@seams/wallet-server 0.5.0

package/dist/esm/core/authService/emailOtpChallengeOperations.js

@@ -0,0 +1,126 @@
+import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
+import "../../shared-ts/src/utils/validation.js";
+import { WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../shared-ts/src/utils/emailOtpDomain.js";
+import { randomBase64Url } from "./bytes.js";
+//#region src/core/authService/emailOtpChallengeOperations.ts
+function loginOperationFromRequest(request) {
+	const operationRaw = normalizeOptionalTrimmedString(request.operation);
+	return operationRaw === "transaction_sign" || operationRaw === "export_key" ? operationRaw : WALLET_EMAIL_OTP_UNLOCK_OPERATION;
+}
+function createGrantToken() {
+	return typeof crypto === "undefined" || typeof crypto.getRandomValues !== "function" ? null : randomBase64Url(24);
+}
+function unsupportedCryptoResult() {
+	return {
+		ok: false,
+		code: "unsupported",
+		message: "crypto.getRandomValues is unavailable in this runtime"
+	};
+}
+async function createEmailOtpChallenge(input, request) {
+	const result = await input.createChallengeWithAction({
+		challengeSubjectId: request.userId,
+		walletId: request.walletId,
+		orgId: request.orgId,
+		email: request.email,
+		otpChannel: request.otpChannel,
+		ownerProofBindingDigest: request.ownerProofBindingDigest,
+		clientIp: request.clientIp,
+		operation: request.operation,
+		reuseActiveChallenge: request.reuseActiveChallenge,
+		action: WALLET_EMAIL_OTP_ACTIONS.login
+	});
+	if (!result.ok) return result;
+	const operation = result.challenge.operation === "transaction_sign" || result.challenge.operation === "export_key" ? result.challenge.operation : WALLET_EMAIL_OTP_UNLOCK_OPERATION;
+	return {
+		ok: true,
+		challenge: {
+			challengeId: result.challenge.challengeId,
+			issuedAtMs: result.challenge.issuedAtMs,
+			expiresAtMs: result.challenge.expiresAtMs,
+			userId: result.challenge.challengeSubjectId,
+			walletId: result.challenge.walletId,
+			orgId: result.challenge.orgId,
+			otpChannel: result.challenge.otpChannel,
+			ownerProofBindingDigest: result.challenge.ownerProofBindingDigest,
+			action: WALLET_EMAIL_OTP_ACTIONS.login,
+			operation
+		},
+		delivery: result.delivery
+	};
+}
+async function createEmailOtpEnrollmentChallenge(input, request) {
+	const result = await input.createChallengeWithAction({
+		challengeSubjectId: request.userId,
+		walletId: request.walletId,
+		orgId: request.orgId,
+		email: request.email,
+		otpChannel: request.otpChannel,
+		ownerProofBindingDigest: request.ownerProofBindingDigest,
+		clientIp: request.clientIp,
+		operation: request.operation,
+		action: WALLET_EMAIL_OTP_ACTIONS.registration
+	});
+	if (!result.ok) return result;
+	return {
+		ok: true,
+		challenge: {
+			challengeId: result.challenge.challengeId,
+			issuedAtMs: result.challenge.issuedAtMs,
+			expiresAtMs: result.challenge.expiresAtMs,
+			userId: result.challenge.challengeSubjectId,
+			walletId: result.challenge.walletId,
+			orgId: result.challenge.orgId,
+			otpChannel: result.challenge.otpChannel,
+			ownerProofBindingDigest: result.challenge.ownerProofBindingDigest,
+			action: WALLET_EMAIL_OTP_ACTIONS.registration,
+			operation: WALLET_EMAIL_OTP_REGISTRATION_OPERATION
+		},
+		delivery: result.delivery
+	};
+}
+async function verifyEmailOtpChallenge(input, request) {
+	const expectedOperation = loginOperationFromRequest(request);
+	const verified = await input.verifyChallengeCode({
+		challengeSubjectId: request.userId,
+		walletId: request.walletId,
+		orgId: request.orgId,
+		challengeId: request.challengeId,
+		otpCode: request.otpCode,
+		otpChannel: request.otpChannel,
+		ownerProofBindingDigest: request.ownerProofBindingDigest,
+		clientIp: request.clientIp,
+		expectedAction: WALLET_EMAIL_OTP_ACTIONS.login,
+		expectedOperation
+	});
+	if (!verified.ok) return verified;
+	const grantToken = createGrantToken();
+	if (!grantToken) return unsupportedCryptoResult();
+	const otpConfig = input.resolveConfig();
+	const issuedAtMs = Date.now();
+	const grantExpiresAtMs = issuedAtMs + otpConfig.grantTtlMs;
+	await input.grantStore.put({
+		version: "email_otp_grant_v1",
+		grantToken,
+		userId: verified.challengeSubjectId,
+		walletId: verified.walletId,
+		orgId: verified.orgId,
+		challengeId: verified.challengeId,
+		otpChannel: verified.otpChannel,
+		ownerProofBindingDigest: String(request.ownerProofBindingDigest || "").trim(),
+		action: WALLET_EMAIL_OTP_ACTIONS.unseal,
+		issuedAtMs,
+		expiresAtMs: grantExpiresAtMs
+	});
+	return {
+		ok: true,
+		challengeId: verified.challengeId,
+		loginGrant: grantToken,
+		grantExpiresAtMs,
+		otpChannel: verified.otpChannel
+	};
+}
+//#endregion
+export { createEmailOtpChallenge, createEmailOtpEnrollmentChallenge, verifyEmailOtpChallenge };
+
+//# sourceMappingURL=emailOtpChallengeOperations.js.map

package/dist/esm/core/authService/emailOtpChallengeProof.js

@@ -0,0 +1,214 @@
+import { parseChallengeSubjectId, parseEmailOtpChallengeId, parseEmailOtpRegistrationAttemptId, parseOrgId, parseProviderSubject, parseWalletId } from "../../shared-ts/src/utils/domainIds.js";
+import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
+import "../../shared-ts/src/utils/validation.js";
+import { WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_EXPORT_OPERATION, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../shared-ts/src/utils/emailOtpDomain.js";
+//#region src/core/authService/emailOtpChallengeProof.ts
+function assertNever(value) {
+	throw new Error(`Unexpected value: ${String(value)}`);
+}
+function emailOtpChallengeVerificationIntentFromRequest(input) {
+	if (input.expectedAction === WALLET_EMAIL_OTP_ACTIONS.registration) {
+		if (!input.registrationChallengeProof) throw new Error("Email OTP registration verification requires registration challenge proof");
+		return {
+			kind: "registration",
+			binding: input.registrationChallengeProof,
+			allowWalletReroll: input.allowRegistrationChallengeReroll === true
+		};
+	}
+	const operation = input.expectedOperation || "wallet_unlock";
+	if (operation === "transaction_sign") return { kind: "transaction_sign" };
+	if (operation === "export_key") return { kind: "export_key" };
+	return { kind: "wallet_unlock" };
+}
+function expectedEmailOtpStoredChallengePurpose(intent) {
+	switch (intent.kind) {
+		case "registration": return {
+			kind: "registration",
+			action: WALLET_EMAIL_OTP_ACTIONS.registration,
+			operation: WALLET_EMAIL_OTP_REGISTRATION_OPERATION
+		};
+		case "wallet_unlock": return {
+			kind: "wallet_unlock",
+			action: WALLET_EMAIL_OTP_ACTIONS.login,
+			operation: WALLET_EMAIL_OTP_UNLOCK_OPERATION
+		};
+		case "transaction_sign": return {
+			kind: "transaction_sign",
+			action: WALLET_EMAIL_OTP_ACTIONS.login,
+			operation: WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION
+		};
+		case "export_key": return {
+			kind: "export_key",
+			action: WALLET_EMAIL_OTP_ACTIONS.login,
+			operation: WALLET_EMAIL_OTP_EXPORT_OPERATION
+		};
+	}
+	return assertNever(intent);
+}
+function readEmailOtpStoredChallengePurpose(record) {
+	if (record.action === WALLET_EMAIL_OTP_ACTIONS.registration && record.operation === "registration") return {
+		kind: "registration",
+		action: WALLET_EMAIL_OTP_ACTIONS.registration,
+		operation: WALLET_EMAIL_OTP_REGISTRATION_OPERATION
+	};
+	if (record.action === WALLET_EMAIL_OTP_ACTIONS.login) {
+		if (record.operation === "transaction_sign") return {
+			kind: "transaction_sign",
+			action: WALLET_EMAIL_OTP_ACTIONS.login,
+			operation: WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION
+		};
+		if (record.operation === "export_key") return {
+			kind: "export_key",
+			action: WALLET_EMAIL_OTP_ACTIONS.login,
+			operation: WALLET_EMAIL_OTP_EXPORT_OPERATION
+		};
+		if (record.operation === "wallet_unlock") return {
+			kind: "wallet_unlock",
+			action: WALLET_EMAIL_OTP_ACTIONS.login,
+			operation: WALLET_EMAIL_OTP_UNLOCK_OPERATION
+		};
+	}
+	return null;
+}
+function emailOtpStoredChallengePurposeMatches(input) {
+	if (!input.actual) return false;
+	return input.actual.kind === input.expected.kind && input.actual.action === input.expected.action && input.actual.operation === input.expected.operation;
+}
+function emailOtpRegistrationChallengePurposeForRecord(input) {
+	if (input.storedPurpose?.kind === "registration") return {
+		kind: "registration",
+		action: WALLET_EMAIL_OTP_ACTIONS.registration,
+		operation: WALLET_EMAIL_OTP_REGISTRATION_OPERATION
+	};
+	if (input.allowWalletReroll && input.storedPurpose?.kind === "wallet_unlock") return {
+		kind: "registration_reroll",
+		action: WALLET_EMAIL_OTP_ACTIONS.login,
+		operation: WALLET_EMAIL_OTP_UNLOCK_OPERATION
+	};
+	return null;
+}
+function buildVerifiedEmailOtpRegistrationChallengeProof(input) {
+	if (input.record.challengeSubjectId !== input.challengeSubjectId) return null;
+	if (input.proof.challengeSubjectId !== input.challengeSubjectId) return null;
+	if (String(input.proof.providerSubject) !== String(input.proof.challengeSubjectId)) return null;
+	if (input.record.otpChannel !== "email_otp") return null;
+	if (String(input.record.orgId || "") !== input.proof.orgId) return null;
+	const purpose = emailOtpRegistrationChallengePurposeForRecord({
+		storedPurpose: input.storedPurpose,
+		allowWalletReroll: input.allowWalletReroll
+	});
+	if (!purpose) return null;
+	const proofEmail = normalizeOptionalTrimmedString(input.proof.proofEmail)?.toLowerCase();
+	const challengeEmail = normalizeOptionalTrimmedString(input.record.email)?.toLowerCase();
+	if (!proofEmail || !challengeEmail || proofEmail !== challengeEmail) return null;
+	const originalWalletId = parseWalletId(input.record.walletId);
+	if (!originalWalletId.ok) return null;
+	switch (input.proof.kind) {
+		case "registration_attempt": return {
+			kind: "registration_attempt",
+			providerSubject: input.proof.providerSubject,
+			challengeSubjectId: input.proof.challengeSubjectId,
+			challengeEmail,
+			challengeId: input.proof.challengeId,
+			originalWalletId: originalWalletId.value,
+			finalWalletId: input.proof.finalWalletId,
+			orgId: input.proof.orgId,
+			ownerProofBindingDigest: input.proof.ownerProofBindingDigest,
+			purpose,
+			registrationAttemptId: input.proof.registrationAttemptId
+		};
+		case "direct_proof_email": return {
+			kind: "direct_proof_email",
+			providerSubject: input.proof.providerSubject,
+			challengeSubjectId: input.proof.challengeSubjectId,
+			challengeEmail,
+			challengeId: input.proof.challengeId,
+			originalWalletId: originalWalletId.value,
+			finalWalletId: input.proof.finalWalletId,
+			orgId: input.proof.orgId,
+			ownerProofBindingDigest: input.proof.ownerProofBindingDigest,
+			purpose
+		};
+	}
+	return assertNever(input.proof);
+}
+function parseRawEmailOtpRegistrationChallengeProofInput(request) {
+	const providerSubject = parseProviderSubject(request.providerSubject);
+	if (!providerSubject.ok) return {
+		ok: false,
+		code: "invalid_body",
+		message: "Email OTP registration requires providerSubject"
+	};
+	const challengeSubjectId = parseChallengeSubjectId(request.providerSubject);
+	if (!challengeSubjectId.ok) return {
+		ok: false,
+		code: "invalid_body",
+		message: "Email OTP registration requires challengeSubjectId"
+	};
+	const challengeId = parseEmailOtpChallengeId(request.challengeId);
+	if (!challengeId.ok) return {
+		ok: false,
+		code: "invalid_body",
+		message: "Email OTP registration requires challengeId"
+	};
+	const finalWalletId = parseWalletId(request.walletId);
+	if (!finalWalletId.ok) return {
+		ok: false,
+		code: "invalid_body",
+		message: "Email OTP registration requires walletId"
+	};
+	const orgId = parseOrgId(request.orgId);
+	if (!orgId.ok) return {
+		ok: false,
+		code: "invalid_body",
+		message: "Email OTP registration requires orgId"
+	};
+	const ownerProofBindingDigest = normalizeOptionalTrimmedString(request.ownerProofBindingDigest);
+	if (!ownerProofBindingDigest) return {
+		ok: false,
+		code: "invalid_body",
+		message: "Email OTP registration requires ownerProofBindingDigest"
+	};
+	const registrationAttemptId = parseEmailOtpRegistrationAttemptId(request.googleEmailOtpRegistrationAttemptId);
+	if (registrationAttemptId.ok) return {
+		ok: true,
+		input: {
+			kind: "google_registration_attempt",
+			providerSubject: providerSubject.value,
+			challengeSubjectId: challengeSubjectId.value,
+			walletId: finalWalletId.value,
+			orgId: orgId.value,
+			ownerProofBindingDigest,
+			registrationAttemptId: registrationAttemptId.value,
+			challengeId: challengeId.value
+		}
+	};
+	if (registrationAttemptId.error.code === "invalid") return {
+		ok: false,
+		code: "invalid_body",
+		message: "googleEmailOtpRegistrationAttemptId must be a string"
+	};
+	const proofEmail = normalizeOptionalTrimmedString(request.proofEmail)?.toLowerCase();
+	if (!proofEmail) return {
+		ok: false,
+		code: "invalid_body",
+		message: "Email OTP registration requires proofEmail"
+	};
+	return {
+		ok: true,
+		input: {
+			kind: "direct_proof_email",
+			providerSubject: providerSubject.value,
+			challengeSubjectId: challengeSubjectId.value,
+			finalWalletId: finalWalletId.value,
+			orgId: orgId.value,
+			ownerProofBindingDigest,
+			proofEmail,
+			challengeId: challengeId.value
+		}
+	};
+}
+//#endregion
+export { buildVerifiedEmailOtpRegistrationChallengeProof, emailOtpChallengeVerificationIntentFromRequest, emailOtpRegistrationChallengePurposeForRecord, emailOtpStoredChallengePurposeMatches, expectedEmailOtpStoredChallengePurpose, parseRawEmailOtpRegistrationChallengeProofInput, readEmailOtpStoredChallengePurpose };
+
+//# sourceMappingURL=emailOtpChallengeProof.js.map

package/dist/esm/core/authService/emailOtpChallengeVerification.js

@@ -0,0 +1,335 @@
+import { parseChallengeSubjectId, parseEmailOtpChallengeId, parseOrgId, parseWalletId } from "../../shared-ts/src/utils/domainIds.js";
+import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
+import "../../shared-ts/src/utils/validation.js";
+import { errorMessage } from "../../shared-ts/src/utils/errors.js";
+import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS } from "../../shared-ts/src/utils/emailOtpDomain.js";
+import { pruneExpiredEmailOtpChallengesWithStore } from "./emailOtpChallenges.js";
+import { buildVerifiedEmailOtpRegistrationChallengeProof, emailOtpChallengeVerificationIntentFromRequest, emailOtpStoredChallengePurposeMatches, expectedEmailOtpStoredChallengePurpose, readEmailOtpStoredChallengePurpose } from "./emailOtpChallengeProof.js";
+//#region src/core/authService/emailOtpChallengeVerification.ts
+async function verifyEmailOtpChallengeCode(input) {
+	const request = input.request;
+	try {
+		const challengeSubjectId = parseChallengeSubjectId(request.challengeSubjectId);
+		const walletId = parseWalletId(request.walletId);
+		const orgId = parseOrgId(request.orgId);
+		const challengeId = parseEmailOtpChallengeId(request.challengeId);
+		const otpCode = normalizeOptionalTrimmedString(request.otpCode);
+		const otpChannel = normalizeOptionalTrimmedString(request.otpChannel);
+		const ownerProofBindingDigest = normalizeOptionalTrimmedString(request.ownerProofBindingDigest);
+		const clientIp = normalizeOptionalTrimmedString(request.clientIp) || void 0;
+		const expectedAction = request.expectedAction;
+		const expectedOperation = request.expectedOperation;
+		if (expectedAction === WALLET_EMAIL_OTP_ACTIONS.registration && !request.registrationChallengeProof) return {
+			ok: false,
+			code: "invalid_body",
+			message: "Email OTP registration verification requires registration challenge proof"
+		};
+		const verificationIntent = emailOtpChallengeVerificationIntentFromRequest({
+			expectedAction,
+			...expectedOperation ? { expectedOperation } : {},
+			...request.registrationChallengeProof ? { registrationChallengeProof: request.registrationChallengeProof } : {},
+			...request.allowRegistrationChallengeReroll ? { allowRegistrationChallengeReroll: true } : {}
+		});
+		const expectedPurpose = expectedEmailOtpStoredChallengePurpose(verificationIntent);
+		if (!challengeSubjectId.ok) return {
+			ok: false,
+			code: "invalid_body",
+			message: "Missing challengeSubjectId"
+		};
+		if (!walletId.ok) return {
+			ok: false,
+			code: "invalid_body",
+			message: "Missing walletId"
+		};
+		if (!orgId.ok) return {
+			ok: false,
+			code: "invalid_body",
+			message: "Missing orgId"
+		};
+		if (!challengeId.ok) return {
+			ok: false,
+			code: "invalid_body",
+			message: "Missing challengeId"
+		};
+		if (request.registrationChallengeProof && request.registrationChallengeProof.challengeId !== challengeId.value) return {
+			ok: false,
+			code: "challenge_id_mismatch",
+			message: "Email OTP registration proof does not match challengeId"
+		};
+		if (request.registrationChallengeProof && request.registrationChallengeProof.finalWalletId !== walletId.value) return {
+			ok: false,
+			code: "challenge_wallet_mismatch",
+			message: "Email OTP registration proof does not match walletId"
+		};
+		if (request.registrationChallengeProof && request.registrationChallengeProof.orgId !== orgId.value) return {
+			ok: false,
+			code: "challenge_org_mismatch",
+			message: "Email OTP registration proof does not match orgId"
+		};
+		if (!otpCode) return {
+			ok: false,
+			code: "invalid_body",
+			message: "Missing otpCode"
+		};
+		if (otpChannel !== "email_otp") return {
+			ok: false,
+			code: "invalid_body",
+			message: "otpChannel must be email_otp"
+		};
+		if (!ownerProofBindingDigest) return {
+			ok: false,
+			code: "invalid_body",
+			message: "Missing ownerProofBindingDigest"
+		};
+		const rateLimit = await input.consumeRateLimit({
+			scope: "verify",
+			action: expectedAction,
+			userId: challengeSubjectId.value,
+			walletId: walletId.value,
+			orgId: orgId.value,
+			clientIp
+		});
+		if (!rateLimit.ok) return rateLimit;
+		const activeEnrollment = expectedAction !== WALLET_EMAIL_OTP_ACTIONS.registration ? await input.readActiveEnrollment({
+			walletId: walletId.value,
+			orgId: orgId.value
+		}) : null;
+		if (activeEnrollment && !activeEnrollment.ok) return activeEnrollment;
+		const enrollment = activeEnrollment?.ok ? activeEnrollment.enrollment : await input.walletEnrollmentStore.get(walletId.value);
+		if (enrollment && enrollment.orgId !== orgId.value) return {
+			ok: false,
+			code: "tenant_scope_mismatch",
+			message: "Email OTP enrollment does not match the requested orgId"
+		};
+		const authStateResult = enrollment ? await input.readEnrollmentAuthState(enrollment) : {
+			ok: true,
+			state: null
+		};
+		if (!authStateResult.ok) return authStateResult;
+		const authState = authStateResult.state;
+		const activeLockoutUntilMs = authState?.otpLockedUntilMs && authState.otpLockedUntilMs > Date.now() ? authState.otpLockedUntilMs : void 0;
+		if (activeLockoutUntilMs) return {
+			ok: false,
+			code: "otp_locked_out",
+			message: "Email OTP is temporarily locked for this wallet",
+			lockedUntilMs: activeLockoutUntilMs
+		};
+		const challengeStore = input.challengeStore;
+		const nowMs = Date.now();
+		await pruneExpiredEmailOtpChallengesWithStore({
+			challengeStore,
+			memoryOutbox: input.memoryOutbox,
+			nowMs
+		});
+		let record = await challengeStore.get(challengeId.value);
+		if (!record) {
+			record = await challengeStore.findActiveByContext({
+				challengeSubjectId: challengeSubjectId.value,
+				walletId: walletId.value,
+				orgId: orgId.value,
+				otpChannel: EMAIL_OTP_CHANNEL,
+				ownerProofBindingDigest,
+				action: expectedAction,
+				operation: expectedPurpose.operation,
+				otpCode,
+				nowMs
+			});
+			if (!record) {
+				input.logger.warn("[email-otp] challenge record not found during verification", {
+					challengeId: challengeId.value,
+					walletId: walletId.value,
+					challengeSubjectId: challengeSubjectId.value,
+					otpChannel: EMAIL_OTP_CHANNEL,
+					action: expectedAction
+				});
+				return {
+					ok: false,
+					code: "challenge_expired_or_invalid",
+					message: "Email OTP challenge expired or invalid"
+				};
+			}
+		}
+		if (nowMs > record.expiresAtMs) {
+			await challengeStore.del(record.challengeId);
+			input.memoryOutbox.delete(record.challengeId);
+			return {
+				ok: false,
+				code: "challenge_expired_or_invalid",
+				message: "Email OTP challenge expired or invalid"
+			};
+		}
+		const storedPurpose = readEmailOtpStoredChallengePurpose(record);
+		const purposeMatches = emailOtpStoredChallengePurposeMatches({
+			expected: expectedPurpose,
+			actual: storedPurpose
+		});
+		const verifiedRegistrationChallengeProof = verificationIntent.kind === "registration" ? buildVerifiedEmailOtpRegistrationChallengeProof({
+			record,
+			challengeSubjectId: challengeSubjectId.value,
+			proof: verificationIntent.binding,
+			storedPurpose,
+			allowWalletReroll: verificationIntent.allowWalletReroll
+		}) : null;
+		const registrationChallengeCanFollowReroll = verifiedRegistrationChallengeProof != null;
+		const registrationChallengeEmailMatches = verificationIntent.kind === "registration" && normalizeOptionalTrimmedString(record.email)?.toLowerCase() === normalizeOptionalTrimmedString(verificationIntent.binding.proofEmail)?.toLowerCase();
+		const registrationRerollDisallowed = verificationIntent.kind === "registration" && storedPurpose?.kind === "wallet_unlock" && !verificationIntent.allowWalletReroll;
+		const subjectMismatch = registrationChallengeCanFollowReroll ? false : record.challengeSubjectId !== challengeSubjectId.value;
+		const walletMismatch = registrationChallengeCanFollowReroll ? false : record.walletId !== walletId.value;
+		const actionMismatch = registrationChallengeCanFollowReroll ? false : !purposeMatches;
+		const operationMismatch = registrationChallengeCanFollowReroll ? false : !purposeMatches;
+		const ownerProofBindingMismatch = registrationChallengeCanFollowReroll ? false : record.ownerProofBindingDigest !== ownerProofBindingDigest;
+		if (subjectMismatch || walletMismatch || record.otpChannel !== "email_otp" || actionMismatch || operationMismatch || ownerProofBindingMismatch || String(record.orgId || "") !== String(orgId.value || "")) {
+			const mismatchCode = record.otpChannel !== "email_otp" ? "challenge_channel_mismatch" : subjectMismatch ? "challenge_subject_mismatch" : verificationIntent.kind === "registration" && !registrationChallengeEmailMatches ? "challenge_email_mismatch" : String(record.orgId || "") !== String(orgId.value || "") ? "challenge_org_mismatch" : registrationRerollDisallowed ? "registration_reroll_disallowed" : actionMismatch || operationMismatch ? "challenge_purpose_mismatch" : walletMismatch ? "challenge_wallet_mismatch" : ownerProofBindingMismatch ? "challenge_session_mismatch" : "challenge_org_mismatch";
+			input.logger.warn("[email-otp] challenge binding mismatch during verification", {
+				challengeId: record.challengeId,
+				expectedChallengeId: challengeId.value,
+				expectedAction,
+				expectedOperation: expectedOperation || null,
+				recordAction: record.action,
+				recordOperation: record.operation,
+				hasRegistrationChallengeProof: request.registrationChallengeProof != null,
+				registrationChallengeCanFollowReroll,
+				registrationRerollDisallowed,
+				registrationChallengeEmailMatches,
+				registrationChallengePurpose: verifiedRegistrationChallengeProof?.purpose.kind || null,
+				subjectMatches: !subjectMismatch,
+				walletMatches: !walletMismatch,
+				otpChannelMatches: record.otpChannel === EMAIL_OTP_CHANNEL,
+				actionMatches: !actionMismatch,
+				operationMatches: !operationMismatch,
+				ownerProofBindingMatches: !ownerProofBindingMismatch,
+				orgMatches: String(record.orgId || "") === String(orgId.value || ""),
+				recordWalletId: record.walletId,
+				requestWalletId: walletId.value,
+				mismatchCode,
+				expectedPurpose,
+				storedPurpose
+			});
+			return {
+				ok: false,
+				code: mismatchCode,
+				message: "Email OTP challenge is not valid for the current owner proof binding"
+			};
+		}
+		if (registrationChallengeCanFollowReroll) input.logger.info("[email-otp] registration reroll challenge validation", {
+			challengeId: record.challengeId,
+			registrationAttemptId: verifiedRegistrationChallengeProof.kind === "registration_attempt" ? verifiedRegistrationChallengeProof.registrationAttemptId : null,
+			originalWalletId: verifiedRegistrationChallengeProof.originalWalletId,
+			finalWalletId: verifiedRegistrationChallengeProof.finalWalletId,
+			providerSubject: verifiedRegistrationChallengeProof.providerSubject,
+			providerSubjectMatches: record.challengeSubjectId === verifiedRegistrationChallengeProof.challengeSubjectId,
+			proofEmailMatches: registrationChallengeEmailMatches,
+			orgMatches: String(record.orgId || "") === String(verifiedRegistrationChallengeProof.orgId),
+			purpose: verifiedRegistrationChallengeProof.purpose,
+			expectedPurpose,
+			storedPurpose
+		});
+		if (record.otpCode !== otpCode) {
+			const matchingRecord = await challengeStore.findActiveByContext({
+				challengeSubjectId: challengeSubjectId.value,
+				walletId: walletId.value,
+				orgId: orgId.value,
+				otpChannel: EMAIL_OTP_CHANNEL,
+				ownerProofBindingDigest,
+				action: expectedAction,
+				operation: expectedOperation || record.operation,
+				otpCode,
+				nowMs
+			});
+			if (matchingRecord) record = matchingRecord;
+		}
+		if (record.otpCode !== otpCode) {
+			const nextAttemptCount = record.attemptCount + 1;
+			const otpConfig = input.resolveConfig();
+			const nextLockedUntilMs = nextAttemptCount >= record.maxAttempts ? Date.now() + otpConfig.lockoutTtlMs : void 0;
+			if (enrollment) {
+				const nowMsForFailure = Date.now();
+				const nextFailureCount = Number(authState?.otpFailureCount || 0) + 1;
+				await input.putEnrollmentAuthState(enrollment, {
+					otpFailureCount: nextFailureCount,
+					lastOtpFailureAtMs: nowMsForFailure,
+					...nextLockedUntilMs ? { otpLockedUntilMs: nextLockedUntilMs } : {}
+				});
+			}
+			if (nextAttemptCount >= record.maxAttempts) {
+				await challengeStore.del(record.challengeId);
+				input.memoryOutbox.delete(record.challengeId);
+				return {
+					ok: false,
+					code: "otp_attempts_exhausted",
+					message: "Email OTP challenge exceeded the maximum number of attempts",
+					attemptsRemaining: 0,
+					...nextLockedUntilMs ? { lockedUntilMs: nextLockedUntilMs } : {}
+				};
+			}
+			await challengeStore.put({
+				...record,
+				attemptCount: nextAttemptCount
+			});
+			return {
+				ok: false,
+				code: "invalid_otp",
+				message: "OTP code is invalid",
+				attemptsRemaining: record.maxAttempts - nextAttemptCount
+			};
+		}
+		await challengeStore.del(record.challengeId);
+		input.memoryOutbox.delete(record.challengeId);
+		if (enrollment) {
+			if (Number(authState?.otpFailureCount || 0) > 0 || authState?.lastOtpFailureAtMs != null || authState?.otpLockedUntilMs != null) await input.putEnrollmentAuthState(enrollment, {
+				otpFailureCount: 0,
+				lastOtpFailureAtMs: void 0,
+				otpLockedUntilMs: void 0
+			});
+		}
+		const verifiedChallengeId = parseEmailOtpChallengeId(record.challengeId);
+		if (!verifiedChallengeId.ok) return {
+			ok: false,
+			code: "internal",
+			message: "Email OTP challenge record has an invalid challenge id"
+		};
+		const successBase = {
+			challengeId: verifiedChallengeId.value,
+			challengeSubjectId: challengeSubjectId.value,
+			walletId: walletId.value,
+			orgId: orgId.value,
+			otpChannel: EMAIL_OTP_CHANNEL
+		};
+		if (record.email) successBase.email = record.email;
+		if (verificationIntent.kind === "registration") {
+			const finalRegistrationChallengeProof = buildVerifiedEmailOtpRegistrationChallengeProof({
+				record,
+				challengeSubjectId: challengeSubjectId.value,
+				proof: verificationIntent.binding,
+				storedPurpose: readEmailOtpStoredChallengePurpose(record),
+				allowWalletReroll: verificationIntent.allowWalletReroll
+			});
+			if (!finalRegistrationChallengeProof) return {
+				ok: false,
+				code: "challenge_purpose_mismatch",
+				message: "Email OTP challenge is not valid for registration"
+			};
+			return {
+				ok: true,
+				...successBase,
+				intent: "registration",
+				registrationChallengeProof: finalRegistrationChallengeProof
+			};
+		}
+		return {
+			ok: true,
+			...successBase,
+			intent: verificationIntent.kind
+		};
+	} catch (e) {
+		return {
+			ok: false,
+			code: "internal",
+			message: errorMessage(e) || "Failed to verify Email OTP challenge"
+		};
+	}
+}
+//#endregion
+export { verifyEmailOtpChallengeCode };
+
+//# sourceMappingURL=emailOtpChallengeVerification.js.map