@seams/wallet-server 0.5.0

package/dist/esm/core/authService/emailOtpChallenges.js

@@ -0,0 +1,260 @@
+import { base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
+import "../../shared-ts/src/utils/encoders.js";
+import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
+import "../../shared-ts/src/utils/validation.js";
+import { errorMessage } from "../../shared-ts/src/utils/errors.js";
+import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION, isWalletEmailOtpLoginOperation } from "../../shared-ts/src/utils/emailOtpDomain.js";
+import { randomNumericCode } from "./bytes.js";
+//#region src/core/authService/emailOtpChallenges.ts
+function activeChallengeLimit(value) {
+	return Math.max(1, Math.floor(value));
+}
+function emailOtpChallengeOperationFromRequest(input) {
+	if (input.operationRaw && isWalletEmailOtpLoginOperation(input.operationRaw)) return input.operationRaw;
+	if (input.operationRaw === "registration") return WALLET_EMAIL_OTP_REGISTRATION_OPERATION;
+	return input.action === WALLET_EMAIL_OTP_ACTIONS.registration ? WALLET_EMAIL_OTP_REGISTRATION_OPERATION : WALLET_EMAIL_OTP_UNLOCK_OPERATION;
+}
+function createdEmailOtpChallengeFromRecord(input) {
+	return {
+		challengeId: input.record.challengeId,
+		issuedAtMs: input.record.createdAtMs,
+		expiresAtMs: input.record.expiresAtMs,
+		challengeSubjectId: input.challengeSubjectId,
+		walletId: input.walletId,
+		orgId: input.orgId,
+		otpChannel: EMAIL_OTP_CHANNEL,
+		ownerProofBindingDigest: input.ownerProofBindingDigest,
+		action: input.action,
+		operation: input.operation
+	};
+}
+function emailOtpChallengeContextInput(context) {
+	return {
+		challengeSubjectId: context.challengeSubjectId,
+		walletId: context.walletId,
+		orgId: context.orgId,
+		otpChannel: context.otpChannel,
+		ownerProofBindingDigest: context.ownerProofBindingDigest,
+		action: context.action,
+		operation: context.operation,
+		nowMs: context.nowMs
+	};
+}
+async function pruneExpiredEmailOtpChallengesWithStore(input) {
+	const deleted = await input.challengeStore.deleteExpired(input.nowMs);
+	for (const record of deleted) input.memoryOutbox.delete(record.challengeId);
+	return deleted;
+}
+async function enforceEmailOtpActiveChallengeLimitWithStore(input) {
+	const maxActive = activeChallengeLimit(input.maxActiveChallenges);
+	const context = emailOtpChallengeContextInput(input.context);
+	while (await input.challengeStore.countActiveByContext(context) >= maxActive) {
+		const deleted = await input.challengeStore.deleteOldestActiveByContext(context);
+		if (!deleted) break;
+		input.memoryOutbox.delete(deleted.challengeId);
+	}
+}
+async function createEmailOtpChallengeWithAction(input) {
+	try {
+		const request = input.request;
+		const challengeSubjectId = normalizeOptionalTrimmedString(request.challengeSubjectId);
+		const walletId = normalizeOptionalTrimmedString(request.walletId);
+		const orgId = normalizeOptionalTrimmedString(request.orgId) || "";
+		const email = normalizeOptionalTrimmedString(request.email)?.toLowerCase() || "";
+		const otpChannel = normalizeOptionalTrimmedString(request.otpChannel);
+		const ownerProofBindingDigest = normalizeOptionalTrimmedString(request.ownerProofBindingDigest);
+		const clientIp = normalizeOptionalTrimmedString(request.clientIp) || void 0;
+		const reuseActiveChallenge = request.reuseActiveChallenge === true;
+		const action = request.action;
+		const operation = emailOtpChallengeOperationFromRequest({
+			action,
+			operationRaw: normalizeOptionalTrimmedString(request.operation)
+		});
+		if (!challengeSubjectId) return {
+			ok: false,
+			code: "invalid_body",
+			message: "Missing challengeSubjectId"
+		};
+		if (!walletId) return {
+			ok: false,
+			code: "invalid_body",
+			message: "Missing walletId"
+		};
+		if (!orgId) return {
+			ok: false,
+			code: "invalid_body",
+			message: "Missing orgId"
+		};
+		if (otpChannel !== "email_otp") return {
+			ok: false,
+			code: "invalid_body",
+			message: "otpChannel must be email_otp"
+		};
+		if (!ownerProofBindingDigest) return {
+			ok: false,
+			code: "invalid_body",
+			message: "Missing ownerProofBindingDigest"
+		};
+		const activeEnrollment = action !== WALLET_EMAIL_OTP_ACTIONS.registration ? await input.readActiveEnrollment({
+			walletId,
+			orgId
+		}) : null;
+		if (activeEnrollment && !activeEnrollment.ok) return activeEnrollment;
+		const existingEnrollment = activeEnrollment?.ok ? activeEnrollment.enrollment : null;
+		const existingAuthStateResult = existingEnrollment ? await input.readEnrollmentAuthState(existingEnrollment) : {
+			ok: true,
+			state: null
+		};
+		if (!existingAuthStateResult.ok) return existingAuthStateResult;
+		const existingAuthState = existingAuthStateResult.state;
+		const challengeEmail = action === WALLET_EMAIL_OTP_ACTIONS.registration ? email : existingEnrollment?.verifiedEmail || "";
+		if (!challengeEmail) return {
+			ok: false,
+			code: "recovery_email_missing",
+			message: "Authenticated identity does not include a recovery email"
+		};
+		if (existingAuthState?.otpLockedUntilMs && existingAuthState.otpLockedUntilMs > Date.now()) return {
+			ok: false,
+			code: "otp_locked_out",
+			message: "Email OTP is temporarily locked for this wallet",
+			lockedUntilMs: existingAuthState.otpLockedUntilMs
+		};
+		const issuedAtMs = Date.now();
+		await pruneExpiredEmailOtpChallengesWithStore({
+			challengeStore: input.challengeStore,
+			memoryOutbox: input.memoryOutbox,
+			nowMs: issuedAtMs
+		});
+		if (reuseActiveChallenge) {
+			const existingChallenge = await input.challengeStore.findLatestActiveByContext({
+				challengeSubjectId,
+				walletId,
+				orgId,
+				otpChannel: EMAIL_OTP_CHANNEL,
+				ownerProofBindingDigest,
+				action,
+				operation,
+				nowMs: issuedAtMs
+			});
+			if (existingChallenge) return {
+				ok: true,
+				challenge: createdEmailOtpChallengeFromRecord({
+					record: existingChallenge,
+					challengeSubjectId,
+					walletId,
+					orgId,
+					ownerProofBindingDigest,
+					action,
+					operation
+				}),
+				delivery: {
+					status: "reused",
+					mode: "memory",
+					emailHint: existingChallenge.email
+				}
+			};
+		}
+		const rateLimit = await input.consumeRateLimit({
+			scope: "challenge",
+			action,
+			userId: challengeSubjectId,
+			walletId,
+			orgId,
+			clientIp
+		});
+		if (!rateLimit.ok) return rateLimit;
+		if (typeof crypto === "undefined" || typeof crypto.getRandomValues !== "function") return {
+			ok: false,
+			code: "unsupported",
+			message: "crypto.getRandomValues is unavailable in this runtime"
+		};
+		const otpConfig = input.resolveConfig();
+		const expiresAtMs = issuedAtMs + otpConfig.challengeTtlMs;
+		const challengeId = base64UrlEncode(crypto.getRandomValues(new Uint8Array(16)));
+		const otpCode = randomNumericCode(otpConfig.codeLength);
+		await enforceEmailOtpActiveChallengeLimitWithStore({
+			challengeStore: input.challengeStore,
+			memoryOutbox: input.memoryOutbox,
+			context: {
+				challengeSubjectId,
+				walletId,
+				orgId,
+				otpChannel: EMAIL_OTP_CHANNEL,
+				ownerProofBindingDigest,
+				action,
+				operation,
+				nowMs: issuedAtMs
+			},
+			maxActiveChallenges: otpConfig.maxActiveChallengesPerContext
+		});
+		const challengeRecord = {
+			version: "email_otp_challenge_v1",
+			challengeId,
+			challengeSubjectId,
+			walletId,
+			orgId,
+			otpChannel: EMAIL_OTP_CHANNEL,
+			email: challengeEmail,
+			otpCode,
+			ownerProofBindingDigest,
+			action,
+			operation,
+			createdAtMs: issuedAtMs,
+			expiresAtMs,
+			attemptCount: 0,
+			maxAttempts: otpConfig.maxAttempts
+		};
+		await input.challengeStore.put(challengeRecord);
+		if (!await input.challengeStore.get(challengeId)) return {
+			ok: false,
+			code: "internal",
+			message: "Email OTP challenge could not be persisted"
+		};
+		const delivery = await input.deliverCode({
+			challengeId,
+			walletId,
+			userId: challengeSubjectId,
+			otpChannel: EMAIL_OTP_CHANNEL,
+			action,
+			operation,
+			email: challengeEmail,
+			otpCode,
+			expiresAtMs
+		});
+		if (!delivery.ok) {
+			await input.challengeStore.del(challengeId);
+			input.memoryOutbox.delete(challengeId);
+			return delivery;
+		}
+		return {
+			ok: true,
+			challenge: {
+				challengeId,
+				issuedAtMs,
+				expiresAtMs,
+				challengeSubjectId,
+				walletId,
+				orgId,
+				otpChannel: EMAIL_OTP_CHANNEL,
+				ownerProofBindingDigest,
+				action,
+				operation
+			},
+			delivery: {
+				status: "sent",
+				mode: delivery.deliveryMode,
+				emailHint: delivery.emailHint
+			}
+		};
+	} catch (e) {
+		return {
+			ok: false,
+			code: "internal",
+			message: errorMessage(e) || "Failed to create Email OTP challenge"
+		};
+	}
+}
+//#endregion
+export { createEmailOtpChallengeWithAction, enforceEmailOtpActiveChallengeLimitWithStore, pruneExpiredEmailOtpChallengesWithStore };
+
+//# sourceMappingURL=emailOtpChallenges.js.map

package/dist/esm/core/authService/emailOtpConfig.js

@@ -0,0 +1,231 @@
+import { readAuthServiceConfigValue } from "./configValues.js";
+//#region src/core/authService/emailOtpConfig.ts
+const EMAIL_OTP_CODE_LENGTH = 6;
+function readEmailOtpConfigValue(input, name) {
+	return readAuthServiceConfigValue({
+		thresholdStore: input.thresholdStore,
+		name
+	});
+}
+function parseConfiguredInteger(input) {
+	const normalized = String(input.raw || "").trim();
+	if (!normalized) return input.defaultValue;
+	const n = Number(normalized);
+	if (!Number.isFinite(n)) throw new Error(`${input.name} must be a finite number`);
+	if (n < input.min || n > input.max) throw new Error(`${input.name} must be between ${input.min} and ${input.max}`);
+	return Math.floor(n);
+}
+function parseEmailOtpDeliveryMode(raw) {
+	const deliveryModeRaw = raw.toLowerCase();
+	if (!deliveryModeRaw) return "memory";
+	if (deliveryModeRaw === "email_provider" || deliveryModeRaw === "log" || deliveryModeRaw === "memory") return deliveryModeRaw;
+	throw new Error("EMAIL_OTP_DELIVERY_MODE must be one of email_provider, log, or memory");
+}
+function readBooleanFlag(input, name) {
+	const raw = readEmailOtpConfigValue(input, name);
+	if (raw && ![
+		"1",
+		"true",
+		"yes",
+		"on",
+		"0",
+		"false",
+		"no",
+		"off"
+	].includes(raw.toLowerCase())) throw new Error(`${name} must be a boolean flag when provided`);
+	return raw;
+}
+function isTruthyBooleanFlag(raw) {
+	return [
+		"1",
+		"true",
+		"yes",
+		"on"
+	].includes(raw.toLowerCase());
+}
+function resolveRegistrationPrepareRateLimitPolicy(input) {
+	const defaults = input.production ? {
+		limit: 1,
+		windowMs: 5e3
+	} : {
+		limit: 100,
+		windowMs: 6e4
+	};
+	return {
+		limit: parseConfiguredInteger({
+			name: "REGISTRATION_PREPARE_RATE_LIMIT_MAX",
+			raw: readAuthServiceConfigValue({
+				thresholdStore: input.thresholdStore,
+				name: "REGISTRATION_PREPARE_RATE_LIMIT_MAX"
+			}),
+			defaultValue: defaults.limit,
+			min: 1,
+			max: 1e4
+		}),
+		windowMs: parseConfiguredInteger({
+			name: "REGISTRATION_PREPARE_RATE_LIMIT_WINDOW_MS",
+			raw: readAuthServiceConfigValue({
+				thresholdStore: input.thresholdStore,
+				name: "REGISTRATION_PREPARE_RATE_LIMIT_WINDOW_MS"
+			}),
+			defaultValue: defaults.windowMs,
+			min: 1e3,
+			max: 1440 * 6e4
+		})
+	};
+}
+function resolveEmailOtpRateLimitPolicies(input) {
+	const challengeDefault = input.production ? {
+		limit: 30,
+		windowMs: 6e4
+	} : {
+		limit: 100,
+		windowMs: 6e4
+	};
+	const verifyDefault = input.production ? {
+		limit: 30,
+		windowMs: 6e4
+	} : {
+		limit: 100,
+		windowMs: 6e4
+	};
+	const grantDefault = input.production ? {
+		limit: 30,
+		windowMs: 6e4
+	} : {
+		limit: 100,
+		windowMs: 6e4
+	};
+	const googleRegistrationAttemptDefault = input.production ? {
+		limit: 12,
+		windowMs: 10 * 6e4
+	} : {
+		limit: 200,
+		windowMs: 6e4
+	};
+	return {
+		challenge: {
+			limit: parseConfiguredInteger({
+				name: "EMAIL_OTP_CHALLENGE_RATE_LIMIT_MAX",
+				raw: readEmailOtpConfigValue(input, "EMAIL_OTP_CHALLENGE_RATE_LIMIT_MAX"),
+				defaultValue: challengeDefault.limit,
+				min: 1,
+				max: 500
+			}),
+			windowMs: parseConfiguredInteger({
+				name: "EMAIL_OTP_CHALLENGE_RATE_LIMIT_WINDOW_MS",
+				raw: readEmailOtpConfigValue(input, "EMAIL_OTP_CHALLENGE_RATE_LIMIT_WINDOW_MS"),
+				defaultValue: challengeDefault.windowMs,
+				min: 1e3,
+				max: 1440 * 6e4
+			})
+		},
+		verify: {
+			limit: parseConfiguredInteger({
+				name: "EMAIL_OTP_VERIFY_RATE_LIMIT_MAX",
+				raw: readEmailOtpConfigValue(input, "EMAIL_OTP_VERIFY_RATE_LIMIT_MAX"),
+				defaultValue: verifyDefault.limit,
+				min: 1,
+				max: 1e3
+			}),
+			windowMs: parseConfiguredInteger({
+				name: "EMAIL_OTP_VERIFY_RATE_LIMIT_WINDOW_MS",
+				raw: readEmailOtpConfigValue(input, "EMAIL_OTP_VERIFY_RATE_LIMIT_WINDOW_MS"),
+				defaultValue: verifyDefault.windowMs,
+				min: 1e3,
+				max: 1440 * 6e4
+			})
+		},
+		grant: {
+			limit: parseConfiguredInteger({
+				name: "EMAIL_OTP_GRANT_RATE_LIMIT_MAX",
+				raw: readEmailOtpConfigValue(input, "EMAIL_OTP_GRANT_RATE_LIMIT_MAX"),
+				defaultValue: grantDefault.limit,
+				min: 1,
+				max: 1e3
+			}),
+			windowMs: parseConfiguredInteger({
+				name: "EMAIL_OTP_GRANT_RATE_LIMIT_WINDOW_MS",
+				raw: readEmailOtpConfigValue(input, "EMAIL_OTP_GRANT_RATE_LIMIT_WINDOW_MS"),
+				defaultValue: grantDefault.windowMs,
+				min: 1e3,
+				max: 1440 * 6e4
+			})
+		},
+		googleRegistrationAttempt: {
+			limit: parseConfiguredInteger({
+				name: "EMAIL_OTP_GOOGLE_REGISTRATION_ATTEMPT_RATE_LIMIT_MAX",
+				raw: readEmailOtpConfigValue(input, "EMAIL_OTP_GOOGLE_REGISTRATION_ATTEMPT_RATE_LIMIT_MAX"),
+				defaultValue: googleRegistrationAttemptDefault.limit,
+				min: 1,
+				max: 1e3
+			}),
+			windowMs: parseConfiguredInteger({
+				name: "EMAIL_OTP_GOOGLE_REGISTRATION_ATTEMPT_RATE_LIMIT_WINDOW_MS",
+				raw: readEmailOtpConfigValue(input, "EMAIL_OTP_GOOGLE_REGISTRATION_ATTEMPT_RATE_LIMIT_WINDOW_MS"),
+				defaultValue: googleRegistrationAttemptDefault.windowMs,
+				min: 1e3,
+				max: 1440 * 6e4
+			})
+		}
+	};
+}
+function resolveEmailOtpConfig(input) {
+	const deliveryMode = parseEmailOtpDeliveryMode(readEmailOtpConfigValue(input, "EMAIL_OTP_DELIVERY_MODE"));
+	const devOutboxEnabledRaw = readBooleanFlag(input, "EMAIL_OTP_DEV_OUTBOX_ENABLED");
+	const devOutboxEnabled = deliveryMode === "memory" && !input.production && (devOutboxEnabledRaw ? isTruthyBooleanFlag(devOutboxEnabledRaw) : true);
+	return {
+		deliveryMode,
+		challengeTtlMs: parseConfiguredInteger({
+			name: "EMAIL_OTP_CHALLENGE_TTL_MS",
+			raw: readEmailOtpConfigValue(input, "EMAIL_OTP_CHALLENGE_TTL_MS"),
+			defaultValue: 5 * 6e4,
+			min: 3e4,
+			max: 15 * 6e4
+		}),
+		grantTtlMs: parseConfiguredInteger({
+			name: "EMAIL_OTP_GRANT_TTL_MS",
+			raw: readEmailOtpConfigValue(input, "EMAIL_OTP_GRANT_TTL_MS"),
+			defaultValue: 3e4,
+			min: 1e4,
+			max: 5 * 6e4
+		}),
+		maxAttempts: parseConfiguredInteger({
+			name: "EMAIL_OTP_MAX_ATTEMPTS",
+			raw: readEmailOtpConfigValue(input, "EMAIL_OTP_MAX_ATTEMPTS"),
+			defaultValue: 5,
+			min: 1,
+			max: 10
+		}),
+		lockoutTtlMs: parseConfiguredInteger({
+			name: "EMAIL_OTP_LOCKOUT_TTL_MS",
+			raw: readEmailOtpConfigValue(input, "EMAIL_OTP_LOCKOUT_TTL_MS"),
+			defaultValue: 5 * 6e4,
+			min: 6e4,
+			max: 1440 * 6e4
+		}),
+		codeLength: parseEmailOtpCodeLength(readEmailOtpConfigValue(input, "EMAIL_OTP_CODE_LENGTH")),
+		devOutboxEnabled,
+		maxActiveChallengesPerContext: parseConfiguredInteger({
+			name: "EMAIL_OTP_MAX_ACTIVE_CHALLENGES_PER_CONTEXT",
+			raw: readEmailOtpConfigValue(input, "EMAIL_OTP_MAX_ACTIVE_CHALLENGES_PER_CONTEXT"),
+			defaultValue: 5,
+			min: 1,
+			max: 20
+		})
+	};
+}
+function parseEmailOtpCodeLength(raw) {
+	if (parseConfiguredInteger({
+		name: "EMAIL_OTP_CODE_LENGTH",
+		raw,
+		defaultValue: 6,
+		min: 6,
+		max: 8
+	}) !== 6) throw new Error(`EMAIL_OTP_CODE_LENGTH must be 6`);
+	return 6;
+}
+//#endregion
+export { EMAIL_OTP_CODE_LENGTH, parseConfiguredInteger, resolveEmailOtpConfig, resolveEmailOtpRateLimitPolicies, resolveRegistrationPrepareRateLimitPolicy };
+
+//# sourceMappingURL=emailOtpConfig.js.map

package/dist/esm/core/authService/emailOtpDelivery.js

@@ -0,0 +1,169 @@
+import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
+import "../../shared-ts/src/utils/validation.js";
+//#region src/core/authService/emailOtpDelivery.ts
+function logDevelopmentOtpCode(input) {
+	input.logger.warn("[email-otp] development OTP code", {
+		challengeId: input.challengeId,
+		walletId: input.walletId,
+		userId: input.userId,
+		otpChannel: input.otpChannel,
+		action: input.action,
+		operation: input.operation,
+		deliveryMode: input.deliveryMode,
+		emailHint: input.emailHint,
+		devOtpCode: input.otpCode,
+		expiresAtMs: input.expiresAtMs
+	});
+}
+function storeMemoryOtp(input) {
+	input.memoryOutbox.set(input.challengeId, {
+		walletId: input.walletId,
+		userId: input.userId,
+		otpChannel: input.otpChannel,
+		email: input.email,
+		emailHint: input.emailHint,
+		otpCode: input.otpCode,
+		expiresAtMs: input.expiresAtMs
+	});
+}
+function logDevelopmentOtpDelivery(input) {
+	logDevelopmentOtpCode({
+		logger: input.logger,
+		deliveryMode: input.config.deliveryMode,
+		challengeId: input.challengeId,
+		walletId: input.walletId,
+		userId: input.userId,
+		otpChannel: input.otpChannel,
+		action: input.action,
+		operation: input.operation,
+		emailHint: input.emailHint,
+		otpCode: input.otpCode,
+		expiresAtMs: input.expiresAtMs
+	});
+}
+async function deliverEmailOtpCode(input) {
+	if (input.production && input.config.deliveryMode !== "email_provider") return {
+		ok: false,
+		code: "email_otp_delivery_not_allowed",
+		message: `Email OTP delivery mode ${input.config.deliveryMode} is disabled in production`
+	};
+	const emailHint = input.email;
+	if (input.config.deliveryMode === "email_provider") return {
+		ok: false,
+		code: "not_implemented",
+		message: "Email OTP email_provider delivery is not implemented yet"
+	};
+	if (input.config.deliveryMode === "memory") {
+		storeMemoryOtp({
+			memoryOutbox: input.memoryOutbox,
+			challengeId: input.challengeId,
+			walletId: input.walletId,
+			userId: input.userId,
+			otpChannel: input.otpChannel,
+			email: input.email,
+			emailHint,
+			otpCode: input.otpCode,
+			expiresAtMs: input.expiresAtMs
+		});
+		logDevelopmentOtpDelivery({
+			config: input.config,
+			production: input.production,
+			logger: input.logger,
+			memoryOutbox: input.memoryOutbox,
+			challengeId: input.challengeId,
+			walletId: input.walletId,
+			userId: input.userId,
+			otpChannel: input.otpChannel,
+			action: input.action,
+			operation: input.operation,
+			email: input.email,
+			otpCode: input.otpCode,
+			expiresAtMs: input.expiresAtMs,
+			emailHint
+		});
+		return {
+			ok: true,
+			deliveryMode: "memory",
+			emailHint
+		};
+	}
+	logDevelopmentOtpDelivery({
+		config: input.config,
+		production: input.production,
+		logger: input.logger,
+		memoryOutbox: input.memoryOutbox,
+		challengeId: input.challengeId,
+		walletId: input.walletId,
+		userId: input.userId,
+		otpChannel: input.otpChannel,
+		action: input.action,
+		operation: input.operation,
+		email: input.email,
+		otpCode: input.otpCode,
+		expiresAtMs: input.expiresAtMs,
+		emailHint
+	});
+	return {
+		ok: true,
+		deliveryMode: "log",
+		emailHint
+	};
+}
+function readEmailOtpOutboxEntry(input) {
+	if (!input.config.devOutboxEnabled) return {
+		ok: false,
+		code: "not_found",
+		message: "Email OTP dev outbox is not enabled"
+	};
+	const challengeId = normalizeOptionalTrimmedString(input.request.challengeId);
+	const userId = normalizeOptionalTrimmedString(input.request.userId);
+	const walletId = normalizeOptionalTrimmedString(input.request.walletId);
+	if (!challengeId) return {
+		ok: false,
+		code: "invalid_body",
+		message: "Missing challengeId"
+	};
+	if (!userId) return {
+		ok: false,
+		code: "invalid_body",
+		message: "Missing userId"
+	};
+	if (!walletId) return {
+		ok: false,
+		code: "invalid_body",
+		message: "Missing walletId"
+	};
+	const entry = input.memoryOutbox.get(challengeId);
+	if (!entry) return {
+		ok: false,
+		code: "not_found",
+		message: "Email OTP outbox entry was not found"
+	};
+	if (entry.userId !== userId || entry.walletId !== walletId) return {
+		ok: false,
+		code: "not_found",
+		message: "Email OTP outbox entry was not found"
+	};
+	if (input.nowMs > entry.expiresAtMs) {
+		input.memoryOutbox.delete(challengeId);
+		return {
+			ok: false,
+			code: "not_found",
+			message: "Email OTP outbox entry expired"
+		};
+	}
+	return {
+		ok: true,
+		challengeId,
+		walletId,
+		userId,
+		otpChannel: entry.otpChannel,
+		emailHint: entry.emailHint,
+		otpCode: entry.otpCode,
+		expiresAtMs: entry.expiresAtMs
+	};
+}
+//#endregion
+export { deliverEmailOtpCode, readEmailOtpOutboxEntry };
+
+//# sourceMappingURL=emailOtpDelivery.js.map