orgId"),
+		projectId: requireD1ScopeString(input.projectId, "projectId"),
+		envId: requireD1ScopeString(input.envId, "envId"),
+		ensureSchema: input.ensureSchema !== false
+	};
+}
+function d1ScopeFromConfig(input) {
+	return {
+		namespace: requireD1ScopeString(input.namespace, "namespace"),
+		orgId: requireD1ScopeString(input.config.orgId || input.config.ORG_ID, "orgId"),
+		projectId: requireD1ScopeString(input.config.projectId || input.config.PROJECT_ID, "projectId"),
+		envId: requireD1ScopeString(input.config.envId || input.config.ENV_ID, "envId")
+	};
+}
+function bindD1EmailOtpScope(database, scope, statement, values = []) {
+	return database.prepare(statement).bind(scope.namespace, scope.orgId, scope.projectId, scope.envId, ...values);
+}
+function assertD1EmailOtpOrgScope(input) {
+	if (!input.recordOrgId) return;
+	if (input.recordOrgId !== input.scope.orgId) throw new Error(`${input.label} orgId must match D1 Email OTP store orgId`);
+}
+function resolveD1EmailOtpStoreOptions(input, storeLabel) {
+	const config = getStoreConfig(input);
+	if (normalizeOptionalTrimmedString(config.kind) !== "d1") return null;
+	const database = resolveD1DatabaseFromConfig(config);
+	if (!database) throw new Error(`[email-otp] D1 ${storeLabel} store selected but no D1 database was provided`);
+	return {
+		database,
+		...d1ScopeFromConfig({
+			config,
+			namespace: resolveEmailOtpStoreNamespace(config)
+		})
+	};
+}
+function assertEmailOtpStoreKindKnown(input, storeLabel) {
+	const kind = normalizeOptionalTrimmedString(getStoreConfig(input).kind);
+	if (!kind || kind === "in-memory") return;
+	throw new Error(`[email-otp] Unknown ${storeLabel} store kind: ${kind}`);
+}
+function cloneRecord(value) {
+	return JSON.parse(JSON.stringify(value));
+}
+function parseJsonRecord(raw) {
+	if (typeof raw !== "string") return raw;
+	try {
+		return JSON.parse(raw);
+	} catch {
+		return raw;
+	}
+}
+function challengeContextMatches(record, input) {
+	return record.expiresAtMs > input.nowMs && record.challengeSubjectId === input.challengeSubjectId && record.walletId === input.walletId && String(record.orgId || "") === String(input.orgId || "") && record.otpChannel === input.otpChannel && record.ownerProofBindingDigest === input.ownerProofBindingDigest && record.action === input.action && record.operation === input.operation;
+}
+var InMemoryEmailOtpChallengeStore = class {
+	constructor() {
+		this.map = /* @__PURE__ */ new Map();
+	}
+	async put(record) {
+		const parsed = parseCurrentEmailOtpChallengeRecord(record);
+		if (!parsed) throw new Error("Invalid Email OTP challenge record");
+		this.map.set(parsed.challengeId, cloneRecord(parsed));
+	}
+	async get(challengeId) {
+		const id = normalizeOptionalTrimmedString(challengeId);
+		if (!id) return null;
+		const record = this.map.get(id);
+		return record ? cloneRecord(record) : null;
+	}
+	async deleteExpired(nowMs) {
+		const deleted = [];
+		for (const [challengeId, record] of this.map.entries()) {
+			if (record.expiresAtMs > nowMs) continue;
+			this.map.delete(challengeId);
+			deleted.push(cloneRecord(record));
+		}
+		return deleted;
+	}
+	async countActiveByContext(input) {
+		let count = 0;
+		for (const record of this.map.values()) {
+			if (!challengeContextMatches(record, input)) continue;
+			count += 1;
+		}
+		return count;
+	}
+	async findLatestActiveByContext(input) {
+		let latest = null;
+		for (const record of this.map.values()) {
+			if (!challengeContextMatches(record, input)) continue;
+			if (!latest || record.expiresAtMs > latest.expiresAtMs) latest = record;
+		}
+		return latest ? cloneRecord(latest) : null;
+	}
+	async deleteOldestActiveByContext(input) {
+		let oldest = null;
+		for (const record of this.map.values()) {
+			if (!challengeContextMatches(record, input)) continue;
+			if (!oldest || record.createdAtMs < oldest.createdAtMs) oldest = record;
+		}
+		if (!oldest) return null;
+		this.map.delete(oldest.challengeId);
+		return cloneRecord(oldest);
+	}
+	async findActiveByContext(input) {
+		for (const record of this.map.values()) {
+			if (!challengeContextMatches(record, input)) continue;
+			if (record.otpCode !== input.otpCode) continue;
+			return cloneRecord(record);
+		}
+		return null;
+	}
+	async del(challengeId) {
+		const id = normalizeOptionalTrimmedString(challengeId);
+		if (!id) return;
+		this.map.delete(id);
+	}
+};
+var InMemoryEmailOtpGrantStore = class {
+	constructor() {
+		this.map = /* @__PURE__ */ new Map();
+	}
+	async put(record) {
+		const parsed = parseCurrentEmailOtpGrantRecord(record);
+		if (!parsed) throw new Error("Invalid Email OTP grant record");
+		this.map.set(parsed.grantToken, cloneRecord(parsed));
+	}
+	async get(grantToken) {
+		const token = normalizeOptionalTrimmedString(grantToken);
+		if (!token) return null;
+		const record = this.map.get(token);
+		return record ? cloneRecord(record) : null;
+	}
+	async consume(grantToken) {
+		const token = normalizeOptionalTrimmedString(grantToken);
+		if (!token) return null;
+		const record = this.map.get(token);
+		this.map.delete(token);
+		return record ? cloneRecord(record) : null;
+	}
+	async del(grantToken) {
+		const token = normalizeOptionalTrimmedString(grantToken);
+		if (!token) return;
+		this.map.delete(token);
+	}
+};
+var InMemoryEmailOtpWalletEnrollmentStore = class {
+	constructor() {
+		this.map = /* @__PURE__ */ new Map();
+	}
+	async get(walletId) {
+		const key = normalizeOptionalTrimmedString(walletId);
+		if (!key) return null;
+		const record = this.map.get(key);
+		return record ? cloneRecord(record) : null;
+	}
+	async getByProviderUserId(input) {
+		const providerUserId = normalizeOptionalTrimmedString(input.providerUserId);
+		const orgId = normalizeOptionalTrimmedString(input.orgId);
+		if (!providerUserId || !orgId) return null;
+		const record = Array.from(this.map.values()).find((candidate) => candidate.providerUserId === providerUserId && candidate.orgId === orgId) || null;
+		return record ? cloneRecord(record) : null;
+	}
+	async put(record) {
+		const parsed = parseCurrentEmailOtpWalletEnrollmentRecord(record);
+		if (!parsed) throw new Error("Invalid Email OTP wallet enrollment record");
+		if (Array.from(this.map.values()).find((existing) => existing.walletId !== parsed.walletId && existing.orgId === parsed.orgId && existing.providerUserId === parsed.providerUserId)) throw new Error("Email OTP wallet enrollment already exists for this provider user in org");
+		this.map.set(parsed.walletId, cloneRecord(parsed));
+	}
+	async del(walletId) {
+		const key = normalizeOptionalTrimmedString(walletId);
+		if (!key) return;
+		this.map.delete(key);
+	}
+};
+var InMemoryEmailOtpAuthStateStore = class {
+	constructor() {
+		this.map = /* @__PURE__ */ new Map();
+	}
+	async get(walletId) {
+		const key = normalizeOptionalTrimmedString(walletId);
+		if (!key) return null;
+		const record = this.map.get(key);
+		return record ? cloneRecord(record) : null;
+	}
+	async put(record) {
+		const parsed = parseCurrentEmailOtpAuthStateRecord(record);
+		if (!parsed) throw new Error("Invalid Email OTP auth state record");
+		this.map.set(parsed.walletId, cloneRecord(parsed));
+	}
+	async del(walletId) {
+		const key = normalizeOptionalTrimmedString(walletId);
+		if (!key) return;
+		this.map.delete(key);
+	}
+};
+var InMemoryEmailOtpUnlockChallengeStore = class {
+	constructor() {
+		this.map = /* @__PURE__ */ new Map();
+	}
+	async put(record) {
+		const parsed = parseCurrentEmailOtpUnlockChallengeRecord(record);
+		if (!parsed) throw new Error("Invalid Email OTP unlock challenge record");
+		this.map.set(parsed.challengeId, cloneRecord(parsed));
+	}
+	async consume(challengeId) {
+		const id = normalizeOptionalTrimmedString(challengeId);
+		if (!id) return null;
+		const record = this.map.get(id);
+		this.map.delete(id);
+		return record ? cloneRecord(record) : null;
+	}
+	async del(challengeId) {
+		const id = normalizeOptionalTrimmedString(challengeId);
+		if (!id) return;
+		this.map.delete(id);
+	}
+};
+var InMemoryEmailOtpRegistrationAttemptStore = class {
+	constructor() {
+		this.map = /* @__PURE__ */ new Map();
+	}
+	async put(record) {
+		const parsed = parseCurrentGoogleEmailOtpRegistrationAttemptRecord(record);
+		if (!parsed) throw new Error("Invalid Google Email OTP registration attempt record");
+		this.map.set(parsed.attemptId, cloneRecord(parsed));
+	}
+	async get(attemptId) {
+		const id = normalizeOptionalTrimmedString(attemptId);
+		if (!id) return null;
+		const record = this.map.get(id);
+		return record ? cloneRecord(record) : null;
+	}
+	async findStartedBySubjectEmail(input) {
+		for (const record of this.map.values()) if (registrationAttemptMatchesStartedScope(record, input)) return cloneRecord(record);
+		return null;
+	}
+	async abandonStartedBySubjectEmailExceptBinding(input) {
+		let abandoned = 0;
+		for (const record of this.map.values()) {
+			if (!registrationAttemptMatchesReplacementScope(record, input)) continue;
+			this.map.set(record.attemptId, {
+				...cloneRecord(record),
+				state: "abandoned",
+				failureCode: input.failureCode,
+				updatedAtMs: input.nowMs
+			});
+			abandoned += 1;
+		}
+		return abandoned;
+	}
+	async hasLiveStartedWalletAttempt(input) {
+		for (const record of this.map.values()) if ((record.state === "started" || record.state === "key_finalized") && record.expiresAtMs > input.nowMs && (record.walletId === input.walletId || record.offerCandidates.some((candidate) => candidate.walletId === input.walletId))) return true;
+		return false;
+	}
+	async deleteExpired(nowMs) {
+		let deleted = 0;
+		for (const [attemptId, record] of this.map.entries()) if (record.expiresAtMs <= nowMs || record.state === "expired") {
+			this.map.delete(attemptId);
+			deleted += 1;
+		}
+		return deleted;
+	}
+};
+var D1EmailOtpStoreBase = class {
+	constructor(input) {
+		this.schemaReady = false;
+		const normalized = normalizeD1EmailOtpStoreOptions(input);
+		this.database = normalized.database;
+		this.scope = {
+			namespace: normalized.namespace,
+			orgId: normalized.orgId,
+			projectId: normalized.projectId,
+			envId: normalized.envId
+		};
+		this.ensureSchemaOnUse = normalized.ensureSchema;
+	}
+	async ensureSchema() {
+		if (!this.ensureSchemaOnUse || this.schemaReady) return;
+		await ensureEmailOtpStoreD1Schema({ database: this.database });
+		this.schemaReady = true;
+	}
+	bindScope(statement, values = []) {
+		return bindD1EmailOtpScope(this.database, this.scope, statement, values);
+	}
+};
+var D1EmailOtpChallengeStore = class extends D1EmailOtpStoreBase {
+	constructor(..._args) {
+		super(..._args);
+		this.adapterKind = "d1";
+	}
+	async put(record) {
+		await this.ensureSchema();
+		const parsed = parseCurrentEmailOtpChallengeRecord(record);
+		if (!parsed) throw new Error("Invalid Email OTP challenge record");
+		assertD1EmailOtpOrgScope({
+			recordOrgId: parsed.orgId,
+			scope: this.scope,
+			label: "Email OTP challenge"
+		});
+		await this.bindScope(`INSERT INTO email_otp_challenges (
+        namespace,
+        org_id,
+        project_id,
+        env_id,
+        challenge_id,
+        challenge_subject_id,
+        wallet_id,
+        record_org_id,
+        otp_channel,
+        owner_proof_binding_digest,
+        action,
+        operation,
+        otp_code,
+        record_json,
+        created_at_ms,
+        expires_at_ms
+      )
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT (namespace, org_id, project_id, env_id, challenge_id)
+      DO UPDATE SET
+        challenge_subject_id = EXCLUDED.challenge_subject_id,
+        wallet_id = EXCLUDED.wallet_id,
+        record_org_id = EXCLUDED.record_org_id,
+        otp_channel = EXCLUDED.otp_channel,
+        owner_proof_binding_digest = EXCLUDED.owner_proof_binding_digest,
+        action = EXCLUDED.action,
+        operation = EXCLUDED.operation,
+        otp_code = EXCLUDED.otp_code,
+        record_json = EXCLUDED.record_json,
+        created_at_ms = EXCLUDED.created_at_ms,
+        expires_at_ms = EXCLUDED.expires_at_ms`, [
+			parsed.challengeId,
+			parsed.challengeSubjectId,
+			parsed.walletId,
+			parsed.orgId || "",
+			parsed.otpChannel,
+			parsed.ownerProofBindingDigest,
+			parsed.action,
+			parsed.operation,
+			parsed.otpCode,
+			JSON.stringify(parsed),
+			parsed.createdAtMs,
+			parsed.expiresAtMs
+		]).run();
+	}
+	async get(challengeId) {
+		await this.ensureSchema();
+		const id = normalizeOptionalTrimmedString(challengeId);
+		if (!id) return null;
+		const row = await this.bindScope(`SELECT record_json, expires_at_ms, challenge_id
+         FROM email_otp_challenges
+        WHERE namespace = ?
+          AND org_id = ?
+          AND project_id = ?
+          AND env_id = ?
+          AND challenge_id = ?
+        LIMIT 1`, [id]).first();
+		const parsed = parseCurrentEmailOtpChallengeRow({
+			recordJson: parseJsonRecord(row?.record_json),
+			expiresAtMs: row?.expires_at_ms
+		});
+		if (!row) return null;
+		if (!parsed) {
+			await this.del(id);
+			return null;
+		}
+		return cloneRecord(parsed);
+	}
+	async deleteExpired(nowMs) {
+		await this.ensureSchema();
+		return ((await this.bindScope(`DELETE FROM email_otp_challenges
+        WHERE namespace = ?
+          AND org_id = ?
+          AND project_id = ?
+          AND env_id = ?
+          AND expires_at_ms <= ?
+        RETURNING record_json, expires_at_ms`, [nowMs]).all()).results || []).map((row) => parseCurrentEmailOtpChallengeRow({
+			recordJson: parseJsonRecord(row.record_json),
+			expiresAtMs: row.expires_at_ms
+		})).filter((record) => Boolean(record)).map((record) => cloneRecord(record));
+	}
+	async countActiveByContext(input) {
+		await this.ensureSchema();
+		const row = await this.bindScope(`SELECT COUNT(*) AS count
+         FROM email_otp_challenges
+        WHERE namespace = ?
+          AND org_id = ?
+          AND project_id = ?
+          AND env_id = ?
+          AND expires_at_ms > ?
+          AND challenge_subject_id = ?
+          AND wallet_id = ?
+          AND record_org_id = ?
+          AND otp_channel = ?
+          AND owner_proof_binding_digest = ?
+          AND action = ?
+          AND operation = ?`, [
+			input.nowMs,
+			input.challengeSubjectId,
+			input.walletId,
+			String(input.orgId || ""),
+			input.otpChannel,
+			input.ownerProofBindingDigest,
+			input.action,
+			input.operation
+		]).first();
+		return Number(row?.count || 0);
+	}
+	async findLatestActiveByContext(input) {
+		await this.ensureSchema();
+		const row = await this.bindScope(`SELECT record_json, expires_at_ms, challenge_id
+         FROM email_otp_challenges
+        WHERE namespace = ?
+          AND org_id = ?
+          AND project_id = ?
+          AND env_id = ?
+          AND expires_at_ms > ?
+          AND challenge_subject_id = ?
+          AND wallet_id = ?
+          AND record_org_id = ?
+          AND otp_channel = ?
+          AND owner_proof_binding_digest = ?
+          AND action = ?
+          AND operation = ?
+        ORDER BY expires_at_ms DESC, created_at_ms DESC
+        LIMIT 1`, [
+			input.nowMs,
+			input.challengeSubjectId,
+			input.walletId,
+			String(input.orgId || ""),
+			input.otpChannel,
+			input.ownerProofBindingDigest,
+			input.action,
+			input.operation
+		]).first();
+		const parsed = parseCurrentEmailOtpChallengeRow({
+			recordJson: parseJsonRecord(row?.record_json),
+			expiresAtMs: row?.expires_at_ms
+		});
+		if (parsed) return cloneRecord(parsed);
+		const malformedId = normalizeOptionalTrimmedString(row?.challenge_id);
+		if (malformedId) await this.del(malformedId);
+		return null;
+	}
+	async deleteOldestActiveByContext(input) {
+		await this.ensureSchema();
+		const row = await this.bindScope(`WITH oldest AS (
+        SELECT challenge_id
+          FROM email_otp_challenges
+         WHERE namespace = ?
+           AND org_id = ?
+           AND project_id = ?
+           AND env_id = ?
+           AND expires_at_ms > ?
+           AND challenge_subject_id = ?
+           AND wallet_id = ?
+           AND record_org_id = ?
+           AND otp_channel = ?
+           AND owner_proof_binding_digest = ?
+           AND action = ?
+           AND operation = ?
+         ORDER BY created_at_ms ASC, expires_at_ms ASC
+         LIMIT 1
+      )
+      DELETE FROM email_otp_challenges
+       WHERE namespace = ?
+         AND org_id = ?
+         AND project_id = ?
+         AND env_id = ?
+         AND challenge_id IN (SELECT challenge_id FROM oldest)
+      RETURNING record_json, expires_at_ms, challenge_id`, [
+			input.nowMs,
+			input.challengeSubjectId,
+			input.walletId,
+			String(input.orgId || ""),
+			input.otpChannel,
+			input.ownerProofBindingDigest,
+			input.action,
+			input.operation,
+			this.scope.namespace,
+			this.scope.orgId,
+			this.scope.projectId,
+			this.scope.envId
+		]).first();
+		const parsed = parseCurrentEmailOtpChallengeRow({
+			recordJson: parseJsonRecord(row?.record_json),
+			expiresAtMs: row?.expires_at_ms
+		});
+		if (parsed) return cloneRecord(parsed);
+		const malformedId = normalizeOptionalTrimmedString(row?.challenge_id);
+		if (malformedId) await this.del(malformedId);
+		return null;
+	}
+	async findActiveByContext(input) {
+		await this.ensureSchema();
+		const row = await this.bindScope(`SELECT record_json, expires_at_ms, challenge_id
+         FROM email_otp_challenges
+        WHERE namespace = ?
+          AND org_id = ?
+          AND project_id = ?
+          AND env_id = ?
+          AND expires_at_ms > ?
+          AND challenge_subject_id = ?
+          AND wallet_id = ?
+          AND record_org_id = ?
+          AND otp_channel = ?
+          AND owner_proof_binding_digest = ?
+          AND action = ?
+          AND operation = ?
+          AND otp_code = ?
+        ORDER BY expires_at_ms DESC
+        LIMIT 1`, [
+			input.nowMs,
+			input.challengeSubjectId,
+			input.walletId,
+			String(input.orgId || ""),
+			input.otpChannel,
+			input.ownerProofBindingDigest,
+			input.action,
+			input.operation,
+			input.otpCode
+		]).first();
+		const parsed = parseCurrentEmailOtpChallengeRow({
+			recordJson: parseJsonRecord(row?.record_json),
+			expiresAtMs: row?.expires_at_ms
+		});
+		if (parsed) return cloneRecord(parsed);
+		const malformedId = normalizeOptionalTrimmedString(row?.challenge_id);
+		if (malformedId) await this.del(malformedId);
+		return null;
+	}
+	async del(challengeId) {
+		await this.ensureSchema();
+		const id = normalizeOptionalTrimmedString(challengeId);
+		if (!id) return;
+		await this.bindScope(`DELETE FROM email_otp_challenges
+        WHERE namespace = ?
+          AND org_id = ?
+          AND project_id = ?
+          AND env_id = ?
+          AND challenge_id = ?`, [id]).run();
+	}
+};
+var D1EmailOtpGrantStore = class extends D1EmailOtpStoreBase {
+	constructor(..._args2) {
+		super(..._args2);
+		this.adapterKind = "d1";
+	}
+	async put(record) {
+		await this.ensureSchema();
+		const parsed = parseCurrentEmailOtpGrantRecord(record);
+		if (!parsed) throw new Error("Invalid Email OTP grant record");
+		assertD1EmailOtpOrgScope({
+			recordOrgId: parsed.orgId,
+			scope: this.scope,
+			label: "Email OTP grant"
+		});
+		await this.bindScope(`INSERT INTO email_otp_grants (
+        namespace,
+        org_id,
+        project_id,
+        env_id,
+        grant_token,
+        user_id,
+        wallet_id,
+        record_org_id,
+        challenge_id,
+        action,
+        record_json,
+        issued_at_ms,
+        expires_at_ms
+      )
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT (namespace, org_id, project_id, env_id, grant_token)
+      DO UPDATE SET
+        user_id = EXCLUDED.user_id,
+        wallet_id = EXCLUDED.wallet_id,
+        record_org_id = EXCLUDED.record_org_id,
+        challenge_id = EXCLUDED.challenge_id,
+        action = EXCLUDED.action,
+        record_json = EXCLUDED.record_json,
+        issued_at_ms = EXCLUDED.issued_at_ms,
+        expires_at_ms = EXCLUDED.expires_at_ms`, [
+			parsed.grantToken,
+			parsed.userId,
+			parsed.walletId,
+			parsed.orgId || "",
+			parsed.challengeId,
+			parsed.action,
+			JSON.stringify(parsed),
+			parsed.issuedAtMs,
+			parsed.expiresAtMs
+		]).run();
+	}
+	async get(grantToken) {
+		await this.ensureSchema();
+		const token = normalizeOptionalTrimmedString(grantToken);
+		if (!token) return null;
+		const row = await this.bindScope(`SELECT record_json, expires_at_ms
+         FROM email_otp_grants
+        WHERE namespace = ?
+          AND org_id = ?
+          AND project_id = ?
+          AND env_id = ?
+          AND grant_token = ?
+        LIMIT 1`, [token]).first();
+		const parsed = parseCurrentEmailOtpGrantRow({
+			recordJson: parseJsonRecord(row?.record_json),
+			expiresAtMs: row?.expires_at_ms
+		});
+		if (!row) return null;
+		if (!parsed) {
+			await this.del(token);
+			return null;
+		}
+		return cloneRecord(parsed);
+	}
+	async consume(grantToken) {
+		await this.ensureSchema();
+		const token = normalizeOptionalTrimmedString(grantToken);
+		if (!token) return null;
+		const row = await this.bindScope(`DELETE FROM email_otp_grants
+        WHERE namespace = ?
+          AND org_id = ?
+          AND project_id = ?
+          AND env_id = ?
+          AND grant_token = ?
+      RETURNING record_json, expires_at_ms`, [token]).first();
+		const parsed = parseCurrentEmailOtpGrantRow({
+			recordJson: parseJsonRecord(row?.record_json),
+			expiresAtMs: row?.expires_at_ms
+		});
+		return parsed ? cloneRecord(parsed) : null;
+	}
+	async del(grantToken) {
+		await this.ensureSchema();
+		const token = normalizeOptionalTrimmedString(grantToken);
+		if (!token) return;
+		await this.bindScope(`DELETE FROM email_otp_grants
+        WHERE namespace = ?
+          AND org_id = ?
+          AND project_id = ?
+          AND env_id = ?
+          AND grant_token = ?`, [token]).run();
+	}
+};
+var D1EmailOtpWalletEnrollmentStore = class extends D1EmailOtpStoreBase {
+	constructor(..._args3) {
+		super(..._args3);
+		this.adapterKind = "d1";
+	}
+	async get(walletId) {
+		await this.ensureSchema();
+		const key = normalizeOptionalTrimmedString(walletId);
+		if (!key) return null;
+		const row = await this.bindScope(`SELECT record_json, updated_at_ms, wallet_id
+         FROM email_otp_wallet_enrollments
+        WHERE namespace = ?
+          AND org_id = ?
+          AND project_id = ?
+          AND env_id = ?
+          AND wallet_id = ?
+        LIMIT 1`, [key]).first();
+		const parsed = parseCurrentEmailOtpWalletEnrollmentRow({
+			recordJson: parseJsonRecord(row?.record_json),
+			updatedAtMs: row?.updated_at_ms
+		});
+		if (!row) return null;
+		if (!parsed) {
+			await this.del(key);
+			return null;
+		}
+		return cloneRecord(parsed);
+	}
+	async getByProviderUserId(input) {
+		await this.ensureSchema();
+		const providerUserId = normalizeOptionalTrimmedString(input.providerUserId);
+		const orgId = normalizeOptionalTrimmedString(input.orgId);
+		if (!providerUserId || !orgId) return null;
+		const row = await this.bindScope(`SELECT record_json, updated_at_ms, wallet_id
+         FROM email_otp_wallet_enrollments
+        WHERE namespace = ?
+          AND org_id = ?
+          AND project_id = ?
+          AND env_id = ?
+          AND record_org_id = ?
+          AND provider_user_id = ?
+        ORDER BY updated_at_ms DESC
+        LIMIT 1`, [orgId, providerUserId]).first();
+		const parsed = parseCurrentEmailOtpWalletEnrollmentRow({
+			recordJson: parseJsonRecord(row?.record_json),
+			updatedAtMs: row?.updated_at_ms
+		});
+		if (parsed) return cloneRecord(parsed);
+		const malformedWalletId = normalizeOptionalTrimmedString(row?.wallet_id);
+		if (malformedWalletId) await this.del(malformedWalletId);
+		return null;
+	}
+	async put(record) {
+		await this.ensureSchema();
+		const parsed = parseCurrentEmailOtpWalletEnrollmentRecord(record);
+		if (!parsed) throw new Error("Invalid Email OTP wallet enrollment record");
+		assertD1EmailOtpOrgScope({
+			recordOrgId: parsed.orgId,
+			scope: this.scope,
+			label: "Email OTP wallet enrollment"
+		});
+		await this.bindScope(`INSERT INTO email_otp_wallet_enrollments (
+        namespace,
+        org_id,
+        project_id,
+        env_id,
+        wallet_id,
+        provider_user_id,
+        record_org_id,
+        verified_email,
+        record_json,
+        created_at_ms,
+        updated_at_ms
+      )
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT (namespace, org_id, project_id, env_id, wallet_id)
+      DO UPDATE SET
+        provider_user_id = EXCLUDED.provider_user_id,
+        record_org_id = EXCLUDED.record_org_id,
+        verified_email = EXCLUDED.verified_email,
+        record_json = EXCLUDED.record_json,
+        created_at_ms = EXCLUDED.created_at_ms,
+        updated_at_ms = EXCLUDED.updated_at_ms`, [
+			parsed.walletId,
+			parsed.providerUserId,
+			parsed.orgId,
+			parsed.verifiedEmail,
+			JSON.stringify(parsed),
+			parsed.createdAtMs,
+			parsed.updatedAtMs
+		]).run();
+	}
+	async del(walletId) {
+		await this.ensureSchema();
+		const key = normalizeOptionalTrimmedString(walletId);
+		if (!key) return;
+		await this.bindScope(`DELETE FROM email_otp_wallet_enrollments
+        WHERE namespace = ?
+          AND org_id = ?
+          AND project_id = ?
+          AND env_id = ?
+          AND wallet_id = ?`, [key]).run();
+	}
+};
+var D1EmailOtpAuthStateStore = class extends D1EmailOtpStoreBase {
+	constructor(..._args4) {
+		super(..._args4);
+		this.adapterKind = "d1";
+	}
+	async get(walletId) {
+		await this.ensureSchema();
+		const key = normalizeOptionalTrimmedString(walletId);
+		if (!key) return null;
+		const row = await this.bindScope(`SELECT record_json, updated_at_ms
+         FROM email_otp_auth_states
+        WHERE namespace = ?
+          AND org_id = ?
+          AND project_id = ?
+          AND env_id = ?
+          AND wallet_id = ?
+        LIMIT 1`, [key]).first();
+		const parsed = parseCurrentEmailOtpAuthStateRow({
+			recordJson: parseJsonRecord(row?.record_json),
+			updatedAtMs: row?.updated_at_ms
+		});
+		if (!row) return null;
+		if (!parsed) {
+			await this.del(key);
+			return null;
+		}
+		return cloneRecord(parsed);
+	}
+	async put(record) {
+		await this.ensureSchema();
+		const parsed = parseCurrentEmailOtpAuthStateRecord(record);
+		if (!parsed) throw new Error("Invalid Email OTP auth state record");
+		assertD1EmailOtpOrgScope({
+			recordOrgId: parsed.orgId,
+			scope: this.scope,
+			label: "Email OTP auth state"
+		});
+		await this.bindScope(`INSERT INTO email_otp_auth_states (
+        namespace,
+        org_id,
+        project_id,
+        env_id,
+        wallet_id,
+        provider_user_id,
+        record_org_id,
+        record_json,
+        created_at_ms,
+        updated_at_ms
+      )
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT (namespace, org_id, project_id, env_id, wallet_id)
+      DO UPDATE SET
+        provider_user_id = EXCLUDED.provider_user_id,
+        record_org_id = EXCLUDED.record_org_id,
+        record_json = EXCLUDED.record_json,
+        created_at_ms = EXCLUDED.created_at_ms,
+        updated_at_ms = EXCLUDED.updated_at_ms`, [
+			parsed.walletId,
+			parsed.providerUserId,
+			parsed.orgId,
+			JSON.stringify(parsed),
+			parsed.createdAtMs,
+			parsed.updatedAtMs
+		]).run();
+	}
+	async del(walletId) {
+		await this.ensureSchema();
+		const key = normalizeOptionalTrimmedString(walletId);
+		if (!key) return;
+		await this.bindScope(`DELETE FROM email_otp_auth_states
+        WHERE namespace = ?
+          AND org_id = ?
+          AND project_id = ?
+          AND env_id = ?
+          AND wallet_id = ?`, [key]).run();
+	}
+};
+var D1EmailOtpUnlockChallengeStore = class extends D1EmailOtpStoreBase {
+	constructor(..._args5) {
+		super(..._args5);
+		this.adapterKind = "d1";
+	}
+	async put(record) {
+		await this.ensureSchema();
+		const parsed = parseCurrentEmailOtpUnlockChallengeRecord(record);
+		if (!parsed) throw new Error("Invalid Email OTP unlock challenge record");
+		assertD1EmailOtpOrgScope({
+			recordOrgId: parsed.orgId,
+			scope: this.scope,
+			label: "Email OTP unlock challenge"
+		});
+		await this.bindScope(`INSERT INTO email_otp_unlock_challenges (
+        namespace,
+        org_id,
+        project_id,
+        env_id,
+        challenge_id,
+        wallet_id,
+        user_id,
+        record_org_id,
+        record_json,
+        created_at_ms,
+        expires_at_ms
+      )
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT (namespace, org_id, project_id, env_id, challenge_id)
+      DO UPDATE SET
+        wallet_id = EXCLUDED.wallet_id,
+        user_id = EXCLUDED.user_id,
+        record_org_id = EXCLUDED.record_org_id,
+        record_json = EXCLUDED.record_json,
+        created_at_ms = EXCLUDED.created_at_ms,
+        expires_at_ms = EXCLUDED.expires_at_ms`, [
+			parsed.challengeId,
+			parsed.walletId,
+			parsed.userId,
+			parsed.orgId || "",
+			JSON.stringify(parsed),
+			parsed.createdAtMs,
+			parsed.expiresAtMs
+		]).run();
+	}
+	async consume(challengeId) {
+		await this.ensureSchema();
+		const id = normalizeOptionalTrimmedString(challengeId);
+		if (!id) return null;
+		const row = await this.bindScope(`DELETE FROM email_otp_unlock_challenges
+        WHERE namespace = ?
+          AND org_id = ?
+          AND project_id = ?
+          AND env_id = ?
+          AND challenge_id = ?
+      RETURNING record_json, expires_at_ms`, [id]).first();
+		const parsed = parseCurrentEmailOtpUnlockChallengeRow({
+			recordJson: parseJsonRecord(row?.record_json),
+			expiresAtMs: row?.expires_at_ms
+		});
+		return parsed ? cloneRecord(parsed) : null;
+	}
+	async del(challengeId) {
+		await this.ensureSchema();
+		const id = normalizeOptionalTrimmedString(challengeId);
+		if (!id) return;
+		await this.bindScope(`DELETE FROM email_otp_unlock_challenges
+        WHERE namespace = ?
+          AND org_id = ?
+          AND project_id = ?
+          AND env_id = ?
+          AND challenge_id = ?`, [id]).run();
+	}
+};
+var D1EmailOtpRegistrationAttemptStore = class extends D1EmailOtpStoreBase {
+	constructor(..._args6) {
+		super(..._args6);
+		this.adapterKind = "d1";
+	}
+	async put(record) {
+		await this.ensureSchema();
+		const parsed = parseCurrentGoogleEmailOtpRegistrationAttemptRecord(record);
+		if (!parsed) throw new Error("Invalid Google Email OTP registration attempt record");
+		assertD1EmailOtpOrgScope({
+			recordOrgId: parsed.runtimePolicyScope?.orgId,
+			scope: this.scope,
+			label: "Google Email OTP registration attempt"
+		});
+		await this.bindScope(`INSERT INTO email_otp_registration_attempts (
+        namespace,
+        org_id,
+        project_id,
+        env_id,
+        attempt_id,
+        provider_subject,
+        email,
+        wallet_id,
+        state,
+        owner_proof_binding_digest,
+        runtime_org_id,
+        runtime_policy_key,
+        offer_wallet_ids_json,
+        record_json,
+        created_at_ms,
+        updated_at_ms,
+        expires_at_ms
+      )
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT (namespace, org_id, project_id, env_id, attempt_id)
+      DO UPDATE SET
+        provider_subject = EXCLUDED.provider_subject,
+        email = EXCLUDED.email,
+        wallet_id = EXCLUDED.wallet_id,
+        state = EXCLUDED.state,
+        owner_proof_binding_digest = EXCLUDED.owner_proof_binding_digest,
+        runtime_org_id = EXCLUDED.runtime_org_id,
+        runtime_policy_key = EXCLUDED.runtime_policy_key,
+        offer_wallet_ids_json = EXCLUDED.offer_wallet_ids_json,
+        record_json = EXCLUDED.record_json,
+        created_at_ms = EXCLUDED.created_at_ms,
+        updated_at_ms = EXCLUDED.updated_at_ms,
+        expires_at_ms = EXCLUDED.expires_at_ms`, [
+			parsed.attemptId,
+			parsed.providerSubject,
+			parsed.email,
+			parsed.walletId,
+			parsed.state,
+			parsed.ownerProofBindingDigest,
+			parsed.runtimePolicyScope?.orgId || "",
+			runtimePolicyScopeKey(parsed.runtimePolicyScope),
+			JSON.stringify(parsed.offerCandidates.map((candidate) => candidate.walletId)),
+			JSON.stringify(parsed),
+			parsed.createdAtMs,
+			parsed.updatedAtMs,
+			parsed.expiresAtMs
+		]).run();
+	}
+	async get(attemptId) {
+		await this.ensureSchema();
+		const id = normalizeOptionalTrimmedString(attemptId);
+		if (!id) return null;
+		const row = await this.bindScope(`SELECT record_json, expires_at_ms, updated_at_ms, attempt_id
+         FROM email_otp_registration_attempts
+        WHERE namespace = ?
+          AND org_id = ?
+          AND project_id = ?
+          AND env_id = ?
+          AND attempt_id = ?
+        LIMIT 1`, [id]).first();
+		const parsed = parseCurrentGoogleEmailOtpRegistrationAttemptRow({
+			recordJson: parseJsonRecord(row?.record_json),
+			expiresAtMs: row?.expires_at_ms,
+			updatedAtMs: row?.updated_at_ms
+		});
+		if (!row) return null;
+		if (!parsed) {
+			await this.deleteAttempt(id);
+			return null;
+		}
+		return cloneRecord(parsed);
+	}
+	async findStartedBySubjectEmail(input) {
+		await this.ensureSchema();
+		const row = await this.bindScope(`SELECT record_json, expires_at_ms, updated_at_ms, attempt_id
+         FROM email_otp_registration_attempts
+        WHERE namespace = ?
+          AND org_id = ?
+          AND project_id = ?
+          AND env_id = ?
+          AND provider_subject = ?
+          AND email = ?
+          AND state IN ('started', 'key_finalized')
+          AND expires_at_ms > ?
+          AND owner_proof_binding_digest = ?
+          AND runtime_org_id = ?
+          AND runtime_policy_key = ?
+        ORDER BY updated_at_ms DESC
+        LIMIT 1`, [
+			input.providerSubject,
+			input.email,
+			input.nowMs,
+			input.ownerProofBindingDigest,
+			input.orgId,
+			runtimePolicyScopeKey(input.runtimePolicyScope)
+		]).first();
+		const parsed = parseCurrentGoogleEmailOtpRegistrationAttemptRow({
+			recordJson: parseJsonRecord(row?.record_json),
+			expiresAtMs: row?.expires_at_ms,
+			updatedAtMs: row?.updated_at_ms
+		});
+		if (parsed && registrationAttemptMatchesStartedScope(parsed, input)) return cloneRecord(parsed);
+		const malformedAttemptId = normalizeOptionalTrimmedString(row?.attempt_id);
+		if (row && !parsed && malformedAttemptId) await this.deleteAttempt(malformedAttemptId);
+		return null;
+	}
+	async abandonStartedBySubjectEmailExceptBinding(input) {
+		await this.ensureSchema();
+		const result = await this.bindScope(`SELECT record_json, expires_at_ms, updated_at_ms, attempt_id
+         FROM email_otp_registration_attempts
+        WHERE namespace = ?
+          AND org_id = ?
+          AND project_id = ?
+          AND env_id = ?
+          AND provider_subject = ?
+          AND email = ?
+          AND state IN ('started', 'key_finalized')
+          AND expires_at_ms > ?`, [
+			input.providerSubject,
+			input.email,
+			input.nowMs
+		]).all();
+		let abandoned = 0;
+		for (const row of result.results || []) {
+			const parsed = parseCurrentGoogleEmailOtpRegistrationAttemptRow({
+				recordJson: parseJsonRecord(row.record_json),
+				expiresAtMs: row.expires_at_ms,
+				updatedAtMs: row.updated_at_ms
+			});
+			if (!parsed) {
+				const attemptId = normalizeOptionalTrimmedString(row.attempt_id);
+				if (attemptId) await this.deleteAttempt(attemptId);
+				continue;
+			}
+			if (!registrationAttemptMatchesReplacementScope(parsed, input)) continue;
+			await this.put({
+				...parsed,
+				state: "abandoned",
+				failureCode: input.failureCode,
+				updatedAtMs: input.nowMs
+			});
+			abandoned += 1;
+		}
+		return abandoned;
+	}
+	async hasLiveStartedWalletAttempt(input) {
+		await this.ensureSchema();
+		const walletId = normalizeOptionalTrimmedString(input.walletId);
+		if (!walletId) return false;
+		const row = await this.bindScope(`SELECT 1 AS found
+         FROM email_otp_registration_attempts
+        WHERE namespace = ?
+          AND org_id = ?
+          AND project_id = ?
+          AND env_id = ?
+          AND state IN ('started', 'key_finalized')
+          AND expires_at_ms > ?
+          AND (
+            wallet_id = ?
+            OR EXISTS (
+              SELECT 1
+                FROM json_each(offer_wallet_ids_json)
+               WHERE value = ?
+            )
+          )
+        LIMIT 1`, [
+			input.nowMs,
+			walletId,
+			walletId
+		]).first();
+		return Boolean(row);
+	}
+	async deleteExpired(nowMs) {
+		await this.ensureSchema();
+		return d1ChangedRows(await this.bindScope(`DELETE FROM email_otp_registration_attempts
+        WHERE namespace = ?
+          AND org_id = ?
+          AND project_id = ?
+          AND env_id = ?
+          AND (expires_at_ms <= ? OR state = 'expired')`, [nowMs]).run());
+	}
+	async deleteAttempt(attemptId) {
+		const id = normalizeOptionalTrimmedString(attemptId);
+		if (!id) return;
+		await this.bindScope(`DELETE FROM email_otp_registration_attempts
+        WHERE namespace = ?
+          AND org_id = ?
+          AND project_id = ?
+          AND env_id = ?
+          AND attempt_id = ?`, [id]).run();
+	}
+};
+function createEmailOtpChallengeStore(input) {
+	const d1 = resolveD1EmailOtpStoreOptions(input, "challenge");
+	if (d1) {
+		input?.logger?.info("[email-otp] Using D1 challenge store");
+		return new D1EmailOtpChallengeStore(d1);
+	}
+	assertEmailOtpStoreKindKnown(input, "challenge");
+	input?.logger?.info("[email-otp] Using in-memory challenge store (non-persistent)");
+	return new InMemoryEmailOtpChallengeStore();
+}
+function createEmailOtpGrantStore(input) {
+	const d1 = resolveD1EmailOtpStoreOptions(input, "grant");
+	if (d1) {
+		input?.logger?.info("[email-otp] Using D1 grant store");
+		return new D1EmailOtpGrantStore(d1);
+	}
+	assertEmailOtpStoreKindKnown(input, "grant");
+	input?.logger?.info("[email-otp] Using in-memory grant store (non-persistent)");
+	return new InMemoryEmailOtpGrantStore();
+}
+function createEmailOtpWalletEnrollmentStore(input) {
+	const d1 = resolveD1EmailOtpStoreOptions(input, "wallet enrollment");
+	if (d1) {
+		input?.logger?.info("[email-otp] Using D1 wallet enrollment store");
+		return new D1EmailOtpWalletEnrollmentStore(d1);
+	}
+	assertEmailOtpStoreKindKnown(input, "enrollment");
+	input?.logger?.info("[email-otp] Using in-memory wallet enrollment store (non-persistent)");
+	return new InMemoryEmailOtpWalletEnrollmentStore();
+}
+function createEmailOtpAuthStateStore(input) {
+	const d1 = resolveD1EmailOtpStoreOptions(input, "auth state");
+	if (d1) {
+		input?.logger?.info("[email-otp] Using D1 auth state store");
+		return new D1EmailOtpAuthStateStore(d1);
+	}
+	assertEmailOtpStoreKindKnown(input, "auth state");
+	input?.logger?.info("[email-otp] Using in-memory auth state store (non-persistent)");
+	return new InMemoryEmailOtpAuthStateStore();
+}
+function createEmailOtpUnlockChallengeStore(input) {
+	const d1 = resolveD1EmailOtpStoreOptions(input, "unlock challenge");
+	if (d1) {
+		input?.logger?.info("[email-otp] Using D1 unlock challenge store");
+		return new D1EmailOtpUnlockChallengeStore(d1);
+	}
+	assertEmailOtpStoreKindKnown(input, "unlock challenge");
+	input?.logger?.info("[email-otp] Using in-memory unlock challenge store (non-persistent)");
+	return new InMemoryEmailOtpUnlockChallengeStore();
+}
+function createEmailOtpRegistrationAttemptStore(input) {
+	const d1 = resolveD1EmailOtpStoreOptions(input, "registration attempt");
+	if (d1) {
+		input?.logger?.info("[email-otp] Using D1 registration attempt store");
+		return new D1EmailOtpRegistrationAttemptStore(d1);
+	}
+	assertEmailOtpStoreKindKnown(input, "registration attempt");
+	input?.logger?.info("[email-otp] Using in-memory registration attempt store (non-persistent)");
+	return new InMemoryEmailOtpRegistrationAttemptStore();
+}
+//#endregion
+export { D1EmailOtpAuthStateStore, D1EmailOtpChallengeStore, D1EmailOtpGrantStore, D1EmailOtpRegistrationAttemptStore, D1EmailOtpUnlockChallengeStore, D1EmailOtpWalletEnrollmentStore, EMAIL_OTP_STORE_D1_SCHEMA_SQL, createEmailOtpAuthStateStore, createEmailOtpChallengeStore, createEmailOtpGrantStore, createEmailOtpRegistrationAttemptStore, createEmailOtpUnlockChallengeStore, createEmailOtpWalletEnrollmentStore, ensureEmailOtpStoreD1Schema, resolveEmailOtpStoreNamespace };
+
+//# sourceMappingURL=EmailOtpStores.js.map